From 34f25815c036d2c91bdfddc9c7d40ca2edf677bd Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Wed, 13 Aug 2025 20:15:29 +0400 Subject: [PATCH] docs: fork docs for v1.12 Generated docs go to v1.12 folder now. Signed-off-by: Andrey Smirnov --- Dockerfile | 24 +- Makefile | 11 +- .../v1.11/introduction/support-matrix.md | 2 +- website/content/v1.12/_index.md | 56 + website/content/v1.12/advanced/_index.md | 4 + .../v1.12/advanced/advanced-networking.md | 108 + website/content/v1.12/advanced/air-gapped.md | 164 + .../content/v1.12/advanced/building-images.md | 120 + website/content/v1.12/advanced/ca-rotation.md | 187 + .../v1.12/advanced/cgroups-analysis.md | 285 + .../v1.12/advanced/customizing-the-kernel.md | 95 + .../v1.12/advanced/developing-talos.md | 441 + .../v1.12/advanced/disaster-recovery.md | 148 + .../content/v1.12/advanced/egress-domains.md | 44 + .../v1.12/advanced/etcd-maintenance.md | 226 + .../v1.12/advanced/extension-services.md | 208 + .../v1.12/advanced/install-kubevirt.md | 538 + .../content/v1.12/advanced/kernel-module.md | 314 + .../v1.12/advanced/machine-config-oauth.md | 83 + .../advanced/metal-network-configuration.md | 420 + .../v1.12/advanced/migrating-from-kubeadm.md | 150 + .../content/v1.12/advanced/oci-base-spec.md | 49 + website/content/v1.12/advanced/overlays.md | 113 + website/content/v1.12/advanced/sbom.md | 89 + website/content/v1.12/advanced/selinux.md | 55 + website/content/v1.12/advanced/static-pods.md | 102 + .../advanced/talos-api-access-from-k8s.md | 157 + .../v1.12/advanced/verifying-images.md | 37 + website/content/v1.12/advanced/watchdog.md | 69 + website/content/v1.12/introduction/_index.md | 4 + .../v1.12/introduction/getting-started.md | 231 + .../content/v1.12/introduction/prodnotes.md | 389 + .../content/v1.12/introduction/quickstart.md | 62 + .../v1.12/introduction/support-matrix.md | 58 + .../v1.12/introduction/system-requirements.md | 71 + .../v1.12/introduction/troubleshooting.md | 432 + .../v1.12/introduction/what-is-new/index.md | 9 + .../v1.12/introduction/what-is-talos.md | 28 + .../content/v1.12/kubernetes-guides/_index.md | 5 + .../kubernetes-guides/configuration/_index.md | 5 + .../configuration/ceph-with-rook.md | 285 + .../configuration/deploy-metrics-server.md | 45 + .../configuration/device-plugins.md | 145 + .../configuration/etcd-metrics.md | 57 + .../configuration/inlinemanifests.md | 139 + .../configuration/kubeprism.md | 58 + .../configuration/local-storage.md | 139 + .../configuration/pod-security.md | 288 + .../configuration/seccomp-profiles.md | 118 + .../configuration/storage.md | 163 + .../configuration/synology-csi.md | 259 + .../configuration/usernamespace.md | 30 + .../v1.12/kubernetes-guides/network/_index.md | 5 + .../network/deploying-cilium.md | 437 + .../v1.12/kubernetes-guides/network/multus.md | 200 + .../kubernetes-guides/upgrading-kubernetes.md | 387 + website/content/v1.12/learn-more/_index.md | 4 + .../content/v1.12/learn-more/architecture.md | 55 + .../content/v1.12/learn-more/components.md | 120 + .../content/v1.12/learn-more/control-plane.md | 145 + .../v1.12/learn-more/controllers-resources.md | 230 + website/content/v1.12/learn-more/faqs.md | 72 + .../content/v1.12/learn-more/image-factory.md | 182 + .../v1.12/learn-more/knowledge-base.md | 98 + website/content/v1.12/learn-more/kubespan.md | 207 + .../v1.12/learn-more/networking-resources.md | 434 + .../content/v1.12/learn-more/philosophy.md | 110 + .../v1.12/learn-more/process-capabilities.md | 23 + .../learn-more/talos-network-connectivity.md | 74 + website/content/v1.12/learn-more/talosctl.md | 62 + website/content/v1.12/reference/_index.md | 4 + website/content/v1.12/reference/api.md | 9707 +++++++++++++++++ website/content/v1.12/reference/cli.md | 3011 +++++ .../v1.12/reference/configuration/_index.md | 28 + .../reference/configuration/block/_index.md | 8 + .../block/existingvolumeconfig.md | 94 + .../configuration/block/rawvolumeconfig.md | 257 + .../configuration/block/swapvolumeconfig.md | 254 + .../configuration/block/uservolumeconfig.md | 284 + .../configuration/block/volumeconfig.md | 254 + .../configuration/block/zswapconfig.md | 37 + .../configuration/extensions/_index.md | 8 + .../extensions/extensionserviceconfig.md | 57 + .../configuration/hardware/_index.md | 8 + .../hardware/pcidriverrebindconfig.md | 33 + .../reference/configuration/network/_index.md | 8 + .../configuration/network/ethernetconfig.md | 87 + .../network/kubespanendpointsconfig.md | 33 + .../network/networkdefaultactionconfig.md | 31 + .../network/networkruleconfig.md | 90 + .../reference/configuration/runtime/_index.md | 8 + .../configuration/runtime/eventsinkconfig.md | 33 + .../configuration/runtime/kmsglogconfig.md | 35 + .../runtime/watchdogtimerconfig.md | 35 + .../configuration/security/_index.md | 8 + .../security/trustedrootsconfig.md | 36 + .../configuration/siderolink/_index.md | 8 + .../siderolink/siderolinkconfig.md | 34 + .../configuration/v1alpha1/_index.md | 14 + .../configuration/v1alpha1/config.md | 3609 ++++++ website/content/v1.12/reference/kernel.md | 288 + .../content/v1.12/schemas/config.schema.json | 4319 ++++++++ .../v1.12/schemas/v1alpha1_config.schema.json | 2931 +++++ website/content/v1.12/talos-guides/_index.md | 5 + .../talos-guides/configuration/_index.md | 5 + .../configuration/certificate-authorities.md | 28 + .../talos-guides/configuration/containerd.md | 101 + .../configuration/disk-encryption.md | 238 + .../configuration/disk-management/_index.md | 29 + .../configuration/disk-management/common.md | 131 + .../configuration/disk-management/existing.md | 48 + .../configuration/disk-management/layout.md | 159 + .../configuration/disk-management/raw.md | 73 + .../disk-management/resources.md | 164 + .../configuration/disk-management/system.md | 72 + .../configuration/disk-management/user.md | 101 + .../editing-machine-configuration.md | 164 + .../talos-guides/configuration/image-cache.md | 160 + .../talos-guides/configuration/insecure.md | 105 + .../talos-guides/configuration/logging.md | 435 + .../configuration/nvidia-fabricmanager.md | 37 + .../configuration/nvidia-gpu-proprietary.md | 158 + .../talos-guides/configuration/nvidia-gpu.md | 147 + .../talos-guides/configuration/patching.md | 398 + .../configuration/performance-tuning.md | 75 + .../configuration/pull-through-cache.md | 171 + .../v1.12/talos-guides/configuration/rbac.md | 52 + .../v1.12/talos-guides/configuration/swap.md | 134 + .../configuration/system-extensions.md | 106 + .../talos-guides/configuration/time-sync.md | 97 + .../content/v1.12/talos-guides/discovery.md | 168 + .../v1.12/talos-guides/howto/_index.md | 5 + .../talos-guides/howto/cert-management.md | 75 + .../v1.12/talos-guides/howto/scaling-down.md | 17 + .../v1.12/talos-guides/howto/scaling-up.md | 27 + .../howto/workers-on-controlplane.md | 33 + .../v1.12/talos-guides/install/_index.md | 5 + .../install/bare-metal-platforms/_index.md | 5 + .../bare-metal-platforms/bootloader.md | 57 + .../bare-metal-platforms/equinix-metal.md | 144 + .../install/bare-metal-platforms/iso.md | 21 + .../install/bare-metal-platforms/matchbox.md | 174 + .../bare-metal-platforms/network-config.md | 71 + .../install/bare-metal-platforms/pxe.md | 39 + .../bare-metal-platforms/secureboot.md | 251 + .../v1.12/talos-guides/install/boot-assets.md | 489 + .../install/cloud-platforms/_index.md | 5 + .../install/cloud-platforms/akamai.md | 159 + .../install/cloud-platforms/aws.md | 491 + .../install/cloud-platforms/azure.md | 296 + .../install/cloud-platforms/cloudstack.md | 228 + .../install/cloud-platforms/digitalocean.md | 172 + .../install/cloud-platforms/exoscale.md | 8 + .../install/cloud-platforms/gcp.md | 425 + .../install/cloud-platforms/gcp/config.yaml | 21 + .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 + .../cloud-platforms/gcp/talos-ha.jinja | 282 + .../install/cloud-platforms/hetzner.md | 325 + .../install/cloud-platforms/kubernetes.md | 103 + .../install/cloud-platforms/nocloud.md | 142 + .../install/cloud-platforms/openstack.md | 148 + .../install/cloud-platforms/oracle.md | 261 + .../install/cloud-platforms/scaleway.md | 18 + .../install/cloud-platforms/upcloud.md | 246 + .../install/cloud-platforms/vultr.md | 160 + .../install/local-platforms/_index.md | 5 + .../install/local-platforms/docker.md | 131 + .../install/local-platforms/qemu.md | 345 + .../install/local-platforms/virtualbox.md | 198 + .../v1.12/talos-guides/install/omni.md | 27 + .../install/single-board-computers/_index.md | 5 + .../single-board-computers/bananapi_m64.md | 70 + .../single-board-computers/jetson_nano.md | 130 + .../libretech_all_h3_cc_h5.md | 72 + .../single-board-computers/nanopi_r4s.md | 70 + .../single-board-computers/orangepi_5.md | 109 + .../orangepi_r1_plus_lts.md | 68 + .../install/single-board-computers/pine64.md | 70 + .../single-board-computers/rock4cplus.md | 76 + .../install/single-board-computers/rock5b.md | 72 + .../install/single-board-computers/rock64.md | 70 + .../single-board-computers/rockpi_4.md | 88 + .../single-board-computers/rockpi_4c.md | 86 + .../single-board-computers/rpi_generic.md | 375 + .../single-board-computers/turing_rk1.md | 136 + .../single-board-computers/unofficial.md | 20 + .../v1.12/talos-guides/install/talosctl.md | 39 + .../install/virtualized-platforms/_index.md | 5 + .../install/virtualized-platforms/hyper-v.md | 92 + .../install/virtualized-platforms/kvm.md | 14 + .../virtualized-platforms/opennebula.md | 5 + .../install/virtualized-platforms/proxmox.md | 271 + .../virtualized-platforms/vagrant-libvirt.md | 283 + .../install/virtualized-platforms/vmware.md | 337 + .../vmware/cp.patch.yaml | 8 + .../virtualized-platforms/vmware/vmware.sh | 120 + .../install/virtualized-platforms/xen.md | 12 + .../interactive-dashboard/index.md | 70 + .../interactive-dashboard-1.png | Bin 0 -> 275479 bytes .../interactive-dashboard-2.png | Bin 0 -> 91579 bytes .../interactive-dashboard-3.png | Bin 0 -> 81872 bytes .../v1.12/talos-guides/network/_index.md | 5 + .../talos-guides/network/corporate-proxies.md | 60 + .../talos-guides/network/device-selector.md | 73 + .../talos-guides/network/ethernet-config.md | 106 + .../v1.12/talos-guides/network/host-dns.md | 112 + .../talos-guides/network/ingress-firewall.md | 245 + .../v1.12/talos-guides/network/kubespan.md | 231 + .../network/predictable-interface-names.md | 38 + .../v1.12/talos-guides/network/siderolink.md | 39 + .../content/v1.12/talos-guides/network/vip.md | 109 + .../talos-guides/network/wireguard-network.md | 104 + .../v1.12/talos-guides/resetting-a-machine.md | 44 + .../v1.12/talos-guides/upgrading-talos.md | 157 + website/hugo.toml | 4 + 215 files changed, 49331 insertions(+), 30 deletions(-) create mode 100644 website/content/v1.12/_index.md create mode 100644 website/content/v1.12/advanced/_index.md create mode 100644 website/content/v1.12/advanced/advanced-networking.md create mode 100644 website/content/v1.12/advanced/air-gapped.md create mode 100644 website/content/v1.12/advanced/building-images.md create mode 100644 website/content/v1.12/advanced/ca-rotation.md create mode 100644 website/content/v1.12/advanced/cgroups-analysis.md create mode 100644 website/content/v1.12/advanced/customizing-the-kernel.md create mode 100644 website/content/v1.12/advanced/developing-talos.md create mode 100644 website/content/v1.12/advanced/disaster-recovery.md create mode 100644 website/content/v1.12/advanced/egress-domains.md create mode 100644 website/content/v1.12/advanced/etcd-maintenance.md create mode 100644 website/content/v1.12/advanced/extension-services.md create mode 100644 website/content/v1.12/advanced/install-kubevirt.md create mode 100644 website/content/v1.12/advanced/kernel-module.md create mode 100644 website/content/v1.12/advanced/machine-config-oauth.md create mode 100644 website/content/v1.12/advanced/metal-network-configuration.md create mode 100644 website/content/v1.12/advanced/migrating-from-kubeadm.md create mode 100644 website/content/v1.12/advanced/oci-base-spec.md create mode 100644 website/content/v1.12/advanced/overlays.md create mode 100644 website/content/v1.12/advanced/sbom.md create mode 100644 website/content/v1.12/advanced/selinux.md create mode 100644 website/content/v1.12/advanced/static-pods.md create mode 100644 website/content/v1.12/advanced/talos-api-access-from-k8s.md create mode 100644 website/content/v1.12/advanced/verifying-images.md create mode 100644 website/content/v1.12/advanced/watchdog.md create mode 100644 website/content/v1.12/introduction/_index.md create mode 100644 website/content/v1.12/introduction/getting-started.md create mode 100644 website/content/v1.12/introduction/prodnotes.md create mode 100644 website/content/v1.12/introduction/quickstart.md create mode 100644 website/content/v1.12/introduction/support-matrix.md create mode 100644 website/content/v1.12/introduction/system-requirements.md create mode 100644 website/content/v1.12/introduction/troubleshooting.md create mode 100644 website/content/v1.12/introduction/what-is-new/index.md create mode 100644 website/content/v1.12/introduction/what-is-talos.md create mode 100644 website/content/v1.12/kubernetes-guides/_index.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/_index.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/ceph-with-rook.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/deploy-metrics-server.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/device-plugins.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/etcd-metrics.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/inlinemanifests.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/kubeprism.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/local-storage.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/pod-security.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/seccomp-profiles.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/storage.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/synology-csi.md create mode 100644 website/content/v1.12/kubernetes-guides/configuration/usernamespace.md create mode 100644 website/content/v1.12/kubernetes-guides/network/_index.md create mode 100644 website/content/v1.12/kubernetes-guides/network/deploying-cilium.md create mode 100644 website/content/v1.12/kubernetes-guides/network/multus.md create mode 100644 website/content/v1.12/kubernetes-guides/upgrading-kubernetes.md create mode 100644 website/content/v1.12/learn-more/_index.md create mode 100644 website/content/v1.12/learn-more/architecture.md create mode 100644 website/content/v1.12/learn-more/components.md create mode 100644 website/content/v1.12/learn-more/control-plane.md create mode 100644 website/content/v1.12/learn-more/controllers-resources.md create mode 100644 website/content/v1.12/learn-more/faqs.md create mode 100644 website/content/v1.12/learn-more/image-factory.md create mode 100644 website/content/v1.12/learn-more/knowledge-base.md create mode 100644 website/content/v1.12/learn-more/kubespan.md create mode 100644 website/content/v1.12/learn-more/networking-resources.md create mode 100644 website/content/v1.12/learn-more/philosophy.md create mode 100644 website/content/v1.12/learn-more/process-capabilities.md create mode 100644 website/content/v1.12/learn-more/talos-network-connectivity.md create mode 100644 website/content/v1.12/learn-more/talosctl.md create mode 100644 website/content/v1.12/reference/_index.md create mode 100644 website/content/v1.12/reference/api.md create mode 100644 website/content/v1.12/reference/cli.md create mode 100644 website/content/v1.12/reference/configuration/_index.md create mode 100644 website/content/v1.12/reference/configuration/block/_index.md create mode 100644 website/content/v1.12/reference/configuration/block/existingvolumeconfig.md create mode 100644 website/content/v1.12/reference/configuration/block/rawvolumeconfig.md create mode 100644 website/content/v1.12/reference/configuration/block/swapvolumeconfig.md create mode 100644 website/content/v1.12/reference/configuration/block/uservolumeconfig.md create mode 100644 website/content/v1.12/reference/configuration/block/volumeconfig.md create mode 100644 website/content/v1.12/reference/configuration/block/zswapconfig.md create mode 100644 website/content/v1.12/reference/configuration/extensions/_index.md create mode 100644 website/content/v1.12/reference/configuration/extensions/extensionserviceconfig.md create mode 100644 website/content/v1.12/reference/configuration/hardware/_index.md create mode 100644 website/content/v1.12/reference/configuration/hardware/pcidriverrebindconfig.md create mode 100644 website/content/v1.12/reference/configuration/network/_index.md create mode 100644 website/content/v1.12/reference/configuration/network/ethernetconfig.md create mode 100644 website/content/v1.12/reference/configuration/network/kubespanendpointsconfig.md create mode 100644 website/content/v1.12/reference/configuration/network/networkdefaultactionconfig.md create mode 100644 website/content/v1.12/reference/configuration/network/networkruleconfig.md create mode 100644 website/content/v1.12/reference/configuration/runtime/_index.md create mode 100644 website/content/v1.12/reference/configuration/runtime/eventsinkconfig.md create mode 100644 website/content/v1.12/reference/configuration/runtime/kmsglogconfig.md create mode 100644 website/content/v1.12/reference/configuration/runtime/watchdogtimerconfig.md create mode 100644 website/content/v1.12/reference/configuration/security/_index.md create mode 100644 website/content/v1.12/reference/configuration/security/trustedrootsconfig.md create mode 100644 website/content/v1.12/reference/configuration/siderolink/_index.md create mode 100644 website/content/v1.12/reference/configuration/siderolink/siderolinkconfig.md create mode 100644 website/content/v1.12/reference/configuration/v1alpha1/_index.md create mode 100644 website/content/v1.12/reference/configuration/v1alpha1/config.md create mode 100644 website/content/v1.12/reference/kernel.md create mode 100644 website/content/v1.12/schemas/config.schema.json create mode 100644 website/content/v1.12/schemas/v1alpha1_config.schema.json create mode 100644 website/content/v1.12/talos-guides/_index.md create mode 100644 website/content/v1.12/talos-guides/configuration/_index.md create mode 100644 website/content/v1.12/talos-guides/configuration/certificate-authorities.md create mode 100644 website/content/v1.12/talos-guides/configuration/containerd.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-encryption.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/_index.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/common.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/existing.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/layout.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/raw.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/resources.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/system.md create mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/user.md create mode 100644 website/content/v1.12/talos-guides/configuration/editing-machine-configuration.md create mode 100644 website/content/v1.12/talos-guides/configuration/image-cache.md create mode 100644 website/content/v1.12/talos-guides/configuration/insecure.md create mode 100644 website/content/v1.12/talos-guides/configuration/logging.md create mode 100644 website/content/v1.12/talos-guides/configuration/nvidia-fabricmanager.md create mode 100644 website/content/v1.12/talos-guides/configuration/nvidia-gpu-proprietary.md create mode 100644 website/content/v1.12/talos-guides/configuration/nvidia-gpu.md create mode 100644 website/content/v1.12/talos-guides/configuration/patching.md create mode 100644 website/content/v1.12/talos-guides/configuration/performance-tuning.md create mode 100644 website/content/v1.12/talos-guides/configuration/pull-through-cache.md create mode 100644 website/content/v1.12/talos-guides/configuration/rbac.md create mode 100644 website/content/v1.12/talos-guides/configuration/swap.md create mode 100644 website/content/v1.12/talos-guides/configuration/system-extensions.md create mode 100644 website/content/v1.12/talos-guides/configuration/time-sync.md create mode 100644 website/content/v1.12/talos-guides/discovery.md create mode 100644 website/content/v1.12/talos-guides/howto/_index.md create mode 100644 website/content/v1.12/talos-guides/howto/cert-management.md create mode 100644 website/content/v1.12/talos-guides/howto/scaling-down.md create mode 100644 website/content/v1.12/talos-guides/howto/scaling-up.md create mode 100644 website/content/v1.12/talos-guides/howto/workers-on-controlplane.md create mode 100644 website/content/v1.12/talos-guides/install/_index.md create mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/_index.md create mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/bootloader.md create mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/equinix-metal.md create mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/iso.md create mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/matchbox.md create mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/network-config.md create mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/pxe.md create mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/secureboot.md create mode 100644 website/content/v1.12/talos-guides/install/boot-assets.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/_index.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/akamai.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/aws.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/azure.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/cloudstack.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/digitalocean.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/exoscale.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/gcp.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/gcp/config.yaml create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/hetzner.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/kubernetes.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/nocloud.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/openstack.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/oracle.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/scaleway.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/upcloud.md create mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/vultr.md create mode 100644 website/content/v1.12/talos-guides/install/local-platforms/_index.md create mode 100644 website/content/v1.12/talos-guides/install/local-platforms/docker.md create mode 100644 website/content/v1.12/talos-guides/install/local-platforms/qemu.md create mode 100644 website/content/v1.12/talos-guides/install/local-platforms/virtualbox.md create mode 100644 website/content/v1.12/talos-guides/install/omni.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/_index.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/bananapi_m64.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/jetson_nano.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/nanopi_r4s.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/orangepi_5.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/orangepi_r1_plus_lts.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/pine64.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rock4cplus.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rock5b.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rock64.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rockpi_4.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rockpi_4c.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rpi_generic.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/turing_rk1.md create mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/unofficial.md create mode 100644 website/content/v1.12/talos-guides/install/talosctl.md create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/_index.md create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/hyper-v.md create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/kvm.md create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/opennebula.md create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/proxmox.md create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/vagrant-libvirt.md create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/vmware.md create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/vmware/vmware.sh create mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/xen.md create mode 100644 website/content/v1.12/talos-guides/interactive-dashboard/index.md create mode 100644 website/content/v1.12/talos-guides/interactive-dashboard/interactive-dashboard-1.png create mode 100644 website/content/v1.12/talos-guides/interactive-dashboard/interactive-dashboard-2.png create mode 100644 website/content/v1.12/talos-guides/interactive-dashboard/interactive-dashboard-3.png create mode 100644 website/content/v1.12/talos-guides/network/_index.md create mode 100644 website/content/v1.12/talos-guides/network/corporate-proxies.md create mode 100644 website/content/v1.12/talos-guides/network/device-selector.md create mode 100644 website/content/v1.12/talos-guides/network/ethernet-config.md create mode 100644 website/content/v1.12/talos-guides/network/host-dns.md create mode 100644 website/content/v1.12/talos-guides/network/ingress-firewall.md create mode 100644 website/content/v1.12/talos-guides/network/kubespan.md create mode 100644 website/content/v1.12/talos-guides/network/predictable-interface-names.md create mode 100644 website/content/v1.12/talos-guides/network/siderolink.md create mode 100644 website/content/v1.12/talos-guides/network/vip.md create mode 100644 website/content/v1.12/talos-guides/network/wireguard-network.md create mode 100644 website/content/v1.12/talos-guides/resetting-a-machine.md create mode 100644 website/content/v1.12/talos-guides/upgrading-talos.md diff --git a/Dockerfile b/Dockerfile index 2d05d4b61..65e887e22 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1318,11 +1318,8 @@ RUN --mount=type=cache,target=/.cache,id=talos/.cache prototool break check --de FROM oven/bun:1-alpine AS lint-markdown ARG MARKDOWNLINTCLI_VERSION -ARG TEXTLINT_VERSION -ARG TEXTLINT_FILTER_RULE_COMMENTS_VERSION -ARG TEXTLINT_RULE_ONE_SENTENCE_PER_LINE_VERSION RUN apk add --no-cache findutils -RUN bun i -g markdownlint-cli@${MARKDOWNLINTCLI_VERSION} textlint@${TEXTLINT_VERSION} textlint-filter-rule-comments@${TEXTLINT_FILTER_RULE_COMMENTS_VERSION} textlint-rule-one-sentence-per-line@${TEXTLINT_RULE_ONE_SENTENCE_PER_LINE_VERSION} +RUN bun i -g markdownlint-cli@${MARKDOWNLINTCLI_VERSION} WORKDIR /src COPY . . RUN bun run --bun markdownlint \ @@ -1335,17 +1332,6 @@ RUN bun run --bun markdownlint \ --ignore 'website/themes/**' \ --disable MD045 MD056 -- \ . -RUN find . \ - -name '*.md' \ - -not -path './LICENCE.md' \ - -not -path './CHANGELOG.md' \ - -not -path './CODE_OF_CONDUCT.md' \ - -not -path '*/node_modules/*' \ - -not -path './hack/chglog/**' \ - -not -path './website/content/*/reference/*' \ - -not -path './website/themes/**' \ - -print0 \ - | xargs -0 bun run --bun textlint # The docs target generates documentation. @@ -1383,10 +1369,10 @@ RUN protoc \ /protos/time/*.proto FROM scratch AS docs -COPY --from=docs-build /tmp/configuration/ /website/content/v1.11/reference/configuration/ -COPY --from=docs-build /tmp/cli.md /website/content/v1.11/reference/ -COPY --from=docs-build /tmp/schemas /website/content/v1.11/schemas/ -COPY --from=proto-docs-build /tmp/api.md /website/content/v1.11/reference/ +COPY --from=docs-build /tmp/configuration/ /website/content/v1.12/reference/configuration/ +COPY --from=docs-build /tmp/cli.md /website/content/v1.12/reference/ +COPY --from=docs-build /tmp/schemas /website/content/v1.12/schemas/ +COPY --from=proto-docs-build /tmp/api.md /website/content/v1.12/reference/ # The talosctl-cni-bundle builds the CNI bundle for talosctl. diff --git a/Makefile b/Makefile index 1b1c973f4..e831def11 100644 --- a/Makefile +++ b/Makefile @@ -112,12 +112,6 @@ PROTOTOOL_VERSION ?= v1.10.0 PROTOC_GEN_DOC_VERSION ?= v1.5.1 # renovate: datasource=npm depName=markdownlint-cli MARKDOWNLINTCLI_VERSION ?= 0.45.0 -# renovate: datasource=npm depName=textlint -TEXTLINT_VERSION ?= 15.2.0 -# renovate: datasource=npm depName=textlint-filter-rule-comments -TEXTLINT_FILTER_RULE_COMMENTS_VERSION ?= 1.2.2 -# renovate: datasource=npm depName=textlint-rule-one-sentence-per-line -TEXTLINT_RULE_ONE_SENTENCE_PER_LINE_VERSION ?= 2.0.0 # renovate: datasource=docker versioning=docker depName=hugomods/hugo HUGO_VERSION ?= dart-sass-0.145.0 OPERATING_SYSTEM := $(shell uname -s | tr "[:upper:]" "[:lower:]") @@ -283,9 +277,6 @@ COMMON_ARGS += --build-arg=SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) COMMON_ARGS += --build-arg=STRINGER_VERSION=$(STRINGER_VERSION) COMMON_ARGS += --build-arg=TAG=$(TAG) COMMON_ARGS += --build-arg=TESTPKGS=$(TESTPKGS) -COMMON_ARGS += --build-arg=TEXTLINT_FILTER_RULE_COMMENTS_VERSION=$(TEXTLINT_FILTER_RULE_COMMENTS_VERSION) -COMMON_ARGS += --build-arg=TEXTLINT_RULE_ONE_SENTENCE_PER_LINE_VERSION=$(TEXTLINT_RULE_ONE_SENTENCE_PER_LINE_VERSION) -COMMON_ARGS += --build-arg=TEXTLINT_VERSION=$(TEXTLINT_VERSION) COMMON_ARGS += --build-arg=TOOLS_PREFIX=$(TOOLS_PREFIX) COMMON_ARGS += --build-arg=TOOLS=$(TOOLS) COMMON_ARGS += --build-arg=GENERATE_VEX_PREFIX=$(GENERATE_VEX_PREFIX) @@ -561,7 +552,7 @@ lint-%: ## Runs the specified linter. Valid options are go, protobuf, and markdo @$(MAKE) target-lint-$* PLATFORM=linux/$(ARCH) lint: ## Runs linters on go, vulncheck, deadcode, protobuf, and markdown file types. - @$(MAKE) lint-go lint-vulncheck lint-deadcode lint-protobuf lint-markdown + @$(MAKE) lint-go lint-deadcode lint-protobuf lint-markdown check-dirty: ## Verifies that source tree is not dirty @if test -n "`git status --porcelain`"; then echo "Source tree is dirty"; git status; git diff; exit 1 ; fi diff --git a/website/content/v1.11/introduction/support-matrix.md b/website/content/v1.11/introduction/support-matrix.md index 5915f3315..4f6c5fb3e 100644 --- a/website/content/v1.11/introduction/support-matrix.md +++ b/website/content/v1.11/introduction/support-matrix.md @@ -19,7 +19,7 @@ description: "Table of supported Talos Linux versions and respective platforms." | - SBCs | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Nano Pi R4S, Pine64, Pine64 Rock64, Radxa ROCK Pi 4C, Radxa ROCK 4C+, Radxa ROCK 5B, Raspberry Pi 4B, Raspberry Pi Compute Module 4, Turing RK1, Orange Pi 5 | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Nano Pi R4S, Pine64, Pine64 Rock64, Radxa ROCK Pi 4C, Radxa ROCK 4C+, Radxa ROCK 5B, Raspberry Pi 4B, Raspberry Pi Compute Module 4, Turing RK1, Orange Pi 5 | | - local | Docker, QEMU | Docker, QEMU | | **Omni** | | | -| [Omni](https://github.com/siderolabs/omni) | >= 0.50.0 | >= 0.49.0 | +| [Omni](https://github.com/siderolabs/omni) | >= 1.1.0 | >= 0.49.0 | | **Cluster API** | | | | [CAPI Bootstrap Provider Talos](https://github.com/siderolabs/cluster-api-bootstrap-provider-talos) | >= 0.6.8 | >= 0.6.8 | | [CAPI Control Plane Provider Talos](https://github.com/siderolabs/cluster-api-control-plane-provider-talos) | >= 0.5.9 | >= 0.5.9 | diff --git a/website/content/v1.12/_index.md b/website/content/v1.12/_index.md new file mode 100644 index 000000000..76f9a5395 --- /dev/null +++ b/website/content/v1.12/_index.md @@ -0,0 +1,56 @@ +--- +title: Welcome +no_list: true +linkTitle: "Documentation" +images: ["images/talos-dev-banner.png"] +cascade: + type: docs +lastRelease: v1.12.0-alpha0 +kubernetesRelease: "1.35.0-alpha.0" +prevKubernetesRelease: "1.34.0" +nvidiaContainerToolkitRelease: "v1.17.8" +nvidiaDriverRelease: "535.247.01" +preRelease: true +--- + +## Welcome + +Welcome to the Talos documentation. +If you are just getting familiar with Talos, we recommend starting here: + +- [What is Talos]({{< relref "introduction/what-is-talos" >}}): a quick description of Talos +- [Quickstart]({{< relref "introduction/quickstart" >}}): the fastest way to get a Talos cluster up and running +- [Getting Started]({{< relref "introduction/getting-started" >}}): a long-form, guided tour of getting a full Talos cluster deployed + +## Open Source + +### Community + +- GitHub: [repo](https://github.com/siderolabs/talos) +- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/siderolabs/talos/discussions) +- Community Slack: Join our [slack channel](https://slack.dev.talos-systems.io) +- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) +- Twitter: [@SideroLabs](https://twitter.com/talossystems) +- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) + +If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! +We hold a weekly meeting that all audiences are welcome to attend. + +We would appreciate your feedback so that we can make Talos even better! +To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). + +### Office Hours + +- When: Second Monday of every month at 16:30 UTC. +- Where: [Google Meet](https://meet.google.com/ivb-kjfm-jfc). + +You can subscribe to this meeting by joining the community forum above. + +> Note: You can convert the meeting hours to your [local time](https://everytimezone.com/s/599e61d6). + +## Enterprise + +If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. +Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. + +[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v1.12/advanced/_index.md b/website/content/v1.12/advanced/_index.md new file mode 100644 index 000000000..3b85c2391 --- /dev/null +++ b/website/content/v1.12/advanced/_index.md @@ -0,0 +1,4 @@ +--- +title: "Advanced Guides" +weight: 60 +--- diff --git a/website/content/v1.12/advanced/advanced-networking.md b/website/content/v1.12/advanced/advanced-networking.md new file mode 100644 index 000000000..c45d39100 --- /dev/null +++ b/website/content/v1.12/advanced/advanced-networking.md @@ -0,0 +1,108 @@ +--- +title: "Advanced Networking" +description: "How to configure advanced networking options on Talos Linux." +aliases: + - ../guides/advanced-networking +--- + +## Static Addressing + +Static addressing is comprised of specifying `addresses`, `routes` ( remember to add your default gateway ), and `interface`. +Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. + +```yaml +machine: + network: + hostname: talos + nameservers: + - 10.0.0.1 + interfaces: + - interface: eth0 + addresses: + - 10.0.0.201/8 + mtu: 8765 + routes: + - network: 0.0.0.0/0 + gateway: 10.0.0.1 + - interface: eth1 + ignore: true + time: + servers: + - time.cloudflare.com +``` + +## Additional Addresses for an Interface + +In some environments you may need to set additional addresses on an interface. +In the following example, we set two additional addresses on the loopback interface. + +```yaml +machine: + network: + interfaces: + - interface: lo + addresses: + - 192.168.0.21/24 + - 10.2.2.2/24 +``` + +## Bonding + +The following example shows how to create a bonded interface. + +```yaml +machine: + network: + interfaces: + - interface: bond0 + dhcp: true + bond: + mode: 802.3ad + lacpRate: fast + xmitHashPolicy: layer3+4 + miimon: 100 + updelay: 200 + downdelay: 200 + interfaces: + - eth0 + - eth1 +``` + +## Setting Up a Bridge + +The following example shows how to set up a bridge between two interfaces with an assigned static address. + +```yaml +machine: + network: + interfaces: + - interface: br0 + addresses: + - 192.168.0.42/24 + bridge: + stp: + enabled: true + interfaces: + - eth0 + - eth1 +``` + +## VLANs + +To setup vlans on a specific device use an array of VLANs to add. +The master device may be configured without addressing by setting dhcp to false. + +```yaml +machine: + network: + interfaces: + - interface: eth0 + dhcp: false + vlans: + - vlanId: 100 + addresses: + - "192.168.2.10/28" + routes: + - network: 0.0.0.0/0 + gateway: 192.168.2.1 +``` diff --git a/website/content/v1.12/advanced/air-gapped.md b/website/content/v1.12/advanced/air-gapped.md new file mode 100644 index 000000000..3b686a87d --- /dev/null +++ b/website/content/v1.12/advanced/air-gapped.md @@ -0,0 +1,164 @@ +--- +title: "Air-gapped Environments" +description: "Setting up Talos Linux to work in environments with no internet access." +aliases: + - ../guides/air-gapped +--- + +In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. +We will use the [QEMU]({{< relref "../talos-guides/install/local-platforms/qemu" >}}) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. + +## Requirements + +The follow are requirements for this guide: + +- Docker 18.03 or greater +- Requirements for the Talos [QEMU]({{< relref "../talos-guides/install/local-platforms/qemu" >}}) cluster + +## Identifying Images + +In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) +We need to identify the images required to install and run Talos. +The same strategy can be used for images required by custom workloads running on the cluster. + +The `talosctl image default` command provides a list of default images used by the Talos cluster (with default configuration +settings). +To print the list of images, run: + +```bash +talosctl image default +``` + +This list contains images required by a default deployment of Talos. +There might be additional images required for the workloads running on this cluster, and those should be added to this list. + +## Preparing the Internal Registry + +As access to the public registries is restricted, we have to run an internal Docker registry. +In this guide, we will launch the registry on the same machine using Docker: + +```bash +$ docker run -d -p 6000:5000 --restart always --name registry-airgapped registry:2 +1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 +``` + +This registry will be accepting connections on port 6000 on the host IPs. +The registry is empty by default, so we have fill it with the images required by Talos. + +First, we pull all the images to our local Docker daemon: + +```bash +$ for image in `talosctl image default`; do docker pull $image; done +v0.15.1: Pulling from coreos/flannel +Digest: sha256:9a296fbb67790659adc3701e287adde3c59803b7fcefe354f1fc482840cdb3d9 +... +``` + +All images are now stored in the Docker daemon store: + +```bash +$ docker images +REPOSITORY TAG IMAGE ID CREATED SIZE +gcr.io/etcd-development/etcd v3.5.3 604d4f022632 6 days ago 181MB +ghcr.io/siderolabs/install-cni v1.0.0-2-gc5d3ab0 4729e54f794d 6 days ago 76MB +... +``` + +Now we need to re-tag them so that we can push them to our local registry. +We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: + +```bash +$ for image in `talosctl image default`; do \ + docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \ + done +``` + +As the next step, we push images to the internal registry: + +```bash +$ for image in `talosctl image default`; do \ + docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \ + done +``` + +We can now verify that the images are pushed to the registry: + +```bash +$ curl http://127.0.0.1:6000/v2/_catalog +{"repositories":["coredns/coredns","coreos/flannel","etcd-development/etcd","kube-apiserver","kube-controller-manager","kube-proxy","kube-scheduler","pause","siderolabs/install-cni","siderolabs/installer","siderolabs/kubelet"]} +``` + +> Note: images in the registry don't have the registry endpoint prefix anymore. + +## Launching Talos in an Air-gapped Environment + +For Talos to use the internal registry, we use the registry mirror feature to redirect all image pull requests to the internal registry. +This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. + +We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. +As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. + +Identify all registry prefixes from `talosctl image default`, for example: + +- `docker.io` +- `gcr.io` +- `ghcr.io` +- `registry.k8s.io` + +The `talosctl cluster create` command provides conveniences for common configuration options. +The only required flag for this guide is `--registry-mirror =http://10.5.0.1:6000` which redirects every pull request to the internal registry, this flag +needs to be repeated for each of the identified registry prefixes above. +The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). + +```bash +$ sudo --preserve-env=HOME talosctl cluster create --provisioner=qemu --install-image=ghcr.io/siderolabs/installer:{{< release >}} \ + --registry-mirror docker.io=http://10.5.0.1:6000 \ + --registry-mirror gcr.io=http://10.5.0.1:6000 \ + --registry-mirror ghcr.io=http://10.5.0.1:6000 \ + --registry-mirror registry.k8s.io=http://10.5.0.1:6000 \ +validating CIDR and reserving IPs +generating PKI and tokens +creating state directory in "/home/user/.talos/clusters/talos-default" +creating network talos-default +creating load balancer +creating dhcpd +creating master nodes +creating worker nodes +waiting for API +... +``` + +> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. + +You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. + +## Closing Notes + +Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. + +When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: + +```bash +machine: + ... + registries: + mirrors: + docker.io: + endpoints: + - http://10.5.0.1:6000/ + gcr.io: + endpoints: + - http://10.5.0.1:6000/ + ghcr.io: + endpoints: + - http://10.5.0.1:6000/ + registry.k8s.io: + endpoints: + - http://10.5.0.1:6000/ +... +``` + +Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. +If required, auth can be configured for the internal registry (and custom TLS certificates if needed). + +Please see [pull-through cache guide]({{< relref "../talos-guides/configuration/pull-through-cache" >}}) for an example using Harbor container registry with Talos. diff --git a/website/content/v1.12/advanced/building-images.md b/website/content/v1.12/advanced/building-images.md new file mode 100644 index 000000000..cff3bb84d --- /dev/null +++ b/website/content/v1.12/advanced/building-images.md @@ -0,0 +1,120 @@ +--- +title: "Building Custom Talos Images" +description: "How to build a custom Talos image from source." +--- + +There might be several reasons to build Talos images from source: + +* verifying the [image integrity]({{< relref "verifying-images" >}}) +* building an image with custom configuration + +## Checkout Talos Source + +```bash +git clone https://github.com/siderolabs/talos.git +``` + +If building for a specific release, checkout the corresponding tag: + +```bash +git checkout {{< release >}} +``` + +## Set up the Build Environment + +See [Developing Talos]({{< relref "developing-talos" >}}) for details on setting up the buildkit builder. + +## Architectures + +By default, Talos builds for `linux/amd64`, but you can customize that by passing `PLATFORM` variable to `make`: + +```bash +make PLATFORM=linux/arm64 # build for arm64 only +make PLATFORM=linux/arm64,linux/amd64 # build for arm64 and amd64, container images will be multi-arch +``` + +## Custom `PKGS` + +When [customizing Linux kernel]({{< relref "customizing-the-kernel" >}}), the source for the [`siderolabs/pkgs`](https://github.com/siderolabs/pkgs) repository can +be overridden with: + +* if you built and pushed only a custom `kernel` package, the reference can be overridden with `PKG_KERNEL` variable: `make PKG_KERNEL=//kernel:` +* if any other single package was customized, the reference can be overridden with `PKG_` (e.g. `PKG_IPTABLES`) variable: `make PKG_=//:` +* if the full `pkgs` repository was built and pushed, the references can be overridden with `PKGS_PREFIX` and `PKGS` variables: `make PKGS_PREFIX=/ PKGS=` + +## Customizations + +Some of the build parameters can be customized by passing environment variables to `make`, e.g. `GOAMD64=v1` can be used to build +Talos images compatible with old AMD64 CPUs: + +```bash +make GOAMD64=v1 +``` + +## Building Kernel and Initramfs + +The most basic boot assets can be built with: + +```bash +make kernel initramfs +``` + +Build result will be stored as `_out/vmlinuz-` and `_out/initramfs-.xz`. + +## Building Container Images + +Talos container images should be pushed to the registry as the result of the build process. + +The default settings are: + +* `IMAGE_REGISTRY` is set to `ghcr.io` +* `USERNAME` is set to the `siderolabs` (or value of environment variable `USERNAME` if it is set) + +The image can be pushed to any registry you have access to, but the access credentials should be stored in `~/.docker/config.json` file (e.g. with `docker login`). + +Building and pushing the image can be done with: + +```bash +make installer-base PUSH=true IMAGE_REGISTRY=docker.io USERNAME= # ghcr.io/siderolabs/installer-base +make imager PUSH=true IMAGE_REGISTRY=docker.io USERNAME= # ghcr.io/siderolabs/imager +make installer IMAGE_REGISTRY=docker.io USERNAME= # ghcr.io/siderolabs/installer +``` + +The [local registry]({{< relref "developing-talos" >}}) running on `127.0.0.1:5005` can be used as well to avoid pushing/pulling over the network: + +```bash +make installer REGISTRY=127.0.0.1:5005 +``` + +When building `imager` container, by default Talos will include the boot assets for both `amd64` and `arm64` architectures, if building only for single architecture, specify `INSTALLER_ARCH` variable: + +```bash +make imager INSTALLER_ARCH=targetarch PLATFORM=linux/amd64 +``` + +## Building ISO + +The [ISO image]({{< relref "../talos-guides/install/boot-assets" >}}) is built with the help of `imager` container image, by default `ghcr.io/siderolabs/imager` will be used with the matching tag: + +```bash +make iso +``` + +The ISO image will be stored as `_out/talos-.iso`. + +If ISO image should be built with the custom `imager` image, it can be specified with `IMAGE_REGISTRY`/`USERNAME` variables: + +```bash +make iso IMAGE_REGISTRY=docker.io USERNAME= +``` + +## Building Disk Images + +The disk image is built with the help of `imager` container image, by default `ghcr.io/siderolabs/imager` will be used with the matching tag: + +```bash +make image-metal +``` + +Available disk images are encoded in the `image-%` target, e.g. `make image-aws`. +Same as with ISO image, the custom `imager` image can be specified with `IMAGE_REGISTRY`/`USERNAME` variables. diff --git a/website/content/v1.12/advanced/ca-rotation.md b/website/content/v1.12/advanced/ca-rotation.md new file mode 100644 index 000000000..e10e9e701 --- /dev/null +++ b/website/content/v1.12/advanced/ca-rotation.md @@ -0,0 +1,187 @@ +--- +title: "CA Rotation" +description: "How to rotate Talos and Kubernetes API root certificate authorities." +--- + +In general, you almost never need to rotate the root CA certificate and key for the Talos API and Kubernetes API. +Talos sets up root certificate authorities with the lifetime of 10 years, and all Talos and Kubernetes API certificates are issued by these root CAs. +So the rotation of the root CA is only needed if: + +- you suspect that the private key has been compromised; +- you want to revoke access to the cluster for a leaked `talosconfig` or `kubeconfig`; +- once in 10 years. + +## Overview + +There are some details which make Talos and Kubernetes API root CA rotation a bit different, but the general flow is the same: + +- generate new CA certificate and key; +- add new CA certificate as 'accepted', so new certificates will be accepted as valid; +- swap issuing CA to the new one, old CA as accepted; +- refresh all certificates in the cluster; +- remove old CA from 'accepted'. + +At the end of the flow, old CA is completely removed from the cluster, so all certificates issued by it will be considered invalid. + +Both rotation flows are described in detail below. + +## Talos API + +### Automated Talos API CA Rotation + +Talos API CA rotation doesn't interrupt connections within the cluster, and it doesn't require a reboot of the nodes. + +Run the following command in dry-run mode to see the steps which will be taken: + +```shell +$ talosctl -n rotate-ca --dry-run=true --talos=true --kubernetes=false +> Starting Talos API PKI rotation, dry-run mode true... +> Using config context: "talos-default" +> Using Talos API endpoints: ["172.20.0.2"] +> Cluster topology: + - control plane nodes: ["172.20.0.2"] + - worker nodes: ["172.20.0.3"] +> Current Talos CA: +... +``` + +No changes will be done to the cluster in dry-run mode, so you can safely run it to see the steps. + +Before proceeding, make sure that you can capture the output of `talosctl` command, as it will contain the new CA certificate and key. +Record a list of Talos API users to make sure they can all be updated with new `talosconfig`. + +Run the following command to rotate the Talos API CA: + +```shell +$ talosctl -n rotate-ca --dry-run=false --talos=true --kubernetes=false +> Starting Talos API PKI rotation, dry-run mode false... +> Using config context: "talos-default-268" +> Using Talos API endpoints: ["172.20.0.2"] +> Cluster topology: + - control plane nodes: ["172.20.0.2"] + - worker nodes: ["172.20.0.3"] +> Current Talos CA: +... +> New Talos CA: +... +> Generating new talosconfig: +context: talos-default +contexts: + talos-default: + .... +> Verifying connectivity with existing PKI: + - 172.20.0.2: OK (version {{< release >}}) + - 172.20.0.3: OK (version {{< release >}}) +> Adding new Talos CA as accepted... + - 172.20.0.2: OK + - 172.20.0.3: OK +> Verifying connectivity with new client cert, but old server CA: +2024/04/17 21:26:07 retrying error: rpc error: code = Unavailable desc = connection error: desc = "error reading server preface: remote error: tls: unknown certificate authority" + - 172.20.0.2: OK (version {{< release >}}) + - 172.20.0.3: OK (version {{< release >}}) +> Making new Talos CA the issuing CA, old Talos CA the accepted CA... + - 172.20.0.2: OK + - 172.20.0.3: OK +> Verifying connectivity with new PKI: +2024/04/17 21:26:08 retrying error: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of \"x509: Ed25519 verification failure\" while trying to verify candidate authority certificate \"talos\")" + - 172.20.0.2: OK (version {{< release >}}) + - 172.20.0.3: OK (version {{< release >}}) +> Removing old Talos CA from the accepted CAs... + - 172.20.0.2: OK + - 172.20.0.3: OK +> Verifying connectivity with new PKI: + - 172.20.0.2: OK (version {{< release >}}) + - 172.20.0.3: OK (version {{< release >}}) +> Writing new talosconfig to "talosconfig" +``` + +Once the rotation is done, stash the new Talos CA, update `secrets.yaml` (if using that for machine configuration generation) with new CA key and certificate. + +The new client `talosconfig` is written to the current directory as `talosconfig`. +You can merge it to the default location with `talosctl config merge ./talosconfig`. + +If other client access `talosconfig` files needs to be generated, use `talosctl config new` with new `talosconfig`. + +> Note: if using [Talos API access from Kubernetes]({{< relref "./talos-api-access-from-k8s" >}}) feature, pods might need to be restarted manually to pick up new `talosconfig`. + +### Manual Steps for Talos API CA Rotation + +1. Generate new Talos CA (e.g. use `talosctl gen secrets` and use Talos CA). +2. Patch machine configuration on all nodes updating `.machine.acceptedCAs` with new CA certificate. +3. Generate `talosconfig` with client certificate generated with new CA, but still using old CA as server CA, verify connectivity, Talos should accept new client certificate. +4. Patch machine configuration on all nodes updating `.machine.ca` with new CA certificate and key, and keeping old CA certificate in `.machine.acceptedCAs` (on worker nodes `.machine.ca` doesn't have the key). +5. Generate `talosconfig` with both client certificate and server CA using new CA PKI, verify connectivity. +6. Remove old CA certificate from `.machine.acceptedCAs` on all nodes. +7. Verify connectivity. + +## Kubernetes API + +### Automated Kubernetes API CA Rotation + +The automated process only rotates Kubernetes API CA, used by the `kube-apiserver`, `kubelet`, etc. +Other Kubernetes secrets might need to be rotated manually as required. +Kubernetes pods might need to be restarted to handle changes, and communication within the cluster might be disrupted during the rotation process. + +Run the following command in dry-run mode to see the steps which will be taken: + +```shell +$ talosctl -n rotate-ca --dry-run=true --talos=false --kubernetes=true +> Starting Kubernetes API PKI rotation, dry-run mode true... +> Cluster topology: + - control plane nodes: ["172.20.0.2"] + - worker nodes: ["172.20.0.3"] +> Building current Kubernetes client... +> Current Kubernetes CA: +... +``` + +Before proceeding, make sure that you can capture the output of `talosctl` command, as it will contain the new CA certificate and key. +As Talos API access will not be disrupted, the changes can be reverted back if needed by reverting machine configuration. + +Run the following command to rotate the Kubernetes API CA: + +```shell +$ talosctl -n rotate-ca --dry-run=false --talos=false --kubernetes=true +> Starting Kubernetes API PKI rotation, dry-run mode false... +> Cluster topology: + - control plane nodes: ["172.20.0.2"] + - worker nodes: ["172.20.0.3"] +> Building current Kubernetes client... +> Current Kubernetes CA: +... +> New Kubernetes CA: +... +> Verifying connectivity with existing PKI... + - OK (2 nodes ready) +> Adding new Kubernetes CA as accepted... + - 172.20.0.2: OK + - 172.20.0.3: OK +> Making new Kubernetes CA the issuing CA, old Kubernetes CA the accepted CA... + - 172.20.0.2: OK + - 172.20.0.3: OK +> Building new Kubernetes client... +> Verifying connectivity with new PKI... +2024/04/17 21:45:52 retrying error: Get "https://172.20.0.1:6443/api/v1/nodes": EOF + - OK (2 nodes ready) +> Removing old Kubernetes CA from the accepted CAs... + - 172.20.0.2: OK + - 172.20.0.3: OK +> Verifying connectivity with new PKI... + - OK (2 nodes ready) +> Kubernetes CA rotation done, new 'kubeconfig' can be fetched with `talosctl kubeconfig`. +``` + +At the end of the process, Kubernetes control plane components will be restarted to pick up CA certificate changes. +Each node `kubelet` will re-join the cluster with new client certficiate. + +New `kubeconfig` can be fetched with `talosctl kubeconfig` command from the cluster. + +Kubernetes pods might need to be restarted manually to pick up changes to the Kubernetes API CA. + +### Manual Steps for Kubernetes API CA Rotation + +Steps are similar [to the Talos API CA rotation](#manual-steps-for-talos-api-ca-rotation), but use: + +- `.cluster.acceptedCAs` in place of `.machine.acceptedCAs`; +- `.cluster.ca` in place of `.machine.ca`; +- `kubeconfig` in place of `talosconfig`. diff --git a/website/content/v1.12/advanced/cgroups-analysis.md b/website/content/v1.12/advanced/cgroups-analysis.md new file mode 100644 index 000000000..4422c5dd1 --- /dev/null +++ b/website/content/v1.12/advanced/cgroups-analysis.md @@ -0,0 +1,285 @@ +--- +title: "Cgroups Resource Analysis" +description: "How to use `talosctl cgroups` to monitor resource usage on the node." +--- + +Talos provides a way to monitor resource usage of the [control groups](https://docs.kernel.org/admin-guide/cgroup-v2.html) on the machine. +This feature is useful to understand how much resources are being used by the containers and processes running on the machine. + +Talos creates several system cgroups: + +* `init` (contains `machined` PID 1) +* `system` (contains system services, and extension services) +* `podruntime` (contains CRI containerd, kubelet, etcd) + +Kubelet creates a tree of cgroups for each pod, and each container in the pod, starting with `kubepods` as the root group. + +Talos Linux might set some default limits for the cgroups, and these are not configurable at the moment. +Kubelet is configured by default to reserve some amount of RAM and CPU for system processes to prevent the system from becoming unresponsive under extreme resource pressure. + +> Note: this feature is only available in `cgroupsv2` mode which is Talos default. + +The `talosctl cgroups` command provides a way to monitor the resource usage of the cgroups on the machine, it has a set of presets which are described below. + +## Presets + +### `cpu` + +```text +$ talosctl cgroups --preset=cpu +NAME CpuWeight CpuNice CpuMax CpuUser User/% CpuSystem System/% Throttled +. unset unset [] 7m42.43755s - 8m51.855608s - 0s +├──init 79 1 [ max 100000] 35.061148s 7.58% 41.027589s 7.71% 0s +├──kubepods 77 1 [ max 100000] 3m29.902395s 45.39% 4m41.033592s 52.84% 0s +│ ├──besteffort 1 19 [ max 100000] 1.297303s 0.62% 960.152ms 0.34% 0s +│ │ └──kube-system/kube-proxy-6r5bz 1 19 [ max 100000] 1.297441s 100.01% 960.014ms 99.99% 0s +│ │ ├──kube-proxy 1 19 [ max 100000] 1.289143s 99.36% 958.587ms 99.85% 0s +│ │ └──sandbox 1 19 [ max 100000] 9.724ms 0.75% 0s 0.00% 0s +│ └──burstable 14 9 [ max 100000] 3m28.653931s 99.41% 4m40.024231s 99.64% 0s +│ ├──kube-system/kube-apiserver-talos-default-controlplane-1 8 11 [ max 100000] 2m22.458603s 68.28% 2m22.983949s 51.06% 0s +│ │ ├──kube-apiserver 8 11 [ max 100000] 2m22.440159s 99.99% 2m22.976538s 99.99% 0s +│ │ └──sandbox 1 19 [ max 100000] 14.774ms 0.01% 11.081ms 0.01% 0s +│ ├──kube-system/kube-controller-manager-talos-default-controlplane-1 2 18 [ max 100000] 17.314271s 8.30% 3.014955s 1.08% 0s +│ │ ├──kube-controller-manager 2 18 [ max 100000] 17.303941s 99.94% 3.001934s 99.57% 0s +│ │ └──sandbox 1 19 [ max 100000] 11.675ms 0.07% 11.675ms 0.39% 0s +│ ├──kube-system/kube-flannel-jzx6m 4 14 [ max 100000] 38.986678s 18.68% 1m47.717143s 38.47% 0s +│ │ ├──kube-flannel 4 14 [ max 100000] 38.962703s 99.94% 1m47.690508s 99.98% 0s +│ │ └──sandbox 1 19 [ max 100000] 14.228ms 0.04% 7.114ms 0.01% 0s +│ └──kube-system/kube-scheduler-talos-default-controlplane-1 1 19 [ max 100000] 20.103563s 9.63% 16.099219s 5.75% 0s +│ ├──kube-scheduler 1 19 [ max 100000] 20.092317s 99.94% 16.086603s 99.92% 0s +│ └──sandbox 1 19 [ max 100000] 11.93ms 0.06% 11.93ms 0.07% 0s +├──podruntime 79 1 [ max 100000] 4m59.707084s 64.81% 5m4.010222s 57.16% 0s +│ ├──etcd 79 1 [ max 100000] 2m38.215322s 52.79% 3m7.812204s 61.78% 0s +│ ├──kubelet 39 4 [ max 100000] 1m29.026444s 29.70% 1m23.112332s 27.34% 0s +│ └──runtime 39 4 [ max 100000] 48.501668s 16.18% 37.049334s 12.19% 0s +└──system 59 2 [ max 100000] 32.395345s 7.01% 12.176964s 2.29% 0s + ├──apid 20 7 [ max 100000] 1.261381s 3.89% 756.827ms 6.22% 0s + ├──dashboard 8 11 [ max 100000] 22.231337s 68.63% 5.328927s 43.76% 0s + ├──runtime 20 7 [ max 100000] 7.282253s 22.48% 5.924559s 48.65% 0s + ├──trustd 10 10 [ max 100000] 1.254353s 3.87% 220.698ms 1.81% 0s + └──udevd 10 10 [ max 100000] 78.726ms 0.24% 233.244ms 1.92% 0s +``` + +In the CPU view, the following columns are displayed: + +* `CpuWeight`: the CPU weight of the cgroup (relative, controls the CPU shares/bandwidth) +* `CpuNice`: the CPU nice value (direct translation of the `CpuWeight` to the `nice` value) +* `CpuMax`: the maximum CPU time allowed for the cgroup +* `CpuUser`: the total CPU time consumed by the cgroup and its children in user mode +* `User/%`: the percentage of CPU time consumed by the cgroup and its children in user mode relative to the parent cgroup +* `CpuSystem`: the total CPU time consumed by the cgroup and its children in system mode +* `System/%`: the percentage of CPU time consumed by the cgroup and its children in system mode relative to the parent cgroup +* `Throttled`: the total time the cgroup has been throttled on CPU + +### `cpuset` + +```bash +$ talosctl cgroups --preset=cpuset +NAME CpuSet CpuSet(Eff) Mems Mems(Eff) +. 0-1 0 +├──init 0-1 0 +├──kubepods 0-1 0 +│ ├──besteffort 0-1 0 +│ │ └──kube-system/kube-proxy-6r5bz 0-1 0 +│ │ ├──kube-proxy 0-1 0 +│ │ └──sandbox 0-1 0 +│ └──burstable 0-1 0 +│ ├──kube-system/kube-apiserver-talos-default-controlplane-1 0-1 0 +│ │ ├──kube-apiserver 0-1 0 +│ │ └──sandbox 0-1 0 +│ ├──kube-system/kube-controller-manager-talos-default-controlplane-1 0-1 0 +│ │ ├──kube-controller-manager 0-1 0 +│ │ └──sandbox 0-1 0 +│ ├──kube-system/kube-flannel-jzx6m 0-1 0 +│ │ ├──kube-flannel 0-1 0 +│ │ └──sandbox 0-1 0 +│ └──kube-system/kube-scheduler-talos-default-controlplane-1 0-1 0 +│ ├──kube-scheduler 0-1 0 +│ └──sandbox 0-1 0 +├──podruntime 0-1 0 +│ ├──etcd 0-1 0 +│ ├──kubelet 0-1 0 +│ └──runtime 0-1 0 +└──system 0-1 0 + ├──apid 0-1 0 + ├──dashboard 0-1 0 + ├──runtime 0-1 0 + ├──trustd 0-1 0 + └──udevd 0-1 0 +``` + +This preset shows information about the CPU and memory sets of the cgroups, it is mostly useful with `kubelet` CPU manager. + +* `CpuSet`: the CPU set of the cgroup +* `CpuSet(Eff)`: the effective CPU set of the cgroup +* `Mems`: the memory set of the cgroup (NUMA nodes) +* `Mems(Eff)`: the effective memory set of the cgroup + +### `io` + +```bash +$ talosctl cgroups --preset=io +NAME Bytes Read/Written ios Read/Write PressAvg10 PressAvg60 PressTotal +. loop0: 94 MiB/0 B vda: 700 MiB/803 MiB 0.12 0.37 2m12.512921s +├──init loop0: 231 KiB/0 B vda: 4.9 MiB/4.3 MiB loop0: 6/0 vda: 206/37 0.00 0.00 232.446ms +├──kubepods vda: 282 MiB/16 MiB vda: 3195/3172 0.00 0.00 383.858ms +│ ├──besteffort vda: 58 MiB/0 B vda: 678/0 0.00 0.00 86.833ms +│ │ └──kube-system/kube-proxy-6r5bz vda: 58 MiB/0 B vda: 678/0 0.00 0.00 86.833ms +│ │ ├──kube-proxy vda: 58 MiB/0 B vda: 670/0 0.00 0.00 86.554ms +│ │ └──sandbox vda: 692 KiB/0 B vda: 8/0 0.00 0.00 467µs +│ └──burstable vda: 224 MiB/16 MiB vda: 2517/3172 0.00 0.00 308.616ms +│ ├──kube-system/kube-apiserver-talos-default-controlplane-1 vda: 76 MiB/16 MiB vda: 870/3171 0.00 0.00 151.677ms +│ │ ├──kube-apiserver vda: 76 MiB/16 MiB vda: 870/3171 0.00 0.00 156.375ms +│ │ └──sandbox 0.00 0.00 0s +│ ├──kube-system/kube-controller-manager-talos-default-controlplane-1 vda: 62 MiB/0 B vda: 670/0 0.00 0.00 95.432ms +│ │ ├──kube-controller-manager vda: 62 MiB/0 B vda: 670/0 0.00 0.00 100.197ms +│ │ └──sandbox 0.00 0.00 0s +│ ├──kube-system/kube-flannel-jzx6m vda: 36 MiB/4.0 KiB vda: 419/1 0.00 0.00 64.203ms +│ │ ├──kube-flannel vda: 35 MiB/0 B vda: 399/0 0.00 0.00 55.26ms +│ │ └──sandbox 0.00 0.00 0s +│ └──kube-system/kube-scheduler-talos-default-controlplane-1 vda: 50 MiB/0 B vda: 558/0 0.00 0.00 64.331ms +│ ├──kube-scheduler vda: 50 MiB/0 B vda: 558/0 0.00 0.00 62.821ms +│ └──sandbox 0.00 0.00 0s +├──podruntime vda: 379 MiB/764 MiB vda: 3802/287674 0.39 0.39 2m13.409399s +│ ├──etcd vda: 308 MiB/759 MiB vda: 2598/286420 0.50 0.41 2m15.407179s +│ ├──kubelet vda: 69 MiB/62 KiB vda: 834/13 0.00 0.00 122.371ms +│ └──runtime vda: 76 KiB/3.9 MiB vda: 19/1030 0.00 0.00 164.984ms +└──system loop0: 18 MiB/0 B vda: 3.2 MiB/0 B loop0: 590/0 vda: 116/0 0.00 0.00 153.609ms + ├──apid loop0: 1.9 MiB/0 B loop0: 103/0 0.00 0.00 3.345ms + ├──dashboard loop0: 16 MiB/0 B loop0: 487/0 0.00 0.00 11.596ms + ├──runtime 0.00 0.00 28.957ms + ├──trustd 0.00 0.00 0s + └──udevd vda: 3.2 MiB/0 B vda: 116/0 0.00 0.00 135.586ms +``` + +In the IO (input/output) view, the following columns are displayed: + +* `Bytes Read/Written`: the total number of bytes read and written by the cgroup and its children, per each blockdevice +* `ios Read/Write`: the total number of I/O operations read and written by the cgroup and its children, per each blockdevice +* `PressAvg10`: the average IO pressure of the cgroup and its children over the last 10 seconds +* `PressAvg60`: the average IO pressure of the cgroup and its children over the last 60 seconds +* `PressTotal`: the total IO pressure of the cgroup and its children (see [PSI](https://docs.kernel.org/accounting/psi.html#psi) for more information) + +### `memory` + +```bash +$ talosctl cgroups --preset=memory +NAME MemCurrent MemPeak MemLow Peak/Low MemHigh MemMin Current/Min MemMax +. unset unset unset unset% unset unset unset% unset +├──init 133 MiB 133 MiB 192 MiB 69.18% max 96 MiB 138.35% max +├──kubepods 494 MiB 505 MiB 0 B max% max 0 B max% 1.4 GiB +│ ├──besteffort 70 MiB 74 MiB 0 B max% max 0 B max% max +│ │ └──kube-system/kube-proxy-6r5bz 70 MiB 74 MiB 0 B max% max 0 B max% max +│ │ ├──kube-proxy 69 MiB 73 MiB 0 B max% max 0 B max% max +│ │ └──sandbox 872 KiB 2.2 MiB 0 B max% max 0 B max% max +│ └──burstable 424 MiB 435 MiB 0 B max% max 0 B max% max +│ ├──kube-system/kube-apiserver-talos-default-controlplane-1 233 MiB 242 MiB 0 B max% max 0 B max% max +│ │ ├──kube-apiserver 232 MiB 242 MiB 0 B max% max 0 B max% max +│ │ └──sandbox 208 KiB 3.3 MiB 0 B max% max 0 B max% max +│ ├──kube-system/kube-controller-manager-talos-default-controlplane-1 78 MiB 80 MiB 0 B max% max 0 B max% max +│ │ ├──kube-controller-manager 78 MiB 80 MiB 0 B max% max 0 B max% max +│ │ └──sandbox 212 KiB 3.3 MiB 0 B max% max 0 B max% max +│ ├──kube-system/kube-flannel-jzx6m 48 MiB 50 MiB 0 B max% max 0 B max% max +│ │ ├──kube-flannel 46 MiB 48 MiB 0 B max% max 0 B max% max +│ │ └──sandbox 216 KiB 3.1 MiB 0 B max% max 0 B max% max +│ └──kube-system/kube-scheduler-talos-default-controlplane-1 66 MiB 67 MiB 0 B max% max 0 B max% max +│ ├──kube-scheduler 66 MiB 67 MiB 0 B max% max 0 B max% max +│ └──sandbox 208 KiB 3.4 MiB 0 B max% max 0 B max% max +├──podruntime 549 MiB 647 MiB 0 B max% max 0 B max% max +│ ├──etcd 382 MiB 482 MiB 256 MiB 188.33% max 0 B max% max +│ ├──kubelet 103 MiB 104 MiB 192 MiB 54.31% max 96 MiB 107.57% max +│ └──runtime 64 MiB 71 MiB 392 MiB 18.02% max 196 MiB 32.61% max +└──system 229 MiB 232 MiB 192 MiB 120.99% max 96 MiB 239.00% max + ├──apid 26 MiB 28 MiB 32 MiB 88.72% max 16 MiB 159.23% 40 MiB + ├──dashboard 113 MiB 113 MiB 0 B max% max 0 B max% 196 MiB + ├──runtime 74 MiB 77 MiB 96 MiB 79.89% max 48 MiB 154.57% max + ├──trustd 10 MiB 11 MiB 16 MiB 69.85% max 8.0 MiB 127.78% 24 MiB + └──udevd 6.8 MiB 14 MiB 16 MiB 86.87% max 8.0 MiB 84.67% max +``` + +In the memory view, the following columns are displayed: + +* `MemCurrent`: the current memory usage of the cgroup and its children +* `MemPeak`: the peak memory usage of the cgroup and its children +* `MemLow`: the low memory reservation of the cgroup +* `Peak/Low`: the ratio of the peak memory usage to the low memory reservation +* `MemHigh`: the high memory limit of the cgroup +* `MemMin`: the minimum memory reservation of the cgroup +* `Current/Min`: the ratio of the current memory usage to the minimum memory reservation +* `MemMax`: the maximum memory limit of the cgroup + +### `swap` + +```bash +$ talosctl cgroups --preset=swap +NAME SwapCurrent SwapPeak SwapHigh SwapMax +. unset unset unset unset +├──init 0 B 0 B max max +├──kubepods 0 B 0 B max max +│ ├──besteffort 0 B 0 B max max +│ │ └──kube-system/kube-proxy-6r5bz 0 B 0 B max max +│ │ ├──kube-proxy 0 B 0 B max 0 B +│ │ └──sandbox 0 B 0 B max max +│ └──burstable 0 B 0 B max max +│ ├──kube-system/kube-apiserver-talos-default-controlplane-1 0 B 0 B max max +│ │ ├──kube-apiserver 0 B 0 B max 0 B +│ │ └──sandbox 0 B 0 B max max +│ ├──kube-system/kube-controller-manager-talos-default-controlplane-1 0 B 0 B max max +│ │ ├──kube-controller-manager 0 B 0 B max 0 B +│ │ └──sandbox 0 B 0 B max max +│ ├──kube-system/kube-flannel-jzx6m 0 B 0 B max max +│ │ ├──kube-flannel 0 B 0 B max 0 B +│ │ └──sandbox 0 B 0 B max max +│ └──kube-system/kube-scheduler-talos-default-controlplane-1 0 B 0 B max max +│ ├──kube-scheduler 0 B 0 B max 0 B +│ └──sandbox 0 B 0 B max max +├──podruntime 0 B 0 B max max +│ ├──etcd 0 B 0 B max max +│ ├──kubelet 0 B 0 B max max +│ └──runtime 0 B 0 B max max +└──system 0 B 0 B max max + ├──apid 0 B 0 B max max + ├──dashboard 0 B 0 B max max + ├──runtime 0 B 0 B max max + ├──trustd 0 B 0 B max max + └──udevd 0 B 0 B max max +``` + +In the swap view, the following columns are displayed: + +* `SwapCurrent`: the current swap usage of the cgroup and its children +* `SwapPeak`: the peak swap usage of the cgroup and its children +* `SwapHigh`: the high swap limit of the cgroup +* `SwapMax`: the maximum swap limit of the cgroup + +## Custom Schemas + +The `talosctl cgroups` command allows you to define custom schemas to display the cgroups information in a specific way. +The schema is defined in a YAML file with the following structure: + +```yaml +columns: + - name: Bytes Read/Written + template: '{{ range $disk, $v := .IOStat }}{{ if $v }}{{ $disk }}: {{ $v.rbytes.HumanizeIBytes }}/{{ $v.wbytes.HumanizeIBytes }} {{ end }}{{ end }}' + - name: ios Read/Write + template: '{{ if .Parent }}{{ range $disk, $v := .IOStat }}{{ $disk }}: {{ $v.rios }}/{{ $v.wios }} {{ end }}{{ end }}' + - name: PressAvg10 + template: '{{ .IOPressure.some.avg10 | printf "%6s" }}' + - name: PressAvg60 + template: '{{ .IOPressure.some.avg60 | printf "%6s" }}' + - name: PressTotal + template: '{{ .IOPressure.some.total.UsecToDuration | printf "%12s" }}' +``` + +The schema file can be passed to the `talosctl cgroups` command with the `--schema-file` flag: + +```bash +talosctl cgroups --schema-file=schema.yaml +``` + +In the schema, for each column, you can define a `name` and a `template` which is a Go template that will be executed with the cgroups data. +In the template, there's a `.` variable that contains the cgroups data, and `.Parent` variable which is a parent cgroup (if available). +Each cgroup node contains information parsed from the cgroup filesystem, with field names matching the filenames adjusted for Go naming conventions, +e.g. `io.stat` becomes `.IOStat` in the template. + +The schemas for the presets above can be found in the [source code](https://github.com/siderolabs/talos/tree/main/cmd/talosctl/cmd/talos/cgroupsprinter/schemas). diff --git a/website/content/v1.12/advanced/customizing-the-kernel.md b/website/content/v1.12/advanced/customizing-the-kernel.md new file mode 100644 index 000000000..c100c6051 --- /dev/null +++ b/website/content/v1.12/advanced/customizing-the-kernel.md @@ -0,0 +1,95 @@ +--- +title: "Customizing the Kernel" +description: "Guide on how to customize the kernel used by Talos Linux." +aliases: + - ../guides/customizing-the-kernel +--- + +Talos Linux configures the kernel to allow loading only cryptographically signed modules. +The signing key is generated during the build process, it is unique to each build, and it is not available to the user. +The public key is embedded in the kernel, and it is used to verify the signature of the modules. +So if you want to use a custom kernel module, you will need to build your own kernel, and all required kernel modules in order to get the signature in sync with the kernel. + +## Overview + +In order to build a custom kernel (or a custom kernel module), the following steps are required: + +- build a new Linux kernel and modules, push the artifacts to a registry +- build a new Talos base artifacts: kernel and initramfs image +- produce a new Talos boot artifact (ISO, installer image, disk image, etc.) + +We will go through each step in detail. + +## Building a Custom Kernel + +First, you might need to prepare the build environment, follow the [Building Custom Images]({{< relref "building-images" >}}) guide. + +Checkout the [`siderolabs/pkgs`](https://github.com/siderolabs/pkgs) repository: + +```shell +git clone https://github.com/siderolabs/pkgs.git +cd pkgs +git checkout {{< release_branch >}} +``` + +The kernel configuration is located in the files `kernel/build/config-ARCH` files. +It can be modified using the text editor, or by using the Linux kernel `menuconfig` tool: + +```shell +make kernel-menuconfig +``` + +The kernel configuration can be cleaned up by running: + +```shell +make kernel-olddefconfig +``` + +Both commands will output the new configuration to the `kernel/build/config-ARCH` files. + +Once ready, build the kernel any out-of-tree modules (if required, e.g. `zfs`) and push the artifacts to a registry: + +```shell +make kernel REGISTRY=127.0.0.1:5005 PUSH=true +``` + +By default, this command will compile and push the kernel both for `amd64` and `arm64` architectures, but you can specify a single architecture by overriding +a variable `PLATFORM`: + +```shell +make kernel REGISTRY=127.0.0.1:5005 PUSH=true PLATFORM=linux/amd64 +``` + +This will create a container image `127.0.0.1:5005/siderolabs/kernel:$TAG` with the kernel and modules. + +## Building Talos Base Artifacts + +Follow the [Building Custom Images]({{< relref "building-images" >}}) guide to set up the Talos source code checkout. + +If some new kernel modules were introduced, adjust the list of the default modules compiled into the Talos `initramfs` by +editing the file `hack/modules-ARCH.txt`. + +Try building base Talos artifacts: + +```shell +make kernel initramfs PKG_KERNEL=127.0.0.1:5005/siderolabs/kernel:$TAG PLATFORM=linux/amd64 +``` + +This should create a new image of the kernel and initramfs in `_out/vmlinuz-amd64` and `_out/initramfs-amd64.xz` respectively. + +> Note: if building for `arm64`, replace `amd64` with `arm64` in the commands above. + +As a final step, produce the new `imager` container image which can generate Talos boot assets: + +```shell +make imager PKG_KERNEL=127.0.0.1:5005/siderolabs/kernel:$TAG PLATFORM=linux/amd64 INSTALLER_ARCH=targetarch +``` + +> Note: if you built the kernel for both `amd64` and `arm64`, a multi-arch `imager` container can be built as well by specifying `INSTALLER_ARCH=all` and `PLATFORM=linux/amd64,linux/arm64`. + +## Building Talos Boot Assets + +Follow the [Boot Assets]({{< relref "../talos-guides/install/boot-assets" >}}) guide to build Talos boot assets you might need to boot Talos: ISO, `installer` image, etc. +Replace the reference to the `imager` in guide with the reference to the `imager` container built above. + +> Note: if you update the `imager` container, don't forget to `docker pull` it, as `docker` caches pulled images and won't pull the updated image automatically. diff --git a/website/content/v1.12/advanced/developing-talos.md b/website/content/v1.12/advanced/developing-talos.md new file mode 100644 index 000000000..c7c510691 --- /dev/null +++ b/website/content/v1.12/advanced/developing-talos.md @@ -0,0 +1,441 @@ +--- +title: "Developing Talos" +description: "Learn how to set up a development environment for local testing and hacking on Talos itself!" +aliases: + - ../learn-more/developing-talos +--- + +This guide outlines steps and tricks to develop Talos operating systems and related components. +The guide assumes macOS or a Linux operating system on the development host. + +## Prepare + +Check out the [Talos repository](https://github.com/siderolabs/talos). + +Try running `make help` to see available `make` commands. +You would need Docker and `buildx` installed on the host. + +> Note: Usually it is better to install up to date Docker from Docker apt repositories, e.g. [Ubuntu instructions](https://docs.docker.com/engine/install/ubuntu/). +> +> If `buildx` plugin is not available with OS docker packages, it can be installed [as a plugin from GitHub releases](https://docs.docker.com/buildx/working-with-buildx/#install). + +Set up a builder with access to the host network: + +```bash + docker buildx create --driver docker-container --driver-opt network=host --name local1 --buildkitd-flags '--allow-insecure-entitlement security.insecure' --use +``` + +> Note: `network=host` allows buildx builder to access host network, so that it can push to a local container registry (see below). + +Make sure the following steps work: + +- `make talosctl` +- `make initramfs kernel` + +Set up a local docker registry: + +```bash +docker run -d -p 5005:5000 \ + --restart always \ + --name local registry:2 +``` + +Try to build and push to local registry an installer image: + +```bash +make installer-base IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true +make imager IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true INSTALLER_ARCH=targetarch +make installer IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true +``` + +Record the image name output in the step above. + +> Note: it is also possible to force a stable image tag by using `TAG` variable: `make installer-base IMAGE_REGISTRY=127.0.0.1:5005 TAG=v1.0.0-alpha.1 PUSH=true`. + +## Running Talos cluster + +Set up local caching docker registries (this speeds up Talos cluster boot a lot), script is in the Talos repo: + +```bash +bash hack/start-registry-proxies.sh +``` + +Start your local cluster with: + +```bash +sudo --preserve-env=HOME _out/talosctl- cluster create \ + --provisioner=qemu \ + --cidr=172.20.0.0/24 \ + --registry-mirror docker.io=http://172.20.0.1:5000 \ + --registry-mirror registry.k8s.io=http://172.20.0.1:5001 \ + --registry-mirror gcr.io=http://172.20.0.1:5003 \ + --registry-mirror ghcr.io=http://172.20.0.1:5004 \ + --registry-mirror 127.0.0.1:5005=http://172.20.0.1:5005 \ + --install-image=127.0.0.1:5005/siderolabs/installer: \ + --controlplanes 3 \ + --workers 2 \ + --with-bootloader=false +``` + +- `--provisioner` selects QEMU vs. default Docker +- custom `--cidr` to make QEMU cluster use different network than default Docker setup (optional) +- `--registry-mirror` uses the caching proxies set up above to speed up boot time a lot, last one adds your local registry (installer image was pushed to it) +- `--install-image` is the image you built with `make installer` above +- `--controlplanes` & `--workers` configure cluster size, choose to match your resources; 3 controlplanes give you HA control plane; 1 controlplane is enough, never do 2 controlplanes +- `--with-bootloader=false` disables boot from disk (Talos will always boot from `_out/vmlinuz-` and `_out/initramfs-.xz`). + This speeds up development cycle a lot - no need to rebuild installer and perform an install, rebooting is enough to get new code changes. + +> Note: when configuration changes are introduced and the old installer doesn't validate the config, or the installation flow itself is being worked on `--with-bootloader=false` should not be used +> +> `talosctl cluster create` derives Talos machine configuration version from the install image tag, so sometimes early in the development cycle (when new minor tag is not released yet), machine config version can be overridden with `--talos-version={{< version >}}`. + +## Console Logs + +Watching console logs is easy with `tail`: + +```bash +tail -F ~/.talos/clusters/talos-default/talos-default-*.log +``` + +## Interacting with Talos + +Once `talosctl cluster create` finishes successfully, `talosconfig` and `kubeconfig` will be set up automatically to point to your cluster. + +Start playing with `talosctl`: + +```bash +talosctl -n 172.20.0.2 version +talosctl -n 172.20.0.3,172.20.0.4 dashboard +talosctl -n 172.20.0.4 get members +``` + +Same with `kubectl`: + +```bash +kubectl get nodes -o wide +``` + +You can deploy some Kubernetes workloads to the cluster. + +You can edit machine config on the fly with `talosctl edit mc --immediate`, config patches can be applied via `--config-patch` flags, also many features have specific flags in `talosctl cluster create`. + +## Quick Reboot + +To reboot whole cluster quickly (e.g. to pick up a change made in the code): + +```bash +for socket in ~/.talos/clusters/talos-default/talos-default-*.monitor; do echo "q" | sudo socat - unix-connect:$socket; done +``` + +Sending `q` to a single socket allows to reboot a single node. + +> Note: This command performs immediate reboot (as if the machine was powered down and immediately powered back up), for normal Talos reboot use `talosctl reboot`. + +## Development Cycle + +Fast development cycle: + +- bring up a cluster +- make code changes +- rebuild `initramfs` with `make initramfs` +- reboot a node to pick new `initramfs` +- verify code changes +- more code changes... + +Some aspects of Talos development require to enable bootloader (when working on `installer` itself), in that case quick development cycle is no longer possible, and cluster should be destroyed and recreated each time. + +## Running Integration Tests + +If integration tests were changed (or when running them for the first time), first rebuild the integration test binary: + +```bash +rm -f _out/integration-test-linux-amd64; make _out/integration-test-linux-amd64 +``` + +Running short tests against QEMU provisioned cluster: + +```bash +_out/integration-test-linux-amd64 \ + -talos.provisioner=qemu \ + -test.v \ + -test.short \ + -talos.talosctlpath=$PWD/_out/talosctl-linux-amd64 +``` + +Whole test suite can be run removing `-test.short` flag. + +Specfic tests can be run with `-test.run=TestIntegration/api.ResetSuite`. + +## Build Flavors + +`make WITH_RACE=1` enables Go race detector, Talos runs slower and uses more memory, but memory races are detected. + +`make WITH_DEBUG=1` enables Go profiling and other debug features, useful for local development. + +`make initramfs WITH_DEBUG_SHELL=true` adds bash and minimal utilities for debugging purposes. +Combine with `--with-debug-shell` flag when creating cluster to obtain shell access. +This is uncommonly used as in this case the bash shell will run in place of machined. + +## Destroying Cluster + +```bash +sudo --preserve-env=HOME ../talos/_out/talosctl-linux-amd64 cluster destroy --provisioner=qemu +``` + +This command stops QEMU and helper processes, tears down bridged network on the host, and cleans up +cluster state in `~/.talos/clusters`. + +> Note: if the host machine is rebooted, QEMU instances and helpers processes won't be started back. +> In that case it's required to clean up files in `~/.talos/clusters/` directory manually. + +## Optional + +Set up cross-build environment with: + +```bash +docker run --rm --privileged multiarch/qemu-user-static --reset -p yes +``` + +> Note: the static qemu binaries which come with Ubuntu 21.10 seem to be broken. + +## Unit tests + +Unit tests can be run in buildx with `make unit-tests`, on Ubuntu systems some tests using `loop` devices will fail because Ubuntu uses low-index `loop` devices for snaps. + +Most of the unit-tests can be run standalone as well, with regular `go test`, or using IDE integration: + +```bash +go test -v ./internal/pkg/circular/ +``` + +This provides much faster feedback loop, but some tests require either elevated privileges (running as `root`) or additional binaries available only in Talos `rootfs` (containerd tests). + +Running tests as root can be done with `-exec` flag to `go test`, but this is risky, as test code has root access and can potentially make undesired changes: + +```bash +go test -exec sudo -v ./internal/app/machined/pkg/controllers/network/... +``` + +## Go Profiling + +Build `initramfs` with debug enabled: `make initramfs WITH_DEBUG=1`. + +Launch Talos cluster with bootloader disabled, and use `go tool pprof` to capture the profile and show the output in your browser: + +```bash +go tool pprof http://172.20.0.2:9982/debug/pprof/heap +``` + +The IP address `172.20.0.2` is the address of the Talos node, and port `:9982` depends on the Go application to profile: + +- 9981: `apid` +- 9982: `machined` +- 9983: `trustd` + +## Testing Air-gapped Environments + +There is a hidden `talosctl debug air-gapped` command which launches two components: + +- HTTP proxy capable of proxying HTTP and HTTPS requests +- HTTPS server with a self-signed certificate + +The command also writes down Talos machine configuration patch to enable the HTTP proxy and add a self-signed certificate +to the list of trusted certificates: + +```shell +$ talosctl debug air-gapped --advertised-address 172.20.0.1 +2022/08/04 16:43:14 writing config patch to air-gapped-patch.yaml +2022/08/04 16:43:14 starting HTTP proxy on :8002 +2022/08/04 16:43:14 starting HTTPS server with self-signed cert on :8001 +``` + +The `--advertised-address` should match the bridge IP of the Talos node. + +Generated machine configuration patch looks like: + +```yaml +machine: + env: + http_proxy: http://172.20.0.1:8002 + https_proxy: http://172.20.0.1:8002 + no_proxy: 172.20.0.1/24 +cluster: + extraManifests: + - https://172.20.0.1:8001/debug.yaml +--- +apiVersion: v1alpha1 +kind: TrustedRootsConfig +name: air-gapped-ca +certificates: | + -----BEGIN CERTIFICATE----- + MIIBiTCCAS+gAwIBAgIBATAKBggqhkjOPQQDAjAUMRIwEAYDVQQKEwlUZXN0IE9u + bHkwHhcNMjUwMTE1MTE1OTI3WhcNMjUwMTE2MTE1OTI3WjAUMRIwEAYDVQQKEwlU + ZXN0IE9ubHkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAReznBeEcQFcB/y1yqI + HQcP0IWBMvgwGTeaaTBM6rV+AjbnyxgCrXAnmJ0t45Eur27eW9J/1T5tzA6fe24f + YyY9o3IwcDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG + AQUFBwMCMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEGBbafXsyzxVhVqfjzy + 7aBmVvtaMA8GA1UdEQQIMAaHBKwUAAEwCgYIKoZIzj0EAwIDSAAwRQIhAPAFm6Lv + 1Bw+M55Z1SEDLyILJSS0En5F6n8Q9LyGGT4fAiBi+Fm3wSQcvgGPG9OfokFaXmGp + Pa6c4ZrarKO8ZxWigA== + -----END CERTIFICATE----- +``` + +The first section appends a self-signed certificate of the HTTPS server to the list of trusted certificates, +followed by the HTTP proxy setup (in-cluster traffic is excluded from the proxy). +The last section adds an extra Kubernetes manifest hosted on the HTTPS server. + +The machine configuration patch can now be used to launch a test Talos cluster: + +```shell +talosctl cluster create ... --config-patch @air-gapped-patch.yaml +``` + +The following lines should appear in the output of the `talosctl debug air-gapped` command: + +- `CONNECT discovery.talos.dev:443`: the HTTP proxy is used to talk to the discovery service +- `http: TLS handshake error from 172.20.0.2:53512: remote error: tls: bad certificate`: an expected error on Talos side, as self-signed cert is not written yet to the file +- `GET /debug.yaml`: Talos successfully fetches the extra manifest successfully + +There might be more output depending on the registry caches being used or not. + +## Running Upgrade Integration Tests + +Talos has a separate set of provision upgrade tests, which create a cluster on older versions of Talos, perform an upgrade, +and verify that the cluster is still functional. + +Build the test binary: + +```bash +rm -f _out/integration-test-provision-linux-amd64; make _out/integration-test-provision-linux-amd64 +``` + +Prepare the test artifacts for the upgrade test: + +```bash +make release-artifacts +``` + +Build and push an installer image for the development version of Talos: + +```bash +make installer-base IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true +make imager IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true +make installer IMAGE_REGISTRY=127.0.0.1:5005 +``` + +Run the tests (the tests will create the cluster on the older version of Talos, perform an upgrade, and verify that the cluster is still functional): + +```bash +sudo --preserve-env=HOME _out/integration-test-provision-linux-amd64 \ + -test.v \ + -talos.talosctlpath _out/talosctl-linux-amd64 \ + -talos.provision.target-installer-registry=127.0.0.1:5005 \ + -talos.provision.registry-mirror 127.0.0.1:5005=http://172.20.0.1:5005,docker.io=http://172.20.0.1:5000,registry.k8s.io=http://172.20.0.1:5001,quay.io=http://172.20.0.1:5002,gcr.io=http://172.20.0.1:5003,ghcr.io=http://172.20.0.1:5004 \ + -talos.provision.cidr 172.20.0.0/24 +``` + +## SELinux policy debugging and development + +Here are some tips about how Talos SELinux policy is built, which should mainly help developers troubleshoot denials and assess policy rules for security against different threats. + +### Obtaining and processing denial logs + +If SELinux has blocked some event from happening, it will log it to the audit log. +If the mode is permissive, the only implication of would be a denial message, so permissive mode is useful for prototyping the policy. +You can check the logs with: + +`talosctl --nodes 172.20.0.2 logs auditd > audit.log` + +The obtained logs can be processed with `audit2allow` to obtain a CIL code that would allow the denied event to happen, alongside an explanation of the denial. +For this we use SELinux userspace utilities, which can be ran in a container for cases you use a Linux system without SELinux or another OS. +Some of the useful commands are: + +```bash +audit2why -p ./internal/pkg/selinux/policy/policy.33 -i audit.log +audit2allow -C -e -p ./internal/pkg/selinux/policy/policy.33 -i audit.log +``` + +However, please do not consider the output of `audit2allow` as a final modification for the policy. +It is a good starting point to understand the denial, but the generated code should be reviewed and correctly reformulated once confirmed to be needed and not caused by mislabeling. + +### Iterating on the policy + +`make generate` generates the compiled SELinux files. +However, if you want to iterate on the policy rapidly, you might want to consider only rebuilding the policy during the testing: + +```bash +make local-selinux-generate DEST=./internal/pkg/selinux PLATFORM=linux/amd64 PROGRESS=plain +``` + +### Debugging locally with many denials happening + +Sometimes, e.g. during a major refactor, the policy can be broken and many denials can happen. +This can cause the audit ring buffer to fill up, losing some messages. +These are some kernel cmdline parameters that redirect the audit logs to the console, which is saved to your development cluster directory: + +`talos.auditd.disabled=1 audit=1 audit_backlog_limit=65535 debug=1 sysctl.kernel.printk_ratelimit=0 sysctl.kernel.printk_delay=0 sysctl.kernel.printk_ratelimit_burst=10000` + +### SELinux policy structure + +The SELinux policy is built using the CIL language. +The CIL files are located in `internal/pkg/selinux/policy/selinux` and are compiled into a binary format (e.g. `33` for the current kernel policy format version) using the `secilc` tool from Talos tools bundle. +The policy is embedded into the initramfs init and loaded early in the boot process. + +For understanding and modifying the policy, [CIL language reference](https://github.com/SELinuxProject/selinux-notebook/blob/dfabf5f1bcdc72e440c1f7010e39ae3ce9f0c364/src/notebook-examples/selinux-policy/cil/CIL_Reference_Guide.pdf) is a recommended starting point to get familiar with the language. +[Object Classes and Permissions](https://github.com/SELinuxProject/selinux-notebook/blob/dfabf5f1bcdc72e440c1f7010e39ae3ce9f0c364/src/object_classes_permissions.md) is another helpful document, listing all SELinux entities and the meaning of all the permissions. + +The policy directory contains the following main subdirectories: + +- `immutable`: contains the preamble parts, mostly listing SELinux SIDs, classes, policy capabilities and roles, not expected to change frequently. +- `common`: abstractions and common rules, which are used by the other parts of the policy or by all objects of some kind.: + - classmaps: contains class maps, which are a SELinux concept for easily configuring the same list of permissions on a list of classes. + Our policy frequently uses `fs_classes` classmap for enabling a group of file operations on all types of files. + - files: labels for common system files, stored on squashfs. + Mostly used for generalized labels not related to a particular service. + - network: rules that allow basically any network activity, as Talos does not currently use SELinux features like IPsec labeling for network security. + - typeattributes: this file contains typeattributes, which are a SELinux concept for grouping types together to have the same rules applied to all of them. + This file also contains macros used to assign objects into typeattributes. + When such a macro exists its use is recommended over using the typeattribute directly, as it allows for grepping for the macro call. + - processes: common rules, applied to all processes or typeattribute of processes. + We only add rules that apply widely here, with more specific rules being added to the service policy files. +- `services`: policy files for each service. +These files contain the definitions and rules that are specific to the service, like allowing access to its configuration files or communicating over sockets. +Some specific parts not being a service in the Talos terms are: + - `selinux` - selinuxfs rules protecting SELinux settings from modifications after the OS has started. + - `system-containerd` - a containerd instance used for `apid` and similar services internal to Talos. + - `system-containers` - `apid`, `trustd`, `etcd` and other system services, running in system containerd instance. + +#### classmaps overview + +- `fs_classes` - contains file classes and their permissions, used for file operations. + - `rw` - all operations, except SELinux label management. + - `ro` - read-only operations. + - others - just a class permission applied to all supported file classes. +- `netlink_classes (full)` - full (except security labels) access to all netlink socket classes. +- `process_classes` - helpers to allow a wide range of process operations. + - `full` - all operations, except ptrace (considered to be a rare requirement, so should be added specifically where needed). + - `signal` - send any signal to the target process. + +#### typeattributes overview + +- Processes: + - `service_p` - system services. + - `system_container_p` - containerized system services. + - `pod_p` - Kubernetes pods. + - `system_p` - kernel, init, system services (not containerized). + - `any_p` - any process registered with the SELinux. + - Service-specific types and typeattributes in service policy files. +- Files: + - `common_f` - world-rw files, which can be accessed by any process. + - `protected_f` - mostly files used by specific services, not accessible by other processes (except e.g. machined) + - `system_f` - files and directories used by the system services, also generally to be specified by precise type and not typeattribute. + - `system_socket_f` - sockets used for communication between system services, not accessible by workload processes. + - `device_f`: + - `common_device_f` - devices not considered protected like GPUs. + - `protected_device_f` - protected devices like TPM, watchdog timers. + - `any_f` - any file registered with the SELinux. + - `filesystem_f` - filesystems, generally used for allowing mount operations. + - `service_exec_f` - system service executable files. + - Service-specific types and typeattributes in service policy files. +- General: + - `any_f_any_p` - any file or any process, the widest typeattribute. diff --git a/website/content/v1.12/advanced/disaster-recovery.md b/website/content/v1.12/advanced/disaster-recovery.md new file mode 100644 index 000000000..a06c6ecad --- /dev/null +++ b/website/content/v1.12/advanced/disaster-recovery.md @@ -0,0 +1,148 @@ +--- +title: "Disaster Recovery" +description: "Procedure for snapshotting etcd database and recovering from catastrophic control plane failure." +aliases: + - ../guides/disaster-recovery +--- + +`etcd` database backs Kubernetes control plane state, so if the `etcd` service is unavailable, + the Kubernetes control plane goes down, and the cluster is not recoverable until `etcd` is recovered. +`etcd` builds around the consensus protocol Raft, so highly-available control plane clusters can tolerate the loss of nodes so long as more than half of the members are running and reachable. +For a three control plane node Talos cluster, this means that the cluster tolerates a failure of any single node, +but losing more than one node at the same time leads to complete loss of service. +Because of that, it is important to take routine backups of `etcd` state to have a snapshot to recover the cluster from +in case of catastrophic failure. + +## Backup + +### Snapshotting `etcd` Database + +Create a consistent snapshot of `etcd` database with `talosctl etcd snapshot` command: + +```bash +$ talosctl -n etcd snapshot db.snapshot +etcd snapshot saved to "db.snapshot" (2015264 bytes) +snapshot info: hash c25fd181, revision 4193, total keys 1287, total size 3035136 +``` + +> Note: filename `db.snapshot` is arbitrary. + +This database snapshot can be taken on any healthy control plane node (with IP address `` in the example above), +as all `etcd` instances contain exactly same data. +It is recommended to configure `etcd` snapshots to be created on some schedule to allow point-in-time recovery using the latest snapshot. + +### Disaster Database Snapshot + +If the `etcd` cluster is not healthy (for example, if quorum has already been lost), the `talosctl etcd snapshot` command might fail. +In that case, copy the database snapshot directly from the control plane node: + +```bash +talosctl -n cp /var/lib/etcd/member/snap/db . +``` + +This snapshot might not be fully consistent (if the `etcd` process is running), but it allows +for disaster recovery when latest regular snapshot is not available. + +### Machine Configuration + +Machine configuration might be required to recover the node after hardware failure. +Backup Talos node machine configuration with the command: + +```bash +talosctl -n IP get mc v1alpha1 -o yaml | yq eval '.spec' - +``` + +## Recovery + +Before starting a disaster recovery procedure, make sure that `etcd` cluster can't be recovered: + +* get `etcd` cluster member list on all healthy control plane nodes with `talosctl -n IP etcd members` command and compare across all members. +* query `etcd` health across control plane nodes with `talosctl -n IP service etcd`. + +If the quorum can be restored, restoring quorum might be a better strategy than performing full disaster recovery +procedure. + +### Latest Etcd Snapshot + +Get hold of the latest `etcd` database snapshot. +If a snapshot is not fresh enough, create a database snapshot (see above), even if the `etcd` cluster is unhealthy. + +### Init Node + +Make sure that there are no control plane nodes with machine type `init`: + +```bash +$ talosctl -n ,,... get machinetype +NODE NAMESPACE TYPE ID VERSION TYPE +172.20.0.2 config MachineType machine-type 2 controlplane +172.20.0.4 config MachineType machine-type 2 controlplane +172.20.0.3 config MachineType machine-type 2 controlplane +``` + +Init node type is deprecated, and are incompatible with `etcd` recovery procedure. +`init` node can be converted to `controlplane` type with `talosctl edit mc --mode=staged` command followed +by node reboot with `talosctl reboot` command. + +### Preparing Control Plane Nodes + +If some control plane nodes experienced hardware failure, replace them with new nodes. + +Use machine configuration backup to re-create the nodes with the same secret material and control plane settings +to allow workers to join the recovered control plane. + +If a control plane node is up but `etcd` isn't, wipe the node's [EPHEMERAL]({{< relref "../learn-more/architecture/#file-system-partitions" >}}) partition to remove the `etcd` +data directory (make sure a database snapshot is taken before doing this): + +```bash +talosctl -n reset --graceful=false --reboot --system-labels-to-wipe=EPHEMERAL +``` + +At this point, all control plane nodes should boot up, and `etcd` service should be in the `Preparing` state. + +The Kubernetes control plane endpoint should be pointed to the new control plane nodes if there were +changes to the node addresses. + +### Recovering from the Backup + +Make sure all `etcd` service instances are in `Preparing` state: + +```bash +$ talosctl -n service etcd +NODE 172.20.0.2 +ID etcd +STATE Preparing +HEALTH ? +EVENTS [Preparing]: Running pre state (17s ago) + [Waiting]: Waiting for service "cri" to be "up", time sync (18s ago) + [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", time sync (20s ago) +``` + +Execute the bootstrap command against any control plane node passing the path to the `etcd` database snapshot: + +```bash +$ talosctl -n bootstrap --recover-from=./db.snapshot +recovering from snapshot "./db.snapshot": hash c25fd181, revision 4193, total keys 1287, total size 3035136 +``` + +> Note: if database snapshot was copied out directly from the `etcd` data directory using `talosctl cp`, +> add flag `--recover-skip-hash-check` to skip integrity check on restore. + +Talos node should print matching information in the kernel log: + +```log +recovering etcd from snapshot: hash c25fd181, revision 4193, total keys 1287, total size 3035136 +{"level":"info","msg":"restoring snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/li} +{"level":"info","msg":"restored last compact revision","meta-bucket-name":"meta","meta-bucket-name-key":"finishedCompactRev","restored-compact-revision":3360} +{"level":"info","msg":"added member","cluster-id":"a3390e43eb5274e2","local-member-id":"0","added-peer-id":"eb4f6f534361855e","added-peer-peer-urls":["https:/} +{"level":"info","msg":"restored snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/lib/etcd/member/snap"} +``` + +Now `etcd` service should become healthy on the bootstrap node, Kubernetes control plane components +should start and control plane endpoint should become available. +Remaining control plane nodes join `etcd` cluster once control plane endpoint is up. + +## Single Control Plane Node Cluster + +This guide applies to the single control plane clusters as well. +In fact, it is much more important to take regular snapshots of the `etcd` database in single control plane node +case, as loss of the control plane node might render the whole cluster irrecoverable without a backup. diff --git a/website/content/v1.12/advanced/egress-domains.md b/website/content/v1.12/advanced/egress-domains.md new file mode 100644 index 000000000..a1020eea1 --- /dev/null +++ b/website/content/v1.12/advanced/egress-domains.md @@ -0,0 +1,44 @@ +--- +title: "Egress Domains" +description: "Allowing outbound access for installing Talos" +aliases: + - ../guides/egress-domains +--- + +For some more constrained environments, it is important to whitelist only specific domains for outbound internet access. +These rules will need to be updated to allow for certain domains if the user wishes to still install and bootstrap Talos from public sources. +That said, users should also note that all of the following components can be mirrored locally with an internal registry, as well as a self-hosted [discovery service](https://github.com/siderolabs/discovery-service) and [image factory](https://github.com/siderolabs/image-factory). + +The following list of egress domains was tested using a Fortinet FortiGate Next-Generation Firewall to confirm that Talos was installed, bootstrapped, and Kubernetes was fully up and running. +The FortiGate allows for passing in wildcard domains and will handle resolution of those domains to defined IPs automatically. +All traffic is HTTPS over port 443. + +Discovery Service: + +- discovery.talos.dev + +Image Factory: + +- factory.talos.dev +- *.azurefd.net (Azure Front Door for serving cached assets) + +Google Container Registry / Google Artifact Registry (GCR/GAR): + +- gcr.io +- storage.googleapis.com (backing blob storage for images) +- *.pkg.dev (backing blob storage for images) + +Github Container Registry (GHCR) + +- ghcr.io +- *.githubusercontent.com (backing blob storage for images) + +Kubernetes Registry (k8s.io) + +- registry.k8s.io +- *.s3.dualstack.us-east-1.amazonaws.com (backing blob storage for images) + +> Note: In this testing, DNS and NTP servers were updated to use those services that are built-in to the FortiGate. + These may also need to be allowed if the user cannot make use of internal services. + Additionally,these rules only cover that which is required for Talos to be fully installed and running. + There may be other domains like docker.io that must be allowed for non-default CNIs or workload container images. diff --git a/website/content/v1.12/advanced/etcd-maintenance.md b/website/content/v1.12/advanced/etcd-maintenance.md new file mode 100644 index 000000000..4a789b925 --- /dev/null +++ b/website/content/v1.12/advanced/etcd-maintenance.md @@ -0,0 +1,226 @@ +--- +title: "etcd Maintenance" +description: "Operational instructions for etcd database." +--- + +`etcd` database backs Kubernetes control plane state, so `etcd` health is critical for Kubernetes availability. + +> Note: Commands from `talosctl etcd` namespace are functional only on the Talos control plane nodes. +> Each time you see `` in this page, it is referencing IP address of control plane node. + +## Space Quota + +`etcd` default database space quota is set to 2 GiB by default. +If the database size exceeds the quota, `etcd` will stop operations until the issue is resolved. + +This condition can be checked with `talosctl etcd alarm list` command: + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n etcd alarm list +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MEMBER ALARM +172.20.0.2 a49c021e76e707db NOSPACE +{{< /tab >}} +{{< /tabpane >}} + +If the Kubernetes database contains lots of resources, space quota can be increased to match the actual usage. +The recommended maximum size is 8 GiB. + +To increase the space quota, edit the `etcd` section in the machine configuration: + +```yaml +cluster: + etcd: + extraArgs: + quota-backend-bytes: 4294967296 # 4 GiB +``` + +Once the node is rebooted with the new configuration, use `talosctl etcd alarm disarm` to clear the `NOSPACE` alarm. + +## Defragmentation + +`etcd` database can become fragmented over time if there are lots of writes and deletes. +Kubernetes API server performs automatic compaction of the `etcd` database, which marks deleted space as free and ready to be reused. +However, the space is not actually freed until the database is defragmented. + +If the database is heavily fragmented (in use/db size ratio is less than 0.5), defragmentation might increase the performance. +If the database runs over the space quota (see above), but the actual in use database size is small, defragmentation is required to bring the on-disk database size below the limit. + +Current database size can be checked with `talosctl etcd status` command: + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n ,, etcd status +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MEMBER DB SIZE IN USE LEADER RAFT INDEX RAFT TERM RAFT APPLIED INDEX LEARNER ERRORS +172.20.0.3 ecebb05b59a776f1 21 MB 6.0 MB (29.08%) ecebb05b59a776f1 53391 4 53391 false +172.20.0.2 a49c021e76e707db 17 MB 4.5 MB (26.10%) ecebb05b59a776f1 53391 4 53391 false +172.20.0.4 eb47fb33e59bf0e2 20 MB 5.9 MB (28.96%) ecebb05b59a776f1 53391 4 53391 false +{{< /tab >}} +{{< /tabpane >}} + +If any of the nodes are over database size quota, alarms will be printed in the `ERRORS` column. + +To defragment the database, run `talosctl etcd defrag` command: + +```bash +talosctl -n etcd defrag +``` + +> Note: Defragmentation is a resource-intensive operation, so it is recommended to run it on a single node at a time. +> Defragmentation to a live member blocks the system from reading and writing data while rebuilding its state. + +Once the defragmentation is complete, the database size will match closely to the in use size: + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n etcd status +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MEMBER DB SIZE IN USE LEADER RAFT INDEX RAFT TERM RAFT APPLIED INDEX LEARNER ERRORS +172.20.0.2 a49c021e76e707db 4.5 MB 4.5 MB (100.00%) ecebb05b59a776f1 56065 4 56065 false +{{< /tab >}} +{{< /tabpane >}} + +## Snapshotting + +Regular backups of `etcd` database should be performed to ensure that the cluster can be restored in case of a failure. +This procedure is described in the [disaster recovery]({{< relref "disaster-recovery" >}}) guide. + +## Downgrade v3.6 to v3.5 + +Before beginning, check the `etcd` health and download snapshot, as described in [disaster recovery]({{< relref "disaster-recovery" >}}). +Should something go wrong with the downgrade, it is possible to use this backup to rollback to existing `etcd` version. + +This example shows how to downgrade an `etcd` in Talos cluster. + +### Step 1: Check Downgrade Requirements + +Is the cluster healthy and running v3.6.x? + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n ,, etcd status +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MEMBER DB SIZE IN USE LEADER RAFT INDEX RAFT TERM RAFT APPLIED INDEX LEARNER PROTOCOL STORAGE ERRORS +172.20.0.4 a2b8a1f794bdd561 3.6 MB 2.2 MB (61.59%) a49c021e76e707db 4703 2 4703 false 3.6.4 3.6.0 +172.20.0.3 912415ee6ed360c4 3.5 MB 2.2 MB (61.88%) a49c021e76e707db 4703 2 4703 false 3.6.4 3.6.0 +172.20.0.2 a49c021e76e707db 3.5 MB 2.2 MB (62.06%) a49c021e76e707db 4703 2 4703 false 3.6.4 3.6.0 +{{< /tab >}} +{{< /tabpane >}} + +### Step 2: Download Snapshot + +[Download the snapshot backup]({{< relref "disaster-recovery" >}}) to provide a downgrade path should any problems occur. + +### Step 3: Validate Downgrade + +Validate the downgrade target version before enabling the downgrade: + +- We only support downgrading one minor version at a time, e.g. downgrading from v3.6 to v3.4 isn't allowed. +- Please do not move on to next step until the validation is successful. + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n etcd downgrade validate 3.5 +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MESSAGE +172.20.0.2 downgrade validate success, cluster version 3.6 +{{< /tab >}} +{{< /tabpane >}} + +### Step 4: Enable Downgrade + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n etcd downgrade enable 3.5 +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MESSAGE +172.20.0.2 downgrade enable success, cluster version 3.6 +{{< /tab >}} +{{< /tabpane >}} + +After enabling downgrade, the cluster will start to operate with v3.5 protocol, which is the downgrade target version. +In addition, `etcd` will automatically migrate the schema to the downgrade target version, which usually happens very fast. +Confirm the storage version of all servers has been migrated to v3.5 by checking the endpoint status before moving on to the next step. + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n ,, etcd status +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MEMBER DB SIZE IN USE LEADER RAFT INDEX RAFT TERM RAFT APPLIED INDEX LEARNER PROTOCOL STORAGE ERRORS +172.20.0.3 912415ee6ed360c4 3.5 MB 1.9 MB (54.92%) a49c021e76e707db 5152 2 5152 false 3.6.4 3.5.0 +172.20.0.2 a49c021e76e707db 3.5 MB 1.9 MB (54.64%) a49c021e76e707db 5152 2 5152 false 3.6.4 3.5.0 +172.20.0.4 a2b8a1f794bdd561 3.6 MB 1.9 MB (54.44%) a49c021e76e707db 5152 2 5152 false 3.6.4 3.5.0 +{{< /tab >}} +{{< /tabpane >}} + +> Note: Once downgrade is enabled, the cluster will remain operating with v3.5 protocol even if all the servers are still running the v3.6 binary, unless the downgrade is canceled with `talosctl -n downgrade cancel`. + +### Step 5: Patch Machine Config + +Before patching the node, check if the etcd is leader. +We recommend downgrading the leader last. +If the server to be downgraded is the leader, you can avoid some downtime by `forfeit-leadership` to another server before stopping this server. + +```bash +talosctl -n etcd forfeit-leadership +``` + +Create a file with the patch pointing to desired `etcd` image: + +```yaml +# etcd-patch.yaml +cluster: + etcd: + image: gcr.io/etcd-development/etcd:v3.5.22 +``` + +Apply patch to the machine with same configuration but with the new `etcd` version. + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n patch machineconfig --patch @etcd-patch.yaml --mode reboot +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +patched MachineConfigs.config.talos.dev/v1alpha1 at the node 172.20.0.2 +Applied configuration with a reboot +{{< /tab >}} +{{< /tabpane >}} + +Verify that each member, and then the entire cluster, becomes healthy with the new v3.5 `etcd`: + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n ,, etcd status +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MEMBER DB SIZE IN USE LEADER RAFT INDEX RAFT TERM RAFT APPLIED INDEX LEARNER PROTOCOL STORAGE ERRORS +172.20.0.2 a49c021e76e707db 3.5 MB 3.1 MB (88.05%) a2b8a1f794bdd561 13116 4 13116 false 3.5.22 3.5.0 +172.20.0.4 a2b8a1f794bdd561 3.6 MB 3.1 MB (88.12%) a2b8a1f794bdd561 13116 4 13116 false 3.6.4 3.5.0 +172.20.0.3 912415ee6ed360c4 3.5 MB 3.1 MB (88.30%) a2b8a1f794bdd561 13116 4 13116 false 3.6.4 3.5.0 +{{< /tab >}} +{{< /tabpane >}} + +### Step 6: Continue on the Remaining Control Plane Nodes + +When all members are downgraded, check the health and status of the cluster, and confirm the minor version of all members is v3.5, and storage version is empty: + +{{< tabpane >}} +{{< tab header="Command" lang="Bash" >}} +talosctl -n ,, etcd status +{{< /tab >}} +{{< tab header="Output" lang="Console" >}} +NODE MEMBER DB SIZE IN USE LEADER RAFT INDEX RAFT TERM RAFT APPLIED INDEX LEARNER PROTOCOL STORAGE ERRORS +172.20.0.2 a49c021e76e707db 4.5 MB 4.5 MB (100.00%) 912415ee6ed360c4 13865 5 13865 false 3.5.22 3.5.0 +172.20.0.4 a2b8a1f794bdd561 4.6 MB 4.6 MB (100.00%) 912415ee6ed360c4 13865 5 13865 false 3.5.22 3.5.0 +172.20.0.3 912415ee6ed360c4 4.6 MB 4.6 MB (99.64%) 912415ee6ed360c4 13865 5 13865 false 3.5.22 3.5.0 +{{< /tab >}} +{{< /tabpane >}} diff --git a/website/content/v1.12/advanced/extension-services.md b/website/content/v1.12/advanced/extension-services.md new file mode 100644 index 000000000..823227fdb --- /dev/null +++ b/website/content/v1.12/advanced/extension-services.md @@ -0,0 +1,208 @@ +--- +title: "Extension Services" +description: "Use extension services in Talos Linux." +aliases: + - ../learn-more/extension-services +--- + +Talos provides a way to run additional system services early in the Talos boot process. +Extension services should be included into the Talos root filesystem (e.g. using [system extensions]({{< relref "../talos-guides/configuration/system-extensions" >}})). +Extension services run as privileged containers with ephemeral root filesystem located in the Talos root filesystem. + +Extension services can be used to use extend core features of Talos in a way that is not possible via [static pods]({{< relref "../advanced/static-pods" >}}) or +Kubernetes DaemonSets. + +Potential extension services use-cases: + +* storage: Open iSCSI, software RAID, etc. +* networking: BGP FRR, etc. +* platform integration: VMWare open VM tools, etc. + +## Configuration + +Talos on boot scans directory `/usr/local/etc/containers` for `*.yaml` files describing the extension services to run. +Format of the extension service config: + +```yaml +name: hello-world +container: + entrypoint: ./hello-world + environment: + - XDG_RUNTIME_DIR=/run + args: + - -f + mounts: + - # OCI Mount Spec +depends: + - configuration: true + - service: cri + - path: /run/machined/machined.sock + - network: + - addresses + - connectivity + - hostname + - etcfiles + - time: true +restart: never|always|untilSuccess +logToConsole: true|false +``` + +### `name` + +Field `name` sets the service name, valid names are `[a-z0-9-_]+`. +The service container root filesystem path is derived from the `name`: `/usr/local/lib/containers/`. +The extension service will be registered as a Talos service under an `ext-` identifier. + +### `container` + +* `entrypoint` defines the container entrypoint relative to the container root filesystem (`/usr/local/lib/containers/`) +* `environmentFile` (**deprecated**) defines the path to a file containing environment variables, the service waits for the file to + exist before starting. + Use `ExtensionServiceConfig` instead. +* `environment` defines the container environment variables. +* `args` defines the additional arguments to pass to the entrypoint +* `mounts` defines the volumes to be mounted into the container root + +#### `container.mounts` + +The section `mounts` uses the standard OCI spec: + +```yaml +- source: /var/log/audit + destination: /var/log/audit + type: bind + options: + - rshared + - bind + - ro +``` + +All requested directories will be mounted into the extension service container mount namespace. +If the `source` directory doesn't exist in the host filesystem, it will be created (only for writable paths in the Talos root filesystem). + +#### `container.security` + +The section `security` follows this example: + +```yaml +maskedPaths: + - "/should/be/masked" +readonlyPaths: + - "/path/that/should/be/readonly" + - "/another/readonly/path" +writeableRootfs: true +writeableSysfs: true +rootfsPropagation: shared +``` + +> * The rootfs is readonly by default unless `writeableRootfs: true` is set. +> * The sysfs is readonly by default unless `writeableSysfs: true` is set. +> * Masked paths if not set defaults to [containerd defaults](https://github.com/containerd/containerd/tree/main/oci/spec.go). +Masked paths will be mounted to `/dev/null`. +To set empty masked paths use: +> +> ```yaml +> container: +> security: +> maskedPaths: [] +> ``` +> +> * Read Only paths if not set defaults to [containerd defaults](https://github.com/containerd/containerd/tree/main/oci/spec.go). +Read-only paths will be mounted to `/dev/null`. +To set empty read only paths use: +> +> ```yaml +> container: +> security: +> readonlyPaths: [] +> ``` +> +> * Rootfs propagation is not set by default (container mounts are private). + +### `depends` + +The `depends` section describes extension service start dependencies: the service will not be started until all dependencies are met. + +Available dependencies: + +* `service: `: wait for the service `` to be running and healthy +* `path: `: wait for the `` to exist +* `network: [addresses, connectivity, hostname, etcfiles]`: wait for the specified network readiness checks to succeed +* `time: true`: wait for the NTP time sync +* `configuration: true`: wait for `ExtensionServiceConfig` resource with a name matching the extension name to be available. + The mounts specified in the `ExtensionServiceConfig` will be added as extra mounts to the extension service. + +### `restart` + +Field `restart` defines the service restart policy, it allows to either configure an always running service or a one-shot service: + +* `always`: restart service always +* `never`: start service only once and never restart +* `untilSuccess`: restart failing service, stop restarting on successful run + +### `logToConsole` + +Field `logToConsole` defines whether the service logs should also be written to the console, i.e., to kernel log buffer (or to the container logs in container mode). + +This feature is particularly useful for debugging extensions that operate in maintenance mode or early in the boot process when service logs cannot be accessed yet. + +## Example + +Example layout of the Talos root filesystem contents for the extension service: + +```text +/ +└── usr +    └── local +       ├── etc +      │   └── containers +       │     └── hello-world.yaml +       └── lib +           └── containers +          └── hello-world +          ├── hello + └── config.ini +``` + +Talos discovers the extension service configuration in `/usr/local/etc/containers/hello-world.yaml`: + +```yaml +name: hello-world +container: + entrypoint: ./hello + args: + - --config + - config.ini +depends: + - network: + - addresses +restart: always +``` + +Talos starts the container for the extension service with container root filesystem at `/usr/local/lib/containers/hello-world`: + +```text +/ +├── hello +└── config.ini +``` + +Extension service is registered as `ext-hello-world` in `talosctl services`: + +```shell +$ talosctl service ext-hello-world +NODE 172.20.0.5 +ID ext-hello-world +STATE Running +HEALTH ? +EVENTS [Running]: Started task ext-hello-world (PID 1100) for container ext-hello-world (2m47s ago) + [Preparing]: Creating service runner (2m47s ago) + [Preparing]: Running pre state (2m47s ago) + [Waiting]: Waiting for service "containerd" to be "up" (2m48s ago) + [Waiting]: Waiting for service "containerd" to be "up", network (2m49s ago) +``` + +An extension service can be started, restarted and stopped using `talosctl service ext-hello-world start|restart|stop`. +Use `talosctl logs ext-hello-world` to get the logs of the service. + +Complete example of the extension service can be found in the [extensions repository](https://github.com/talos-systems/extensions/tree/main/examples/hello-world-service). diff --git a/website/content/v1.12/advanced/install-kubevirt.md b/website/content/v1.12/advanced/install-kubevirt.md new file mode 100644 index 000000000..b41723391 --- /dev/null +++ b/website/content/v1.12/advanced/install-kubevirt.md @@ -0,0 +1,538 @@ +--- +title: "Install KubeVirt on Talos" +description: "This is a guide on how to get started with KubeVirt on Talos" +--- + +KubeVirt allows you to run virtual machines on Kubernetes. +It runs with QEMU and KVM to provide a seamless virtual machine experience and can be mixed with containerized workloads. +This guide explains on how to install KubeVirt on Talos. + +## Prerequisites + +For KubeVirt and Talos to work you have to enable certain configurations in the BIOS and configure Talos properly for it to work. + +### Enable virtualization in your BIOS + +On many new PCs and servers, virtualization is enabled by default. +Please consult your manufacturer on how to enable this in the BIOS. +You can also run KubeVirt from within a virtual machine. +For that to work you have to enable Nested Virtualization. +This can also be done in the BIOS. + +### Configure your network interface in bridge mode (optional) + +When you want to leverage [Multus]({{< relref "../kubernetes-guides/network/multus" >}}) to give your virtual machines direct access to your node network, your bridge needs to be configured properly. +This can be done by setting your network interface in bridge mode. +You can look up the network interface name by using the following command: + +```bash +$ talosctl get links -n 10.99.101.9 +NODE NAMESPACE TYPE ID VERSION TYPE KIND HW ADDR OPER STATE LINK STATE +10.99.101.9 network LinkStatus bond0 1 ether bond 52:62:01:53:5b:a7 down false +10.99.101.9 network LinkStatus br0 3 ether bridge bc:24:11:a1:98:fc up true +10.99.101.9 network LinkStatus cni0 9 ether bridge 1e:5e:99:8f:1e:19 up true +10.99.101.9 network LinkStatus dummy0 1 ether dummy 62:1c:3e:d5:72:11 down false +10.99.101.9 network LinkStatus eth0 5 ether bc:24:11:a1:98:fc +``` + +In this case, this network interface is called `eth0`. +Now you can configure your bridge properly. +This can be done in the machine config of your node: + +```yaml +machine: + interfaces: + - interface: br0 + addresses: + - 10.99.101.9/24 + bridge: + stp: + enabled: true + interfaces: + - eth0 # This must be changed to your matching interface name + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 10.99.101.254 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. +``` + +### Install the `local-path-provisioner` + +When we are using KubeVirt, we are also installing the CDI (containerized data importer) operator. +For this to work properly, we have to install the `local-path-provisioner`. +This CNI can be used to write scratch space when importing images with the CDI. + +You can install the `local-path-provisioner` by following [this guide]({{< relref "../kubernetes-guides/configuration/local-storage" >}}). + +### Configure storage + +If you would like to use features such as `LiveMigration` shared storage is neccesary. +You can either choose to install a CSI that connects to NFS or you can install Longhorn, for example. +For more information on how to install Longhorn on Talos you can follow [this](https://longhorn.io/docs/1.7.2/advanced-resources/os-distro-specific/talos-linux-support/) link. + +To install the NFS-CSI driver, you can follow [This](https://github.com/kubernetes-csi/csi-driver-nfs/blob/master/docs/install-csi-driver-v4.9.0.md) guide. + +After the installation of the NFS-CSI driver is done, you can create a storage class for the NFS CSI driver to work: + +```yaml +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: nfs-csi + annotations: + storageclass.kubernetes.io/is-default-class: "true" +provisioner: nfs.csi.k8s.io +parameters: + server: 10.99.102.253 + share: /mnt/data/nfs/kubernetes_csi +reclaimPolicy: Delete +volumeBindingMode: Immediate +mountOptions: + - nfsvers=3 + - nolock +``` + +Note that this is just an example. +Make sure to set the `nolock` option. +If not, the nfs-csi storageclass won't work, because talos doesn't have a `rpc.statd` daemon running. + +### Install `virtctl` + +`virtctl` is needed for communication between the CLI and the KubeVirt api server. + +You can install the `virtctl` client directly by running: + +```bash +export VERSION=$(curl https://storage.googleapis.com/kubevirt-prow/release/kubevirt/kubevirt/stable.txt) +wget https://github.com/kubevirt/kubevirt/releases/download/${VERSION}/virtctl-${VERSION}-linux-amd64 +``` + +Or you can use [krew](https://github.com/kubernetes-sigs/krew/#installation) to integrate it nicely in `kubectl`: + +```bash +kubectl krew install virt +``` + +## Installing KubeVirt + +After the neccesary preperations are done, you can now install KubeVirt. +This can either be done through the [Operator Lifecycle Manager](https://olm.operatorframework.io/docs/getting-started/) or by just simply applying a YAML file. +We will keep this simple and do the following: + +```bash +# Point at latest release +export RELEASE=$(curl https://storage.googleapis.com/kubevirt-prow/release/kubevirt/kubevirt/stable.txt) +# Deploy the KubeVirt operator +kubectl apply -f https://github.com/kubevirt/kubevirt/releases/download/${RELEASE}/kubevirt-operator.yaml +``` + +After the operator is installed, it is time to apply the Custom Resource (CR) for the operator to fully deploy KubeVirt. + +```yaml +--- +apiVersion: kubevirt.io/v1 +kind: KubeVirt +metadata: + name: kubevirt + namespace: kubevirt +spec: + configuration: + developerConfiguration: + featureGates: + - LiveMigration + - NetworkBindingPlugins + smbios: + sku: "TalosCloud" + version: "v0.1.0" + manufacturer: "Talos Virtualization" + product: "talosvm" + family: "ccio" + workloadUpdateStrategy: + workloadUpdateMethods: + - LiveMigrate # enable if you have deployed either Longhorn or NFS-CSI for shared storage. +``` + +### KubeVirt configuration options + +In this yaml file we specified certain configurations: + +#### `featureGates` + +KubeVirt has a set of features that are not mature enough to be enabled by default. +As such, they are protected by a Kubernetes concept called feature gates. +More information about the feature gates can be found in the [KubeVirt](https://kubevirt.io/user-guide/cluster_admin/activating_feature_gates/) documentation. + +In this example we enable: + +- `LiveMigration` -- For live migration of virtual machines to other nodes +- `NetworkBindingPlugins` -- This is needed for Multus to work. + +#### `smbios` + +Here we configure a specific smbios configuration. +This can be useful when you want to give your virtual machines a own sku, manufacturer name etc. + +#### `workloadUpdateStrategy` + +If this is configured, virtual machines will be live migrated to other nodes when KubeVirt is updated. + +## Installing CDI + +The CDI (containerized data importer) is needed to import virtual disk images in your KubeVirt cluster. +The CDI can do the following: + +- Import images of type: + - qcow2 + - raw + - iso +- Import disks from either: + - http/https + - uploaded through virtctl + - Container registry + - Another PVC + +You can either import these images by creating a DataVolume CR or by integrating this in your `VirtualMachine` CR. + +When applying either the `DataVolume` CR or the `VirtualMachine` CR with a `dataVolumeTemplates`, the CDI kicks in and will do the following: + +- creates a PVC with the requirements from either the `DataVolume` or the `dataVolumeTemplates` +- starts a pod +- writes temporary scratch space to local disk +- downloads the image +- extracts it to the temporary scratch space +- copies the image to the PVC + +Installing the CDI is very simple: + +```bash +# Point to latest release +export TAG=$(curl -s -w %{redirect_url} \ +https://github.com/kubevirt/containerized-data-importer/releases/latest) + +export VERSION=$(echo ${TAG##*/}) + +# install operator +kubectl create -f \ +https://github.com/kubevirt/containerized-data-importer/releases/download/$VERSION/cdi-operator.yaml +``` + +After that, you can apply a CDI CR for the CDI operator to fully deploy CDI: + +```yaml +apiVersion: cdi.kubevirt.io/v1beta1 +kind: CDI +metadata: + name: cdi +spec: + config: + scratchSpaceStorageClass: local-path + podResourceRequirements: + requests: + cpu: "100m" + memory: "60M" + limits: + cpu: "750m" + memory: "2Gi" +``` + +This CR has some special settings that are needed for CDI to work properly: + +### `scratchSpaceStorageClass` + +This is the storage class that we installed earlier with the `local-path-provisioner`. +This is needed for the CDI to write scratch space to local disk before importing the image + +### `podResourceRequirements` + +In many cases the default resource requests and limits are not sufficient for the importer pod to import the image. +This will result in a crash of the importer pod. + +After applying this yaml file, the CDI operator is ready. + +## Creating your first virtual machine + +Now it is time to create your first virtual machine in KubeVirt. +Below we will describe two examples: + +- A virtual machine with the default CNI +- A virtual machine with Multus + +### Basic virtual machine example with default CNI + +```yaml +--- +apiVersion: kubevirt.io/v1 +kind: VirtualMachine +metadata: + name: fedora-vm +spec: + running: false + template: + metadata: + labels: + kubevirt.io/vm: fedora-vm + annotations: + kubevirt.io/allow-pod-bridge-network-live-migration: "true" + + spec: + evictionStrategy: LiveMigrate + domain: + cpu: + cores: 2 + resources: + requests: + memory: 4G + devices: + disks: + - name: fedora-vm-pvc + disk: + bus: virtio + - name: cloudinitdisk + disk: + bus: virtio + interfaces: + - name: podnet + masquerade: {} + networks: + - name: podnet + pod: {} + volumes: + - name: fedora-vm-pvc + persistentVolumeClaim: + claimName: fedora-vm-pvc + - name: cloudinitdisk + cloudInitNoCloud: + networkData: | + network: + version: 1 + config: + - type: physical + name: eth0 + subnets: + - type: dhcp + userData: |- + #cloud-config + users: + - name: cloud-user + ssh_authorized_keys: + - ssh-rsa .... + sudo: ['ALL=(ALL) NOPASSWD:ALL'] + groups: sudo + shell: /bin/bash + runcmd: + - "sudo touch /root/installed" + - "sudo dnf update" + - "sudo dnf install httpd fastfetch -y" + - "sudo systemctl daemon-reload" + - "sudo systemctl enable httpd" + - "sudo systemctl start --no-block httpd" + + dataVolumeTemplates: + - metadata: + name: fedora-vm-pvc + spec: + storage: + resources: + requests: + storage: 35Gi + accessModes: + - ReadWriteMany + storageClassName: "nfs-csi" + source: + http: + url: "https://fedora.mirror.wearetriple.com/linux/releases/40/Cloud/x86_64/images/Fedora-Cloud-Base-Generic.x86_64-40-1.14.qcow2" +``` + +In this examples we install a basic Fedora 40 virtual machine and install a webserver. + +After applying this YAML, the CDI will import the image and create a `Datavolume`. +You can monitor this process by running: + +```bash +kubectl get dv -w +``` + +After the `DataVolume` is created, you can start the virtual machine: + +```bash +kubectl virt start fedora-vm +``` + +By starting the virtual machine, KubeVirt will create a instance of that `VirtualMachine` called `VirtualMachineInstance`: + +```bash +kubectl get virtualmachineinstance +NAME AGE PHASE IP NODENAME READY +fedora-vm 13s Running 10.244.4.92 kube1 True +``` + +You can view the console of the virtual machine by running: + +```bash +kubectl virt console fedora-vm +``` + +or by running: + +```bash +kubectl virt vnc fedora-vm +``` + +with the `console` command it will open a terminal to the virtual machine. +With the `vnc` command, it will open `vncviewer`. +Note that a `vncviewer` needs to installed for it to work. + +Now you can create a `Service` object to expose the virtual machine to the outside. +In this example we will use [MetalLB](https://metallb.universe.tf/) as a LoadBalancer. + +```yaml +apiVersion: v1 +kind: Service +metadata: + labels: + kubevirt.io/vm: fedora-vm + name: fedora-vm +spec: + ipFamilyPolicy: PreferDualStack + externalTrafficPolicy: Local + ports: + - name: ssh + port: 22 + protocol: TCP + targetPort: 22 + - name: httpd + port: 80 + protocol: TCP + targetPort: 80 + selector: + kubevirt.io/vm: fedora-vm + type: LoadBalancer +``` + +```bash +$ kubectl get svc +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +fedora-vm LoadBalancer 10.96.14.253 10.99.50.1 22:31149/TCP,80:31445/TCP 2s +``` + +And we can reach the server with either ssh or http: + +```bash +$ nc -zv 10.99.50.1 22 +Ncat: Version 7.92 ( https://nmap.org/ncat ) +Ncat: Connected to 10.99.50.1:22. +Ncat: 0 bytes sent, 0 bytes received in 0.01 seconds. + +$ nc -zv 10.99.50.1 80 +Ncat: Version 7.92 ( https://nmap.org/ncat ) +Ncat: Connected to 10.99.50.1:80. +Ncat: 0 bytes sent, 0 bytes received in 0.01 seconds. +``` + +### Basic virtual machine example with Multus + +```yaml +--- +apiVersion: kubevirt.io/v1 +kind: VirtualMachine +metadata: + name: fedora-vm +spec: + running: false + template: + metadata: + labels: + kubevirt.io/vm: fedora-vm + annotations: + kubevirt.io/allow-pod-bridge-network-live-migration: "true" + + spec: + evictionStrategy: LiveMigrate + domain: + cpu: + cores: 2 + resources: + requests: + memory: 4G + devices: + disks: + - name: fedora-vm-pvc + disk: + bus: virtio + - name: cloudinitdisk + disk: + bus: virtio + interfaces: + - name: external + bridge: {} # We use the bridge interface. + networks: + - name: external + multus: + networkName: namespace/networkattachmentdefinition # This is the NetworkAttachmentDefinition. See multus docs for more info. + volumes: + - name: fedora-vm-pvc + persistentVolumeClaim: + claimName: fedora-vm-pvc + - name: cloudinitdisk + cloudInitNoCloud: + networkData: | + network: + version: 1 + config: + - type: physical + name: eth0 + subnets: + - type: dhcp + userData: |- + #cloud-config + users: + - name: cloud-user + ssh_authorized_keys: + - ssh-rsa .... + sudo: ['ALL=(ALL) NOPASSWD:ALL'] + groups: sudo + shell: /bin/bash + runcmd: + - "sudo touch /root/installed" + - "sudo dnf update" + - "sudo dnf install httpd fastfetch -y" + - "sudo systemctl daemon-reload" + - "sudo systemctl enable httpd" + - "sudo systemctl start --no-block httpd" + + dataVolumeTemplates: + - metadata: + name: fedora-vm-pvc + spec: + storage: + resources: + requests: + storage: 35Gi + accessModes: + - ReadWriteMany + storageClassName: "nfs-csi" + source: + http: + url: "https://fedora.mirror.wearetriple.com/linux/releases/40/Cloud/x86_64/images/Fedora-Cloud-Base-Generic.x86_64-40-1.14.qcow2" +``` + +In this example we will create a virtual machine that is bound to the bridge interface with the help of [Multus]({{< relref "../kubernetes-guides/network/multus" >}}). +You can start the machine with `kubectl virt start fedora-vm`. +After that you can look up the ip address of the virtual machine with + +```bash +kubectl get vmi -owide + +NAME AGE PHASE IP NODENAME READY LIVE-MIGRATABLE PAUSED +fedora-vm 6d9h Running 10.99.101.53 kube1 True True +``` + +## Other forms of management + +There is a project called [KubeVirt-Manager](https://kubevirt-manager.io/) for managing virtual machines with KubeVirt through a nice web interface. +You can also choose to deploy virtual machines with ArgoCD or Flux. + +## Documentation + +KubeVirt has a huge documentation page where you can check out everything on running virtual machines with KubeVirt. +The documentation can be found [here](https://kubevirt.io/user-guide/). diff --git a/website/content/v1.12/advanced/kernel-module.md b/website/content/v1.12/advanced/kernel-module.md new file mode 100644 index 000000000..3272a912b --- /dev/null +++ b/website/content/v1.12/advanced/kernel-module.md @@ -0,0 +1,314 @@ +--- +title: "Adding a Kernel Module" +description: "Create a system extension that includes kernel modules." +--- + +[System extensions]({{< relref "../talos-guides/configuration/system-extensions" >}}) in Talos provide ways to add files to the root filesystem and make it possible to run privileged containers as services. +But Talos still requires that kernel modules be signed with a trusted signing key to be loaded at run time. + +To add a kernel module to Talos you will need to create a system extension that is built with the kernel and signed by the same signing key. +System extensions without kernel modules work without this requirement, but there are a couple extra steps needed when adding kernel modules. + +## Create a package hello + +Talos is built from the [pkgs](https://github.com/siderolabs/pkgs/) repo and the first step will be to add your custom package to that repo to be built with Talos. +You can look at other packages in that repository for examples of what should be included. + +The only file required to create a package is a pkg.yaml file in a folder. +Let's create an example package to walk through each step. + +Clone the repo and create a folder. + +```bash +git clone https://github.com/siderolabs/pkgs.git +cd pkgs +mkdir my-module +``` + +Now add the package to the `.kres.yaml` file in the root of the repository. +We use this file for templating and generating Makefiles. +Put your out-of-tree kernel module below the comment for dependent packages. + +```yaml + spec: + targets: + ... + # - kernel & dependent packages (out of tree kernel modules) + # kernel first, then packages in alphabetical order + ... + - my-module-pkg + ... +``` + +Run the following command to generate a new Makefile. + +```bash +make rekres +``` + +Now you have a `make` target to build your module and a directory to store your module configuration. +The next step is to create a `pkg.yaml` file to tell [`bldr`](https://github.com/siderolabs/bldr) how to create a container with the files you need. +The `bldr` tool has assumptions about directory structure and steps you can read about in the GitHub repo. + +This example does not build a kernel module, but it can be used as a basis for your own packages. +Please also see existing pkg.yaml files in [the pkgs repo](https://github.com/siderolabs/pkgs) + +```bash +name: my-module-pkg # name of your package +variant: scratch # base container for environment (e.g. alpine, scratch) +shell: /bin/sh # shell to use to execute commands in steps +dependencies: # other steps required before building package + - stage: base +steps: # steps needed to build package container + - sources: # download source files + - url: https://example.com/source.tar.gz + destination: my-module.tar.gz + sha256: 1234abcd... + sha521: abcd1234... + prepare: # create directories and untar + - tar -xzf my-module.tar.gz --strip-components=1 + build: # compiling software + - make -j $(nproc) + install: # move compiled software to correct directory + - make DESTDIR=/rootfs install + test: # validate software + - fhs-validator /rootfs +finalize: # copy directory structure from source to destination + - from: /rootfs + to: / +``` + +## Build the package and kernel + +After you've created a pkg.yaml file you can test building your package with the make target you generated earlier. +Because Talos requires kernel modules to be signed with a signing key only available during the Talos kernel build process we need to build the kernel and package at the same time. + +We also need a container registry available to store the built assets. +Follow the steps in [developing Talos]({{< relref "../advanced/developing-talos#prepare" >}}) to create a docker builder and run a local container registry before running this command. + +```bash +make kernel my-module-pkg REGISTRY=127.0.0.1:5005 \ + PLATFORM=linux/amd64 \ + PUSH=true +``` + +If this is successful it should output two pieces of information we need to collect for the next steps. +We need to save the kernel and package images. +The output will look something like this: + +```bash +=> => pushing manifest for 127.0.0.1:5005/user/kernel:v1.11.0-alpha.0... +... +=> => pushing manifest for 127.0.0.1:5005/user/my-module-pkg:v1.11.0-alpha.0... +``` + +For easier reference in this guide I will save these images as `$KERNEL_IMAGE` and `$PKG_IMAGE` variables. + +## Create an extension + +System extensions are the way to add software and files to a Talos Linux root filesystem. +Just like packages they are built as containers and then layered with Talos to create a bootable squashfs image. + +The only unique thing about building a system extension with a kernel module is we need to build it against the kernel we just built in the previous step. +If we don't do this then our kernel module won't be signed and cannot be loaded at runtime. + +The process is very similar to creating a package. +Start by cloning the extensions repo: + +```bash +git clone https://github.com/siderolabs/extensions +cd extensions +mkdir my-module +``` + +Add your extension to the `.kres.yaml` file. + +```yaml +--- +kind: pkgfile.Build +spec: + targets: + ... + - my-module + ... +``` + +Then generate a new Makefile with additional target. + +```bash +make rekres +``` + +Now create the `manifest.yaml` file for the metadata of your extension in the my-module folder. + +```yaml +version: v1alpha1 # version of manifest.yaml +metadata: + name: my-module + version: 0.1 + author: me + description: | + An extension that adds a kernel module + compatibility: + talos: + version: ">= v1.10.0" # what version of Talos is supported +``` + +Create a pkg.yaml file in the my-module folder which works similarly to our pkg.yaml file for our package, but this time starts from the base image we built in the first step. +The local directory is mounted into the container at `/pkg` so we can copy files from that directory. + +```yaml +name: my-module +variant: scratch +shell: /bin/sh +dependencies: + - stage: base + - image: "${PKG_IMAGE}" # the image we built in the first step +steps: + - install: + - mkdir -p /rootfs/usr/lib/modules + - cp -R /usr/lib/modules/* /rootfs/usr/lib/modules/ +finalize: + - from: /rootfs + to: /rootfs + - from: /pkg/manifest.yaml # make sure you add the metadata file + to: / +``` + +Lastly create a vars.yaml file to store a version variable in the my-module folder. +This isn't strictly required, but it is a convention used which will let the automated build work. + +```bash +echo 'VERSION: "0.1"' > vars.yaml +``` + +## Build extension + +You now have a complete extension config and can build it with the kernel from your previous pkg build. + +```bash +make my-module REGISTRY=127.0.0.1:5005 \ + PLATFORM=linux/amd64 \ + PUSH=true +``` + +This will create a system extension image and push it to your local registry. +Copy the image that get's pushed and save it as `${EXTENSION_IMAGE}`. + +```bash + export EXTENSION_IMAGE='127.0.0.1:5005/jgarr/my-module:0.1@sha256:e8f3352...' +``` + +## Test the extension + +Now we need to create installation media to boot Talos. +We will build and use [imager]({{< relref "../talos-guides/install/boot-assets#imager" >}}) to include our extension. + +Clone the Talos repo. + +```bash +git clone https://github.com/siderolabs/talos +cd talos +``` + +Build the installer, and remember to use the kernel image from the first step. + +```bash +make installer-base imager PLATFORM=linux/amd64 \ + INSTALLER_ARCH=amd64 \ + REGISTRY=127.0.0.1:5005 \ + PKG_KERNEL=${KERNEL_IMAGE} \ + PUSH=true +``` + +This will create two images - installer-base and imager and push them to your local registry. +Export the installer-base image and save it as `$BASE_INSTALLER_IMAGE`. + +Create an installer image from your extension and the installer-base you just created with the following command. + +```bash +make image-installer \ + REGISTRY=127.0.0.1:5005 \ + IMAGER_ARGS="--base-installer-image=${BASE_INSTALLER_IMAGE} \ + --system-extension-image=${EXTENSION_IMAGE}" +``` + +We'll have a new container image tar file in the `_out/` folder of our repository. +Load and push the container image to a registry with [crane](https://github.com/google/go-containerregistry/blob/main/cmd/crane/doc/crane.md). +Make sure you replace `$REGISTRY`, `$USER`, and `$TAG` with the values you want. + +```bash +crane push _out/installer-amd64.tar $REGISTRY/$USER/installer:$TAG +``` + +And if you don't have `crane`: + +```bash +docker load -i _out/installer-amd64.tar +# note down sha256 or the image tag output from above command + +docker tag $SHA256_OR_IMAGE_TAG $REGISTRY/$USER/installer:$TAG +docker push $REGISTRY/$USER/installer:$TAG +``` + +## Test the installer with fresh install + +Now you can boot a machine from generic Talos installation media. +This is only used to get access to the API so we can apply a configuration that will use our installer image. +We'll assume this machine has an IP address of 192.168.100.100 + +Generate a configuration that uses your installer image. + +```bash +talosctl gen config --install-image $REGISTRY/$USER/installer:$TAG \ + test https://192.168.100.100:6443 # cluster name and endpoint +``` + +Now create a configuration patch that loads your kernel module by name. +This should be the name of the `.ko` file you built in the package and put in the `/modules` directory. + +```yaml +# my-module.yaml +machine: + kernel: + modules: + - name: my-module +``` + +Apply the machine config and patch to your test machine. + +```bash +talosctl apply -f controlplane.yaml -i -p '@my-module.yaml' -n 192.168.100.100 +``` + +The machine will reboot as Talos is installed. +When the machine boots you should see logs that the module was loaded from dmesg. + +```bash +192.168.100.100: kern: warning: my-module: loading out-of-tree module taints kernel. +192.168.100.100: kern: info: Loading my-module driver module v0.1 +``` + +## Test installer with existing machine + +If you already have Talos running on a machine you can apply the installer during an upgrade to have the extension installed. + +```bash +talosctl upgrade -i $REGISTRY/$USER/installer:$TAG +``` + +Make sure you still create a patch to load the kernel module and apply it to the machine. + +```yaml +# my-module.yaml +machine: + kernel: + modules: + - name: my-module +``` + +Apply the machine config and patch to your test machine. + +```bash +talosctl apply -f controlplane.yaml -p '@my-module.yaml' +``` diff --git a/website/content/v1.12/advanced/machine-config-oauth.md b/website/content/v1.12/advanced/machine-config-oauth.md new file mode 100644 index 000000000..53be49420 --- /dev/null +++ b/website/content/v1.12/advanced/machine-config-oauth.md @@ -0,0 +1,83 @@ +--- +title: "Machine Configuration OAuth2 Authentication" +description: "How to authenticate Talos machine configuration download (`talos.config=`) on `metal` platform using OAuth." +--- + +Talos Linux when running on the `metal` platform can be configured to authenticate the machine configuration download using OAuth2 device flow. +The machine configuration is fetched from the URL specified with `talos.config` kernel argument, and by default this HTTP request is not authenticated. +When the OAuth2 authentication is enabled, Talos will authenticate the request using OAuth device flow first, and then pass the token to the machine configuration download endpoint. + +## Prerequisites + +Obtain the following information: + +* OAuth client ID (mandatory) +* OAuth client secret (optional) +* OAuth device endpoint +* OAuth token endpoint +* OAuth scopes, audience (optional) +* OAuth client secret (optional) +* extra Talos variables to send to the device auth endpoint (optional) + +## Configuration + +Set the following kernel parameters on the initial Talos boot to enable the OAuth flow: + +* `talos.config` set to the URL of the machine configuration endpoint (which will be authenticated using OAuth) +* `talos.config.oauth.client_id` set to the OAuth client ID (required) +* `talos.config.oauth.client_secret` set to the OAuth client secret (optional) +* `talos.config.oauth.scope` set to the OAuth scopes (optional, repeat the parameter for multiple scopes) +* `talos.config.oauth.audience` set to the OAuth audience (optional) +* `talos.config.oauth.device_auth_url` set to the OAuth device endpoint (if not set defaults to `talos.config` URL with the path `/device/code`) +* `talos.config.oauth.token_url` set to the OAuth token endpoint (if not set defaults to `talos.config` URL with the path `/token`) +* `talos.config.oauth.extra_variable` set to the extra Talos variables to send to the device auth endpoint (optional, repeat the parameter for multiple variables) + +The list of variables supported by the `talos.config.oauth.extra_variable` parameter is same as the [list of variables]({{< relref "../reference/kernel#talosconfig" >}}) supported by the `talos.config` parameter. + +## Flow + +On the initial Talos boot, when machine configuration is not available, Talos will print the following messages: + +```text +[talos] downloading config {"component": "controller-runtime", "controller": "config.AcquireController", "platform": "metal"} +[talos] waiting for network to be ready +[talos] [OAuth] starting the authentication device flow with the following settings: +[talos] [OAuth] - client ID: "" +[talos] [OAuth] - device auth URL: "https://oauth2.googleapis.com/device/code" +[talos] [OAuth] - token URL: "https://oauth2.googleapis.com/token" +[talos] [OAuth] - extra variables: ["uuid" "mac"] +[talos] waiting for variables: [uuid mac] +[talos] waiting for variables: [mac] +[talos] [OAuth] please visit the URL https://www.google.com/device and enter the code +[talos] [OAuth] waiting for the device to be authorized (expires at 14:46:55)... +``` + +If the OAuth service provides the complete verification URL, the QR code to scan is also printed to the console: + +```text +[talos] [OAuth] or scan the following QR code: +█████████████████████████████████ +█████████████████████████████████ +████ ▄▄▄▄▄ ██▄▀▀ ▀█ ▄▄▄▄▄ ████ +████ █ █ █▄ ▀▄██▄██ █ █ ████ +████ █▄▄▄█ ██▀▄██▄ ▀█ █▄▄▄█ ████ +████▄▄▄▄▄▄▄█ ▀ █ ▀ █▄█▄▄▄▄▄▄▄████ +████ ▀ ▄▄ ▄█ ██▄█ ███▄█▀████ +████▀█▄ ▄▄▀▄▄█▀█▄██ ▄▀▄██▄ ▄████ +████▄██▀█▄▄▄███▀ ▀█▄▄ ██ █▄ ████ +████▄▀▄▄▄ ▄███ ▄ ▀ ▀▀▄▀▄▀█▄ ▄████ +████▄█████▄█ █ ██ ▀ ▄▄▄ █▀▀████ +████ ▄▄▄▄▄ █ █ ▀█▄█▄ █▄█ █▄ ████ +████ █ █ █▄ ▄▀ ▀█▀▄▄▄ ▀█▄████ +████ █▄▄▄█ █ ██▄ ▀ ▀███ ▀█▀▄████ +████▄▄▄▄▄▄▄█▄▄█▄██▄▄▄▄█▄███▄▄████ +█████████████████████████████████ +``` + +Once the authentication flow is complete on the OAuth provider side, Talos will print the following message: + +```text +[talos] [OAuth] device authorized +[talos] fetching machine config from: "http://example.com/config.yaml" +[talos] machine config loaded successfully {"component": "controller-runtime", "controller": "config.AcquireController", "sources": ["metal"]} +``` diff --git a/website/content/v1.12/advanced/metal-network-configuration.md b/website/content/v1.12/advanced/metal-network-configuration.md new file mode 100644 index 000000000..1725ca1ea --- /dev/null +++ b/website/content/v1.12/advanced/metal-network-configuration.md @@ -0,0 +1,420 @@ +--- +title: "Metal Network Configuration" +description: "How to use `META`-based network configuration on Talos `metal` platform." +--- + +> Note: This is an advanced feature which requires deep understanding of Talos and Linux network configuration. + +Talos Linux when running on a cloud platform (e.g. AWS or Azure), uses the platform-provided metadata server to provide initial network configuration to the node. +When running on bare-metal, there is no metadata server, so there are several options to provide initial network configuration (before machine configuration is acquired): + +- use automatic network configuration via DHCP (Talos default) +- use initial boot [kernel command line parameters]({{< relref "../reference/kernel" >}}) to configure networking +- use automatic network configuration via DHCP just enough to fetch machine configuration and then use machine configuration to set desired advanced configuration. + +If DHCP option is available, it is by far the easiest way to configure networking. +The initial boot kernel command line parameters are not very flexible, and they are not persisted after initial Talos installation. + +Talos starting with version 1.4.0 offers a new option to configure networking on bare-metal: `META`-based network configuration. + +> Note: `META`-based network configuration is only available on Talos Linux `metal` platform. + +Talos [dashboard]({{< relref "../talos-guides/interactive-dashboard" >}}) provides a way to configure `META`-based network configuration for a machine using the console, but +it doesn't support all kinds of network configuration. + +## Network Configuration Format + +Talos `META`-based network configuration is a YAML file with the following format: + +```yaml +addresses: + - address: 147.75.61.43/31 + linkName: bond0 + family: inet4 + scope: global + flags: permanent + layer: platform + - address: 2604:1380:45f2:6c00::1/127 + linkName: bond0 + family: inet6 + scope: global + flags: permanent + layer: platform + - address: 10.68.182.1/31 + linkName: bond0 + family: inet4 + scope: global + flags: permanent + layer: platform +links: + - name: eth0 + up: true + masterName: bond0 + slaveIndex: 0 + layer: platform + - name: eth1 + up: true + masterName: bond0 + slaveIndex: 1 + layer: platform + - name: bond0 + logical: true + up: true + mtu: 0 + kind: bond + type: ether + bondMaster: + mode: 802.3ad + xmitHashPolicy: layer3+4 + lacpRate: slow + arpValidate: none + arpAllTargets: any + primaryReselect: always + failOverMac: 0 + miimon: 100 + updelay: 200 + downdelay: 200 + resendIgmp: 1 + lpInterval: 1 + packetsPerSlave: 1 + numPeerNotif: 1 + tlbLogicalLb: 1 + adActorSysPrio: 65535 + layer: platform +routes: + - family: inet4 + gateway: 147.75.61.42 + outLinkName: bond0 + table: main + priority: 1024 + scope: global + type: unicast + protocol: static + layer: platform + - family: inet6 + gateway: '2604:1380:45f2:6c00::' + outLinkName: bond0 + table: main + priority: 2048 + scope: global + type: unicast + protocol: static + layer: platform + - family: inet4 + dst: 10.0.0.0/8 + gateway: 10.68.182.0 + outLinkName: bond0 + table: main + scope: global + type: unicast + protocol: static + layer: platform +hostnames: + - hostname: ci-blue-worker-amd64-2 + layer: platform +resolvers: [] +timeServers: [] +``` + +Every section is optional, so you can configure only the parts you need. +The format of each section matches the respective network [`*Spec` resource]({{< relref "../learn-more/networking-resources" >}}) `.spec` part, e.g the `addresses:` +section matches the `.spec` of `AddressSpec` resource: + +```yaml +# talosctl get addressspecs bond0/10.68.182.1/31 -o yaml | yq .spec +address: 10.68.182.1/31 +linkName: bond0 +family: inet4 +scope: global +flags: permanent +layer: platform +``` + +So one way to prepare the network configuration file is to boot Talos Linux, apply necessary network configuration using Talos machine configuration, and grab the resulting +resources from the running Talos instance. + +In this guide we will briefly cover the most common examples of the network configuration. + +### Addresses + +The addresses configured are usually routable IP addresses assigned to the machine, so +the `scope:` should be set to `global` and `flags:` to `permanent`. +Additionally, `family:` should be set to either `inet4` or `inet6` depending on the address family. + +The `linkName:` property should match the name of the link the address is assigned to, it might be a physical link, +e.g. `en9sp0`, or the name of a logical link, e.g. `bond0`, created in the `links:` section. + +Example, IPv4 address: + +```yaml +addresses: + - address: 147.75.61.43/31 + linkName: bond0 + family: inet4 + scope: global + flags: permanent + layer: platform +``` + +Example, IPv6 address: + +```yaml +addresses: + - address: 2604:1380:45f2:6c00::1/127 + linkName: bond0 + family: inet6 + scope: global + flags: permanent + layer: platform +``` + +### Links + +For physical network interfaces (links), the most usual configuration is to bring the link up: + +```yaml +links: + - name: en9sp0 + up: true + layer: platform +``` + +This will bring the link up, and it will also disable Talos auto-configuration (disables running DHCP on the link). + +Another common case is to set a custom MTU: + +```yaml +links: + - name: en9sp0 + up: true + mtu: 9000 + layer: platform +``` + +The order of the links in the `links:` section is not important. + +#### Bonds + +For bonded links, there should be a link resource for the bond itself, and a link resource for each enslaved link: + +```yaml +links: + - name: bond0 + logical: true + up: true + kind: bond + type: ether + bondMaster: + mode: 802.3ad + xmitHashPolicy: layer3+4 + lacpRate: slow + arpValidate: none + arpAllTargets: any + primaryReselect: always + failOverMac: 0 + miimon: 100 + updelay: 200 + downdelay: 200 + resendIgmp: 1 + lpInterval: 1 + packetsPerSlave: 1 + numPeerNotif: 1 + tlbLogicalLb: 1 + adActorSysPrio: 65535 + layer: platform + - name: eth0 + up: true + masterName: bond0 + slaveIndex: 0 + layer: platform + - name: eth1 + up: true + masterName: bond0 + slaveIndex: 1 + layer: platform +``` + +The name of the bond can be anything supported by Linux kernel, but the following properties are important: + +- `logical: true` - this is a logical link, not a physical one +- `kind: bond` - this is a bonded link +- `type: ether` - this is an Ethernet link +- `bondMaster:` - defines bond configuration, please see Linux documentation on the available options + +For each enslaved link, the following properties are important: + +- `masterName: bond0` - the name of the bond this link is enslaved to +- `slaveIndex: 0` - the index of the enslaved link, starting from 0, controls the order of bond slaves + +#### VLANs + +VLANs are logical links which have a parent link, and a VLAN ID and protocol: + +```yaml +links: + - name: bond0.35 + logical: true + up: true + kind: vlan + type: ether + parentName: bond0 + vlan: + vlanID: 35 + vlanProtocol: 802.1ad +``` + +The name of the VLAN link can be anything supported by Linux kernel, but the following properties are important: + +- `logical: true` - this is a logical link, not a physical one +- `kind: vlan` - this is a VLAN link +- `type: ether` - this is an Ethernet link +- `parentName: bond0` - the name of the parent link +- `vlan:` - defines VLAN configuration: `vlanID` and `vlanProtocol` + +### Routes + +For route configuration, most of the time `table: main`, `scope: global`, `type: unicast` and `protocol: static` are used. + +The route most important fields are: + +- `dst:` defines the destination network, if left empty means "default gateway" +- `gateway:` defines the gateway address +- `priority:` defines the route priority (metric), lower values are preferred for the same `dst:` network +- `outLinkName:` defines the name of the link the route is associated with +- `src:` sets the source address for the route (optional) + +Additionally, `family:` should be set to either `inet4` or `inet6` depending on the address family. + +Example, IPv6 default gateway: + +```yaml +routes: + - family: inet6 + gateway: '2604:1380:45f2:6c00::' + outLinkName: bond0 + table: main + priority: 2048 + scope: global + type: unicast + protocol: static + layer: platform +``` + +Example, IPv4 route to `10/8` via `10.68.182.0` gateway: + +```yaml +routes: + - family: inet4 + dst: 10.0.0.0/8 + gateway: 10.68.182.0 + outLinkName: bond0 + table: main + scope: global + type: unicast + protocol: static + layer: platform +``` + +### Hostnames + +Even though the section supports multiple hostnames, only a single one should be used: + +```yaml +hostnames: + - hostname: host + domainname: some.org + layer: platform +``` + +The `domainname:` is optional. + +If the hostname is not set, Talos will use default generated hostname. + +### Resolvers + +The `resolvers:` section is used to configure DNS resolvers, only single entry should be used: + +```yaml +resolvers: + - dnsServers: + - 8.8.8.8 + - 1.1.1.1 + layer: platform +``` + +If the `dnsServers:` is not set, Talos will use default DNS servers. + +### Time Servers + +The `timeServers:` section is used to configure NTP time servers, only single entry should be used: + +```yaml +timeServers: + - timeServers: + - 169.254.169.254 + layer: platform +``` + +If the `timeServers:` is not set, Talos will use default NTP servers. + +## Supplying `META` Network Configuration + +Once the network configuration YAML document is ready, it can be supplied to Talos in one of the following ways: + +- for a running Talos machine, using Talos API (requires already established network connectivity) +- for Talos disk images, it can be embedded into the image +- for ISO/PXE boot methods, it can be supplied via kernel command line parameters as an environment variable + +The metal network configuration is stored in Talos `META` partition under the key `0xa` (decimal 10). + +In this guide we will assume that the prepared network configuration is stored in the file `network.yaml`. + +> Note: as JSON is a subset of YAML, the network configuration can be also supplied as a JSON document. + +### Supplying Network Configuration to a Running Talos Machine + +Use the `talosctl` to write a network configuration to a running Talos machine: + +```bash +talosctl meta write 0xa "$(cat network.yaml)" +``` + +### Supplying Network Configuration to a Talos Disk Image + +Following the [boot assets]({{< relref "../talos-guides/install/boot-assets" >}}) guide, create a disk image passing the network configuration as a `--meta` flag: + +```bash +docker run --rm -t -v $PWD/_out:/out -v /dev:/dev --privileged ghcr.io/siderolabs/imager:{{< release >}} metal --meta "0xa=$(cat network.yaml)" +``` + +### Supplying Network Configuration to a Talos ISO/PXE Boot + +As there is no `META` partition created yet before Talos Linux is installed, `META` values can be set as an environment variable `INSTALLER_META_BASE64` passed to the initial boot of Talos. +The supplied value will be used immediately, and also it will be written to the `META` partition once Talos is installed. + +When using `imager` to create the ISO, the `INSTALLER_META_BASE64` environment variable will be automatically generated from the `--meta` flag: + +```bash +$ docker run --rm -t -v $PWD/_out:/out ghcr.io/siderolabs/imager:{{< release >}} iso --meta "0xa=$(cat network.yaml)" +... +kernel command line: ... talos.environment=INSTALLER_META_BASE64=MHhhPWZvbw== +``` + +When PXE booting, the value of `INSTALLER_META_BASE64` should be set manually: + +```bash +echo -n "0xa=$(cat network.yaml)" | gzip -9 | base64 +``` + +The resulting base64 string should be passed as an environment variable `INSTALLER_META_BASE64` to the initial boot of Talos: `talos.environment=INSTALLER_META_BASE64=`. + +### Getting Current `META` Network Configuration + +Talos exports `META` keys as resources: + +```yaml +# talosctl get meta 0x0a -o yaml +... +spec: + value: '{"addresses": ...}' +``` diff --git a/website/content/v1.12/advanced/migrating-from-kubeadm.md b/website/content/v1.12/advanced/migrating-from-kubeadm.md new file mode 100644 index 000000000..f596c8c11 --- /dev/null +++ b/website/content/v1.12/advanced/migrating-from-kubeadm.md @@ -0,0 +1,150 @@ +--- +title: "Migrating from Kubeadm" +description: "Migrating Kubeadm-based clusters to Talos." +aliases: + - ../guides/migrating-from-kubeadm +--- + +It is possible to migrate Talos from a cluster that is created using +[kubeadm](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) to Talos. + +High-level steps are the following: + +1. Collect CA certificates and a bootstrap token from a control plane node. +2. Create a Talos machine config with the CA certificates with the ones you collected. +3. Update control plane endpoint in the machine config to point to the existing control plane (i.e. your load balancer address). +4. Boot a new Talos machine and apply the machine config. +5. Verify that the new control plane node is ready. +6. Remove one of the old control plane nodes. +7. Repeat the same steps for all control plane nodes. +8. Verify that all control plane nodes are ready. +9. Repeat the same steps for all worker nodes, using the machine config generated for the workers. + +## Remarks on kube-apiserver load balancer + +While migrating to Talos, you need to make sure that your kube-apiserver load balancer is in place +and keeps pointing to the correct set of control plane nodes. + +This process depends on your load balancer setup. + +If you are using an LB that is external to the control plane nodes (e.g. cloud provider LB, F5 BIG-IP, etc.), +you need to make sure that you update the backend IPs of the load balancer to point to the control plane nodes as +you add Talos nodes and remove kubeadm-based ones. + +If your load balancing is done on the control plane nodes (e.g. keepalived + haproxy on the control plane nodes), +you can do the following: + +1. Add Talos nodes and remove kubeadm-based ones while updating the haproxy backends + to point to the newly added nodes except the last kubeadm-based control plane node. +2. Turn off keepalived to drop the virtual IP used by the kubeadm-based nodes (introduces kube-apiserver downtime). +3. Set up a virtual-IP based new load balancer on the new set of Talos control plane nodes. + Use the previous LB IP as the LB virtual IP. +4. Verify apiserver connectivity over the Talos-managed virtual IP. +5. Migrate the last control-plane node. + +## Prerequisites + +- Admin access to the kubeadm-based cluster +- Access to the `/etc/kubernetes/pki` directory (e.g. SSH & root permissions) + on the control plane nodes of the kubeadm-based cluster +- Access to kube-apiserver load-balancer configuration + +## Step-by-step guide + +1. Download `/etc/kubernetes/pki` directory from a control plane node of the kubeadm-based cluster. + +2. Create a new join token for the new control plane nodes: + + ```bash + # inside a control plane node + kubeadm token create --ttl 0 + ``` + +3. Create Talos secrets from the PKI directory you downloaded on step 1 and the token you generated on step 2: + + ```bash + talosctl gen secrets --kubernetes-bootstrap-token --from-kubernetes-pki + ``` + +4. Create a new Talos config from the secrets: + + ```bash + talosctl gen config --with-secrets secrets.yaml https:// + ``` + +5. Collect the information about the kubeadm-based cluster from the kubeadm configmap: + + ```bash + kubectl get configmap -n kube-system kubeadm-config -oyaml + ``` + + Take note of the following information in the `ClusterConfiguration`: + - `.controlPlaneEndpoint` + - `.networking.dnsDomain` + - `.networking.podSubnet` + - `.networking.serviceSubnet` + +6. Replace the following information in the generated `controlplane.yaml`: + - `.cluster.network.cni.name` with `none` + - `.cluster.network.podSubnets[0]` with the value of the `networking.podSubnet` from the previous step + - `.cluster.network.serviceSubnets[0]` with the value of the `networking.serviceSubnet` from the previous step + - `.cluster.network.dnsDomain` with the value of the `networking.dnsDomain` from the previous step + +7. Go through the rest of `controlplane.yaml` and `worker.yaml` to customize them according to your needs, especially : + - `.cluster.secretboxEncryptionSecret` should be either removed if you don't currently use `EncryptionConfig` on your `kube-apiserver` or set to the correct value + +8. Make sure that, on your current Kubeadm cluster, the first `--service-account-issuer=` parameter in `/etc/kubernetes/manifests/kube-apiserver.yaml` is equal to the value of `.cluster.controlPlane.endpoint` in `controlplane.yaml`. + If it's not, add a new `--service-account-issuer=` parameter with the correct value before your current one in `/etc/kubernetes/manifests/kube-apiserver.yaml` on all of your control planes nodes, and restart the kube-apiserver containers. + +9. Bring up a Talos node to be the initial Talos control plane node. + +10. Apply the generated `controlplane.yaml` to the Talos control plane node: + + ```bash + talosctl --nodes apply-config --insecure --file controlplane.yaml + ``` + +11. Wait until the new control plane node joins the cluster and is ready. + + ```bash + kubectl get node -owide --watch + ``` + +12. Update your load balancer to point to the new control plane node. + +13. Drain the old control plane node you are replacing: + + ```bash + kubectl drain --delete-emptydir-data --force --ignore-daemonsets --timeout=10m + ``` + +14. Remove the old control plane node from the cluster: + + ```bash + kubectl delete node + ``` + +15. Destroy the old node: + + ```bash + # inside the node + sudo kubeadm reset --force + ``` + +16. Repeat the same steps, starting from step 7, for all control plane nodes. + +17. Repeat the same steps, starting from step 7, for all worker nodes while applying the `worker.yaml` instead and skipping the LB step: + + ```bash + talosctl --nodes apply-config --insecure --file worker.yaml + ``` + +18. Your kubeadm `kube-proxy` configuration may not be compatible with the one generated by Talos, which will make the Talos Kubernetes upgrades impossible (labels may not be the same, and `selector.matchLabels` is an immutable field). + To be sure, export your current kube-proxy daemonset manifest, check the labels, they have to be: + + ```yaml + tier: node + k8s-app: kube-proxy + ``` + + If the are not, modify all the labels fields, save the file, delete your current kube-proxy daemonset, and apply the one you modified. diff --git a/website/content/v1.12/advanced/oci-base-spec.md b/website/content/v1.12/advanced/oci-base-spec.md new file mode 100644 index 000000000..457f1abb8 --- /dev/null +++ b/website/content/v1.12/advanced/oci-base-spec.md @@ -0,0 +1,49 @@ +--- +title: "OCI Base Runtime Specification" +description: "Adjusting OCI base runtime specification for CRI containers." +--- + +Every container initiated by the Container Runtime Interface (CRI) adheres to the [OCI runtime specification](https://github.com/opencontainers/runtime-spec/blob/main/spec.md). +While certain aspects of this specification can be modified through Kubernetes pod and container configurations, others remain fixed. + +Talos Linux provides the capability to adjust the OCI base runtime specification for all containers managed by the CRI. +However, it is important to note that the Kubernetes/CRI plugin may still override some settings, meaning changes to the base runtime specification are not always guaranteed to take effect. + +## Getting Current OCI Base Runtime Specification + +To get the current OCI base runtime specification, you can use the following command (`yq -P .` is used to pretty-print the output): + +```bash +$ talosctl read /etc/cri/conf.d/base-spec.json | yq -P . +ociVersion: 1.2.0 +process: + user: + uid: 0 + gid: 0 + cwd: / + capabilities: + bounding: + - CAP_CHOWN +... +``` + +The output might depend on a specific Talos (`containerd`) version. + +## Adjusting OCI Base Runtime Specification + +To adjust the OCI base runtime specification, the following machine configuration patch can be used: + +```yaml +machine: + baseRuntimeSpecOverrides: + process: + rlimits: + - type: RLIMIT_NOFILE + hard: 1024 + soft: 1024 +``` + +In this example, the number of open files is adjusted to be 1024 for all containers (OCI default is unset, so it inherits the Talos default of 1048576 open files). +The contents of the `baseRuntimeSpecOverrides` field are merged with the current base runtime specification, so only the fields that need to be adjusted should be included. + +This configuration change will be applied with a machine reboot, and OCI base runtime specification will only affect new containers created after the change on the node. diff --git a/website/content/v1.12/advanced/overlays.md b/website/content/v1.12/advanced/overlays.md new file mode 100644 index 000000000..e6a63fc1e --- /dev/null +++ b/website/content/v1.12/advanced/overlays.md @@ -0,0 +1,113 @@ +--- +title: "Overlays" +description: "Overlays" +--- + +Overlays provide a way to customize Talos Linux boot image. +Overlays hook into the Talos install steps and can be used to provide additional boot assets (in the case of single board computers), +extra kernel arguments or some custom configuration that is not part of the default Talos installation and specific to a particular overlay. + +## Overlays v/s Extensions + +Overlays are similar to extensions, but they are used to customize the installation process, while extensions are used to customize the root filesystem. + +## Official Overlays + +The list of official overlays can be found in the [Overlays GitHub repository](https://github.com/siderolabs/overlays/). + +## Using Overlays + +Overlays can be used to generate a modified metal image or installer image with the overlay applied. + +The process of generating boot assets with overlays is described in the [boot assets guide]({{< relref "../talos-guides/install/boot-assets" >}}). + +### Example: Booting a Raspberry Pi 4 with an Overlay + +Follow the board specific guide for [Raspberry Pi]({{< relref "../talos-guides/install/single-board-computers/rpi_generic" >}}) to download or generate the metal disk image and write to an SD card. + +Boot the machine with the boot media and apply the machine configuration with the installer image that has the overlay applied. + +```yaml +# Talos machine configuration patch +machine: + install: + image: factory.talos.dev/installer/fc1cceeb5711cd263877b6b808fbf4942a8deda65e8804c114a0b5bae252dc50:{{< release >}} +``` + +> Note: The schematic id shown in the above patch is for a vanilla `rpi_generic` overlay. +> Replace it with the schematic id of the overlay you want to apply. + +## Authoring Overlays + +An Overlay is a container image with the [specific folder structure](https://github.com/siderolabs/overlays#readme). +Overlays can be built and managed using any tool that produces container images, e.g. `docker build`. + +Sidero Labs maintains a [repository of overlays](https://github.com/siderolabs/overlays). + +### Developing An Overlay + +Let's assume that you would like to contribute an overlay for a specific board, e.g. by contributing to the [`sbc-rockchip` repository](https://github.com/siderolabs/sbc-rockchip). +Clone the repositry and insepct the existing overlays to understand the structure. + +Usually an overlay consist of a few key components: + +- `firmware`: contains the firmware files required for the board +- `bootloader`: contains the bootloader, e.g. `u-boot` for the board +- `dtb`: contains the device tree blobs for the board +- `installer`: contains the installer that will be used to install this overlay on the node +- `profile`: contains information about the disk image profile, e.g. the disk image size, bootloader used, output format etc. + +1. For the new overlay, create any needed folders and `pkg.yaml` files. +2. If your board introduces a new chipset that is not supported yet, make sure to add the firmware build for it. +3. Add the necessary `u-boot` and `dtb` build steps to the `pkg.yaml` files. +4. Proceed to add an installer, which is a small go binary that will be used to install the overlay on the node. + Here you need to add the go `src/` as well as the `pkg.yaml` file. +5. Lastly, add the profile information in the `profiles` folder. + +You are now ready to attempt building the overlay. +It's recommend to push the build to a container registry to test the overlay with the Talos installer. + +The default settings are: + +- `REGISTRY` is set to `ghcr.io` +- `USERNAME` is set to the `siderolabs` (or value of environment variable `USERNAME` if it is set) + +```bash +make sbc-rockchip PUSH=true +``` + +If using a custom registry, the `REGISTRY` and `USERNAME` variables can be set: + +```bash +make sbc-rockchip PUSH=true REGISTRY= USERNAME= +``` + +After building the overlay, take note of the pushed image tag, e.g. `664638a`, because you will need it for the next step. +You can now build a flashable image using the command below. + +```bash +export TALOS_VERSION=v1.7.6 +export USERNAME=octocat +export BOARD=nanopi-r5s +export TAG=664638a + +docker run --rm -t -v ./_out:/out -v /dev:/dev --privileged ghcr.io/siderolabs/imager:${TALOS_VERSION} \ + "${BOARD}" --arch arm64 \ + --base-installer-image="ghcr.io/siderolabs/installer-base:${TALOS_VERSION}" \ + --overlay-name="${BOARD}" \ + --overlay-image="ghcr.io/${USERNAME}/sbc-rockchip:${TAG}" \ +``` + +> **--overlay-option** + + `--overlay-option` can be used to pass additional options to the overlay installer if they are implemented by the overlay. + An example can be seen in the [sbc-raspberrypi](https://github.com/siderolabs/sbc-raspberrypi/) overlay repository. + It supports passing multiple options by repeating the flag or can be read from a yaml document by passing `--overlay-option=@`. + +> **Note:** In some cases you need to build a custom imager. +> In this case, refer to [this guide on how to build a custom images]({{< relref "./building-images" >}}) using an imager. + +#### Troubleshooting + +> **IMPORTANT:** If this does not succeed, have a look at the documentation of the external dependecies you are pulling in and make sure that the `pkg.yaml` files are correctly configured. +> In some cases it may be required to update the dependencies to an appropriate version via the `Pkgfile`. diff --git a/website/content/v1.12/advanced/sbom.md b/website/content/v1.12/advanced/sbom.md new file mode 100644 index 000000000..f408a0345 --- /dev/null +++ b/website/content/v1.12/advanced/sbom.md @@ -0,0 +1,89 @@ +--- +title: "SBOMs" +description: "A guide on using Software Bill of Materials for Talos Linux." +--- + +Software Bill of Materials (SBOM) is a formal record containing the details and supply chain relationships of various components used in building a software product. +SBOMs are used to provide transparency and traceability of software components, which is essential for security, compliance, and efficient management of software supply chains. + +Talos Linux provides SBOMs for core operating system components, including the Linux kernel, built-in components like `containerd`, and other software packages used to build Talos Linux. +When a system extension is installed, it can also provide its own SBOM, which will be included in the overall SBOM for the Talos Linux system. + +## Acquiring SBOMs + +SBOMs for Talos Linux are provided in SPDX format, which is a standard format for representing SBOMs. +You can acquire SBOMs for Talos Linux in the following ways: + +* Download the SBOM for a specific Talos Linux release from the [GitHub release](https://github.com/siderolabs/talos/releases/tag/{{< release >}}) page: + * `talos-amd64.spdx.json` for the amd64 architecture. + * `talos-arm64.spdx.json` for the arm64 architecture. +* Acquire the SBOM from a running Talos Linux system using the `talosctl` command: + * core Talos Linux SBOM in the `/usr/share/spdx` directory. + * extension SBOMs in the `/usr/local/share/spdx` directory. + +## SBOMs as Resources + +Talos Linux SBOMs are also available as resources in the Talos Linux system. +You can access the SBOMs using the `talosctl` command: + +```bash +talosctl get sboms +NODE NAMESPACE TYPE ID VERSION VERSION LICENSE +172.20.0.2 runtime SBOMItem Talos 1 {{< release >}} +172.20.0.2 runtime SBOMItem apparmor 1 v3.1.7 GPL-2.0-or-later +172.20.0.2 runtime SBOMItem cel.dev/expr 1 v0.24.0 +... +``` + +You can also get the SBOM for a specific component using the `talosctl get sbom` command: + +```yaml +# talosctl get sbom kernel -o yaml +node: 172.20.0.2 +metadata: + namespace: runtime + type: SBOMItems.talos.dev + id: kernel + version: 1 + owner: runtime.SBOMItemController + phase: running + created: 2025-07-24T14:20:29Z + updated: 2025-07-24T14:20:29Z +spec: + name: kernel + version: 6.12.38 + license: GPL-2.0-only + cpes: + - cpe:2.3:o:linux:linux_kernel:6.12.38:*:*:*:*:*:*:* +``` + +## Scanning SBOMs + +You can scan SBOMs for known vulnerabilities using tools like [Grype](https://github.com/anchore/grype). +You will need two source files for scanning: + +* The SBOM file in SPDX format. +* The vulnerability exclusion database (VEX). + +VEX database is used to filter out vulnerabilities that are not applicable to the specific software version or configuration, +which helps to reduce false positives in vulnerability scanning. + +In order to generate the VEX database, run the following command: + +```bash +docker run --rm --pull always ghcr.io/siderolabs/generate-vex:latest gen --target-version {{< release >}} > vex.json +``` + +The basic command to scan the SBOM is as follows: + +```bash +grype sbom:talos-amd64.spdx.json +``` + +With VEX database, the command becomes: + +> Note: At the moment of writing, the scan with VEX database fails until this [PR](https://github.com/anchore/grype/pull/2798) is merged. + +```bash +grype sbom:talos-amd64.spdx.json --vex vex.json +``` diff --git a/website/content/v1.12/advanced/selinux.md b/website/content/v1.12/advanced/selinux.md new file mode 100644 index 000000000..e709833b5 --- /dev/null +++ b/website/content/v1.12/advanced/selinux.md @@ -0,0 +1,55 @@ +--- +title: "SELinux" +description: "SELinux security module support (experimental)." +--- + +Talos Linux 1.10 introduces initial SELinux support. +Talos currently contains a basic SELinux policy that is designed to protect the OS from workloads, including privileged pods. +The policy denies access to machine configuration, prevents debuggers from attaching to system processes, however it is out of its scope to secure the Kubernetes components themselves. + +## Configuration + +SELinux is enabled by default in Talos 1.10 images. +The default mode is permissive, as currently some CNI and CSI solutions as well as extensions are incompatible with it. +For now, enforcing mode has only been tested with the Flannel CNI we ship by default. +These missing parts are being worked on to make SELinux available for more use cases. + +### Disabling SELinux + +On some occasions, you may want to disable SELinux completely, mostly if even permissive mode +is not compatible with some of your workloads or plugins. + +SELinux also needs to be disabled if you are enabling AppArmor, because both security modules cannot be enabled at the same time. + +If you want to disable SELinux, you can do so by adding `selinux=0` to the kernel cmdline. +This is most commonly done when creating the image via the configuration in the Image Factory. + +### Mode of operation + +You can query the SELinux state with: + +```shell +$ talosctl --nodes get SecurityState +NODE NAMESPACE TYPE ID VERSION SECUREBOOT UKISIGNINGKEYFINGERPRINT PCRSIGNINGKEYFINGERPRINT SELINUXSTATE +172.20.0.2 runtime SecurityState securitystate 1 false enabled, permissive +``` + +> Please note that SELinux is still in an experimental state in Talos Linux. +> Extensions currently do not support enforcing mode, which is a known missing feature being worked on. +> Expect some CNI and CSI plugins to not work in enforcing mode. +> Please report the issues you encounter with different configurations to help cover various usage scenarios. +> Enforcing mode should only be enabled on new installs as of version 1.10, since the upgrade path for enabling SELinux is still being worked on. + +As for version 1.10, SELinux runs in permissive mode by default, which does not offer any extra protection, but allows to log denials. +SELinux can be put in enforcing mode (to actually prevent access when it is not authorized by the policy) by adding `enforcing=1` to the kernel cmdline. +This is most commonly done via the configuration in the Image Factory. + +## Obtaining and processing denial logs + +If SELinux has blocked some event from happening, it will log it to the audit log. +If the mode is permissive, the only implication of that would be a denial message, so permissive mode is useful for prototyping the policy. +You can check the logs with: + +`talosctl --nodes logs auditd > audit.log` + +You can get more insights on SELinux policy inner workings in the corresponding section of the [Developing Talos]({{< relref "./developing-talos/#selinux-policy-debugging-and-development" >}}) page. diff --git a/website/content/v1.12/advanced/static-pods.md b/website/content/v1.12/advanced/static-pods.md new file mode 100644 index 000000000..02070a878 --- /dev/null +++ b/website/content/v1.12/advanced/static-pods.md @@ -0,0 +1,102 @@ +--- +title: "Static Pods" +description: "Using Talos Linux to set up static pods in Kubernetes." +aliases: + - ../guides/static-pods +--- + +## Static Pods + +Static pods are run directly by the `kubelet` bypassing the Kubernetes API server checks and validations. +Most of the time `DaemonSet` is a better alternative to static pods, but some workloads need to run +before the Kubernetes API server is available or might need to bypass security restrictions imposed by the API server. + +See [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/) for more information on static pods. + +## Configuration + +Static pod definitions are specified in the Talos machine configuration: + +```yaml +machine: + pods: + - apiVersion: v1 + kind: Pod + metadata: + name: nginx + spec: + containers: + - name: nginx + image: nginx +``` + +Talos renders static pod definitions to the `kubelet` using a local HTTP server, `kubelet` picks up the definition and launches the pod. + +Talos accepts changes to the static pod configuration without a reboot. + +To see a full list of static pods, use `talosctl get staticpods`, and to see the status of the static pods (as reported by the `kubelet`), use `talosctl get staticpodstatus`. + +## Usage + +Kubelet mirrors pod definition to the API server state, so static pods can be inspected with `kubectl get pods`, logs can be retrieved with `kubectl logs`, etc. + +```bash +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-talos-default-controlplane-2 1/1 Running 0 17s +``` + +If the API server is not available, status of the static pod can also be inspected with `talosctl containers --kubernetes`: + +```bash +$ talosctl containers --kubernetes +NODE NAMESPACE ID IMAGE PID STATUS +172.20.0.3 k8s.io default/nginx-talos-default-controlplane-2 registry.k8s.io/pause:3.6 4886 SANDBOX_READY +172.20.0.3 k8s.io └─ default/nginx-talos-default-controlplane-2:nginx:4183a7d7a771 docker.io/library/nginx:latest +... +``` + +Logs of static pods can be retrieved with `talosctl logs --kubernetes`: + +```bash +$ talosctl logs --kubernetes default/nginx-talos-default-controlplane-2:nginx:4183a7d7a771 +172.20.0.3: 2022-02-10T15:26:01.289208227Z stderr F 2022/02/10 15:26:01 [notice] 1#1: using the "epoll" event method +172.20.0.3: 2022-02-10T15:26:01.2892466Z stderr F 2022/02/10 15:26:01 [notice] 1#1: nginx/1.21.6 +172.20.0.3: 2022-02-10T15:26:01.28925723Z stderr F 2022/02/10 15:26:01 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) +``` + +## Troubleshooting + +Talos doesn't perform any validation on the static pod definitions. +If the pod isn't running, use `kubelet` logs (`talosctl logs kubelet`) to find the problem: + +```bash +$ talosctl logs kubelet +172.20.0.2: {"ts":1644505520281.427,"caller":"config/file.go:187","msg":"Could not process manifest file","path":"/etc/kubernetes/manifests/talos-default-nginx-gvisor.yaml","err":"invalid pod: [spec.containers: Required value]"} +``` + +## Resource Definitions + +Static pod definitions are available as `StaticPod` resources combined with Talos-generated control plane static pods: + +```bash +$ talosctl get staticpods +NODE NAMESPACE TYPE ID VERSION +172.20.0.3 k8s StaticPod default-nginx 1 +172.20.0.3 k8s StaticPod kube-apiserver 1 +172.20.0.3 k8s StaticPod kube-controller-manager 1 +172.20.0.3 k8s StaticPod kube-scheduler 1 +``` + +Talos assigns ID `-` to the static pods specified in the machine configuration. + +On control plane nodes status of the running static pods is available in the `StaticPodStatus` resource: + +```bash +$ talosctl get staticpodstatus +NODE NAMESPACE TYPE ID VERSION READY +172.20.0.3 k8s StaticPodStatus default/nginx-talos-default-controlplane-2 2 True +172.20.0.3 k8s StaticPodStatus kube-system/kube-apiserver-talos-default-controlplane-2 2 True +172.20.0.3 k8s StaticPodStatus kube-system/kube-controller-manager-talos-default-controlplane-2 3 True +172.20.0.3 k8s StaticPodStatus kube-system/kube-scheduler-talos-default-controlplane-2 3 True +``` diff --git a/website/content/v1.12/advanced/talos-api-access-from-k8s.md b/website/content/v1.12/advanced/talos-api-access-from-k8s.md new file mode 100644 index 000000000..de9fe185b --- /dev/null +++ b/website/content/v1.12/advanced/talos-api-access-from-k8s.md @@ -0,0 +1,157 @@ +--- +title: "Talos API access from Kubernetes" +description: "How to access Talos API from within Kubernetes." +aliases: + - ../guides/talos-api-access-from-k8s +--- + +In this guide, we will enable the Talos feature to access the Talos API from within Kubernetes. + +## Enabling the Feature + +Edit the machine configuration to enable the feature, specifying the Kubernetes namespaces from which Talos API +can be accessed and the allowed Talos API roles. + +```bash +talosctl -n 172.20.0.2 edit machineconfig +``` + +Configure the `kubernetesTalosAPIAccess` like the following: + +```yaml +spec: + machine: + features: + kubernetesTalosAPIAccess: + enabled: true + allowedRoles: + - os:reader + allowedKubernetesNamespaces: + - default +``` + +## Injecting Talos ServiceAccount into manifests + +Create the following manifest file `deployment.yaml`: + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: talos-api-access +spec: + selector: + matchLabels: + app: talos-api-access + template: + metadata: + labels: + app: talos-api-access + spec: + containers: + - name: talos-api-access + image: alpine:3 + command: + - sh + - -c + - | + wget -O /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/{{< release >}}/talosctl-linux-amd64 + chmod +x /usr/local/bin/talosctl + while true; talosctl -n 172.20.0.2 version; do sleep 1; done +``` + +**Note:** make sure that you replace the IP `172.20.0.2` with a valid Talos node IP. + +Use `talosctl inject serviceaccount` command to inject the Talos ServiceAccount into the manifest. + +```bash +talosctl inject serviceaccount -f deployment.yaml > deployment-injected.yaml +``` + +Inspect the generated manifest: + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: null + name: talos-api-access +spec: + selector: + matchLabels: + app: talos-api-access + strategy: {} + template: + metadata: + creationTimestamp: null + labels: + app: talos-api-access + spec: + containers: + - command: + - sh + - -c + - | + wget -O /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/{{< release >}}/talosctl-linux-amd64 + chmod +x /usr/local/bin/talosctl + while true; talosctl -n 172.20.0.2 version; do sleep 1; done + image: alpine:3 + name: talos-api-access + resources: {} + volumeMounts: + - mountPath: /var/run/secrets/talos.dev + name: talos-secrets + tolerations: + - operator: Exists + volumes: + - name: talos-secrets + secret: + secretName: talos-api-access-talos-secrets +status: {} +--- +apiVersion: talos.dev/v1alpha1 +kind: ServiceAccount +metadata: + name: talos-api-access-talos-secrets +spec: + roles: + - os:reader +--- +``` + +As you can notice, your deployment manifest is now injected with the Talos ServiceAccount. + +## Testing API Access + +Apply the new manifest into `default` namespace: + +```bash +kubectl apply -n default -f deployment-injected.yaml +``` + +Follow the logs of the pods belong to the deployment: + +```bash +kubectl logs -n default -f -l app=talos-api-access +``` + +You'll see a repeating output similar to the following: + +```text +Client: + Tag: + SHA: .... + Built: + Go version: go1.18.4 + OS/Arch: linux/amd64 +Server: + NODE: 172.20.0.2 + Tag: + SHA: ... + Built: + Go version: go1.18.4 + OS/Arch: linux/amd64 + Enabled: RBAC +``` + +This means that the pod can talk to Talos API of node 172.20.0.2 successfully. diff --git a/website/content/v1.12/advanced/verifying-images.md b/website/content/v1.12/advanced/verifying-images.md new file mode 100644 index 000000000..71a3d58ea --- /dev/null +++ b/website/content/v1.12/advanced/verifying-images.md @@ -0,0 +1,37 @@ +--- +title: "Verifying Images" +description: "Verifying Talos container image signatures." +--- + +Sidero Labs signs the container images generated for the Talos release with [cosign](https://docs.sigstore.dev/cosign/overview/): + +* `ghcr.io/siderolabs/installer` (Talos installer) +* `ghcr.io/siderolabs/talos` (Talos image for container runtime) +* `ghcr.io/siderolabs/talosctl` (`talosctl` client packaged as a container image) +* `ghcr.io/siderolabs/imager` (Talos install image generator) +* all [system extension images](https://github.com/siderolabs/extensions/) + +## Verifying Container Image Signatures + +The `cosign` tool can be used to verify the signatures of the Talos container images: + +```bash +$ cosign verify --certificate-identity-regexp '@siderolabs\.com$' --certificate-oidc-issuer https://accounts.google.com ghcr.io/siderolabs/installer:v1.4.0 + +Verification for ghcr.io/siderolabs/installer:v1.4.0 -- +The following checks were performed on each of these signatures: + - The cosign claims were validated + - Existence of the claims in the transparency log was verified offline + - The code-signing certificate was verified using trusted certificate authority certificates + +[{"critical":{"identity":{"docker-reference":"ghcr.io/siderolabs/installer"},"image":{"docker-manifest-digest":"sha256:f41795cc88f40eb1bc6b3c638c4a3123f6ef3c90627bfc35c04ebab82581e3ee"},"type":"cosign container image signature"},"optional":{"1.3.6.1.4.1.57264.1.1":"https://accounts.google.com","Bundle":{"SignedEntryTimestamp":"MEQCIERkQpgEnPWnfjUHIWO9QxC9Ute3/xJOc7TO5GUnu59xAiBKcFvrDWHoUYChT0/+gaazTrI+r0/GWSbi+Q+sEQ5AKA==","Payload":{"body":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJkYjhjYWUyMDZmODE5MDlmZmI4NjE4ZjRkNjIzM2ZlYmM3NzY5MzliOGUxZmZkMTM1ODA4ZmZjNDgwNjYwNGExIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUURQWXhiVG5vSDhJTzBEakRGRE9rNU1HUjRjMXpWMys3YWFjczNHZ2J0TG1RSWdHczN4dVByWUgwQTAvM1BSZmZydDRYNS9nOUtzQVdwdG9JbE9wSDF0NllrPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXhha05EUVd4NVowRjNTVUpCWjBsVlNIbEhaRTFQVEhkV09WbFFSbkJYUVRKb01qSjRVM1ZIZVZGM2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcE5kMDVFUlRSTlZHZDZUbXBWTlZkb1kwNU5hazEzVGtSRk5FMVVaekJPYWxVMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZaUVdKaVkwbDZUVzR3ZERBdlVEZHVUa0pNU0VscU1rbHlORTFQZGpoVVRrVjZUemNLUkVadVRXSldVbGc0TVdWdmExQnVZblJHTVZGMmRWQndTVm95VkV3NFFUUkdSMWw0YldFeGJFTk1kMkk0VEZOVWMzRlBRMEZZYzNkblowWXpUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZqYWsweUNrbGpVa1lyTkhOVmRuRk5ia3hsU0ZGMVJIRkdRakZqZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDB0M1dVUldVakJTUVZGSUwwSkRSWGRJTkVWa1dWYzFhMk50VmpWTWJrNTBZVmhLZFdJeldrRmpNbXhyV2xoS2RtSkhSbWxqZVRWcVlqSXdkd3BMVVZsTFMzZFpRa0pCUjBSMmVrRkNRVkZSWW1GSVVqQmpTRTAyVEhrNWFGa3lUblprVnpVd1kzazFibUl5T1c1aVIxVjFXVEk1ZEUxRGMwZERhWE5IQ2tGUlVVSm5OemgzUVZGblJVaFJkMkpoU0ZJd1kwaE5Oa3g1T1doWk1rNTJaRmMxTUdONU5XNWlNamx1WWtkVmRWa3lPWFJOU1VkTFFtZHZja0puUlVVS1FXUmFOVUZuVVVOQ1NIZEZaV2RDTkVGSVdVRXpWREIzWVhOaVNFVlVTbXBIVWpSamJWZGpNMEZ4U2t0WWNtcGxVRXN6TDJnMGNIbG5Remh3TjI4MFFRcEJRVWRJYkdGbVp6Um5RVUZDUVUxQlVucENSa0ZwUVdKSE5tcDZiVUkyUkZCV1dUVXlWR1JhUmtzeGVUSkhZVk5wVW14c1IydHlSRlpRVXpsSmJGTktDblJSU1doQlR6WlZkbnBFYVVOYVFXOXZSU3RLZVdwaFpFdG5hV2xLT1RGS00yb3ZZek5CUTA5clJIcFhOamxaVUUxQmIwZERRM0ZIVTAwME9VSkJUVVFLUVRKblFVMUhWVU5OUVZCSlRUVjJVbVpIY0VGVWNqQTJVR1JDTURjeFpFOXlLMHhFSzFWQ04zbExUVWRMWW10a1UxTnJaMUp5U3l0bGNuZHdVREp6ZGdvd1NGRkdiM2h0WlRkM1NYaEJUM2htWkcxTWRIQnpjazFJZGs5cWFFSmFTMVoxVG14WmRXTkJaMVF4V1VWM1ZuZHNjR2QzYTFWUFdrWjRUemRrUnpONkNtVnZOWFJ3YVdoV1kyTndWMlozUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19","integratedTime":1681843022,"logIndex":18304044,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}},"Issuer":"https://accounts.google.com","Subject":"andrey.smirnov@siderolabs.com"}}] +``` + +The image should be signed using [cosign certificate authority flow](https://docs.sigstore.dev/certificate_authority/certificate-issuing-overview/) by a Sidero Labs employee with and email from `siderolabs.com` domain. + +## Reproducible Builds + +Talos builds for `kernel`, `initramfs`, `talosctl`, ISO image, and container images are reproducible. +So you can verify that the build is the same as the one as provided on [GitHub releases page](https://github.com/siderolabs/talos/releases). + +See [building Talos images]({{< relref "building-images" >}}) for more details. diff --git a/website/content/v1.12/advanced/watchdog.md b/website/content/v1.12/advanced/watchdog.md new file mode 100644 index 000000000..a64508c53 --- /dev/null +++ b/website/content/v1.12/advanced/watchdog.md @@ -0,0 +1,69 @@ +--- +title: "Watchdog Timers" +description: "Using hardware watchdogs to workaround hardware/software lockups." +--- + +Talos Linux now supports hardware watchdog timers configuration. +Hardware watchdog timers allow to reset (reboot) the system if the software stack becomes unresponsive. +Please consult your hardware/VM documentation for the availability of the hardware watchdog timers. + +## Configuration + +To discover the available watchdog devices, run: + +```shell +$ talosctl ls /sys/class/watchdog/ +NODE NAME +172.20.0.2 . +172.20.0.2 watchdog0 +172.20.0.2 watchdog1 +``` + +The implementation of the watchdog device can be queried with: + +```shell +$ talosctl read /sys/class/watchdog/watchdog0/identity +i6300ESB timer +``` + +To enable the watchdog timer, patch the machine configuration with the following: + +```yaml +# watchdog.yaml +apiVersion: v1alpha1 +kind: WatchdogTimerConfig +device: /dev/watchdog0 +timeout: 5m +``` + +```shell +talosctl patch mc -p @watchdog.yaml +``` + +Talos Linux will set up the watchdog time with a 5-minute timeout, and it will keep resetting the timer to prevent the system from rebooting. +If the software becomes unresponsive, the watchdog timer will expire, and the system will be reset by the watchdog hardware. + +## Inspection + +To inspect the watchdog timer configuration, run: + +```shell +$ talosctl get watchdogtimerconfig +NODE NAMESPACE TYPE ID VERSION DEVICE TIMEOUT +172.20.0.2 runtime WatchdogTimerConfig timer 1 /dev/watchdog0 5m0s +``` + +To inspect the watchdog timer status, run: + +```shell +$ talosctl get watchdogtimerstatus +NODE NAMESPACE TYPE ID VERSION DEVICE TIMEOUT +172.20.0.2 runtime WatchdogTimerStatus timer 1 /dev/watchdog0 5m0s +``` + +Current status of the watchdog timer can also be inspected via Linux sysfs: + +```shell +$ talosctl read /sys/class/watchdog/watchdog0/state +active +``` diff --git a/website/content/v1.12/introduction/_index.md b/website/content/v1.12/introduction/_index.md new file mode 100644 index 000000000..a12a4a13c --- /dev/null +++ b/website/content/v1.12/introduction/_index.md @@ -0,0 +1,4 @@ +--- +title: "Introduction" +weight: 10 +--- diff --git a/website/content/v1.12/introduction/getting-started.md b/website/content/v1.12/introduction/getting-started.md new file mode 100644 index 000000000..ab92cb84e --- /dev/null +++ b/website/content/v1.12/introduction/getting-started.md @@ -0,0 +1,231 @@ +--- +title: Getting Started +weight: 30 +description: "A guide to setting up a Talos cluster" +--- + +This guide walks you through creating a simple Talos cluster with one control plane node and one or more worker nodes. + +If you're looking to set up a cluster with multiple control plane nodes, see [Production Notes]({{< relref "prodnotes" >}}). + +**New to Talos?** Start with [Quickstart]({{< relref "quickstart" >}}) to create a local virtual cluster on your workstation. + +**Planning for production?** See [Production Notes]({{< relref "prodnotes" >}}) for additional requirements and best practices. + +**Installing on cloud or virtualized platforms?** Check out the [platform-specific guides]({{< relref "../talos-guides/install" >}}) for installation methods tailored to different environments. + +## Prerequisites + +To create a Kubernetes cluster with Talos, you’ll need to: + +- **Install talosctl**: `talosctl` is the CLI tool used to interact with the Talos API. +Since Talos Linux does not have SSH access, `talosctl` is the primary tool for managing and configuring your Talos machines + + You can install `talosctl` on macOS or Linux by running: + +```bash +brew install siderolabs/tap/talosctl +``` + +Refer to the [talosctl installation guide]({{< relref "../talos-guides/install/talosctl" >}}) for installation on other platforms. + +- **Ensure network access**: Your machines will need internet access to download the Talos installer and container images, sync time, and more. + + If you’re working in a restricted network environment, check out the official documentation on using [registry proxies]({{< relref "../talos-guides/configuration/pull-through-cache" >}}), local registries, or setting up an [air-gapped installation]({{< relref "../advanced/air-gapped" >}}). + +## Talos Cluster Setup Overview + +Every Talos cluster follows the same process, regardless of where you deploy it: + +1. **Boot** - Start machines with the Talos Linux image +1. **Configure** - Create a root of trust certificate authority and generate configuration files +1. **Apply** - Apply machine configurations to the nodes +1. **Connect** - Set up your local `talosctl` client +1. **Bootstrap** - Initialize the Kubernetes cluster. + +**Note**: You can also use [Omni](https://www.siderolabs.com/omni-signup/) to create a Talos cluster that spans multiple platforms, including bare metal, cloud providers, and virtual machines. + +Let's walk through each step and create a Talos cluster. + +## Step 1: Download The Talos Linux Image + +Get the latest ISO for your architecture from our [Image factory](https://factory.talos.dev/). + +## Step 2: Boot Your Machine + +Boot your hardware using the ISO you just downloaded. +At this stage, you'll: + +- Boot one machine as your control plane node. +- Boot additional machines as worker nodes (this is optional). + +You’ll see the Talos dashboard once your hardware boots from the ISO image. + +**Note:** The ISO runs entirely in RAM and won't modify your disks until you apply a configuration. + +**Troubleshooting network connectivity:** If your machine fails to establish a network connection after booting, you may need to add network drivers through system extensions. +Add these extensions to your Talos image via the [Image factory](https://factory.talos.dev/), or see the [system extensions repository](https://github.com/siderolabs/extensions) for more information. + +## Step 3: Store Your Node IP Addresses in a Variable + +To create variables for your machines’ IP addresses: + +1. Copy the IP address displayed on each machine console, including the control plane and any worker nodes you’ve created. + + If you don’t have a display connected, retrieve the IP addresses from your DHCP server. + + ![IP address display](/images/IP-address-install-display.png) + +1. Create a variable for your control plane node’s IP address by replacing `` with the actual IP: + + ```bash + export CONTROL_PLANE_IP= + ``` + +1. If you have worker nodes, store their IP addresses in a Bash array. +Replace each `` placeholder with the actual IP address of a worker node. +You can include as many IP addresses as needed: + + ```bash + WORKER_IP=("" "" ""...) + ``` + +## Step 4: Unmount the ISO + +Unplug your installation USB drive or unmount the ISO. +This prevents you from accidentally installing to the USB drive and makes it clearer which disk to select for installation. + +## Step 5: Learn About Your Installation Disks + +When you first boot your machine from the ISO, Talos runs temporarily in memory. +This means that your Talos nodes, configurations, and cluster membership won't survive reboots or power cycles. + +However, once you apply the machine configuration (which you'll do later in this guide), you'll install Talos, its complete operating system, and your configuration to a specified disk for permanent storage. + +Run this command to view all the available disks on your control plane: + +```bash +talosctl get disks --insecure --nodes $CONTROL_PLANE_IP +``` + +Note the disk ID (e.g., `sda`, `vda`) as you will use it in the next step. + +## Step 6: Generate Cluster Configuration + +Talos Linux is configured entirely using declarative configuration files avoiding the need to deal with SSH and running commands. + +To generate these declarative configuration files: + +1. Define variables for your cluster name and the disk ID from step 5. +Replace the placeholders with your actual values: + + ```bash + export CLUSTER_NAME= + export DISK_NAME= + ``` + +1. Run this command to generate the configuration file: + + ```bash + talosctl gen config $CLUSTER_NAME https://$CONTROL_PLANE_IP:6443 --install-disk /dev/$DISK_NAME + ``` + +This command generates machine configurations that specify the Kubernetes API endpoint (which is your control plane node's IP) for cluster communication and the target disk for the Talos installation. + +You'll get three files from this command: + +- **controlplane.yaml**: The configuration for your control plane. +- **worker.yaml**: The configuration for your worker nodes. +- **talosconfig**: Your `talosctl` configuration file, used to connect to and authenticate access to your cluster. + +## Step 7: Apply Configurations + +Now that you've created your configurations, it's time to apply them to bring your nodes and cluster online: + +1. Run this command to apply the control plane configuration: + + ```bash + talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file controlplane.yaml + ``` + +1. Next, apply the worker node configuration: + + ```bash + for ip in "${WORKER_IP[@]}"; do + echo "Applying config to worker node: $ip" + talosctl apply-config --insecure --nodes "$ip" --file worker.yaml + done + ``` + +## Step 8: Set your endpoints + +Set your endpoints with this: + +```bash +talosctl --talosconfig=./talosconfig config endpoints $CONTROL_PLANE_IP +``` + +## Step 9: Bootstrap Your Etcd Cluster + +Wait for your control plane node to finish booting, then bootstrap your etcd cluster by running: + +```bash +talosctl bootstrap --nodes $CONTROL_PLANE_IP --talosconfig=./talosconfig +``` + +**Note:** Run this command ONCE on a SINGLE control plane node. +If you have multiple control plane nodes, you can choose any of them. + +## Step 10: Get Kubernetes Access + +Download your `kubeconfig` file to start using `kubectl`. + +You have two download options: you can either merge your Kubernetes configurations **OR** keep them separate. + +Here’s how to do both: + +- Merge your new cluster into your local Kubernetes configuration: + +```bash +talosctl kubeconfig --nodes $CONTROL_PLANE_IP --talosconfig=./talosconfig +``` + +- Specify a filename if you prefer not to merge with your default Kubernetes configuration: + +```bash +talosctl kubeconfig alternative-kubeconfig --nodes $CONTROL_PLANE_IP --talosconfig=./talosconfig +export KUBECONFIG=./alternative-kubeconfig + +``` + +## Step 11: Check Cluster Health + +Run the following command to check the health of your nodes: + +```bash +talosctl --nodes $CONTROL_PLANE_IP --talosconfig=./talosconfig health +``` + +## Step 11: Verify Node Registration + +Confirm that your nodes are registered in Kubernetes: + +```bash +kubectl get nodes +``` + +You should see your control plane and worker nodes listed with a **Ready** status. + +## Next Steps + +Congratulations! +You now have a working Kubernetes cluster on Talos Linux . + +For a list of all the commands and operations that `talosctl` provides, see the CLI reference. + +### What's Next? + +- [Set up persistent storage]({{< relref "../kubernetes-guides/configuration/storage" >}}) +- [Deploy a Metrics Server]({{< relref "../kubernetes-guides/configuration/deploy-metrics-server" >}}) +- [Explore the talosctl CLI reference]({{< relref "../reference/cli" >}}) +- [Plan your production deployment]({{< relref "prodnotes" >}}) diff --git a/website/content/v1.12/introduction/prodnotes.md b/website/content/v1.12/introduction/prodnotes.md new file mode 100644 index 000000000..361e7d482 --- /dev/null +++ b/website/content/v1.12/introduction/prodnotes.md @@ -0,0 +1,389 @@ +--- +title: Production Clusters +weight: 30 +description: "Recommendations for setting up a Talos Linux cluster in production." +--- + +This guide explains things to consider to create a production quality Talos Linux cluster for bare metal. +Check out the [Reference Architecture documentation](https://www.siderolabs.com/resource-hub/resources/) for architectural diagrams and guidance on creating production-grade clusters in other environments. + +This guide assumes that you’ve already created a development cluster and are familiar with the **Getting Started** documentation. +If not, please refer to the [Getting Started]({{< relref "getting-started" >}}) guide for more information. + +When moving from a learning environment to a production-ready Talos Linux cluster, you have to consider several critical factors: + +- High availability for your control plane nodes. +- Secure configuration management. +- Reliability for continuous service and minimal downtime. +- Authentication for access control. + +Follow the steps below to build a production-grade Talos cluster that is highly available, reliable, and secure. + +**Note**: Check out [Omni](https://www.siderolabs.com/omni-signup/) for managing large-scale Talos Linux clusters automatically. + +## Step 1: Prepare Your Infrastructure + +To create your production cluster infrastructure : + +1. Boot your machines using the Talos ISO image +1. Ensure network access on your nodes. + +Here is how to do each step: + +### Boot Your Machines Using the Talos ISO Image + +Follow these steps to boot your machines using the Talos ISO image: + +1. Download the latest ISO for your infrastructure depending on the hardware type from the [Talos Image factory](https://factory.talos.dev/). + + **Note**: For network booting and self-built media using published kernel there are a number of required kernel parameters. +Please see the [kernel docs]({{< relref "../reference/kernel" >}}) getting-started for more information. + +1. Boot three control planes using the ISO image you just downloaded. +1. Boot additional machines as worker nodes. + +### Ensure Network Access + +If your nodes are behind a firewall, in a private network, or otherwise not directly reachable, you would need to configure a load balancer to forward TCP port 50000 to reach the nodes for Talos API access. + +**Note**: Because the Talos Linux API uses gRPC and mutual TLS, it cannot be proxied by a HTTP/S proxy, but only by a TCP load balancer. + +With your control plane and worker nodes booted, next configure your Kubernetes endpoint. + +## Step 2: Store Your IP Addresses in a Variable + +To store variables for your machines’ IP addresses: + +1. Copy the IP address displayed on each machine console, including the control plane and any worker nodes you’ve created. + + If you don’t have a display connected, retrieve the IP addresses from your DHCP server. + + ![IP address display](/images/IP-address-install-display.png) + +1. Create a Bash array for your control plane node IP addresses, replacing each `` placeholder with the IP address of a control plane node. +You can include as many IP addresses as needed: + + ```bash + CONTROL_PLANE_IP=("" "" "") + ``` + + **For example**: + + If your control plane nodes IP addresses are `192.168.0.2`, `192.168.0.3`, `192.168.0.4`, your command would be: + + ```bash + CONTROL_PLANE_IP= ("192.168.0.2" "192.168.0.3" "192.168.0.4") + ``` + +1. If you have worker nodes, store their IP addresses in a Bash array. +Replace each `` placeholder with the actual IP address of a worker node. +You can include as many IP addresses as needed: + + ```bash + WORKER_IP=("" "" "") + ``` + +## Step 3: Decide Your Kubernetes Endpoint + +You've set up multiple control planes for high availability, but they only provide true high availability if the Kubernetes API server endpoint can reach all control plane nodes. + +Here are two common ways to configure this: + +- **Dedicated load balancer**: Set a dedicated load balancer that route to your control plane nodes. +- **DNS records**: Create multiple DNS records that point to all your control plane nodes + +With these, you can pass in one IP address or DNS name during setup that route to all your control plane nodes. + +Here is how you can configure each option: + +### Dedicated Load Balancer + +If you're using a cloud provider or have your own load balancer (such as HAProxy, an NGINX reverse proxy, or an F5 load balancer), setting up a dedicated load balancer is a natural choice. + +It is also important to note that if you [created the cluster with Omni](https://omni.siderolabs.com/tutorials/getting_started), Omni will automatically be a load balancer for your Kubernetes endpoint. + +Configure a frontend to listen on TCP port 6443 and direct traffic to the addresses of your Talos control plane nodes. + +Your Kubernetes endpoint will be the IP address or DNS name of the load balancer's frontend, with the port appended, for example, `https://myK8s.mydomain.io:6443`. + +**Note**: You cannot use a HTTP load balancer, because the Kubernetes API server handles TLS termination and mutual TLS authentication. + +### DNS Records + +Additionally, you can configure your Kubernetes endpoint using DNS records. +Simply, add multiple A or AAAA records, one for each control plane, to a DNS name. + +For example, you can add: + +```url +kube.cluster1.mydomain.com IN A 192.168.0.10 +kube.cluster1.mydomain.com IN A 192.168.0.11 +kube.cluster1.mydomain.com IN A 192.168.0.12 +``` + +Then your endpoint would be: + +```url +https://kube.cluster1.mydomain.com:6443 +``` + +## Step 4: Save Your Endpoint in a Variable + +Set a variable to store the endpoint you chose in Step 3. +Replace `` placeholder with your actual endpoint: + +```bash +export YOUR_ENDPOINT= +``` + +## Step 5: Generate Secrets Bundle + +The secrets bundle is a file that contains all the cryptographic keys, certificates, and tokens needed to secure your Talos Linux cluster. + +To generate the secrets bundle, run: + +```bash +talosctl gen secrets -o secrets.yaml +``` + +## Step 6: Generate Machine Configurations + +Follow these steps to generate machine configuration: + +1. Set a variable for your cluster name by running the following command. +Replace `` with the name you want to give your cluster: + + ```bash + export CLUSTER_NAME= + ``` + +1. Run this command to generate your machine configuration files using your secrets bundle: + + ```bash + talosctl gen config --with-secrets secrets.yaml $CLUSTER_NAME https://$YOUR_ENDPOINT:6443 + ``` + +This command will generate three files: + +- **controlplane.yaml**: Configuration for your control plane. +- **worker.yaml**: Configuration for your worker nodes. +- **talosconfig**: The `talosctl` configuration file used to connect to and authenticate with your cluster. + +## Step 7: Unmount the ISO + +Unplug your installation USB drive or unmount the ISO from all your control plane and worker nodes. +This prevents you from accidentally installing to the USB drive and makes it clearer which disk to select for installation. + +## Step 8: Understand Your Nodes + +The default machine configurations for control plane and worker nodes are typically sufficient to get your cluster running. +However, you may need to customize certain settings such as network interfaces and disk configurations depending on your specific environment. + +Follow these steps to verify that your machine configurations are set up correctly: + +1. **Check network interfaces**: Run this command to view all network interfaces on any node, whether control plane or worker. + + Replace `` with the IP of the node you want to inspect. + + **Note**: Copy the network ID with an Operational state (OPER) value of **up**. + + ```bash + talosctl --nodes get links --insecure + ``` + +1. **Check Available Disks:** Run this command to check all available disks on any node. +Replace `` with the IP address of the node you want to inspect: + + ```bash + talosctl get disks --insecure --nodes + ``` + +1. **Verify Configuration Files:** Open your `worker.yaml` and `controlplane.yaml` configuration files in your preferred editor. +Check that the values match your worker and control plane node's network and disk settings. +If the values don't match, you'll need to update your machine configuration.. + + **Note**: Refer to the [Talos CLI reference]({{< relref "../reference/cli" >}}) for additional commands to gather more information about your nodes and cluster. + +## Step 9: Patch Your Machine Configuration (Optional) + +You can patch your worker and control plane machine configuration to reflect the correct network interface and disk of your control plane nodes. + +Follow these steps to patch your machine configuration: + +1. Create patch files for the configurations you want to modify: + + ```bash + touch controlplane-patch-1.yaml # For patching the control plane nodes configuration + touch worker-patch-1.yaml # For patching the worker nodes configuration + ``` + + **Note**: You don't have to create both patch files, only create patches for the configurations you actually need to modify. + + You can also create multiple patch files (e.g., `controlplane-patch-2.yaml`, `controlplane-patch-3.yaml`) if you want to make multiple subsequent patches to the same machine configuration. + +1. Copy and paste this YAML block of code and add the correct hardware values to each patch file. + + For example, for `controlplane-patch-1` use the network interface and disk information you gathered from your control plane nodes : + + ```yaml + # controlplane-patch-1 file + machine: + network: + interfaces: + - interface: # From control plane node + dhcp: true + install: + disk: /dev/ # From control plane node + ``` + + For `worker-patch-1.yaml`, use network interface and disk information from your worker nodes: + + ```yaml + # worker-patch-1.yaml file + + machine: + network: + interfaces: + - interface: # From worker node + dhcp: true + install: + disk: /dev/ # From worker node + ``` + +1. Apply the different patch files for the different machine configuration: + - **For control plane**: + + ```bash + talosctl machineconfig patch controlplane.yaml --patch @controlplane-patch-1.yaml --output controlplane.yaml + ``` + + - **For worker**: + + ```bash + talosctl machineconfig patch worker.yaml --patch @worker-patch-1.yaml --output worker.yaml + ``` + +Additionally, you can learn more about [patches]({{< relref "../talos-guides/configuration/patching/" >}}) from the configuration patches documentation. + +## Step 10: Apply the Machine Configuration + +To apply your machine configuration: + +1. Run this command to apply the `controlplane.yaml` configuration to your control plane nodes: + + ```bash + for ip in "${CONTROL_PLANE_IP[@]}"; do + echo "=== Applying configuration to node $ip ===" + talosctl apply-config --insecure \ + --nodes $ip \ + --file controlplane.yaml + echo "Configuration applied to $ip" + echo "" + done + ``` + +1. Run this command to apply the `worker.yaml`configuration to your worker node: + + ```bash + for ip in "${WORKER_IP[@]}"; do + echo "=== Applying configuration to node $ip ===" + talosctl apply-config --insecure \ + --nodes $ip \ + --file worker.yaml + echo "Configuration applied to $ip" + echo "" + done + ``` + +## Step 11: Manage Your Talos Configuration File + +The `talosconfig` is your key to managing the Talos Linux cluster, without it, you cannot authenticate or communicate with your cluster nodes using `talosctl`. + +You have two options for managing your `talosconfig`: + +1. Merge your new `talosconfig` into the default configuration file located at `~/.talos/config`: + + ```bash + talosctl config merge ./talosconfig + ``` + +1. Copy the configuration file to your `~/.talos` directory and set the `TALOSCONFIG` environment variable: + + ```bash + mkdir -p ~/.talos + cp ./talosconfig ~/.talos/config + export TALOSCONFIG=~/.talos/config + ``` + +## Step 12: Set Endpoints of Your Control Plane Nodes + +Configure your endpoints to enable talosctl to automatically load balance requests and fail over between control plane nodes when individual nodes become unavailable. + +Run this command to configure your endpoints. +Replace the placeholders ` ` with the IP addresses of your control plane nodes: + +```bash +talosctl config endpoint +``` + +**For example**: + +If your control plane nodes IP addresses are `192.168.0.2`, `192.168.0.3`, `192.168.0.4`, your command would be: + +```bash +talosctl config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 +``` + +## Step 13: Bootstrap Your Kubernetes Cluster + +Wait for your control plane nodes to finish booting, then bootstrap your etcd cluster by running the command below. + +Replace the `` placeholder with the IP address of ONE of your three control plane nodes: + +```bash +talosctl bootstrap --nodes +``` + +**Note**: Run this command ONCE on a SINGLE control plane node. +If you have multiple control plane nodes, you can choose any of them. + +## Step 14: Get Kubernetes Access + +Download your `kubeconfig` file to start using `kubectl` with your cluster. +These commands must be run against a single control plane node. + +You have two options for managing your `kubeconfig`. +Replace `` with the IP address of any one of your control plane nodes: + +- Merge into your default `kubeconfig`: + +```bash +talosctl kubeconfig --nodes +``` + +- Create a separate `kubeconfig` file: + +```bash +talosctl kubeconfig alternative-kubeconfig --nodes +export KUBECONFIG=./alternative-kubeconfig + +``` + +## Step 15: Verify Your Nodes Are Running + +Run the command to ensure that your nodes are running: + +```bash +kubectl get nodes +``` + +## Next Steps + +Congratulations! +You now have a working production grade Talos Linux Kubernetes cluster. + +### What's Next? + +- [Set up persistent storage]({{< relref "../kubernetes-guides/configuration/storage" >}}) +- [Deploy a Metrics Server]({{< relref "../kubernetes-guides/configuration/deploy-metrics-server" >}}) +- [Explore the talosctl CLI reference]({{< relref "../reference/cli" >}}) diff --git a/website/content/v1.12/introduction/quickstart.md b/website/content/v1.12/introduction/quickstart.md new file mode 100644 index 000000000..cc45e4c39 --- /dev/null +++ b/website/content/v1.12/introduction/quickstart.md @@ -0,0 +1,62 @@ +--- +title: Quickstart +weight: 20 +description: "A short guide on setting up a simple Talos Linux cluster locally with Docker." +--- + +{{< youtube IO2Yo3N46nk >}} + +## Local Docker Cluster + +The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. + +### Prerequisites + +#### `talosctl` + +Download `talosctl` (macOS or Linux): + +```bash +brew install siderolabs/tap/talosctl +``` + +#### `kubectl` + +Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). + +### Create the Cluster + +Now run the following: + +```bash +talosctl cluster create +``` + +{{% alert title="Note" color="info" %}} +If you are using Docker Desktop on a macOS computer, if you encounter the error: *Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?* you may need to manually create the link for the Docker socket: +```sudo ln -s "$HOME/.docker/run/docker.sock" /var/run/docker.sock``` + +{{% /alert %}} + +You can explore using Talos API commands: + +```bash +talosctl dashboard --nodes 10.5.0.2 +``` + +Verify that you can reach Kubernetes: + +```bash +kubectl get nodes -o wide +NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME +talos-default-controlplane-1 Ready master 115s v{{< k8s_release >}} 10.5.0.2 Talos ({{< release >}}) containerd://1.5.5 +talos-default-worker-1 Ready 115s v{{< k8s_release >}} 10.5.0.3 Talos ({{< release >}}) containerd://1.5.5 +``` + +### Destroy the Cluster + +When you are all done, remove the cluster: + +```bash +talosctl cluster destroy +``` diff --git a/website/content/v1.12/introduction/support-matrix.md b/website/content/v1.12/introduction/support-matrix.md new file mode 100644 index 000000000..21aeaf330 --- /dev/null +++ b/website/content/v1.12/introduction/support-matrix.md @@ -0,0 +1,58 @@ +--- +title: Support Matrix +weight: 60 +description: "Table of supported Talos Linux versions and respective platforms." +--- + +| Talos Version | 1.12 | 1.11 | +| ----------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Release Date | 2025-12-15 (TBD) | 2025-09-01 (1.11.0) | +| End of Community Support | 1.13.0 release (2026-04-30, TBD) | 1.12.0 release (2025-12-15, TBD) | +| Enterprise Support | [offered by Sidero Labs Inc.](https://www.siderolabs.com/support/) | [offered by Sidero Labs Inc.](https://www.siderolabs.com/support/) | +| Kubernetes | 1.35, 1.34, 1.33, 1.32, 1.31, 1.30 | 1.34, 1.33, 1.32, 1.31, 1.30, 1.29 | +| NVIDIA Drivers | 570.x.x (PRODUCTION), 535.x.x (LTS) | 570.x.x (PRODUCTION), 535.x.x (LTS) | +| Architecture | amd64, arm64 | amd64, arm64 | +| **Platforms** | | | +| - cloud | Akamai, AWS, GCP, Azure, CloudStack, Digital Ocean, Exoscale, Hetzner, OpenNebula, OpenStack, Oracle Cloud, Scaleway, Vultr, Upcloud | Akamai, AWS, GCP, Azure, CloudStack, Digital Ocean, Exoscale, Hetzner, OpenNebula, OpenStack, Oracle Cloud, Scaleway, Vultr, Upcloud | +| - bare metal | x86: BIOS, UEFI, SecureBoot; arm64: UEFI, SecureBoot; boot: ISO, PXE, disk image | x86: BIOS, UEFI; arm64: UEFI; boot: ISO, PXE, disk image | +| - virtualized | VMware, Hyper-V, KVM, Proxmox, Xen | VMware, Hyper-V, KVM, Proxmox, Xen | +| - SBCs | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Nano Pi R4S, Pine64, Pine64 Rock64, Radxa ROCK Pi 4C, Radxa ROCK 4C+, Radxa ROCK 5B, Raspberry Pi 4B, Raspberry Pi Compute Module 4, Turing RK1, Orange Pi 5 | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Nano Pi R4S, Pine64, Pine64 Rock64, Radxa ROCK Pi 4C, Radxa ROCK 4C+, Radxa ROCK 5B, Raspberry Pi 4B, Raspberry Pi Compute Module 4, Turing RK1, Orange Pi 5 | +| - local | Docker, QEMU | Docker, QEMU | +| **Omni** | | | +| [Omni](https://github.com/siderolabs/omni) | >= 1.1.0 | >= 1.1.0 | +| **Cluster API** | | | +| [CAPI Bootstrap Provider Talos](https://github.com/siderolabs/cluster-api-bootstrap-provider-talos) | >= 0.6.9 | >= 0.6.8 | +| [CAPI Control Plane Provider Talos](https://github.com/siderolabs/cluster-api-control-plane-provider-talos) | >= 0.5.10 | >= 0.5.9 | +| [Sidero](https://www.sidero.dev/) | >= 0.6.7 | >= 0.6.6 | + +## Platform Tiers + +* Tier 1: Automated tests, high-priority fixes. +* Tier 2: Tested from time to time, medium-priority bugfixes. +* Tier 3: Not tested by core Talos team, community tested. + +### Tier 1 + +* Metal +* AWS +* GCP + +### Tier 2 + +* Azure +* Digital Ocean +* OpenStack +* VMWare + +### Tier 3 + +* Akamai +* CloudStack +* Exoscale +* Hetzner +* nocloud +* OpenNebula +* Oracle Cloud +* Scaleway +* Vultr +* Upcloud diff --git a/website/content/v1.12/introduction/system-requirements.md b/website/content/v1.12/introduction/system-requirements.md new file mode 100644 index 000000000..dbd43933d --- /dev/null +++ b/website/content/v1.12/introduction/system-requirements.md @@ -0,0 +1,71 @@ +--- +title: System Requirements +weight: 40 +description: "Hardware requirements for running Talos Linux." +--- + +## Minimum Requirements + + + + + + + + + + + + + + + + + + + + + + + + +
RoleMemoryCoresSystem Disk
Control Plane2 GiB210 GiB
Worker1 GiB110 GiB
+ +## Recommended + + + + + + + + + + + + + + + + + + + + + + + + +
RoleMemoryCoresSystem Disk
Control Plane4 GiB4100 GiB
Worker2 GiB2100 GiB
+ +These requirements are similar to that of Kubernetes. + +## Storage + +Talos Linux itself only requires less than 100 MB of disk space, but the EPHEMERAL partition is used to store pulled images, container work directories, and so on. +Thus a minimum is 10 GiB of disk space is required. +100 GiB is desired. +Note, however, that because Talos Linux assumes complete control of the disk it is installed on, so that it can control the partition table for image based upgrades, you cannot partition the rest of the disk for use by workloads. + +Thus it is recommended to install Talos Linux on a small, dedicated disk - using a Terabyte sized SSD for the Talos install disk would be wasteful. +Sidero Labs recommends having separate disks (apart from the Talos install disk) to be used for storage. diff --git a/website/content/v1.12/introduction/troubleshooting.md b/website/content/v1.12/introduction/troubleshooting.md new file mode 100644 index 000000000..1e4ad1f62 --- /dev/null +++ b/website/content/v1.12/introduction/troubleshooting.md @@ -0,0 +1,432 @@ +--- +title: "Troubleshooting" +description: "Troubleshoot control plane and other failures for Talos Linux clusters." +aliases: + - ../guides/troubleshooting-control-plane + - ../advanced/troubleshooting-control-plane +--- + + + +In this guide we assume that Talos is configured with default features enabled, such as [Discovery Service]({{< relref "../talos-guides/discovery" >}}) and [KubePrism]({{< relref "../kubernetes-guides/configuration/kubeprism" >}}). +If these features are disabled, some of the troubleshooting steps may not apply or may need to be adjusted. + +This guide is structured so that it can be followed step-by-step, skip sections which are not relevant to your issue. + +## Network Configuration + +As Talos Linux is an API-based operating system, it is important to have networking configured so that the API can be accessed. +Some information can be gathered from the [Interactive Dashboard]({{< relref "../talos-guides/interactive-dashboard" >}}) which is available on the machine console. + +When running in the cloud the networking should be configured automatically. +Whereas when running on bare-metal it may need more specific configuration, see [networking `metal` configuration guide]({{< relref "../talos-guides/install/bare-metal-platforms/network-config" >}}). + +## Talos API + +The Talos API runs on [port 50000]({{< relref "../learn-more/talos-network-connectivity" >}}). +Control plane nodes should always serve the Talos API, while worker nodes require access to the control plane nodes to issue TLS certificates for the workers. + +### Firewall Issues + +Make sure that the firewall is not blocking port 50000, and [communication]({{< relref "../learn-more/talos-network-connectivity" >}}) on ports 50000/50001 inside the cluster. + +### Client Configuration Issues + +Make sure to use correct `talosconfig` client configuration file matching your cluster. +See [getting started]({{< relref "./getting-started" >}}) for more information. + +The most common issue is that `talosctl gen config` writes `talosconfig` to the file in the current directory, while `talosctl` by default picks up the configuration from the default location (`~/.talos/config`). +The path to the configuration file can be specified with `--talosconfig` flag to `talosctl`. + +### Conflict on Kubernetes and Host Subnets + +If `talosctl` returns an error saying that certificate IPs are empty, it might be due to a conflict between Kubernetes and host subnets. +The Talos API runs on the host network, but it automatically excludes Kubernetes pod & network subnets from the useable set of addresses. + +Talos default machine configuration specifies the following Kubernetes pod and service IPv4 CIDRs: `10.244.0.0/16` and `10.96.0.0/12`. +If the host network is configured with one of these subnets, change the machine configuration to use a different subnet. + +### Wrong Endpoints + +The `talosctl` CLI connects to the Talos API via the specified endpoints, which should be a list of control plane machine addresses. +The client will automatically retry on other endpoints if there are unavailable endpoints. + +Worker nodes should not be used as the endpoint, as they are not able to forward request to other nodes. + +The [VIP]({{< relref "../talos-guides/network/vip" >}}) should never be used as Talos API endpoint. + +### TCP Loadbalancer + +When using a TCP loadbalancer, make sure the loadbalancer endpoint is included in the `.machine.certSANs` list in the machine configuration. + +## System Requirements + +If minimum [system requirements]({{< relref "./system-requirements" >}}) are not met, this might manifest itself in various ways, such as random failures when starting services, or failures to pull images from the container registry. + +## Running Health Checks + +Talos Linux provides a set of basic health checks with `talosctl health` command which can be used to check the health of the cluster. + +In the default mode, `talosctl health` uses information from the [discovery]({{< relref "../talos-guides/discovery" >}}) to get the information about cluster members. +This can be overridden with command line flags `--control-plane-nodes` and `--worker-nodes`. + +## Gathering Logs + +While the logs and state of the system can be queried via the Talos API, it is often useful to gather the logs from all nodes in the cluster, and analyze them offline. +The `talosctl support` command can be used to gather logs and other information from the nodes specified with `--nodes` flag (multiple nodes are supported). + +## Discovery and Cluster Membership + +Talos Linux uses [Discovery Service]({{< relref "../talos-guides/discovery" >}}) to discover other nodes in the cluster. + +The list of members on each machine should be consistent: `talosctl -n get members`. + +### Some Members are Missing + +Ensure connectivity to the discovery service (default is `discovery.talos.dev:443`), and that the discovery registry is not disabled. + +### Duplicate Members + +Don't use same base secrets to generate machine configuration for multiple clusters, as some secrets are used to identify members of the same cluster. +So if the same machine configuration (or secrets) are used to repeatedly create and destroy clusters, the discovery service will see the same nodes as members of different clusters. + +### Removed Members are Still Present + +Talos Linux removes itself from the discovery service when it is [reset]({{< relref "../talos-guides/resetting-a-machine" >}}). +If the machine was not reset, it might show up as a member of the cluster for the maximum TTL of the discovery service (30 minutes), and after that it will be automatically removed. + +## `etcd` Issues + +`etcd` is the distributed key-value store used by Kubernetes to store its state. +Talos Linux provides automation to manage `etcd` members running on control plane nodes. +If `etcd` is not healthy, the Kubernetes API server will not be able to function correctly. + +It is always recommended to run an odd number of `etcd` members, as with 3 or more members it provides fault tolerance for less than quorum member failures. + +Common troubleshooting steps: + +- check `etcd` service state with `talosctl -n IP service etcd` for each control plane node +- check `etcd` membership on each control plane node with `talosctl -n IP etcd members` +- check `etcd` logs with `talosctl -n IP logs etcd` +- check `etcd` alarms with `talosctl -n IP etcd alarm list` + +### All `etcd` Services are Stuck in `Pre` State + +Make sure that a single member was [bootstrapped]({{< relref "./getting-started#kubernetes-bootstrap" >}}). + +Check that the machine is able to pull the `etcd` container image, check `talosctl dmesg` for messages starting with `retrying:` prefix. + +### Some `etcd` Services are Stuck in `Pre` State + +Make sure traffic is not blocked on port 2380 between controlplane nodes. + +Check that `etcd` quorum is not lost. + +Check that all control plane nodes are reported in `talosctl get members` output. + +### `etcd` Reports and Alarm + +See [etcd maintenance]({{< relref "../advanced/etcd-maintenance" >}}) guide. + +### `etcd` Quorum is Lost + +See [disaster recovery]({{< relref "../advanced/disaster-recovery" >}}) guide. + +### Other Issues + +`etcd` will only run on control plane nodes. +If a node is designated as a worker node, you should not expect `etcd` to be running on it. + +When a node boots for the first time, the `etcd` data directory (`/var/lib/etcd`) is empty, and it will only be populated when `etcd` is launched. + +If the `etcd` service is crashing and restarting, check its logs with `talosctl -n logs etcd`. +The most common reasons for crashes are: + +- wrong arguments passed via `extraArgs` in the configuration; +- booting Talos on non-empty disk with an existing Talos installation, `/var/lib/etcd` contains data from the old cluster. + +## `kubelet` and Kubernetes Node Issues + +The `kubelet` service should be running on all Talos nodes, and it is responsible for running Kubernetes pods, +static pods (including control plane components), and registering the node with the Kubernetes API server. + +If the `kubelet` doesn't run on a control plane node, it will block the control plane components from starting. + +The node will not be registered in Kubernetes until the Kubernetes API server is up and initial Kubernetes manifests are applied. + +### `kubelet` is not running + +Check that `kubelet` image is available (`talosctl image ls --namespace system`). + +Check `kubelet` logs with `talosctl -n IP logs kubelet` for startup errors: + +- make sure Kubernetes version is [supported]({{< relref "./support-matrix" >}}) with this Talos release +- make sure `kubelet` extra arguments and extra configuration supplied with Talos machine configuration is valid + +### Talos Complains about Node Not Found + +`kubelet` hasn't yet registered the node with the Kubernetes API server, this is expected during initial cluster bootstrap, the error will go away. +If the message persists, check Kubernetes API health. + +The Kubernetes controller manager (`kube-controller-manager`) is responsible for monitoring the certificate +signing requests (CSRs) and issuing certificates for each of them. +The `kubelet` is responsible for generating and submitting the CSRs for its +associated node. + +The state of any CSRs can be checked with `kubectl get csr`: + +```bash +$ kubectl get csr +NAME AGE SIGNERNAME REQUESTOR CONDITION +csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued +csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued +csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued +csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued +``` + +### `kubectl get nodes` Reports Wrong Internal IP + +Configure the correct internal IP address with [`.machine.kubelet.nodeIP`]({{< relref "../reference/configuration/v1alpha1/config#Config.machine.kubelet.nodeIP" >}}) + +### `kubectl get nodes` Reports Wrong External IP + +Talos Linux doesn't manage the external IP, it is managed with the Kubernetes Cloud Controller Manager. + +### `kubectl get nodes` Reports Wrong Node Name + +By default, the Kubernetes node name is derived from the hostname. +Update the hostname using the machine configuration, cloud configuration, or via DHCP server. + +### Node Is Not Ready + +A Node in Kubernetes is marked as `Ready` only once its CNI is up. +It takes a minute or two for the CNI images to be pulled and for the CNI to start. +If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`. +Usually, CNI-related resources are created in `kube-system` namespace. + +For example, for the default Talos Flannel CNI: + +```bash +$ kubectl -n kube-system get pods +NAME READY STATUS RESTARTS AGE +... +kube-flannel-25drx 1/1 Running 0 23m +kube-flannel-8lmb6 1/1 Running 0 23m +kube-flannel-gl7nx 1/1 Running 0 23m +kube-flannel-jknt9 1/1 Running 0 23m +... +``` + +### Duplicate/Stale Nodes + +Talos Linux doesn't remove Kubernetes nodes automatically, so if a node is removed from the cluster, it will still be present in Kubernetes. +Remove the node from Kubernetes with `kubectl delete node `. + +### Talos Complains about Certificate Errors on `kubelet` API + +This error might appear during initial cluster bootstrap, and it will go away once the Kubernetes API server is up and the node is registered. + +The example of Talos logs: + +```bash +[talos] controller failed {"component": "controller-runtime", "controller": "k8s.KubeletStaticPodController", "error": "error refreshing pod status: error fetching pod status: Get \"https://127.0.0.1:10250/pods/?timeout=30s\": remote error: tls: internal error"} +``` + +By default configuration, `kubelet` issues a self-signed server certificate, but when `rotate-server-certificates` feature is enabled, +`kubelet` issues its certificate using `kube-apiserver`. +Make sure the `kubelet` CSR is approved by the Kubernetes API server. + +In either case, this error is not critical, as it only affects reporting of the pod status to Talos Linux. + +## Kubernetes Control Plane + +The Kubernetes control plane consists of the following components: + +- `kube-apiserver` - the Kubernetes API server +- `kube-controller-manager` - the Kubernetes controller manager +- `kube-scheduler` - the Kubernetes scheduler + +Optionally, `kube-proxy` runs as a DaemonSet to provide pod-to-service communication. + +`coredns` provides name resolution for the cluster. + +CNI is not part of the control plane, but it is required for Kubernetes pods using pod networking. + +Troubleshooting should always start with `kube-apiserver`, and then proceed to other components. + +Talos Linux configures `kube-apiserver` to talk to the `etcd` running on the same node, so `etcd` must be healthy before `kube-apiserver` can start. +The `kube-controller-manager` and `kube-scheduler` are configured to talk to the `kube-apiserver` on the same node, so they will not start until `kube-apiserver` is healthy. + +### Control Plane Static Pods + +Talos should generate the static pod definitions for the Kubernetes control plane +as resources: + +```bash +$ talosctl -n get staticpods +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 k8s StaticPod kube-apiserver 1 +172.20.0.2 k8s StaticPod kube-controller-manager 1 +172.20.0.2 k8s StaticPod kube-scheduler 1 +``` + +Talos should report that the static pod definitions are rendered for the `kubelet`: + +```bash +$ talosctl -n dmesg | grep 'rendered new' +172.20.0.2: user: warning: [2023-04-26T19:17:52.550527204Z]: [talos] rendered new static pod {"component": "controller-runtime", "controller": "k8s.StaticPodServerController", "id": "kube-apiserver"} +172.20.0.2: user: warning: [2023-04-26T19:17:52.552186204Z]: [talos] rendered new static pod {"component": "controller-runtime", "controller": "k8s.StaticPodServerController", "id": "kube-controller-manager"} +172.20.0.2: user: warning: [2023-04-26T19:17:52.554607204Z]: [talos] rendered new static pod {"component": "controller-runtime", "controller": "k8s.StaticPodServerController", "id": "kube-scheduler"} +``` + +If the static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above) +and the controller runtime logs (`talosctl logs controller-runtime`). + +### Control Plane Pod Status + +Initially the `kube-apiserver` component will not be running, and it takes some time before it becomes fully up +during bootstrap (image should be pulled from the Internet, etc.) + +The status of the control plane components on each of the control plane nodes can be checked with `talosctl containers -k`: + +```bash +$ talosctl -n containers --kubernetes +NODE NAMESPACE ID IMAGE PID STATUS +172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-controlplane-1 registry.k8s.io/pause:3.2 2539 SANDBOX_READY +172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-controlplane-1:kube-apiserver:51c3aad7a271 registry.k8s.io/kube-apiserver:v{{< k8s_release >}} 2572 CONTAINER_RUNNING +``` + +The logs of the control plane components can be checked with `talosctl logs --kubernetes` (or with `-k` as a shorthand): + +```bash +talosctl -n logs -k kube-system/kube-apiserver-talos-default-controlplane-1:kube-apiserver:51c3aad7a271 +``` + +If the control plane component reports error on startup, check that: + +- make sure Kubernetes version is [supported]({{< relref "./support-matrix" >}}) with this Talos release +- make sure extra arguments and extra configuration supplied with Talos machine configuration is valid + +### Kubernetes Bootstrap Manifests + +As part of the bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. +There are two kinds of these manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): + +```bash +$ talosctl -n get manifests +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 +172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 +172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 +172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 +172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 +172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 +172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 +172.20.0.2 controlplane Manifest 10-kube-proxy 1 +172.20.0.2 controlplane Manifest 11-core-dns 1 +172.20.0.2 controlplane Manifest 11-core-dns-svc 1 +172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 +``` + +Details of each manifest can be queried by adding `-o yaml`: + +```bash +$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: Manifests.kubernetes.talos.dev + id: 01-csr-approver-role-binding + version: 1 + phase: running +spec: + - apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: system-bootstrap-approve-node-client-csr + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:certificates.k8s.io:certificatesigningrequests:nodeclient + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:bootstrappers +``` + +### Other Control Plane Components + +Once the Kubernetes API server is up, other control plane components issues can be troubleshooted with `kubectl`: + +```shell +kubectl get nodes -o wide +kubectl get pods -o wide --all-namespaces +kubectl describe pod -n NAMESPACE POD +kubectl logs -n NAMESPACE POD +``` + +## Kubernetes API + +The Kubernetes API client configuration (`kubeconfig`) can be retrieved using Talos API with `talosctl -n kubeconfig` command. +Talos Linux mostly doesn't depend on the Kubernetes API endpoint for the cluster, but Kubernetes API endpoint should be configured +correctly for external access to the cluster. + +### Kubernetes Control Plane Endpoint + +The Kubernetes control plane endpoint is the single canonical URL by which the +Kubernetes API is accessed. +Especially with high-availability (HA) control planes, this endpoint may point to a load balancer or a DNS name which may +have multiple `A` and `AAAA` records. + +Like Talos' own API, the Kubernetes API uses mutual TLS, client +certs, and a common Certificate Authority (CA). +Unlike general-purpose websites, there is no need for an upstream CA, so tools +such as cert-manager, Let's Encrypt, or products such +as validated TLS certificates are not required. +Encryption, however, _is_, and hence the URL scheme will always be `https://`. + +By default, the Kubernetes API server in Talos runs on port 6443. +As such, the control plane endpoint URLs for Talos will almost always be of the form +`https://endpoint:6443`. +(The port, since it is not the `https` default of `443` is required.) +The `endpoint` above may be a DNS name or IP address, but it should be +directed to the _set_ of all controlplane nodes, as opposed to a +single one. + +As mentioned above, this can be achieved by a number of strategies, including: + +- an external load balancer +- DNS records +- Talos-builtin shared IP ([VIP]({{< relref "../talos-guides/network/vip" >}})) +- BGP peering of a shared IP (such as with [kube-vip](https://kube-vip.io)) + +Using a DNS name here is a good idea, since it allows any other option, while offering +a layer of abstraction. +It allows the underlying IP addresses to change without impacting the +canonical URL. + +Unlike most services in Kubernetes, the API server runs with host networking, +meaning that it shares the network namespace with the host. +This means you can use the IP address(es) of the host to refer to the Kubernetes +API server. + +For availability of the API, it is important that any load balancer be aware of +the health of the backend API servers, to minimize disruptions during +common node operations like reboots and upgrades. + +## Miscellaneous + +### Checking Controller Runtime Logs + +Talos runs a set of [controllers]({{< relref "../learn-more/controllers-resources" >}}) which operate on resources to build and support machine operations. + +Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: + +```bash +talosctl -n logs controller-runtime +``` + +Controllers continuously run a reconcile loop, so at any time, they may be starting, failing, or restarting. +This is expected behavior. + +If there are no new messages in the `controller-runtime` log, it means that the controllers have successfully finished reconciling, and that the current system state is the desired system state. diff --git a/website/content/v1.12/introduction/what-is-new/index.md b/website/content/v1.12/introduction/what-is-new/index.md new file mode 100644 index 000000000..329b7919c --- /dev/null +++ b/website/content/v1.12/introduction/what-is-new/index.md @@ -0,0 +1,9 @@ +--- +title: What's New in Talos 1.12.0 +weight: 50 +description: "Discover the latest features and updates in Talos Linux 1.12." +--- + +For critical changes, refer to the [upgrade notes]({{< relref "../talos-guides/upgrading-talos" >}}). + +TBD diff --git a/website/content/v1.12/introduction/what-is-talos.md b/website/content/v1.12/introduction/what-is-talos.md new file mode 100644 index 000000000..d0b047d99 --- /dev/null +++ b/website/content/v1.12/introduction/what-is-talos.md @@ -0,0 +1,28 @@ +--- +title: What is Talos? +weight: 10 +description: "A quick introduction in to what Talos is and why it should be used." +--- + +Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. +Designed to be as minimal as possible while still maintaining practicality. +For these reasons, Talos has a number of features unique to it: + +- it is immutable +- it is atomic +- it is ephemeral +- it is minimal +- it is secure by default +- it is managed via a single declarative configuration file and gRPC API + +Talos can be deployed on container, cloud, virtualized, and bare metal platforms. + +## Why Talos + +In having less, Talos offers more. +Security. +Efficiency. +Resiliency. +Consistency. + +All of these areas are improved simply by having less. diff --git a/website/content/v1.12/kubernetes-guides/_index.md b/website/content/v1.12/kubernetes-guides/_index.md new file mode 100644 index 000000000..1c9c43e36 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/_index.md @@ -0,0 +1,5 @@ +--- +title: "Kubernetes Guides" +weight: 30 +description: "Management of a Kubernetes Cluster hosted by Talos Linux" +--- diff --git a/website/content/v1.12/kubernetes-guides/configuration/_index.md b/website/content/v1.12/kubernetes-guides/configuration/_index.md new file mode 100644 index 000000000..d44941272 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/_index.md @@ -0,0 +1,5 @@ +--- +title: "Configuration" +weight: 10 +description: "How to configure components of the Kubernetes cluster itself." +--- diff --git a/website/content/v1.12/kubernetes-guides/configuration/ceph-with-rook.md b/website/content/v1.12/kubernetes-guides/configuration/ceph-with-rook.md new file mode 100644 index 000000000..0fc9e9af0 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/ceph-with-rook.md @@ -0,0 +1,285 @@ +--- +title: "Ceph Storage cluster with Rook" +description: "Guide on how to create a simple Ceph storage cluster with Rook for Kubernetes" +aliases: + - ../../guides/configuring-ceph-with-rook +--- + +## Preparation + +Talos Linux reserves an entire disk for the OS installation, so machines with multiple available disks are needed for a reliable Ceph cluster with Rook and Talos Linux. +Rook requires that the block devices or partitions used by Ceph have no partitions or formatted filesystems before use. +Rook also requires a minimum Kubernetes version of `v1.16` and Helm `v3.0` for installation of charts. +It is highly recommended that the [Rook Ceph overview](https://rook.io/docs/rook/v1.8/ceph-storage.html) is read and understood before deploying a Ceph cluster with Rook. + +## Installation + +Creating a Ceph cluster with Rook requires two steps; first the Rook Operator needs to be installed which can be done with a Helm Chart. +The example below installs the Rook Operator into the `rook-ceph` namespace, which is the default for a Ceph cluster with Rook. + +```shell +$ helm repo add rook-release https://charts.rook.io/release +"rook-release" has been added to your repositories + +$ helm install --create-namespace --namespace rook-ceph rook-ceph rook-release/rook-ceph +W0327 17:52:44.277830 54987 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ +W0327 17:52:44.612243 54987 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ +NAME: rook-ceph +LAST DEPLOYED: Sun Mar 27 17:52:42 2022 +NAMESPACE: rook-ceph +STATUS: deployed +REVISION: 1 +TEST SUITE: None +NOTES: +The Rook Operator has been installed. Check its status by running: + kubectl --namespace rook-ceph get pods -l "app=rook-ceph-operator" + +Visit https://rook.io/docs/rook/latest for instructions on how to create and configure Rook clusters + +Important Notes: +- You must customize the 'CephCluster' resource in the sample manifests for your cluster. +- Each CephCluster must be deployed to its own namespace, the samples use `rook-ceph` for the namespace. +- The sample manifests assume you also installed the rook-ceph operator in the `rook-ceph` namespace. +- The helm chart includes all the RBAC required to create a CephCluster CRD in the same namespace. +- Any disk devices you add to the cluster in the 'CephCluster' must be empty (no filesystem and no partitions). +``` + +Default PodSecurity configuration prevents execution of priviledged pods. +Adding a label to the namespace will allow ceph to start. + +```shell +kubectl label namespace rook-ceph pod-security.kubernetes.io/enforce=privileged +``` + +Once that is complete, the Ceph cluster can be installed with the official Helm Chart. +The Chart can be installed with default values, which will attempt to use all nodes in the Kubernetes cluster, and all unused disks on each node for Ceph storage, and make available block storage, object storage, as well as a shared filesystem. +Generally more specific node/device/cluster configuration is used, and the [Rook documentation](https://rook.io/docs/rook/v1.8/ceph-cluster-crd.html) explains all the available options in detail. +For this example the defaults will be adequate. + +```shell +$ helm install --create-namespace --namespace rook-ceph rook-ceph-cluster --set operatorNamespace=rook-ceph rook-release/rook-ceph-cluster +NAME: rook-ceph-cluster +LAST DEPLOYED: Sun Mar 27 18:12:46 2022 +NAMESPACE: rook-ceph +STATUS: deployed +REVISION: 1 +TEST SUITE: None +NOTES: +The Ceph Cluster has been installed. Check its status by running: + kubectl --namespace rook-ceph get cephcluster + +Visit https://rook.github.io/docs/rook/latest/ceph-cluster-crd.html for more information about the Ceph CRD. + +Important Notes: +- You can only deploy a single cluster per namespace +- If you wish to delete this cluster and start fresh, you will also have to wipe the OSD disks using `sfdisk` +``` + +Now the Ceph cluster configuration has been created, the Rook operator needs time to install the Ceph cluster and bring all the components online. +The progression of the Ceph cluster state can be followed with the following command. + +```shell +$ watch kubectl --namespace rook-ceph get cephcluster rook-ceph +Every 2.0s: kubectl --namespace rook-ceph get cephcluster rook-ceph + +NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL +rook-ceph /var/lib/rook 3 57s Progressing Configuring Ceph Mons +``` + +Depending on the size of the Ceph cluster and the availability of resources the Ceph cluster should become available, and with it the storage classes that can be used with Kubernetes Physical Volumes. + +```shell +$ kubectl --namespace rook-ceph get cephcluster rook-ceph +NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL +rook-ceph /var/lib/rook 3 40m Ready Cluster created successfully HEALTH_OK + +$ kubectl get storageclass +NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE +ceph-block (default) rook-ceph.rbd.csi.ceph.com Delete Immediate true 77m +ceph-bucket rook-ceph.ceph.rook.io/bucket Delete Immediate false 77m +ceph-filesystem rook-ceph.cephfs.csi.ceph.com Delete Immediate true 77m +``` + +## Talos Linux Considerations + +By default, Rook configues Ceph to have 3 `mon` instances, in which case the data stored in `dataDirHostPath` can be regenerated from the other `mon` instances. +So when performing maintenance on a Talos Linux node with a Rook Ceph cluster (e.g. upgrading the Talos Linux version), it is imperative that care be taken to maintain the health of the Ceph cluster. +Before upgrading, you should always check the health status of the Ceph cluster to ensure that it is healthy. + +```shell +$ kubectl --namespace rook-ceph get cephclusters.ceph.rook.io rook-ceph +NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL +rook-ceph /var/lib/rook 3 98m Ready Cluster created successfully HEALTH_OK +``` + +If it is, you can begin the upgrade process for the Talos Linux node, during which time the Ceph cluster will become unhealthy as the node is reconfigured. +Before performing any other action on the Talos Linux nodes, the Ceph cluster must return to a healthy status. + +```shell +$ talosctl upgrade --nodes 172.20.15.5 --image ghcr.io/talos-systems/installer:v0.14.3 +NODE ACK STARTED +172.20.15.5 Upgrade request received 2022-03-27 20:29:55.292432887 +0200 CEST m=+10.050399758 + +$ kubectl --namespace rook-ceph get cephclusters.ceph.rook.io +NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL +rook-ceph /var/lib/rook 3 99m Progressing Configuring Ceph Mgr(s) HEALTH_WARN + +$ kubectl --namespace rook-ceph wait --timeout=1800s --for=jsonpath='{.status.ceph.health}=HEALTH_OK' cephclusters.ceph.rook.io rook-ceph +cephcluster.ceph.rook.io/rook-ceph condition met +``` + +The above steps need to be performed for each Talos Linux node undergoing maintenance, one at a time. + +## Cleaning Up + +### Rook Ceph Cluster Removal + +Removing a Rook Ceph cluster requires a few steps, starting with signalling to Rook that the Ceph cluster is really being destroyed. +Then all Persistent Volumes (and Claims) backed by the Ceph cluster must be deleted, followed by the Storage Classes and the Ceph storage types. + +```shell +$ kubectl --namespace rook-ceph patch cephcluster rook-ceph --type merge -p '{"spec":{"cleanupPolicy":{"confirmation":"yes-really-destroy-data"}}}' +cephcluster.ceph.rook.io/rook-ceph patched + +$ kubectl delete storageclasses ceph-block ceph-bucket ceph-filesystem +storageclass.storage.k8s.io "ceph-block" deleted +storageclass.storage.k8s.io "ceph-bucket" deleted +storageclass.storage.k8s.io "ceph-filesystem" deleted + +$ kubectl --namespace rook-ceph delete cephblockpools ceph-blockpool +cephblockpool.ceph.rook.io "ceph-blockpool" deleted + +$ kubectl --namespace rook-ceph delete cephobjectstore ceph-objectstore +cephobjectstore.ceph.rook.io "ceph-objectstore" deleted + +$ kubectl --namespace rook-ceph delete cephfilesystem ceph-filesystem +cephfilesystem.ceph.rook.io "ceph-filesystem" deleted +``` + +Once that is complete, the Ceph cluster itself can be removed, along with the Rook Ceph cluster Helm chart installation. + +```shell +$ kubectl --namespace rook-ceph delete cephcluster rook-ceph +cephcluster.ceph.rook.io "rook-ceph" deleted + +$ helm --namespace rook-ceph uninstall rook-ceph-cluster +release "rook-ceph-cluster" uninstalled +``` + +If needed, the Rook Operator can also be removed along with all the Custom Resource Definitions that it created. + +```shell +$ helm --namespace rook-ceph uninstall rook-ceph +W0328 12:41:14.998307 147203 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ +These resources were kept due to the resource policy: +[CustomResourceDefinition] cephblockpools.ceph.rook.io +[CustomResourceDefinition] cephbucketnotifications.ceph.rook.io +[CustomResourceDefinition] cephbuckettopics.ceph.rook.io +[CustomResourceDefinition] cephclients.ceph.rook.io +[CustomResourceDefinition] cephclusters.ceph.rook.io +[CustomResourceDefinition] cephfilesystemmirrors.ceph.rook.io +[CustomResourceDefinition] cephfilesystems.ceph.rook.io +[CustomResourceDefinition] cephfilesystemsubvolumegroups.ceph.rook.io +[CustomResourceDefinition] cephnfses.ceph.rook.io +[CustomResourceDefinition] cephobjectrealms.ceph.rook.io +[CustomResourceDefinition] cephobjectstores.ceph.rook.io +[CustomResourceDefinition] cephobjectstoreusers.ceph.rook.io +[CustomResourceDefinition] cephobjectzonegroups.ceph.rook.io +[CustomResourceDefinition] cephobjectzones.ceph.rook.io +[CustomResourceDefinition] cephrbdmirrors.ceph.rook.io +[CustomResourceDefinition] objectbucketclaims.objectbucket.io +[CustomResourceDefinition] objectbuckets.objectbucket.io + +release "rook-ceph" uninstalled + +$ kubectl delete crds cephblockpools.ceph.rook.io cephbucketnotifications.ceph.rook.io cephbuckettopics.ceph.rook.io \ + cephclients.ceph.rook.io cephclusters.ceph.rook.io cephfilesystemmirrors.ceph.rook.io \ + cephfilesystems.ceph.rook.io cephfilesystemsubvolumegroups.ceph.rook.io \ + cephnfses.ceph.rook.io cephobjectrealms.ceph.rook.io cephobjectstores.ceph.rook.io \ + cephobjectstoreusers.ceph.rook.io cephobjectzonegroups.ceph.rook.io cephobjectzones.ceph.rook.io \ + cephrbdmirrors.ceph.rook.io objectbucketclaims.objectbucket.io objectbuckets.objectbucket.io +customresourcedefinition.apiextensions.k8s.io "cephblockpools.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephbucketnotifications.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephbuckettopics.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephclients.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephclusters.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephfilesystemmirrors.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephfilesystems.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephfilesystemsubvolumegroups.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephnfses.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectrealms.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectstores.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectstoreusers.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectzonegroups.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectzones.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephrbdmirrors.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "objectbucketclaims.objectbucket.io" deleted +customresourcedefinition.apiextensions.k8s.io "objectbuckets.objectbucket.io" deleted +``` + +### Talos Linux Rook Metadata Removal + +If the Rook Operator is cleanly removed following the above process, the node metadata and disks should be clean and ready to be re-used. +In the case of an unclean cluster removal, there may be still a few instances of metadata stored on the system disk, as well as the partition information on the storage disks. +First the node metadata needs to be removed, make sure to update the `nodeName` with the actual name of a storage node that needs cleaning, and `path` with the Rook configuration `dataDirHostPath` (this is `/var/lib/rook` when using the default values.yaml) set when installing the chart. +The following will need to be repeated for each node used in the Rook Ceph cluster. + +```shell +$ cat < + volumes: + - name: rook-data-dir + hostPath: + path: + containers: + - name: disk-clean + image: busybox + securityContext: + privileged: true + volumeMounts: + - name: rook-data-dir + mountPath: /node/rook-data + command: ["/bin/sh", "-c", "rm -rf /node/rook-data/*"] +EOF +pod/disk-clean created + +$ kubectl wait --timeout=900s --for=jsonpath='{.status.phase}=Succeeded' pod disk-clean +pod/disk-clean condition met + +$ kubectl delete pod disk-clean +pod "disk-clean" deleted +``` + +Lastly, the disks themselves need the partition and filesystem data wiped before they can be reused. +Again, the following as to be repeated for each node **and** disk used in the Rook Ceph cluster, updating `nodeName` and `of=` in the `command` as needed. + +```shell +$ cat < + containers: + - name: disk-wipe + image: busybox + securityContext: + privileged: true + command: ["/bin/sh", "-c", "dd if=/dev/zero bs=1M count=100 oflag=direct of="] +EOF +pod/disk-wipe created + +$ kubectl wait --timeout=900s --for=jsonpath='{.status.phase}=Succeeded' pod disk-wipe +pod/disk-wipe condition met + +$ kubectl delete pod disk-wipe +pod "disk-wipe" deleted +``` diff --git a/website/content/v1.12/kubernetes-guides/configuration/deploy-metrics-server.md b/website/content/v1.12/kubernetes-guides/configuration/deploy-metrics-server.md new file mode 100644 index 000000000..59986d423 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/deploy-metrics-server.md @@ -0,0 +1,45 @@ +--- +title: "Deploying Metrics Server" +description: "In this guide you will learn how to set up metrics-server." +aliases: + - ../../guides/deploy-metrics-server +--- + +Metrics Server enables use of the [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and [Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler). +It does this by gathering metrics data from the kubelets in a cluster. +By default, the certificates in use by the kubelets will not be recognized by metrics-server. +This can be solved by either configuring metrics-server to do no validation of the TLS certificates, or by modifying the kubelet configuration to rotate its certificates and use ones that will be recognized by metrics-server. + +## Node Configuration + +To enable kubelet certificate rotation, all nodes should have the following Machine Config snippet: + +```yaml +machine: + kubelet: + extraArgs: + rotate-server-certificates: true +``` + +## Install During Bootstrap + +We will want to ensure that new certificates for the kubelets are approved automatically. +This can easily be done with the [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver), which will automatically approve the Certificate Signing Requests generated by the kubelets. + +We can have Kubelet Serving Certificate Approver and metrics-server installed on the cluster automatically during bootstrap by adding the following snippet to the Cluster Config of the node that will be handling the bootstrap process: + +```yaml +cluster: + extraManifests: + - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml + - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml +``` + +## Install After Bootstrap + +If you choose not to use `extraManifests` to install Kubelet Serving Certificate Approver and metrics-server during bootstrap, you can install them once the cluster is online using `kubectl`: + +```sh +kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml +kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml +``` diff --git a/website/content/v1.12/kubernetes-guides/configuration/device-plugins.md b/website/content/v1.12/kubernetes-guides/configuration/device-plugins.md new file mode 100644 index 000000000..a2026a035 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/device-plugins.md @@ -0,0 +1,145 @@ +--- +title: "Device Plugins" +description: "In this guide you will learn how to expose host devices to the Kubernetes pods." +--- + +[Kubernetes Device Plugins](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) can be used to expose host devices to the Kubernetes pods. +This guide will show you how to deploy a device plugin to your Talos cluster. +In this guide, we will use [Kubernetes Generic Device Plugin](https://github.com/squat/generic-device-plugin), but there are other implementations available. + +## Deploying the Device Plugin + +The Kubernetes Generic Device Plugin is a DaemonSet that runs on each node in the cluster, exposing the devices to the pods. +The device plugin is configured with a [list of devices to expose](https://github.com/squat/generic-device-plugin#overview), e.g. +`--device='{"name": "video", "groups": [{"paths": [{"path": "/dev/video0"}]}]}`. + +In this guide, we will demonstrate how to deploy the device plugin with a configuration that exposes the `/dev/net/tun` device. +This device is commonly used for user-space Wireguard, including Tailscale. + +```yaml +# generic-device-plugin.yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: generic-device-plugin + namespace: kube-system + labels: + app.kubernetes.io/name: generic-device-plugin +spec: + selector: + matchLabels: + app.kubernetes.io/name: generic-device-plugin + template: + metadata: + labels: + app.kubernetes.io/name: generic-device-plugin + spec: + priorityClassName: system-node-critical + tolerations: + - operator: "Exists" + effect: "NoExecute" + - operator: "Exists" + effect: "NoSchedule" + containers: + - image: squat/generic-device-plugin + args: + - --device + - | + name: tun + groups: + - count: 1000 + paths: + - path: /dev/net/tun + name: generic-device-plugin + resources: + requests: + cpu: 50m + memory: 10Mi + limits: + cpu: 50m + memory: 20Mi + ports: + - containerPort: 8080 + name: http + securityContext: + privileged: true + volumeMounts: + - name: device-plugin + mountPath: /var/lib/kubelet/device-plugins + - name: dev + mountPath: /dev + volumes: + - name: device-plugin + hostPath: + path: /var/lib/kubelet/device-plugins + - name: dev + hostPath: + path: /dev + updateStrategy: + type: RollingUpdate +``` + +Apply the manifest to your cluster: + +```sh +kubectl apply -f generic-device-plugin.yaml +``` + +Once the device plugin is deployed, you can verify that the nodes have a new resource: `squat.ai/tun` (the `tun` name comes from the name of the group in the device plugin configuration).: + +```sh +$ kubectl describe node worker-1 +... +Allocated resources: + Resource Requests Limits + -------- -------- ------ + ... + squat.ai/tun 0 0 +``` + +## Deploying a Pod with the Device + +Now that the device plugin is deployed, you can deploy a pod that requests the device. +The request for the device is specified as a [resource](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) in the pod spec. + +```yaml +requests: + limits: + squat.ai/tun: "1" +``` + +Here is an example non-privileged pod spec that requests the `/dev/net/tun` device: + +```yaml +# tun-pod.yaml +apiVersion: v1 +kind: Pod +metadata: + name: tun-test +spec: + containers: + - image: alpine + name: test + command: + - sleep + - inf + resources: + limits: + squat.ai/tun: "1" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + add: + - NET_ADMIN + dnsPolicy: ClusterFirst + restartPolicy: Always +``` + +When running the pod, you should see the `/dev/net/tun` device available: + +```sh +$ ls -l /dev/net/tun +crw-rw-rw- 1 root root 10, 200 Sep 17 10:30 /dev/net/tun +``` diff --git a/website/content/v1.12/kubernetes-guides/configuration/etcd-metrics.md b/website/content/v1.12/kubernetes-guides/configuration/etcd-metrics.md new file mode 100644 index 000000000..1f52bda94 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/etcd-metrics.md @@ -0,0 +1,57 @@ +--- +title: "Expose the Etcd Metrics Endpoint" +description: "Learn how to the expose etcd metrics endpoint." +--- + +To allow monitoring tools to collect metrics from your etcd database, you need to explicitly expose the etcd metrics endpoint. + +Here's how to do it: + +1. Create a patch file named `etcd-metrics-patch.yaml` that exposes the etcd metrics endpoint on `port:2381`, accessible from all network interfaces + + ```shell + cat << EOF > etcd-metrics-patch.yaml + - op: add + path: /cluster/etcd/extraArgs + value: + listen-metrics-urls: http://0.0.0.0:2381 + EOF + ``` + +1. Create a `CP_IPS` variable that contains the IP addresses of your control plane nodes: + + ```bash + CP_IPS=",," + ``` + +1. Ensure you are in your project's directory and apply the `etcd-metrics-patch.yaml` patch to your control plane nodes. + + ```bash + talosctl patch machineconfig \ + --patch @etcd-metrics-patch.yaml \ + --endpoints $CP_IPS \ + --nodes $CP_IPS \ + --talosconfig=./talosconfig + ``` + + **Note**: You can also [export your `TALOSCONFIG` variable]({{< relref "../../introduction/prodnotes/#step-11-manage-your-talos-configuration-file">}}) and then remove the `--talosconfig=./talosconfig` flag in the patch command above. + +1. Reboot the nodes. + Note that if you have only one control plane node, rebooting it will cause cluster downtime. + + ```bash + for NODE in $(echo "${CP_IPS}" | tr ',' ' '); do + echo "Rebooting control plane node: $NODE" + talosctl reboot --endpoints "$NODE" --nodes "$NODE" --wait + done + ``` + +1. After the node reboots, run the following command to confirm that the etcd metrics endpoint is accessible: + + ```bash + CP_IP=$(echo $CP_IPS | cut -d',' -f1) + curl "${CP_IP}:2381/metrics" + ``` + +1. Secure your control plane IP addresses to prevent public access. +See the [Ingress Firewall guide]({{< relref "../../talos-guides/network/ingress-firewall" >}}) for instructions on securing your control plane. diff --git a/website/content/v1.12/kubernetes-guides/configuration/inlinemanifests.md b/website/content/v1.12/kubernetes-guides/configuration/inlinemanifests.md new file mode 100644 index 000000000..7388d85e9 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/inlinemanifests.md @@ -0,0 +1,139 @@ +--- +title: "inlineManifests and extraManifests" +description: "Learn what inlineManifests and extraManifests are, how they differ, and why they matter." +--- + +`inlineManifests` and `extraManifests` allow you to automatically apply Kubernetes resources to your cluster during initial bootstrap. + +Both are designed to automate the provisioning of components like CNIs and other static infrastructure, but they differ in how the manifest content is sourced and applied. +They are not meant for deploying applications or frequently changing services. +For those, it's better to use a GitOps or CI/CD tool. + +## inlineManifests + +`inlineManifests` are defined directly within the machine configuration file. +The YAML content is embedded inside the `inlineManifests` section, making it ideal for tightly coupled resources that need to be provisioned as soon as the node boots up. + +Here’s an example of how to configure a cluster using an `inlineManifest`: + +```yaml +cluster: + inlineManifests: + - name: my-app + contents: | + apiVersion: apps/v1 + kind: Deployment + metadata: + name: my-application + spec: + # ... deployment specification +``` + +## extraManifests + +`extraManifests` are Kubernetes manifests fetched from external, unauthenticated HTTP sources such as GitHub, raw file servers, or gists. + +You define them in the `extraManifests` section of the machine configuration. +They’re best suited for shared, versioned, or centrally managed resources. + +These manifests are pulled directly by the node during configuration. +If the node doesn’t have network access to the HTTP endpoint hosting the manifest the installation will fail. + +Similarly, if the endpoint is down or returns an error, the manifest will not be applied, and the machine configuration will fail as a result. + +Here’s how to reference `extraManifests`: + +```yaml +cluster: + extraManifests: + - "https://raw.githubusercontent.com/example/repo/main/manifest.yaml" + - "https://gist.githubusercontent.com/user/gist-id/raw/manifest.yaml" +``` + +## Resource Ordering Considerations + +Talos automatically sorts all manifests, including `inlineManifests`, `extraManifests`, and built-in manifests (such as the kubelet bootstrap token and CoreDNS), before applying them in the following order: + +1. `Namespace` resources +2. CustomResourceDefinitions (CRDs) +3. All other resources, sorted alphabetically by their `metadata.name` property + +## Example Usecase: Install a GitOps controller with extraManifests + +A common use case for `inlineManifests` or `extraManifests` is to install a GitOps controller like Flux or ArgoCD. +Once the controller is running, it connects to your Git repository and automatically applies the rest of your Kubernetes configuration. + +Here's how to install the Flux GitOps controller using an `extraManifest`: + +1. Create a patch file named `flux-extra-manifest.yaml` that automatically downloads and applies the Flux installation manifest from GitHub: + + ```shell + cat << EOF > flux-extra-manifest.yaml + cluster: + extraManifests: + - "https://github.com/fluxcd/flux2/releases/latest/download/install.yaml" + EOF + ``` + +1. Create a `CP_IPS` variable that contains the IP addresses of your control plane nodes: + + ```bash + CP_IPS=",," + ``` + +1. Run this command to export your `TALOSCONFIG` variable. +You can skip this step if you've already done it: + + ```bash + mkdir -p ~/.talos + cp ./talosconfig ~/.talos/config + ``` + +1. Apply the `flux-extra-manifest.yaml` patch to your control plane nodes: + + ```bash + talosctl patch machineconfig \ + --patch @flux-extra-manifest.yaml \ + --endpoints $CP_IPS \ + --nodes $CP_IPS + ``` + +1. Wait a few seconds and check for the Flux pods: + + ```bash + kubectl get pods -n flux-system -w + ``` + +## Omni Patches + +You can also apply `inlineManifests` or `extraManifests` patches to Talos clusters managed by Omni. + +Refer to [Create a Patch For Cluster Machines](https://omni.siderolabs.com/how-to-guides/create-a-patch-for-cluster-machines) to learn how to create and apply the patches. + +## Summary: inlineManifests vs extraManifests + +Here’s a quick overview of the key differences between `inlineManifests` and `extraManifests`: + +| | `inlineManifests` | `extraManifests` | +| ---------------------- | ---------------------------------------------- | ------------------------------------------------------------ | +| Source | Defined directly in the machine configuration | Pulled from external URLs (GitHub gists, web servers, gists) | +| Configuration Location | Under the `inlineManifests` section. | Under the `extraManifests` section | +| Usecase | Early bootstrapping of critical resources | For reusable, version-controlled, or shared manifests | +| Benefits | No external dependencies | Centrally managed | +| Disadvantages | Difficult to maintain and format embedded YAML | Requires external HTTP server | + +## How Talos Handles Manifest Resources + +Talos continuously reconciles manifests on every boot, on every failure to apply, and on every change to the manifests in the machine config. +When processing your `inlineManifests` and `extraManifests`, Talos follows a conservative, additive-only approach. + +Here's what that means in practice: + +* **Creates missing resources**: If a resource defined in your manifests doesn't exist in the cluster, Talos will create it. + +* **Preserves existing resources**: Resources that already exist in the cluster are left completely unchanged, regardless of any differences between the current state and the manifest definition. + +* **Never deletes resources**: Talos will not remove resources from the cluster, even if they're no longer present in your manifest configuration. + +If you need to reapply or update these manifests after the cluster has been created, use the [Kubernetes upgrade]({{< relref "../../kubernetes-guides/upgrading-kubernetes">}}) process. +Specify the same Kubernetes version that’s currently running in your cluster to ensure that only the manifests are reapplied, without performing a version upgrade. diff --git a/website/content/v1.12/kubernetes-guides/configuration/kubeprism.md b/website/content/v1.12/kubernetes-guides/configuration/kubeprism.md new file mode 100644 index 000000000..22de9e9b7 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/kubeprism.md @@ -0,0 +1,58 @@ +--- +title: "KubePrism" +description: "Enabling in-cluster highly-available controlplane endpoint." +--- + +Kubernetes pods running in CNI mode can use the `kubernetes.default.svc` service endpoint to access the Kubernetes API server, +however pods running in host networking mode can only use the external cluster endpoint to access the Kubernetes API server. + +Because Kubernetes controlplane and CNI components run in host networking mode, they can only use the external cluster endpoint to access the Kubernetes API server. +If the external cluster endpoint is unavailable (due to misconfiguration, network issues, etc), this will cause issues in the cluster: pods will not be scheduled, service IPs stop working, etc. + +KubePrism solves this problem by enabling an in-cluster highly-available controlplane endpoint on every node in the cluster. + +## Video Walkthrough + +To see a live demo of this writeup, see the video below: + + + +## Enabling KubePrism + +> As of Talos 1.6, KubePrism is enabled by default with port 7445. + +To enable KubePrism, apply the following machine config patch either during the machine config generation, or to a running cluster (the patch should be applied to all nodes): + +```yaml +machine: + features: + kubePrism: + enabled: true + port: 7445 +``` + +> Note: the `port` specified should be available on every node in the cluster. + +## How it works + +Talos spins up a TCP loadbalancer on every machine on the `localhost` on the specified port which automatically picks up one of the endpoints: + +* the external cluster endpoint as specified in the machine configuration +* for controlplane machines: `https://localhost:` (`http://localhost:6443` in the default configuration) +* `https://:` for every controlplane machine (based on the information from [Cluster Discovery]({{< relref "../../talos-guides/discovery" >}})) + +KubePrism automatically filters out unhealthy (or unreachable) endpoints, and prefers lower-latency endpoints over higher-latency endpoints. + +Talos automatically reconfigures `kubelet`, `kube-scheduler` and `kube-controller-manager` to use the KubePrism endpoint. +The `kube-proxy` manifest is also reconfigured to use the KubePrism endpoint by default, but when enabling KubePrism for a running cluster the manifest should be updated +with `talosctl upgrade-k8s` command. + +When using CNI components that require access to the Kubernetes API server, the KubePrism endpoint should be passed to the CNI configuration (e.g. Cilium, Calico CNIs). + +## Notes + +As the list of endpoints for KubePrism includes the external cluster endpoint, KubePrism in the worst case scenario will behave the same as the external cluster endpoint. +For controlplane nodes, the KubePrism should pick up the `localhost` endpoint of the `kube-apiserver`, minimizing the latency. +Worker nodes might use direct address of the controlplane endpoint if the latency is lower than the latency of the external cluster endpoint. + +KubePrism listen endpoint is bound to `localhost` address, so it can't be used outside the cluster. diff --git a/website/content/v1.12/kubernetes-guides/configuration/local-storage.md b/website/content/v1.12/kubernetes-guides/configuration/local-storage.md new file mode 100644 index 000000000..9f2d00b1e --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/local-storage.md @@ -0,0 +1,139 @@ +--- +title: "Local Storage" +description: "Using local storage for Kubernetes workloads." +--- + +Using local storage for Kubernetes workloads implies that the pod will be bound to the node where the local storage is available. +Local storage is not replicated, so in case of a machine failure contents of the local storage will be lost. + +## User Volumes + +The simplest way to use local storage is to use [user volumes]({{< relref "../../talos-guides/configuration/disk-management/user" >}}). + +Once the user volume is created, it is automatically mounted under `/var/mnt/u-` path on the node. + +For example, create a configuration patch for a user volume named `local-storage`: + +```yaml +# local-storage.yaml +apiVersion: v1alpha1 +kind: UserVolumeConfig +name: local-storage +provisioning: + diskSelector: + match: "!system_disk" + minSize: 2GB + maxSize: 2GB +``` + +Apply the patch to the machine configuration: + +```bash +talosctl --nodes patch mc --patch @local-storage.yaml +``` + +If there is enough space available on a non-system disk (see `diskSelector`), the user volume will be created and mounted under `/var/mnt/u-local-storage` path on the node. + +```bash +$ talosctl -n get volumestatus u-local-storage +NODE NAMESPACE TYPE ID VERSION TYPE PHASE LOCATION SIZE +172.20.0.5 runtime VolumeStatus u-local-storage 3 partition ready /dev/nvme0n2p1 2.0 GB +$ talosctl -n get mountstatus u-local-storage +NODE NAMESPACE TYPE ID VERSION SOURCE TARGET FILESYSTEM VOLUME +172.20.0.5 runtime MountStatus u-local-storage 2 /dev/nvme0n2p1 /var/mnt/local-storage xfs u-local-storage +``` + +Now you can use the `/var/mnt/local-storage` path in your Kubernetes manifests to refer to the local storage: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: local-storage-pod +spec: + containers: + - name: local-storage-container + # ... + volumeMounts: + - mountPath: /usr/share + name: local-storage-volume + volumes: + - name: local-storage-volume + hostPath: + path: /var/mnt/local-storage + type: DirectoryOrCreate +``` + +## Local Path Provisioner + +[Local Path Provisioner](https://github.com/rancher/local-path-provisioner) can be used to dynamically provision local storage. + +First, we will create a separate [user volume]({{< relref "../../talos-guides/configuration/disk-management/user" >}}) for the Local Path Provisioner to use. +Apply the following machine configuration patch: + +> Note: make sure you have [enough space]({{< relref "../../talos-guides/configuration/disk-management/layout" >}}) available to provision the user volume. + +```yaml +apiVersion: v1alpha1 +kind: UserVolumeConfig +name: local-path-provisioner +provisioning: + diskSelector: + match: disk.transport == 'nvme' + minSize: 200GB + maxSize: 200GB +``` + +Make sure to update Local Path Provisioner configuration to use a the user volume path `/var/mnt/local-path-provisioner` as the root path for the local storage. + +For example, Local Path Provisioner can be installed using [kustomize](https://kustomize.io/) with the following configuration: + +```yaml +# kustomization.yaml +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- github.com/rancher/local-path-provisioner/deploy?ref=v0.0.31 +patches: +- patch: |- + kind: ConfigMap + apiVersion: v1 + metadata: + name: local-path-config + namespace: local-path-storage + data: + config.json: |- + { + "nodePathMap":[ + { + "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES", + "paths":["/var/mnt/local-path-provisioner"] + } + ] + } +- patch: |- + apiVersion: storage.k8s.io/v1 + kind: StorageClass + metadata: + name: local-path + annotations: + storageclass.kubernetes.io/is-default-class: "true" +- patch: |- + apiVersion: v1 + kind: Namespace + metadata: + name: local-path-storage + labels: + pod-security.kubernetes.io/enforce: privileged +``` + +Put `kustomization.yaml` into a new directory, and run `kustomize build | kubectl apply -f -` to install Local Path Provisioner to a Talos Linux cluster. +There are three patches applied: + +* change default `/opt/local-path-provisioner` path to `/var/mnt/local-path-provisioner` +* make `local-path` storage class the default storage class (optional) +* label the `local-path-storage` namespace as privileged to allow privileged pods to be scheduled there + +To test the Local Path Provisioner, you can refer to the [Usage section of the official guide](https://github.com/rancher/local-path-provisioner?tab=readme-ov-file#usage). + +You can check that directories for PVCs are created on the node's filesystem with the `talosctl ls /var/mnt/local-path-provisioner` command. diff --git a/website/content/v1.12/kubernetes-guides/configuration/pod-security.md b/website/content/v1.12/kubernetes-guides/configuration/pod-security.md new file mode 100644 index 000000000..b0f7c5bfa --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/pod-security.md @@ -0,0 +1,288 @@ +--- +title: "Pod Security" +description: "Enabling Pod Security Admission plugin to configure Pod Security Standards." +aliases: + - ../../guides/pod-security +--- + +Kubernetes deprecated [Pod Security Policy (PSP)](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) in version 1.21 and removed it entirely in 1.25. + +It was replaced by [Pod Security Admission (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/), which is enabled by default starting with v1.23. + +Talos Linux automatically enables and configures PSA to enforce Pod Security Standards. +These [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) define three policies that cover the security spectrum: + +* **Privileged**: Unrestricted policy, providing the widest possible level of permissions. +* **Baseline**: Minimally restrictive policy. +* **Restricted**: Heavily restricted policy. + +By default, Talos with the help of PSA, applies the `baseline` profile to all namespaces, except for the `kube-system` namespace, which uses the `privileged` profile. + +## Default PSA Configuration + +Here is the default PSA configuration on Talos: + +```yaml +apiVersion: pod-security.admission.config.k8s.io/v1alpha1 +kind: PodSecurityConfiguration +defaults: + enforce: "baseline" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" +exemptions: + usernames: [] + runtimeClasses: [] + namespaces: [kube-system] +``` + +This cluster-wide configuration: + +* Enforces the `baseline` security profile by default. +* Throws a warning, if the `restricted` profile is violated, but does not enforce this profile. + +## Modify the Default PSA Configuraion + +You can modify this PSA policy by updating the generated machine configuration before the cluster is created or on the fly by using the `talosctl` CLI utility. + +Verify current admission plugin configuration with: + +```bash +$ talosctl get admissioncontrolconfigs.kubernetes.talos.dev admission-control -o yaml + +node: 172.20.0.2 +metadata: + namespace: controlplane + type: AdmissionControlConfigs.kubernetes.talos.dev + id: admission-control + version: 1 + owner: config.K8sControlPlaneController + phase: running + created: 2022-02-22T20:28:21Z + updated: 2022-02-22T20:28:21Z +spec: + config: + - name: PodSecurity + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration +``` + +## Workloads That Satisfy the Different Security Profiles + +To deploy a workload that satisfies both the `baseline` and `restricted` profiles, you must ensure that your workloads: + +* Run as non-root users (UID 1000 or higher) +* Use read-only root filesystems where possible +* Minimize or eliminate kernel capabilities + +To see how PSA treats workloads that violate security profiles, consider these examples that violate the `restricted`, `baseline`, or both profiles: + +* A Deployment that satisfies the `restricted` profile +* A Deployment that meets `baseline` requirements but `violates` restricted +* A DaemonSet that violates both `restricted` and `baseline` profiles + +### Deployment that Satisfies the Restricted Profile + +This Deployment complies with the `restricted` profile and does not produce any errors or warnings when applied: + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: example-workload + namespace: default +spec: + selector: + matchLabels: + app: example-workload + template: + metadata: + labels: + app: example-workload + spec: + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + seccompProfile: + type: RuntimeDefault + containers: + - name: example-workload + image: ghcr.io/siderolabs/example-workload + imagePullPolicy: Always + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + capabilities: + drop: + - ALL +``` + +When you apply this `example-workload` Deployment, it successfully creates the Deployment and deploys its pods: + +
+$ kubectl apply -f example-workload.yaml
+deployment.apps/example-workload created
+
+$ kubectl get pods
+NAME                                READY   STATUS    RESTARTS   AGE
+example-workload-6f847d64b9-jctkv   1/1     Running   0          10s
+
+
+ +This is because the Deployment follows Talos’ recommended security practices, which, as shown in the Deployment configuration, include: + +* **runAsNonRoot: true**: Prevents the container from running as root. +* **runAsUser and runAsGroup**: Ensures a dedicated non-root user (UID/GID 1000) runs the process. +* **fsGroup**: Sets file system group ownership for shared volumes. +* **seccompProfile: RuntimeDefault**: Uses the default seccomp profile to restrict available system calls. +* **allowPrivilegeEscalation: false**: Blocks processes from gaining additional privileges. +* **capabilities: drop: [ALL]**: Removes unnecessary Linux capabilities. + +### Deployment that Violates the Restricted but Meets Baseline Profile + +Run the following command to create a Deployment that complies with the `baseline` profile but violates the `restricted` profile: + +```bash +kubectl create deployment nginx --image=nginx +``` + +Applying this Deployment triggers warnings indicating excessive privileges: + +
+Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
+deployment.apps/nginx created
+
+ +Despite these warnings, the deployment and its pods are still created successfully because it complies with the default Talos `baseline` security profile: + +
+$ kubectl get pods
+NAME                     READY   STATUS    RESTARTS   AGE
+nginx-85b98978db-j68l8   1/1     Running   0          2m3s
+
+ +### DaemonSet that Fails Both the Restricted and Baseline Profiles + +This DaemonSet violates both the `baseline` and `restricted` profiles: + +```yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + labels: + app: debug-container + name: debug-container + namespace: default +spec: + revisionHistoryLimit: 10 + selector: + matchLabels: + app: debug-container + template: + metadata: + creationTimestamp: null + labels: + app: debug-container + spec: + containers: + - args: + - "360000" + command: + - /bin/sleep + image: ubuntu:latest + imagePullPolicy: IfNotPresent + name: debug-container + resources: {} + securityContext: + privileged: true + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + dnsPolicy: ClusterFirstWithHostNet + hostIPC: true + hostPID: true + hostNetwork: true + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + terminationGracePeriodSeconds: 30 + updateStrategy: + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + type: RollingUpdate +``` + +When you apply this DaemonSet: + +* An error is thrown, showing that the DaemonSet requests too much privileges: + +
+Warning: would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true, hostPID=true, hostIPC=true), privileged (container "debug-container" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "debug-container" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "debug-container" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "debug-container" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "debug-container" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
+daemonset.apps/debug-container created
+
+ +* The DaemonSet object gets created but no pods are scheduled: + +
+$ kubectl get ds
+
+NAME              DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
+debug-container   0         0         0       0            0                     34s
+
+
+ +* When you describe the DaemonSet, the `Events` section shows that Pod Security Admission errors are blocking pod creation: + +
+$ kubectl describe ds debug-container
+...
+Warning  FailedCreate  92s                daemonset-controller  Error creating: pods "debug-container-kwzdj" is forbidden: violates PodSecurity "baseline:latest": host namespaces (hostNetwork=true, hostPID=true, hostIPC=true), privileged (container "debug-container" must not set securityContext.privileged=true)
+
+ +This happens because the DaemonSet does not comply with the enforced `baseline` Pod Security profile. + +## Override the Pod Security Admission Configuration + +You can override the Pod Security Admission configuration at the namespace level. + +This is especially useful for applications like Prometheus node exporter or storage solutions that require more relaxed Pod Security Standards. + +Using the DaemonSet workload example, you can update the enforced policy to `privilege` for its namespace, which is the default namespace. + +```bash +kubectl label ns default pod-security.kubernetes.io/enforce=privileged +namespace/default labeled +``` + +With this update, the DaemonSet is successfully running: + +
+$ kubectl get ds
+
+NAME              DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
+debug-container   2         2         0       2            0                     4s
+
diff --git a/website/content/v1.12/kubernetes-guides/configuration/seccomp-profiles.md b/website/content/v1.12/kubernetes-guides/configuration/seccomp-profiles.md new file mode 100644 index 000000000..1cff21e50 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/seccomp-profiles.md @@ -0,0 +1,118 @@ +--- +title: "Seccomp Profiles" +description: "Using custom Seccomp Profiles with Kubernetes workloads." +aliases: + - ../../guides/pod-security +--- + +Seccomp stands for secure computing mode and has been a feature of the Linux kernel since version 2.6.12. +It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel. + +Refer the [Kubernetes Seccomp Guide](https://kubernetes.io/docs/tutorials/security/seccomp/) for more details. + +In this guide we are going to configure a custom Seccomp Profile that logs all syscalls made by the workload. + +## Preparing the nodes + +Create a machine config path with the contents below and save as `patch.yaml` + +```yaml +machine: + seccompProfiles: + - name: audit.json + value: + defaultAction: SCMP_ACT_LOG +``` + +Apply the machine config to all the nodes using talosctl: + +```bash +talosctl -e -n patch mc -p @patch.yaml +``` + +This would create a seccomp profile name `audit.json` on the node at `/var/lib/kubelet/seccomp/profiles`. + +The profiles can be used by Kubernetes pods by specfying the pod `securityContext` as below: + +```yaml +spec: + securityContext: + seccompProfile: + type: Localhost + localhostProfile: profiles/audit.json +``` + +> Note that the `localhostProfile` uses the name of the profile created under `profiles` directory. +> So make sure to use path as `profiles/` + +This can be verfied by running the below commands: + +```bash +talosctl -e -n get seccompprofiles +``` + +An output similar to below can be observed: + +```text +NODE NAMESPACE TYPE ID VERSION +10.5.0.3 cri SeccompProfile audit.json 1 +``` + +The content of the seccomp profile can be viewed by running the below command: + +```bash +talosctl -e -n read /var/lib/kubelet/seccomp/profiles/audit.json +``` + +An output similar to below can be observed: + +```text +{"defaultAction":"SCMP_ACT_LOG"} +``` + +## Create a Kubernetes workload that uses the custom Seccomp Profile + +Here we'll be using an example workload from the Kubernetes [documentation](https://kubernetes.io/docs/tutorials/security/seccomp/). + +First open up a second terminal and run the following talosctl command so that we can view the Syscalls being logged in realtime: + +```bash +talosctl -e -n dmesg --follow --tail +``` + +Now deploy the example workload from the Kubernetes documentation: + +```bash +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/audit-pod.yaml +``` + +Once the pod starts running the terminal running `talosctl dmesg` command from above should log similar to below: + +```text +10.5.0.3: kern: info: [2022-07-28T11:49:42.489473063Z]: cni0: port 1(veth32488a86) entered blocking state +10.5.0.3: kern: info: [2022-07-28T11:49:42.490852063Z]: cni0: port 1(veth32488a86) entered disabled state +10.5.0.3: kern: info: [2022-07-28T11:49:42.492470063Z]: device veth32488a86 entered promiscuous mode +10.5.0.3: kern: info: [2022-07-28T11:49:42.503105063Z]: IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready +10.5.0.3: kern: info: [2022-07-28T11:49:42.503944063Z]: IPv6: ADDRCONF(NETDEV_CHANGE): veth32488a86: link becomes ready +10.5.0.3: kern: info: [2022-07-28T11:49:42.504764063Z]: cni0: port 1(veth32488a86) entered blocking state +10.5.0.3: kern: info: [2022-07-28T11:49:42.505423063Z]: cni0: port 1(veth32488a86) entered forwarding state +10.5.0.3: kern: warning: [2022-07-28T11:49:44.873616063Z]: kauditd_printk_skb: 14 callbacks suppressed +10.5.0.3: kern: notice: [2022-07-28T11:49:44.873619063Z]: audit: type=1326 audit(1659008985.445:25): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.876609063Z]: audit: type=1326 audit(1659008985.445:26): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.878789063Z]: audit: type=1326 audit(1659008985.449:27): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=257 compat=0 ip=0x55ec0657bdaa code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.886693063Z]: audit: type=1326 audit(1659008985.461:28): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=202 compat=0 ip=0x55ec06532b43 code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.888764063Z]: audit: type=1326 audit(1659008985.461:29): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=202 compat=0 ip=0x55ec06532b43 code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.891009063Z]: audit: type=1326 audit(1659008985.461:30): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=1 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.893162063Z]: audit: type=1326 audit(1659008985.461:31): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.895365063Z]: audit: type=1326 audit(1659008985.461:32): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=39 compat=0 ip=0x55ec066eb68b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.898306063Z]: audit: type=1326 audit(1659008985.461:33): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=59 compat=0 ip=0x55ec0657be16 code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.901518063Z]: audit: type=1326 audit(1659008985.473:34): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=158 compat=0 ip=0x455f35 code=0x7ffc0000 +``` + +## Cleanup + +You can clean up the test resources by running the following command: + +```bash +kubectl delete pod audit-pod +``` diff --git a/website/content/v1.12/kubernetes-guides/configuration/storage.md b/website/content/v1.12/kubernetes-guides/configuration/storage.md new file mode 100644 index 000000000..7e202168c --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/storage.md @@ -0,0 +1,163 @@ +--- +title: "Storage" +description: "Setting up storage for a Kubernetes cluster" +aliases: + - ../../guides/storage +--- + +In Kubernetes, using storage in the right way is well-facilitated by the API. +However, unless you are running in a major public cloud, that API may not be hooked up to anything. +There are a _lot_ of options out there, and it can be fairly bewildering. + +For Talos, we have some recommendations to make the decision easier. + +## Public Cloud + +If you are running on a major public cloud, use their block storage. +It is easy and automatic. + +## Storage Clusters + +> **Sidero Labs** recommends having separate disks (separate from the Talos install disk) dedicated for storage. + +Redundancy, scaling capabilities, reliability, speed, maintenance load, and ease of use are all factors you must consider when managing your own storage. + +Running a storage cluster can be a very good choice when managing your own storage. +The following projects are known to work with Talos Linux and provide good options, depending on your situation. + +**MayaStor**: Ultra-low latency and high-performance workloads. + +**Longhorn**: Simple, reliable, easy-to-use Kubernetes storage with easy replication and snapshots. + +**Rook/Ceph**: Enterprise-scale, distributed, multi-tenant storage (block, file, and object storage) + +Also, if you need _both_ mount-once _and_ mount-many capabilities, Ceph is your answer. + +> Please note that _most_ people should not use mount-many semantics. +> NFS is pervasive because it is old and easy, _not_ because it is a good idea. +> There are all manner of locking, performance, change control, and reliability concerns inherent in _any_ mount-many situation, so we **strongly** recommend you avoid this method. + +### Longhorn + +Documentation for installing Longhorn on Talos Linux is available on the [Longhorn site](https://longhorn.io/docs/1.9.0/advanced-resources/os-distro-specific/talos-linux-support/). + +### Rook/Ceph + +[Ceph](https://ceph.io) is a mature open source storage system, that can provide almost any type of storage. +It scales well, and enables the operator to easily add and remove storage with no downtime. +It comes bundled with an S3-compatible object store; CephFS, a NFS-like clustered filesystem; and RBD, a block storage system. + +With the help of [Rook](https://rook.io), the vast majority of the complexity of Ceph is hidden away, allowing you to control almost everything about your Ceph cluster from fairly simple Kubernetes CRDs. + +However, Ceph can be rather slow for small clusters. +It relies heavily on CPUs and massive parallelization for performance. +If your cluster is small, just running Ceph may eat up a significant amount of the resources you have available. + +Troubleshooting Ceph can be difficult if you do not understand its architecture. +There are very good tools for inspection and debugging, but this is still frequently seen as a concern. + +### OpenEBS Mayastor replicated storage + +[Mayastor](https://github.com/openebs/Mayastor) is an OpenEBS project built in Rust utilizing the modern NVMEoF system. + +#### Deploy Mayastor + +Mayastor has documentation specific to installing on Talos Linux in their official [documentation](https://openebs.io/docs/Solutioning/openebs-on-kubernetes-platforms/talos) + +Installing on Talos Linux requires patching the Pod Security policies, enabling Huge Page support, and labels. +This is all covered in the Mayastor documentation, + +We need to disable the init container that checks for the `nvme_tcp` module, since Talos has that module built-in. + +Create a helm values file `mayastor-values.yaml` with the following contents: + +```yaml +mayastor: + csi: + node: + initContainers: + enabled: false +``` + +If you do not need to use the LVM and ZFS engines they can be disabled in the values file: + +```yaml +engines: + local: + lvm: + enabled: false + zfs: + enabled: false +``` + +Continue setting up [Mayastor](https://openebs.io/docs/quickstart-guide/installation#installation-via-helm) using the official documentation, passing the values file. + +Follow the Post-Installation from official [documentation](https://openebs.io/docs/quickstart-guide/installation#post-installation-considerations) to use Local Storage or Replicated Storage. + +### Piraeus / LINSTOR + +* [Piraeus-Operator](https://piraeus.io/) +* [LINSTOR](https://linbit.com/drbd/) +* [DRBD Extension](https://github.com/siderolabs/extensions#storage) + +#### Install Piraeus Operator V2 + +There is already a how-to for Talos: [Link](https://piraeus.io/docs/stable/how-to/talos/) + +#### Create first storage pool and PVC + +Before proceeding, install linstor plugin for kubectl: +https://github.com/piraeusdatastore/kubectl-linstor + +Or use [krew](https://krew.sigs.k8s.io/): `kubectl krew install linstor` + +```sh +# Create device pool on a blank (no partition table!) disk on node01 +kubectl linstor physical-storage create-device-pool --pool-name nvme_lvm_pool LVM node01 /dev/nvme0n1 --storage-pool nvme_pool +``` + +piraeus-sc.yml + +```yaml +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: simple-nvme +parameters: + csi.storage.k8s.io/fstype: xfs + linstor.csi.linbit.com/autoPlace: "3" + linstor.csi.linbit.com/storagePool: nvme_pool +provisioner: linstor.csi.linbit.com +volumeBindingMode: WaitForFirstConsumer +``` + +```sh +# Create storage class +kubectl apply -f piraeus-sc.yml +``` + +## NFS + +NFS is slow, has all kinds of bottlenecks involving contention, distributed locking, single points of service, and more. +However, it is supported by a wide variety of systems, such as NetApp storage arrays. + +The NFS client is part of the [`kubelet` image](https://github.com/talos-systems/kubelet) maintained by the Talos team. +This means that the version installed in your running `kubelet` is the version of NFS supported by Talos. +You can reduce some of the contention problems by parceling Persistent Volumes from separate underlying directories. + +## Object storage + +Ceph comes with an S3-compatible object store, but there are other options, as +well. +These can often be built on top of other storage backends. +For instance, you may have your block storage running with Mayastor but assign a +Pod a large Persistent Volume to serve your object store. + +One of the most popular open source add-on object stores is [MinIO](https://min.io/). + +## Others (iSCSI) + +The most common remaining systems involve iSCSI in one form or another. +iSCSI in Linux is facilitated by [open-iscsi](https://github.com/open-iscsi/open-iscsi). + +iSCSI support in Talos is now supported via the [iscsi-tools](https://github.com/siderolabs/extensions/pkgs/container/iscsi-tools) [system extension]({{< relref "../../talos-guides/configuration/system-extensions" >}}) installed. diff --git a/website/content/v1.12/kubernetes-guides/configuration/synology-csi.md b/website/content/v1.12/kubernetes-guides/configuration/synology-csi.md new file mode 100644 index 000000000..238eeb63d --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/synology-csi.md @@ -0,0 +1,259 @@ +--- +title: "iSCSI Storage with Synology CSI" +description: "Automatically provision iSCSI volumes on a Synology NAS with the synology-csi driver." +aliases: + - ../../guides/synology-csi +--- + +## Background + +Synology is a company that specializes in Network Attached Storage (NAS) devices. +They provide a number of features within a simple web OS, including an LDAP server, Docker support, and (perhaps most relevant to this guide) function as an iSCSI host. +The focus of this guide is to allow a Kubernetes cluster running on Talos to provision Kubernetes storage (both dynamic or static) on a Synology NAS using a direct integration, rather than relying on an intermediary layer like Rook/Ceph or Maystor. + +This guide assumes a very basic familiarity with iSCSI terminology (LUN, iSCSI target, etc.). + +## Prerequisites + +* Synology NAS running DSM 7.0 or above +* Provisioned Talos cluster running Kubernetes v1.20 or above with `siderolabs/iscsi-tools` extension installed +* (Optional) Both [Volume Snapshot CRDs](https://github.com/kubernetes-csi/external-snapshotter/tree/v4.0.0/client/config/crd) and the [common snapshot controller](https://github.com/kubernetes-csi/external-snapshotter/tree/v4.0.0/deploy/kubernetes/snapshot-controller) must be installed in your Kubernetes cluster if you want to use the **Snapshot** feature + +## Setting up the Synology user account + +The `synology-csi` controller interacts with your NAS in two different ways: via the API and via the iSCSI protocol. +Actions such as creating a new iSCSI target or deleting an old one are accomplished via the Synology API, and require administrator access. +On the other hand, mounting the disk to a pod and reading from / writing to it will utilize iSCSI. +Because you can only authenticate with one account per DSM configured, that account needs to have admin privileges. +In order to minimize access in the case of these credentials being compromised, you should configure the account with the lease possible amount of access – explicitly specify "No Access" on all volumes when configuring the user permissions. + +## Setting up the Synology CSI + +> Note: this guide is paraphrased from the Synology CSI [readme](https://github.com/zebernst/synology-csi-talos). +> Please consult the readme for more in-depth instructions and explanations. + +Clone the git repository. + +```bash +git clone https://github.com/zebernst/synology-csi-talos.git +``` + +While Synology provides some automated scripts to deploy the CSI driver, they can be finicky especially when making changes to the source code. +We will be configuring and deploying things manually in this guide. + +The relevant files we will be touching are in the following locations: + +```text +. +├── Dockerfile +├── Makefile +├── config +│ └── client-info-template.yml +└── deploy + └── kubernetes + └── v1.20 + ├── controller.yml + ├── csi-driver.yml + ├── namespace.yml + ├── node.yml + ├── snapshotter + │ ├── snapshotter.yaml + │ └── volume-snapshot-class.yml + └── storage-class.yml +``` + +### Configure connection info + +Use `config/client-info-template.yml` as an example to configure the connection information for DSM. +You can specify **one or more** storage systems on which the CSI volumes will be created. +See below for an example: + +```yaml +--- +clients: +- host: 192.168.1.1 # ipv4 address or domain of the DSM + port: 5000 # port for connecting to the DSM + https: false # set this true to use https. you need to specify the port to DSM HTTPS port as well + username: username # username + password: password # password +``` + +Create a Kubernetes secret using the client information config file. + +```bash +kubectl create secret -n synology-csi generic client-info-secret --from-file=config/client-info.yml +``` + +Note that if you rename the secret to something other than `client-info-secret`, make sure you update the corresponding references in the deployment manifests as well. + +### Build the Talos-compatible image + +Modify the `Makefile` so that the image is built and tagged under your GitHub Container Registry username: + +```makefile +REGISTRY_NAME=ghcr.io/ +``` + +When you run `make docker-build` or `make docker-build-multiarch`, it will push the resulting image to `ghcr.io//synology-csi:v1.1.0`. +Ensure that you find and change any reference to `synology/synology-csi:v1.1.0` to point to your newly-pushed image within the deployment manifests. + +### Configure the CSI driver + +By default, the deployment manifests include one storage class and one volume snapshot class. +See below for examples: + +```yaml +--- +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + annotations: + storageclass.kubernetes.io/is-default-class: "false" + name: syno-storage +provisioner: csi.san.synology.com +parameters: + fsType: 'ext4' + dsm: '192.168.1.1' + location: '/volume1' +reclaimPolicy: Retain +allowVolumeExpansion: true +--- +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: syno-snapshot + annotations: + storageclass.kubernetes.io/is-default-class: "false" +driver: csi.san.synology.com +deletionPolicy: Delete +parameters: + description: 'Kubernetes CSI' +``` + +It can be useful to configure multiple different StorageClasses. +For example, a popular strategy is to create two nearly identical StorageClasses, with one configured with `reclaimPolicy: Retain` and the other with `reclaimPolicy: Delete`. +Alternately, a workload may require a specific filesystem, such as `ext4`. +If a Synology NAS is going to be the most common way to configure storage on your cluster, it can be convenient to add the `storageclass.kubernetes.io/is-default-class: "true"` annotation to one of your StorageClasses. + +The following table details the configurable parameters for the Synology StorageClass. + +| Name | Type | Description | Default | Supported protocols | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- | ------------------- | +| *dsm* | string | The IPv4 address of your DSM, which must be included in the `client-info.yml` for the CSI driver to log in to DSM | - | iSCSI, SMB | +| *location* | string | The location (/volume1, /volume2, ...) on DSM where the LUN for *PersistentVolume* will be created | - | iSCSI, SMB | +| *fsType* | string | The formatting file system of the *PersistentVolumes* when you mount them on the pods. This parameter only works with iSCSI. For SMB, the fsType is always ‘cifs‘. | `ext4` | iSCSI | +| *protocol* | string | The backing storage protocol. Enter ‘iscsi’ to create LUNs or ‘smb‘ to create shared folders on DSM. | `iscsi` | iSCSI, SMB | +| *csi.storage.k8s.io/node-stage-secret-name* | string | The name of node-stage-secret. Required if DSM shared folder is accessed via SMB. | - | SMB | +| *csi.storage.k8s.io/node-stage-secret-namespace* | string | The namespace of node-stage-secret. Required if DSM shared folder is accessed via SMB. | - | SMB | + +The VolumeSnapshotClass can be similarly configured with the following parameters: + +| Name | Type | Description | Default | Supported protocols | +| ------------- | ------ | -------------------------------------------- | ------- | ------------------- | +| *description* | string | The description of the snapshot on DSM | - | iSCSI | +| *is_locked* | string | Whether you want to lock the snapshot on DSM | `false` | iSCSI, SMB | + +### Apply YAML manifests + +Once you have created the desired StorageClass(es) and VolumeSnapshotClass(es), the final step is to apply the Kubernetes manifests against the cluster. +The easiest way to apply them all at once is to create a `kustomization.yaml` file in the same directory as the manifests and use Kustomize to apply: + +```bash +kubectl apply -k path/to/manifest/directory +``` + +Alternately, you can apply each manifest one-by-one: + +```bash +kubectl apply -f +``` + +## Run performance tests + +In order to test the provisioning, mounting, and performance of using a Synology NAS as Kubernetes persistent storage, use the following command: + +```bash +kubectl apply -f speedtest.yaml +``` + +Content of speedtest.yaml ([source](https://github.com/phnmnl/k8s-volume-test)) + +```yaml +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: test-claim +spec: +# storageClassName: syno-storage + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5G +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: read +spec: + template: + metadata: + name: read + labels: + app: speedtest + job: read + spec: + containers: + - name: read + image: ubuntu:xenial + command: ["dd","if=/mnt/pv/test.img","of=/dev/null","bs=8k"] + volumeMounts: + - mountPath: "/mnt/pv" + name: test-volume + volumes: + - name: test-volume + persistentVolumeClaim: + claimName: test-claim + restartPolicy: Never +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: write +spec: + template: + metadata: + name: write + labels: + app: speedtest + job: write + spec: + containers: + - name: write + image: ubuntu:xenial + command: ["dd","if=/dev/zero","of=/mnt/pv/test.img","bs=1G","count=1","oflag=dsync"] + volumeMounts: + - mountPath: "/mnt/pv" + name: test-volume + volumes: + - name: test-volume + persistentVolumeClaim: + claimName: test-claim + restartPolicy: Never +``` + +If these two jobs complete successfully, use the following commands to get the results of the speed tests: + +```bash +# Pod logs for read test: +kubectl logs -l app=speedtest,job=read + +# Pod logs for write test: +kubectl logs -l app=speedtest,job=write +``` + +When you're satisfied with the results of the test, delete the artifacts created from the speedtest: + +```bash +kubectl delete -f speedtest.yaml +``` diff --git a/website/content/v1.12/kubernetes-guides/configuration/usernamespace.md b/website/content/v1.12/kubernetes-guides/configuration/usernamespace.md new file mode 100644 index 000000000..f8503efc1 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/configuration/usernamespace.md @@ -0,0 +1,30 @@ +--- +title: "User Namespaces" +description: "Guide on how to configure Talos Cluster to support User Namespaces" +--- + +User Namespaces are a feature of the Linux kernel that allows unprivileged users to have their own range of UIDs and GIDs, without needing to be root. + +Refer to the [official documentation](https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/) for more information on Usernamespaces. + +## Enabling Usernamespaces + +To enable User Namespaces in Talos, you need to add the following configuration to Talos machine configuration: + +```yaml +--- +cluster: + apiServer: + extraArgs: + feature-gates: UserNamespacesSupport=true,UserNamespacesPodSecurityStandards=true +machine: + sysctls: + user.max_user_namespaces: "11255" + kubelet: + extraConfig: + featureGates: + UserNamespacesSupport: true + UserNamespacesPodSecurityStandards: true +``` + +After applying the configuration, refer to the [official documentation](https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/) to configure workloads to use User Namespaces. diff --git a/website/content/v1.12/kubernetes-guides/network/_index.md b/website/content/v1.12/kubernetes-guides/network/_index.md new file mode 100644 index 000000000..420161673 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/network/_index.md @@ -0,0 +1,5 @@ +--- +title: "Network" +weight: 20 +description: "Managing the Kubernetes cluster networking" +--- diff --git a/website/content/v1.12/kubernetes-guides/network/deploying-cilium.md b/website/content/v1.12/kubernetes-guides/network/deploying-cilium.md new file mode 100644 index 000000000..0a305d464 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/network/deploying-cilium.md @@ -0,0 +1,437 @@ +--- +title: "Deploying Cilium CNI" +description: "In this guide you will learn how to set up Cilium CNI on Talos." +aliases: + - ../../guides/deploying-cilium +--- + +> Cilium can be installed either via the `cilium` cli or using `helm`. + +This documentation will outline installing Cilium CNI v1.18.0 on Talos in six different ways. +Adhering to Talos principles we'll deploy Cilium with IPAM mode set to Kubernetes, and using the `cgroupv2` and `bpffs` mount that talos already provides. +As Talos does not allow loading kernel modules by Kubernetes workloads, `SYS_MODULE` capability needs to be dropped from the Cilium default set of values, this override can be seen in the helm/cilium cli install commands. +Each method can either install Cilium using kube proxy (default) or without: [Kubernetes Without kube-proxy](https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/) + +In this guide we assume that [KubePrism]({{< relref "../configuration/kubeprism" >}}) is enabled and configured to use the port 7445. + +## Machine config preparation + +When generating the machine config for a node set the CNI to none. +For example using a config patch: + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: none +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +Or if you want to deploy Cilium without kube-proxy, you also need to disable kube proxy: + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: none + proxy: + disabled: true +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +### Installation using Cilium CLI + +> Note: It is recommended to template the cilium manifest using helm and use it as part of Talos machine config, but if you want to install Cilium using the Cilium CLI, you can follow the steps below. + +Install the [Cilium CLI](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/#install-the-cilium-cli) following the steps here. + +#### With kube-proxy + +```bash +cilium install \ + --set ipam.mode=kubernetes \ + --set kubeProxyReplacement=false \ + --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set cgroup.autoMount.enabled=false \ + --set cgroup.hostRoot=/sys/fs/cgroup +``` + +#### Without kube-proxy + +```bash +cilium install \ + --set ipam.mode=kubernetes \ + --set kubeProxyReplacement=true \ + --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set cgroup.autoMount.enabled=false \ + --set cgroup.hostRoot=/sys/fs/cgroup \ + --set k8sServiceHost=localhost \ + --set k8sServicePort=7445 +``` + +Or if you want to deploy Cilium with support for Gateway API (requires installing cilium without kube-proxy), install [Gateway API CRDs](https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/#prerequisites) and set some extra parameters: + +```bash +cilium install \ + --set ipam.mode=kubernetes \ + --set kubeProxyReplacement=true \ + --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set cgroup.autoMount.enabled=false \ + --set cgroup.hostRoot=/sys/fs/cgroup \ + --set k8sServiceHost=localhost \ + --set k8sServicePort=7445 \ + --set gatewayAPI.enabled=true \ + --set gatewayAPI.enableAlpn=true \ + --set gatewayAPI.enableAppProtocol=true +``` + +> Note: If you plan to use gRPC and GRPCRoutes with TLS, you must enable ALPN by setting `gatewayAPI.enableAlpn=true`. +> Since gRPC relies on HTTP/2, ALPN is required to negotiate HTTP/2 support between the client and server. + +### Installation using Helm + +Refer to [Installing with Helm](https://docs.cilium.io/en/stable/installation/k8s-install-helm/) for more information. + +First we'll need to add the helm repo for Cilium. + +```bash +helm repo add cilium https://helm.cilium.io/ +helm repo update +``` + +### Method 1: Helm install + +After applying the machine config and bootstrapping Talos will appear to hang on phase 18/19 with the message: retrying error: node not ready. +This happens because nodes in Kubernetes are only marked as ready once the CNI is up. +As there is no CNI defined, the boot process is pending and will reboot the node to retry after 10 minutes, this is expected behavior. + +During this window you can install Cilium manually by running the following: + +```bash +helm install \ + cilium \ + cilium/cilium \ + --version 1.18.0 \ + --namespace kube-system \ + --set ipam.mode=kubernetes \ + --set kubeProxyReplacement=false \ + --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set cgroup.autoMount.enabled=false \ + --set cgroup.hostRoot=/sys/fs/cgroup +``` + +Or if you want to deploy Cilium without kube-proxy, also set some extra parameters: + +```bash +helm install \ + cilium \ + cilium/cilium \ + --version 1.18.0 \ + --namespace kube-system \ + --set ipam.mode=kubernetes \ + --set kubeProxyReplacement=true \ + --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set cgroup.autoMount.enabled=false \ + --set cgroup.hostRoot=/sys/fs/cgroup \ + --set k8sServiceHost=localhost \ + --set k8sServicePort=7445 +``` + +And with GatewayAPI support: + +```bash +... + --set=gatewayAPI.enabled=true \ + --set=gatewayAPI.enableAlpn=true \ + --set=gatewayAPI.enableAppProtocol=true +``` + +After Cilium is installed the boot process should continue and complete successfully. + +### Method 2: Helm manifests install + +Instead of directly installing Cilium you can instead first generate the manifest and then apply it: + +```bash +helm template \ + cilium \ + cilium/cilium \ + --version 1.18.0 \ + --namespace kube-system \ + --set ipam.mode=kubernetes \ + --set kubeProxyReplacement=false \ + --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set cgroup.autoMount.enabled=false \ + --set cgroup.hostRoot=/sys/fs/cgroup > cilium.yaml + +kubectl apply -f cilium.yaml +``` + +Without kube-proxy: + +```bash +helm template \ + cilium \ + cilium/cilium \ + --version 1.18.0 \ + --namespace kube-system \ + --set ipam.mode=kubernetes \ + --set kubeProxyReplacement=true \ + --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set cgroup.autoMount.enabled=false \ + --set cgroup.hostRoot=/sys/fs/cgroup \ + --set k8sServiceHost=localhost \ + --set k8sServicePort=7445 > cilium.yaml + +kubectl apply -f cilium.yaml +``` + +### Method 3: Helm manifests hosted install + +After generating `cilium.yaml` using `helm template`, instead of applying this manifest directly during the Talos boot window (before the reboot timeout). +You can also host this file somewhere and patch the machine config to apply this manifest automatically during bootstrap. +To do this patch your machine configuration to include this config instead of the above: + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: custom + urls: + - https://server.yourdomain.tld/some/path/cilium.yaml +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +However, beware of the fact that the helm generated Cilium manifest contains sensitive key material. +As such you should definitely not host this somewhere publicly accessible. + +### Method 4: Helm manifests inline install + +A more secure option would be to include the `helm template` output manifest inside the machine configuration. +The machine config should be generated with CNI set to `none` + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: none +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +if deploying Cilium with `kube-proxy` disabled, you can also include the following: + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: none + proxy: + disabled: true +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +To do so patch this into your machine configuration: + +``` yaml +cluster: + inlineManifests: + - name: cilium + contents: | + -- + # Source: cilium/templates/cilium-agent/serviceaccount.yaml + apiVersion: v1 + kind: ServiceAccount + metadata: + name: "cilium" + namespace: kube-system + --- + # Source: cilium/templates/cilium-operator/serviceaccount.yaml + apiVersion: v1 + kind: ServiceAccount + -> Your cilium.yaml file will be pretty long.... +``` + +This will install the Cilium manifests at just the right time during bootstrap. + +Beware though: + +- Changing the namespace when templating with Helm does not generate a manifest containing the yaml to create that namespace. +As the inline manifest is processed from top to bottom make sure to manually put the namespace yaml at the start of the inline manifest. +- Only add the Cilium inline manifest to the control plane nodes machine configuration. +- Make sure all control plane nodes have an identical configuration. +- If you delete any of the generated resources they will be restored whenever a control plane node reboots. +- As a safety measure, Talos only creates missing resources from inline manifests, it never deletes or updates anything. +- If you need to update a manifest make sure to first edit all control plane machine configurations and then run `talosctl upgrade-k8s` as it will take care of updating inline manifests. + +### Method 5: Using a job + +We can utilize a job pattern run arbitrary logic during bootstrap time. +We can leverage this to our advantage to install Cilium by using an inline manifest as shown in the example below: + +``` yaml +cluster: + inlineManifests: + - name: cilium-install + contents: | + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: cilium-install + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin + subjects: + - kind: ServiceAccount + name: cilium-install + namespace: kube-system + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + name: cilium-install + namespace: kube-system + --- + apiVersion: batch/v1 + kind: Job + metadata: + name: cilium-install + namespace: kube-system + spec: + backoffLimit: 10 + template: + metadata: + labels: + app: cilium-install + spec: + restartPolicy: OnFailure + tolerations: + - operator: Exists + - effect: NoSchedule + operator: Exists + - effect: NoExecute + operator: Exists + - effect: PreferNoSchedule + operator: Exists + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoExecute + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: PreferNoSchedule + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: Exists + serviceAccount: cilium-install + serviceAccountName: cilium-install + hostNetwork: true + containers: + - name: cilium-install + image: quay.io/cilium/cilium-cli:latest + env: + - name: KUBERNETES_SERVICE_HOST + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.podIP + - name: KUBERNETES_SERVICE_PORT + value: "6443" + command: + - cilium + - install + - --set + - ipam.mode=kubernetes + - --set + - kubeProxyReplacement=true + - --set + - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} + - --set + - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} + - --set + - cgroup.autoMount.enabled=false + - --set + - cgroup.hostRoot=/sys/fs/cgroup + - --set + - k8sServiceHost=localhost + - --set + - k8sServicePort=7445 +``` + +Because there is no CNI present at installation time the kubernetes.default.svc cannot be used to install Cilium, to overcome this limitation we'll utilize the host network connection to connect back to itself with 'hostNetwork: true' in tandem with the environment variables KUBERNETES_SERVICE_PORT and KUBERNETES_SERVICE_HOST. + +The job runs a container to install cilium to your liking, after the job is finished Cilium can be managed/operated like usual. + +The above can be combined exchanged with for example Method 3 to host arbitrary configurations externally but render/run them at bootstrap time. + +## Known issues + +- There are some gotchas when using Talos and Cilium on the Google cloud platform when using internal load balancers. +For more details: [GCP ILB support / support scope local routes to be configured](https://github.com/siderolabs/talos/issues/4109) + +- When using Talos `forwardKubeDNSToHost=true` option (which is enabled by default) in combination with cilium `bpf.masquerade=true`. +There is a known issue that causes `CoreDNS` to not work correctly. +As a workaround, configuring `forwardKubeDNSToHost=false` resolves the issue. +For more details see [the discusssion here](https://github.com/siderolabs/talos/pull/9200) + +## Other things to know + +- After installing Cilium, `cilium connectivity test` might hang and/or fail with errors similar to + + ```Error creating: pods "client-69748f45d8-9b9jg" is forbidden: violates PodSecurity "baseline:latest": non-default capabilities (container "client" must not include "NET_RAW" in securityContext.capabilities.add)``` + + This is expected, you can workaround it by adding the `pod-security.kubernetes.io/enforce=privileged` [label on the namespace level]({{< relref "../configuration/pod-security">}}). + +- Talos has full kernel module support for eBPF, See: + - [Cilium System Requirements](https://docs.cilium.io/en/stable/operations/system_requirements/) + - [Talos Kernel Config AMD64](https://github.com/siderolabs/pkgs/blob/main/kernel/build/config-amd64) + - [Talos Kernel Config ARM64](https://github.com/siderolabs/pkgs/blob/main/kernel/build/config-arm64) diff --git a/website/content/v1.12/kubernetes-guides/network/multus.md b/website/content/v1.12/kubernetes-guides/network/multus.md new file mode 100644 index 000000000..2bddb3c51 --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/network/multus.md @@ -0,0 +1,200 @@ +--- +title: "Multus CNI" +description: "A brief instruction on howto use Multus on Talos Linux" +--- + +[Multus CNI](https://github.com/k8snetworkplumbingwg/multus-cni) is a container network interface (CNI) plugin for Kubernetes that enables attaching multiple network interfaces to pods. +Typically, in Kubernetes each pod only has one network interface (apart from a loopback) -- with Multus you can create a multi-homed pod that has multiple interfaces. +This is accomplished by Multus acting as a "meta-plugin", a CNI plugin that can call multiple other CNI plugins. + +## Installation + +Multus can be deployed by simply applying the `thick` `DaemonSet` with `kubectl`. + +```bash +kubectl apply -f https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/master/deployments/multus-daemonset-thick.yml +``` + +This will create a `DaemonSet` and a CRD: `NetworkAttachmentDefinition`. +This can be used to specify your network configuration. + +## Configuration + +### Patching the `DaemonSet` + +For Multus to properly work with Talos a change need to be made to the `DaemonSet`. +Instead of of mounting the volume called `host-run-netns` on `/run/netns` it has to be mounted on `/var/run/netns`. + +Edit the `DaemonSet` and change the volume `host-run-netns` from `/run/netns` to `/var/run/netns`. + +```yaml +... + - name: host-run-netns + hostPath: + path: /var/run/netns/ +``` + +Failing to do so will leave your cluster crippled. +Running pods will remain running but new pods and deployments will give you the following error in the events: + +```text + Normal Scheduled 3s default-scheduler Successfully assigned virtualmachines/samplepod to virt2 + Warning FailedCreatePodSandBox 3s kubelet Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "3a6a58386dfbf2471a6f86bd41e4e9a32aac54ccccd1943742cb67d1e9c58b5b": plugin type="multus-shim" name="multus-cni-network" failed (add): CmdAdd (shim): CNI request failed with status 400: 'ContainerID:"3a6a58386dfbf2471a6f86bd41e4e9a32aac54ccccd1943742cb67d1e9c58b5b" Netns:"/var/run/netns/cni-1d80f6e3-fdab-4505-eb83-7deb17431293" IfName:"eth0" Args:"IgnoreUnknown=1;K8S_POD_NAMESPACE=virtualmachines;K8S_POD_NAME=samplepod;K8S_POD_INFRA_CONTAINER_ID=3a6a58386dfbf2471a6f86bd41e4e9a32aac54ccccd1943742cb67d1e9c58b5b;K8S_POD_UID=8304765e-fd7e-4968-9144-c42c53be04f4" Path:"" ERRORED: error configuring pod [virtualmachines/samplepod] networking: [virtualmachines/samplepod/8304765e-fd7e-4968-9144-c42c53be04f4:cbr0]: error adding container to network "cbr0": DelegateAdd: cannot set "" interface name to "eth0": validateIfName: no net namespace /var/run/netns/cni-1d80f6e3-fdab-4505-eb83-7deb17431293 found: failed to Statfs "/var/run/netns/cni-1d80f6e3-fdab-4505-eb83-7deb17431293": no such file or directory +': StdinData: {"capabilities":{"portMappings":true},"clusterNetwork":"/host/etc/cni/net.d/10-flannel.conflist","cniVersion":"0.3.1","logLevel":"verbose","logToStderr":true,"name":"multus-cni-network","type":"multus-shim"} +``` + +As of March 21, 2025, Multus has a [bug](https://github.com/k8snetworkplumbingwg/multus-cni/issues/1221) in the `install-multus-binary` container that can be lead to race problems after a node reboot. +To prevent this issue, it is necessary to patch this container. +Set the following command to the `install-multus-binary` container. + +```yaml + initContainers: + - name: install-multus-binary + command: + - "/usr/src/multus-cni/bin/install_multus" + - "-d" + - "/host/opt/cni/bin" + - "-t" + - "thick" +``` + +### Creating your `NetworkAttachmentDefinition` + +The `NetworkAttachmentDefinition` configuration is used to define your bridge where your second pod interface needs to be attached to. + +```yaml +apiVersion: "k8s.cni.cncf.io/v1" +kind: NetworkAttachmentDefinition +metadata: + name: macvlan-conf +spec: + config: '{ + "cniVersion": "0.3.0", + "type": "macvlan", + "master": "eth0", + "mode": "bridge", + "ipam": { + "type": "host-local", + "subnet": "192.168.1.0/24", + "rangeStart": "192.168.1.200", + "rangeEnd": "192.168.1.216", + "routes": [ + { "dst": "0.0.0.0/0" } + ], + "gateway": "192.168.1.1" + } + }' +``` + +In this example `macvlan` is used as a bridge type. +There are 3 types of bridges: `bridge`, `macvlan` and `ipvlan`: + +1. `bridge` is a way to connect two Ethernet segments together in a protocol-independent way. + Packets are forwarded based on Ethernet address, rather than IP address (like a router). + Since forwarding is done at Layer 2, all protocols can go transparently through a bridge. + In terms of containers or virtual machines, a bridge can also be used to connect the virtual interfaces of each container/VM to the host network, allowing them to communicate. + +2. `macvlan` is a driver that makes it possible to create virtual network interfaces that appear as distinct physical devices each with unique MAC addresses. + The underlying interface can route traffic to each of these virtual interfaces separately, as if they were separate physical devices. + This means that each macvlan interface can have its own IP subnet and routing. + Macvlan interfaces are ideal for situations where containers or virtual machines require the same network access as the host system. + +3. `ipvlan` is similar to `macvlan`, with the key difference being that ipvlan shares the parent's MAC address, which requires less configuration from the networking equipment. + This makes deployments simpler in certain situations where MAC address control or limits are in place. + It offers two operational modes: L2 mode (the default) where it behaves similarly to a MACVLAN, and L3 mode for routing based traffic isolation (rather than bridged). + +When using the `bridge` interface you must also configure a bridge on your Talos nodes. +That can be done by updating Talos Linux machine configuration: + +```yaml +machine: + network: + interfaces: + - interface: br0 + addresses: + - 172.16.1.60/24 + bridge: + stp: + enabled: true + interfaces: + - eno1 # This must be changed to your matching interface name + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 172.16.1.254 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. +``` + +More information about the configuration of bridges can be found [here](https://github.com/k8snetworkplumbingwg/multus-cni/tree/master/docs) + +## Attaching the `NetworkAttachmentDefinition` to your `Pod` or `Deployment` + +After the `NetworkAttachmentDefinition` is configured, you can attach that interface to your your `Deployment` or `Pod`. +In this example we use a pod: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: samplepod + annotations: + k8s.v1.cni.cncf.io/networks: macvlan-conf +spec: + containers: + - name: samplepod + command: ["/bin/ash", "-c", "trap : TERM INT; sleep infinity & wait"] + image: alpine +``` + +## Notes on using KubeVirt in combination with Multus + +If you would like to use KubeVirt and expose your virtual machine to the outside world with Multus, make sure to configure a `bridge` instead of `macvlan` or `ipvlan`, because that doesn't work, according to the KubeVirt [Documentation](https://kubevirt.io/user-guide/virtual_machines/interfaces_and_networks/#invalid-cnis-for-secondary-networks). + +> Invalid CNIs for secondary networks +> The following list of CNIs is known not to work for bridge interfaces - which are most common for secondary interfaces. +> +> * macvlan +> * ipvlan +> +> The reason is similar: the bridge interface type moves the pod interface MAC address to the VM, leaving the pod interface with a different address. +> The aforementioned CNIs require the pod interface to have the original MAC address. + +## Notes on using Cilium in combination with Multus + +### CNI reference plugins + +Cilium does not ship the CNI reference plugins, which most multus setups are expecting (e.g. macvlan). +This can be addressed by extending the daemonset with an additional init-container, setting them up, e.g. using the following kustomize strategic-merge patch: + +```yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: kube-multus-ds + namespace: kube-system +spec: + template: + spec: + initContainers: + - command: + - /install-cni.sh + image: ghcr.io/siderolabs/install-cni:v1.7.0 # adapt to your talos version + name: install-cni + securityContext: + privileged: true + volumeMounts: + - mountPath: /host/opt/cni/bin + mountPropagation: Bidirectional + name: cnibin +``` + +### Exclusive CNI + +By default, Cilium is an exclusive CNI, meaning it removes other CNI configuration files. +However, when using Multus, this behavior needs to be disabled. +To do so, set the Helm variable `cni.exclusive=false`. +For more information, refer to the [Cilium documentation](https://docs.cilium.io/en/stable/network/kubernetes/configuration/#adjusting-cni-configuration). + +## Notes on ARM64 nodes + +The official images (as of 29.07.24) are built incorrectly for ARM64 ([ref](https://github.com/k8snetworkplumbingwg/multus-cni/issues/1251)). +Self-building them is an adequate workaround for now. diff --git a/website/content/v1.12/kubernetes-guides/upgrading-kubernetes.md b/website/content/v1.12/kubernetes-guides/upgrading-kubernetes.md new file mode 100644 index 000000000..4c8e7b85f --- /dev/null +++ b/website/content/v1.12/kubernetes-guides/upgrading-kubernetes.md @@ -0,0 +1,387 @@ +--- +title: "Upgrading Kubernetes" +description: "Guide on how to upgrade the Kubernetes cluster from Talos Linux." +aliases: + - guides/upgrading-kubernetes +--- + +This guide covers upgrading Kubernetes on Talos Linux clusters. + +For a list of Kubernetes versions compatible with each Talos release, see the [Support Matrix]({{< relref "../introduction/support-matrix" >}}). + +For upgrading the Talos Linux operating system, see [Upgrading Talos]({{< relref "../talos-guides/upgrading-talos" >}}) + +## Video Walkthrough + +To see a demo of this process, watch this video: + + + +## Automated Kubernetes Upgrade + +The recommended method to upgrade Kubernetes is to use the `talosctl upgrade-k8s` command. +This will automatically update the components needed to upgrade Kubernetes safely. +Upgrading Kubernetes is non-disruptive to the cluster workloads. + +To trigger a Kubernetes upgrade, issue a command specifying the version of Kubernetes to ugprade to, such as: + +`talosctl --nodes upgrade-k8s --to {{< k8s_release >}}` + +Note that the `--nodes` parameter specifies the control plane node to send the API call to, but all members of the cluster will be upgraded. + +To check what will be upgraded you can run `talosctl upgrade-k8s` with the `--dry-run` flag: + +```bash +$ talosctl --nodes upgrade-k8s --to {{< k8s_release >}} --dry-run +WARNING: found resources which are going to be deprecated/migrated in the version {{< k8s_release >}} +RESOURCE COUNT +validatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 4 +mutatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 3 +customresourcedefinitions.v1beta1.apiextensions.k8s.io 25 +apiservices.v1beta1.apiregistration.k8s.io 54 +leases.v1beta1.coordination.k8s.io 4 +automatically detected the lowest Kubernetes version {{< k8s_prev_release >}} +checking for resource APIs to be deprecated in version {{< k8s_release >}} +discovered controlplane nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] +discovered worker nodes ["172.20.0.5" "172.20.0.6"] +updating "kube-apiserver" to version "{{< k8s_release >}}" + > "172.20.0.2": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > skipped in dry-run + > "172.20.0.3": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > skipped in dry-run + > "172.20.0.4": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > skipped in dry-run +updating "kube-controller-manager" to version "{{< k8s_release >}}" + > "172.20.0.2": starting update + > update kube-controller-manager: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > skipped in dry-run + > "172.20.0.3": starting update + + + +updating manifests + > apply manifest Secret bootstrap-token-3lb63t + > apply skipped in dry run + > apply manifest ClusterRoleBinding system-bootstrap-approve-node-client-csr + > apply skipped in dry run + +``` + +To upgrade Kubernetes from v{{< k8s_prev_release >}} to v{{< k8s_release >}} run: + +```bash +$ talosctl --nodes upgrade-k8s --to {{< k8s_release >}} +automatically detected the lowest Kubernetes version {{< k8s_prev_release >}} +checking for resource APIs to be deprecated in version {{< k8s_release >}} +discovered controlplane nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] +discovered worker nodes ["172.20.0.5" "172.20.0.6"] +updating "kube-apiserver" to version "{{< k8s_release >}}" + > "172.20.0.2": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > "172.20.0.2": machine configuration patched + > "172.20.0.2": waiting for API server state pod update + < "172.20.0.2": successfully updated + > "172.20.0.3": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + +``` + +This command runs in several phases: + +1. Images for new Kubernetes components are pre-pulled to the nodes to minimize downtime and test for image availability. +2. Every control plane node machine configuration is patched with the new image version for each control plane component. + Talos renders new static pod definitions on the configuration update which is picked up by the kubelet. + The command waits for the change to propagate to the API server state. +3. The command updates the `kube-proxy` daemonset with the new image version. +4. On every node in the cluster, the `kubelet` version is updated. + The command then waits for the `kubelet` service to be restarted and become healthy. + The update is verified by checking the `Node` resource state. +5. Kubernetes bootstrap manifests are re-applied to the cluster. + Updated bootstrap manifests might come with a new Talos version (e.g. CoreDNS version update), or might be the result of machine configuration change. + +> Note: The `upgrade-k8s` command never deletes any resources from the cluster: they should be deleted manually. + +If the command fails for any reason, it can be safely restarted to continue the upgrade process from the moment of the failure. + +> Note: When using custom/overridden Kubernetes component images, use flags `--*-image` to override the default image names. + +## Manual Kubernetes Upgrade + +Kubernetes can be upgraded manually by following the steps outlined below. +They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. + +### Kubeconfig + +In order to edit the control plane, you need a working `kubectl` config. +If you don't already have one, you can get one by running: + +```bash +talosctl --nodes kubeconfig +``` + +### API Server + +Patch machine configuration using `talosctl patch` command: + +```bash +$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "registry.k8s.io/kube-apiserver:v{{< k8s_release >}}"}]' +patched mc at the node 172.20.0.2 +``` + +The JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. + +Also the machine configuration can be edited manually with `talosctl -n edit mc --mode=no-reboot`. + +Capture the new version of `kube-apiserver` config with: + +```bash +$ talosctl -n get apiserverconfig -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: APIServerConfigs.kubernetes.talos.dev + id: kube-apiserver + version: 5 + owner: k8s.ControlPlaneAPIServerController + phase: running +spec: + image: registry.k8s.io/kube-apiserver:v{{< k8s_release >}} + cloudProvider: "" + controlPlaneEndpoint: https://172.20.0.1:6443 + etcdServers: + - https://localhost:2379 + localPort: 6443 + serviceCIDR: + - 10.96.0.0/12 + extraArgs: {} + extraVolumes: [] + environmentVariables: {} + podSecurityPolicyEnabled: false + advertisedAddress: $(POD_IP) + resources: + requests: + cpu: "" + memory: "" + limits: {} +``` + +In this example, the new version is `5`. +Wait for the new pod definition to propagate to the API server state (replace `talos-default-controlplane-1` with the node name): + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-controlplane-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' +5 +``` + +Check that the pod is running: + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-controlplane-1 +NAME READY STATUS RESTARTS AGE +kube-apiserver-talos-default-controlplane-1 1/1 Running 0 16m +``` + +Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. + +### Controller Manager + +Patch machine configuration using `talosctl patch` command: + +```bash +$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "registry.k8s.io/kube-controller-manager:v{{< k8s_release >}}"}]' +patched mc at the node 172.20.0.2 +``` + +The JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. + +Capture new version of `kube-controller-manager` config with: + +```bash +$ talosctl -n get controllermanagerconfig -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: ControllerManagerConfigs.kubernetes.talos.dev + id: kube-controller-manager + version: 3 + owner: k8s.ControlPlaneControllerManagerController + phase: running +spec: + enabled: true + image: registry.k8s.io/kube-controller-manager:v{{< k8s_release >}} + cloudProvider: "" + podCIDRs: + - 10.244.0.0/16 + serviceCIDRs: + - 10.96.0.0/12 + extraArgs: {} + extraVolumes: [] + environmentVariables: {} + resources: + requests: + cpu: "" + memory: "" + limits: {} +``` + +In this example, new version is `3`. +Wait for the new pod definition to propagate to the API server state (replace `talos-default-controlplane-1` with the node name): + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-controlplane-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' +3 +``` + +Check that the pod is running: + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-controlplane-1 +NAME READY STATUS RESTARTS AGE +kube-controller-manager-talos-default-controlplane-1 1/1 Running 0 35m +``` + +Repeat this process for every control plane node, verifying that state propagated successfully between each node update. + +### Scheduler + +Patch machine configuration using `talosctl patch` command: + +```bash +$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "registry.k8s.io/kube-scheduler:v{{< k8s_release >}}"}]' +patched mc at the node 172.20.0.2 +``` + +JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. + +Capture new version of `kube-scheduler` config with: + +```bash +$ talosctl -n get schedulerconfig -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: SchedulerConfigs.kubernetes.talos.dev + id: kube-scheduler + version: 3 + owner: k8s.ControlPlaneSchedulerController + phase: running + created: 2024-11-06T12:37:22Z + updated: 2024-11-06T12:37:20Z +spec: + enabled: true + image: registry.k8s.io/kube-scheduler:v{{< k8s_release >}} + extraArgs: {} + extraVolumes: [] + environmentVariables: {} + resources: + requests: + cpu: "" + memory: "" + limits: {} + config: {} +``` + +In this example, new version is `3`. +Wait for the new pod definition to propagate to the API server state (replace `talos-default-controlplane-1` with the node name): + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-controlplane-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' +3 +``` + +Check that the pod is running: + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-controlplane-1 +NAME READY STATUS RESTARTS AGE +kube-scheduler-talos-default-controlplane-1 1/1 Running 0 39m +``` + +Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. + +### Proxy + +In the proxy's `DaemonSet`, change: + +```yaml +kind: DaemonSet +... +spec: + ... + template: + ... + spec: + containers: + - name: kube-proxy + image: registry.k8s.io/kube-proxy:v{{< k8s_prev_release >}} + tolerations: + - ... +``` + +to: + +```yaml +kind: DaemonSet +... +spec: + ... + template: + ... + spec: + containers: + - name: kube-proxy + image: registry.k8s.io/kube-proxy:v{{< k8s_release >}} + tolerations: + - ... + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule +``` + +To edit the `DaemonSet`, run: + +```bash +kubectl edit daemonsets -n kube-system kube-proxy +``` + +### Bootstrap Manifests + +Bootstrap manifests can be retrieved in a format which works for `kubectl` with the following command: + +```bash +talosctl -n get manifests -o yaml | yq eval-all '.spec | .[] | splitDoc' - > manifests.yaml +``` + +Diff the manifests with the cluster: + +```bash +kubectl diff -f manifests.yaml +``` + +Apply the manifests: + +```bash +kubectl apply -f manifests.yaml +``` + +> Note: if some bootstrap resources were removed, they have to be removed from the cluster manually. + +### kubelet + +For every node, patch machine configuration with new kubelet version, wait for the kubelet to restart with new version: + +```bash +$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/siderolabs/kubelet:v{{< k8s_release >}}"}]' +patched mc at the node 172.20.0.2 +``` + +Once `kubelet` restarts with the new configuration, confirm upgrade with `kubectl get nodes `: + +```bash +$ kubectl get nodes talos-default-controlplane-1 +NAME STATUS ROLES AGE VERSION +talos-default-controlplane-1 Ready control-plane 123m v{{< k8s_release >}} +``` diff --git a/website/content/v1.12/learn-more/_index.md b/website/content/v1.12/learn-more/_index.md new file mode 100644 index 000000000..0c6fe17a0 --- /dev/null +++ b/website/content/v1.12/learn-more/_index.md @@ -0,0 +1,4 @@ +--- +title: "Learn More" +weight: 80 +--- diff --git a/website/content/v1.12/learn-more/architecture.md b/website/content/v1.12/learn-more/architecture.md new file mode 100644 index 000000000..4b0c38dfb --- /dev/null +++ b/website/content/v1.12/learn-more/architecture.md @@ -0,0 +1,55 @@ +--- +title: "Architecture" +weight: 20 +description: "Learn the system architecture of Talos Linux itself." +--- + +Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. + +It is atomic in that the entirety of Talos is distributed as a +single, self-contained image, which is versioned, signed, and immutable. + +It is modular in that it is composed of many separate components +which have clearly defined gRPC interfaces which facilitate internal flexibility +and external operational guarantees. + +All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. +This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. +The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. +This is a key component in reducing coupling and maintaining modularity. + +## File system partitions + +Talos uses these partitions with the following labels: + +1. **EFI** - stores EFI boot data. +1. **BIOS** - used for GRUB's second stage boot. +1. **BOOT** - used for the boot loader, stores initramfs and kernel data. +1. **META** - stores metadata about the talos node, such as node id's. +1. **STATE** - stores machine configuration, node identity data for cluster discovery and KubeSpan info +1. **EPHEMERAL** - stores ephemeral state information, mounted at `/var` + +## The File System + +One of the unique design decisions in Talos is the layout of the root file system. +There are three "layers" to the Talos root file system. +At its core the rootfs is a read-only squashfs. +The squashfs is then mounted as a loop device into memory. +This provides Talos with an immutable base. + +The next layer is a set of `tmpfs` file systems for runtime specific needs. +Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. +One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). +For example, at boot Talos will write `/system/etc/hosts` and then bind mount it over `/etc/hosts`. +This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. + +All files under `/system` are completely recreated on each boot. +For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. +The `/etc/kubernetes` is a good example of this. +Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. + +The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. +This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). +Its content survives machine reboots and on machine upgrades, but it is wiped and lost on resets, unless the +`--system-labels-to-wipe` option of [`talosctl reset`]({{< relref "../reference/cli#talosctl-reset" >}}) +is used. diff --git a/website/content/v1.12/learn-more/components.md b/website/content/v1.12/learn-more/components.md new file mode 100644 index 000000000..f4262c798 --- /dev/null +++ b/website/content/v1.12/learn-more/components.md @@ -0,0 +1,120 @@ +--- +title: "Components" +weight: 40 +description: "Understand the system components that make up Talos Linux." +--- + +In this section, we discuss the various components that underpin Talos. + +## Components + +Talos Linux and Kubernetes are tightly integrated. + +![Talos Linux and Kubernetes components](/images/components.drawio.svg) + +In the following, the focus is on the Talos Linux specific components. + +| Component | Description | +| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `machined`. | +| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | +| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | +| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](https://kspp.github.io/). | +| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | +| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | + +### apid + +When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. +Apid acts as the gateway for all component interactions. +Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. + +We'll use some examples below to illustrate what `apid` is doing. + +When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. +The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. +Typically this is a public-facing server. +The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. +If `--nodes` is omitted, the first endpoint will be used. + +> Note: Typically, there will be an `endpoint` already defined in the Talos config file. +> Optionally, `nodes` can be included here as well. + +For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. + +```bash +$ talosctl -e cluster.talos.dev memory +NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE +cluster.talos.dev 7938 1768 2390 145 53 3724 6571 +``` + +In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. + +If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. + +```bash +$ talosctl -e cluster.talos.dev -n node02 memory +NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE +node02 7938 1768 2390 145 53 3724 6571 +``` + +The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. + +We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): + +```bash +$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory +NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE +node01 7938 871 4071 137 49 2945 7042 +node02 257844 14408 190796 18138 49 52589 227492 +node03 257844 1830 255186 125 49 777 254556 +``` + +The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. + +### containerd + +[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. + +Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. + +### machined + +A common theme throughout the design of Talos is minimalism. +We believe strongly in the UNIX philosophy that each program should do one job well. +The `init` included in Talos is one example of this, and we are calling it "`machined`". + +We wanted to create a focused `init` that had one job - run Kubernetes. +To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. +Only the services necessary to run Kubernetes and manage the node are available. +This includes: + +- containerd +- etcd +- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) +- networkd +- trustd +- udevd + +The `machined` process handles all machine configuration, API handling, resource and controller management. + +### kernel + +The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSPP](https://kspp.github.io/)). + +### trustd + +Security is one of the highest priorities within Talos. +To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. +For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. + +To that end, we created `trustd`. +Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. +Once trust is established, various methods become available to the trustee. +For example, it can accept a write request from another node to place a file on disk. + +Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. + +### udevd + +Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v1.12/learn-more/control-plane.md b/website/content/v1.12/learn-more/control-plane.md new file mode 100644 index 000000000..16fd8b08d --- /dev/null +++ b/website/content/v1.12/learn-more/control-plane.md @@ -0,0 +1,145 @@ +--- +title: "Control Plane" +weight: 50 +description: "Understand the Kubernetes Control Plane." +--- + +This guide provides information about the Kubernetes control plane, and details on how Talos runs and bootstraps the Kubernetes control plane. + + + +## What is a control plane node? + +A control plane node is a node which: + +- runs etcd, the Kubernetes database +- runs the Kubernetes control plane + - kube-apiserver + - kube-controller-manager + - kube-scheduler +- serves as an administrative proxy to the worker nodes + +These nodes are critical to the operation of your cluster. +Without control plane nodes, Kubernetes will not respond to changes in the +system, and certain central services may not be available. + +Talos nodes which have `.machine.type` of `controlplane` are control plane nodes. +(check via `talosctl get member`) + +Control plane nodes are tainted by default to prevent workloads from being scheduled onto them. +This is both to protect the control plane from workloads consuming resources and starving the control plane processes, and also to reduce the risk of a vulnerability exposes the control plane's credentials to a workload. + +## The Control Plane and Etcd + +A critical design concept of Kubernetes (and Talos) is the `etcd` database. + +Properly managed (which Talos Linux does), `etcd` should never have split brain or noticeable down time. +In order to do this, `etcd` maintains the concept of "membership" and of +"quorum". +To perform any operation, read or write, the database requires +quorum. +That is, a majority of members must agree on the current leader, and absenteeism (members that are down, or not reachable) +counts as a negative. +For example, if there are three members, at least two out +of the three must agree on the current leader. +If two disagree or fail to answer, the `etcd` database will lock itself +until quorum is achieved in order to protect the integrity of +the data. + +This design means that having two controlplane nodes is _worse_ than having only one, because if _either_ goes down, your database will lock (and the chance of one of two nodes going down is greater than the chance of just a single node going down). +Similarly, a 4 node etcd cluster is worse than a 3 node etcd cluster - a 4 node cluster requires 3 nodes to be up to achieve quorum (in order to have a majority), while the 3 node cluster requires 2 nodes: +i.e. both can support a single node failure and keep running - but the chance of a node failing in a 4 node cluster is higher than that in a 3 node cluster. + +Another note about etcd: due to the need to replicate data amongst members, performance of etcd _decreases_ as the cluster scales. +A 5 node cluster can commit about 5% less writes per second than a 3 node cluster running on the same hardware. + +## Recommendations for your control plane + +- Run your clusters with three or five control plane nodes. + Three is enough for most use cases. + Five will give you better availability (in that it can tolerate two node failures simultaneously), but cost you more both in the number of nodes required, and also as each node may require more hardware resources to offset the performance degradation seen in larger clusters. +- Implement good monitoring and put processes in place to deal with a failed node in a timely manner (and test them!) +- Even with robust monitoring and procedures for replacing failed nodes in place, backup etcd and your control plane node configuration to guard against unforeseen disasters. +- Monitor the performance of your etcd clusters. + If etcd performance is slow, vertically scale the nodes, not the number of nodes. +- If a control plane node fails, remove it first, then add the replacement node. + (This ensures that the failed node does not "vote" when adding in the new node, minimizing the chances of a quorum violation.) +- If replacing a node that has not failed, add the new one, then remove the old. + +## Bootstrapping the Control Plane + +Every new cluster must be bootstrapped only once, which is achieved by telling a single control plane node to initiate the bootstrap. + +Bootstrapping itself does not do anything with Kubernetes. +Bootstrapping only tells `etcd` to form a cluster, so don't judge the success of +a bootstrap by the failure of Kubernetes to start. +Kubernetes relies on `etcd`, so bootstrapping is _required_, but it is not +_sufficient_ for Kubernetes to start. +If your Kubernetes cluster fails to form for other reasons (say, a bad +configuration option or unavailable container repository), if the bootstrap API +call returns successfully, you do NOT need to bootstrap again: +just fix the config or let Kubernetes retry. + +### High-level Overview + +Talos cluster bootstrap flow: + +1. The `etcd` service is started on control plane nodes. + Instances of `etcd` on control plane nodes build the `etcd` cluster. +2. The `kubelet` service is started. +3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. +4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). +5. The `kubelet` registers the node in the API server. +6. Kubernetes control plane schedules pods on the nodes. + +### Cluster Bootstrapping + +All nodes start the `kubelet` service. +The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. + +One of the control plane nodes is chosen as the bootstrap node, and promoted using the bootstrap API (`talosctl bootstrap`). +The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. + +> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. + +Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. + +As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. +The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. +As soon as `kube-apiserver` is launched, the control plane endpoint comes up. + +The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. +The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. +The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. + +Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) + +The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. +The `etcd` cluster is now formed and consists of all control plane nodes. + +All control plane nodes render static pod manifests for the control plane components. +Each node now runs a full set of components to make the control plane HA. + +The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. + +### Scaling Up the Control Plane + +When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the +control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. + +### Scaling Down the Control Plane + +Scaling down the control plane involves removing a node from the cluster. +The most critical part is making sure that the node which is being removed leaves the etcd cluster. +The recommended way to do this is to use: + +- `talosctl -n IP.of.node.to.remove reset` +- `kubectl delete node` + +When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence, and its disks are erased. + +### Upgrading Talos on Control Plane Nodes + +When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. +The upgraded node then joins the `etcd` cluster on reboot. +So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v1.12/learn-more/controllers-resources.md b/website/content/v1.12/learn-more/controllers-resources.md new file mode 100644 index 000000000..35c9074ec --- /dev/null +++ b/website/content/v1.12/learn-more/controllers-resources.md @@ -0,0 +1,230 @@ +--- +title: "Controllers and Resources" +weight: 60 +description: "Discover how Talos Linux uses the concepts on Controllers and Resources." +--- + + + +Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. +Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. +The content of this document is not required to operate Talos, but it is useful for troubleshooting. + +Starting with Talos 0.9, most of the Kubernetes control plane bootstrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). + +## Resources + +A resource captures a piece of system state. +Each resource belongs to a "Type" which defines resource contents. +Resource state can be split in two parts: + +* metadata: fixed set of fields describing resource - namespace, type, ID, etc. +* spec: contents of the resource (depends on resource type). + +Resource is uniquely identified by (`namespace`, `type`, `id`). +Namespaces provide a way to avoid conflicts on duplicate resource IDs. + +At the moment of this writing, all resources are local to the node and stored in memory. +So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). + +## Controllers + +Controllers run as independent lightweight threads in Talos. +The goal of the controller is to reconcile the state based on inputs and eventually update outputs. + +A controller can have any number of resource types (and namespaces) as inputs. +In other words, it watches specified resources for changes and reconciles when these changes occur. +A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. + +A controller has a single output: a set of resources of fixed type in a fixed namespace. +Only one controller can manage resource type in the namespace, so conflicts are avoided. + +## Querying Resources + +Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, +listing resources and watching for changes. + +Talos stores resources describing resource types and namespaces in `meta` namespace: + +```bash +$ talosctl get resourcedefinitions +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 +172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 +172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 +172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 +172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 +172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 +172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 +172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 +172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 +172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 +172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 +``` + +```bash +$ talosctl get namespaces +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 meta Namespace config 1 +172.20.0.2 meta Namespace controlplane 1 +172.20.0.2 meta Namespace meta 1 +172.20.0.2 meta Namespace runtime 1 +172.20.0.2 meta Namespace secrets 1 +``` + +Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default +namespace which is used if no namespace is given: + +```bash +$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml +node: 172.20.0.2 +metadata: + namespace: meta + type: ResourceDefinitions.meta.cosi.dev + id: resourcedefinitions.meta.cosi.dev + version: 1 + phase: running +spec: + type: ResourceDefinitions.meta.cosi.dev + displayType: ResourceDefinition + aliases: + - resourcedefinitions + - resourcedefinition + - resourcedefinitions.meta + - resourcedefinitions.meta.cosi + - rd + - rds + printColumns: [] + defaultNamespace: meta +``` + +Resource definition also contains type aliases which can be used interchangeably with canonical resource name: + +```bash +$ talosctl get ns config +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 meta Namespace config 1 +``` + +### Output + +Command `talosctl get` supports following output modes: + +* `table` (default) prints resource list as a table +* `yaml` prints pretty formatted resources with details, including full metadata spec. + This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) +* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. + This format is useful for automated processing with tools like `jq`. + +### Watching Changes + +If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. +If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information for every change: + +```bash +$ talosctl get svc -w +NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY +172.20.0.2 + runtime Service timed 2 true true +172.20.0.2 + runtime Service trustd 2 true true +172.20.0.2 + runtime Service udevd 2 true true +172.20.0.2 - runtime Service timed 2 true true +172.20.0.2 + runtime Service timed 1 true false +172.20.0.2 runtime Service timed 2 true true +``` + +Column `*` specifies event type: + +* `+` is created +* `-` is deleted +* ` ` is updated + +In YAML/JSON output, field `event` is added to the resource representation to describe the event type. + +### Examples + +Getting machine config: + +```bash +$ talosctl get machineconfig v1alpha1 -o yaml +node: 172.20.0.2 +metadata: + namespace: config + type: MachineConfigs.config.talos.dev + id: v1alpha1 + version: 2 + phase: running +spec: + version: v1alpha1 # Indicates the schema used to decode the contents. + debug: false # Enable verbose logging to the console. + persist: true # Indicates whether to pull the machine config upon every boot. + # Provides machine specific configuration options. +... +``` + +Getting control plane static pod statuses: + +```bash +$ talosctl get staticpodstatus +NODE NAMESPACE TYPE ID VERSION READY +172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-controlplane-1 3 True +172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-controlplane-1 3 True +172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-controlplane-1 4 True +``` + +Getting static pod definition for `kube-apiserver`: + +```bash +$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: StaticPods.kubernetes.talos.dev + id: kube-apiserver + version: 3 + phase: running + finalizers: + - k8s.StaticPodStatus("kube-apiserver") +spec: + apiVersion: v1 + kind: Pod + metadata: + annotations: + talos.dev/config-version: "1" + talos.dev/secrets-version: "2" +... +``` + +## Inspecting Controller Dependencies + +Talos can report current dependencies between controllers and resources for debugging purposes: + +```bash +$ talosctl inspect dependencies +digraph { + + n1[label="config.K8sControlPlaneController",shape="box"]; + n3[label="config.MachineTypeController",shape="box"]; + n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; +... +``` + +This outputs graph in `graphviz` format which can be rendered to PNG with command: + +```bash +talosctl inspect dependencies | dot -T png > deps.png +``` + +![Controller Dependencies](/images/controller-dependencies-v2.png) + +Graph can be enhanced by replacing resource types with actual resource instances: + +```bash +talosctl inspect dependencies --with-resources | dot -T png > deps.png +``` + +![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png) diff --git a/website/content/v1.12/learn-more/faqs.md b/website/content/v1.12/learn-more/faqs.md new file mode 100644 index 000000000..7bca1d20e --- /dev/null +++ b/website/content/v1.12/learn-more/faqs.md @@ -0,0 +1,72 @@ +--- +title: "FAQs" +weight: 999 +description: "Frequently Asked Questions about Talos Linux." +--- + + + +## How is Talos different from other container optimized Linux distros? + +Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. +The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. +We don't ship SSH, and there is no console access. +Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. +It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. + +## Why no shell or SSH? + +Since Talos is fully API-driven, all maintenance and debugging operations are possible via the OS API. +We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. +That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. +We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. +Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remediation of the issue. +However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. +We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. + +## Why the name "Talos"? + +Talos was an automaton created by the Greek God of the forge to protect the island of Crete. +He would patrol the coast and enforce laws throughout the land. +We felt it was a fitting name for a security focused operating system designed to run Kubernetes. + +## Why does Talos rely on a separate configuration from Kubernetes? + +The `talosconfig` file contains client credentials to access the Talos Linux API. +Sometimes Kubernetes might be down for a number of reasons (etcd issues, misconfiguration, etc.), while Talos API access will always be available. +The Talos API is a way to access the operating system and fix issues, e.g. fixing access to Kubernetes. +When Talos Linux is running fine, using the Kubernetes APIs (via `kubeconfig`) is all you should need to deploy and manage Kubernetes workloads. + +## How does Talos handle certificates? + +During the machine config generation process, Talos generates a set of certificate authorities (CAs) that remains valid for 10 years. +Talos is responsible for managing certificates for `etcd`, Talos API (`apid`), node certificates (`kubelet`), and other components. +It also handles the automatic rotation of server-side certificates. + +However, client certificates such as `talosconfig` and `kubeconfig` are the user's responsibility, and by default, they have a validity period of 1 year. + +To renew the `talosconfig` certificate, the follow [this process]({{< relref "../talos-guides/howto/cert-management" >}}). +To renew `kubeconfig`, use `talosctl kubeconfig` command, and the time-to-live (TTL) is defined in the [configuration]({{< relref "../reference/configuration/#adminkubeconfigconfig" >}}). + +## How can I set the timezone of my Talos Linux clusters? + +Talos doesn't support timezones, and will always run in UTC. +This ensures consistency of log timestamps for all Talos Linux clusters, simplifying debugging. +Your containers can run with any timezone configuration you desire, but the timezone of Talos Linux is not configurable. + +## How do I see Talos kernel configuration? + +### Using Talos API + +Current kernel config can be read with `talosctl -n read /proc/config.gz`. + +For example: + +```shell +talosctl -n NODE read /proc/config.gz | zgrep E1000 +``` + +### Using GitHub + +For `amd64`, see https://github.com/siderolabs/pkgs/blob/main/kernel/build/config-amd64. +Use appropriate branch to see the kernel config matching your Talos release. diff --git a/website/content/v1.12/learn-more/image-factory.md b/website/content/v1.12/learn-more/image-factory.md new file mode 100644 index 000000000..93c77b80c --- /dev/null +++ b/website/content/v1.12/learn-more/image-factory.md @@ -0,0 +1,182 @@ +--- +title: "Image Factory" +weight: 55 +description: "Image Factory generates customized Talos Linux images based on configured schematics." +--- + +The Image Factory provides a way to download Talos Linux artifacts. +Artifacts can be generated with customizations defined by a "schematic". +A schematic can be applied to any of the versions of Talos Linux offered by the Image Factory to produce a "model". + +The following assets are provided: + +* ISO +* `kernel`, `initramfs`, and kernel command line +* UKI +* disk images in various formats (e.g. AWS, GCP, VMware, etc.) +* installer container images + +The supported frontends are: + +* HTTP +* PXE +* Container Registry + +The official instance of Image Factory is available at https://factory.talos.dev. + +See [Boot Assets]({{< relref "../talos-guides/install/boot-assets#image-factory" >}}) for an example of how to use the Image Factory to boot and upgrade Talos on different platforms. +Full API documentation for the Image Factory is available at [GitHub](https://github.com/siderolabs/image-factory#readme). + +## Schematics + +Schematics are YAML files that define customizations to be applied to a Talos Linux image. +Schematics can be applied to any of the versions of Talos Linux offered by the Image Factory to produce a "model", which is a Talos Linux image with the customizations applied. + +Schematics are content-addressable, that is, the content of the schematic is used to generate a unique ID. +The schematic should be uploaded to the Image Factory first, and then the ID can be used to reference the schematic in a model. + +Schematics can be generated using the [Image Factory UI](#ui), or using the Image Factory API: + +```yaml +customization: + extraKernelArgs: # optional + - vga=791 + meta: # optional, allows to set initial Talos META + - key: 0xa + value: "{}" + systemExtensions: # optional + officialExtensions: # optional + - siderolabs/gvisor + - siderolabs/amd-ucode +overlay: # optional + name: rpi_generic + image: siderolabs/sbc-raspberry-pi + options: # optional, any valid yaml, depends on the overlay implementation + data: "mydata" +``` + +The "vanilla" schematic is: + +```yaml +customization: +``` + +and has an ID of `376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba`. + +The schematic can be applied by uploading it to the Image Factory: + +```shell +curl -X POST --data-binary @schematic.yaml https://factory.talos.dev/schematics +``` + +As the schematic is content-addressable, the same schematic can be uploaded multiple times, and the Image Factory will return the same ID. + +## Models + +Models are Talos Linux images with customizations applied. +The inputs to generate a model are: + +* schematic ID +* Talos Linux version +* model type (e.g. ISO, UKI, etc.) +* architecture (e.g. amd64, arm64) +* various model type specific options (e.g. disk image format, disk image size, etc.) + +## Frontends + +Image Factory provides several frontends to retrieve models: + +* HTTP frontend to download models (e.g. download an ISO or a disk image) +* PXE frontend to boot bare-metal machines (PXE script references kernel/initramfs from HTTP frontend) +* Registry frontend to fetch customized `installer` images (for initial Talos Linux installation and upgrades) + +The links to different models are available in the [Image Factory UI](#ui), and a full list of possible models is documented at [GitHub](https://github.com/siderolabs/image-factory#readme). + +In this guide we will provide a list of examples: + +* amd64 ISO (for Talos {{< release >}}, "vanilla" schematic) [https://factory.talos.dev/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/{{< release >}}/metal-amd64.iso](https://factory.talos.dev/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/{{< release >}}/metal-amd64.iso) +* arm64 AWS image (for Talos {{< release >}}, "vanilla" schematic) [https://factory.talos.dev/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/{{< release >}}/aws-arm64.raw.xz](https://factory.talos.dev/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/{{< release >}}/aws-arm64.raw.xz) +* amd64 PXE boot script (for Talos {{< release >}}, "vanilla" schematic) [https://pxe.factory.talos.dev/pxe/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/{{< release >}}/metal-amd64](https://pxe.factory.talos.dev/pxe/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/{{< release >}}/metal-amd64) +* Talos `installer` image (for Talos {{< release >}}, "vanilla" schematic, architecture is detected automatically): `factory.talos.dev/installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:{{< release >}}` + +The `installer` image can be used to install Talos Linux on a bare-metal machine, or to upgrade an existing Talos Linux installation. +As the Talos version and schematic ID can be changed, via an upgrade process, the `installer` image can be used to upgrade to any version of Talos Linux, or replace a set of installed system extensions. + +## UI + +The Image Factory UI is available at https://factory.talos.dev. +The UI provides a way to list supported Talos Linux versions, list of system extensions available for each release, and a way to generate schematic based on the selected system extensions. + +The UI operations are equivalent to API operations. + +## Find Schematic ID from Talos Installation + +Image Factory always appends "virtual" system extension with the version matching schematic ID used to generate the model. +So, for any running Talos Linux instance the schematic ID can be found by looking at the list of system extensions: + +```shell +$ talosctl get extensions +NAMESPACE TYPE ID VERSION NAME VERSION +runtime ExtensionStatus 0 1 schematic 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba +``` + +## Restrictions + +Some models don't include every customization of the schematic: + +* `installer` and `initramfs` images only support system extensions (kernel args and META are ignored) +* `kernel` assets don't depend on the schematic + +Other models have full support for all customizations: + +* any disk image format +* ISO, PXE boot script + +When installing Talos Linux using ISO/PXE boot, Talos will be installed on the disk using the `installer` image, so the `installer` image in the machine configuration +should be using the same schematic as the ISO/PXE boot image. + +Some system extensions are not available for all Talos Linux versions, so an attempt to generate a model with an unsupported system extension will fail. +List of supported Talos versions and supported system extensions for each version is available in the [Image Factory UI](#ui) and [API](https://github.com/siderolabs/image-factory#readme). + +## Under the Hood + +Image Factory is based on the Talos `imager` container which provides both the Talos base boot assets, and the ability to generate custom assets based on a configuration. +Image Factory manages a set of `imager` container images to acquire base Talos Linux boot assets (`kernel`, `initramfs`), a set of Talos Linux system extension images, and a set of schematics. +When a model is requested, Image Factory uses the `imager` container to generate the requested assets based on the schematic and the Talos Linux version. + +## Security + +Image Factory verifies signatures of all source container images fetched: + +* `imager` container images (base boot assets) +* `extensions` system extensions catalogs +* `installer` contianer images (base installer layer) +* Talos Linux system extension images + +Internally, Image Factory caches generated boot assets and signs all cached images using a private key. +Image Factory verifies the signature of the cached images before serving them to clients. + +Image Factory signs generated `installer` images, and verifies the signature of the `installer` images before serving them to clients. + +Image Factory does not provide a way to list all schematics, as schematics may contain sensitive information (e.g. private kernel boot arguments). +As the schematic ID is content-addressable, it is not possible to guess the ID of a schematic without knowing the content of the schematic. + +## Running your own Image Factory + +Image Factory can be deployed on-premises to provide in-house asset generation. + +Image Factory requires following components: + +* an OCI registry to store schematics (private) +* an OCI registry to store cached assets (private) +* an OCI registry to store `installer` images (should allow public read-only access) +* a container image signing key: ECDSA P-256 private key in PEM format + +Image Factory is configured using command line flags, use `--help` to see a list of available flags. +Image Factory should be configured to use proper authentication to push to the OCI registries: + +* by mounting proper credentials via `~/.docker/config.json` +* by supplying `GITHUB_TOKEN` (for `ghcr.io`) + +Image Factory performs HTTP redirects to the public registry endpoint for `installer` images, so the public endpoint +should be available to Talos Linux machines to pull the `installer` images. diff --git a/website/content/v1.12/learn-more/knowledge-base.md b/website/content/v1.12/learn-more/knowledge-base.md new file mode 100644 index 000000000..c9f78e8db --- /dev/null +++ b/website/content/v1.12/learn-more/knowledge-base.md @@ -0,0 +1,98 @@ +--- +title: "Knowledge Base" +weight: 1999 +description: "Recipes for common configuration tasks with Talos Linux." +--- + +## Disabling `GracefulNodeShutdown` on a node + +Talos Linux enables [Graceful Node Shutdown](https://kubernetes.io/docs/concepts/architecture/nodes/#graceful-node-shutdown) Kubernetes feature by default. + +If this feature should be disabled, modify the `kubelet` part of the machine configuration with: + +```yaml +machine: + kubelet: + extraArgs: + feature-gates: GracefulNodeShutdown=false + extraConfig: + shutdownGracePeriod: 0s + shutdownGracePeriodCriticalPods: 0s +``` + +## Generating Talos Linux ISO image with custom kernel arguments + +Pass additional kernel arguments using `--extra-kernel-arg` flag: + +```shell +$ docker run --rm -i ghcr.io/siderolabs/imager:{{< release >}} iso --arch amd64 --tar-to-stdout --extra-kernel-arg console=ttyS1 --extra-kernel-arg console=tty0 | tar xz +2022/05/25 13:18:47 copying /usr/install/amd64/vmlinuz to /mnt/boot/vmlinuz +2022/05/25 13:18:47 copying /usr/install/amd64/initramfs.xz to /mnt/boot/initramfs.xz +2022/05/25 13:18:47 creating grub.cfg +2022/05/25 13:18:47 creating ISO +``` + +ISO will be output to the file `talos-.iso` in the current directory. + +## Logging Kubernetes audit logs with loki + +If using loki-stack helm chart to gather logs from the Kubernetes cluster, you can use the helm values to configure loki-stack to log Kubernetes API server audit logs: + +```yaml +promtail: + extraArgs: + - -config.expand-env + # this is required so that the promtail process can read the kube-apiserver audit logs written as `nobody` user + containerSecurityContext: + capabilities: + add: + - DAC_READ_SEARCH + extraVolumes: + - name: audit-logs + hostPath: + path: /var/log/audit/kube + extraVolumeMounts: + - name: audit-logs + mountPath: /var/log/audit/kube + readOnly: true + config: + snippets: + extraScrapeConfigs: | + - job_name: auditlogs + static_configs: + - targets: + - localhost + labels: + job: auditlogs + host: ${HOSTNAME} + __path__: /var/log/audit/kube/*.log +``` + +## Setting CPU scaling governor + +While its possible to set [CPU scaling governor](https://kernelnewbies.org/Linux_5.9#CPU_Frequency_scaling) via `.machine.sysfs` it's sometimes cumbersome to set it for all CPU's individually. +A more elegant approach would be set it via a kernel commandline parameter. +This also means that the options are applied way early in the boot process. + +This can be set in the machineconfig via the snippet below: + +```yaml +machine: + install: + extraKernelArgs: + - cpufreq.default_governor=performance +``` + +> Note: Talos needs to be upgraded for the `extraKernelArgs` to take effect. + +## Disable `admissionControl` on control plane nodes + +Talos Linux enables admission control in the API Server by default. + +Although it is not recommended from a security point of view, admission control can be removed by patching your control plane machine configuration: + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch-control-plane '[{"op": "remove", "path": "/cluster/apiServer/admissionControl"}]' +``` diff --git a/website/content/v1.12/learn-more/kubespan.md b/website/content/v1.12/learn-more/kubespan.md new file mode 100644 index 000000000..3a81aaddd --- /dev/null +++ b/website/content/v1.12/learn-more/kubespan.md @@ -0,0 +1,207 @@ +--- +title: "KubeSpan" +weight: 100 +description: "Understand more about KubeSpan for Talos Linux." +--- + +## WireGuard Peer Discovery + +The key pieces of information needed for WireGuard generally are: + +- the public key of the host you wish to connect to +- an IP address and port of the host you wish to connect to + +The latter is really only required of _one_ side of the pair. +Once traffic is received, that information is learned and updated by WireGuard automatically. + +Kubernetes, though, also needs to know which traffic goes to which WireGuard peer. +Because this information may be dynamic, we need a way to keep this information up to date. + +If we already have a connection to Kubernetes, it's fairly easy: we can just keep that information in Kubernetes. +Otherwise, we have to have some way to discover it. + +Talos Linux implements a multi-tiered approach to gathering this information. +Each tier can operate independently, but the amalgamation of the mechanisms produces a more robust set of connection criteria. + +These mechanisms are: + +- an external service +- a Kubernetes-based system + +See [discovery service]({{< relref "../talos-guides/discovery" >}}) to learn more about the external service. + +The Kubernetes-based system utilizes annotations on Kubernetes Nodes which describe each node's public key and local addresses. + +On top of this, KubeSpan can optionally route Pod subnets. +This is usually taken care of by the CNI, but there are many situations where the CNI fails to be able to do this itself, across networks. + +## NAT, Multiple Routes, Multiple IPs + +One of the difficulties in communicating across networks is that there is often not a single address and port which can identify a connection for each node on the system. +For instance, a node sitting on the same network might see its peer as `192.168.2.10`, but a node across the internet may see it as `2001:db8:1ef1::10`. + +We need to be able to handle any number of addresses and ports, and we also need to have a mechanism to _try_ them. +WireGuard only allows us to select one at a time. + +KubeSpan implements a controller which continuously discovers and rotates these IP:port pairs until a connection is established. +It then starts trying again if that connection ever fails. + +## Packet Routing + +After we have established a WireGuard connection, we have to make sure that the right packets get sent to the WireGuard interface. + +WireGuard supplies a convenient facility for tagging packets which come from _it_, which is great. +But in our case, we need to be able to allow traffic which both does _not_ come from WireGuard and _also_ is not destined for another Kubernetes node to flow through the normal mechanisms. + +Unlike many corporate or privacy-oriented VPNs, we need to allow general internet traffic to flow normally. + +Also, as our cluster grows, this set of IP addresses can become quite large and quite dynamic. +This would be very cumbersome and slow in `iptables`. +Luckily, the kernel supplies a convenient mechanism by which to define this arbitrarily large set of IP addresses: IP sets. + +Talos collects all of the IPs and subnets which are considered "in-cluster" and maintains these in the kernel as an IP set. + +Now that we have the IP set defined, we need to tell the kernel how to use it. + +The traditional way of doing this would be to use `iptables`. +However, there is a big problem with IPTables. +It is a common namespace in which any number of other pieces of software may dump things. +We have no surety that what we add will not be wiped out by something else (from Kubernetes itself, to the CNI, to some workload application), be rendered unusable by higher-priority rules, or just generally cause trouble and conflicts. + +Instead, we use a three-pronged system which is both more foundational and less centralised. + +NFTables offers a separately namespaced, decentralised way of marking packets for later processing based on IP sets. +Instead of a common set of well-known tables, NFTables uses hooks into the kernel's netfilter system, which are less vulnerable to being usurped, bypassed, or a source of interference than IPTables, but which are rendered down by the kernel to the same underlying XTables system. + +Our NFTables system is where we store the IP sets. +Any packet which enters the system, either by forward from inside Kubernetes or by generation from the host itself, is compared against a hash table of this IP set. +If it is matched, it is marked for later processing by our next stage. +This is a high-performance system which exists fully in the kernel and which ultimately becomes an eBPF program, so it scales well to hundreds of nodes. + +The next stage is the kernel router's route rules. +These are defined as a common ordered list of operations for the whole operating system, but they are intended to be tightly constrained and are rarely used by applications in any case. +The rules we add are very simple: if a packet is marked by our NFTables system, send it to an alternate routing table. + +This leads us to our third and final stage of packet routing. +We have a custom routing table with two rules: + +- send all IPv4 traffic to the WireGuard interface +- send all IPv6 traffic to the WireGuard interface + +So in summary, we: + +- mark packets destined for Kubernetes applications or Kubernetes nodes +- send marked packets to a special routing table +- send anything which is sent to that routing table through the WireGuard interface + +This gives us an isolated, resilient, tolerant, and non-invasive way to route Kubernetes traffic safely, automatically, and transparently through WireGuard across almost any set of network topologies. + +## Design Decisions + +### Routing + +Routing for Wireguard is a touch complicated when the set of possible peer +endpoints includes at least one member of the set of _destinations_. +That is, packets from Wireguard to a peer endpoint should not be sent to +Wireguard, lest a loop be created. + +In order to handle this situation, Wireguard provides the ability to mark +packets which it generates, so their routing can be handled separately. + +In our case, though, we actually want the inverse of this: we want to route +Wireguard packets however the normal networking routes and rules say they should +be routed, while packets destined for the other side of Wireguard Peers should +be forced into Wireguard interfaces. + +While IP Rules allow you to invert matches, they do not support matching based +on IP sets. +That means, to use simple rules, we would have to add a rule for +each destination, which could reach into hundreds or thousands of rules to +manage. +This is not really much of a performance issue, but it is a management +issue, since it is expected that we would not be the only manager of rules in +the system, and rules offer no facility to tag for ownership. + +IP Sets are supported by IPTables, and we could integrate there. +However, IPTables exists in a global namespace, which makes it fragile having +multiple parties manipulating it. +The newer NFTables replacement for IPTables, though, allows users to +independently hook into various points of XTables, keeping all such rules and +sets independent. +This means that regardless of what CNIs or other user-side routing rules may do, +our KubeSpan setup will not be messed up. + +Therefore, we utilise NFTables (which natively supports IP sets and owner +grouping) instead, to mark matching traffic which should be sent to the +Wireguard interface. +This way, we can keep all our KubeSpan set logic in one place, allowing us to +simply use a single `ip rule` match: +for our fwmark, and sending those matched packets to a separate routing table +with one rule: default to the wireguard interface. + +So we have three components: + + 1. A routing table for Wireguard-destined packets + 2. An NFTables table which defines the set of destinations packets to which will + be marked with our firewall mark. + - Hook into PreRouting (type Filter) + - Hook into Outgoing (type Route) + 3. One IP Rule which sends packets marked with our firewall mark to our Wireguard + routing table. + +### Routing Table + +The routing table (number 180 by default) is simple, containing a single route for each family: send everything through the Wireguard interface. + +### NFTables + +The logic inside NFTables is fairly simple. +First, everything is compiled into a single table: `talos_kubespan`. + +Next, two chains are set up: one for the `prerouting` hook (`kubespan_prerouting`) +and the other for the `outgoing` hook (`kubespan_outgoing`). + +We define two sets of target IP prefixes: one for IPv6 (`kubespan_targets_ipv6`) +and the other for IPv4 (`kubespan_targets_ipv4`). + +Last, we add rules to each chain which basically specify: + + 1. If the packet is marked as _from_ Wireguard, just accept it and terminate + the chain. + 2. If the packet matches an IP in either of the target IP sets, mark that + packet with the _to_ Wireguard mark. + +### Rules + +There are two route rules defined: one to match IPv6 packets and the other to +match IPv4 packets. + +These rules say the same thing for each: if the packet is marked that it should +go _to_ Wireguard, send it to the Wireguard +routing table. + +### Firewall Mark + +KubeSpan is using only two bits of the firewall mark with the mask `0x00000060`. + +> Note: if other software on the node is using the bits `0x60` of the firewall mark, this +> might cause conflicts and break KubeSpan. +> +> At the moment of the writing, it was confirmed that Calico CNI is using bits `0xffff0000` and +> Cilium CNI is using bits `0xf00`, so KubeSpan is compatible with both. +> Flannel CNI uses `0x4000` mask, so it is also compatible. + +In the routing rules table, we match on the mark `0x40` with the mask `0x60`: + +```text +32500: from all fwmark 0x40/0x60 lookup 180 +``` + +In the NFTables table, we match with the same mask `0x60` and we set the mask by only modifying +bits from the `0x60` mask: + +```text +meta mark & 0x00000060 == 0x00000020 accept +ip daddr @kubespan_targets_ipv4 meta mark set meta mark & 0xffffffdf | 0x00000040 accept +ip6 daddr @kubespan_targets_ipv6 meta mark set meta mark & 0xffffffdf | 0x00000040 accept +``` diff --git a/website/content/v1.12/learn-more/networking-resources.md b/website/content/v1.12/learn-more/networking-resources.md new file mode 100644 index 000000000..35bf81b20 --- /dev/null +++ b/website/content/v1.12/learn-more/networking-resources.md @@ -0,0 +1,434 @@ +--- +title: "Networking Resources" +weight: 70 +description: "Delve deeper into networking of Talos Linux." +--- + +Talos network configuration subsystem is powered by [COSI]({{< relref "controllers-resources" >}}). +Talos translates network configuration from multiple sources: machine configuration, cloud metadata, network automatic configuration (e.g. DHCP) into COSI resources. + +Network configuration and network state can be inspected using `talosctl get` command. + +Network machine configuration can be modified using `talosctl edit mc` command (also variants `talosctl patch mc`, `talosctl apply-config`) without a reboot. +As API access requires network connection, [`--mode=try`]({{< relref "../talos-guides/configuration/editing-machine-configuration" >}}) +can be used to test the configuration with automatic rollback to avoid losing network access to the node. + +## Resources + +There are six basic network configuration items in Talos: + +* `Address` (IP address assigned to the interface/link); +* `Route` (route to a destination); +* `Link` (network interface/link configuration); +* `Resolver` (list of DNS servers); +* `Hostname` (node hostname and domainname); +* `TimeServer` (list of NTP servers). + +Each network configuration item has two counterparts: + +* `*Status` (e.g. `LinkStatus`) describes the current state of the system (Linux kernel state); +* `*Spec` (e.g. `LinkSpec`) defines the desired configuration. + +| Resource | Status | Spec | +|--------------------|------------------------|----------------------| +| `Address` | `AddressStatus` | `AddressSpec` | +| `Route` | `RouteStatus` | `RouteSpec` | +| `Link` | `LinkStatus` | `LinkSpec` | +| `Resolver` | `ResolverStatus` | `ResolverSpec` | +| `Hostname` | `HostnameStatus` | `HostnameSpec` | +| `TimeServer` | `TimeServerStatus` | `TimeServerSpec` | + +Status resources have aliases with the `Status` suffix removed, so for example +`AddressStatus` is also available as `Address`. + +Talos networking controllers reconcile the state so that `*Status` equals the desired `*Spec`. + +## Observing State + +The current network configuration state can be observed by querying `*Status` resources via +`talosctl`: + +```sh +$ talosctl get addresses +NODE NAMESPACE TYPE ID VERSION ADDRESS LINK +172.20.0.2 network AddressStatus eth0/172.20.0.2/24 1 172.20.0.2/24 eth0 +172.20.0.2 network AddressStatus eth0/fe80::9804:17ff:fe9d:3058/64 2 fe80::9804:17ff:fe9d:3058/64 eth0 +172.20.0.2 network AddressStatus flannel.1/10.244.4.0/32 1 10.244.4.0/32 flannel.1 +172.20.0.2 network AddressStatus flannel.1/fe80::10b5:44ff:fe62:6fb8/64 2 fe80::10b5:44ff:fe62:6fb8/64 flannel.1 +172.20.0.2 network AddressStatus lo/127.0.0.1/8 1 127.0.0.1/8 lo +172.20.0.2 network AddressStatus lo/::1/128 1 ::1/128 lo +``` + +In the output there are addresses set up by Talos (e.g. `eth0/172.20.0.2/24`) and +addresses set up by other facilities (e.g. `flannel.1/10.244.4.0/32` set up by CNI). + +Talos networking controllers watch the kernel state and update resources +accordingly. + +Additional details about the address can be accessed via the YAML output: + +```yaml +# talosctl get address eth0/172.20.0.2/24 -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: AddressStatuses.net.talos.dev + id: eth0/172.20.0.2/24 + version: 1 + owner: network.AddressStatusController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + address: 172.20.0.2/24 + local: 172.20.0.2 + broadcast: 172.20.0.255 + linkIndex: 4 + linkName: eth0 + family: inet4 + scope: global + flags: permanent +``` + +Resources can be watched for changes with the `--watch` flag to see how configuration changes over time. + +Other networking status resources can be inspected with `talosctl get routes`, `talosctl get links`, etc. +For example: + +```sh +$ talosctl get resolvers +NODE NAMESPACE TYPE ID VERSION RESOLVERS +172.20.0.2 network ResolverStatus resolvers 2 ["8.8.8.8","1.1.1.1"] +``` + +```yaml +# talosctl get links -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: LinkStatuses.net.talos.dev + id: eth0 + version: 2 + owner: network.LinkStatusController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + index: 4 + type: ether + linkIndex: 0 + flags: UP,BROADCAST,RUNNING,MULTICAST,LOWER_UP + hardwareAddr: 4e:95:8e:8f:e4:47 + broadcastAddr: ff:ff:ff:ff:ff:ff + mtu: 1500 + queueDisc: pfifo_fast + operationalState: up + kind: "" + slaveKind: "" + driver: virtio_net + linkState: true + speedMbit: 4294967295 + port: Other + duplex: Unknown +``` + +## Inspecting Configuration + +The desired networking configuration is combined from multiple sources and presented +as `*Spec` resources: + +```sh +$ talosctl get addressspecs +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 network AddressSpec eth0/172.20.0.2/24 2 +172.20.0.2 network AddressSpec lo/127.0.0.1/8 2 +172.20.0.2 network AddressSpec lo/::1/128 2 +``` + +These `AddressSpecs` are applied to the Linux kernel to reach the desired state. +If, for example, an `AddressSpec` is removed, the address is removed from the Linux network interface as well. + +`*Spec` resources can't be manipulated directly, they are generated automatically by Talos +from multiple configuration sources (see a section below for details). + +If a `*Spec` resource is queried in YAML format, some additional information is available: + +```yaml +# talosctl get addressspecs eth0/172.20.0.2/24 -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: AddressSpecs.net.talos.dev + id: eth0/172.20.0.2/24 + version: 2 + owner: network.AddressMergeController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z + finalizers: + - network.AddressSpecController +spec: + address: 172.20.0.2/24 + linkName: eth0 + family: inet4 + scope: global + flags: permanent + layer: operator +``` + +An important field is the `layer` field, which describes a configuration layer this spec is coming from: in this case, it's generated by a network operator (see below) and is set by the DHCPv4 operator. + +## Configuration Merging + +Spec resources described in the previous section show the final merged configuration state, +while initial specs are put to a different unmerged namespace `network-config`. +Spec resources in the `network-config` namespace are merged with conflict resolution to produce the final merged representation in the `network` namespace. + +Let's take `HostnameSpec` as an example. +The final merged representation is: + +```yaml +# talosctl get hostnamespec -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: HostnameSpecs.net.talos.dev + id: hostname + version: 2 + owner: network.HostnameMergeController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z + finalizers: + - network.HostnameSpecController +spec: + hostname: talos-default-controlplane-1 + domainname: "" + layer: operator +``` + +We can see that the final configuration for the hostname is `talos-default-controlplane-1`. +And this is the hostname that was actually applied. +This can be verified by querying a `HostnameStatus` resource: + +```sh +$ talosctl get hostnamestatus +NODE NAMESPACE TYPE ID VERSION HOSTNAME DOMAINNAME +172.20.0.2 network HostnameStatus hostname 1 talos-default-controlplane-1 +``` + +Initial configuration for the hostname in the `network-config` namespace is: + +```yaml +# talosctl get hostnamespec -o yaml --namespace network-config +node: 172.20.0.2 +metadata: + namespace: network-config + type: HostnameSpecs.net.talos.dev + id: default/hostname + version: 2 + owner: network.HostnameConfigController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + hostname: talos-172-20-0-2 + domainname: "" + layer: default +--- +node: 172.20.0.2 +metadata: + namespace: network-config + type: HostnameSpecs.net.talos.dev + id: dhcp4/eth0/hostname + version: 1 + owner: network.OperatorSpecController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + hostname: talos-default-controlplane-1 + domainname: "" + layer: operator +``` + +We can see that there are two specs for the hostname: + +* one from the `default` configuration layer which defines the hostname as `talos-172-20-0-2` (default driven by the default node address); +* another one from the layer `operator` that defines the hostname as `talos-default-controlplane-1` (DHCP). + +Talos merges these two specs into a final `HostnameSpec` based on the configuration layer and merge rules. +Here is the order of precedence from low to high: + +* `default` (defaults provided by Talos); +* `cmdline` (from the kernel command line); +* `platform` (driven by the cloud provider); +* `operator` (various dynamic configuration options: DHCP, Virtual IP, etc); +* `configuration` (derived from the machine configuration). + +So in our example the `operator` layer `HostnameSpec` overrides the `default` layer producing the final hostname `talos-default-controlplane-1`. + +The merge process applies to all six core networking specs. +For each spec, the `layer` controls the merge behavior +If multiple configuration specs +appear at the same layer, they can be merged together if possible, otherwise merge result +is stable but not defined (e.g. if DHCP on multiple interfaces provides two different hostnames for the node). + +`LinkSpecs` are merged across layers, so for example, machine configuration for the interface MTU overrides an MTU set by the DHCP server. + +## Network Operators + +Network operators provide dynamic network configuration which can change over time as the node is running: + +* DHCPv4 +* DHCPv6 +* Virtual IP + +Network operators produce specs for addresses, routes, links, etc., which are then merged and applied according to the rules described above. + +Operators are configured with `OperatorSpec` resources which describe when operators +should run and additional configuration for the operator: + +```yaml +# talosctl get operatorspecs -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: OperatorSpecs.net.talos.dev + id: dhcp4/eth0 + version: 1 + owner: network.OperatorConfigController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + operator: dhcp4 + linkName: eth0 + requireUp: true + dhcp4: + routeMetric: 1024 +``` + +`OperatorSpec` resources are generated by Talos based on machine configuration mostly. +DHCP4 operator is created automatically for all physical network links which are not configured explicitly via the kernel command line or the machine configuration. +This also means that on the first boot, without a machine configuration, a DHCP request is made on all physical network interfaces by default. + +Specs generated by operators are prefixed with the operator ID (`dhcp4/eth0` in the example above) in the unmerged `network-config` namespace: + +```sh +$ talosctl -n 172.20.0.2 get addressspecs --namespace network-config +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 network-config AddressSpec dhcp4/eth0/eth0/172.20.0.2/24 1 +``` + +## Other Network Resources + +There are some additional resources describing the network subsystem state. + +The `NodeAddress` resource presents node addresses excluding link-local and loopback addresses: + +```sh +$ talosctl get nodeaddresses +NODE NAMESPACE TYPE ID VERSION ADDRESSES +10.100.2.23 network NodeAddress accumulative 6 ["10.100.2.23","147.75.98.173","147.75.195.143","192.168.95.64","2604:1380:1:ca00::17"] +10.100.2.23 network NodeAddress current 5 ["10.100.2.23","147.75.98.173","192.168.95.64","2604:1380:1:ca00::17"] +10.100.2.23 network NodeAddress default 1 ["10.100.2.23"] +``` + +* `default` is the node default address; +* `current` is the set of addresses a node currently has; +* `accumulative` is the set of addresses a node had over time (it might include virtual IPs which are not owned by the node at the moment). + +`NodeAddress` resources are used to pick up the default address for `etcd` peer URL, to populate SANs field in the generated certificates, etc. + +Another important resource is `Nodename` which provides `Node` name in Kubernetes: + +```sh +$ talosctl get nodename +NODE NAMESPACE TYPE ID VERSION NODENAME +10.100.2.23 controlplane Nodename nodename 1 infra-green-cp-mmf7v +``` + +Depending on the machine configuration `nodename` might be just a hostname or the FQDN of the node. + +`NetworkStatus` aggregates the current state of the network configuration: + +```yaml +# talosctl get networkstatus -o yaml +node: 10.100.2.23 +metadata: + namespace: network + type: NetworkStatuses.net.talos.dev + id: status + version: 5 + owner: network.StatusController + phase: running + created: 2021-06-24T18:56:00Z + updated: 2021-06-24T18:56:02Z +spec: + addressReady: true + connectivityReady: true + hostnameReady: true + etcFilesReady: true +``` + +## Network Controllers + +For each of the six basic resource types, there are several controllers: + +* `*StatusController` populates `*Status` resources observing the Linux kernel state. +* `*ConfigController` produces the initial unmerged `*Spec` resources in the `network-config` namespace based on defaults, kernel command line, and machine configuration. +* `*MergeController` merges `*Spec` resources into the final representation in the `network` namespace. +* `*SpecController` applies merged `*Spec` resources to the kernel state. + +For the network operators: + +* `OperatorConfigController` produces `OperatorSpec` resources based on machine configuration and deafauls. +* `OperatorSpecController` runs network operators watching `OperatorSpec` resources and producing various `*Spec` resources in the `network-config` namespace. + +## Configuration Sources + +There are several configuration sources for the network configuration, which are described in this section. + +### Defaults + +* `lo` interface is assigned addresses `127.0.0.1/8` and `::1/128`; +* hostname is set to the `talos-` where `IP` is the default node address; +* resolvers are set to `8.8.8.8`, `1.1.1.1`; +* time servers are set to `pool.ntp.org`; +* DHCP4 operator is run on any physical interface which is not configured explicitly. + +### Cmdline + +The kernel [command line]({{< relref "../reference/kernel" >}}) is parsed for the following options: + +* `ip=` option is parsed for node IP, default gateway, hostname, DNS servers, NTP servers; +* `bond=` option is parsed for bonding interfaces and their options; +* `talos.hostname=` option is used to set node hostname; +* `talos.network.interface.ignore=` can be used to make Talos skip network interface configuration completely. + +### Platform + +Platform configuration delivers cloud environment-specific options (e.g. the hostname). + +Platform configuration is specific to the environment metadata: for example, on Equinix Metal, Talos automatically +configures public and private IPs, routing, link bonding, hostname. + +Platform configuration is cached across reboots in `/system/state/platform-network.yaml`. + +### Operator + +Network operators provide configuration for all basic resource types. + +### Machine Configuration + +The machine configuration is parsed for link configuration, addresses, routes, hostname, +resolvers and time servers. +Any changes to `.machine.network` configuration can be applied in immediate mode. + +## Network Configuration Debugging + +Most of the network controller operations and failures are logged to the kernel console, +additional logs with `debug` level are available with `talosctl logs controller-runtime` command. +If the network configuration can't be established and the API is not available, `debug` level +logs can be sent to the console with `debug: true` option in the machine configuration. diff --git a/website/content/v1.12/learn-more/philosophy.md b/website/content/v1.12/learn-more/philosophy.md new file mode 100644 index 000000000..41a72c770 --- /dev/null +++ b/website/content/v1.12/learn-more/philosophy.md @@ -0,0 +1,110 @@ +--- +title: Philosophy +weight: 10 +description: "Learn about the philosophy behind the need for Talos Linux." +--- + +## Distributed + +Talos is intended to be operated in a distributed manner: it is built for a high-availability dataplane _first_. +Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). +Like Kubernetes, workloads are intended to be distributed across any number of compute nodes. + +There should be no single points of failure, and the level of required coordination is as low as each platform allows. + +## Immutable + +Talos takes immutability very seriously. +Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. +All images are signed and delivered as single, versioned files. +We can always run integrity checks on our image to verify that it has not been modified. + +While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. +We call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. +Thus, if all else fails, we can always wipe the disk and get back up and running. + +## Minimal + +We are always trying to reduce Talos' footprint. +Because nearly the entire OS is built from scratch in Go, we are +in a good position. +We have no shell. +We have no SSH. +We have none of the GNU utilities, not even a rollup tool such as busybox. +Everything in Talos is there because it is necessary, and +nothing is included which isn't. + +As a result, the OS right now produces a SquashFS image size of less than **80 MB**. + +## Ephemeral + +Everything Talos writes to its disk is either replicated or reconstructable. +Since the controlplane is highly available, the loss of any node will cause +neither service disruption nor loss of data. +No writes are even allowed to the vast majority of the filesystem. +We even call the writable partition "ephemeral" to keep this idea always in +focus. + +## Secure + +Talos has always been designed with security in mind. +With its immutability, its minimalism, its signing, and its componenture, we are +able to simply bypass huge classes of vulnerabilities. +Moreover, because of the way we have designed Talos, we are able to take +advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and completely disabling dynamic modules. + +There are no passwords in Talos. +All networked communication is encrypted and key-authenticated. +The Talos certificates are short-lived and automatically-rotating. +Kubernetes is always constructed with its own separate PKI structure which is +enforced. + +## Declarative + +Everything which can be configured in Talos is done through a single YAML +manifest. +There is no scripting and no procedural steps. +Everything is defined by the one declarative YAML file. +This configuration includes that of both Talos itself and the Kubernetes which +it forms. + +This is achievable because Talos is tightly focused to do one thing: run +Kubernetes, in the easiest, most secure, most reliable way it can. + +## Not based on X distro + +Talos Linux _isn't_ based on any other distribution. +We think of ourselves as being the second-generation of +container-optimised operating systems, where things like CoreOS, Flatcar, and Rancher represent the first generation (but the technology is not derived from any of those.) + +Talos Linux is actually a ground-up rewrite of the userspace, from PID 1. +We run the Linux kernel, but everything downstream of that is our own custom +code, written in Go, rigorously-tested, and published as an immutable, +integrated image. +The Linux kernel launches what we call `machined`, for instance, not `systemd`. +There is no `systemd` on our system. +There are no GNU utilities, no shell, no SSH, no packages, nothing you could associate with +any other distribution. + +## An Operating System designed for Kubernetes + +Technically, Talos Linux installs to a computer like any other operating system. +_Unlike_ other operating systems, Talos is not meant to run alone, on a +single machine. +A design goal of Talos Linux is eliminating the management +of individual nodes as much as possible. +In order to do that, Talos Linux operates as a cluster of machines, with lots of +checking and coordination between them, at all levels. + +There is only a cluster. +Talos is meant to do one thing: maintain a Kubernetes cluster, and it does this +very, very well. + +The entirety of the configuration of any machine is specified by a single +configuration file, which can often be the _same_ configuration file used +across _many_ machines. +Much like a biological system, if some component misbehaves, just cut it out and +let a replacement grow. +Rebuilds of Talos are remarkably fast, whether they be new machines, upgrades, +or reinstalls. +Never get hung up on an individual machine. diff --git a/website/content/v1.12/learn-more/process-capabilities.md b/website/content/v1.12/learn-more/process-capabilities.md new file mode 100644 index 000000000..e08b77b75 --- /dev/null +++ b/website/content/v1.12/learn-more/process-capabilities.md @@ -0,0 +1,23 @@ +--- +title: "Process Capabilities" +weight: 105 +description: "Understand the Linux process capabilities restrictions with Talos Linux." +--- + +Linux defines a set of [process capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) that can be used to fine-tune the process permissions. + +Talos Linux for security reasons restricts any process from gaining the following capabilities: + +* `CAP_SYS_MODULE` (loading kernel modules) +* `CAP_SYS_BOOT` (rebooting the system) + +This means that any process including privileged Kubernetes pods will not be able to get these capabilities. + +If you see the following error on starting a pod, make sure it doesn't have any of the capabilities listed above in the spec: + +```text +Error: failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply caps: operation not permitted: unknown +``` + +> Note: even with `CAP_SYS_MODULE` capability, Linux kernel module loading is restricted by requiring a valid signature. +> Talos Linux creates a throw away signing key during kernel build, so it's not possible to build/sign a kernel module for Talos Linux outside of the build process. diff --git a/website/content/v1.12/learn-more/talos-network-connectivity.md b/website/content/v1.12/learn-more/talos-network-connectivity.md new file mode 100644 index 000000000..de0a1c305 --- /dev/null +++ b/website/content/v1.12/learn-more/talos-network-connectivity.md @@ -0,0 +1,74 @@ +--- +title: "Network Connectivity" +weight: 80 +description: "Description of the Networking Connectivity needed by Talos Linux" +aliases: + - ../guides/configuring-network-connectivity +--- + +## Configuring Network Connectivity + +The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. +This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. + +> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. +> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. + +### Control plane node(s) + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl, control plane nodes
TCPInbound50001*trustdWorker nodes
+ +> Ports marked with a `*` are not currently configurable, but that may change in the future. +> [Follow along here](https://github.com/siderolabs/talos/issues/1836). + +### Worker node(s) + + + + + + + + + + + + + + + + + + + + +
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidControl plane nodes
+ +> Ports marked with a `*` are not currently configurable, but that may change in the future. +> [Follow along here](https://github.com/siderolabs/talos/issues/1836). diff --git a/website/content/v1.12/learn-more/talosctl.md b/website/content/v1.12/learn-more/talosctl.md new file mode 100644 index 000000000..ff5d33b4a --- /dev/null +++ b/website/content/v1.12/learn-more/talosctl.md @@ -0,0 +1,62 @@ +--- +title: "talosctl" +weight: 110 +description: "The design and use of the Talos Linux control application." +--- + +The `talosctl` tool acts as a reference implementation for the Talos API, but it also handles a lot of +conveniences for the use of Talos and its clusters. + +### Video Walkthrough + +To see some live examples of talosctl usage, view the following video: + + + +## Client Configuration + +Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. +Otherwise it is in `$HOME/.talos/config`. +The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. + +Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. +It also comes with some intelligent tooling to manage the merging of new contexts into the config. +The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. +You can easily overwrite instead, as well. +See the `talosctl config help` for more information. + +## Endpoints and Nodes + +![Endpoints and Nodes](/images/endpoints-and-nodes.png) + +`endpoints` are the communication endpoints to which the client directly talks. +These can be load balancers, DNS hostnames, a list of IPs, etc. +If multiple endpoints are specified, the client will automatically load +balance and fail over between them. +It is recommended that these point to the set of control plane nodes, either directly or through a load balancer. + +Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. + +Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. + +The `node` is the target node on which you wish to perform the API call. +While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is recommended not to do so, but to explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. + +> When specifying nodes, their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. +> This is because all connections are proxied first through the endpoints. + +## Kubeconfig + +The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. +By default, `talosctl` will safely merge the cluster into the default kubeconfig. +Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. +The `--force` option can be used to overwrite instead. + +You can also specify an alternate path by supplying it as a positional parameter. + +Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any +number of kubernetes clusters from the same workstation. + +## Commands + +Please see the [CLI reference]({{< relref "../reference/cli" >}}) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v1.12/reference/_index.md b/website/content/v1.12/reference/_index.md new file mode 100644 index 000000000..d548bde02 --- /dev/null +++ b/website/content/v1.12/reference/_index.md @@ -0,0 +1,4 @@ +--- +title: "Reference" +weight: 70 +--- diff --git a/website/content/v1.12/reference/api.md b/website/content/v1.12/reference/api.md new file mode 100644 index 000000000..4225d53d0 --- /dev/null +++ b/website/content/v1.12/reference/api.md @@ -0,0 +1,9707 @@ +--- +title: API +description: Talos gRPC API reference. +--- + +## Table of Contents + +- [common/common.proto](#common/common.proto) + - [Data](#common.Data) + - [DataResponse](#common.DataResponse) + - [Empty](#common.Empty) + - [EmptyResponse](#common.EmptyResponse) + - [Error](#common.Error) + - [Metadata](#common.Metadata) + - [NetIP](#common.NetIP) + - [NetIPPort](#common.NetIPPort) + - [NetIPPrefix](#common.NetIPPrefix) + - [PEMEncodedCertificate](#common.PEMEncodedCertificate) + - [PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) + - [PEMEncodedKey](#common.PEMEncodedKey) + - [URL](#common.URL) + + - [Code](#common.Code) + - [ContainerDriver](#common.ContainerDriver) + - [ContainerdNamespace](#common.ContainerdNamespace) + + - [File-level Extensions](#common/common.proto-extensions) + +- [resource/definitions/block/block.proto](#resource/definitions/block/block.proto) + - [DeviceSpec](#talos.resource.definitions.block.DeviceSpec) + - [DiscoveredVolumeSpec](#talos.resource.definitions.block.DiscoveredVolumeSpec) + - [DiscoveryRefreshRequestSpec](#talos.resource.definitions.block.DiscoveryRefreshRequestSpec) + - [DiscoveryRefreshStatusSpec](#talos.resource.definitions.block.DiscoveryRefreshStatusSpec) + - [DiskSelector](#talos.resource.definitions.block.DiskSelector) + - [DiskSpec](#talos.resource.definitions.block.DiskSpec) + - [EncryptionKey](#talos.resource.definitions.block.EncryptionKey) + - [EncryptionSpec](#talos.resource.definitions.block.EncryptionSpec) + - [FilesystemSpec](#talos.resource.definitions.block.FilesystemSpec) + - [LocatorSpec](#talos.resource.definitions.block.LocatorSpec) + - [MountRequestSpec](#talos.resource.definitions.block.MountRequestSpec) + - [MountSpec](#talos.resource.definitions.block.MountSpec) + - [MountStatusSpec](#talos.resource.definitions.block.MountStatusSpec) + - [PartitionSpec](#talos.resource.definitions.block.PartitionSpec) + - [ProvisioningSpec](#talos.resource.definitions.block.ProvisioningSpec) + - [SwapStatusSpec](#talos.resource.definitions.block.SwapStatusSpec) + - [SymlinkProvisioningSpec](#talos.resource.definitions.block.SymlinkProvisioningSpec) + - [SymlinkSpec](#talos.resource.definitions.block.SymlinkSpec) + - [SystemDiskSpec](#talos.resource.definitions.block.SystemDiskSpec) + - [UserDiskConfigStatusSpec](#talos.resource.definitions.block.UserDiskConfigStatusSpec) + - [VolumeConfigSpec](#talos.resource.definitions.block.VolumeConfigSpec) + - [VolumeMountRequestSpec](#talos.resource.definitions.block.VolumeMountRequestSpec) + - [VolumeMountStatusSpec](#talos.resource.definitions.block.VolumeMountStatusSpec) + - [VolumeStatusSpec](#talos.resource.definitions.block.VolumeStatusSpec) + - [ZswapStatusSpec](#talos.resource.definitions.block.ZswapStatusSpec) + +- [resource/definitions/cluster/cluster.proto](#resource/definitions/cluster/cluster.proto) + - [AffiliateSpec](#talos.resource.definitions.cluster.AffiliateSpec) + - [ConfigSpec](#talos.resource.definitions.cluster.ConfigSpec) + - [ControlPlane](#talos.resource.definitions.cluster.ControlPlane) + - [IdentitySpec](#talos.resource.definitions.cluster.IdentitySpec) + - [InfoSpec](#talos.resource.definitions.cluster.InfoSpec) + - [KubeSpanAffiliateSpec](#talos.resource.definitions.cluster.KubeSpanAffiliateSpec) + - [MemberSpec](#talos.resource.definitions.cluster.MemberSpec) + +- [resource/definitions/cri/cri.proto](#resource/definitions/cri/cri.proto) + - [ImageCacheConfigSpec](#talos.resource.definitions.cri.ImageCacheConfigSpec) + - [RegistriesConfigSpec](#talos.resource.definitions.cri.RegistriesConfigSpec) + - [RegistriesConfigSpec.RegistryConfigEntry](#talos.resource.definitions.cri.RegistriesConfigSpec.RegistryConfigEntry) + - [RegistriesConfigSpec.RegistryMirrorsEntry](#talos.resource.definitions.cri.RegistriesConfigSpec.RegistryMirrorsEntry) + - [RegistryAuthConfig](#talos.resource.definitions.cri.RegistryAuthConfig) + - [RegistryConfig](#talos.resource.definitions.cri.RegistryConfig) + - [RegistryEndpointConfig](#talos.resource.definitions.cri.RegistryEndpointConfig) + - [RegistryMirrorConfig](#talos.resource.definitions.cri.RegistryMirrorConfig) + - [RegistryTLSConfig](#talos.resource.definitions.cri.RegistryTLSConfig) + - [SeccompProfileSpec](#talos.resource.definitions.cri.SeccompProfileSpec) + +- [resource/definitions/enums/enums.proto](#resource/definitions/enums/enums.proto) + - [BlockEncryptionKeyType](#talos.resource.definitions.enums.BlockEncryptionKeyType) + - [BlockEncryptionProviderType](#talos.resource.definitions.enums.BlockEncryptionProviderType) + - [BlockFilesystemType](#talos.resource.definitions.enums.BlockFilesystemType) + - [BlockVolumePhase](#talos.resource.definitions.enums.BlockVolumePhase) + - [BlockVolumeType](#talos.resource.definitions.enums.BlockVolumeType) + - [CriImageCacheCopyStatus](#talos.resource.definitions.enums.CriImageCacheCopyStatus) + - [CriImageCacheStatus](#talos.resource.definitions.enums.CriImageCacheStatus) + - [KubespanPeerState](#talos.resource.definitions.enums.KubespanPeerState) + - [MachineType](#talos.resource.definitions.enums.MachineType) + - [NethelpersADSelect](#talos.resource.definitions.enums.NethelpersADSelect) + - [NethelpersARPAllTargets](#talos.resource.definitions.enums.NethelpersARPAllTargets) + - [NethelpersARPValidate](#talos.resource.definitions.enums.NethelpersARPValidate) + - [NethelpersAddressFlag](#talos.resource.definitions.enums.NethelpersAddressFlag) + - [NethelpersAddressSortAlgorithm](#talos.resource.definitions.enums.NethelpersAddressSortAlgorithm) + - [NethelpersBondMode](#talos.resource.definitions.enums.NethelpersBondMode) + - [NethelpersBondXmitHashPolicy](#talos.resource.definitions.enums.NethelpersBondXmitHashPolicy) + - [NethelpersConntrackState](#talos.resource.definitions.enums.NethelpersConntrackState) + - [NethelpersDuplex](#talos.resource.definitions.enums.NethelpersDuplex) + - [NethelpersFailOverMAC](#talos.resource.definitions.enums.NethelpersFailOverMAC) + - [NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) + - [NethelpersLACPRate](#talos.resource.definitions.enums.NethelpersLACPRate) + - [NethelpersLinkType](#talos.resource.definitions.enums.NethelpersLinkType) + - [NethelpersMatchOperator](#talos.resource.definitions.enums.NethelpersMatchOperator) + - [NethelpersNfTablesChainHook](#talos.resource.definitions.enums.NethelpersNfTablesChainHook) + - [NethelpersNfTablesChainPriority](#talos.resource.definitions.enums.NethelpersNfTablesChainPriority) + - [NethelpersNfTablesVerdict](#talos.resource.definitions.enums.NethelpersNfTablesVerdict) + - [NethelpersOperationalState](#talos.resource.definitions.enums.NethelpersOperationalState) + - [NethelpersPort](#talos.resource.definitions.enums.NethelpersPort) + - [NethelpersPrimaryReselect](#talos.resource.definitions.enums.NethelpersPrimaryReselect) + - [NethelpersProtocol](#talos.resource.definitions.enums.NethelpersProtocol) + - [NethelpersRouteFlag](#talos.resource.definitions.enums.NethelpersRouteFlag) + - [NethelpersRouteProtocol](#talos.resource.definitions.enums.NethelpersRouteProtocol) + - [NethelpersRouteType](#talos.resource.definitions.enums.NethelpersRouteType) + - [NethelpersRoutingTable](#talos.resource.definitions.enums.NethelpersRoutingTable) + - [NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) + - [NethelpersVLANProtocol](#talos.resource.definitions.enums.NethelpersVLANProtocol) + - [NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) + - [NetworkOperator](#talos.resource.definitions.enums.NetworkOperator) + - [RuntimeFIPSState](#talos.resource.definitions.enums.RuntimeFIPSState) + - [RuntimeMachineStage](#talos.resource.definitions.enums.RuntimeMachineStage) + - [RuntimeSELinuxState](#talos.resource.definitions.enums.RuntimeSELinuxState) + +- [resource/definitions/etcd/etcd.proto](#resource/definitions/etcd/etcd.proto) + - [ConfigSpec](#talos.resource.definitions.etcd.ConfigSpec) + - [ConfigSpec.ExtraArgsEntry](#talos.resource.definitions.etcd.ConfigSpec.ExtraArgsEntry) + - [MemberSpec](#talos.resource.definitions.etcd.MemberSpec) + - [PKIStatusSpec](#talos.resource.definitions.etcd.PKIStatusSpec) + - [SpecSpec](#talos.resource.definitions.etcd.SpecSpec) + - [SpecSpec.ExtraArgsEntry](#talos.resource.definitions.etcd.SpecSpec.ExtraArgsEntry) + +- [resource/definitions/extensions/extensions.proto](#resource/definitions/extensions/extensions.proto) + - [Compatibility](#talos.resource.definitions.extensions.Compatibility) + - [Constraint](#talos.resource.definitions.extensions.Constraint) + - [Layer](#talos.resource.definitions.extensions.Layer) + - [Metadata](#talos.resource.definitions.extensions.Metadata) + +- [resource/definitions/files/files.proto](#resource/definitions/files/files.proto) + - [EtcFileSpecSpec](#talos.resource.definitions.files.EtcFileSpecSpec) + - [EtcFileStatusSpec](#talos.resource.definitions.files.EtcFileStatusSpec) + +- [resource/definitions/hardware/hardware.proto](#resource/definitions/hardware/hardware.proto) + - [MemoryModuleSpec](#talos.resource.definitions.hardware.MemoryModuleSpec) + - [PCIDeviceSpec](#talos.resource.definitions.hardware.PCIDeviceSpec) + - [PCIDriverRebindConfigSpec](#talos.resource.definitions.hardware.PCIDriverRebindConfigSpec) + - [PCIDriverRebindStatusSpec](#talos.resource.definitions.hardware.PCIDriverRebindStatusSpec) + - [ProcessorSpec](#talos.resource.definitions.hardware.ProcessorSpec) + - [SystemInformationSpec](#talos.resource.definitions.hardware.SystemInformationSpec) + +- [resource/definitions/k8s/k8s.proto](#resource/definitions/k8s/k8s.proto) + - [APIServerConfigSpec](#talos.resource.definitions.k8s.APIServerConfigSpec) + - [APIServerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.APIServerConfigSpec.EnvironmentVariablesEntry) + - [APIServerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.APIServerConfigSpec.ExtraArgsEntry) + - [AdmissionControlConfigSpec](#talos.resource.definitions.k8s.AdmissionControlConfigSpec) + - [AdmissionPluginSpec](#talos.resource.definitions.k8s.AdmissionPluginSpec) + - [AuditPolicyConfigSpec](#talos.resource.definitions.k8s.AuditPolicyConfigSpec) + - [AuthorizationAuthorizersSpec](#talos.resource.definitions.k8s.AuthorizationAuthorizersSpec) + - [AuthorizationConfigSpec](#talos.resource.definitions.k8s.AuthorizationConfigSpec) + - [BootstrapManifestsConfigSpec](#talos.resource.definitions.k8s.BootstrapManifestsConfigSpec) + - [ConfigStatusSpec](#talos.resource.definitions.k8s.ConfigStatusSpec) + - [ControllerManagerConfigSpec](#talos.resource.definitions.k8s.ControllerManagerConfigSpec) + - [ControllerManagerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.ControllerManagerConfigSpec.EnvironmentVariablesEntry) + - [ControllerManagerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.ControllerManagerConfigSpec.ExtraArgsEntry) + - [EndpointSpec](#talos.resource.definitions.k8s.EndpointSpec) + - [ExtraManifest](#talos.resource.definitions.k8s.ExtraManifest) + - [ExtraManifest.ExtraHeadersEntry](#talos.resource.definitions.k8s.ExtraManifest.ExtraHeadersEntry) + - [ExtraManifestsConfigSpec](#talos.resource.definitions.k8s.ExtraManifestsConfigSpec) + - [ExtraVolume](#talos.resource.definitions.k8s.ExtraVolume) + - [KubePrismConfigSpec](#talos.resource.definitions.k8s.KubePrismConfigSpec) + - [KubePrismEndpoint](#talos.resource.definitions.k8s.KubePrismEndpoint) + - [KubePrismEndpointsSpec](#talos.resource.definitions.k8s.KubePrismEndpointsSpec) + - [KubePrismStatusesSpec](#talos.resource.definitions.k8s.KubePrismStatusesSpec) + - [KubeletConfigSpec](#talos.resource.definitions.k8s.KubeletConfigSpec) + - [KubeletConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.KubeletConfigSpec.ExtraArgsEntry) + - [KubeletSpecSpec](#talos.resource.definitions.k8s.KubeletSpecSpec) + - [ManifestSpec](#talos.resource.definitions.k8s.ManifestSpec) + - [ManifestStatusSpec](#talos.resource.definitions.k8s.ManifestStatusSpec) + - [NodeAnnotationSpecSpec](#talos.resource.definitions.k8s.NodeAnnotationSpecSpec) + - [NodeIPConfigSpec](#talos.resource.definitions.k8s.NodeIPConfigSpec) + - [NodeIPSpec](#talos.resource.definitions.k8s.NodeIPSpec) + - [NodeLabelSpecSpec](#talos.resource.definitions.k8s.NodeLabelSpecSpec) + - [NodeStatusSpec](#talos.resource.definitions.k8s.NodeStatusSpec) + - [NodeStatusSpec.AnnotationsEntry](#talos.resource.definitions.k8s.NodeStatusSpec.AnnotationsEntry) + - [NodeStatusSpec.LabelsEntry](#talos.resource.definitions.k8s.NodeStatusSpec.LabelsEntry) + - [NodeTaintSpecSpec](#talos.resource.definitions.k8s.NodeTaintSpecSpec) + - [NodenameSpec](#talos.resource.definitions.k8s.NodenameSpec) + - [Resources](#talos.resource.definitions.k8s.Resources) + - [Resources.LimitsEntry](#talos.resource.definitions.k8s.Resources.LimitsEntry) + - [Resources.RequestsEntry](#talos.resource.definitions.k8s.Resources.RequestsEntry) + - [SchedulerConfigSpec](#talos.resource.definitions.k8s.SchedulerConfigSpec) + - [SchedulerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.SchedulerConfigSpec.EnvironmentVariablesEntry) + - [SchedulerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.SchedulerConfigSpec.ExtraArgsEntry) + - [SecretsStatusSpec](#talos.resource.definitions.k8s.SecretsStatusSpec) + - [SingleManifest](#talos.resource.definitions.k8s.SingleManifest) + - [StaticPodServerStatusSpec](#talos.resource.definitions.k8s.StaticPodServerStatusSpec) + - [StaticPodSpec](#talos.resource.definitions.k8s.StaticPodSpec) + - [StaticPodStatusSpec](#talos.resource.definitions.k8s.StaticPodStatusSpec) + +- [resource/definitions/kubeaccess/kubeaccess.proto](#resource/definitions/kubeaccess/kubeaccess.proto) + - [ConfigSpec](#talos.resource.definitions.kubeaccess.ConfigSpec) + +- [resource/definitions/kubespan/kubespan.proto](#resource/definitions/kubespan/kubespan.proto) + - [ConfigSpec](#talos.resource.definitions.kubespan.ConfigSpec) + - [EndpointSpec](#talos.resource.definitions.kubespan.EndpointSpec) + - [IdentitySpec](#talos.resource.definitions.kubespan.IdentitySpec) + - [PeerSpecSpec](#talos.resource.definitions.kubespan.PeerSpecSpec) + - [PeerStatusSpec](#talos.resource.definitions.kubespan.PeerStatusSpec) + +- [resource/definitions/network/network.proto](#resource/definitions/network/network.proto) + - [AddressSpecSpec](#talos.resource.definitions.network.AddressSpecSpec) + - [AddressStatusSpec](#talos.resource.definitions.network.AddressStatusSpec) + - [BondMasterSpec](#talos.resource.definitions.network.BondMasterSpec) + - [BondSlave](#talos.resource.definitions.network.BondSlave) + - [BridgeMasterSpec](#talos.resource.definitions.network.BridgeMasterSpec) + - [BridgeSlave](#talos.resource.definitions.network.BridgeSlave) + - [BridgeVLANSpec](#talos.resource.definitions.network.BridgeVLANSpec) + - [DHCP4OperatorSpec](#talos.resource.definitions.network.DHCP4OperatorSpec) + - [DHCP6OperatorSpec](#talos.resource.definitions.network.DHCP6OperatorSpec) + - [DNSResolveCacheSpec](#talos.resource.definitions.network.DNSResolveCacheSpec) + - [EthernetChannelsSpec](#talos.resource.definitions.network.EthernetChannelsSpec) + - [EthernetChannelsStatus](#talos.resource.definitions.network.EthernetChannelsStatus) + - [EthernetFeatureStatus](#talos.resource.definitions.network.EthernetFeatureStatus) + - [EthernetRingsSpec](#talos.resource.definitions.network.EthernetRingsSpec) + - [EthernetRingsStatus](#talos.resource.definitions.network.EthernetRingsStatus) + - [EthernetSpecSpec](#talos.resource.definitions.network.EthernetSpecSpec) + - [EthernetSpecSpec.FeaturesEntry](#talos.resource.definitions.network.EthernetSpecSpec.FeaturesEntry) + - [EthernetStatusSpec](#talos.resource.definitions.network.EthernetStatusSpec) + - [HardwareAddrSpec](#talos.resource.definitions.network.HardwareAddrSpec) + - [HostDNSConfigSpec](#talos.resource.definitions.network.HostDNSConfigSpec) + - [HostnameSpecSpec](#talos.resource.definitions.network.HostnameSpecSpec) + - [HostnameStatusSpec](#talos.resource.definitions.network.HostnameStatusSpec) + - [LinkRefreshSpec](#talos.resource.definitions.network.LinkRefreshSpec) + - [LinkSpecSpec](#talos.resource.definitions.network.LinkSpecSpec) + - [LinkStatusSpec](#talos.resource.definitions.network.LinkStatusSpec) + - [NfTablesAddressMatch](#talos.resource.definitions.network.NfTablesAddressMatch) + - [NfTablesChainSpec](#talos.resource.definitions.network.NfTablesChainSpec) + - [NfTablesClampMSS](#talos.resource.definitions.network.NfTablesClampMSS) + - [NfTablesConntrackStateMatch](#talos.resource.definitions.network.NfTablesConntrackStateMatch) + - [NfTablesIfNameMatch](#talos.resource.definitions.network.NfTablesIfNameMatch) + - [NfTablesLayer4Match](#talos.resource.definitions.network.NfTablesLayer4Match) + - [NfTablesLimitMatch](#talos.resource.definitions.network.NfTablesLimitMatch) + - [NfTablesMark](#talos.resource.definitions.network.NfTablesMark) + - [NfTablesPortMatch](#talos.resource.definitions.network.NfTablesPortMatch) + - [NfTablesRule](#talos.resource.definitions.network.NfTablesRule) + - [NodeAddressFilterSpec](#talos.resource.definitions.network.NodeAddressFilterSpec) + - [NodeAddressSortAlgorithmSpec](#talos.resource.definitions.network.NodeAddressSortAlgorithmSpec) + - [NodeAddressSpec](#talos.resource.definitions.network.NodeAddressSpec) + - [OperatorSpecSpec](#talos.resource.definitions.network.OperatorSpecSpec) + - [PortRange](#talos.resource.definitions.network.PortRange) + - [ProbeSpecSpec](#talos.resource.definitions.network.ProbeSpecSpec) + - [ProbeStatusSpec](#talos.resource.definitions.network.ProbeStatusSpec) + - [ResolverSpecSpec](#talos.resource.definitions.network.ResolverSpecSpec) + - [ResolverStatusSpec](#talos.resource.definitions.network.ResolverStatusSpec) + - [RouteSpecSpec](#talos.resource.definitions.network.RouteSpecSpec) + - [RouteStatusSpec](#talos.resource.definitions.network.RouteStatusSpec) + - [STPSpec](#talos.resource.definitions.network.STPSpec) + - [StatusSpec](#talos.resource.definitions.network.StatusSpec) + - [TCPProbeSpec](#talos.resource.definitions.network.TCPProbeSpec) + - [TimeServerSpecSpec](#talos.resource.definitions.network.TimeServerSpecSpec) + - [TimeServerStatusSpec](#talos.resource.definitions.network.TimeServerStatusSpec) + - [VIPEquinixMetalSpec](#talos.resource.definitions.network.VIPEquinixMetalSpec) + - [VIPHCloudSpec](#talos.resource.definitions.network.VIPHCloudSpec) + - [VIPOperatorSpec](#talos.resource.definitions.network.VIPOperatorSpec) + - [VLANSpec](#talos.resource.definitions.network.VLANSpec) + - [WireguardPeer](#talos.resource.definitions.network.WireguardPeer) + - [WireguardSpec](#talos.resource.definitions.network.WireguardSpec) + +- [resource/definitions/perf/perf.proto](#resource/definitions/perf/perf.proto) + - [CPUSpec](#talos.resource.definitions.perf.CPUSpec) + - [CPUStat](#talos.resource.definitions.perf.CPUStat) + - [MemorySpec](#talos.resource.definitions.perf.MemorySpec) + +- [resource/definitions/proto/proto.proto](#resource/definitions/proto/proto.proto) + - [LinuxIDMapping](#talos.resource.definitions.proto.LinuxIDMapping) + - [Mount](#talos.resource.definitions.proto.Mount) + +- [resource/definitions/runtime/runtime.proto](#resource/definitions/runtime/runtime.proto) + - [BootedEntrySpec](#talos.resource.definitions.runtime.BootedEntrySpec) + - [DevicesStatusSpec](#talos.resource.definitions.runtime.DevicesStatusSpec) + - [DiagnosticSpec](#talos.resource.definitions.runtime.DiagnosticSpec) + - [EventSinkConfigSpec](#talos.resource.definitions.runtime.EventSinkConfigSpec) + - [ExtensionServiceConfigFile](#talos.resource.definitions.runtime.ExtensionServiceConfigFile) + - [ExtensionServiceConfigSpec](#talos.resource.definitions.runtime.ExtensionServiceConfigSpec) + - [ExtensionServiceConfigStatusSpec](#talos.resource.definitions.runtime.ExtensionServiceConfigStatusSpec) + - [KernelCmdlineSpec](#talos.resource.definitions.runtime.KernelCmdlineSpec) + - [KernelModuleSpecSpec](#talos.resource.definitions.runtime.KernelModuleSpecSpec) + - [KernelParamSpecSpec](#talos.resource.definitions.runtime.KernelParamSpecSpec) + - [KernelParamStatusSpec](#talos.resource.definitions.runtime.KernelParamStatusSpec) + - [KmsgLogConfigSpec](#talos.resource.definitions.runtime.KmsgLogConfigSpec) + - [LoadedKernelModuleSpec](#talos.resource.definitions.runtime.LoadedKernelModuleSpec) + - [MachineStatusSpec](#talos.resource.definitions.runtime.MachineStatusSpec) + - [MachineStatusStatus](#talos.resource.definitions.runtime.MachineStatusStatus) + - [MaintenanceServiceConfigSpec](#talos.resource.definitions.runtime.MaintenanceServiceConfigSpec) + - [MetaKeySpec](#talos.resource.definitions.runtime.MetaKeySpec) + - [MetaLoadedSpec](#talos.resource.definitions.runtime.MetaLoadedSpec) + - [MountStatusSpec](#talos.resource.definitions.runtime.MountStatusSpec) + - [PlatformMetadataSpec](#talos.resource.definitions.runtime.PlatformMetadataSpec) + - [PlatformMetadataSpec.TagsEntry](#talos.resource.definitions.runtime.PlatformMetadataSpec.TagsEntry) + - [SBOMItemSpec](#talos.resource.definitions.runtime.SBOMItemSpec) + - [SecurityStateSpec](#talos.resource.definitions.runtime.SecurityStateSpec) + - [UniqueMachineTokenSpec](#talos.resource.definitions.runtime.UniqueMachineTokenSpec) + - [UnmetCondition](#talos.resource.definitions.runtime.UnmetCondition) + - [WatchdogTimerConfigSpec](#talos.resource.definitions.runtime.WatchdogTimerConfigSpec) + - [WatchdogTimerStatusSpec](#talos.resource.definitions.runtime.WatchdogTimerStatusSpec) + +- [resource/definitions/secrets/secrets.proto](#resource/definitions/secrets/secrets.proto) + - [APICertsSpec](#talos.resource.definitions.secrets.APICertsSpec) + - [CertSANSpec](#talos.resource.definitions.secrets.CertSANSpec) + - [EncryptionSaltSpec](#talos.resource.definitions.secrets.EncryptionSaltSpec) + - [EtcdCertsSpec](#talos.resource.definitions.secrets.EtcdCertsSpec) + - [EtcdRootSpec](#talos.resource.definitions.secrets.EtcdRootSpec) + - [KubeletSpec](#talos.resource.definitions.secrets.KubeletSpec) + - [KubernetesCertsSpec](#talos.resource.definitions.secrets.KubernetesCertsSpec) + - [KubernetesDynamicCertsSpec](#talos.resource.definitions.secrets.KubernetesDynamicCertsSpec) + - [KubernetesRootSpec](#talos.resource.definitions.secrets.KubernetesRootSpec) + - [MaintenanceRootSpec](#talos.resource.definitions.secrets.MaintenanceRootSpec) + - [MaintenanceServiceCertsSpec](#talos.resource.definitions.secrets.MaintenanceServiceCertsSpec) + - [OSRootSpec](#talos.resource.definitions.secrets.OSRootSpec) + - [TrustdCertsSpec](#talos.resource.definitions.secrets.TrustdCertsSpec) + +- [resource/definitions/siderolink/siderolink.proto](#resource/definitions/siderolink/siderolink.proto) + - [ConfigSpec](#talos.resource.definitions.siderolink.ConfigSpec) + - [StatusSpec](#talos.resource.definitions.siderolink.StatusSpec) + - [TunnelSpec](#talos.resource.definitions.siderolink.TunnelSpec) + +- [resource/definitions/time/time.proto](#resource/definitions/time/time.proto) + - [AdjtimeStatusSpec](#talos.resource.definitions.time.AdjtimeStatusSpec) + - [StatusSpec](#talos.resource.definitions.time.StatusSpec) + +- [resource/definitions/v1alpha1/v1alpha1.proto](#resource/definitions/v1alpha1/v1alpha1.proto) + - [ServiceSpec](#talos.resource.definitions.v1alpha1.ServiceSpec) + +- [inspect/inspect.proto](#inspect/inspect.proto) + - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) + - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) + - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) + + - [DependencyEdgeType](#inspect.DependencyEdgeType) + + - [InspectService](#inspect.InspectService) + +- [machine/machine.proto](#machine/machine.proto) + - [AddressEvent](#machine.AddressEvent) + - [ApplyConfiguration](#machine.ApplyConfiguration) + - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) + - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) + - [BPFInstruction](#machine.BPFInstruction) + - [Bootstrap](#machine.Bootstrap) + - [BootstrapRequest](#machine.BootstrapRequest) + - [BootstrapResponse](#machine.BootstrapResponse) + - [CNIConfig](#machine.CNIConfig) + - [CPUFreqStats](#machine.CPUFreqStats) + - [CPUFreqStatsResponse](#machine.CPUFreqStatsResponse) + - [CPUInfo](#machine.CPUInfo) + - [CPUInfoResponse](#machine.CPUInfoResponse) + - [CPUStat](#machine.CPUStat) + - [CPUsFreqStats](#machine.CPUsFreqStats) + - [CPUsInfo](#machine.CPUsInfo) + - [ClusterConfig](#machine.ClusterConfig) + - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) + - [ConfigLoadErrorEvent](#machine.ConfigLoadErrorEvent) + - [ConfigValidationErrorEvent](#machine.ConfigValidationErrorEvent) + - [ConnectRecord](#machine.ConnectRecord) + - [ConnectRecord.Process](#machine.ConnectRecord.Process) + - [Container](#machine.Container) + - [ContainerInfo](#machine.ContainerInfo) + - [ContainersRequest](#machine.ContainersRequest) + - [ContainersResponse](#machine.ContainersResponse) + - [ControlPlaneConfig](#machine.ControlPlaneConfig) + - [CopyRequest](#machine.CopyRequest) + - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) + - [DiskStat](#machine.DiskStat) + - [DiskStats](#machine.DiskStats) + - [DiskStatsResponse](#machine.DiskStatsResponse) + - [DiskUsageInfo](#machine.DiskUsageInfo) + - [DiskUsageRequest](#machine.DiskUsageRequest) + - [DmesgRequest](#machine.DmesgRequest) + - [EtcdAlarm](#machine.EtcdAlarm) + - [EtcdAlarmDisarm](#machine.EtcdAlarmDisarm) + - [EtcdAlarmDisarmResponse](#machine.EtcdAlarmDisarmResponse) + - [EtcdAlarmListResponse](#machine.EtcdAlarmListResponse) + - [EtcdClusterDowngrade](#machine.EtcdClusterDowngrade) + - [EtcdDefragment](#machine.EtcdDefragment) + - [EtcdDefragmentResponse](#machine.EtcdDefragmentResponse) + - [EtcdDowngradeCancel](#machine.EtcdDowngradeCancel) + - [EtcdDowngradeCancelResponse](#machine.EtcdDowngradeCancelResponse) + - [EtcdDowngradeEnable](#machine.EtcdDowngradeEnable) + - [EtcdDowngradeEnableRequest](#machine.EtcdDowngradeEnableRequest) + - [EtcdDowngradeEnableResponse](#machine.EtcdDowngradeEnableResponse) + - [EtcdDowngradeValidate](#machine.EtcdDowngradeValidate) + - [EtcdDowngradeValidateRequest](#machine.EtcdDowngradeValidateRequest) + - [EtcdDowngradeValidateResponse](#machine.EtcdDowngradeValidateResponse) + - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) + - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) + - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) + - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) + - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) + - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) + - [EtcdMember](#machine.EtcdMember) + - [EtcdMemberAlarm](#machine.EtcdMemberAlarm) + - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) + - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) + - [EtcdMemberStatus](#machine.EtcdMemberStatus) + - [EtcdMembers](#machine.EtcdMembers) + - [EtcdRecover](#machine.EtcdRecover) + - [EtcdRecoverResponse](#machine.EtcdRecoverResponse) + - [EtcdRemoveMember](#machine.EtcdRemoveMember) + - [EtcdRemoveMemberByID](#machine.EtcdRemoveMemberByID) + - [EtcdRemoveMemberByIDRequest](#machine.EtcdRemoveMemberByIDRequest) + - [EtcdRemoveMemberByIDResponse](#machine.EtcdRemoveMemberByIDResponse) + - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) + - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) + - [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) + - [EtcdStatus](#machine.EtcdStatus) + - [EtcdStatusResponse](#machine.EtcdStatusResponse) + - [Event](#machine.Event) + - [EventsRequest](#machine.EventsRequest) + - [FeaturesInfo](#machine.FeaturesInfo) + - [FileInfo](#machine.FileInfo) + - [GenerateClientConfiguration](#machine.GenerateClientConfiguration) + - [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) + - [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) + - [GenerateConfiguration](#machine.GenerateConfiguration) + - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) + - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) + - [Hostname](#machine.Hostname) + - [HostnameResponse](#machine.HostnameResponse) + - [ImageListRequest](#machine.ImageListRequest) + - [ImageListResponse](#machine.ImageListResponse) + - [ImagePull](#machine.ImagePull) + - [ImagePullRequest](#machine.ImagePullRequest) + - [ImagePullResponse](#machine.ImagePullResponse) + - [InstallConfig](#machine.InstallConfig) + - [ListRequest](#machine.ListRequest) + - [LoadAvg](#machine.LoadAvg) + - [LoadAvgResponse](#machine.LoadAvgResponse) + - [LogsContainer](#machine.LogsContainer) + - [LogsContainersResponse](#machine.LogsContainersResponse) + - [LogsRequest](#machine.LogsRequest) + - [MachineConfig](#machine.MachineConfig) + - [MachineStatusEvent](#machine.MachineStatusEvent) + - [MachineStatusEvent.MachineStatus](#machine.MachineStatusEvent.MachineStatus) + - [MachineStatusEvent.MachineStatus.UnmetCondition](#machine.MachineStatusEvent.MachineStatus.UnmetCondition) + - [MemInfo](#machine.MemInfo) + - [Memory](#machine.Memory) + - [MemoryResponse](#machine.MemoryResponse) + - [MetaDelete](#machine.MetaDelete) + - [MetaDeleteRequest](#machine.MetaDeleteRequest) + - [MetaDeleteResponse](#machine.MetaDeleteResponse) + - [MetaWrite](#machine.MetaWrite) + - [MetaWriteRequest](#machine.MetaWriteRequest) + - [MetaWriteResponse](#machine.MetaWriteResponse) + - [MountStat](#machine.MountStat) + - [Mounts](#machine.Mounts) + - [MountsResponse](#machine.MountsResponse) + - [NetDev](#machine.NetDev) + - [Netstat](#machine.Netstat) + - [NetstatRequest](#machine.NetstatRequest) + - [NetstatRequest.Feature](#machine.NetstatRequest.Feature) + - [NetstatRequest.L4proto](#machine.NetstatRequest.L4proto) + - [NetstatRequest.NetNS](#machine.NetstatRequest.NetNS) + - [NetstatResponse](#machine.NetstatResponse) + - [NetworkConfig](#machine.NetworkConfig) + - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) + - [NetworkDeviceStats](#machine.NetworkDeviceStats) + - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) + - [PacketCaptureRequest](#machine.PacketCaptureRequest) + - [PhaseEvent](#machine.PhaseEvent) + - [PlatformInfo](#machine.PlatformInfo) + - [Process](#machine.Process) + - [ProcessInfo](#machine.ProcessInfo) + - [ProcessesResponse](#machine.ProcessesResponse) + - [ReadRequest](#machine.ReadRequest) + - [Reboot](#machine.Reboot) + - [RebootRequest](#machine.RebootRequest) + - [RebootResponse](#machine.RebootResponse) + - [Reset](#machine.Reset) + - [ResetPartitionSpec](#machine.ResetPartitionSpec) + - [ResetRequest](#machine.ResetRequest) + - [ResetResponse](#machine.ResetResponse) + - [Restart](#machine.Restart) + - [RestartEvent](#machine.RestartEvent) + - [RestartRequest](#machine.RestartRequest) + - [RestartResponse](#machine.RestartResponse) + - [Rollback](#machine.Rollback) + - [RollbackRequest](#machine.RollbackRequest) + - [RollbackResponse](#machine.RollbackResponse) + - [RouteConfig](#machine.RouteConfig) + - [SequenceEvent](#machine.SequenceEvent) + - [ServiceEvent](#machine.ServiceEvent) + - [ServiceEvents](#machine.ServiceEvents) + - [ServiceHealth](#machine.ServiceHealth) + - [ServiceInfo](#machine.ServiceInfo) + - [ServiceList](#machine.ServiceList) + - [ServiceListResponse](#machine.ServiceListResponse) + - [ServiceRestart](#machine.ServiceRestart) + - [ServiceRestartRequest](#machine.ServiceRestartRequest) + - [ServiceRestartResponse](#machine.ServiceRestartResponse) + - [ServiceStart](#machine.ServiceStart) + - [ServiceStartRequest](#machine.ServiceStartRequest) + - [ServiceStartResponse](#machine.ServiceStartResponse) + - [ServiceStateEvent](#machine.ServiceStateEvent) + - [ServiceStop](#machine.ServiceStop) + - [ServiceStopRequest](#machine.ServiceStopRequest) + - [ServiceStopResponse](#machine.ServiceStopResponse) + - [Shutdown](#machine.Shutdown) + - [ShutdownRequest](#machine.ShutdownRequest) + - [ShutdownResponse](#machine.ShutdownResponse) + - [SoftIRQStat](#machine.SoftIRQStat) + - [Stat](#machine.Stat) + - [Stats](#machine.Stats) + - [StatsRequest](#machine.StatsRequest) + - [StatsResponse](#machine.StatsResponse) + - [SystemStat](#machine.SystemStat) + - [SystemStatResponse](#machine.SystemStatResponse) + - [TaskEvent](#machine.TaskEvent) + - [Upgrade](#machine.Upgrade) + - [UpgradeRequest](#machine.UpgradeRequest) + - [UpgradeResponse](#machine.UpgradeResponse) + - [Version](#machine.Version) + - [VersionInfo](#machine.VersionInfo) + - [VersionResponse](#machine.VersionResponse) + - [Xattr](#machine.Xattr) + + - [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) + - [ConnectRecord.State](#machine.ConnectRecord.State) + - [ConnectRecord.TimerActive](#machine.ConnectRecord.TimerActive) + - [EtcdMemberAlarm.AlarmType](#machine.EtcdMemberAlarm.AlarmType) + - [ListRequest.Type](#machine.ListRequest.Type) + - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) + - [MachineStatusEvent.MachineStage](#machine.MachineStatusEvent.MachineStage) + - [NetstatRequest.Filter](#machine.NetstatRequest.Filter) + - [PhaseEvent.Action](#machine.PhaseEvent.Action) + - [RebootRequest.Mode](#machine.RebootRequest.Mode) + - [ResetRequest.WipeMode](#machine.ResetRequest.WipeMode) + - [SequenceEvent.Action](#machine.SequenceEvent.Action) + - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) + - [TaskEvent.Action](#machine.TaskEvent.Action) + - [UpgradeRequest.RebootMode](#machine.UpgradeRequest.RebootMode) + + - [MachineService](#machine.MachineService) + +- [security/security.proto](#security/security.proto) + - [CertificateRequest](#securityapi.CertificateRequest) + - [CertificateResponse](#securityapi.CertificateResponse) + + - [SecurityService](#securityapi.SecurityService) + +- [storage/storage.proto](#storage/storage.proto) + - [BlockDeviceWipe](#storage.BlockDeviceWipe) + - [BlockDeviceWipeDescriptor](#storage.BlockDeviceWipeDescriptor) + - [BlockDeviceWipeRequest](#storage.BlockDeviceWipeRequest) + - [BlockDeviceWipeResponse](#storage.BlockDeviceWipeResponse) + - [Disk](#storage.Disk) + - [Disks](#storage.Disks) + - [DisksResponse](#storage.DisksResponse) + + - [BlockDeviceWipeDescriptor.Method](#storage.BlockDeviceWipeDescriptor.Method) + - [Disk.DiskType](#storage.Disk.DiskType) + + - [StorageService](#storage.StorageService) + +- [time/time.proto](#time/time.proto) + - [Time](#time.Time) + - [TimeRequest](#time.TimeRequest) + - [TimeResponse](#time.TimeResponse) + + - [TimeService](#time.TimeService) + +- [Scalar Value Types](#scalar-value-types) + + + + +

Top

+ +## common/common.proto + + + + + +### Data + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [Metadata](#common.Metadata) | | | +| bytes | [bytes](#bytes) | | | + + + + + + + + +### DataResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Data](#common.Data) | repeated | | + + + + + + + + +### Empty + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [Metadata](#common.Metadata) | | | + + + + + + + + +### EmptyResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Empty](#common.Empty) | repeated | | + + + + + + + + +### Error + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| code | [Code](#common.Code) | | | +| message | [string](#string) | | | +| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | + + + + + + + + +### Metadata +Common metadata message nested in all reply message types + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | +| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | +| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | + + + + + + + + +### NetIP + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ip | [bytes](#bytes) | | | + + + + + + + + +### NetIPPort + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ip | [bytes](#bytes) | | | +| port | [int32](#int32) | | | + + + + + + + + +### NetIPPrefix + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ip | [bytes](#bytes) | | | +| prefix_length | [int32](#int32) | | | + + + + + + + + +### PEMEncodedCertificate + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| crt | [bytes](#bytes) | | | + + + + + + + + +### PEMEncodedCertificateAndKey + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| crt | [bytes](#bytes) | | | +| key | [bytes](#bytes) | | | + + + + + + + + +### PEMEncodedKey + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [bytes](#bytes) | | | + + + + + + + + +### URL + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| full_path | [string](#string) | | | + + + + + + + + + + +### Code + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| FATAL | 0 | | +| LOCKED | 1 | | +| CANCELED | 2 | | + + + + + +### ContainerDriver + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| CONTAINERD | 0 | | +| CRI | 1 | | + + + + + +### ContainerdNamespace + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NS_UNKNOWN | 0 | | +| NS_SYSTEM | 1 | | +| NS_CRI | 2 | | + + + + + + + +### File-level Extensions +| Extension | Type | Base | Number | Description | +| --------- | ---- | ---- | ------ | ----------- | +| remove_deprecated_enum | string | .google.protobuf.EnumOptions | 93117 | Indicates the Talos version when this deprecated enum will be removed from API. | +| remove_deprecated_enum_value | string | .google.protobuf.EnumValueOptions | 93117 | Indicates the Talos version when this deprecated enum value will be removed from API. | +| remove_deprecated_field | string | .google.protobuf.FieldOptions | 93117 | Indicates the Talos version when this deprecated filed will be removed from API. | +| remove_deprecated_message | string | .google.protobuf.MessageOptions | 93117 | Indicates the Talos version when this deprecated message will be removed from API. | +| remove_deprecated_method | string | .google.protobuf.MethodOptions | 93117 | Indicates the Talos version when this deprecated method will be removed from API. | +| remove_deprecated_service | string | .google.protobuf.ServiceOptions | 93117 | Indicates the Talos version when this deprecated service will be removed from API. | + + + + + + + + +

Top

+ +## resource/definitions/block/block.proto + + + + + +### DeviceSpec +DeviceSpec is the spec for devices status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| type | [string](#string) | | | +| major | [int64](#int64) | | | +| minor | [int64](#int64) | | | +| partition_name | [string](#string) | | | +| partition_number | [int64](#int64) | | | +| generation | [int64](#int64) | | | +| device_path | [string](#string) | | | +| parent | [string](#string) | | | +| secondaries | [string](#string) | repeated | | + + + + + + + + +### DiscoveredVolumeSpec +DiscoveredVolumeSpec is the spec for DiscoveredVolumes resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| size | [uint64](#uint64) | | | +| sector_size | [uint64](#uint64) | | | +| io_size | [uint64](#uint64) | | | +| name | [string](#string) | | | +| uuid | [string](#string) | | | +| label | [string](#string) | | | +| block_size | [uint32](#uint32) | | | +| filesystem_block_size | [uint32](#uint32) | | | +| probed_size | [uint64](#uint64) | | | +| partition_uuid | [string](#string) | | | +| partition_type | [string](#string) | | | +| partition_label | [string](#string) | | | +| partition_index | [uint64](#uint64) | | | +| type | [string](#string) | | | +| device_path | [string](#string) | | | +| parent | [string](#string) | | | +| dev_path | [string](#string) | | | +| parent_dev_path | [string](#string) | | | +| pretty_size | [string](#string) | | | + + + + + + + + +### DiscoveryRefreshRequestSpec +DiscoveryRefreshRequestSpec is the spec for DiscoveryRefreshRequest. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| request | [int64](#int64) | | | + + + + + + + + +### DiscoveryRefreshStatusSpec +DiscoveryRefreshStatusSpec is the spec for DiscoveryRefreshStatus status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| request | [int64](#int64) | | | + + + + + + + + +### DiskSelector +DiskSelector selects a disk for the volume. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| match | [google.api.expr.v1alpha1.CheckedExpr](#google.api.expr.v1alpha1.CheckedExpr) | | | + + + + + + + + +### DiskSpec +DiskSpec is the spec for Disks status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| size | [uint64](#uint64) | | | +| io_size | [uint64](#uint64) | | | +| sector_size | [uint64](#uint64) | | | +| readonly | [bool](#bool) | | | +| model | [string](#string) | | | +| serial | [string](#string) | | | +| modalias | [string](#string) | | | +| wwid | [string](#string) | | | +| bus_path | [string](#string) | | | +| sub_system | [string](#string) | | | +| transport | [string](#string) | | | +| rotational | [bool](#bool) | | | +| cdrom | [bool](#bool) | | | +| dev_path | [string](#string) | | | +| pretty_size | [string](#string) | | | +| secondary_disks | [string](#string) | repeated | | +| uuid | [string](#string) | | | +| symlinks | [string](#string) | repeated | | + + + + + + + + +### EncryptionKey +EncryptionKey is the spec for volume encryption key. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| slot | [int64](#int64) | | | +| type | [talos.resource.definitions.enums.BlockEncryptionKeyType](#talos.resource.definitions.enums.BlockEncryptionKeyType) | | | +| static_passphrase | [bytes](#bytes) | | | +| kms_endpoint | [string](#string) | | | +| tpm_check_secureboot_status_on_enroll | [bool](#bool) | | | +| lock_to_state | [bool](#bool) | | | + + + + + + + + +### EncryptionSpec +EncryptionSpec is the spec for volume encryption. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| provider | [talos.resource.definitions.enums.BlockEncryptionProviderType](#talos.resource.definitions.enums.BlockEncryptionProviderType) | | | +| keys | [EncryptionKey](#talos.resource.definitions.block.EncryptionKey) | repeated | | +| cipher | [string](#string) | | | +| key_size | [uint64](#uint64) | | | +| block_size | [uint64](#uint64) | | | +| perf_options | [string](#string) | repeated | | + + + + + + + + +### FilesystemSpec +FilesystemSpec is the spec for volume filesystem. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| type | [talos.resource.definitions.enums.BlockFilesystemType](#talos.resource.definitions.enums.BlockFilesystemType) | | | +| label | [string](#string) | | | + + + + + + + + +### LocatorSpec +LocatorSpec is the spec for volume locator. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| match | [google.api.expr.v1alpha1.CheckedExpr](#google.api.expr.v1alpha1.CheckedExpr) | | | + + + + + + + + +### MountRequestSpec +MountRequestSpec is the spec for MountRequest. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| volume_id | [string](#string) | | | +| parent_mount_id | [string](#string) | | | +| requesters | [string](#string) | repeated | | +| requester_i_ds | [string](#string) | repeated | | +| read_only | [bool](#bool) | | | + + + + + + + + +### MountSpec +MountSpec is the spec for volume mount. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| target_path | [string](#string) | | | +| selinux_label | [string](#string) | | | +| project_quota_support | [bool](#bool) | | | +| parent_id | [string](#string) | | | +| file_mode | [uint32](#uint32) | | | +| uid | [int64](#int64) | | | +| gid | [int64](#int64) | | | +| recursive_relabel | [bool](#bool) | | | + + + + + + + + +### MountStatusSpec +MountStatusSpec is the spec for MountStatus. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| spec | [MountRequestSpec](#talos.resource.definitions.block.MountRequestSpec) | | | +| target | [string](#string) | | | +| source | [string](#string) | | | +| filesystem | [talos.resource.definitions.enums.BlockFilesystemType](#talos.resource.definitions.enums.BlockFilesystemType) | | | +| read_only | [bool](#bool) | | | +| project_quota_support | [bool](#bool) | | | +| encryption_provider | [talos.resource.definitions.enums.BlockEncryptionProviderType](#talos.resource.definitions.enums.BlockEncryptionProviderType) | | | + + + + + + + + +### PartitionSpec +PartitionSpec is the spec for volume partitioning. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| min_size | [uint64](#uint64) | | | +| max_size | [uint64](#uint64) | | | +| grow | [bool](#bool) | | | +| label | [string](#string) | | | +| type_uuid | [string](#string) | | | + + + + + + + + +### ProvisioningSpec +ProvisioningSpec is the spec for volume provisioning. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| disk_selector | [DiskSelector](#talos.resource.definitions.block.DiskSelector) | | | +| partition_spec | [PartitionSpec](#talos.resource.definitions.block.PartitionSpec) | | | +| wave | [int64](#int64) | | | +| filesystem_spec | [FilesystemSpec](#talos.resource.definitions.block.FilesystemSpec) | | | + + + + + + + + +### SwapStatusSpec +SwapStatusSpec is the spec for SwapStatuss resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| device | [string](#string) | | | +| size_bytes | [uint64](#uint64) | | | +| size_human | [string](#string) | | | +| used_bytes | [uint64](#uint64) | | | +| used_human | [string](#string) | | | +| priority | [int32](#int32) | | | +| type | [string](#string) | | | + + + + + + + + +### SymlinkProvisioningSpec +SymlinkProvisioningSpec is the spec for volume symlink. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| symlink_target_path | [string](#string) | | | +| force | [bool](#bool) | | | + + + + + + + + +### SymlinkSpec +SymlinkSpec is the spec for Symlinks resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| paths | [string](#string) | repeated | | + + + + + + + + +### SystemDiskSpec +SystemDiskSpec is the spec for SystemDisks resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| disk_id | [string](#string) | | | +| dev_path | [string](#string) | | | + + + + + + + + +### UserDiskConfigStatusSpec +UserDiskConfigStatusSpec is the spec for UserDiskConfigStatus resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| torn_down | [bool](#bool) | | | + + + + + + + + +### VolumeConfigSpec +VolumeConfigSpec is the spec for VolumeConfig resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| parent_id | [string](#string) | | | +| type | [talos.resource.definitions.enums.BlockVolumeType](#talos.resource.definitions.enums.BlockVolumeType) | | | +| provisioning | [ProvisioningSpec](#talos.resource.definitions.block.ProvisioningSpec) | | | +| locator | [LocatorSpec](#talos.resource.definitions.block.LocatorSpec) | | | +| mount | [MountSpec](#talos.resource.definitions.block.MountSpec) | | | +| encryption | [EncryptionSpec](#talos.resource.definitions.block.EncryptionSpec) | | | +| symlink | [SymlinkProvisioningSpec](#talos.resource.definitions.block.SymlinkProvisioningSpec) | | | + + + + + + + + +### VolumeMountRequestSpec +VolumeMountRequestSpec is the spec for VolumeMountRequest. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| volume_id | [string](#string) | | | +| requester | [string](#string) | | | +| read_only | [bool](#bool) | | | + + + + + + + + +### VolumeMountStatusSpec +VolumeMountStatusSpec is the spec for VolumeMountStatus. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| volume_id | [string](#string) | | | +| requester | [string](#string) | | | +| target | [string](#string) | | | +| read_only | [bool](#bool) | | | + + + + + + + + +### VolumeStatusSpec +VolumeStatusSpec is the spec for VolumeStatus resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| phase | [talos.resource.definitions.enums.BlockVolumePhase](#talos.resource.definitions.enums.BlockVolumePhase) | | | +| location | [string](#string) | | | +| error_message | [string](#string) | | | +| uuid | [string](#string) | | | +| partition_uuid | [string](#string) | | | +| pre_fail_phase | [talos.resource.definitions.enums.BlockVolumePhase](#talos.resource.definitions.enums.BlockVolumePhase) | | | +| parent_location | [string](#string) | | | +| partition_index | [int64](#int64) | | | +| size | [uint64](#uint64) | | | +| filesystem | [talos.resource.definitions.enums.BlockFilesystemType](#talos.resource.definitions.enums.BlockFilesystemType) | | | +| mount_location | [string](#string) | | | +| encryption_provider | [talos.resource.definitions.enums.BlockEncryptionProviderType](#talos.resource.definitions.enums.BlockEncryptionProviderType) | | | +| pretty_size | [string](#string) | | | +| encryption_failed_syncs | [string](#string) | repeated | | +| mount_spec | [MountSpec](#talos.resource.definitions.block.MountSpec) | | | +| type | [talos.resource.definitions.enums.BlockVolumeType](#talos.resource.definitions.enums.BlockVolumeType) | | | +| configured_encryption_keys | [string](#string) | repeated | | +| symlink_spec | [SymlinkProvisioningSpec](#talos.resource.definitions.block.SymlinkProvisioningSpec) | | | +| parent_id | [string](#string) | | | + + + + + + + + +### ZswapStatusSpec +ZswapStatusSpec is the spec for ZswapStatus resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| total_size_bytes | [uint64](#uint64) | | | +| total_size_human | [string](#string) | | | +| stored_pages | [uint64](#uint64) | | | +| pool_limit_hit | [uint64](#uint64) | | | +| reject_reclaim_fail | [uint64](#uint64) | | | +| reject_alloc_fail | [uint64](#uint64) | | | +| reject_kmemcache_fail | [uint64](#uint64) | | | +| reject_compress_fail | [uint64](#uint64) | | | +| reject_compress_poor | [uint64](#uint64) | | | +| written_back_pages | [uint64](#uint64) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/cluster/cluster.proto + + + + + +### AffiliateSpec +AffiliateSpec describes Affiliate state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| node_id | [string](#string) | | | +| addresses | [common.NetIP](#common.NetIP) | repeated | | +| hostname | [string](#string) | | | +| nodename | [string](#string) | | | +| operating_system | [string](#string) | | | +| machine_type | [talos.resource.definitions.enums.MachineType](#talos.resource.definitions.enums.MachineType) | | | +| kube_span | [KubeSpanAffiliateSpec](#talos.resource.definitions.cluster.KubeSpanAffiliateSpec) | | | +| control_plane | [ControlPlane](#talos.resource.definitions.cluster.ControlPlane) | | | + + + + + + + + +### ConfigSpec +ConfigSpec describes KubeSpan configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| discovery_enabled | [bool](#bool) | | | +| registry_kubernetes_enabled | [bool](#bool) | | | +| registry_service_enabled | [bool](#bool) | | | +| service_endpoint | [string](#string) | | | +| service_endpoint_insecure | [bool](#bool) | | | +| service_encryption_key | [bytes](#bytes) | | | +| service_cluster_id | [string](#string) | | | + + + + + + + + +### ControlPlane +ControlPlane describes ControlPlane data if any. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| api_server_port | [int64](#int64) | | | + + + + + + + + +### IdentitySpec +IdentitySpec describes status of rendered secrets. + +Note: IdentitySpec is persisted on disk in the STATE partition, +so YAML serialization should be kept backwards compatible. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| node_id | [string](#string) | | | + + + + + + + + +### InfoSpec +InfoSpec describes cluster information. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| cluster_id | [string](#string) | | | +| cluster_name | [string](#string) | | | + + + + + + + + +### KubeSpanAffiliateSpec +KubeSpanAffiliateSpec describes additional information specific for the KubeSpan. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| public_key | [string](#string) | | | +| address | [common.NetIP](#common.NetIP) | | | +| additional_addresses | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| endpoints | [common.NetIPPort](#common.NetIPPort) | repeated | | + + + + + + + + +### MemberSpec +MemberSpec describes Member state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| node_id | [string](#string) | | | +| addresses | [common.NetIP](#common.NetIP) | repeated | | +| hostname | [string](#string) | | | +| machine_type | [talos.resource.definitions.enums.MachineType](#talos.resource.definitions.enums.MachineType) | | | +| operating_system | [string](#string) | | | +| control_plane | [ControlPlane](#talos.resource.definitions.cluster.ControlPlane) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/cri/cri.proto + + + + + +### ImageCacheConfigSpec +ImageCacheConfigSpec represents the ImageCacheConfig. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| status | [talos.resource.definitions.enums.CriImageCacheStatus](#talos.resource.definitions.enums.CriImageCacheStatus) | | | +| roots | [string](#string) | repeated | | +| copy_status | [talos.resource.definitions.enums.CriImageCacheCopyStatus](#talos.resource.definitions.enums.CriImageCacheCopyStatus) | | | + + + + + + + + +### RegistriesConfigSpec +RegistriesConfigSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| registry_mirrors | [RegistriesConfigSpec.RegistryMirrorsEntry](#talos.resource.definitions.cri.RegistriesConfigSpec.RegistryMirrorsEntry) | repeated | | +| registry_config | [RegistriesConfigSpec.RegistryConfigEntry](#talos.resource.definitions.cri.RegistriesConfigSpec.RegistryConfigEntry) | repeated | | + + + + + + + + +### RegistriesConfigSpec.RegistryConfigEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [RegistryConfig](#talos.resource.definitions.cri.RegistryConfig) | | | + + + + + + + + +### RegistriesConfigSpec.RegistryMirrorsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [RegistryMirrorConfig](#talos.resource.definitions.cri.RegistryMirrorConfig) | | | + + + + + + + + +### RegistryAuthConfig +RegistryAuthConfig specifies authentication configuration for a registry. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| registry_username | [string](#string) | | | +| registry_password | [string](#string) | | | +| registry_auth | [string](#string) | | | +| registry_identity_token | [string](#string) | | | + + + + + + + + +### RegistryConfig +RegistryConfig specifies auth & TLS config per registry. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| registry_tls | [RegistryTLSConfig](#talos.resource.definitions.cri.RegistryTLSConfig) | | | +| registry_auth | [RegistryAuthConfig](#talos.resource.definitions.cri.RegistryAuthConfig) | | | + + + + + + + + +### RegistryEndpointConfig +RegistryEndpointConfig represents a single registry endpoint. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint_endpoint | [string](#string) | | | +| endpoint_override_path | [bool](#bool) | | | + + + + + + + + +### RegistryMirrorConfig +RegistryMirrorConfig represents mirror configuration for a registry. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mirror_endpoints | [RegistryEndpointConfig](#talos.resource.definitions.cri.RegistryEndpointConfig) | repeated | | +| mirror_skip_fallback | [bool](#bool) | | | + + + + + + + + +### RegistryTLSConfig +RegistryTLSConfig specifies TLS config for HTTPS registries. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| tls_client_identity | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| tlsca | [bytes](#bytes) | | | +| tls_insecure_skip_verify | [bool](#bool) | | | + + + + + + + + +### SeccompProfileSpec +SeccompProfileSpec represents the SeccompProfile. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| value | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/enums/enums.proto + + + + + + + +### BlockEncryptionKeyType +BlockEncryptionKeyType describes encryption key type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ENCRYPTION_KEY_STATIC | 0 | | +| ENCRYPTION_KEY_NODE_ID | 1 | | +| ENCRYPTION_KEY_KMS | 2 | | +| ENCRYPTION_KEY_TPM | 3 | | + + + + + +### BlockEncryptionProviderType +BlockEncryptionProviderType describes encryption provider type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ENCRYPTION_PROVIDER_NONE | 0 | | +| ENCRYPTION_PROVIDER_LUKS2 | 1 | | + + + + + +### BlockFilesystemType +BlockFilesystemType describes filesystem type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| FILESYSTEM_TYPE_NONE | 0 | | +| FILESYSTEM_TYPE_XFS | 1 | | +| FILESYSTEM_TYPE_VFAT | 2 | | +| FILESYSTEM_TYPE_EXT4 | 3 | | +| FILESYSTEM_TYPE_ISO9660 | 4 | | +| FILESYSTEM_TYPE_SWAP | 5 | | + + + + + +### BlockVolumePhase +BlockVolumePhase describes volume phase. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| VOLUME_PHASE_WAITING | 0 | | +| VOLUME_PHASE_FAILED | 1 | | +| VOLUME_PHASE_MISSING | 2 | | +| VOLUME_PHASE_LOCATED | 3 | | +| VOLUME_PHASE_PROVISIONED | 4 | | +| VOLUME_PHASE_PREPARED | 5 | | +| VOLUME_PHASE_READY | 6 | | +| VOLUME_PHASE_CLOSED | 7 | | + + + + + +### BlockVolumeType +BlockVolumeType describes volume type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| VOLUME_TYPE_PARTITION | 0 | | +| VOLUME_TYPE_DISK | 1 | | +| VOLUME_TYPE_TMPFS | 2 | | +| VOLUME_TYPE_DIRECTORY | 3 | | +| VOLUME_TYPE_SYMLINK | 4 | | +| VOLUME_TYPE_OVERLAY | 5 | | + + + + + +### CriImageCacheCopyStatus +CriImageCacheCopyStatus describes image cache copy status type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| IMAGE_CACHE_COPY_STATUS_UNKNOWN | 0 | | +| IMAGE_CACHE_COPY_STATUS_SKIPPED | 1 | | +| IMAGE_CACHE_COPY_STATUS_PENDING | 2 | | +| IMAGE_CACHE_COPY_STATUS_READY | 3 | | + + + + + +### CriImageCacheStatus +CriImageCacheStatus describes image cache status type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| IMAGE_CACHE_STATUS_UNKNOWN | 0 | | +| IMAGE_CACHE_STATUS_DISABLED | 1 | | +| IMAGE_CACHE_STATUS_PREPARING | 2 | | +| IMAGE_CACHE_STATUS_READY | 3 | | + + + + + +### KubespanPeerState +KubespanPeerState is KubeSpan peer current state. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| PEER_STATE_UNKNOWN | 0 | | +| PEER_STATE_UP | 1 | | +| PEER_STATE_DOWN | 2 | | + + + + + +### MachineType +MachineType represents a machine type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TYPE_UNKNOWN | 0 | TypeUnknown represents undefined node type, when there is no machine configuration yet. | +| TYPE_INIT | 1 | TypeInit type designates the first control plane node to come up. You can think of it like a bootstrap node. This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. | +| TYPE_CONTROL_PLANE | 2 | TypeControlPlane designates the node as a control plane member. This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler. | +| TYPE_WORKER | 3 | TypeWorker designates the node as a worker node. This means it will be an available compute node for scheduling workloads. | + + + + + +### NethelpersADSelect +NethelpersADSelect is ADSelect. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| AD_SELECT_STABLE | 0 | | +| AD_SELECT_BANDWIDTH | 1 | | +| AD_SELECT_COUNT | 2 | | + + + + + +### NethelpersARPAllTargets +NethelpersARPAllTargets is an ARP targets mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ARP_ALL_TARGETS_ANY | 0 | | +| ARP_ALL_TARGETS_ALL | 1 | | + + + + + +### NethelpersARPValidate +NethelpersARPValidate is an ARP Validation mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ARP_VALIDATE_NONE | 0 | | +| ARP_VALIDATE_ACTIVE | 1 | | +| ARP_VALIDATE_BACKUP | 2 | | +| ARP_VALIDATE_ALL | 3 | | + + + + + +### NethelpersAddressFlag +NethelpersAddressFlag wraps IFF_* constants. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_ADDRESSFLAG_UNSPECIFIED | 0 | | +| ADDRESS_TEMPORARY | 1 | | +| ADDRESS_NO_DAD | 2 | | +| ADDRESS_OPTIMISTIC | 4 | | +| ADDRESS_DAD_FAILED | 8 | | +| ADDRESS_HOME | 16 | | +| ADDRESS_DEPRECATED | 32 | | +| ADDRESS_TENTATIVE | 64 | | +| ADDRESS_PERMANENT | 128 | | +| ADDRESS_MANAGEMENT_TEMP | 256 | | +| ADDRESS_NO_PREFIX_ROUTE | 512 | | +| ADDRESS_MC_AUTO_JOIN | 1024 | | +| ADDRESS_STABLE_PRIVACY | 2048 | | + + + + + +### NethelpersAddressSortAlgorithm +NethelpersAddressSortAlgorithm is an internal address sorting algorithm. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ADDRESS_SORT_ALGORITHM_V1 | 0 | | +| ADDRESS_SORT_ALGORITHM_V2 | 1 | | + + + + + +### NethelpersBondMode +NethelpersBondMode is a bond mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| BOND_MODE_ROUNDROBIN | 0 | | +| BOND_MODE_ACTIVE_BACKUP | 1 | | +| BOND_MODE_XOR | 2 | | +| BOND_MODE_BROADCAST | 3 | | +| BOND_MODE8023_AD | 4 | | +| BOND_MODE_TLB | 5 | | +| BOND_MODE_ALB | 6 | | + + + + + +### NethelpersBondXmitHashPolicy +NethelpersBondXmitHashPolicy is a bond hash policy. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| BOND_XMIT_POLICY_LAYER2 | 0 | | +| BOND_XMIT_POLICY_LAYER34 | 1 | | +| BOND_XMIT_POLICY_LAYER23 | 2 | | +| BOND_XMIT_POLICY_ENCAP23 | 3 | | +| BOND_XMIT_POLICY_ENCAP34 | 4 | | + + + + + +### NethelpersConntrackState +NethelpersConntrackState is a conntrack state. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_CONNTRACKSTATE_UNSPECIFIED | 0 | | +| CONNTRACK_STATE_NEW | 8 | | +| CONNTRACK_STATE_RELATED | 4 | | +| CONNTRACK_STATE_ESTABLISHED | 2 | | +| CONNTRACK_STATE_INVALID | 1 | | + + + + + +### NethelpersDuplex +NethelpersDuplex wraps ethtool.Duplex for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| HALF | 0 | | +| FULL | 1 | | +| UNKNOWN | 255 | | + + + + + +### NethelpersFailOverMAC +NethelpersFailOverMAC is a MAC failover mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| FAIL_OVER_MAC_NONE | 0 | | +| FAIL_OVER_MAC_ACTIVE | 1 | | +| FAIL_OVER_MAC_FOLLOW | 2 | | + + + + + +### NethelpersFamily +NethelpersFamily is a network family. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_FAMILY_UNSPECIFIED | 0 | | +| FAMILY_INET4 | 2 | | +| FAMILY_INET6 | 10 | | + + + + + +### NethelpersLACPRate +NethelpersLACPRate is a LACP rate. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| LACP_RATE_SLOW | 0 | | +| LACP_RATE_FAST | 1 | | + + + + + +### NethelpersLinkType +NethelpersLinkType is a link type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| LINK_NETROM | 0 | | +| LINK_ETHER | 1 | | +| LINK_EETHER | 2 | | +| LINK_AX25 | 3 | | +| LINK_PRONET | 4 | | +| LINK_CHAOS | 5 | | +| LINK_IEE802 | 6 | | +| LINK_ARCNET | 7 | | +| LINK_ATALK | 8 | | +| LINK_DLCI | 15 | | +| LINK_ATM | 19 | | +| LINK_METRICOM | 23 | | +| LINK_IEEE1394 | 24 | | +| LINK_EUI64 | 27 | | +| LINK_INFINIBAND | 32 | | +| LINK_SLIP | 256 | | +| LINK_CSLIP | 257 | | +| LINK_SLIP6 | 258 | | +| LINK_CSLIP6 | 259 | | +| LINK_RSRVD | 260 | | +| LINK_ADAPT | 264 | | +| LINK_ROSE | 270 | | +| LINK_X25 | 271 | | +| LINK_HWX25 | 272 | | +| LINK_CAN | 280 | | +| LINK_PPP | 512 | | +| LINK_CISCO | 513 | | +| LINK_HDLC | 513 | | +| LINK_LAPB | 516 | | +| LINK_DDCMP | 517 | | +| LINK_RAWHDLC | 518 | | +| LINK_TUNNEL | 768 | | +| LINK_TUNNEL6 | 769 | | +| LINK_FRAD | 770 | | +| LINK_SKIP | 771 | | +| LINK_LOOPBCK | 772 | | +| LINK_LOCALTLK | 773 | | +| LINK_FDDI | 774 | | +| LINK_BIF | 775 | | +| LINK_SIT | 776 | | +| LINK_IPDDP | 777 | | +| LINK_IPGRE | 778 | | +| LINK_PIMREG | 779 | | +| LINK_HIPPI | 780 | | +| LINK_ASH | 781 | | +| LINK_ECONET | 782 | | +| LINK_IRDA | 783 | | +| LINK_FCPP | 784 | | +| LINK_FCAL | 785 | | +| LINK_FCPL | 786 | | +| LINK_FCFABRIC | 787 | | +| LINK_FCFABRIC1 | 788 | | +| LINK_FCFABRIC2 | 789 | | +| LINK_FCFABRIC3 | 790 | | +| LINK_FCFABRIC4 | 791 | | +| LINK_FCFABRIC5 | 792 | | +| LINK_FCFABRIC6 | 793 | | +| LINK_FCFABRIC7 | 794 | | +| LINK_FCFABRIC8 | 795 | | +| LINK_FCFABRIC9 | 796 | | +| LINK_FCFABRIC10 | 797 | | +| LINK_FCFABRIC11 | 798 | | +| LINK_FCFABRIC12 | 799 | | +| LINK_IEE802TR | 800 | | +| LINK_IEE80211 | 801 | | +| LINK_IEE80211PRISM | 802 | | +| LINK_IEE80211_RADIOTAP | 803 | | +| LINK_IEE8021154 | 804 | | +| LINK_IEE8021154MONITOR | 805 | | +| LINK_PHONET | 820 | | +| LINK_PHONETPIPE | 821 | | +| LINK_CAIF | 822 | | +| LINK_IP6GRE | 823 | | +| LINK_NETLINK | 824 | | +| LINK6_LOWPAN | 825 | | +| LINK_VOID | 65535 | | +| LINK_NONE | 65534 | | + + + + + +### NethelpersMatchOperator +NethelpersMatchOperator is a netfilter match operator. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OPERATOR_EQUAL | 0 | | +| OPERATOR_NOT_EQUAL | 1 | | + + + + + +### NethelpersNfTablesChainHook +NethelpersNfTablesChainHook wraps nftables.ChainHook for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| CHAIN_HOOK_PREROUTING | 0 | | +| CHAIN_HOOK_INPUT | 1 | | +| CHAIN_HOOK_FORWARD | 2 | | +| CHAIN_HOOK_OUTPUT | 3 | | +| CHAIN_HOOK_POSTROUTING | 4 | | + + + + + +### NethelpersNfTablesChainPriority +NethelpersNfTablesChainPriority wraps nftables.ChainPriority for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_NFTABLESCHAINPRIORITY_UNSPECIFIED | 0 | | +| CHAIN_PRIORITY_FIRST | -2147483648 | | +| CHAIN_PRIORITY_CONNTRACK_DEFRAG | -400 | | +| CHAIN_PRIORITY_RAW | -300 | | +| CHAIN_PRIORITY_SE_LINUX_FIRST | -225 | | +| CHAIN_PRIORITY_CONNTRACK | -200 | | +| CHAIN_PRIORITY_MANGLE | -150 | | +| CHAIN_PRIORITY_NAT_DEST | -100 | | +| CHAIN_PRIORITY_FILTER | 0 | | +| CHAIN_PRIORITY_SECURITY | 50 | | +| CHAIN_PRIORITY_NAT_SOURCE | 100 | | +| CHAIN_PRIORITY_SE_LINUX_LAST | 225 | | +| CHAIN_PRIORITY_CONNTRACK_HELPER | 300 | | +| CHAIN_PRIORITY_LAST | 2147483647 | | + + + + + +### NethelpersNfTablesVerdict +NethelpersNfTablesVerdict wraps nftables.Verdict for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| VERDICT_DROP | 0 | | +| VERDICT_ACCEPT | 1 | | + + + + + +### NethelpersOperationalState +NethelpersOperationalState wraps rtnetlink.OperationalState for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OPER_STATE_UNKNOWN | 0 | | +| OPER_STATE_NOT_PRESENT | 1 | | +| OPER_STATE_DOWN | 2 | | +| OPER_STATE_LOWER_LAYER_DOWN | 3 | | +| OPER_STATE_TESTING | 4 | | +| OPER_STATE_DORMANT | 5 | | +| OPER_STATE_UP | 6 | | + + + + + +### NethelpersPort +NethelpersPort wraps ethtool.Port for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TWISTED_PAIR | 0 | | +| AUI | 1 | | +| MII | 2 | | +| FIBRE | 3 | | +| BNC | 4 | | +| DIRECT_ATTACH | 5 | | +| NONE | 239 | | +| OTHER | 255 | | + + + + + +### NethelpersPrimaryReselect +NethelpersPrimaryReselect is an ARP targets mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| PRIMARY_RESELECT_ALWAYS | 0 | | +| PRIMARY_RESELECT_BETTER | 1 | | +| PRIMARY_RESELECT_FAILURE | 2 | | + + + + + +### NethelpersProtocol +NethelpersProtocol is a inet protocol. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_PROTOCOL_UNSPECIFIED | 0 | | +| PROTOCOL_ICMP | 1 | | +| PROTOCOL_TCP | 6 | | +| PROTOCOL_UDP | 17 | | +| PROTOCOL_ICM_PV6 | 58 | | + + + + + +### NethelpersRouteFlag +NethelpersRouteFlag wraps RTM_F_* constants. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_ROUTEFLAG_UNSPECIFIED | 0 | | +| ROUTE_NOTIFY | 256 | | +| ROUTE_CLONED | 512 | | +| ROUTE_EQUALIZE | 1024 | | +| ROUTE_PREFIX | 2048 | | +| ROUTE_LOOKUP_TABLE | 4096 | | +| ROUTE_FIB_MATCH | 8192 | | +| ROUTE_OFFLOAD | 16384 | | +| ROUTE_TRAP | 32768 | | + + + + + +### NethelpersRouteProtocol +NethelpersRouteProtocol is a routing protocol. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| PROTOCOL_UNSPEC | 0 | | +| PROTOCOL_REDIRECT | 1 | | +| PROTOCOL_KERNEL | 2 | | +| PROTOCOL_BOOT | 3 | | +| PROTOCOL_STATIC | 4 | | +| PROTOCOL_RA | 9 | | +| PROTOCOL_MRT | 10 | | +| PROTOCOL_ZEBRA | 11 | | +| PROTOCOL_BIRD | 12 | | +| PROTOCOL_DNROUTED | 13 | | +| PROTOCOL_XORP | 14 | | +| PROTOCOL_NTK | 15 | | +| PROTOCOL_DHCP | 16 | | +| PROTOCOL_MRTD | 17 | | +| PROTOCOL_KEEPALIVED | 18 | | +| PROTOCOL_BABEL | 42 | | +| PROTOCOL_OPENR | 99 | | +| PROTOCOL_BGP | 186 | | +| PROTOCOL_ISIS | 187 | | +| PROTOCOL_OSPF | 188 | | +| PROTOCOL_RIP | 189 | | +| PROTOCOL_EIGRP | 192 | | + + + + + +### NethelpersRouteType +NethelpersRouteType is a route type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TYPE_UNSPEC | 0 | | +| TYPE_UNICAST | 1 | | +| TYPE_LOCAL | 2 | | +| TYPE_BROADCAST | 3 | | +| TYPE_ANYCAST | 4 | | +| TYPE_MULTICAST | 5 | | +| TYPE_BLACKHOLE | 6 | | +| TYPE_UNREACHABLE | 7 | | +| TYPE_PROHIBIT | 8 | | +| TYPE_THROW | 9 | | +| TYPE_NAT | 10 | | +| TYPE_X_RESOLVE | 11 | | + + + + + +### NethelpersRoutingTable +NethelpersRoutingTable is a routing table ID. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TABLE_UNSPEC | 0 | | +| TABLE_DEFAULT | 253 | | +| TABLE_MAIN | 254 | | +| TABLE_LOCAL | 255 | | + + + + + +### NethelpersScope +NethelpersScope is an address scope. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| SCOPE_GLOBAL | 0 | | +| SCOPE_SITE | 200 | | +| SCOPE_LINK | 253 | | +| SCOPE_HOST | 254 | | +| SCOPE_NOWHERE | 255 | | + + + + + +### NethelpersVLANProtocol +NethelpersVLANProtocol is a VLAN protocol. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_VLANPROTOCOL_UNSPECIFIED | 0 | | +| VLAN_PROTOCOL8021_Q | 33024 | | +| VLAN_PROTOCOL8021_AD | 34984 | | + + + + + +### NetworkConfigLayer +NetworkConfigLayer describes network configuration layers, with lowest priority first. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| CONFIG_DEFAULT | 0 | | +| CONFIG_CMDLINE | 1 | | +| CONFIG_PLATFORM | 2 | | +| CONFIG_OPERATOR | 3 | | +| CONFIG_MACHINE_CONFIGURATION | 4 | | + + + + + +### NetworkOperator +NetworkOperator enumerates Talos network operators. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OPERATOR_DHCP4 | 0 | | +| OPERATOR_DHCP6 | 1 | | +| OPERATOR_VIP | 2 | | + + + + + +### RuntimeFIPSState +RuntimeFIPSState describes the current FIPS status. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| FIPS_STATE_DISABLED | 0 | | +| FIPS_STATE_ENABLED | 1 | | +| FIPS_STATE_STRICT | 2 | | + + + + + +### RuntimeMachineStage +RuntimeMachineStage describes the stage of the machine boot/run process. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| MACHINE_STAGE_UNKNOWN | 0 | | +| MACHINE_STAGE_BOOTING | 1 | | +| MACHINE_STAGE_INSTALLING | 2 | | +| MACHINE_STAGE_MAINTENANCE | 3 | | +| MACHINE_STAGE_RUNNING | 4 | | +| MACHINE_STAGE_REBOOTING | 5 | | +| MACHINE_STAGE_SHUTTING_DOWN | 6 | | +| MACHINE_STAGE_RESETTING | 7 | | +| MACHINE_STAGE_UPGRADING | 8 | | + + + + + +### RuntimeSELinuxState +RuntimeSELinuxState describes the current SELinux status. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| SE_LINUX_STATE_DISABLED | 0 | | +| SE_LINUX_STATE_PERMISSIVE | 1 | | +| SE_LINUX_STATE_ENFORCING | 2 | | + + + + + + + + + + + +

Top

+ +## resource/definitions/etcd/etcd.proto + + + + + +### ConfigSpec +ConfigSpec describes (some) configuration settings of etcd. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| advertise_valid_subnets | [string](#string) | repeated | | +| advertise_exclude_subnets | [string](#string) | repeated | | +| image | [string](#string) | | | +| extra_args | [ConfigSpec.ExtraArgsEntry](#talos.resource.definitions.etcd.ConfigSpec.ExtraArgsEntry) | repeated | | +| listen_valid_subnets | [string](#string) | repeated | | +| listen_exclude_subnets | [string](#string) | repeated | | + + + + + + + + +### ConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### MemberSpec +MemberSpec holds information about an etcd member. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member_id | [string](#string) | | | + + + + + + + + +### PKIStatusSpec +PKIStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| version | [string](#string) | | | + + + + + + + + +### SpecSpec +SpecSpec describes (some) Specuration settings of etcd. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| advertised_addresses | [common.NetIP](#common.NetIP) | repeated | | +| image | [string](#string) | | | +| extra_args | [SpecSpec.ExtraArgsEntry](#talos.resource.definitions.etcd.SpecSpec.ExtraArgsEntry) | repeated | | +| listen_peer_addresses | [common.NetIP](#common.NetIP) | repeated | | +| listen_client_addresses | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### SpecSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/extensions/extensions.proto + + + + + +### Compatibility +Compatibility describes extension compatibility. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| talos | [Constraint](#talos.resource.definitions.extensions.Constraint) | | | + + + + + + + + +### Constraint +Constraint describes compatibility constraint. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| version | [string](#string) | | | + + + + + + + + +### Layer +Layer defines overlay mount layer. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| metadata | [Metadata](#talos.resource.definitions.extensions.Metadata) | | | + + + + + + + + +### Metadata +Metadata describes base extension metadata. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| version | [string](#string) | | | +| author | [string](#string) | | | +| description | [string](#string) | | | +| compatibility | [Compatibility](#talos.resource.definitions.extensions.Compatibility) | | | +| extra_info | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/files/files.proto + + + + + +### EtcFileSpecSpec +EtcFileSpecSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| contents | [bytes](#bytes) | | | +| mode | [uint32](#uint32) | | | +| selinux_label | [string](#string) | | | + + + + + + + + +### EtcFileStatusSpec +EtcFileStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| spec_version | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/hardware/hardware.proto + + + + + +### MemoryModuleSpec +MemoryModuleSpec represents a single Memory. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| size | [uint32](#uint32) | | | +| device_locator | [string](#string) | | | +| bank_locator | [string](#string) | | | +| speed | [uint32](#uint32) | | | +| manufacturer | [string](#string) | | | +| serial_number | [string](#string) | | | +| asset_tag | [string](#string) | | | +| product_name | [string](#string) | | | + + + + + + + + +### PCIDeviceSpec +PCIDeviceSpec represents a single processor. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| class | [string](#string) | | | +| subclass | [string](#string) | | | +| vendor | [string](#string) | | | +| product | [string](#string) | | | +| class_id | [string](#string) | | | +| subclass_id | [string](#string) | | | +| vendor_id | [string](#string) | | | +| product_id | [string](#string) | | | +| driver | [string](#string) | | | + + + + + + + + +### PCIDriverRebindConfigSpec +PCIDriverRebindConfigSpec describes PCI rebind configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pciid | [string](#string) | | | +| target_driver | [string](#string) | | | + + + + + + + + +### PCIDriverRebindStatusSpec +PCIDriverRebindStatusSpec describes status of rebinded drivers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pciid | [string](#string) | | | +| target_driver | [string](#string) | | | + + + + + + + + +### ProcessorSpec +ProcessorSpec represents a single processor. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| socket | [string](#string) | | | +| manufacturer | [string](#string) | | | +| product_name | [string](#string) | | | +| max_speed | [uint32](#uint32) | | | +| boot_speed | [uint32](#uint32) | | | +| status | [uint32](#uint32) | | | +| serial_number | [string](#string) | | | +| asset_tag | [string](#string) | | | +| part_number | [string](#string) | | | +| core_count | [uint32](#uint32) | | | +| core_enabled | [uint32](#uint32) | | | +| thread_count | [uint32](#uint32) | | | + + + + + + + + +### SystemInformationSpec +SystemInformationSpec represents the system information obtained from smbios. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| manufacturer | [string](#string) | | | +| product_name | [string](#string) | | | +| version | [string](#string) | | | +| serial_number | [string](#string) | | | +| uuid | [string](#string) | | | +| wake_up_type | [string](#string) | | | +| sku_number | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/k8s/k8s.proto + + + + + +### APIServerConfigSpec +APIServerConfigSpec is configuration for kube-apiserver. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| cloud_provider | [string](#string) | | | +| control_plane_endpoint | [string](#string) | | | +| etcd_servers | [string](#string) | repeated | | +| local_port | [int64](#int64) | | | +| service_cid_rs | [string](#string) | repeated | | +| extra_args | [APIServerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.APIServerConfigSpec.ExtraArgsEntry) | repeated | | +| extra_volumes | [ExtraVolume](#talos.resource.definitions.k8s.ExtraVolume) | repeated | | +| environment_variables | [APIServerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.APIServerConfigSpec.EnvironmentVariablesEntry) | repeated | | +| pod_security_policy_enabled | [bool](#bool) | | | +| advertised_address | [string](#string) | | | +| resources | [Resources](#talos.resource.definitions.k8s.Resources) | | | + + + + + + + + +### APIServerConfigSpec.EnvironmentVariablesEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### APIServerConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### AdmissionControlConfigSpec +AdmissionControlConfigSpec is configuration for kube-apiserver. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| config | [AdmissionPluginSpec](#talos.resource.definitions.k8s.AdmissionPluginSpec) | repeated | | + + + + + + + + +### AdmissionPluginSpec +AdmissionPluginSpec is a single admission plugin configuration Admission Control plugins. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| configuration | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### AuditPolicyConfigSpec +AuditPolicyConfigSpec is audit policy configuration for kube-apiserver. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| config | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### AuthorizationAuthorizersSpec +AuthorizationAuthorizersSpec is a configuration of authorization authorizers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| type | [string](#string) | | | +| name | [string](#string) | | | +| webhook | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### AuthorizationConfigSpec +AuthorizationConfigSpec is authorization configuration for kube-apiserver. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| config | [AuthorizationAuthorizersSpec](#talos.resource.definitions.k8s.AuthorizationAuthorizersSpec) | repeated | | + + + + + + + + +### BootstrapManifestsConfigSpec +BootstrapManifestsConfigSpec is configuration for bootstrap manifests. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| server | [string](#string) | | | +| cluster_domain | [string](#string) | | | +| pod_cid_rs | [string](#string) | repeated | | +| proxy_enabled | [bool](#bool) | | | +| proxy_image | [string](#string) | | | +| proxy_args | [string](#string) | repeated | | +| core_dns_enabled | [bool](#bool) | | | +| core_dns_image | [string](#string) | | | +| dns_service_ip | [string](#string) | | | +| dns_service_i_pv6 | [string](#string) | | | +| flannel_enabled | [bool](#bool) | | | +| flannel_image | [string](#string) | | | +| pod_security_policy_enabled | [bool](#bool) | | | +| talos_api_service_enabled | [bool](#bool) | | | +| flannel_extra_args | [string](#string) | repeated | | +| flannel_kube_service_host | [string](#string) | | | +| flannel_kube_service_port | [string](#string) | | | + + + + + + + + +### ConfigStatusSpec +ConfigStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| version | [string](#string) | | | + + + + + + + + +### ControllerManagerConfigSpec +ControllerManagerConfigSpec is configuration for kube-controller-manager. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| image | [string](#string) | | | +| cloud_provider | [string](#string) | | | +| pod_cid_rs | [string](#string) | repeated | | +| service_cid_rs | [string](#string) | repeated | | +| extra_args | [ControllerManagerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.ControllerManagerConfigSpec.ExtraArgsEntry) | repeated | | +| extra_volumes | [ExtraVolume](#talos.resource.definitions.k8s.ExtraVolume) | repeated | | +| environment_variables | [ControllerManagerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.ControllerManagerConfigSpec.EnvironmentVariablesEntry) | repeated | | +| resources | [Resources](#talos.resource.definitions.k8s.Resources) | | | + + + + + + + + +### ControllerManagerConfigSpec.EnvironmentVariablesEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### ControllerManagerConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### EndpointSpec +EndpointSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| addresses | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### ExtraManifest +ExtraManifest defines a single extra manifest to download. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| url | [string](#string) | | | +| priority | [string](#string) | | | +| extra_headers | [ExtraManifest.ExtraHeadersEntry](#talos.resource.definitions.k8s.ExtraManifest.ExtraHeadersEntry) | repeated | | +| inline_manifest | [string](#string) | | | + + + + + + + + +### ExtraManifest.ExtraHeadersEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### ExtraManifestsConfigSpec +ExtraManifestsConfigSpec is configuration for extra bootstrap manifests. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| extra_manifests | [ExtraManifest](#talos.resource.definitions.k8s.ExtraManifest) | repeated | | + + + + + + + + +### ExtraVolume +ExtraVolume is a configuration of extra volume. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| host_path | [string](#string) | | | +| mount_path | [string](#string) | | | +| read_only | [bool](#bool) | | | + + + + + + + + +### KubePrismConfigSpec +KubePrismConfigSpec describes KubePrismConfig data. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| host | [string](#string) | | | +| port | [int64](#int64) | | | +| endpoints | [KubePrismEndpoint](#talos.resource.definitions.k8s.KubePrismEndpoint) | repeated | | + + + + + + + + +### KubePrismEndpoint +KubePrismEndpoint holds data for control plane endpoint. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| host | [string](#string) | | | +| port | [uint32](#uint32) | | | + + + + + + + + +### KubePrismEndpointsSpec +KubePrismEndpointsSpec describes KubePrismEndpoints configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoints | [KubePrismEndpoint](#talos.resource.definitions.k8s.KubePrismEndpoint) | repeated | | + + + + + + + + +### KubePrismStatusesSpec +KubePrismStatusesSpec describes KubePrismStatuses data. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| host | [string](#string) | | | +| healthy | [bool](#bool) | | | + + + + + + + + +### KubeletConfigSpec +KubeletConfigSpec holds the source of kubelet configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| cluster_dns | [string](#string) | repeated | | +| cluster_domain | [string](#string) | | | +| extra_args | [KubeletConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.KubeletConfigSpec.ExtraArgsEntry) | repeated | | +| extra_mounts | [talos.resource.definitions.proto.Mount](#talos.resource.definitions.proto.Mount) | repeated | | +| extra_config | [google.protobuf.Struct](#google.protobuf.Struct) | | | +| cloud_provider_external | [bool](#bool) | | | +| default_runtime_seccomp_enabled | [bool](#bool) | | | +| skip_node_registration | [bool](#bool) | | | +| static_pod_list_url | [string](#string) | | | +| disable_manifests_directory | [bool](#bool) | | | +| enable_fs_quota_monitoring | [bool](#bool) | | | +| credential_provider_config | [google.protobuf.Struct](#google.protobuf.Struct) | | | +| allow_scheduling_on_control_plane | [bool](#bool) | | | + + + + + + + + +### KubeletConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### KubeletSpecSpec +KubeletSpecSpec holds the source of kubelet configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| args | [string](#string) | repeated | | +| extra_mounts | [talos.resource.definitions.proto.Mount](#talos.resource.definitions.proto.Mount) | repeated | | +| expected_nodename | [string](#string) | | | +| config | [google.protobuf.Struct](#google.protobuf.Struct) | | | +| credential_provider_config | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### ManifestSpec +ManifestSpec holds the Kubernetes resources spec. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| items | [SingleManifest](#talos.resource.definitions.k8s.SingleManifest) | repeated | | + + + + + + + + +### ManifestStatusSpec +ManifestStatusSpec describes manifest application status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| manifests_applied | [string](#string) | repeated | | + + + + + + + + +### NodeAnnotationSpecSpec +NodeAnnotationSpecSpec represents an annoation that's attached to a Talos node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodeIPConfigSpec +NodeIPConfigSpec holds the Node IP specification. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| valid_subnets | [string](#string) | repeated | | +| exclude_subnets | [string](#string) | repeated | | + + + + + + + + +### NodeIPSpec +NodeIPSpec holds the Node IP specification. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| addresses | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### NodeLabelSpecSpec +NodeLabelSpecSpec represents a label that's attached to a Talos node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodeStatusSpec +NodeStatusSpec describes Kubernetes NodeStatus. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| nodename | [string](#string) | | | +| node_ready | [bool](#bool) | | | +| unschedulable | [bool](#bool) | | | +| labels | [NodeStatusSpec.LabelsEntry](#talos.resource.definitions.k8s.NodeStatusSpec.LabelsEntry) | repeated | | +| annotations | [NodeStatusSpec.AnnotationsEntry](#talos.resource.definitions.k8s.NodeStatusSpec.AnnotationsEntry) | repeated | | + + + + + + + + +### NodeStatusSpec.AnnotationsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodeStatusSpec.LabelsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodeTaintSpecSpec +NodeTaintSpecSpec represents a label that's attached to a Talos node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| effect | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodenameSpec +NodenameSpec describes Kubernetes nodename. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| nodename | [string](#string) | | | +| hostname_version | [string](#string) | | | +| skip_node_registration | [bool](#bool) | | | + + + + + + + + +### Resources +Resources is a configuration of cpu and memory resources. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| requests | [Resources.RequestsEntry](#talos.resource.definitions.k8s.Resources.RequestsEntry) | repeated | | +| limits | [Resources.LimitsEntry](#talos.resource.definitions.k8s.Resources.LimitsEntry) | repeated | | + + + + + + + + +### Resources.LimitsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### Resources.RequestsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### SchedulerConfigSpec +SchedulerConfigSpec is configuration for kube-scheduler. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| image | [string](#string) | | | +| extra_args | [SchedulerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.SchedulerConfigSpec.ExtraArgsEntry) | repeated | | +| extra_volumes | [ExtraVolume](#talos.resource.definitions.k8s.ExtraVolume) | repeated | | +| environment_variables | [SchedulerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.SchedulerConfigSpec.EnvironmentVariablesEntry) | repeated | | +| resources | [Resources](#talos.resource.definitions.k8s.Resources) | | | +| config | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### SchedulerConfigSpec.EnvironmentVariablesEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### SchedulerConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### SecretsStatusSpec +SecretsStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| version | [string](#string) | | | + + + + + + + + +### SingleManifest +SingleManifest is a single manifest. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| object | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### StaticPodServerStatusSpec +StaticPodServerStatusSpec describes static pod spec, it contains marshaled *v1.Pod spec. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| url | [string](#string) | | | + + + + + + + + +### StaticPodSpec +StaticPodSpec describes static pod spec, it contains marshaled *v1.Pod spec. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pod | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### StaticPodStatusSpec +StaticPodStatusSpec describes kubelet static pod status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pod_status | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/kubeaccess/kubeaccess.proto + + + + + +### ConfigSpec +ConfigSpec describes KubeSpan configuration.. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| allowed_api_roles | [string](#string) | repeated | | +| allowed_kubernetes_namespaces | [string](#string) | repeated | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/kubespan/kubespan.proto + + + + + +### ConfigSpec +ConfigSpec describes KubeSpan configuration.. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| cluster_id | [string](#string) | | | +| shared_secret | [string](#string) | | | +| force_routing | [bool](#bool) | | | +| advertise_kubernetes_networks | [bool](#bool) | | | +| mtu | [uint32](#uint32) | | | +| endpoint_filters | [string](#string) | repeated | | +| harvest_extra_endpoints | [bool](#bool) | | | +| extra_endpoints | [common.NetIPPort](#common.NetIPPort) | repeated | | + + + + + + + + +### EndpointSpec +EndpointSpec describes Endpoint state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| affiliate_id | [string](#string) | | | +| endpoint | [common.NetIPPort](#common.NetIPPort) | | | + + + + + + + + +### IdentitySpec +IdentitySpec describes KubeSpan keys and address. + +Note: IdentitySpec is persisted on disk in the STATE partition, +so YAML serialization should be kept backwards compatible. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| subnet | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| private_key | [string](#string) | | | +| public_key | [string](#string) | | | + + + + + + + + +### PeerSpecSpec +PeerSpecSpec describes PeerSpec state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address | [common.NetIP](#common.NetIP) | | | +| allowed_ips | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| endpoints | [common.NetIPPort](#common.NetIPPort) | repeated | | +| label | [string](#string) | | | + + + + + + + + +### PeerStatusSpec +PeerStatusSpec describes PeerStatus state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [common.NetIPPort](#common.NetIPPort) | | | +| label | [string](#string) | | | +| state | [talos.resource.definitions.enums.KubespanPeerState](#talos.resource.definitions.enums.KubespanPeerState) | | | +| receive_bytes | [int64](#int64) | | | +| transmit_bytes | [int64](#int64) | | | +| last_handshake_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | +| last_used_endpoint | [common.NetIPPort](#common.NetIPPort) | | | +| last_endpoint_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/network/network.proto + + + + + +### AddressSpecSpec +AddressSpecSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| link_name | [string](#string) | | | +| family | [talos.resource.definitions.enums.NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) | | | +| scope | [talos.resource.definitions.enums.NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) | | | +| flags | [uint32](#uint32) | | | +| announce_with_arp | [bool](#bool) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | +| priority | [uint32](#uint32) | | | + + + + + + + + +### AddressStatusSpec +AddressStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| local | [common.NetIP](#common.NetIP) | | | +| broadcast | [common.NetIP](#common.NetIP) | | | +| anycast | [common.NetIP](#common.NetIP) | | | +| multicast | [common.NetIP](#common.NetIP) | | | +| link_index | [uint32](#uint32) | | | +| link_name | [string](#string) | | | +| family | [talos.resource.definitions.enums.NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) | | | +| scope | [talos.resource.definitions.enums.NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) | | | +| flags | [uint32](#uint32) | | | +| priority | [uint32](#uint32) | | | + + + + + + + + +### BondMasterSpec +BondMasterSpec describes bond settings if Kind == "bond". + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mode | [talos.resource.definitions.enums.NethelpersBondMode](#talos.resource.definitions.enums.NethelpersBondMode) | | | +| hash_policy | [talos.resource.definitions.enums.NethelpersBondXmitHashPolicy](#talos.resource.definitions.enums.NethelpersBondXmitHashPolicy) | | | +| lacp_rate | [talos.resource.definitions.enums.NethelpersLACPRate](#talos.resource.definitions.enums.NethelpersLACPRate) | | | +| arp_validate | [talos.resource.definitions.enums.NethelpersARPValidate](#talos.resource.definitions.enums.NethelpersARPValidate) | | | +| arp_all_targets | [talos.resource.definitions.enums.NethelpersARPAllTargets](#talos.resource.definitions.enums.NethelpersARPAllTargets) | | | +| primary_index | [uint32](#uint32) | | | +| primary_reselect | [talos.resource.definitions.enums.NethelpersPrimaryReselect](#talos.resource.definitions.enums.NethelpersPrimaryReselect) | | | +| fail_over_mac | [talos.resource.definitions.enums.NethelpersFailOverMAC](#talos.resource.definitions.enums.NethelpersFailOverMAC) | | | +| ad_select | [talos.resource.definitions.enums.NethelpersADSelect](#talos.resource.definitions.enums.NethelpersADSelect) | | | +| mii_mon | [uint32](#uint32) | | | +| up_delay | [uint32](#uint32) | | | +| down_delay | [uint32](#uint32) | | | +| arp_interval | [uint32](#uint32) | | | +| resend_igmp | [uint32](#uint32) | | | +| min_links | [uint32](#uint32) | | | +| lp_interval | [uint32](#uint32) | | | +| packets_per_slave | [uint32](#uint32) | | | +| num_peer_notif | [fixed32](#fixed32) | | | +| tlb_dynamic_lb | [fixed32](#fixed32) | | | +| all_slaves_active | [fixed32](#fixed32) | | | +| use_carrier | [bool](#bool) | | | +| ad_actor_sys_prio | [fixed32](#fixed32) | | | +| ad_user_port_key | [fixed32](#fixed32) | | | +| peer_notify_delay | [uint32](#uint32) | | | + + + + + + + + +### BondSlave +BondSlave contains a bond's master name and slave index. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| master_name | [string](#string) | | | +| slave_index | [int64](#int64) | | | + + + + + + + + +### BridgeMasterSpec +BridgeMasterSpec describes bridge settings if Kind == "bridge". + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| stp | [STPSpec](#talos.resource.definitions.network.STPSpec) | | | +| vlan | [BridgeVLANSpec](#talos.resource.definitions.network.BridgeVLANSpec) | | | + + + + + + + + +### BridgeSlave +BridgeSlave contains the name of the master bridge of a bridged interface + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| master_name | [string](#string) | | | + + + + + + + + +### BridgeVLANSpec +BridgeVLANSpec describes VLAN settings of a bridge. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| filtering_enabled | [bool](#bool) | | | + + + + + + + + +### DHCP4OperatorSpec +DHCP4OperatorSpec describes DHCP4 operator options. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| route_metric | [uint32](#uint32) | | | +| skip_hostname_request | [bool](#bool) | | | + + + + + + + + +### DHCP6OperatorSpec +DHCP6OperatorSpec describes DHCP6 operator options. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| duid | [string](#string) | | | +| route_metric | [uint32](#uint32) | | | +| skip_hostname_request | [bool](#bool) | | | + + + + + + + + +### DNSResolveCacheSpec +DNSResolveCacheSpec describes DNS servers status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| status | [string](#string) | | | + + + + + + + + +### EthernetChannelsSpec +EthernetChannelsSpec describes config of Ethernet channels. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| rx | [uint32](#uint32) | | | +| tx | [uint32](#uint32) | | | +| other | [uint32](#uint32) | | | +| combined | [uint32](#uint32) | | | + + + + + + + + +### EthernetChannelsStatus +EthernetChannelsStatus describes status of Ethernet channels. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| rx_max | [uint32](#uint32) | | | +| tx_max | [uint32](#uint32) | | | +| other_max | [uint32](#uint32) | | | +| combined_max | [uint32](#uint32) | | | +| rx | [uint32](#uint32) | | | +| tx | [uint32](#uint32) | | | +| other | [uint32](#uint32) | | | +| combined | [uint32](#uint32) | | | + + + + + + + + +### EthernetFeatureStatus +EthernetFeatureStatus describes status of Ethernet features. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| status | [string](#string) | | | + + + + + + + + +### EthernetRingsSpec +EthernetRingsSpec describes config of Ethernet rings. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| rx | [uint32](#uint32) | | | +| rx_mini | [uint32](#uint32) | | | +| rx_jumbo | [uint32](#uint32) | | | +| tx | [uint32](#uint32) | | | +| rx_buf_len | [uint32](#uint32) | | | +| cqe_size | [uint32](#uint32) | | | +| tx_push | [bool](#bool) | | | +| rx_push | [bool](#bool) | | | +| tx_push_buf_len | [uint32](#uint32) | | | +| tcp_data_split | [bool](#bool) | | | + + + + + + + + +### EthernetRingsStatus +EthernetRingsStatus describes status of Ethernet rings. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| rx_max | [uint32](#uint32) | | | +| rx_mini_max | [uint32](#uint32) | | | +| rx_jumbo_max | [uint32](#uint32) | | | +| tx_max | [uint32](#uint32) | | | +| tx_push_buf_len_max | [uint32](#uint32) | | | +| rx | [uint32](#uint32) | | | +| rx_mini | [uint32](#uint32) | | | +| rx_jumbo | [uint32](#uint32) | | | +| tx | [uint32](#uint32) | | | +| rx_buf_len | [uint32](#uint32) | | | +| cqe_size | [uint32](#uint32) | | | +| tx_push | [bool](#bool) | | | +| rx_push | [bool](#bool) | | | +| tx_push_buf_len | [uint32](#uint32) | | | +| tcp_data_split | [bool](#bool) | | | + + + + + + + + +### EthernetSpecSpec +EthernetSpecSpec describes config of Ethernet link. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| rings | [EthernetRingsSpec](#talos.resource.definitions.network.EthernetRingsSpec) | | | +| features | [EthernetSpecSpec.FeaturesEntry](#talos.resource.definitions.network.EthernetSpecSpec.FeaturesEntry) | repeated | | +| channels | [EthernetChannelsSpec](#talos.resource.definitions.network.EthernetChannelsSpec) | | | + + + + + + + + +### EthernetSpecSpec.FeaturesEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [bool](#bool) | | | + + + + + + + + +### EthernetStatusSpec +EthernetStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| link_state | [bool](#bool) | | | +| speed_megabits | [int64](#int64) | | | +| port | [talos.resource.definitions.enums.NethelpersPort](#talos.resource.definitions.enums.NethelpersPort) | | | +| duplex | [talos.resource.definitions.enums.NethelpersDuplex](#talos.resource.definitions.enums.NethelpersDuplex) | | | +| our_modes | [string](#string) | repeated | | +| peer_modes | [string](#string) | repeated | | +| rings | [EthernetRingsStatus](#talos.resource.definitions.network.EthernetRingsStatus) | | | +| features | [EthernetFeatureStatus](#talos.resource.definitions.network.EthernetFeatureStatus) | repeated | | +| channels | [EthernetChannelsStatus](#talos.resource.definitions.network.EthernetChannelsStatus) | | | + + + + + + + + +### HardwareAddrSpec +HardwareAddrSpec describes spec for the link. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| hardware_addr | [bytes](#bytes) | | | + + + + + + + + +### HostDNSConfigSpec +HostDNSConfigSpec describes host DNS config. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| listen_addresses | [common.NetIPPort](#common.NetIPPort) | repeated | | +| service_host_dns_address | [common.NetIP](#common.NetIP) | | | +| resolve_member_names | [bool](#bool) | | | + + + + + + + + +### HostnameSpecSpec +HostnameSpecSpec describes node hostname. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | | +| domainname | [string](#string) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### HostnameStatusSpec +HostnameStatusSpec describes node hostname. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | | +| domainname | [string](#string) | | | + + + + + + + + +### LinkRefreshSpec +LinkRefreshSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| generation | [int64](#int64) | | | + + + + + + + + +### LinkSpecSpec +LinkSpecSpec describes spec for the link. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| logical | [bool](#bool) | | | +| up | [bool](#bool) | | | +| mtu | [uint32](#uint32) | | | +| kind | [string](#string) | | | +| type | [talos.resource.definitions.enums.NethelpersLinkType](#talos.resource.definitions.enums.NethelpersLinkType) | | | +| parent_name | [string](#string) | | | +| bond_slave | [BondSlave](#talos.resource.definitions.network.BondSlave) | | | +| bridge_slave | [BridgeSlave](#talos.resource.definitions.network.BridgeSlave) | | | +| vlan | [VLANSpec](#talos.resource.definitions.network.VLANSpec) | | | +| bond_master | [BondMasterSpec](#talos.resource.definitions.network.BondMasterSpec) | | | +| bridge_master | [BridgeMasterSpec](#talos.resource.definitions.network.BridgeMasterSpec) | | | +| wireguard | [WireguardSpec](#talos.resource.definitions.network.WireguardSpec) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### LinkStatusSpec +LinkStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| index | [uint32](#uint32) | | | +| type | [talos.resource.definitions.enums.NethelpersLinkType](#talos.resource.definitions.enums.NethelpersLinkType) | | | +| link_index | [uint32](#uint32) | | | +| flags | [uint32](#uint32) | | | +| hardware_addr | [bytes](#bytes) | | | +| broadcast_addr | [bytes](#bytes) | | | +| mtu | [uint32](#uint32) | | | +| queue_disc | [string](#string) | | | +| master_index | [uint32](#uint32) | | | +| operational_state | [talos.resource.definitions.enums.NethelpersOperationalState](#talos.resource.definitions.enums.NethelpersOperationalState) | | | +| kind | [string](#string) | | | +| slave_kind | [string](#string) | | | +| bus_path | [string](#string) | | | +| pciid | [string](#string) | | | +| driver | [string](#string) | | | +| driver_version | [string](#string) | | | +| firmware_version | [string](#string) | | | +| product_id | [string](#string) | | | +| vendor_id | [string](#string) | | | +| product | [string](#string) | | | +| vendor | [string](#string) | | | +| link_state | [bool](#bool) | | | +| speed_megabits | [int64](#int64) | | | +| port | [talos.resource.definitions.enums.NethelpersPort](#talos.resource.definitions.enums.NethelpersPort) | | | +| duplex | [talos.resource.definitions.enums.NethelpersDuplex](#talos.resource.definitions.enums.NethelpersDuplex) | | | +| vlan | [VLANSpec](#talos.resource.definitions.network.VLANSpec) | | | +| bridge_master | [BridgeMasterSpec](#talos.resource.definitions.network.BridgeMasterSpec) | | | +| bond_master | [BondMasterSpec](#talos.resource.definitions.network.BondMasterSpec) | | | +| wireguard | [WireguardSpec](#talos.resource.definitions.network.WireguardSpec) | | | +| permanent_addr | [bytes](#bytes) | | | +| alias | [string](#string) | | | +| alt_names | [string](#string) | repeated | | + + + + + + + + +### NfTablesAddressMatch +NfTablesAddressMatch describes the match on the IP address. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| include_subnets | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| exclude_subnets | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| invert | [bool](#bool) | | | + + + + + + + + +### NfTablesChainSpec +NfTablesChainSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| type | [string](#string) | | | +| hook | [talos.resource.definitions.enums.NethelpersNfTablesChainHook](#talos.resource.definitions.enums.NethelpersNfTablesChainHook) | | | +| priority | [talos.resource.definitions.enums.NethelpersNfTablesChainPriority](#talos.resource.definitions.enums.NethelpersNfTablesChainPriority) | | | +| rules | [NfTablesRule](#talos.resource.definitions.network.NfTablesRule) | repeated | | +| policy | [talos.resource.definitions.enums.NethelpersNfTablesVerdict](#talos.resource.definitions.enums.NethelpersNfTablesVerdict) | | | + + + + + + + + +### NfTablesClampMSS +NfTablesClampMSS describes the TCP MSS clamping operation. + +MSS is limited by the `MaxMTU` so that: +- IPv4: MSS = MaxMTU - 40 +- IPv6: MSS = MaxMTU - 60. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mtu | [fixed32](#fixed32) | | | + + + + + + + + +### NfTablesConntrackStateMatch +NfTablesConntrackStateMatch describes the match on the connection tracking state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| states | [talos.resource.definitions.enums.NethelpersConntrackState](#talos.resource.definitions.enums.NethelpersConntrackState) | repeated | | + + + + + + + + +### NfTablesIfNameMatch +NfTablesIfNameMatch describes the match on the interface name. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| operator | [talos.resource.definitions.enums.NethelpersMatchOperator](#talos.resource.definitions.enums.NethelpersMatchOperator) | | | +| interface_names | [string](#string) | repeated | | + + + + + + + + +### NfTablesLayer4Match +NfTablesLayer4Match describes the match on the transport layer protocol. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| protocol | [talos.resource.definitions.enums.NethelpersProtocol](#talos.resource.definitions.enums.NethelpersProtocol) | | | +| match_source_port | [NfTablesPortMatch](#talos.resource.definitions.network.NfTablesPortMatch) | | | +| match_destination_port | [NfTablesPortMatch](#talos.resource.definitions.network.NfTablesPortMatch) | | | + + + + + + + + +### NfTablesLimitMatch +NfTablesLimitMatch describes the match on the packet rate. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| packet_rate_per_second | [uint64](#uint64) | | | + + + + + + + + +### NfTablesMark +NfTablesMark encodes packet mark match/update operation. + +When used as a match computes the following condition: +(mark & mask) ^ xor == value + +When used as an update computes the following operation: +mark = (mark & mask) ^ xor. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mask | [uint32](#uint32) | | | +| xor | [uint32](#uint32) | | | +| value | [uint32](#uint32) | | | + + + + + + + + +### NfTablesPortMatch +NfTablesPortMatch describes the match on the transport layer port. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ranges | [PortRange](#talos.resource.definitions.network.PortRange) | repeated | | + + + + + + + + +### NfTablesRule +NfTablesRule describes a single rule in the nftables chain. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| match_o_if_name | [NfTablesIfNameMatch](#talos.resource.definitions.network.NfTablesIfNameMatch) | | | +| verdict | [talos.resource.definitions.enums.NethelpersNfTablesVerdict](#talos.resource.definitions.enums.NethelpersNfTablesVerdict) | | | +| match_mark | [NfTablesMark](#talos.resource.definitions.network.NfTablesMark) | | | +| set_mark | [NfTablesMark](#talos.resource.definitions.network.NfTablesMark) | | | +| match_source_address | [NfTablesAddressMatch](#talos.resource.definitions.network.NfTablesAddressMatch) | | | +| match_destination_address | [NfTablesAddressMatch](#talos.resource.definitions.network.NfTablesAddressMatch) | | | +| match_layer4 | [NfTablesLayer4Match](#talos.resource.definitions.network.NfTablesLayer4Match) | | | +| match_i_if_name | [NfTablesIfNameMatch](#talos.resource.definitions.network.NfTablesIfNameMatch) | | | +| clamp_mss | [NfTablesClampMSS](#talos.resource.definitions.network.NfTablesClampMSS) | | | +| match_limit | [NfTablesLimitMatch](#talos.resource.definitions.network.NfTablesLimitMatch) | | | +| match_conntrack_state | [NfTablesConntrackStateMatch](#talos.resource.definitions.network.NfTablesConntrackStateMatch) | | | +| anon_counter | [bool](#bool) | | | + + + + + + + + +### NodeAddressFilterSpec +NodeAddressFilterSpec describes a filter for NodeAddresses. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| include_subnets | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| exclude_subnets | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | + + + + + + + + +### NodeAddressSortAlgorithmSpec +NodeAddressSortAlgorithmSpec describes a filter for NodeAddresses. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| algorithm | [talos.resource.definitions.enums.NethelpersAddressSortAlgorithm](#talos.resource.definitions.enums.NethelpersAddressSortAlgorithm) | | | + + + + + + + + +### NodeAddressSpec +NodeAddressSpec describes a set of node addresses. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| addresses | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| sort_algorithm | [talos.resource.definitions.enums.NethelpersAddressSortAlgorithm](#talos.resource.definitions.enums.NethelpersAddressSortAlgorithm) | | | + + + + + + + + +### OperatorSpecSpec +OperatorSpecSpec describes DNS resolvers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| operator | [talos.resource.definitions.enums.NetworkOperator](#talos.resource.definitions.enums.NetworkOperator) | | | +| link_name | [string](#string) | | | +| require_up | [bool](#bool) | | | +| dhcp4 | [DHCP4OperatorSpec](#talos.resource.definitions.network.DHCP4OperatorSpec) | | | +| dhcp6 | [DHCP6OperatorSpec](#talos.resource.definitions.network.DHCP6OperatorSpec) | | | +| vip | [VIPOperatorSpec](#talos.resource.definitions.network.VIPOperatorSpec) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### PortRange +PortRange describes a range of ports. + +Range is [lo, hi]. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| lo | [fixed32](#fixed32) | | | +| hi | [fixed32](#fixed32) | | | + + + + + + + + +### ProbeSpecSpec +ProbeSpecSpec describes the Probe. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| interval | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| failure_threshold | [int64](#int64) | | | +| tcp | [TCPProbeSpec](#talos.resource.definitions.network.TCPProbeSpec) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### ProbeStatusSpec +ProbeStatusSpec describes the Probe. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| success | [bool](#bool) | | | +| last_error | [string](#string) | | | + + + + + + + + +### ResolverSpecSpec +ResolverSpecSpec describes DNS resolvers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| dns_servers | [common.NetIP](#common.NetIP) | repeated | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | +| search_domains | [string](#string) | repeated | | + + + + + + + + +### ResolverStatusSpec +ResolverStatusSpec describes DNS resolvers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| dns_servers | [common.NetIP](#common.NetIP) | repeated | | +| search_domains | [string](#string) | repeated | | + + + + + + + + +### RouteSpecSpec +RouteSpecSpec describes the route. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| family | [talos.resource.definitions.enums.NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) | | | +| destination | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| source | [common.NetIP](#common.NetIP) | | | +| gateway | [common.NetIP](#common.NetIP) | | | +| out_link_name | [string](#string) | | | +| table | [talos.resource.definitions.enums.NethelpersRoutingTable](#talos.resource.definitions.enums.NethelpersRoutingTable) | | | +| priority | [uint32](#uint32) | | | +| scope | [talos.resource.definitions.enums.NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) | | | +| type | [talos.resource.definitions.enums.NethelpersRouteType](#talos.resource.definitions.enums.NethelpersRouteType) | | | +| flags | [uint32](#uint32) | | | +| protocol | [talos.resource.definitions.enums.NethelpersRouteProtocol](#talos.resource.definitions.enums.NethelpersRouteProtocol) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | +| mtu | [uint32](#uint32) | | | + + + + + + + + +### RouteStatusSpec +RouteStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| family | [talos.resource.definitions.enums.NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) | | | +| destination | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| source | [common.NetIP](#common.NetIP) | | | +| gateway | [common.NetIP](#common.NetIP) | | | +| out_link_index | [uint32](#uint32) | | | +| out_link_name | [string](#string) | | | +| table | [talos.resource.definitions.enums.NethelpersRoutingTable](#talos.resource.definitions.enums.NethelpersRoutingTable) | | | +| priority | [uint32](#uint32) | | | +| scope | [talos.resource.definitions.enums.NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) | | | +| type | [talos.resource.definitions.enums.NethelpersRouteType](#talos.resource.definitions.enums.NethelpersRouteType) | | | +| flags | [uint32](#uint32) | | | +| protocol | [talos.resource.definitions.enums.NethelpersRouteProtocol](#talos.resource.definitions.enums.NethelpersRouteProtocol) | | | +| mtu | [uint32](#uint32) | | | + + + + + + + + +### STPSpec +STPSpec describes Spanning Tree Protocol (STP) settings of a bridge. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | + + + + + + + + +### StatusSpec +StatusSpec describes network state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address_ready | [bool](#bool) | | | +| connectivity_ready | [bool](#bool) | | | +| hostname_ready | [bool](#bool) | | | +| etc_files_ready | [bool](#bool) | | | + + + + + + + + +### TCPProbeSpec +TCPProbeSpec describes the TCP Probe. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [string](#string) | | | +| timeout | [google.protobuf.Duration](#google.protobuf.Duration) | | | + + + + + + + + +### TimeServerSpecSpec +TimeServerSpecSpec describes NTP servers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ntp_servers | [string](#string) | repeated | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### TimeServerStatusSpec +TimeServerStatusSpec describes NTP servers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ntp_servers | [string](#string) | repeated | | + + + + + + + + +### VIPEquinixMetalSpec +VIPEquinixMetalSpec describes virtual (elastic) IP settings for Equinix Metal. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| project_id | [string](#string) | | | +| device_id | [string](#string) | | | +| api_token | [string](#string) | | | + + + + + + + + +### VIPHCloudSpec +VIPHCloudSpec describes virtual (elastic) IP settings for Hetzner Cloud. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| device_id | [int64](#int64) | | | +| network_id | [int64](#int64) | | | +| api_token | [string](#string) | | | + + + + + + + + +### VIPOperatorSpec +VIPOperatorSpec describes virtual IP operator options. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ip | [common.NetIP](#common.NetIP) | | | +| gratuitous_arp | [bool](#bool) | | | +| equinix_metal | [VIPEquinixMetalSpec](#talos.resource.definitions.network.VIPEquinixMetalSpec) | | | +| h_cloud | [VIPHCloudSpec](#talos.resource.definitions.network.VIPHCloudSpec) | | | + + + + + + + + +### VLANSpec +VLANSpec describes VLAN settings if Kind == "vlan". + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| vid | [fixed32](#fixed32) | | | +| protocol | [talos.resource.definitions.enums.NethelpersVLANProtocol](#talos.resource.definitions.enums.NethelpersVLANProtocol) | | | + + + + + + + + +### WireguardPeer +WireguardPeer describes a single peer. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| public_key | [string](#string) | | | +| preshared_key | [string](#string) | | | +| endpoint | [string](#string) | | | +| persistent_keepalive_interval | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| allowed_ips | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | + + + + + + + + +### WireguardSpec +WireguardSpec describes Wireguard settings if Kind == "wireguard". + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| private_key | [string](#string) | | | +| public_key | [string](#string) | | | +| listen_port | [int64](#int64) | | | +| firewall_mark | [int64](#int64) | | | +| peers | [WireguardPeer](#talos.resource.definitions.network.WireguardPeer) | repeated | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/perf/perf.proto + + + + + +### CPUSpec +CPUSpec represents the last CPU stats snapshot. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| cpu | [CPUStat](#talos.resource.definitions.perf.CPUStat) | repeated | | +| cpu_total | [CPUStat](#talos.resource.definitions.perf.CPUStat) | | | +| irq_total | [uint64](#uint64) | | | +| context_switches | [uint64](#uint64) | | | +| process_created | [uint64](#uint64) | | | +| process_running | [uint64](#uint64) | | | +| process_blocked | [uint64](#uint64) | | | +| soft_irq_total | [uint64](#uint64) | | | + + + + + + + + +### CPUStat +CPUStat represents a single cpu stat. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| user | [double](#double) | | | +| nice | [double](#double) | | | +| system | [double](#double) | | | +| idle | [double](#double) | | | +| iowait | [double](#double) | | | +| irq | [double](#double) | | | +| soft_irq | [double](#double) | | | +| steal | [double](#double) | | | +| guest | [double](#double) | | | +| guest_nice | [double](#double) | | | + + + + + + + + +### MemorySpec +MemorySpec represents the last Memory stats snapshot. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mem_total | [uint64](#uint64) | | | +| mem_used | [uint64](#uint64) | | | +| mem_available | [uint64](#uint64) | | | +| buffers | [uint64](#uint64) | | | +| cached | [uint64](#uint64) | | | +| swap_cached | [uint64](#uint64) | | | +| active | [uint64](#uint64) | | | +| inactive | [uint64](#uint64) | | | +| active_anon | [uint64](#uint64) | | | +| inactive_anon | [uint64](#uint64) | | | +| active_file | [uint64](#uint64) | | | +| inactive_file | [uint64](#uint64) | | | +| unevictable | [uint64](#uint64) | | | +| mlocked | [uint64](#uint64) | | | +| swap_total | [uint64](#uint64) | | | +| swap_free | [uint64](#uint64) | | | +| dirty | [uint64](#uint64) | | | +| writeback | [uint64](#uint64) | | | +| anon_pages | [uint64](#uint64) | | | +| mapped | [uint64](#uint64) | | | +| shmem | [uint64](#uint64) | | | +| slab | [uint64](#uint64) | | | +| s_reclaimable | [uint64](#uint64) | | | +| s_unreclaim | [uint64](#uint64) | | | +| kernel_stack | [uint64](#uint64) | | | +| page_tables | [uint64](#uint64) | | | +| nf_sunstable | [uint64](#uint64) | | | +| bounce | [uint64](#uint64) | | | +| writeback_tmp | [uint64](#uint64) | | | +| commit_limit | [uint64](#uint64) | | | +| committed_as | [uint64](#uint64) | | | +| vmalloc_total | [uint64](#uint64) | | | +| vmalloc_used | [uint64](#uint64) | | | +| vmalloc_chunk | [uint64](#uint64) | | | +| hardware_corrupted | [uint64](#uint64) | | | +| anon_huge_pages | [uint64](#uint64) | | | +| shmem_huge_pages | [uint64](#uint64) | | | +| shmem_pmd_mapped | [uint64](#uint64) | | | +| cma_total | [uint64](#uint64) | | | +| cma_free | [uint64](#uint64) | | | +| huge_pages_total | [uint64](#uint64) | | | +| huge_pages_free | [uint64](#uint64) | | | +| huge_pages_rsvd | [uint64](#uint64) | | | +| huge_pages_surp | [uint64](#uint64) | | | +| hugepagesize | [uint64](#uint64) | | | +| direct_map4k | [uint64](#uint64) | | | +| direct_map2m | [uint64](#uint64) | | | +| direct_map1g | [uint64](#uint64) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/proto/proto.proto + + + + + +### LinuxIDMapping +LinuxIDMapping specifies UID/GID mappings. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| container_id | [uint32](#uint32) | | | +| host_id | [uint32](#uint32) | | | +| size | [uint32](#uint32) | | | + + + + + + + + +### Mount +Mount specifies a mount for a container. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| destination | [string](#string) | | | +| type | [string](#string) | | | +| source | [string](#string) | | | +| options | [string](#string) | repeated | | +| uid_mappings | [LinuxIDMapping](#talos.resource.definitions.proto.LinuxIDMapping) | repeated | | +| gid_mappings | [LinuxIDMapping](#talos.resource.definitions.proto.LinuxIDMapping) | repeated | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/runtime/runtime.proto + + + + + +### BootedEntrySpec +BootedEntrySpec describes the booted entry resource properties. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| booted_entry | [string](#string) | | | + + + + + + + + +### DevicesStatusSpec +DevicesStatusSpec is the spec for devices status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | + + + + + + + + +### DiagnosticSpec +DiagnosticSpec is the spec for devices status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| message | [string](#string) | | | +| details | [string](#string) | repeated | | + + + + + + + + +### EventSinkConfigSpec +EventSinkConfigSpec describes configuration of Talos event log streaming. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [string](#string) | | | + + + + + + + + +### ExtensionServiceConfigFile +ExtensionServiceConfigFile describes extensions service config files. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| content | [string](#string) | | | +| mount_path | [string](#string) | | | + + + + + + + + +### ExtensionServiceConfigSpec +ExtensionServiceConfigSpec describes status of rendered extensions service config files. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| files | [ExtensionServiceConfigFile](#talos.resource.definitions.runtime.ExtensionServiceConfigFile) | repeated | | +| environment | [string](#string) | repeated | | + + + + + + + + +### ExtensionServiceConfigStatusSpec +ExtensionServiceConfigStatusSpec describes status of rendered extensions service config files. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| spec_version | [string](#string) | | | + + + + + + + + +### KernelCmdlineSpec +KernelCmdlineSpec presents kernel command line (contents of /proc/cmdline). + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| cmdline | [string](#string) | | | + + + + + + + + +### KernelModuleSpecSpec +KernelModuleSpecSpec describes Linux kernel module to load. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| parameters | [string](#string) | repeated | | + + + + + + + + +### KernelParamSpecSpec +KernelParamSpecSpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| value | [string](#string) | | | +| ignore_errors | [bool](#bool) | | | + + + + + + + + +### KernelParamStatusSpec +KernelParamStatusSpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| current | [string](#string) | | | +| default | [string](#string) | | | +| unsupported | [bool](#bool) | | | + + + + + + + + +### KmsgLogConfigSpec +KmsgLogConfigSpec describes configuration for kmsg log streaming. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| destinations | [common.URL](#common.URL) | repeated | | + + + + + + + + +### LoadedKernelModuleSpec +LoadedKernelModuleSpec describes Linux kernel module to load. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| size | [int64](#int64) | | | +| reference_count | [int64](#int64) | | | +| dependencies | [string](#string) | repeated | | +| state | [string](#string) | | | +| address | [string](#string) | | | + + + + + + + + +### MachineStatusSpec +MachineStatusSpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| stage | [talos.resource.definitions.enums.RuntimeMachineStage](#talos.resource.definitions.enums.RuntimeMachineStage) | | | +| status | [MachineStatusStatus](#talos.resource.definitions.runtime.MachineStatusStatus) | | | + + + + + + + + +### MachineStatusStatus +MachineStatusStatus describes machine current status at the stage. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| unmet_conditions | [UnmetCondition](#talos.resource.definitions.runtime.UnmetCondition) | repeated | | + + + + + + + + +### MaintenanceServiceConfigSpec +MaintenanceServiceConfigSpec describes configuration for maintenance service API. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| listen_address | [string](#string) | | | +| reachable_addresses | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### MetaKeySpec +MetaKeySpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| value | [string](#string) | | | + + + + + + + + +### MetaLoadedSpec +MetaLoadedSpec is the spec for meta loaded. The Done field is always true when resource exists. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| done | [bool](#bool) | | | + + + + + + + + +### MountStatusSpec +MountStatusSpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| source | [string](#string) | | | +| target | [string](#string) | | | +| filesystem_type | [string](#string) | | | +| options | [string](#string) | repeated | | +| encrypted | [bool](#bool) | | | +| encryption_providers | [string](#string) | repeated | | + + + + + + + + +### PlatformMetadataSpec +PlatformMetadataSpec describes platform metadata properties. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| platform | [string](#string) | | | +| hostname | [string](#string) | | | +| region | [string](#string) | | | +| zone | [string](#string) | | | +| instance_type | [string](#string) | | | +| instance_id | [string](#string) | | | +| provider_id | [string](#string) | | | +| spot | [bool](#bool) | | | +| internal_dns | [string](#string) | | | +| external_dns | [string](#string) | | | +| tags | [PlatformMetadataSpec.TagsEntry](#talos.resource.definitions.runtime.PlatformMetadataSpec.TagsEntry) | repeated | | + + + + + + + + +### PlatformMetadataSpec.TagsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### SBOMItemSpec +SBOMItemSpec describes the SBOM item resource properties. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| version | [string](#string) | | | +| license | [string](#string) | | | +| cp_es | [string](#string) | repeated | | +| pur_ls | [string](#string) | repeated | | +| extension | [bool](#bool) | | | + + + + + + + + +### SecurityStateSpec +SecurityStateSpec describes the security state resource properties. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| secure_boot | [bool](#bool) | | | +| uki_signing_key_fingerprint | [string](#string) | | | +| pcr_signing_key_fingerprint | [string](#string) | | | +| se_linux_state | [talos.resource.definitions.enums.RuntimeSELinuxState](#talos.resource.definitions.enums.RuntimeSELinuxState) | | | +| booted_with_uki | [bool](#bool) | | | +| fips_state | [talos.resource.definitions.enums.RuntimeFIPSState](#talos.resource.definitions.enums.RuntimeFIPSState) | | | + + + + + + + + +### UniqueMachineTokenSpec +UniqueMachineTokenSpec is the spec for the machine unique token. Token can be empty if machine wasn't assigned any. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| token | [string](#string) | | | + + + + + + + + +### UnmetCondition +UnmetCondition is a failure which prevents machine from being ready at the stage. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| reason | [string](#string) | | | + + + + + + + + +### WatchdogTimerConfigSpec +WatchdogTimerConfigSpec describes configuration of watchdog timer. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| device | [string](#string) | | | +| timeout | [google.protobuf.Duration](#google.protobuf.Duration) | | | + + + + + + + + +### WatchdogTimerStatusSpec +WatchdogTimerStatusSpec describes configuration of watchdog timer. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| device | [string](#string) | | | +| timeout | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| feed_interval | [google.protobuf.Duration](#google.protobuf.Duration) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/secrets/secrets.proto + + + + + +### APICertsSpec +APICertsSpec describes etcd certs secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| client | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| accepted_c_as | [common.PEMEncodedCertificate](#common.PEMEncodedCertificate) | repeated | | + + + + + + + + +### CertSANSpec +CertSANSpec describes fields of the cert SANs. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| i_ps | [common.NetIP](#common.NetIP) | repeated | | +| dns_names | [string](#string) | repeated | | +| fqdn | [string](#string) | | | + + + + + + + + +### EncryptionSaltSpec +EncryptionSaltSpec describes the salt. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| disk_salt | [bytes](#bytes) | | | + + + + + + + + +### EtcdCertsSpec +EtcdCertsSpec describes etcd certs secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| etcd | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| etcd_peer | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| etcd_admin | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| etcd_api_server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### EtcdRootSpec +EtcdRootSpec describes etcd CA secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| etcd_ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### KubeletSpec +KubeletSpec describes root Kubernetes secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [common.URL](#common.URL) | | | +| bootstrap_token_id | [string](#string) | | | +| bootstrap_token_secret | [string](#string) | | | +| accepted_c_as | [common.PEMEncodedCertificate](#common.PEMEncodedCertificate) | repeated | | + + + + + + + + +### KubernetesCertsSpec +KubernetesCertsSpec describes generated Kubernetes certificates. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| scheduler_kubeconfig | [string](#string) | | | +| controller_manager_kubeconfig | [string](#string) | | | +| localhost_admin_kubeconfig | [string](#string) | | | +| admin_kubeconfig | [string](#string) | | | + + + + + + + + +### KubernetesDynamicCertsSpec +KubernetesDynamicCertsSpec describes generated KubernetesCerts certificates. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| api_server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| api_server_kubelet_client | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| front_proxy | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### KubernetesRootSpec +KubernetesRootSpec describes root Kubernetes secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| endpoint | [common.URL](#common.URL) | | | +| local_endpoint | [common.URL](#common.URL) | | | +| cert_sa_ns | [string](#string) | repeated | | +| dns_domain | [string](#string) | | | +| issuing_ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| service_account | [common.PEMEncodedKey](#common.PEMEncodedKey) | | | +| aggregator_ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| aescbc_encryption_secret | [string](#string) | | | +| bootstrap_token_id | [string](#string) | | | +| bootstrap_token_secret | [string](#string) | | | +| secretbox_encryption_secret | [string](#string) | | | +| api_server_ips | [common.NetIP](#common.NetIP) | repeated | | +| accepted_c_as | [common.PEMEncodedCertificate](#common.PEMEncodedCertificate) | repeated | | + + + + + + + + +### MaintenanceRootSpec +MaintenanceRootSpec describes maintenance service CA. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### MaintenanceServiceCertsSpec +MaintenanceServiceCertsSpec describes maintenance service certs secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### OSRootSpec +OSRootSpec describes operating system CA. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| issuing_ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| cert_sani_ps | [common.NetIP](#common.NetIP) | repeated | | +| cert_sandns_names | [string](#string) | repeated | | +| token | [string](#string) | | | +| accepted_c_as | [common.PEMEncodedCertificate](#common.PEMEncodedCertificate) | repeated | | + + + + + + + + +### TrustdCertsSpec +TrustdCertsSpec describes etcd certs secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| accepted_c_as | [common.PEMEncodedCertificate](#common.PEMEncodedCertificate) | repeated | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/siderolink/siderolink.proto + + + + + +### ConfigSpec +ConfigSpec describes Siderolink configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| api_endpoint | [string](#string) | | | +| host | [string](#string) | | | +| join_token | [string](#string) | | | +| insecure | [bool](#bool) | | | +| tunnel | [bool](#bool) | | | + + + + + + + + +### StatusSpec +StatusSpec describes Siderolink status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| host | [string](#string) | | | +| connected | [bool](#bool) | | | +| link_name | [string](#string) | | | +| grpc_tunnel | [bool](#bool) | | | + + + + + + + + +### TunnelSpec +TunnelSpec describes Siderolink GRPC Tunnel configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| api_endpoint | [string](#string) | | | +| link_name | [string](#string) | | | +| mtu | [int64](#int64) | | | +| node_address | [common.NetIPPort](#common.NetIPPort) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/time/time.proto + + + + + +### AdjtimeStatusSpec +AdjtimeStatusSpec describes Linux internal adjtime state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| offset | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| frequency_adjustment_ratio | [double](#double) | | | +| max_error | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| est_error | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| status | [string](#string) | | | +| constant | [int64](#int64) | | | +| sync_status | [bool](#bool) | | | +| state | [string](#string) | | | + + + + + + + + +### StatusSpec +StatusSpec describes time sync state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| synced | [bool](#bool) | | | +| epoch | [int64](#int64) | | | +| sync_disabled | [bool](#bool) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/v1alpha1/v1alpha1.proto + + + + + +### ServiceSpec +ServiceSpec describe service state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| running | [bool](#bool) | | | +| healthy | [bool](#bool) | | | +| unknown | [bool](#bool) | | | + + + + + + + + + + + + + + + + +

Top

+ +## inspect/inspect.proto + + + + + +### ControllerDependencyEdge + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| controller_name | [string](#string) | | | +| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | +| resource_namespace | [string](#string) | | | +| resource_type | [string](#string) | | | +| resource_id | [string](#string) | | | + + + + + + + + +### ControllerRuntimeDependenciesResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | + + + + + + + + +### ControllerRuntimeDependency +The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | + + + + + + + + + + +### DependencyEdgeType + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OUTPUT_EXCLUSIVE | 0 | | +| OUTPUT_SHARED | 3 | | +| INPUT_STRONG | 1 | | +| INPUT_WEAK | 2 | | +| INPUT_DESTROY_READY | 4 | | + + + + + + + + + +### InspectService +The inspect service definition. + +InspectService provides auxiliary API to inspect OS internals. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | + + + + + + +

Top

+ +## machine/machine.proto + + + + + +### AddressEvent +AddressEvent reports node endpoints aggregated from k8s.Endpoints and network.Hostname. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | | +| addresses | [string](#string) | repeated | | + + + + + + + + +### ApplyConfiguration +ApplyConfigurationResponse describes the response to a configuration request. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| warnings | [string](#string) | repeated | Configuration validation warnings. | +| mode | [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) | | States which mode was actually chosen. | +| mode_details | [string](#string) | | Human-readable message explaining the result of the apply configuration call. | + + + + + + + + +### ApplyConfigurationRequest +rpc applyConfiguration +ApplyConfiguration describes a request to assert a new configuration upon a +node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| data | [bytes](#bytes) | | | +| mode | [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) | | | +| dry_run | [bool](#bool) | | | +| try_mode_timeout | [google.protobuf.Duration](#google.protobuf.Duration) | | | + + + + + + + + +### ApplyConfigurationResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | + + + + + + + + +### BPFInstruction + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| op | [uint32](#uint32) | | | +| jt | [uint32](#uint32) | | | +| jf | [uint32](#uint32) | | | +| k | [uint32](#uint32) | | | + + + + + + + + +### Bootstrap +The bootstrap message containing the bootstrap status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### BootstrapRequest +rpc Bootstrap + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| recover_etcd | [bool](#bool) | | Enable etcd recovery from the snapshot. Snapshot should be uploaded before this call via EtcdRecover RPC. | +| recover_skip_hash_check | [bool](#bool) | | Skip hash check on the snapshot (etcd). Enable this when recovering from data directory copy to skip integrity check. | + + + + + + + + +### BootstrapResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Bootstrap](#machine.Bootstrap) | repeated | | + + + + + + + + +### CNIConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| urls | [string](#string) | repeated | | + + + + + + + + +### CPUFreqStats + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| current_frequency | [uint64](#uint64) | | | +| minimum_frequency | [uint64](#uint64) | | | +| maximum_frequency | [uint64](#uint64) | | | +| governor | [string](#string) | | | + + + + + + + + +### CPUFreqStatsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [CPUsFreqStats](#machine.CPUsFreqStats) | repeated | | + + + + + + + + +### CPUInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| processor | [uint32](#uint32) | | | +| vendor_id | [string](#string) | | | +| cpu_family | [string](#string) | | | +| model | [string](#string) | | | +| model_name | [string](#string) | | | +| stepping | [string](#string) | | | +| microcode | [string](#string) | | | +| cpu_mhz | [double](#double) | | | +| cache_size | [string](#string) | | | +| physical_id | [string](#string) | | | +| siblings | [uint32](#uint32) | | | +| core_id | [string](#string) | | | +| cpu_cores | [uint32](#uint32) | | | +| apic_id | [string](#string) | | | +| initial_apic_id | [string](#string) | | | +| fpu | [string](#string) | | | +| fpu_exception | [string](#string) | | | +| cpu_id_level | [uint32](#uint32) | | | +| wp | [string](#string) | | | +| flags | [string](#string) | repeated | | +| bugs | [string](#string) | repeated | | +| bogo_mips | [double](#double) | | | +| cl_flush_size | [uint32](#uint32) | | | +| cache_alignment | [uint32](#uint32) | | | +| address_sizes | [string](#string) | | | +| power_management | [string](#string) | | | + + + + + + + + +### CPUInfoResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | + + + + + + + + +### CPUStat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| user | [double](#double) | | | +| nice | [double](#double) | | | +| system | [double](#double) | | | +| idle | [double](#double) | | | +| iowait | [double](#double) | | | +| irq | [double](#double) | | | +| soft_irq | [double](#double) | | | +| steal | [double](#double) | | | +| guest | [double](#double) | | | +| guest_nice | [double](#double) | | | + + + + + + + + +### CPUsFreqStats + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| cpu_freq_stats | [CPUFreqStats](#machine.CPUFreqStats) | repeated | | + + + + + + + + +### CPUsInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | + + + + + + + + +### ClusterConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | +| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | +| allow_scheduling_on_control_planes | [bool](#bool) | | | + + + + + + + + +### ClusterNetworkConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| dns_domain | [string](#string) | | | +| cni_config | [CNIConfig](#machine.CNIConfig) | | | + + + + + + + + +### ConfigLoadErrorEvent +ConfigLoadErrorEvent is reported when the config loading has failed. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| error | [string](#string) | | | + + + + + + + + +### ConfigValidationErrorEvent +ConfigValidationErrorEvent is reported when config validation has failed. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| error | [string](#string) | | | + + + + + + + + +### ConnectRecord + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| l4proto | [string](#string) | | | +| localip | [string](#string) | | | +| localport | [uint32](#uint32) | | | +| remoteip | [string](#string) | | | +| remoteport | [uint32](#uint32) | | | +| state | [ConnectRecord.State](#machine.ConnectRecord.State) | | | +| txqueue | [uint64](#uint64) | | | +| rxqueue | [uint64](#uint64) | | | +| tr | [ConnectRecord.TimerActive](#machine.ConnectRecord.TimerActive) | | | +| timerwhen | [uint64](#uint64) | | | +| retrnsmt | [uint64](#uint64) | | | +| uid | [uint32](#uint32) | | | +| timeout | [uint64](#uint64) | | | +| inode | [uint64](#uint64) | | | +| ref | [uint64](#uint64) | | | +| pointer | [uint64](#uint64) | | | +| process | [ConnectRecord.Process](#machine.ConnectRecord.Process) | | | +| netns | [string](#string) | | | + + + + + + + + +### ConnectRecord.Process + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pid | [uint32](#uint32) | | | +| name | [string](#string) | | | + + + + + + + + +### Container +The messages message containing the requested containers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | + + + + + + + + +### ContainerInfo +The messages message containing the requested containers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| id | [string](#string) | | | +| uid | [string](#string) | | | +| internal_id | [string](#string) | | | +| image | [string](#string) | | | +| pid | [uint32](#uint32) | | | +| status | [string](#string) | | | +| pod_id | [string](#string) | | | +| name | [string](#string) | | | +| network_namespace | [string](#string) | | | + + + + + + + + +### ContainersRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | + + + + + + + + +### ContainersResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Container](#machine.Container) | repeated | | + + + + + + + + +### ControlPlaneConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [string](#string) | | | + + + + + + + + +### CopyRequest +CopyRequest describes a request to copy data out of Talos node + +Copy produces .tar.gz archive which is streamed back to the caller + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | + + + + + + + + +### DHCPOptionsConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| route_metric | [uint32](#uint32) | | | + + + + + + + + +### DiskStat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| read_completed | [uint64](#uint64) | | | +| read_merged | [uint64](#uint64) | | | +| read_sectors | [uint64](#uint64) | | | +| read_time_ms | [uint64](#uint64) | | | +| write_completed | [uint64](#uint64) | | | +| write_merged | [uint64](#uint64) | | | +| write_sectors | [uint64](#uint64) | | | +| write_time_ms | [uint64](#uint64) | | | +| io_in_progress | [uint64](#uint64) | | | +| io_time_ms | [uint64](#uint64) | | | +| io_time_weighted_ms | [uint64](#uint64) | | | +| discard_completed | [uint64](#uint64) | | | +| discard_merged | [uint64](#uint64) | | | +| discard_sectors | [uint64](#uint64) | | | +| discard_time_ms | [uint64](#uint64) | | | + + + + + + + + +### DiskStats + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| total | [DiskStat](#machine.DiskStat) | | | +| devices | [DiskStat](#machine.DiskStat) | repeated | | + + + + + + + + +### DiskStatsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [DiskStats](#machine.DiskStats) | repeated | | + + + + + + + + +### DiskUsageInfo +DiskUsageInfo describes a file or directory's information for du command + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | +| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | +| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | +| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | + + + + + + + + +### DiskUsageRequest +DiskUsageRequest describes a request to list disk usage of directories and regular files + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | +| all | [bool](#bool) | | All write sizes for all files, not just directories. | +| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | +| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | + + + + + + + + +### DmesgRequest +dmesg + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| follow | [bool](#bool) | | | +| tail | [bool](#bool) | | | + + + + + + + + +### EtcdAlarm + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| member_alarms | [EtcdMemberAlarm](#machine.EtcdMemberAlarm) | repeated | | + + + + + + + + +### EtcdAlarmDisarm + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| member_alarms | [EtcdMemberAlarm](#machine.EtcdMemberAlarm) | repeated | | + + + + + + + + +### EtcdAlarmDisarmResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdAlarmDisarm](#machine.EtcdAlarmDisarm) | repeated | | + + + + + + + + +### EtcdAlarmListResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdAlarm](#machine.EtcdAlarm) | repeated | | + + + + + + + + +### EtcdClusterDowngrade + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| cluster_version | [string](#string) | | | + + + + + + + + +### EtcdDefragment + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdDefragmentResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdDefragment](#machine.EtcdDefragment) | repeated | | + + + + + + + + +### EtcdDowngradeCancel + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| cluster_downgrade | [EtcdClusterDowngrade](#machine.EtcdClusterDowngrade) | | | + + + + + + + + +### EtcdDowngradeCancelResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdDowngradeCancel](#machine.EtcdDowngradeCancel) | repeated | | + + + + + + + + +### EtcdDowngradeEnable + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| cluster_downgrade | [EtcdClusterDowngrade](#machine.EtcdClusterDowngrade) | | | + + + + + + + + +### EtcdDowngradeEnableRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| version | [string](#string) | | | + + + + + + + + +### EtcdDowngradeEnableResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdDowngradeEnable](#machine.EtcdDowngradeEnable) | repeated | | + + + + + + + + +### EtcdDowngradeValidate + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| cluster_downgrade | [EtcdClusterDowngrade](#machine.EtcdClusterDowngrade) | | | + + + + + + + + +### EtcdDowngradeValidateRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| version | [string](#string) | | | + + + + + + + + +### EtcdDowngradeValidateResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdDowngradeValidate](#machine.EtcdDowngradeValidate) | repeated | | + + + + + + + + +### EtcdForfeitLeadership + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| member | [string](#string) | | | + + + + + + + + +### EtcdForfeitLeadershipRequest + + + + + + + + + +### EtcdForfeitLeadershipResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | + + + + + + + + +### EtcdLeaveCluster + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdLeaveClusterRequest + + + + + + + + + +### EtcdLeaveClusterResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | + + + + + + + + +### EtcdMember +EtcdMember describes a single etcd member. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [uint64](#uint64) | | member ID. | +| hostname | [string](#string) | | human-readable name of the member. | +| peer_urls | [string](#string) | repeated | the list of URLs the member exposes to clients for communication. | +| client_urls | [string](#string) | repeated | the list of URLs the member exposes to the cluster for communication. | +| is_learner | [bool](#bool) | | learner flag | + + + + + + + + +### EtcdMemberAlarm + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member_id | [uint64](#uint64) | | | +| alarm | [EtcdMemberAlarm.AlarmType](#machine.EtcdMemberAlarm.AlarmType) | | | + + + + + + + + +### EtcdMemberListRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| query_local | [bool](#bool) | | | + + + + + + + + +### EtcdMemberListResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdMembers](#machine.EtcdMembers) | repeated | | + + + + + + + + +### EtcdMemberStatus + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| storage_version | [string](#string) | | | +| member_id | [uint64](#uint64) | | | +| protocol_version | [string](#string) | | | +| db_size | [int64](#int64) | | | +| db_size_in_use | [int64](#int64) | | | +| leader | [uint64](#uint64) | | | +| raft_index | [uint64](#uint64) | | | +| raft_term | [uint64](#uint64) | | | +| raft_applied_index | [uint64](#uint64) | | | +| errors | [string](#string) | repeated | | +| is_learner | [bool](#bool) | | | + + + + + + + + +### EtcdMembers +EtcdMembers contains the list of members registered on the host. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| legacy_members | [string](#string) | repeated | list of member hostnames. | +| members | [EtcdMember](#machine.EtcdMember) | repeated | the list of etcd members registered on the node. | + + + + + + + + +### EtcdRecover + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdRecoverResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdRecover](#machine.EtcdRecover) | repeated | | + + + + + + + + +### EtcdRemoveMember + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdRemoveMemberByID + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdRemoveMemberByIDRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member_id | [uint64](#uint64) | | | + + + + + + + + +### EtcdRemoveMemberByIDResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdRemoveMemberByID](#machine.EtcdRemoveMemberByID) | repeated | | + + + + + + + + +### EtcdRemoveMemberRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member | [string](#string) | | | + + + + + + + + +### EtcdRemoveMemberResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | + + + + + + + + +### EtcdSnapshotRequest + + + + + + + + + +### EtcdStatus + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| member_status | [EtcdMemberStatus](#machine.EtcdMemberStatus) | | | + + + + + + + + +### EtcdStatusResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdStatus](#machine.EtcdStatus) | repeated | | + + + + + + + + +### Event + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| data | [google.protobuf.Any](#google.protobuf.Any) | | | +| id | [string](#string) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### EventsRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| tail_events | [int32](#int32) | | | +| tail_id | [string](#string) | | | +| tail_seconds | [int32](#int32) | | | +| with_actor_id | [string](#string) | | | + + + + + + + + +### FeaturesInfo +FeaturesInfo describes individual Talos features that can be switched on or off. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| rbac | [bool](#bool) | | RBAC is true if role-based access control is enabled. | + + + + + + + + +### FileInfo +FileInfo describes a file or directory's information + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | +| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | +| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | +| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified | +| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | +| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | +| link | [string](#string) | | Link is filled with symlink target | +| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | +| uid | [uint32](#uint32) | | Owner uid | +| gid | [uint32](#uint32) | | Owner gid | +| xattrs | [Xattr](#machine.Xattr) | repeated | Extended attributes (if present and requested) | + + + + + + + + +### GenerateClientConfiguration + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| ca | [bytes](#bytes) | | PEM-encoded CA certificate. | +| crt | [bytes](#bytes) | | PEM-encoded generated client certificate. | +| key | [bytes](#bytes) | | PEM-encoded generated client key. | +| talosconfig | [bytes](#bytes) | | Client configuration (talosconfig) file content. | + + + + + + + + +### GenerateClientConfigurationRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| roles | [string](#string) | repeated | Roles in the generated client certificate. | +| crt_ttl | [google.protobuf.Duration](#google.protobuf.Duration) | | Client certificate TTL. | + + + + + + + + +### GenerateClientConfigurationResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [GenerateClientConfiguration](#machine.GenerateClientConfiguration) | repeated | | + + + + + + + + +### GenerateConfiguration +GenerateConfiguration describes the response to a generate configuration request. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| data | [bytes](#bytes) | repeated | | +| talosconfig | [bytes](#bytes) | | | + + + + + + + + +### GenerateConfigurationRequest +GenerateConfigurationRequest describes a request to generate a new configuration +on a node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| config_version | [string](#string) | | | +| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | +| machine_config | [MachineConfig](#machine.MachineConfig) | | | +| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### GenerateConfigurationResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | + + + + + + + + +### Hostname + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| hostname | [string](#string) | | | + + + + + + + + +### HostnameResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Hostname](#machine.Hostname) | repeated | | + + + + + + + + +### ImageListRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [common.ContainerdNamespace](#common.ContainerdNamespace) | | Containerd namespace to use. | + + + + + + + + +### ImageListResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| name | [string](#string) | | | +| digest | [string](#string) | | | +| size | [int64](#int64) | | | +| created_at | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### ImagePull + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### ImagePullRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [common.ContainerdNamespace](#common.ContainerdNamespace) | | Containerd namespace to use. | +| reference | [string](#string) | | Image reference to pull. | + + + + + + + + +### ImagePullResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ImagePull](#machine.ImagePull) | repeated | | + + + + + + + + +### InstallConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| install_disk | [string](#string) | | | +| install_image | [string](#string) | | | + + + + + + + + +### ListRequest +ListRequest describes a request to list the contents of a directory. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | +| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | +| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | +| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | +| report_xattrs | [bool](#bool) | | Report xattrs | + + + + + + + + +### LoadAvg + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| load1 | [double](#double) | | | +| load5 | [double](#double) | | | +| load15 | [double](#double) | | | + + + + + + + + +### LoadAvgResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [LoadAvg](#machine.LoadAvg) | repeated | | + + + + + + + + +### LogsContainer +LogsContainer desribes all avalaible registered log containers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| ids | [string](#string) | repeated | | + + + + + + + + +### LogsContainersResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [LogsContainer](#machine.LogsContainer) | repeated | | + + + + + + + + +### LogsRequest +rpc logs +The request message containing the process name. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| id | [string](#string) | | | +| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | +| follow | [bool](#bool) | | | +| tail_lines | [int32](#int32) | | | + + + + + + + + +### MachineConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | +| install_config | [InstallConfig](#machine.InstallConfig) | | | +| network_config | [NetworkConfig](#machine.NetworkConfig) | | | +| kubernetes_version | [string](#string) | | | + + + + + + + + +### MachineStatusEvent +MachineStatusEvent reports changes to the MachineStatus resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| stage | [MachineStatusEvent.MachineStage](#machine.MachineStatusEvent.MachineStage) | | | +| status | [MachineStatusEvent.MachineStatus](#machine.MachineStatusEvent.MachineStatus) | | | + + + + + + + + +### MachineStatusEvent.MachineStatus + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| unmet_conditions | [MachineStatusEvent.MachineStatus.UnmetCondition](#machine.MachineStatusEvent.MachineStatus.UnmetCondition) | repeated | | + + + + + + + + +### MachineStatusEvent.MachineStatus.UnmetCondition + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| reason | [string](#string) | | | + + + + + + + + +### MemInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| memtotal | [uint64](#uint64) | | | +| memfree | [uint64](#uint64) | | | +| memavailable | [uint64](#uint64) | | | +| buffers | [uint64](#uint64) | | | +| cached | [uint64](#uint64) | | | +| swapcached | [uint64](#uint64) | | | +| active | [uint64](#uint64) | | | +| inactive | [uint64](#uint64) | | | +| activeanon | [uint64](#uint64) | | | +| inactiveanon | [uint64](#uint64) | | | +| activefile | [uint64](#uint64) | | | +| inactivefile | [uint64](#uint64) | | | +| unevictable | [uint64](#uint64) | | | +| mlocked | [uint64](#uint64) | | | +| swaptotal | [uint64](#uint64) | | | +| swapfree | [uint64](#uint64) | | | +| dirty | [uint64](#uint64) | | | +| writeback | [uint64](#uint64) | | | +| anonpages | [uint64](#uint64) | | | +| mapped | [uint64](#uint64) | | | +| shmem | [uint64](#uint64) | | | +| slab | [uint64](#uint64) | | | +| sreclaimable | [uint64](#uint64) | | | +| sunreclaim | [uint64](#uint64) | | | +| kernelstack | [uint64](#uint64) | | | +| pagetables | [uint64](#uint64) | | | +| nfsunstable | [uint64](#uint64) | | | +| bounce | [uint64](#uint64) | | | +| writebacktmp | [uint64](#uint64) | | | +| commitlimit | [uint64](#uint64) | | | +| committedas | [uint64](#uint64) | | | +| vmalloctotal | [uint64](#uint64) | | | +| vmallocused | [uint64](#uint64) | | | +| vmallocchunk | [uint64](#uint64) | | | +| hardwarecorrupted | [uint64](#uint64) | | | +| anonhugepages | [uint64](#uint64) | | | +| shmemhugepages | [uint64](#uint64) | | | +| shmempmdmapped | [uint64](#uint64) | | | +| cmatotal | [uint64](#uint64) | | | +| cmafree | [uint64](#uint64) | | | +| hugepagestotal | [uint64](#uint64) | | | +| hugepagesfree | [uint64](#uint64) | | | +| hugepagesrsvd | [uint64](#uint64) | | | +| hugepagessurp | [uint64](#uint64) | | | +| hugepagesize | [uint64](#uint64) | | | +| directmap4k | [uint64](#uint64) | | | +| directmap2m | [uint64](#uint64) | | | +| directmap1g | [uint64](#uint64) | | | + + + + + + + + +### Memory + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| meminfo | [MemInfo](#machine.MemInfo) | | | + + + + + + + + +### MemoryResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Memory](#machine.Memory) | repeated | | + + + + + + + + +### MetaDelete + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### MetaDeleteRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [uint32](#uint32) | | | + + + + + + + + +### MetaDeleteResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [MetaDelete](#machine.MetaDelete) | repeated | | + + + + + + + + +### MetaWrite + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### MetaWriteRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [uint32](#uint32) | | | +| value | [bytes](#bytes) | | | + + + + + + + + +### MetaWriteResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [MetaWrite](#machine.MetaWrite) | repeated | | + + + + + + + + +### MountStat +The messages message containing the requested processes. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| filesystem | [string](#string) | | | +| size | [uint64](#uint64) | | | +| available | [uint64](#uint64) | | | +| mounted_on | [string](#string) | | | + + + + + + + + +### Mounts +The messages message containing the requested df stats. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| stats | [MountStat](#machine.MountStat) | repeated | | + + + + + + + + +### MountsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Mounts](#machine.Mounts) | repeated | | + + + + + + + + +### NetDev + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| rx_bytes | [uint64](#uint64) | | | +| rx_packets | [uint64](#uint64) | | | +| rx_errors | [uint64](#uint64) | | | +| rx_dropped | [uint64](#uint64) | | | +| rx_fifo | [uint64](#uint64) | | | +| rx_frame | [uint64](#uint64) | | | +| rx_compressed | [uint64](#uint64) | | | +| rx_multicast | [uint64](#uint64) | | | +| tx_bytes | [uint64](#uint64) | | | +| tx_packets | [uint64](#uint64) | | | +| tx_errors | [uint64](#uint64) | | | +| tx_dropped | [uint64](#uint64) | | | +| tx_fifo | [uint64](#uint64) | | | +| tx_collisions | [uint64](#uint64) | | | +| tx_carrier | [uint64](#uint64) | | | +| tx_compressed | [uint64](#uint64) | | | + + + + + + + + +### Netstat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| connectrecord | [ConnectRecord](#machine.ConnectRecord) | repeated | | + + + + + + + + +### NetstatRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| filter | [NetstatRequest.Filter](#machine.NetstatRequest.Filter) | | | +| feature | [NetstatRequest.Feature](#machine.NetstatRequest.Feature) | | | +| l4proto | [NetstatRequest.L4proto](#machine.NetstatRequest.L4proto) | | | +| netns | [NetstatRequest.NetNS](#machine.NetstatRequest.NetNS) | | | + + + + + + + + +### NetstatRequest.Feature + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pid | [bool](#bool) | | | + + + + + + + + +### NetstatRequest.L4proto + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| tcp | [bool](#bool) | | | +| tcp6 | [bool](#bool) | | | +| udp | [bool](#bool) | | | +| udp6 | [bool](#bool) | | | +| udplite | [bool](#bool) | | | +| udplite6 | [bool](#bool) | | | +| raw | [bool](#bool) | | | +| raw6 | [bool](#bool) | | | + + + + + + + + +### NetstatRequest.NetNS + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostnetwork | [bool](#bool) | | | +| netns | [string](#string) | repeated | | +| allnetns | [bool](#bool) | | | + + + + + + + + +### NetstatResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Netstat](#machine.Netstat) | repeated | | + + + + + + + + +### NetworkConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | | +| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | + + + + + + + + +### NetworkDeviceConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| interface | [string](#string) | | | +| cidr | [string](#string) | | | +| mtu | [int32](#int32) | | | +| dhcp | [bool](#bool) | | | +| ignore | [bool](#bool) | | | +| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | +| routes | [RouteConfig](#machine.RouteConfig) | repeated | | + + + + + + + + +### NetworkDeviceStats + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| total | [NetDev](#machine.NetDev) | | | +| devices | [NetDev](#machine.NetDev) | repeated | | + + + + + + + + +### NetworkDeviceStatsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | + + + + + + + + +### PacketCaptureRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| interface | [string](#string) | | Interface name to perform packet capture on. | +| promiscuous | [bool](#bool) | | Enable promiscuous mode. | +| snap_len | [uint32](#uint32) | | Snap length in bytes. | +| bpf_filter | [BPFInstruction](#machine.BPFInstruction) | repeated | BPF filter. | + + + + + + + + +### PhaseEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| phase | [string](#string) | | | +| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | + + + + + + + + +### PlatformInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| mode | [string](#string) | | | + + + + + + + + +### Process + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | + + + + + + + + +### ProcessInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pid | [int32](#int32) | | | +| ppid | [int32](#int32) | | | +| state | [string](#string) | | | +| threads | [int32](#int32) | | | +| cpu_time | [double](#double) | | | +| virtual_memory | [uint64](#uint64) | | | +| resident_memory | [uint64](#uint64) | | | +| command | [string](#string) | | | +| executable | [string](#string) | | | +| args | [string](#string) | | | +| label | [string](#string) | | | + + + + + + + + +### ProcessesResponse +rpc processes + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Process](#machine.Process) | repeated | | + + + + + + + + +### ReadRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| path | [string](#string) | | | + + + + + + + + +### Reboot +The reboot message containing the reboot status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### RebootRequest +rpc reboot + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mode | [RebootRequest.Mode](#machine.RebootRequest.Mode) | | | + + + + + + + + +### RebootResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Reboot](#machine.Reboot) | repeated | | + + + + + + + + +### Reset +The reset message containing the restart status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### ResetPartitionSpec +rpc reset + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| label | [string](#string) | | | +| wipe | [bool](#bool) | | | + + + + + + + + +### ResetRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | +| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | +| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | +| user_disks_to_wipe | [string](#string) | repeated | UserDisksToWipe lists specific connected block devices to be reset (wiped). | +| mode | [ResetRequest.WipeMode](#machine.ResetRequest.WipeMode) | | WipeMode defines which devices should be wiped. | + + + + + + + + +### ResetResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Reset](#machine.Reset) | repeated | | + + + + + + + + +### Restart + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### RestartEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| cmd | [int64](#int64) | | | + + + + + + + + +### RestartRequest +rpc restart +The request message containing the process to restart. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| id | [string](#string) | | | +| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | + + + + + + + + +### RestartResponse +The messages message containing the restart status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Restart](#machine.Restart) | repeated | | + + + + + + + + +### Rollback + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### RollbackRequest +rpc rollback + + + + + + + + +### RollbackResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Rollback](#machine.Rollback) | repeated | | + + + + + + + + +### RouteConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| network | [string](#string) | | | +| gateway | [string](#string) | | | +| metric | [uint32](#uint32) | | | + + + + + + + + +### SequenceEvent +rpc events + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| sequence | [string](#string) | | | +| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | +| error | [common.Error](#common.Error) | | | + + + + + + + + +### ServiceEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| msg | [string](#string) | | | +| state | [string](#string) | | | +| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### ServiceEvents + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | + + + + + + + + +### ServiceHealth + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| unknown | [bool](#bool) | | | +| healthy | [bool](#bool) | | | +| last_message | [string](#string) | | | +| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### ServiceInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [string](#string) | | | +| state | [string](#string) | | | +| events | [ServiceEvents](#machine.ServiceEvents) | | | +| health | [ServiceHealth](#machine.ServiceHealth) | | | + + + + + + + + +### ServiceList +rpc servicelist + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | + + + + + + + + +### ServiceListResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ServiceList](#machine.ServiceList) | repeated | | + + + + + + + + +### ServiceRestart + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| resp | [string](#string) | | | + + + + + + + + +### ServiceRestartRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [string](#string) | | | + + + + + + + + +### ServiceRestartResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | + + + + + + + + +### ServiceStart + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| resp | [string](#string) | | | + + + + + + + + +### ServiceStartRequest +rpc servicestart + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [string](#string) | | | + + + + + + + + +### ServiceStartResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ServiceStart](#machine.ServiceStart) | repeated | | + + + + + + + + +### ServiceStateEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| service | [string](#string) | | | +| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | +| message | [string](#string) | | | +| health | [ServiceHealth](#machine.ServiceHealth) | | | + + + + + + + + +### ServiceStop + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| resp | [string](#string) | | | + + + + + + + + +### ServiceStopRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [string](#string) | | | + + + + + + + + +### ServiceStopResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ServiceStop](#machine.ServiceStop) | repeated | | + + + + + + + + +### Shutdown +rpc shutdown +The messages message containing the shutdown status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### ShutdownRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| force | [bool](#bool) | | Force indicates whether node should shutdown without first cordening and draining | + + + + + + + + +### ShutdownResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Shutdown](#machine.Shutdown) | repeated | | + + + + + + + + +### SoftIRQStat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hi | [uint64](#uint64) | | | +| timer | [uint64](#uint64) | | | +| net_tx | [uint64](#uint64) | | | +| net_rx | [uint64](#uint64) | | | +| block | [uint64](#uint64) | | | +| block_io_poll | [uint64](#uint64) | | | +| tasklet | [uint64](#uint64) | | | +| sched | [uint64](#uint64) | | | +| hrtimer | [uint64](#uint64) | | | +| rcu | [uint64](#uint64) | | | + + + + + + + + +### Stat +The messages message containing the requested stat. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| id | [string](#string) | | | +| memory_usage | [uint64](#uint64) | | | +| cpu_usage | [uint64](#uint64) | | | +| pod_id | [string](#string) | | | +| name | [string](#string) | | | + + + + + + + + +### Stats +The messages message containing the requested stats. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| stats | [Stat](#machine.Stat) | repeated | | + + + + + + + + +### StatsRequest +The request message containing the containerd namespace. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | + + + + + + + + +### StatsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Stats](#machine.Stats) | repeated | | + + + + + + + + +### SystemStat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| boot_time | [uint64](#uint64) | | | +| cpu_total | [CPUStat](#machine.CPUStat) | | | +| cpu | [CPUStat](#machine.CPUStat) | repeated | | +| irq_total | [uint64](#uint64) | | | +| irq | [uint64](#uint64) | repeated | | +| context_switches | [uint64](#uint64) | | | +| process_created | [uint64](#uint64) | | | +| process_running | [uint64](#uint64) | | | +| process_blocked | [uint64](#uint64) | | | +| soft_irq_total | [uint64](#uint64) | | | +| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | + + + + + + + + +### SystemStatResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [SystemStat](#machine.SystemStat) | repeated | | + + + + + + + + +### TaskEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| task | [string](#string) | | | +| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | + + + + + + + + +### Upgrade + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| ack | [string](#string) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### UpgradeRequest +rpc upgrade + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| preserve | [bool](#bool) | | | +| stage | [bool](#bool) | | | +| force | [bool](#bool) | | | +| reboot_mode | [UpgradeRequest.RebootMode](#machine.UpgradeRequest.RebootMode) | | | + + + + + + + + +### UpgradeResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Upgrade](#machine.Upgrade) | repeated | | + + + + + + + + +### Version + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| version | [VersionInfo](#machine.VersionInfo) | | | +| platform | [PlatformInfo](#machine.PlatformInfo) | | | +| features | [FeaturesInfo](#machine.FeaturesInfo) | | Features describe individual Talos features that can be switched on or off. | + + + + + + + + +### VersionInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| tag | [string](#string) | | | +| sha | [string](#string) | | | +| built | [string](#string) | | | +| go_version | [string](#string) | | | +| os | [string](#string) | | | +| arch | [string](#string) | | | + + + + + + + + +### VersionResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Version](#machine.Version) | repeated | | + + + + + + + + +### Xattr + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| data | [bytes](#bytes) | | | + + + + + + + + + + +### ApplyConfigurationRequest.Mode + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| REBOOT | 0 | | +| AUTO | 1 | | +| NO_REBOOT | 2 | | +| STAGED | 3 | | +| TRY | 4 | | + + + + + +### ConnectRecord.State + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| RESERVED | 0 | | +| ESTABLISHED | 1 | | +| SYN_SENT | 2 | | +| SYN_RECV | 3 | | +| FIN_WAIT1 | 4 | | +| FIN_WAIT2 | 5 | | +| TIME_WAIT | 6 | | +| CLOSE | 7 | | +| CLOSEWAIT | 8 | | +| LASTACK | 9 | | +| LISTEN | 10 | | +| CLOSING | 11 | | + + + + + +### ConnectRecord.TimerActive + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OFF | 0 | | +| ON | 1 | | +| KEEPALIVE | 2 | | +| TIMEWAIT | 3 | | +| PROBE | 4 | | + + + + + +### EtcdMemberAlarm.AlarmType + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NONE | 0 | | +| NOSPACE | 1 | | +| CORRUPT | 2 | | + + + + + +### ListRequest.Type +File type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| REGULAR | 0 | Regular file (not directory, symlink, etc). | +| DIRECTORY | 1 | Directory. | +| SYMLINK | 2 | Symbolic link. | + + + + + +### MachineConfig.MachineType + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TYPE_UNKNOWN | 0 | | +| TYPE_INIT | 1 | | +| TYPE_CONTROL_PLANE | 2 | | +| TYPE_WORKER | 3 | | + + + + + +### MachineStatusEvent.MachineStage + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| UNKNOWN | 0 | | +| BOOTING | 1 | | +| INSTALLING | 2 | | +| MAINTENANCE | 3 | | +| RUNNING | 4 | | +| REBOOTING | 5 | | +| SHUTTING_DOWN | 6 | | +| RESETTING | 7 | | +| UPGRADING | 8 | | + + + + + +### NetstatRequest.Filter + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ALL | 0 | | +| CONNECTED | 1 | | +| LISTENING | 2 | | + + + + + +### PhaseEvent.Action + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| START | 0 | | +| STOP | 1 | | + + + + + +### RebootRequest.Mode + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| DEFAULT | 0 | | +| POWERCYCLE | 1 | | + + + + + +### ResetRequest.WipeMode + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ALL | 0 | | +| SYSTEM_DISK | 1 | | +| USER_DISKS | 2 | | + + + + + +### SequenceEvent.Action + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NOOP | 0 | | +| START | 1 | | +| STOP | 2 | | + + + + + +### ServiceStateEvent.Action + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| INITIALIZED | 0 | | +| PREPARING | 1 | | +| WAITING | 2 | | +| RUNNING | 3 | | +| STOPPING | 4 | | +| FINISHED | 5 | | +| FAILED | 6 | | +| SKIPPED | 7 | | +| STARTING | 8 | | + + + + + +### TaskEvent.Action + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| START | 0 | | +| STOP | 1 | | + + + + + +### UpgradeRequest.RebootMode + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| DEFAULT | 0 | | +| POWERCYCLE | 1 | | + + + + + + + + + +### MachineService +The machine service definition. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | +| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | Bootstrap method makes control plane node enter etcd bootstrap mode. Node aborts etcd join sequence and creates single-node etcd cluster. If recover_etcd argument is specified, etcd is recovered from a snapshot uploaded with EtcdRecover. | +| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | +| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | +| CPUFreqStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUFreqStatsResponse](#machine.CPUFreqStatsResponse) | | +| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | +| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | +| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | +| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | +| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | +| EtcdRemoveMemberByID | [EtcdRemoveMemberByIDRequest](#machine.EtcdRemoveMemberByIDRequest) | [EtcdRemoveMemberByIDResponse](#machine.EtcdRemoveMemberByIDResponse) | EtcdRemoveMemberByID removes a member from the etcd cluster identified by member ID. This API should be used to remove members which don't have an associated Talos node anymore. To remove a member with a running Talos node, use EtcdLeaveCluster API on the node to be removed. | +| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | +| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | +| EtcdRecover | [.common.Data](#common.Data) stream | [EtcdRecoverResponse](#machine.EtcdRecoverResponse) | EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot to the node. Snapshot can be later used to recover the cluster via Bootstrap method. | +| EtcdSnapshot | [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) | [.common.Data](#common.Data) stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client. This method is available only on control plane nodes (which run etcd). | +| EtcdAlarmList | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdAlarmListResponse](#machine.EtcdAlarmListResponse) | EtcdAlarmList lists etcd alarms for the current node. This method is available only on control plane nodes (which run etcd). | +| EtcdAlarmDisarm | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdAlarmDisarmResponse](#machine.EtcdAlarmDisarmResponse) | EtcdAlarmDisarm disarms etcd alarms for the current node. This method is available only on control plane nodes (which run etcd). | +| EtcdDefragment | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdDefragmentResponse](#machine.EtcdDefragmentResponse) | EtcdDefragment defragments etcd data directory for the current node. Defragmentation is a resource-heavy operation, so it should only run on a specific node. This method is available only on control plane nodes (which run etcd). | +| EtcdStatus | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdStatusResponse](#machine.EtcdStatusResponse) | EtcdStatus returns etcd status for the current member. This method is available only on control plane nodes (which run etcd). | +| EtcdDowngradeValidate | [EtcdDowngradeValidateRequest](#machine.EtcdDowngradeValidateRequest) | [EtcdDowngradeValidateResponse](#machine.EtcdDowngradeValidateResponse) | EtcdDowngradeValidate validates etcd cluster for downgrade to a specific version. This method is available only on control plane nodes (which run etcd). | +| EtcdDowngradeEnable | [EtcdDowngradeEnableRequest](#machine.EtcdDowngradeEnableRequest) | [EtcdDowngradeEnableResponse](#machine.EtcdDowngradeEnableResponse) | EtcdDowngradeEnable enables etcd cluster downgrade to a specific version. This method is available only on control plane nodes (which run etcd). | +| EtcdDowngradeCancel | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdDowngradeCancelResponse](#machine.EtcdDowngradeCancelResponse) | EtcdDowngradeCancel cancels etcd cluster downgrade that is in progress. This method is available only on control plane nodes (which run etcd). | +| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | +| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | +| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | +| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | +| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | +| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | +| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | +| LogsContainers | [.google.protobuf.Empty](#google.protobuf.Empty) | [LogsContainersResponse](#machine.LogsContainersResponse) | | +| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | +| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | +| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | +| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | +| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | +| Reboot | [RebootRequest](#machine.RebootRequest) | [RebootResponse](#machine.RebootResponse) | | +| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | +| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | +| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | +| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | +| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | +| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | +| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | +| Shutdown | [ShutdownRequest](#machine.ShutdownRequest) | [ShutdownResponse](#machine.ShutdownResponse) | | +| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | +| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | +| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | +| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | +| GenerateClientConfiguration | [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) | [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) | GenerateClientConfiguration generates talosctl client configuration (talosconfig). | +| PacketCapture | [PacketCaptureRequest](#machine.PacketCaptureRequest) | [.common.Data](#common.Data) stream | PacketCapture performs packet capture and streams back pcap file. | +| Netstat | [NetstatRequest](#machine.NetstatRequest) | [NetstatResponse](#machine.NetstatResponse) | Netstat provides information about network connections. | +| MetaWrite | [MetaWriteRequest](#machine.MetaWriteRequest) | [MetaWriteResponse](#machine.MetaWriteResponse) | MetaWrite writes a META key-value pair. | +| MetaDelete | [MetaDeleteRequest](#machine.MetaDeleteRequest) | [MetaDeleteResponse](#machine.MetaDeleteResponse) | MetaDelete deletes a META key. | +| ImageList | [ImageListRequest](#machine.ImageListRequest) | [ImageListResponse](#machine.ImageListResponse) stream | ImageList lists images in the CRI. | +| ImagePull | [ImagePullRequest](#machine.ImagePullRequest) | [ImagePullResponse](#machine.ImagePullResponse) | ImagePull pulls an image into the CRI. | + + + + + + +

Top

+ +## security/security.proto + + + + + +### CertificateRequest +The request message containing the certificate signing request. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| csr | [bytes](#bytes) | | Certificate Signing Request in PEM format. | + + + + + + + + +### CertificateResponse +The response message containing signed certificate. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [bytes](#bytes) | | Certificate of the CA that signed the requested certificate in PEM format. | +| crt | [bytes](#bytes) | | Signed X.509 requested certificate in PEM format. | + + + + + + + + + + + + + + +### SecurityService +The security service definition. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | + + + + + + +

Top

+ +## storage/storage.proto + + + + + +### BlockDeviceWipe + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### BlockDeviceWipeDescriptor +BlockDeviceWipeDescriptor represents a single block device to be wiped. + +The device can be either a full disk (e.g. vda) or a partition (vda5). +The device should not be used in any of active volumes. +The device should not be used as a secondary (e.g. part of LVM). + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| device | [string](#string) | | Device name to wipe (e.g. sda or sda5). + +The name should be submitted without `/dev/` prefix. | +| method | [BlockDeviceWipeDescriptor.Method](#storage.BlockDeviceWipeDescriptor.Method) | | Wipe method to use. | +| skip_volume_check | [bool](#bool) | | Skip the volume in use check. | +| skip_secondary_check | [bool](#bool) | | Skip the secondary disk check (e.g. underlying disk for RAID or LVM). | +| drop_partition | [bool](#bool) | | Drop the partition (only applies if the device is a partition). | + + + + + + + + +### BlockDeviceWipeRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| devices | [BlockDeviceWipeDescriptor](#storage.BlockDeviceWipeDescriptor) | repeated | | + + + + + + + + +### BlockDeviceWipeResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [BlockDeviceWipe](#storage.BlockDeviceWipe) | repeated | | + + + + + + + + +### Disk +Disk represents a disk. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | +| model | [string](#string) | | Model idicates the disk model. | +| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | +| name | [string](#string) | | Name as in `/sys/block//device/name`. | +| serial | [string](#string) | | Serial as in `/sys/block//device/serial`. | +| modalias | [string](#string) | | Modalias as in `/sys/block//device/modalias`. | +| uuid | [string](#string) | | Uuid as in `/sys/block//device/uuid`. | +| wwid | [string](#string) | | Wwid as in `/sys/block//device/wwid`. | +| type | [Disk.DiskType](#storage.Disk.DiskType) | | Type is a type of the disk: nvme, ssd, hdd, sd card. | +| bus_path | [string](#string) | | BusPath is the bus path of the disk. | +| system_disk | [bool](#bool) | | SystemDisk indicates that the disk is used as Talos system disk. | +| subsystem | [string](#string) | | Subsystem is the symlink path in the `/sys/block//subsystem`. | +| readonly | [bool](#bool) | | Readonly specifies if the disk is read only. | + + + + + + + + +### Disks +DisksResponse represents the response of the `Disks` RPC. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| disks | [Disk](#storage.Disk) | repeated | | + + + + + + + + +### DisksResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Disks](#storage.Disks) | repeated | | + + + + + + + + + + +### BlockDeviceWipeDescriptor.Method + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| FAST | 0 | Fast wipe - wipe only filesystem signatures. | +| ZEROES | 1 | Zeroes wipe - wipe by overwriting with zeroes (might be slow depending on the disk size and available hardware features). | + + + + + +### Disk.DiskType + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| UNKNOWN | 0 | | +| SSD | 1 | | +| HDD | 2 | | +| NVME | 3 | | +| SD | 4 | | +| CD | 5 | | + + + + + + + + + +### StorageService +StorageService represents the storage service. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | +| BlockDeviceWipe | [BlockDeviceWipeRequest](#storage.BlockDeviceWipeRequest) | [BlockDeviceWipeResponse](#storage.BlockDeviceWipeResponse) | BlockDeviceWipe performs a wipe of the blockdevice (partition or disk). + +The method doesn't require a reboot, and it can only wipe blockdevices which are not being used as volumes at the moment. Wiping of volumes requires a different API. | + + + + + + +

Top

+ +## time/time.proto + + + + + +### Time + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| server | [string](#string) | | | +| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | +| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### TimeRequest +The response message containing the ntp server + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| server | [string](#string) | | | + + + + + + + + +### TimeResponse +The response message containing the ntp server, time, and offset + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Time](#time.Time) | repeated | | + + + + + + + + + + + + + + +### TimeService +The time service definition. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | +| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | + + + + + +## Scalar Value Types + +| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | +| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | +| double | | double | double | float | float64 | double | float | Float | +| float | | float | float | float | float32 | float | float | Float | +| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | +| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | +| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | +| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | +| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | +| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | +| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | +| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | +| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | +| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | +| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | +| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | +| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | + diff --git a/website/content/v1.12/reference/cli.md b/website/content/v1.12/reference/cli.md new file mode 100644 index 000000000..9a25b70a1 --- /dev/null +++ b/website/content/v1.12/reference/cli.md @@ -0,0 +1,3011 @@ +--- +description: Talosctl CLI tool reference. +title: CLI +--- + + + +## talosctl apply-config + +Apply a new configuration to a node + +``` +talosctl apply-config [flags] +``` + +### Options + +``` + --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) + --cluster string Cluster to connect to if a proxy endpoint is used. + -p, --config-patch stringArray the list of config patches to apply to the local config file before sending it to the node + --context string Context to be used in command + --dry-run check how the config change will be applied in dry-run mode + -e, --endpoints strings override default endpoints in Talos configuration + -f, --file string the filename of the updated configuration + -h, --help help for apply-config + -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service + -m, --mode auto, interactive, no-reboot, reboot, staged, try apply config mode (default auto) + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --timeout duration the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl bootstrap + +Bootstrap the etcd cluster on the specified node. + +### Synopsis + +When Talos cluster is created etcd service on control plane nodes enter the join loop waiting +to join etcd peers from other control plane nodes. One node should be picked as the bootstrap node. +When bootstrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. +Other control plane nodes will join etcd cluster once Kubernetes is bootstrapped on the bootstrap node. + +This command should not be used when "init" type node are used. + +Talos etcd cluster can be recovered from a known snapshot with '--recover-from=' flag. + +``` +talosctl bootstrap [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for bootstrap + -n, --nodes strings target the specified nodes + --recover-from string recover etcd cluster from the snapshot + --recover-skip-hash-check skip integrity check when recovering etcd (use when recovering from data directory copy) + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl cgroups + +Retrieve cgroups usage information + +### Synopsis + +The cgroups command fetches control group v2 (cgroupv2) usage details from the machine. +Several presets are available to focus on specific cgroup subsystems: + +* cpu +* cpuset +* io +* memory +* process +* swap + +You can specify the preset using the --preset flag. + +Alternatively, a custom schema can be provided using the --schema-file flag. +To see schema examples, refer to https://github.com/siderolabs/talos/tree/main/cmd/talosctl/cmd/talos/cgroupsprinter/schemas. + + +``` +talosctl cgroups [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for cgroups + -n, --nodes strings target the specified nodes + --preset string preset name (one of: [cpu cpuset io memory process swap]) + --schema-file string path to the columns schema file + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl cluster create + +Creates a local docker-based or QEMU-based kubernetes cluster + +``` +talosctl cluster create [flags] +``` + +### Options + +``` + --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") + --config-patch stringArray patch generated machineconfigs (applied to all node types), use @file to read a patch from file + --config-patch-control-plane stringArray patch generated machineconfigs (applied to 'init' and 'controlplane' types) + --config-patch-worker stringArray patch generated machineconfigs (applied to 'worker' type) + --control-plane-port int control plane port (load balancer and local API port) (default 6443) + --controlplanes int the number of controlplanes to create (default 1) + --cpus string the share of CPUs as fraction (each control plane/VM) (default "2.0") + --cpus-workers string the share of CPUs as fraction (each worker/VM) (default "2.0") + --custom-cni-url string install custom CNI from the URL (Talos cluster) + --dns-domain string the dns domain to use for cluster (default "cluster.local") + --endpoint string use endpoint instead of provider defaults + --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint + -i, --input-dir string location of pre-generated config files + --ipv4 enable IPv4 network in the cluster (default true) + --kubeprism-port int KubePrism port (set to 0 to disable) (default 7445) + --kubernetes-version string desired kubernetes version to run (default "1.34.0-rc.1") + --memory int the limit on memory usage in MB (each control plane/VM) (default 2048) + --memory-workers int the limit on memory usage in MB (each worker/VM) (default 2048) + --mtu int MTU of the cluster network (default 1500) + --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for + --registry-mirror strings list of registry mirrors to use in format: = + --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory + --skip-k8s-node-readiness-check skip k8s node readiness checks + --skip-kubeconfig skip merging kubeconfig from the created cluster + --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --wait wait for the cluster to be ready before returning (default true) + --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) + --wireguard-cidr string CIDR of the wireguard network + --with-apply-config enable apply config when the VM is starting in maintenance mode + --with-cluster-discovery enable cluster discovery (default true) + --with-debug enable debug in Talos config to send service logs to the console + --with-init-node create the cluster with an init node + --with-json-logs enable JSON logs receiver and configure Talos to send logs there + --with-kubespan enable KubeSpan system + --workers int the number of workers to create (default 1) + --arch string (qemu) cluster architecture (default "amd64") + --bad-rtc (qemu) launch VM with bad RTC state + --cni-bin-path strings (qemu) search path for CNI binaries (default [/home/user/.talos/cni/bin]) + --cni-bundle-url string (qemu) URL to download CNI bundle from (default "https://github.com/siderolabs/talos/releases/download/v1.11.0-alpha.3/talosctl-cni-bundle-${ARCH}.tar.gz") + --cni-cache-dir string (qemu) CNI cache directory path (default "/home/user/.talos/cni/cache") + --cni-conf-dir string (qemu) CNI config directory path (default "/home/user/.talos/cni/conf.d") + --config-injection-method string (qemu) a method to inject machine config: default is HTTP server, 'metal-iso' to mount an ISO + --disable-dhcp-hostname (qemu) skip announcing hostname via DHCP + --disk int (qemu) default limit on disk size in MB (each VM) (default 6144) + --disk-block-size uint (qemu) disk block size (default 512) + --disk-encryption-key-types stringArray (qemu) encryption key types to use for disk encryption (uuid, kms) (default [uuid]) + --disk-image-path string (qemu) disk image to use + --disk-preallocate (qemu) whether disk space should be preallocated (default true) + --encrypt-ephemeral (qemu) enable ephemeral partition encryption + --encrypt-state (qemu) enable state partition encryption + --encrypt-user-volumes (qemu) enable ephemeral partition encryption + --extra-boot-kernel-args string (qemu) add extra kernel args to the initial boot from vmlinuz and initramfs + --extra-disks int (qemu) number of extra disks to create for each worker VM + --extra-disks-drivers strings (qemu) driver for each extra disk (virtio, ide, ahci, scsi, nvme, megaraid) + --extra-disks-size int (qemu) default limit on disk size in MB (each VM) (default 5120) + --extra-uefi-search-paths strings (qemu) additional search paths for UEFI firmware (only applies when UEFI is enabled) + --initrd-path string (qemu) initramfs image to use (default "_out/initramfs-${ARCH}.xz") + --install-image string (qemu) the installer image to use (default "ghcr.io/siderolabs/installer:latest") + --ipv6 (qemu) enable IPv6 network in the cluster + --ipxe-boot-script string (qemu) iPXE boot script (URL) to use + --iso-path string (qemu) the ISO path to use for the initial boot + --nameservers strings (qemu) list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) + --no-masquerade-cidrs strings (qemu) list of CIDRs to exclude from NAT + --uki-path string (qemu) the UKI image path to use for the initial boot + --usb-path string (qemu) the USB stick image path to use for the initial boot + --use-vip (qemu) use a virtual IP for the controlplane endpoint instead of the loadbalancer + --user-volumes strings (qemu) list of user volumes to create for each VM in format: ::: + --vmlinuz-path string (qemu) the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") + --with-bootloader (qemu) enable bootloader to load kernel and initramfs from disk image after install (default true) + --with-firewall string (qemu) inject firewall rules into the cluster, value is default policy - accept/block + --with-iommu (qemu) enable IOMMU support, this also add a new PCI root port and an interface attached to it + --with-network-bandwidth int (qemu) specify bandwidth restriction (in kbps) on the bridge interface + --with-network-chaos (qemu) enable to use network chaos parameters + --with-network-jitter duration (qemu) specify jitter on the bridge interface + --with-network-latency duration (qemu) specify latency on the bridge interface + --with-network-packet-corrupt float (qemu) specify percent of corrupt packets on the bridge interface. e.g. 50% = 0.50 (default: 0.0) + --with-network-packet-loss float (qemu) specify percent of packet loss on the bridge interface. e.g. 50% = 0.50 (default: 0.0) + --with-network-packet-reorder float (qemu) specify percent of reordered packets on the bridge interface. e.g. 50% = 0.50 (default: 0.0) + --with-siderolink true (qemu) enables the use of siderolink agent as configuration apply mechanism. true or `wireguard` enables the agent, `tunnel` enables the agent with grpc tunneling (default none) + --with-tpm1_2 (qemu) enable TPM 1.2 emulation support using swtpm + --with-tpm2 (qemu) enable TPM 2.0 emulation support using swtpm + --with-uefi (qemu) enable UEFI on x86_64 architecture (default true) + --with-uuid-hostnames (qemu) use machine UUIDs as default hostnames + --docker-disable-ipv6 (docker) skip enabling IPv6 in containers + --docker-host-ip string (docker) Host IP to forward exposed ports to (default "0.0.0.0") + -p, --exposed-ports string (docker) Comma-separated list of ports/protocols to expose on init node. Ex -p :/ + --image string (docker) the image to use (default "ghcr.io/siderolabs/talos:latest") + --mount mount (docker) attach a mount to the container + -h, --help help for create +``` + +### Options inherited from parent commands + +``` + --name string the name of the cluster (default "talos-default") + --provisioner string Talos cluster provisioner to use (default "docker") + --state string directory path to store cluster state (default "/home/user/.talos/clusters") +``` + +### SEE ALSO + +* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters + +## talosctl cluster destroy + +Destroys a local docker-based or firecracker-based kubernetes cluster + +``` +talosctl cluster destroy [flags] +``` + +### Options + +``` + -f, --force force deletion of cluster directory if there were errors + -h, --help help for destroy + --save-cluster-logs-archive-path string save cluster logs archive to the specified file on destroy + --save-support-archive-path string save support archive to the specified file on destroy +``` + +### Options inherited from parent commands + +``` + --name string the name of the cluster (default "talos-default") + --provisioner string Talos cluster provisioner to use (default "docker") + --state string directory path to store cluster state (default "/home/user/.talos/clusters") +``` + +### SEE ALSO + +* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters + +## talosctl cluster show + +Shows info about a local provisioned kubernetes cluster + +``` +talosctl cluster show [flags] +``` + +### Options + +``` + -h, --help help for show +``` + +### Options inherited from parent commands + +``` + --name string the name of the cluster (default "talos-default") + --provisioner string Talos cluster provisioner to use (default "docker") + --state string directory path to store cluster state (default "/home/user/.talos/clusters") +``` + +### SEE ALSO + +* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters + +## talosctl cluster + +A collection of commands for managing local docker-based or QEMU-based clusters + +### Options + +``` + -h, --help help for cluster + --name string the name of the cluster (default "talos-default") + --provisioner string Talos cluster provisioner to use (default "docker") + --state string directory path to store cluster state (default "/home/user/.talos/clusters") +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster +* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster +* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster + +## talosctl completion + +Output shell completion code for the specified shell (bash, fish or zsh) + +### Synopsis + +Output shell completion code for the specified shell (bash, fish or zsh). +The shell code must be evaluated to provide interactive +completion of talosctl commands. This can be done by sourcing it from +the .bash_profile. + +Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 + +``` +talosctl completion SHELL [flags] +``` + +### Examples + +``` +# Installing bash completion on macOS using homebrew +## If running Bash 3.2 included with macOS + brew install bash-completion +## or, if running Bash 4.1+ + brew install bash-completion@2 +## If talosctl is installed via homebrew, this should start working immediately. +## If you've installed via other means, you may need add the completion to your completion directory + talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl + +# Installing bash completion on Linux +## If bash-completion is not installed on Linux, please install the 'bash-completion' package +## via your distribution's package manager. +## Load the talosctl completion code for bash into the current shell + source <(talosctl completion bash) +## Write bash completion code to a file and source if from .bash_profile + talosctl completion bash > ~/.talos/completion.bash.inc + printf " + # talosctl shell completion + source '$HOME/.talos/completion.bash.inc' + " >> $HOME/.bash_profile + source $HOME/.bash_profile +# Load the talosctl completion code for fish[1] into the current shell + talosctl completion fish | source +# Set the talosctl completion code for fish[1] to autoload on startup + talosctl completion fish > ~/.config/fish/completions/talosctl.fish +# Load the talosctl completion code for zsh[1] into the current shell + source <(talosctl completion zsh) +# Set the talosctl completion code for zsh[1] to autoload on startup + talosctl completion zsh > "${fpath[1]}/_talosctl" +``` + +### Options + +``` + -h, --help help for completion +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl config add + +Add a new context + +``` +talosctl config add [flags] +``` + +### Options + +``` + --ca string the path to the CA certificate + --crt string the path to the certificate + -h, --help help for add + --key string the path to the key +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config context + +Set the current context + +``` +talosctl config context [flags] +``` + +### Options + +``` + -h, --help help for context +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config contexts + +List defined contexts + +``` +talosctl config contexts [flags] +``` + +### Options + +``` + -h, --help help for contexts +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config endpoint + +Set the endpoint(s) for the current context + +``` +talosctl config endpoint ... [flags] +``` + +### Options + +``` + -h, --help help for endpoint +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config info + +Show information about the current context + +``` +talosctl config info [flags] +``` + +### Options + +``` + -h, --help help for info + -o, --output string output format (json|yaml|text). Default text. (default "text") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config merge + +Merge additional contexts from another client configuration file + +### Synopsis + +Contexts with the same name are renamed while merging configs. + +``` +talosctl config merge [flags] +``` + +### Options + +``` + -h, --help help for merge +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config new + +Generate a new client configuration file + +``` +talosctl config new [] [flags] +``` + +### Options + +``` + --crt-ttl duration certificate TTL (default 8760h0m0s) + -h, --help help for new + --roles strings roles (default [os:admin]) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config node + +Set the node(s) for the current context + +``` +talosctl config node ... [flags] +``` + +### Options + +``` + -h, --help help for node +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config remove + +Remove contexts + +``` +talosctl config remove [flags] +``` + +### Options + +``` + --dry-run dry run + -h, --help help for remove + -y, --noconfirm do not ask for confirmation +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config + +Manage the client configuration file (talosconfig) + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for config + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl config add](#talosctl-config-add) - Add a new context +* [talosctl config context](#talosctl-config-context) - Set the current context +* [talosctl config contexts](#talosctl-config-contexts) - List defined contexts +* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context +* [talosctl config info](#talosctl-config-info) - Show information about the current context +* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another client configuration file +* [talosctl config new](#talosctl-config-new) - Generate a new client configuration file +* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context +* [talosctl config remove](#talosctl-config-remove) - Remove contexts + +## talosctl conformance kubernetes + +Run Kubernetes conformance tests + +``` +talosctl conformance kubernetes [flags] +``` + +### Options + +``` + -h, --help help for kubernetes + --mode string conformance test mode: [fast, certified] (default "fast") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl conformance](#talosctl-conformance) - Run conformance tests + +## talosctl conformance + +Run conformance tests + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for conformance + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl conformance kubernetes](#talosctl-conformance-kubernetes) - Run Kubernetes conformance tests + +## talosctl containers + +List containers + +``` +talosctl containers [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for containers + -k, --kubernetes use the k8s.io containerd namespace + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl copy + +Copy data out from the node + +### Synopsis + +Creates an .tar.gz archive at the node starting at and +streams it back to the client. + +If '-' is given for , archive is written to stdout. +Otherwise archive is extracted to which should be an empty directory or +talosctl creates a directory if doesn't exist. Command doesn't preserve +ownership and access mode for the files in extract mode, while streamed .tar archive +captures ownership and permission bits. + +``` +talosctl copy -| [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for copy + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl dashboard + +Cluster dashboard with node overview, logs and real-time metrics + +### Synopsis + +Provide a text-based UI to navigate node overview, logs and real-time metrics. + +Keyboard shortcuts: + + - h, - switch one node to the left + - l, - switch one node to the right + - j, - scroll logs/process list down + - k, - scroll logs/process list up + - - scroll logs/process list half page down + - - scroll logs/process list half page up + - - scroll logs/process list one page down + - - scroll logs/process list one page up + + +``` +talosctl dashboard [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for dashboard + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + -d, --update-interval duration interval between updates (default 3s) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl dmesg + +Retrieve kernel logs + +``` +talosctl dmesg [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --follow specify if the kernel log should be streamed + -h, --help help for dmesg + -n, --nodes strings target the specified nodes + --tail specify if only new messages should be sent (makes sense only when combined with --follow) + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl edit + +Edit a resource from the default editor. + +### Synopsis + +The edit command allows you to directly edit any API resource +you can retrieve via the command line tools. + +It will open the editor defined by your TALOS_EDITOR, +or EDITOR environment variables, or fall back to 'vi' for Linux +or 'notepad' for Windows. + +``` +talosctl edit [] [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --dry-run do not apply the change after editing and print the change summary instead + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for edit + -m, --mode auto, no-reboot, reboot, staged, try apply config mode (default auto) + --namespace string resource namespace (default is to use default namespace per resource) + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --timeout duration the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl etcd alarm disarm + +Disarm the etcd alarms for the node. + +``` +talosctl etcd alarm disarm [flags] +``` + +### Options + +``` + -h, --help help for disarm +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd alarm](#talosctl-etcd-alarm) - Manage etcd alarms + +## talosctl etcd alarm list + +List the etcd alarms for the node. + +``` +talosctl etcd alarm list [flags] +``` + +### Options + +``` + -h, --help help for list +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd alarm](#talosctl-etcd-alarm) - Manage etcd alarms + +## talosctl etcd alarm + +Manage etcd alarms + +### Options + +``` + -h, --help help for alarm +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd +* [talosctl etcd alarm disarm](#talosctl-etcd-alarm-disarm) - Disarm the etcd alarms for the node. +* [talosctl etcd alarm list](#talosctl-etcd-alarm-list) - List the etcd alarms for the node. + +## talosctl etcd defrag + +Defragment etcd database on the node + +### Synopsis + +Defragmentation is a maintenance operation that releases unused space from the etcd database file. +Defragmentation is a resource heavy operation and should be performed only when necessary on a single node at a time. + +``` +talosctl etcd defrag [flags] +``` + +### Options + +``` + -h, --help help for defrag +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd downgrade cancel + +Cancel etcd storage system downgrade. + +``` +talosctl etcd downgrade cancel [flags] +``` + +### Options + +``` + -h, --help help for cancel +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd downgrade](#talosctl-etcd-downgrade) - Manage etcd storage system downgrades + +## talosctl etcd downgrade enable + +Enable etcd storage system downgrade to the specified version. + +``` +talosctl etcd downgrade enable [flags] +``` + +### Options + +``` + -h, --help help for enable +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd downgrade](#talosctl-etcd-downgrade) - Manage etcd storage system downgrades + +## talosctl etcd downgrade validate + +Validate if the etcd storage system can be downgraded to the specified version. + +``` +talosctl etcd downgrade validate [flags] +``` + +### Options + +``` + -h, --help help for validate +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd downgrade](#talosctl-etcd-downgrade) - Manage etcd storage system downgrades + +## talosctl etcd downgrade + +Manage etcd storage system downgrades + +### Options + +``` + -h, --help help for downgrade +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd +* [talosctl etcd downgrade cancel](#talosctl-etcd-downgrade-cancel) - Cancel etcd storage system downgrade. +* [talosctl etcd downgrade enable](#talosctl-etcd-downgrade-enable) - Enable etcd storage system downgrade to the specified version. +* [talosctl etcd downgrade validate](#talosctl-etcd-downgrade-validate) - Validate if the etcd storage system can be downgraded to the specified version. + +## talosctl etcd forfeit-leadership + +Tell node to forfeit etcd cluster leadership + +``` +talosctl etcd forfeit-leadership [flags] +``` + +### Options + +``` + -h, --help help for forfeit-leadership +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd leave + +Tell nodes to leave etcd cluster + +``` +talosctl etcd leave [flags] +``` + +### Options + +``` + -h, --help help for leave +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd members + +Get the list of etcd cluster members + +``` +talosctl etcd members [flags] +``` + +### Options + +``` + -h, --help help for members +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd remove-member + +Remove the node from etcd cluster + +### Synopsis + +Use this command only if you want to remove a member which is in broken state. +If there is no access to the node, or the node can't access etcd to call etcd leave. +Always prefer etcd leave over this command. + +``` +talosctl etcd remove-member [flags] +``` + +### Options + +``` + -h, --help help for remove-member +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd snapshot + +Stream snapshot of the etcd node to the path. + +``` +talosctl etcd snapshot [flags] +``` + +### Options + +``` + -h, --help help for snapshot +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd status + +Get the status of etcd cluster member + +### Synopsis + +Returns the status of etcd member on the node, use multiple nodes to get status of all members. + +``` +talosctl etcd status [flags] +``` + +### Options + +``` + -h, --help help for status +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd + +Manage etcd + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for etcd + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl etcd alarm](#talosctl-etcd-alarm) - Manage etcd alarms +* [talosctl etcd defrag](#talosctl-etcd-defrag) - Defragment etcd database on the node +* [talosctl etcd downgrade](#talosctl-etcd-downgrade) - Manage etcd storage system downgrades +* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership +* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster +* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members +* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster +* [talosctl etcd snapshot](#talosctl-etcd-snapshot) - Stream snapshot of the etcd node to the path. +* [talosctl etcd status](#talosctl-etcd-status) - Get the status of etcd cluster member + +## talosctl events + +Stream runtime events + +``` +talosctl events [flags] +``` + +### Options + +``` + --actor-id string filter events by the specified actor ID (default is no filter) + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --duration duration show events for the past duration interval (one second resolution, default is to show no history) + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for events + -n, --nodes strings target the specified nodes + --since string show events after the specified event ID (default is to show no history) + --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl gen ca + +Generates a self-signed X.509 certificate authority + +``` +talosctl gen ca [flags] +``` + +### Options + +``` + -h, --help help for ca + --hours int the hours from now on which the certificate validity period ends (default 87600) + --organization string X.509 distinguished name for the Organization + --rsa generate in RSA format +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen config + +Generates a set of configuration files for Talos cluster + +### Synopsis + +The cluster endpoint is the URL for the Kubernetes API. If you decide to use +a control plane node, common in a single node control plane setup, use port 6443 as +this is the port that the API server binds to on every control plane node. For an HA +setup, usually involving a load balancer, use the IP and port of the load balancer. + +``` +talosctl gen config [flags] +``` + +### Options + +``` + --additional-sans strings additional Subject-Alt-Names for the APIServer certificate + --config-patch stringArray patch generated machineconfigs (applied to all node types), use @file to read a patch from file + --config-patch-control-plane stringArray patch generated machineconfigs (applied to 'init' and 'controlplane' types) + --config-patch-worker stringArray patch generated machineconfigs (applied to 'worker' type) + --dns-domain string the dns domain to use for cluster (default "cluster.local") + -h, --help help for config + --install-disk string the disk to install to (default "/dev/sda") + --install-image string the image used to perform an installation (default "ghcr.io/siderolabs/installer:latest") + --kubernetes-version string desired kubernetes version to run (default "1.34.0-rc.1") + -o, --output string destination to output generated files. when multiple output types are specified, it must be a directory. for a single output type, it must either be a file path, or "-" for stdout + -t, --output-types strings types of outputs to be generated. valid types are: ["controlplane" "worker" "talosconfig"] (default [controlplane,worker,talosconfig]) + -p, --persist the desired persist value for configs (default true) + --registry-mirror strings list of registry mirrors to use in format: = + --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) + --version string the desired machine config version to generate (default "v1alpha1") + --with-cluster-discovery enable cluster discovery feature (default true) + --with-docs renders all machine configs adding the documentation for each field (default true) + --with-examples renders all machine configs with the commented examples (default true) + --with-kubespan enable KubeSpan feature + --with-secrets string use a secrets file generated using 'gen secrets' +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen crt + +Generates an X.509 Ed25519 certificate + +``` +talosctl gen crt [flags] +``` + +### Options + +``` + --ca string path to the PEM encoded CERTIFICATE + --csr string path to the PEM encoded CERTIFICATE REQUEST + -h, --help help for crt + --hours int the hours from now on which the certificate validity period ends (default 24) + --name string the basename of the generated file +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen csr + +Generates a CSR using an Ed25519 private key + +``` +talosctl gen csr [flags] +``` + +### Options + +``` + -h, --help help for csr + --ip string generate the certificate for this IP address + --key string path to the PEM encoded EC or RSA PRIVATE KEY + --roles strings roles (default [os:admin]) +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen key + +Generates an Ed25519 private key + +``` +talosctl gen key [flags] +``` + +### Options + +``` + -h, --help help for key + --name string the basename of the generated file +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen keypair + +Generates an X.509 Ed25519 key pair + +``` +talosctl gen keypair [flags] +``` + +### Options + +``` + -h, --help help for keypair + --ip string generate the certificate for this IP address + --organization string X.509 distinguished name for the Organization +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen secrets + +Generates a secrets bundle file which can later be used to generate a config + +``` +talosctl gen secrets [flags] +``` + +### Options + +``` + --from-controlplane-config string use the provided controlplane Talos machine configuration as input + -p, --from-kubernetes-pki string use a Kubernetes PKI directory (e.g. /etc/kubernetes/pki) as input + -h, --help help for secrets + -t, --kubernetes-bootstrap-token string use the provided bootstrap token as input + -o, --output-file string path of the output file (default "secrets.yaml") + --talos-version string the desired Talos version to generate secrets bundle for (backwards compatibility, e.g. v0.8) +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen secureboot database + +Generates a UEFI database to enroll the signing certificate + +``` +talosctl gen secureboot database [flags] +``` + +### Options + +``` + --enrolled-certificate string path to the certificate to enroll (default "_out/uki-signing-cert.pem") + -h, --help help for database + --include-well-known-uefi-certs include well-known UEFI (Microsoft) certificates in the database + --signing-certificate string path to the certificate used to sign the database (default "_out/uki-signing-cert.pem") + --signing-key string path to the key used to sign the database (default "_out/uki-signing-key.pem") +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files + -o, --output string path to the directory storing the generated files (default "_out") +``` + +### SEE ALSO + +* [talosctl gen secureboot](#talosctl-gen-secureboot) - Generates secrets for the SecureBoot process + +## talosctl gen secureboot pcr + +Generates a key which is used to sign TPM PCR values + +``` +talosctl gen secureboot pcr [flags] +``` + +### Options + +``` + -h, --help help for pcr +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files + -o, --output string path to the directory storing the generated files (default "_out") +``` + +### SEE ALSO + +* [talosctl gen secureboot](#talosctl-gen-secureboot) - Generates secrets for the SecureBoot process + +## talosctl gen secureboot uki + +Generates a certificate which is used to sign boot assets (UKI) + +``` +talosctl gen secureboot uki [flags] +``` + +### Options + +``` + --common-name string common name for the certificate (default "Test UKI Signing Key") + -h, --help help for uki +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files + -o, --output string path to the directory storing the generated files (default "_out") +``` + +### SEE ALSO + +* [talosctl gen secureboot](#talosctl-gen-secureboot) - Generates secrets for the SecureBoot process + +## talosctl gen secureboot + +Generates secrets for the SecureBoot process + +### Options + +``` + -h, --help help for secureboot + -o, --output string path to the directory storing the generated files (default "_out") +``` + +### Options inherited from parent commands + +``` + -f, --force will overwrite existing files +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys +* [talosctl gen secureboot database](#talosctl-gen-secureboot-database) - Generates a UEFI database to enroll the signing certificate +* [talosctl gen secureboot pcr](#talosctl-gen-secureboot-pcr) - Generates a key which is used to sign TPM PCR values +* [talosctl gen secureboot uki](#talosctl-gen-secureboot-uki) - Generates a certificate which is used to sign boot assets (UKI) + +## talosctl gen + +Generate CAs, certificates, and private keys + +### Options + +``` + -f, --force will overwrite existing files + -h, --help help for gen +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority +* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster +* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate +* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key +* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key +* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair +* [talosctl gen secrets](#talosctl-gen-secrets) - Generates a secrets bundle file which can later be used to generate a config +* [talosctl gen secureboot](#talosctl-gen-secureboot) - Generates secrets for the SecureBoot process + +## talosctl get + +Get a specific resource or list of resources (use 'talosctl get rd' to see all available resource types). + +### Synopsis + +Similar to 'kubectl get', 'talosctl get' returns a set of resources from the OS. +To get a list of all available resource definitions, issue 'talosctl get rd' + +``` +talosctl get [] [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for get + -i, --insecure get resources using the insecure (encrypted with no auth) maintenance service + --namespace string resource namespace (default is to use default namespace per resource) + -n, --nodes strings target the specified nodes + -o, --output string output mode (json, table, yaml, jsonpath) (default "table") + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + -w, --watch watch resource changes +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl health + +Check cluster health + +``` +talosctl health [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --control-plane-nodes strings specify IPs of control plane nodes + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for health + --init-node string specify IPs of init node + --k8s-endpoint string use endpoint instead of kubeconfig default + -n, --nodes strings target the specified nodes + --run-e2e run Kubernetes e2e test + --server run server-side check (default true) + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) + --worker-nodes strings specify IPs of worker nodes +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl image cache-create + +Create a cache of images in OCI format into a directory + +### Synopsis + +Create a cache of images in OCI format into a directory + +``` +talosctl image cache-create [flags] +``` + +### Examples + +``` +talosctl images cache-create --images=ghcr.io/siderolabs/kubelet:v1.34.0-rc.1 --image-cache-path=/tmp/talos-image-cache + +Alternatively, stdin can be piped to the command: +talosctl images default | talosctl images cache-create --image-cache-path=/tmp/talos-image-cache --images=- + +``` + +### Options + +``` + --force force overwrite of existing image cache + -h, --help help for cache-create + --image-cache-path string directory to save the image cache in OCI format + --image-layer-cache-path string directory to save the image layer cache + --images strings images to cache + --insecure allow insecure registries + --platform string platform to use for the cache (default "linux/amd64") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl image](#talosctl-image) - Manage CRI container images + +## talosctl image default + +List the default images used by Talos + +``` +talosctl image default [flags] +``` + +### Options + +``` + -h, --help help for default +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl image](#talosctl-image) - Manage CRI container images + +## talosctl image list + +List CRI images + +``` +talosctl image list [flags] +``` + +### Options + +``` + -h, --help help for list +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl image](#talosctl-image) - Manage CRI container images + +## talosctl image pull + +Pull an image into CRI + +``` +talosctl image pull [flags] +``` + +### Options + +``` + -h, --help help for pull +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl image](#talosctl-image) - Manage CRI container images + +## talosctl image + +Manage CRI container images + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for image + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl image cache-create](#talosctl-image-cache-create) - Create a cache of images in OCI format into a directory +* [talosctl image default](#talosctl-image-default) - List the default images used by Talos +* [talosctl image list](#talosctl-image-list) - List CRI images +* [talosctl image pull](#talosctl-image-pull) - Pull an image into CRI + +## talosctl inject serviceaccount + +Inject Talos API ServiceAccount into Kubernetes manifests + +``` +talosctl inject serviceaccount [--roles=','] -f [flags] +``` + +### Examples + +``` +talosctl inject serviceaccount --roles="os:admin" -f deployment.yaml > deployment-injected.yaml + +Alternatively, stdin can be piped to the command: +cat deployment.yaml | talosctl inject serviceaccount --roles="os:admin" -f - > deployment-injected.yaml + +``` + +### Options + +``` + -f, --file string file with Kubernetes manifests to be injected with ServiceAccount + -h, --help help for serviceaccount + -r, --roles strings roles to add to the generated ServiceAccount manifests (default [os:reader]) +``` + +### SEE ALSO + +* [talosctl inject](#talosctl-inject) - Inject Talos API resources into Kubernetes manifests + +## talosctl inject + +Inject Talos API resources into Kubernetes manifests + +### Options + +``` + -h, --help help for inject +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl inject serviceaccount](#talosctl-inject-serviceaccount) - Inject Talos API ServiceAccount into Kubernetes manifests + +## talosctl inspect dependencies + +Inspect controller-resource dependencies as graphviz graph. + +### Synopsis + +Inspect controller-resource dependencies as graphviz graph. + +Pipe the output of the command through the "dot" program (part of graphviz package) +to render the graph: + + talosctl inspect dependencies | dot -Tpng > graph.png + + +``` +talosctl inspect dependencies [flags] +``` + +### Options + +``` + -h, --help help for dependencies + --with-resources display live resource information with dependencies +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos + +## talosctl inspect + +Inspect internals of Talos + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for inspect + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. + +## talosctl kubeconfig + +Download the admin kubeconfig from the node + +### Synopsis + +Download the admin kubeconfig from the node. +If merge flag is true, config will be merged with ~/.kube/config or [local-path] if specified. +Otherwise, kubeconfig will be written to PWD or [local-path] if specified. + +If merge flag is false and [local-path] is "-", config will be written to stdout. + +``` +talosctl kubeconfig [local-path] [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge + --force-context-name string Force context name for kubeconfig merge + -h, --help help for kubeconfig + -m, --merge Merge with existing kubeconfig (default true) + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl list + +Retrieve a directory listing + +``` +talosctl list [path] [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -d, --depth int32 maximum recursion depth (default 1) + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for list + -H, --humanize humanize size and time in the output + -l, --long display additional file details + -n, --nodes strings target the specified nodes + -r, --recurse recurse into subdirectories + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + -t, --type strings filter by specified types: + f regular file + d directory + l, L symbolic link +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl logs + +Retrieve logs for a service + +``` +talosctl logs [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --follow specify if the logs should be streamed + -h, --help help for logs + -k, --kubernetes use the k8s.io containerd namespace + -n, --nodes strings target the specified nodes + --tail int32 lines of log file to display (default is to show from the beginning) (default -1) + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl machineconfig gen + +Generates a set of configuration files for Talos cluster + +### Synopsis + +The cluster endpoint is the URL for the Kubernetes API. If you decide to use +a control plane node, common in a single node control plane setup, use port 6443 as +this is the port that the API server binds to on every control plane node. For an HA +setup, usually involving a load balancer, use the IP and port of the load balancer. + +``` +talosctl machineconfig gen [flags] +``` + +### Options + +``` + -h, --help help for gen +``` + +### SEE ALSO + +* [talosctl machineconfig](#talosctl-machineconfig) - Machine config related commands + +## talosctl machineconfig patch + +Patch a machine config + +``` +talosctl machineconfig patch [flags] +``` + +### Options + +``` + -h, --help help for patch + -o, --output string output destination. if not specified, output will be printed to stdout + -p, --patch stringArray patch generated machineconfigs (applied to all node types), use @file to read a patch from file +``` + +### SEE ALSO + +* [talosctl machineconfig](#talosctl-machineconfig) - Machine config related commands + +## talosctl machineconfig + +Machine config related commands + +### Options + +``` + -h, --help help for machineconfig +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl machineconfig gen](#talosctl-machineconfig-gen) - Generates a set of configuration files for Talos cluster +* [talosctl machineconfig patch](#talosctl-machineconfig-patch) - Patch a machine config + +## talosctl memory + +Show memory usage + +``` +talosctl memory [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for memory + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + -v, --verbose display extended memory statistics +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl meta delete + +Delete a key from the META partition. + +``` +talosctl meta delete key [flags] +``` + +### Options + +``` + -h, --help help for delete +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -i, --insecure write|delete meta using the insecure (encrypted with no auth) maintenance service + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl meta](#talosctl-meta) - Write and delete keys in the META partition + +## talosctl meta write + +Write a key-value pair to the META partition. + +``` +talosctl meta write key value [flags] +``` + +### Options + +``` + -h, --help help for write +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -i, --insecure write|delete meta using the insecure (encrypted with no auth) maintenance service + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl meta](#talosctl-meta) - Write and delete keys in the META partition + +## talosctl meta + +Write and delete keys in the META partition + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for meta + -i, --insecure write|delete meta using the insecure (encrypted with no auth) maintenance service + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl meta delete](#talosctl-meta-delete) - Delete a key from the META partition. +* [talosctl meta write](#talosctl-meta-write) - Write a key-value pair to the META partition. + +## talosctl mounts + +List mounts + +``` +talosctl mounts [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for mounts + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl netstat + +Show network connections and sockets + +### Synopsis + +Show network connections and sockets. + +You can pass an optional argument to view a specific pod's connections. +To do this, format the argument as "namespace/pod". +Note that only pods with a pod network namespace are allowed. +If you don't pass an argument, the command will show host connections. + +``` +talosctl netstat [flags] +``` + +### Options + +``` + -a, --all display all sockets states (default: connected) + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -x, --extend show detailed socket information + -h, --help help for netstat + -4, --ipv4 display only ipv4 sockets + -6, --ipv6 display only ipv6 sockets + -l, --listening display listening server sockets + -n, --nodes strings target the specified nodes + -k, --pods show sockets used by Kubernetes pods + -p, --programs show process using socket + -w, --raw display only RAW sockets + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + -t, --tcp display only TCP sockets + -o, --timers display timers + -u, --udp display only UDP sockets + -U, --udplite display only UDPLite sockets + -v, --verbose display sockets of all supported transport protocols +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl patch + +Update field(s) of a resource using a JSON patch. + +``` +talosctl patch [] [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --dry-run print the change summary and patch preview without applying the changes + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for patch + -m, --mode auto, no-reboot, reboot, staged, try apply config mode (default auto) + --namespace string resource namespace (default is to use default namespace per resource) + -n, --nodes strings target the specified nodes + -p, --patch stringArray the patch to be applied to the resource file, use @file to read a patch from file. + --patch-file string a file containing a patch to be applied to the resource. + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --timeout duration the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl pcap + +Capture the network packets from the node. + +### Synopsis + +The command launches packet capture on the node and streams back the packets as raw pcap file. + +Default behavior is to decode the packets with internal decoder to stdout: + + talosctl pcap -i eth0 + +Raw pcap file can be saved with `--output` flag: + + talosctl pcap -i eth0 --output eth0.pcap + +Output can be piped to tcpdump: + + talosctl pcap -i eth0 -o - | tcpdump -vvv -r - + +BPF filter can be applied, but it has to compiled to BPF instructions first using tcpdump. +Correct link type should be specified for the tcpdump: EN10MB for Ethernet links and RAW +for e.g. Wireguard tunnels: + + talosctl pcap -i eth0 --bpf-filter "$(tcpdump -dd -y EN10MB 'tcp and dst port 80')" + + talosctl pcap -i kubespan --bpf-filter "$(tcpdump -dd -y RAW 'port 50000')" + +As packet capture is transmitted over the network, it is recommended to filter out the Talos API traffic, +e.g. by excluding packets with the port 50000. + + +``` +talosctl pcap [flags] +``` + +### Options + +``` + --bpf-filter string bpf filter to apply, tcpdump -dd format + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --duration duration duration of the capture + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for pcap + -i, --interface string interface name to capture packets on (default "eth0") + -n, --nodes strings target the specified nodes + -o, --output string if not set, decode packets to stdout; if set write raw pcap data to a file, use '-' for stdout + --promiscuous put interface into promiscuous mode + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl processes + +List running processes + +``` +talosctl processes [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for processes + -n, --nodes strings target the specified nodes + -s, --sort string Column to sort output by. [rss|cpu] (default "rss") + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + -w, --watch Stream running processes +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl read + +Read a file on the machine + +``` +talosctl read [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for read + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl reboot + +Reboot a node + +``` +talosctl reboot [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --debug debug operation from kernel logs. --wait is set to true when this flag is set + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for reboot + -m, --mode string select the reboot mode: "default", "powercycle" (skips kexec) (default "default") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --timeout duration time to wait for the operation is complete if --debug or --wait is set (default 30m0s) + --wait wait for the operation to complete, tracking its progress. always set to true when --debug is set (default true) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl reset + +Reset a node + +``` +talosctl reset [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --debug debug operation from kernel logs. --wait is set to true when this flag is set + -e, --endpoints strings override default endpoints in Talos configuration + --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) + -h, --help help for reset + --insecure reset using the insecure (encrypted with no auth) maintenance service + -n, --nodes strings target the specified nodes + --reboot if true, reboot the node after resetting instead of shutting down + --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --timeout duration time to wait for the operation is complete if --debug or --wait is set (default 30m0s) + --user-disks-to-wipe strings if set, wipes defined devices in the list + --wait wait for the operation to complete, tracking its progress. always set to true when --debug is set (default true) + --wipe-mode all, system-disk, user-disks disk reset mode (default all) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl restart + +Restart a process + +``` +talosctl restart [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for restart + -k, --kubernetes use the k8s.io containerd namespace + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl rollback + +Rollback a node to the previous installation + +``` +talosctl rollback [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for rollback + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl rotate-ca + +Rotate cluster CAs (Talos and Kubernetes APIs). + +### Synopsis + +The command can rotate both Talos and Kubernetes root CAs (for the API). +By default both CAs are rotated, but you can choose to rotate just one or another. +The command starts by generating new CAs, and gracefully applying it to the cluster. + +For Kubernetes, the command only rotates the API server issuing CA, and other Kubernetes +PKI can be rotated by applying machine config changes to the controlplane nodes. + +``` +talosctl rotate-ca [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --control-plane-nodes strings specify IPs of control plane nodes + --dry-run dry-run mode (no changes to the cluster) (default true) + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for rotate-ca + --init-node string specify IPs of init node + --k8s-endpoint string use endpoint instead of kubeconfig default + --kubernetes rotate Kubernetes API CA (default true) + -n, --nodes strings target the specified nodes + -o, --output talosconfig path to the output new talosconfig (default "talosconfig") + --talos rotate Talos API CA (default true) + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --with-docs patch all machine configs adding the documentation for each field (default true) + --with-examples patch all machine configs with the commented examples (default true) + --worker-nodes strings specify IPs of worker nodes +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl service + +Retrieve the state of a service (or all services), control service state + +### Synopsis + +Service control command. If run without arguments, lists all the services and their state. +If service ID is specified, default action 'status' is executed which shows status of a single list service. +With actions 'start', 'stop', 'restart', service state is updated respectively. + +``` +talosctl service [ [start|stop|restart|status]] [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for service + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl shutdown + +Shutdown a node + +``` +talosctl shutdown [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --debug debug operation from kernel logs. --wait is set to true when this flag is set + -e, --endpoints strings override default endpoints in Talos configuration + --force if true, force a node to shutdown without a cordon/drain + -h, --help help for shutdown + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --timeout duration time to wait for the operation is complete if --debug or --wait is set (default 30m0s) + --wait wait for the operation to complete, tracking its progress. always set to true when --debug is set (default true) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl stats + +Get container stats + +``` +talosctl stats [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for stats + -k, --kubernetes use the k8s.io containerd namespace + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl support + +Dump debug information about the cluster + +### Synopsis + +Generated bundle contains the following debug information: + +- For each node: + + - Kernel logs. + - All Talos internal services logs. + - All kube-system pods logs. + - Talos COSI resources without secrets. + - COSI runtime state graph. + - Processes snapshot. + - IO pressure snapshot. + - Mounts list. + - PCI devices info. + - Talos version. + +- For the cluster: + + - Kubernetes nodes and kube-system pods manifests. + + +``` +talosctl support [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for support + -n, --nodes strings target the specified nodes + -w, --num-workers int number of workers per node (default 1) + -O, --output string output file to write support archive to + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + -v, --verbose verbose output +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl time + +Gets current server time + +``` +talosctl time [--check server] [flags] +``` + +### Options + +``` + -c, --check string checks server time against specified ntp server + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for time + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl upgrade + +Upgrade Talos on the target node + +``` +talosctl upgrade [flags] +``` + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --debug debug operation from kernel logs. --wait is set to true when this flag is set + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) + -h, --help help for upgrade + -i, --image string the container image to use for performing the install (default "ghcr.io/siderolabs/installer:v1.11.0-alpha.3") + --insecure upgrade using the insecure (encrypted with no auth) maintenance service + -n, --nodes strings target the specified nodes + -m, --reboot-mode string select the reboot mode during upgrade. Mode "powercycle" bypasses kexec. Valid values are: ["default" "powercycle"]. (default "default") + -s, --stage stage the upgrade to perform it after a reboot + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --timeout duration time to wait for the operation is complete if --debug or --wait is set (default 30m0s) + --wait wait for the operation to complete, tracking its progress. always set to true when --debug is set (default true) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl upgrade-k8s + +Upgrade Kubernetes control plane in the Talos cluster. + +### Synopsis + +Command runs upgrade of Kubernetes control plane components between specified versions. + +``` +talosctl upgrade-k8s [flags] +``` + +### Options + +``` + --apiserver-image string kube-apiserver image to use (default "registry.k8s.io/kube-apiserver") + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + --controller-manager-image string kube-controller-manager image to use (default "registry.k8s.io/kube-controller-manager") + --dry-run skip the actual upgrade and show the upgrade plan instead + --endpoint string the cluster control plane endpoint + -e, --endpoints strings override default endpoints in Talos configuration + --from string the Kubernetes control plane version to upgrade from + -h, --help help for upgrade-k8s + --kubelet-image string kubelet image to use (default "ghcr.io/siderolabs/kubelet") + -n, --nodes strings target the specified nodes + --pre-pull-images pre-pull images before upgrade (default true) + --proxy-image string kube-proxy image to use (default "registry.k8s.io/kube-proxy") + --scheduler-image string kube-scheduler image to use (default "registry.k8s.io/kube-scheduler") + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --to string the Kubernetes control plane version to upgrade to (default "1.34.0-rc.1") + --upgrade-kubelet upgrade kubelet service (default true) + --with-docs patch all machine configs adding the documentation for each field (default true) + --with-examples patch all machine configs with the commented examples (default true) +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl usage + +Retrieve a disk usage + +``` +talosctl usage [path1] [path2] ... [pathN] [flags] +``` + +### Options + +``` + -a, --all write counts for all files, not just directories + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -d, --depth int32 maximum recursion depth + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for usage + -H, --humanize humanize size and time in the output + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl validate + +Validate config + +``` +talosctl validate [flags] +``` + +### Options + +``` + -c, --config string the path of the config file + -h, --help help for validate + -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) + --strict treat validation warnings as errors +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl version + +Prints the version + +``` +talosctl version [flags] +``` + +### Options + +``` + --client Print client version only + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for version + -i, --insecure use Talos maintenance mode API + -n, --nodes strings target the specified nodes + --short Print the short version + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl wipe disk + +Wipe a block device (disk or partition) which is not used as a volume + +### Synopsis + +Wipe a block device (disk or partition) which is not used as a volume. + +Use device names as arguments, for example: vda or sda5. + +``` +talosctl wipe disk ... [flags] +``` + +### Options + +``` + --drop-partition drop partition after wipe (if applicable) + -h, --help help for disk + -i, --insecure use Talos maintenance mode API + --method string wipe method to use [FAST ZEROES] (default "FAST") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl wipe](#talosctl-wipe) - Wipe block device or volumes + +## talosctl wipe + +Wipe block device or volumes + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for wipe + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl wipe disk](#talosctl-wipe-disk) - Wipe a block device (disk or partition) which is not used as a volume + +## talosctl + +A CLI for out-of-band management of Kubernetes nodes created by Talos + +### Options + +``` + -h, --help help for talosctl +``` + +### SEE ALSO + +* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node +* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the etcd cluster on the specified node. +* [talosctl cgroups](#talosctl-cgroups) - Retrieve cgroups usage information +* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters +* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash, fish or zsh) +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) +* [talosctl conformance](#talosctl-conformance) - Run conformance tests +* [talosctl containers](#talosctl-containers) - List containers +* [talosctl copy](#talosctl-copy) - Copy data out from the node +* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with node overview, logs and real-time metrics +* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs +* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. +* [talosctl etcd](#talosctl-etcd) - Manage etcd +* [talosctl events](#talosctl-events) - Stream runtime events +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys +* [talosctl get](#talosctl-get) - Get a specific resource or list of resources (use 'talosctl get rd' to see all available resource types). +* [talosctl health](#talosctl-health) - Check cluster health +* [talosctl image](#talosctl-image) - Manage CRI container images +* [talosctl inject](#talosctl-inject) - Inject Talos API resources into Kubernetes manifests +* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos +* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node +* [talosctl list](#talosctl-list) - Retrieve a directory listing +* [talosctl logs](#talosctl-logs) - Retrieve logs for a service +* [talosctl machineconfig](#talosctl-machineconfig) - Machine config related commands +* [talosctl memory](#talosctl-memory) - Show memory usage +* [talosctl meta](#talosctl-meta) - Write and delete keys in the META partition +* [talosctl mounts](#talosctl-mounts) - List mounts +* [talosctl netstat](#talosctl-netstat) - Show network connections and sockets +* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. +* [talosctl pcap](#talosctl-pcap) - Capture the network packets from the node. +* [talosctl processes](#talosctl-processes) - List running processes +* [talosctl read](#talosctl-read) - Read a file on the machine +* [talosctl reboot](#talosctl-reboot) - Reboot a node +* [talosctl reset](#talosctl-reset) - Reset a node +* [talosctl restart](#talosctl-restart) - Restart a process +* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation +* [talosctl rotate-ca](#talosctl-rotate-ca) - Rotate cluster CAs (Talos and Kubernetes APIs). +* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state +* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node +* [talosctl stats](#talosctl-stats) - Get container stats +* [talosctl support](#talosctl-support) - Dump debug information about the cluster +* [talosctl time](#talosctl-time) - Gets current server time +* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node +* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. +* [talosctl usage](#talosctl-usage) - Retrieve a disk usage +* [talosctl validate](#talosctl-validate) - Validate config +* [talosctl version](#talosctl-version) - Prints the version +* [talosctl wipe](#talosctl-wipe) - Wipe block device or volumes + diff --git a/website/content/v1.12/reference/configuration/_index.md b/website/content/v1.12/reference/configuration/_index.md new file mode 100644 index 000000000..6018f4c6e --- /dev/null +++ b/website/content/v1.12/reference/configuration/_index.md @@ -0,0 +1,28 @@ +--- +title: Configuration +description: Talos Linux machine configuration reference. +--- + +Talos Linux machine is fully configured via a single YAML file called *machine configuration*. + +The file might contain one or more configuration documents separated by `---` (three dashes) lines. +At the moment, majority of the configuration options are within the [v1alpha1]({{< relref "./v1alpha1" >}}) document, so +this is the only mandatory document in the configuration file. + +Configuration documents might be named (contain a `name:` field) or unnamed. +Unnamed documents can be supplied to the machine configuration file only once, while named documents can be supplied multiple times with unique names. + +The `v1alpha1` document has its own (legacy) structure, while every other document has the following set of fields: + +```yaml +apiVersion: v1alpha1 # version of the document +kind: NetworkRuleConfig # type of document +name: rule1 # only for named documents +``` + +This section contains the configuration reference, to learn more about Talos Linux machine configuration management, please see: + +* [quick guide to configuration generation]({{< relref "../../introduction/getting-started#configure-talos-linux" >}}) +* [configuration management in production]({{< relref "../../introduction/prodnotes#configure-talos" >}}) +* [configuration patches]({{< relref "../../talos-guides/configuration/patching" >}}) +* [editing live machine configuration]({{< relref "../../talos-guides/configuration/editing-machine-configuration" >}}) diff --git a/website/content/v1.12/reference/configuration/block/_index.md b/website/content/v1.12/reference/configuration/block/_index.md new file mode 100644 index 000000000..93ca178ad --- /dev/null +++ b/website/content/v1.12/reference/configuration/block/_index.md @@ -0,0 +1,8 @@ +--- +description: | + Package block provides block device and volume configuration documents. +title: block +--- + + + diff --git a/website/content/v1.12/reference/configuration/block/existingvolumeconfig.md b/website/content/v1.12/reference/configuration/block/existingvolumeconfig.md new file mode 100644 index 000000000..6826e025f --- /dev/null +++ b/website/content/v1.12/reference/configuration/block/existingvolumeconfig.md @@ -0,0 +1,94 @@ +--- +description: | + ExistingVolumeConfig is an existing volume configuration document. + Existing volumes allow to mount partitions (or whole disks) that were created + outside of Talos. Volume will be mounted under `/var/mnt/`. + The existing volume config name should not conflict with user volume names. +title: ExistingVolumeConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: ExistingVolumeConfig +name: my-existing-volume # Name of the volume. +# The discovery describes how to find a volume. +discovery: + # The volume selector expression. + volumeSelector: + match: volume.partition_label == "MY-DATA" # The Common Expression Language (CEL) expression to match the volume. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the volume.

Name can only contain:
lowercase and uppercase ASCII letters, digits, and hyphens. | | +|`discovery` |VolumeDiscoverySpec |The discovery describes how to find a volume. | | +|`mount` |MountSpec |The mount describes additional mount options. | | + + + + +## discovery {#ExistingVolumeConfig.discovery} + +VolumeDiscoverySpec describes how the volume is discovered. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`volumeSelector` |VolumeSelector |The volume selector expression. | | + + + + +### volumeSelector {#ExistingVolumeConfig.discovery.volumeSelector} + +VolumeSelector selects an existing volume. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`match` |Expression |The Common Expression Language (CEL) expression to match the volume.
Show example(s){{< highlight yaml >}} +match: volume.partition_label == "MY-DATA" +{{< /highlight >}}{{< highlight yaml >}} +match: volume.name == "xfs" && disk.serial == "SERIAL123" +{{< /highlight >}}
| | + + + + + + + + +## mount {#ExistingVolumeConfig.mount} + +MountSpec describes how the volume is mounted. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`readOnly` |bool |Mount the volume read-only. | | + + + + + + + + diff --git a/website/content/v1.12/reference/configuration/block/rawvolumeconfig.md b/website/content/v1.12/reference/configuration/block/rawvolumeconfig.md new file mode 100644 index 000000000..6bacb8ef5 --- /dev/null +++ b/website/content/v1.12/reference/configuration/block/rawvolumeconfig.md @@ -0,0 +1,257 @@ +--- +description: | + RawVolumeConfig is a raw volume configuration document. + Raw volumes allow to create partitions without formatting them. + If you want to use local storage, user volumes is a better choice, + raw volumes are intended to be used with CSI provisioners. + The partition label is automatically generated as `r-`. +title: RawVolumeConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: RawVolumeConfig +name: ceph-data # Name of the volume. +# The provisioning describes how the volume is provisioned. +provisioning: + # The disk selector expression. + diskSelector: + match: disk.transport == "nvme" # The Common Expression Language (CEL) expression to match the disk. + maxSize: 50GiB # The maximum size of the volume, if not specified the volume can grow to the size of the + + # # The minimum size of the volume. + # minSize: 2.5GiB + +# # The encryption describes how the volume is encrypted. +# encryption: +# provider: luks2 # Encryption provider to use for the encryption. +# # Defines the encryption keys generation and storage method. +# keys: +# - slot: 0 # Key slot number for LUKS2 encryption. +# # Key which value is stored in the configuration file. +# static: +# passphrase: exampleKey # Defines the static passphrase value. +# +# # # KMS managed encryption key. +# # kms: +# # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. +# - slot: 1 # Key slot number for LUKS2 encryption. +# # KMS managed encryption key. +# kms: +# endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key. +# cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider. +# blockSize: 4096 # Defines the encryption sector size. +# # Additional --perf parameters for the LUKS2 encryption. +# options: +# - no_read_workqueue +# - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the volume.

Name might be between 1 and 34 characters long and can only contain:
lowercase and uppercase ASCII letters, digits, and hyphens. | | +|`provisioning` |ProvisioningSpec |The provisioning describes how the volume is provisioned. | | +|`encryption` |EncryptionSpec |The encryption describes how the volume is encrypted. | | + + + + +## provisioning {#RawVolumeConfig.provisioning} + +ProvisioningSpec describes how the volume is provisioned. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`diskSelector` |DiskSelector |The disk selector expression. | | +|`grow` |bool |Should the volume grow to the size of the disk (if possible). | | +|`minSize` |ByteSize |The minimum size of the volume.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB.
Show example(s){{< highlight yaml >}} +minSize: 2.5GiB +{{< /highlight >}}
| | +|`maxSize` |ByteSize |The maximum size of the volume, if not specified the volume can grow to the size of the
disk.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB.
Show example(s){{< highlight yaml >}} +maxSize: 50GiB +{{< /highlight >}}
| | + + + + +### diskSelector {#RawVolumeConfig.provisioning.diskSelector} + +DiskSelector selects a disk for the volume. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`match` |Expression |The Common Expression Language (CEL) expression to match the disk.
Show example(s){{< highlight yaml >}} +match: disk.size > 120u * GB && disk.size < 1u * TB +{{< /highlight >}}{{< highlight yaml >}} +match: disk.transport == "sata" && !disk.rotational && !system_disk +{{< /highlight >}}
| | + + + + + + + + +## encryption {#RawVolumeConfig.encryption} + +EncryptionSpec represents volume encryption settings. + + + +{{< highlight yaml >}} +encryption: + provider: luks2 # Encryption provider to use for the encryption. + # Defines the encryption keys generation and storage method. + keys: + - slot: 0 # Key slot number for LUKS2 encryption. + # Key which value is stored in the configuration file. + static: + passphrase: exampleKey # Defines the static passphrase value. + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + - slot: 1 # Key slot number for LUKS2 encryption. + # KMS managed encryption key. + kms: + endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key. + cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider. + blockSize: 4096 # Defines the encryption sector size. + + # # Additional --perf parameters for the LUKS2 encryption. + # options: + # - no_read_workqueue + # - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`provider` |EncryptionProviderType |Encryption provider to use for the encryption. |`luks2`
| +|`keys` |[]EncryptionKey |Defines the encryption keys generation and storage method. | | +|`cipher` |string |Cipher to use for the encryption. Depends on the encryption provider.
Show example(s){{< highlight yaml >}} +cipher: aes-xts-plain64 +{{< /highlight >}}
|`aes-xts-plain64`
`xchacha12,aes-adiantum-plain64`
`xchacha20,aes-adiantum-plain64`
| +|`keySize` |uint |Defines the encryption key length. | | +|`blockSize` |uint64 |Defines the encryption sector size.
Show example(s){{< highlight yaml >}} +blockSize: 4096 +{{< /highlight >}}
| | +|`options` |[]string |Additional --perf parameters for the LUKS2 encryption.
Show example(s){{< highlight yaml >}} +options: + - no_read_workqueue + - no_write_workqueue +{{< /highlight >}}
|`no_read_workqueue`
`no_write_workqueue`
`same_cpu_crypt`
| + + + + +### keys[] {#RawVolumeConfig.encryption.keys.} + +EncryptionKey represents configuration for disk encryption key. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`slot` |int |Key slot number for LUKS2 encryption. | | +|`static` |EncryptionKeyStatic |Key which value is stored in the configuration file. | | +|`nodeID` |EncryptionKeyNodeID |Deterministically generated key from the node UUID and PartitionLabel. | | +|`kms` |EncryptionKeyKMS |KMS managed encryption key. | | +|`tpm` |EncryptionKeyTPM |Enable TPM based disk encryption. | | +|`lockToState` |bool |Lock the disk encryption key to the random salt stored in the STATE partition. This is useful to prevent the volume from being unlocked if STATE partition is compromised or replaced. It is recommended to use this option with TPM disk encryption for non-STATE volumes. | | + + + + +#### static {#RawVolumeConfig.encryption.keys..static} + +EncryptionKeyStatic represents throw away key type. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`passphrase` |string |Defines the static passphrase value. | | + + + + + + +#### nodeID {#RawVolumeConfig.encryption.keys..nodeID} + +EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. + + + + + + + + + +#### kms {#RawVolumeConfig.encryption.keys..kms} + +EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server. + + + +{{< highlight yaml >}} +encryption: + keys: + - kms: + endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |string |KMS endpoint to Seal/Unseal the key. | | + + + + + + +#### tpm {#RawVolumeConfig.encryption.keys..tpm} + +EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`checkSecurebootStatusOnEnroll` |bool |Check that Secureboot is enabled in the EFI firmware.
If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable. | | + + + + + + + + + + + + diff --git a/website/content/v1.12/reference/configuration/block/swapvolumeconfig.md b/website/content/v1.12/reference/configuration/block/swapvolumeconfig.md new file mode 100644 index 000000000..a99bdf3ca --- /dev/null +++ b/website/content/v1.12/reference/configuration/block/swapvolumeconfig.md @@ -0,0 +1,254 @@ +--- +description: | + SwapVolumeConfig is a disk swap volume configuration document. + Swap volume is automatically allocated as a partition on the specified disk + and activated as swap, removing a swap volume deactivates swap. + The partition label is automatically generated as `s-`. +title: SwapVolumeConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: SwapVolumeConfig +name: swap1 # Name of the volume. +# The provisioning describes how the volume is provisioned. +provisioning: + # The disk selector expression. + diskSelector: + match: disk.transport == "nvme" # The Common Expression Language (CEL) expression to match the disk. + minSize: 3GiB # The minimum size of the volume. + maxSize: 4GiB # The maximum size of the volume, if not specified the volume can grow to the size of the +# The encryption describes how the volume is encrypted. +encryption: + provider: luks2 # Encryption provider to use for the encryption. + # Defines the encryption keys generation and storage method. + keys: + - slot: 0 # Key slot number for LUKS2 encryption. + # Key which value is stored in the configuration file. + static: + passphrase: swapsecret # Defines the static passphrase value. + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + + # # Cipher to use for the encryption. Depends on the encryption provider. + # cipher: aes-xts-plain64 + + # # Defines the encryption sector size. + # blockSize: 4096 + + # # Additional --perf parameters for the LUKS2 encryption. + # options: + # - no_read_workqueue + # - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the volume.

Name might be between 1 and 34 characters long and can only contain:
lowercase and uppercase ASCII letters, digits, and hyphens. | | +|`provisioning` |ProvisioningSpec |The provisioning describes how the volume is provisioned. | | +|`encryption` |EncryptionSpec |The encryption describes how the volume is encrypted. | | + + + + +## provisioning {#SwapVolumeConfig.provisioning} + +ProvisioningSpec describes how the volume is provisioned. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`diskSelector` |DiskSelector |The disk selector expression. | | +|`grow` |bool |Should the volume grow to the size of the disk (if possible). | | +|`minSize` |ByteSize |The minimum size of the volume.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB.
Show example(s){{< highlight yaml >}} +minSize: 2.5GiB +{{< /highlight >}}
| | +|`maxSize` |ByteSize |The maximum size of the volume, if not specified the volume can grow to the size of the
disk.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB.
Show example(s){{< highlight yaml >}} +maxSize: 50GiB +{{< /highlight >}}
| | + + + + +### diskSelector {#SwapVolumeConfig.provisioning.diskSelector} + +DiskSelector selects a disk for the volume. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`match` |Expression |The Common Expression Language (CEL) expression to match the disk.
Show example(s){{< highlight yaml >}} +match: disk.size > 120u * GB && disk.size < 1u * TB +{{< /highlight >}}{{< highlight yaml >}} +match: disk.transport == "sata" && !disk.rotational && !system_disk +{{< /highlight >}}
| | + + + + + + + + +## encryption {#SwapVolumeConfig.encryption} + +EncryptionSpec represents volume encryption settings. + + + +{{< highlight yaml >}} +encryption: + provider: luks2 # Encryption provider to use for the encryption. + # Defines the encryption keys generation and storage method. + keys: + - slot: 0 # Key slot number for LUKS2 encryption. + # Key which value is stored in the configuration file. + static: + passphrase: exampleKey # Defines the static passphrase value. + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + - slot: 1 # Key slot number for LUKS2 encryption. + # KMS managed encryption key. + kms: + endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key. + cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider. + blockSize: 4096 # Defines the encryption sector size. + + # # Additional --perf parameters for the LUKS2 encryption. + # options: + # - no_read_workqueue + # - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`provider` |EncryptionProviderType |Encryption provider to use for the encryption. |`luks2`
| +|`keys` |[]EncryptionKey |Defines the encryption keys generation and storage method. | | +|`cipher` |string |Cipher to use for the encryption. Depends on the encryption provider.
Show example(s){{< highlight yaml >}} +cipher: aes-xts-plain64 +{{< /highlight >}}
|`aes-xts-plain64`
`xchacha12,aes-adiantum-plain64`
`xchacha20,aes-adiantum-plain64`
| +|`keySize` |uint |Defines the encryption key length. | | +|`blockSize` |uint64 |Defines the encryption sector size.
Show example(s){{< highlight yaml >}} +blockSize: 4096 +{{< /highlight >}}
| | +|`options` |[]string |Additional --perf parameters for the LUKS2 encryption.
Show example(s){{< highlight yaml >}} +options: + - no_read_workqueue + - no_write_workqueue +{{< /highlight >}}
|`no_read_workqueue`
`no_write_workqueue`
`same_cpu_crypt`
| + + + + +### keys[] {#SwapVolumeConfig.encryption.keys.} + +EncryptionKey represents configuration for disk encryption key. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`slot` |int |Key slot number for LUKS2 encryption. | | +|`static` |EncryptionKeyStatic |Key which value is stored in the configuration file. | | +|`nodeID` |EncryptionKeyNodeID |Deterministically generated key from the node UUID and PartitionLabel. | | +|`kms` |EncryptionKeyKMS |KMS managed encryption key. | | +|`tpm` |EncryptionKeyTPM |Enable TPM based disk encryption. | | +|`lockToState` |bool |Lock the disk encryption key to the random salt stored in the STATE partition. This is useful to prevent the volume from being unlocked if STATE partition is compromised or replaced. It is recommended to use this option with TPM disk encryption for non-STATE volumes. | | + + + + +#### static {#SwapVolumeConfig.encryption.keys..static} + +EncryptionKeyStatic represents throw away key type. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`passphrase` |string |Defines the static passphrase value. | | + + + + + + +#### nodeID {#SwapVolumeConfig.encryption.keys..nodeID} + +EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. + + + + + + + + + +#### kms {#SwapVolumeConfig.encryption.keys..kms} + +EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server. + + + +{{< highlight yaml >}} +encryption: + keys: + - kms: + endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |string |KMS endpoint to Seal/Unseal the key. | | + + + + + + +#### tpm {#SwapVolumeConfig.encryption.keys..tpm} + +EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`checkSecurebootStatusOnEnroll` |bool |Check that Secureboot is enabled in the EFI firmware.
If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable. | | + + + + + + + + + + + + diff --git a/website/content/v1.12/reference/configuration/block/uservolumeconfig.md b/website/content/v1.12/reference/configuration/block/uservolumeconfig.md new file mode 100644 index 000000000..cbed83478 --- /dev/null +++ b/website/content/v1.12/reference/configuration/block/uservolumeconfig.md @@ -0,0 +1,284 @@ +--- +description: | + UserVolumeConfig is a user volume configuration document. + User volume is automatically allocated as a partition on the specified disk + and mounted under `/var/mnt/`. + The partition label is automatically generated as `u-`. +title: UserVolumeConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: UserVolumeConfig +name: ceph-data # Name of the volume. +# The provisioning describes how the volume is provisioned. +provisioning: + # The disk selector expression. + diskSelector: + match: disk.transport == "nvme" # The Common Expression Language (CEL) expression to match the disk. + maxSize: 50GiB # The maximum size of the volume, if not specified the volume can grow to the size of the + + # # The minimum size of the volume. + # minSize: 2.5GiB +# The filesystem describes how the volume is formatted. +filesystem: + type: xfs # Filesystem type. Default is `xfs`. +# The encryption describes how the volume is encrypted. +encryption: + provider: luks2 # Encryption provider to use for the encryption. + # Defines the encryption keys generation and storage method. + keys: + - slot: 0 # Key slot number for LUKS2 encryption. + # Enable TPM based disk encryption. + tpm: {} + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + - slot: 1 # Key slot number for LUKS2 encryption. + # Key which value is stored in the configuration file. + static: + passphrase: topsecret # Defines the static passphrase value. + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + + # # Cipher to use for the encryption. Depends on the encryption provider. + # cipher: aes-xts-plain64 + + # # Defines the encryption sector size. + # blockSize: 4096 + + # # Additional --perf parameters for the LUKS2 encryption. + # options: + # - no_read_workqueue + # - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the volume.

Name might be between 1 and 34 characters long and can only contain:
lowercase and uppercase ASCII letters, digits, and hyphens. | | +|`provisioning` |ProvisioningSpec |The provisioning describes how the volume is provisioned. | | +|`filesystem` |FilesystemSpec |The filesystem describes how the volume is formatted. | | +|`encryption` |EncryptionSpec |The encryption describes how the volume is encrypted. | | + + + + +## provisioning {#UserVolumeConfig.provisioning} + +ProvisioningSpec describes how the volume is provisioned. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`diskSelector` |DiskSelector |The disk selector expression. | | +|`grow` |bool |Should the volume grow to the size of the disk (if possible). | | +|`minSize` |ByteSize |The minimum size of the volume.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB.
Show example(s){{< highlight yaml >}} +minSize: 2.5GiB +{{< /highlight >}}
| | +|`maxSize` |ByteSize |The maximum size of the volume, if not specified the volume can grow to the size of the
disk.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB.
Show example(s){{< highlight yaml >}} +maxSize: 50GiB +{{< /highlight >}}
| | + + + + +### diskSelector {#UserVolumeConfig.provisioning.diskSelector} + +DiskSelector selects a disk for the volume. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`match` |Expression |The Common Expression Language (CEL) expression to match the disk.
Show example(s){{< highlight yaml >}} +match: disk.size > 120u * GB && disk.size < 1u * TB +{{< /highlight >}}{{< highlight yaml >}} +match: disk.transport == "sata" && !disk.rotational && !system_disk +{{< /highlight >}}
| | + + + + + + + + +## filesystem {#UserVolumeConfig.filesystem} + +FilesystemSpec configures the filesystem for the volume. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`type` |FilesystemType |Filesystem type. Default is `xfs`. |`ext4`
`xfs`
| +|`projectQuotaSupport` |bool |Enables project quota support, valid only for 'xfs' filesystem.

Note: changing this value might require a full remount of the filesystem. | | + + + + + + +## encryption {#UserVolumeConfig.encryption} + +EncryptionSpec represents volume encryption settings. + + + +{{< highlight yaml >}} +encryption: + provider: luks2 # Encryption provider to use for the encryption. + # Defines the encryption keys generation and storage method. + keys: + - slot: 0 # Key slot number for LUKS2 encryption. + # Key which value is stored in the configuration file. + static: + passphrase: exampleKey # Defines the static passphrase value. + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + - slot: 1 # Key slot number for LUKS2 encryption. + # KMS managed encryption key. + kms: + endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key. + cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider. + blockSize: 4096 # Defines the encryption sector size. + + # # Additional --perf parameters for the LUKS2 encryption. + # options: + # - no_read_workqueue + # - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`provider` |EncryptionProviderType |Encryption provider to use for the encryption. |`luks2`
| +|`keys` |[]EncryptionKey |Defines the encryption keys generation and storage method. | | +|`cipher` |string |Cipher to use for the encryption. Depends on the encryption provider.
Show example(s){{< highlight yaml >}} +cipher: aes-xts-plain64 +{{< /highlight >}}
|`aes-xts-plain64`
`xchacha12,aes-adiantum-plain64`
`xchacha20,aes-adiantum-plain64`
| +|`keySize` |uint |Defines the encryption key length. | | +|`blockSize` |uint64 |Defines the encryption sector size.
Show example(s){{< highlight yaml >}} +blockSize: 4096 +{{< /highlight >}}
| | +|`options` |[]string |Additional --perf parameters for the LUKS2 encryption.
Show example(s){{< highlight yaml >}} +options: + - no_read_workqueue + - no_write_workqueue +{{< /highlight >}}
|`no_read_workqueue`
`no_write_workqueue`
`same_cpu_crypt`
| + + + + +### keys[] {#UserVolumeConfig.encryption.keys.} + +EncryptionKey represents configuration for disk encryption key. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`slot` |int |Key slot number for LUKS2 encryption. | | +|`static` |EncryptionKeyStatic |Key which value is stored in the configuration file. | | +|`nodeID` |EncryptionKeyNodeID |Deterministically generated key from the node UUID and PartitionLabel. | | +|`kms` |EncryptionKeyKMS |KMS managed encryption key. | | +|`tpm` |EncryptionKeyTPM |Enable TPM based disk encryption. | | +|`lockToState` |bool |Lock the disk encryption key to the random salt stored in the STATE partition. This is useful to prevent the volume from being unlocked if STATE partition is compromised or replaced. It is recommended to use this option with TPM disk encryption for non-STATE volumes. | | + + + + +#### static {#UserVolumeConfig.encryption.keys..static} + +EncryptionKeyStatic represents throw away key type. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`passphrase` |string |Defines the static passphrase value. | | + + + + + + +#### nodeID {#UserVolumeConfig.encryption.keys..nodeID} + +EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. + + + + + + + + + +#### kms {#UserVolumeConfig.encryption.keys..kms} + +EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server. + + + +{{< highlight yaml >}} +encryption: + keys: + - kms: + endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |string |KMS endpoint to Seal/Unseal the key. | | + + + + + + +#### tpm {#UserVolumeConfig.encryption.keys..tpm} + +EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`checkSecurebootStatusOnEnroll` |bool |Check that Secureboot is enabled in the EFI firmware.
If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable. | | + + + + + + + + + + + + diff --git a/website/content/v1.12/reference/configuration/block/volumeconfig.md b/website/content/v1.12/reference/configuration/block/volumeconfig.md new file mode 100644 index 000000000..0fb5beaf6 --- /dev/null +++ b/website/content/v1.12/reference/configuration/block/volumeconfig.md @@ -0,0 +1,254 @@ +--- +description: | + VolumeConfig is a system volume configuration document. + Note: at the moment, only `STATE`, `EPHEMERAL` and `IMAGE-CACHE` system volumes are supported. +title: VolumeConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: VolumeConfig +name: EPHEMERAL # Name of the volume. +# The provisioning describes how the volume is provisioned. +provisioning: + # The disk selector expression. + diskSelector: + match: disk.transport == "nvme" # The Common Expression Language (CEL) expression to match the disk. + maxSize: 50GiB # The maximum size of the volume, if not specified the volume can grow to the size of the + + # # The minimum size of the volume. + # minSize: 2.5GiB + +# # The encryption describes how the volume is encrypted. +# encryption: +# provider: luks2 # Encryption provider to use for the encryption. +# # Defines the encryption keys generation and storage method. +# keys: +# - slot: 0 # Key slot number for LUKS2 encryption. +# # Key which value is stored in the configuration file. +# static: +# passphrase: exampleKey # Defines the static passphrase value. +# +# # # KMS managed encryption key. +# # kms: +# # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. +# - slot: 1 # Key slot number for LUKS2 encryption. +# # KMS managed encryption key. +# kms: +# endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key. +# cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider. +# blockSize: 4096 # Defines the encryption sector size. +# # Additional --perf parameters for the LUKS2 encryption. +# options: +# - no_read_workqueue +# - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the volume. | | +|`provisioning` |ProvisioningSpec |The provisioning describes how the volume is provisioned. | | +|`encryption` |EncryptionSpec |The encryption describes how the volume is encrypted. | | + + + + +## provisioning {#VolumeConfig.provisioning} + +ProvisioningSpec describes how the volume is provisioned. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`diskSelector` |DiskSelector |The disk selector expression. | | +|`grow` |bool |Should the volume grow to the size of the disk (if possible). | | +|`minSize` |ByteSize |The minimum size of the volume.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB.
Show example(s){{< highlight yaml >}} +minSize: 2.5GiB +{{< /highlight >}}
| | +|`maxSize` |ByteSize |The maximum size of the volume, if not specified the volume can grow to the size of the
disk.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB.
Show example(s){{< highlight yaml >}} +maxSize: 50GiB +{{< /highlight >}}
| | + + + + +### diskSelector {#VolumeConfig.provisioning.diskSelector} + +DiskSelector selects a disk for the volume. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`match` |Expression |The Common Expression Language (CEL) expression to match the disk.
Show example(s){{< highlight yaml >}} +match: disk.size > 120u * GB && disk.size < 1u * TB +{{< /highlight >}}{{< highlight yaml >}} +match: disk.transport == "sata" && !disk.rotational && !system_disk +{{< /highlight >}}
| | + + + + + + + + +## encryption {#VolumeConfig.encryption} + +EncryptionSpec represents volume encryption settings. + + + +{{< highlight yaml >}} +encryption: + provider: luks2 # Encryption provider to use for the encryption. + # Defines the encryption keys generation and storage method. + keys: + - slot: 0 # Key slot number for LUKS2 encryption. + # Key which value is stored in the configuration file. + static: + passphrase: exampleKey # Defines the static passphrase value. + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + - slot: 1 # Key slot number for LUKS2 encryption. + # KMS managed encryption key. + kms: + endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key. + cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider. + blockSize: 4096 # Defines the encryption sector size. + + # # Additional --perf parameters for the LUKS2 encryption. + # options: + # - no_read_workqueue + # - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`provider` |EncryptionProviderType |Encryption provider to use for the encryption. |`luks2`
| +|`keys` |[]EncryptionKey |Defines the encryption keys generation and storage method. | | +|`cipher` |string |Cipher to use for the encryption. Depends on the encryption provider.
Show example(s){{< highlight yaml >}} +cipher: aes-xts-plain64 +{{< /highlight >}}
|`aes-xts-plain64`
`xchacha12,aes-adiantum-plain64`
`xchacha20,aes-adiantum-plain64`
| +|`keySize` |uint |Defines the encryption key length. | | +|`blockSize` |uint64 |Defines the encryption sector size.
Show example(s){{< highlight yaml >}} +blockSize: 4096 +{{< /highlight >}}
| | +|`options` |[]string |Additional --perf parameters for the LUKS2 encryption.
Show example(s){{< highlight yaml >}} +options: + - no_read_workqueue + - no_write_workqueue +{{< /highlight >}}
|`no_read_workqueue`
`no_write_workqueue`
`same_cpu_crypt`
| + + + + +### keys[] {#VolumeConfig.encryption.keys.} + +EncryptionKey represents configuration for disk encryption key. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`slot` |int |Key slot number for LUKS2 encryption. | | +|`static` |EncryptionKeyStatic |Key which value is stored in the configuration file. | | +|`nodeID` |EncryptionKeyNodeID |Deterministically generated key from the node UUID and PartitionLabel. | | +|`kms` |EncryptionKeyKMS |KMS managed encryption key. | | +|`tpm` |EncryptionKeyTPM |Enable TPM based disk encryption. | | +|`lockToState` |bool |Lock the disk encryption key to the random salt stored in the STATE partition. This is useful to prevent the volume from being unlocked if STATE partition is compromised or replaced. It is recommended to use this option with TPM disk encryption for non-STATE volumes. | | + + + + +#### static {#VolumeConfig.encryption.keys..static} + +EncryptionKeyStatic represents throw away key type. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`passphrase` |string |Defines the static passphrase value. | | + + + + + + +#### nodeID {#VolumeConfig.encryption.keys..nodeID} + +EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. + + + + + + + + + +#### kms {#VolumeConfig.encryption.keys..kms} + +EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server. + + + +{{< highlight yaml >}} +encryption: + keys: + - kms: + endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |string |KMS endpoint to Seal/Unseal the key. | | + + + + + + +#### tpm {#VolumeConfig.encryption.keys..tpm} + +EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`checkSecurebootStatusOnEnroll` |bool |Check that Secureboot is enabled in the EFI firmware.
If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable. | | + + + + + + + + + + + + diff --git a/website/content/v1.12/reference/configuration/block/zswapconfig.md b/website/content/v1.12/reference/configuration/block/zswapconfig.md new file mode 100644 index 000000000..5efa3c4d0 --- /dev/null +++ b/website/content/v1.12/reference/configuration/block/zswapconfig.md @@ -0,0 +1,37 @@ +--- +description: | + ZswapConfig is a zswap (compressed memory) configuration document. + When zswap is enabled, Linux kernel compresses pages that would otherwise be swapped out to disk. + The compressed pages are stored in a memory pool, which is used to avoid writing to disk + when the system is under memory pressure. +title: ZswapConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: ZswapConfig +maxPoolPercent: 25 # The maximum percent of memory that zswap can use. +shrinkerEnabled: true # Enable the shrinker feature: kernel might move +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`maxPoolPercent` |int |The maximum percent of memory that zswap can use.
This is a percentage of the total system memory.
The value must be between 0 and 100. | | +|`shrinkerEnabled` |bool |Enable the shrinker feature: kernel might move
cold pages from zswap to swap device to free up memory
for other use cases. | | + + + + + + diff --git a/website/content/v1.12/reference/configuration/extensions/_index.md b/website/content/v1.12/reference/configuration/extensions/_index.md new file mode 100644 index 000000000..f168f15e5 --- /dev/null +++ b/website/content/v1.12/reference/configuration/extensions/_index.md @@ -0,0 +1,8 @@ +--- +description: | + Package extensions provides extensions config documents. +title: extensions +--- + + + diff --git a/website/content/v1.12/reference/configuration/extensions/extensionserviceconfig.md b/website/content/v1.12/reference/configuration/extensions/extensionserviceconfig.md new file mode 100644 index 000000000..00a269ac3 --- /dev/null +++ b/website/content/v1.12/reference/configuration/extensions/extensionserviceconfig.md @@ -0,0 +1,57 @@ +--- +description: ExtensionServiceConfig is a extensionserviceconfig document. +title: ExtensionServiceConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: ExtensionServiceConfig +name: nut-client # Name of the extension service. +# The config files for the extension service. +configFiles: + - content: MONITOR ${upsmonHost} 1 remote username password # The content of the extension service config file. + mountPath: /usr/local/etc/nut/upsmon.conf # The mount path of the extension service config file. +# The environment for the extension service. +environment: + - NUT_UPS=upsname +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the extension service. | | +|`configFiles` |[]ConfigFile |The config files for the extension service. | | +|`environment` |[]string |The environment for the extension service. | | + + + + +## configFiles[] {#ExtensionServiceConfig.configFiles.} + +ConfigFile is a config file for extension services. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`content` |string |The content of the extension service config file. | | +|`mountPath` |string |The mount path of the extension service config file. | | + + + + + + + + diff --git a/website/content/v1.12/reference/configuration/hardware/_index.md b/website/content/v1.12/reference/configuration/hardware/_index.md new file mode 100644 index 000000000..684b659bf --- /dev/null +++ b/website/content/v1.12/reference/configuration/hardware/_index.md @@ -0,0 +1,8 @@ +--- +description: | + Package hardware provides hardware related config documents. +title: hardware +--- + + + diff --git a/website/content/v1.12/reference/configuration/hardware/pcidriverrebindconfig.md b/website/content/v1.12/reference/configuration/hardware/pcidriverrebindconfig.md new file mode 100644 index 000000000..0b9977493 --- /dev/null +++ b/website/content/v1.12/reference/configuration/hardware/pcidriverrebindconfig.md @@ -0,0 +1,33 @@ +--- +description: PCIDriverRebindConfig allows to configure PCI driver rebinds. +title: PCIDriverRebindConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: PCIDriverRebindConfig +name: 0000:04:00.00 # PCI device id +targetDriver: vfio-pci # Target driver to rebind the PCI device to. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |PCI device id | | +|`targetDriver` |string |Target driver to rebind the PCI device to. | | + + + + + + diff --git a/website/content/v1.12/reference/configuration/network/_index.md b/website/content/v1.12/reference/configuration/network/_index.md new file mode 100644 index 000000000..30aa35f5b --- /dev/null +++ b/website/content/v1.12/reference/configuration/network/_index.md @@ -0,0 +1,8 @@ +--- +description: | + Package network provides network machine configuration documents. +title: network +--- + + + diff --git a/website/content/v1.12/reference/configuration/network/ethernetconfig.md b/website/content/v1.12/reference/configuration/network/ethernetconfig.md new file mode 100644 index 000000000..a143bfa69 --- /dev/null +++ b/website/content/v1.12/reference/configuration/network/ethernetconfig.md @@ -0,0 +1,87 @@ +--- +description: EthernetConfig is a config document to configure Ethernet interfaces. +title: EthernetConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: EthernetConfig +name: enp0s2 # Name of the link (interface). +# Configuration for Ethernet features. +features: + tx-tcp-segmentation: false +# Configuration for Ethernet link rings. +rings: + rx: 256 # Number of RX rings. +# Configuration for Ethernet link channels. +channels: + rx: 4 # Number of RX channels. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the link (interface). | | +|`features` |map[string]bool |Configuration for Ethernet features.

Set of features available and whether they can be enabled or disabled is driver specific.
Use `talosctl get ethernetstatus -o yaml` to get the list of available features and
their current status. | | +|`rings` |EthernetRingsConfig |Configuration for Ethernet link rings.

This is similar to `ethtool -G` command. | | +|`channels` |EthernetChannelsConfig |Configuration for Ethernet link channels.

This is similar to `ethtool -L` command. | | + + + + +## rings {#EthernetConfig.rings} + +EthernetRingsConfig is a configuration for Ethernet link rings. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`rx` |uint32 |Number of RX rings. | | +|`tx` |uint32 |Number of TX rings. | | +|`rx-mini` |uint32 |Number of RX mini rings. | | +|`rx-jumbo` |uint32 |Number of RX jumbo rings. | | +|`rx-buf-len` |uint32 |RX buffer length. | | +|`cqe-size` |uint32 |CQE size. | | +|`tx-push` |bool |TX push enabled. | | +|`rx-push` |bool |RX push enabled. | | +|`tx-push-buf-len` |uint32 |TX push buffer length. | | +|`tcp-data-split` |bool |TCP data split enabled. | | + + + + + + +## channels {#EthernetConfig.channels} + +EthernetChannelsConfig is a configuration for Ethernet link channels. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`rx` |uint32 |Number of RX channels. | | +|`tx` |uint32 |Number of TX channels. | | +|`other` |uint32 |Number of other channels. | | +|`combined` |uint32 |Number of combined channels. | | + + + + + + + + diff --git a/website/content/v1.12/reference/configuration/network/kubespanendpointsconfig.md b/website/content/v1.12/reference/configuration/network/kubespanendpointsconfig.md new file mode 100644 index 000000000..ce0a59746 --- /dev/null +++ b/website/content/v1.12/reference/configuration/network/kubespanendpointsconfig.md @@ -0,0 +1,33 @@ +--- +description: KubeSpanEndpointsConfig is a config document to configure KubeSpan endpoints. +title: KubeSpanEndpointsConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: KubeSpanEndpointsConfig +# A list of extra Wireguard endpoints to announce from this machine. +extraAnnouncedEndpoints: + - 192.168.13.46:52000 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`extraAnnouncedEndpoints` |[]AddrPort |A list of extra Wireguard endpoints to announce from this machine.

Talos automatically adds endpoints based on machine addresses, public IP, etc.
This field allows to add extra endpoints which are managed outside of Talos, e.g. NAT mapping. | | + + + + + + diff --git a/website/content/v1.12/reference/configuration/network/networkdefaultactionconfig.md b/website/content/v1.12/reference/configuration/network/networkdefaultactionconfig.md new file mode 100644 index 000000000..1fa4a8220 --- /dev/null +++ b/website/content/v1.12/reference/configuration/network/networkdefaultactionconfig.md @@ -0,0 +1,31 @@ +--- +description: NetworkDefaultActionConfig is a ingress firewall default action configuration document. +title: NetworkDefaultActionConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: NetworkDefaultActionConfig +ingress: accept # Default action for all not explicitly configured ingress traffic: accept or block. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`ingress` |DefaultAction |Default action for all not explicitly configured ingress traffic: accept or block. |`accept`
`block`
| + + + + + + diff --git a/website/content/v1.12/reference/configuration/network/networkruleconfig.md b/website/content/v1.12/reference/configuration/network/networkruleconfig.md new file mode 100644 index 000000000..ebaaa2c36 --- /dev/null +++ b/website/content/v1.12/reference/configuration/network/networkruleconfig.md @@ -0,0 +1,90 @@ +--- +description: NetworkRuleConfig is a network firewall rule config document. +title: NetworkRuleConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: NetworkRuleConfig +name: ingress-apid # Name of the config document. +# Port selector defines which ports and protocols on the host are affected by the rule. +portSelector: + # Ports defines a list of port ranges or single ports. + ports: + - 50000 + protocol: tcp # Protocol defines traffic protocol (e.g. TCP or UDP). +# Ingress defines which source subnets are allowed to access the host ports/protocols defined by the `portSelector`. +ingress: + - subnet: 192.168.0.0/16 # Subnet defines a source subnet. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the config document. | | +|`portSelector` |RulePortSelector |Port selector defines which ports and protocols on the host are affected by the rule. | | +|`ingress` |[]IngressRule |Ingress defines which source subnets are allowed to access the host ports/protocols defined by the `portSelector`. | | + + + + +## portSelector {#NetworkRuleConfig.portSelector} + +RulePortSelector is a port selector for the network rule. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`ports` |PortRanges |Ports defines a list of port ranges or single ports.
The port ranges are inclusive, and should not overlap.
Show example(s){{< highlight yaml >}} +ports: + - 80 + - 443 +{{< /highlight >}}{{< highlight yaml >}} +ports: + - 1200-1299 + - 8080 +{{< /highlight >}}
| | +|`protocol` |Protocol |Protocol defines traffic protocol (e.g. TCP or UDP). |`tcp`
`udp`
`icmp`
`icmpv6`
| + + + + + + +## ingress[] {#NetworkRuleConfig.ingress.} + +IngressRule is a ingress rule. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`subnet` |Prefix |Subnet defines a source subnet.
Show example(s){{< highlight yaml >}} +subnet: 10.3.4.0/24 +{{< /highlight >}}{{< highlight yaml >}} +subnet: 2001:db8::/32 +{{< /highlight >}}{{< highlight yaml >}} +subnet: 1.3.4.5/32 +{{< /highlight >}}
| | +|`except` |Prefix |Except defines a source subnet to exclude from the rule, it gets excluded from the `subnet`. | | + + + + + + + + diff --git a/website/content/v1.12/reference/configuration/runtime/_index.md b/website/content/v1.12/reference/configuration/runtime/_index.md new file mode 100644 index 000000000..8af9fa9ce --- /dev/null +++ b/website/content/v1.12/reference/configuration/runtime/_index.md @@ -0,0 +1,8 @@ +--- +description: | + Package runtime provides runtime machine configuration documents. +title: runtime +--- + + + diff --git a/website/content/v1.12/reference/configuration/runtime/eventsinkconfig.md b/website/content/v1.12/reference/configuration/runtime/eventsinkconfig.md new file mode 100644 index 000000000..37e401dc1 --- /dev/null +++ b/website/content/v1.12/reference/configuration/runtime/eventsinkconfig.md @@ -0,0 +1,33 @@ +--- +description: EventSinkConfig is a event sink config document. +title: EventSinkConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: EventSinkConfig +endpoint: 192.168.10.3:3247 # The endpoint for the event sink as 'host:port'. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |string |The endpoint for the event sink as 'host:port'.
Show example(s){{< highlight yaml >}} +endpoint: 10.3.7.3:2810 +{{< /highlight >}}
| | + + + + + + diff --git a/website/content/v1.12/reference/configuration/runtime/kmsglogconfig.md b/website/content/v1.12/reference/configuration/runtime/kmsglogconfig.md new file mode 100644 index 000000000..ee2f1ac74 --- /dev/null +++ b/website/content/v1.12/reference/configuration/runtime/kmsglogconfig.md @@ -0,0 +1,35 @@ +--- +description: KmsgLogConfig is a event sink config document. +title: KmsgLogConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: KmsgLogConfig +name: remote-log # Name of the config document. +url: tcp://192.168.3.7:3478/ # The URL encodes the log destination. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the config document. | | +|`url` |URL |The URL encodes the log destination.
The scheme must be tcp:// or udp://.
The path must be empty.
The port is required.
Show example(s){{< highlight yaml >}} +url: udp://10.3.7.3:2810 +{{< /highlight >}}
| | + + + + + + diff --git a/website/content/v1.12/reference/configuration/runtime/watchdogtimerconfig.md b/website/content/v1.12/reference/configuration/runtime/watchdogtimerconfig.md new file mode 100644 index 000000000..effb8498c --- /dev/null +++ b/website/content/v1.12/reference/configuration/runtime/watchdogtimerconfig.md @@ -0,0 +1,35 @@ +--- +description: WatchdogTimerConfig is a watchdog timer config document. +title: WatchdogTimerConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: WatchdogTimerConfig +device: /dev/watchdog0 # Path to the watchdog device. +timeout: 2m0s # Timeout for the watchdog. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`device` |string |Path to the watchdog device.
Show example(s){{< highlight yaml >}} +device: /dev/watchdog0 +{{< /highlight >}}
| | +|`timeout` |Duration |Timeout for the watchdog.

If Talos is unresponsive for this duration, the watchdog will reset the system.

Default value is 1 minute, minimum value is 10 seconds. | | + + + + + + diff --git a/website/content/v1.12/reference/configuration/security/_index.md b/website/content/v1.12/reference/configuration/security/_index.md new file mode 100644 index 000000000..39740599f --- /dev/null +++ b/website/content/v1.12/reference/configuration/security/_index.md @@ -0,0 +1,8 @@ +--- +description: | + Package security provides security-related machine configuration documents. +title: security +--- + + + diff --git a/website/content/v1.12/reference/configuration/security/trustedrootsconfig.md b/website/content/v1.12/reference/configuration/security/trustedrootsconfig.md new file mode 100644 index 000000000..c934fd39c --- /dev/null +++ b/website/content/v1.12/reference/configuration/security/trustedrootsconfig.md @@ -0,0 +1,36 @@ +--- +description: TrustedRootsConfig allows to configure additional trusted CA roots. +title: TrustedRootsConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: TrustedRootsConfig +name: my-enterprise-ca # Name of the config document. +certificates: | # List of additional trusted certificate authorities (as PEM-encoded certificates). + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the config document. | | +|`certificates` |string |List of additional trusted certificate authorities (as PEM-encoded certificates).

Multiple certificates can be provided in a single config document, separated by newline characters. | | + + + + + + diff --git a/website/content/v1.12/reference/configuration/siderolink/_index.md b/website/content/v1.12/reference/configuration/siderolink/_index.md new file mode 100644 index 000000000..859fed07d --- /dev/null +++ b/website/content/v1.12/reference/configuration/siderolink/_index.md @@ -0,0 +1,8 @@ +--- +description: | + Package siderolink provides SideroLink machine configuration documents. +title: siderolink +--- + + + diff --git a/website/content/v1.12/reference/configuration/siderolink/siderolinkconfig.md b/website/content/v1.12/reference/configuration/siderolink/siderolinkconfig.md new file mode 100644 index 000000000..1c9b5dc7b --- /dev/null +++ b/website/content/v1.12/reference/configuration/siderolink/siderolinkconfig.md @@ -0,0 +1,34 @@ +--- +description: SideroLinkConfig is a SideroLink connection machine configuration document. +title: SideroLinkConfig +--- + + + + + + + + + + + +{{< highlight yaml >}} +apiVersion: v1alpha1 +kind: SideroLinkConfig +apiUrl: https://siderolink.api/jointoken?token=secret # SideroLink API URL to connect to. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`apiUrl` |URL |SideroLink API URL to connect to.
Show example(s){{< highlight yaml >}} +apiUrl: https://siderolink.api/?jointoken=secret +{{< /highlight >}}
| | +|`uniqueToken` |string |SideroLink unique token to use for the connection (optional).

This value is overridden with META key UniqueMachineToken. | | + + + + + + diff --git a/website/content/v1.12/reference/configuration/v1alpha1/_index.md b/website/content/v1.12/reference/configuration/v1alpha1/_index.md new file mode 100644 index 000000000..ad91a41bf --- /dev/null +++ b/website/content/v1.12/reference/configuration/v1alpha1/_index.md @@ -0,0 +1,14 @@ +--- +description: | + Package v1alpha1 contains definition of the `v1alpha1` configuration document. + + Even though the machine configuration in Talos Linux is multi-document, at the moment + this configuration document contains most of the configuration options. + + It is expected that new configuration options will be added as new documents, and existing ones + migrated to their own documents. +title: v1alpha1 +--- + + + diff --git a/website/content/v1.12/reference/configuration/v1alpha1/config.md b/website/content/v1.12/reference/configuration/v1alpha1/config.md new file mode 100644 index 000000000..d59eb3f7d --- /dev/null +++ b/website/content/v1.12/reference/configuration/v1alpha1/config.md @@ -0,0 +1,3609 @@ +--- +description: Config defines the v1alpha1.Config Talos machine configuration document. +title: Config +--- + + + + + + + + + + + +{{< highlight yaml >}} +version: v1alpha1 +machine: # ... +cluster: # ... +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`version` |string |Indicates the schema used to decode the contents. |`v1alpha1`
| +|`debug` |bool |Enable verbose logging to the console.
All system containers logs will flow into serial console.

**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. |`true`
`yes`
`false`
`no`
| +|`machine` |MachineConfig |Provides machine specific configuration options. | | +|`cluster` |ClusterConfig |Provides cluster specific configuration options. | | + + + + +## machine {#Config.machine} + +MachineConfig represents the machine-specific config values. + + + +{{< highlight yaml >}} +machine: + type: controlplane + # InstallConfig represents the installation options for preparing a node. + install: + disk: /dev/sda # The disk used for installations. + # Allows for supplying extra kernel args via the bootloader. + extraKernelArgs: + - console=ttyS1 + - panic=10 + image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`type` |string |Defines the role of the machine within the cluster.

**Control Plane**

Control Plane node type designates the node as a control plane member.
This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.

**Worker**

Worker node type designates the node as a worker node.
This means it will be an available compute node for scheduling workloads.

This node type was previously known as "join"; that value is still supported but deprecated. |`controlplane`
`worker`
| +|`token` |string |The `token` is used by a machine to join the PKI of the cluster.
Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.
Show example(s){{< highlight yaml >}} +token: 328hom.uqjzh6jnn2eie9oi +{{< /highlight >}}
| | +|`ca` |PEMEncodedCertificateAndKey |The root certificate authority of the PKI.
It is composed of a base64 encoded `crt` and `key`.
Show example(s){{< highlight yaml >}} +ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`acceptedCAs` |[]PEMEncodedCertificate |The certificates issued by certificate authorities are accepted in addition to issuing 'ca'.
It is composed of a base64 encoded `crt``. | | +|`certSANs` |[]string |Extra certificate subject alternative names for the machine's certificate.
By default, all non-loopback interface IPs are automatically added to the certificate's SANs.
Show example(s){{< highlight yaml >}} +certSANs: + - 10.0.0.10 + - 172.16.0.10 + - 192.168.0.10 +{{< /highlight >}}
| | +|`controlPlane` |MachineControlPlaneConfig |Provides machine specific control plane configuration options.
Show example(s){{< highlight yaml >}} +controlPlane: + # Controller manager machine specific configuration options. + controllerManager: + disabled: false # Disable kube-controller-manager on the node. + # Scheduler machine specific configuration options. + scheduler: + disabled: true # Disable kube-scheduler on the node. +{{< /highlight >}}
| | +|`kubelet` |KubeletConfig |Used to provide additional options to the kubelet.
Show example(s){{< highlight yaml >}} +kubelet: + image: ghcr.io/siderolabs/kubelet:v1.34.0-rc.1 # The `image` field is an optional reference to an alternative kubelet image. + # The `extraArgs` field is used to provide additional flags to the kubelet. + extraArgs: + feature-gates: ServerSideApply=true + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 +{{< /highlight >}}
| | +|`pods` |[]Unstructured |Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.

Static pods can be used to run components which should be started before the Kubernetes control plane is up.
Talos doesn't validate the pod definition.
Updates to this field can be applied without a reboot.

See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.
Show example(s){{< highlight yaml >}} +pods: + - apiVersion: v1 + kind: pod + metadata: + name: nginx + spec: + containers: + - image: nginx + name: nginx +{{< /highlight >}}
| | +|`network` |NetworkConfig |Provides machine specific network configuration options.
Show example(s){{< highlight yaml >}} +network: + hostname: worker-1 # Used to statically set the hostname for the machine. + # `interfaces` is used to define the network interface configuration. + interfaces: + - interface: enp0s1 # The interface name. + # Assigns static IP addresses to the interface. + addresses: + - 192.168.2.0/24 + # A list of routes associated with the interface. + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. + mtu: 1500 # The interface's MTU. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*. + # deviceSelector: + # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + + # # Bond specific options. + # bond: + # # The interfaces that make up the bond. + # interfaces: + # - enp2s0 + # - enp2s1 + # # Picks a network device using the selector. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + # mode: 802.3ad # A bond option. + # lacpRate: fast # A bond option. + + # # Bridge specific options. + # bridge: + # # The interfaces that make up the bridge. + # interfaces: + # - enxda4042ca9a51 + # - enxae2a6774c259 + # # Enable STP on this bridge. + # stp: + # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # Configure this device as a bridge port. + # bridgePort: + # master: br0 # The name of the bridge master interface + + # # Indicates if DHCP should be used to configure the interface. + # dhcp: true + + # # DHCP specific options. + # dhcpOptions: + # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # Wireguard specific configuration. + + # # wireguard server example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # listenPort: 51111 # Specifies a device's listening port. + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + # # wireguard peer example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + + # # Virtual (shared) IP address configuration. + + # # layer2 vip example + # vip: + # ip: 172.16.199.55 # Specifies the IP address to be used. + # Used to statically set the nameservers for the machine. + nameservers: + - 9.8.7.6 + - 8.7.6.5 + # Used to statically set arbitrary search domains. + searchDomains: + - example.org + - example.com + + # # Allows for extra entries to be added to the `/etc/hosts` file + # extraHostEntries: + # - ip: 192.168.1.100 # The IP of the host. + # # The host alias. + # aliases: + # - example + # - example.domain.tld + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. +{{< /highlight >}}
| | +|`install` |InstallConfig |Used to provide instructions for installations.

Note that this configuration section gets silently ignored by Talos images that are considered pre-installed.
To make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.
Show example(s){{< highlight yaml >}} +install: + disk: /dev/sda # The disk used for installations. + # Allows for supplying extra kernel args via the bootloader. + extraKernelArgs: + - console=ttyS1 + - panic=10 + image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. +{{< /highlight >}}
| | +|`files` |[]MachineFile |Allows the addition of user specified files.
The value of `op` can be `create`, `overwrite`, or `append`.
In the case of `create`, `path` must not exist.
In the case of `overwrite`, and `append`, `path` must be a valid file.
If an `op` value of `append` is used, the existing file will be appended.
Note that the file contents are not required to be base64 encoded.
Show example(s){{< highlight yaml >}} +files: + - content: '...' # The contents of the file. + permissions: 0o666 # The file's permissions in octal. + path: /tmp/file.txt # The path of the file. + op: append # The operation to use +{{< /highlight >}}
| | +|`env` |Env |The `env` field allows for the addition of environment variables.
All environment variables are set on PID 1 in addition to every service.
Show example(s){{< highlight yaml >}} +env: + GRPC_GO_LOG_SEVERITY_LEVEL: info + GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + https_proxy: http://SERVER:PORT/ +{{< /highlight >}}{{< highlight yaml >}} +env: + GRPC_GO_LOG_SEVERITY_LEVEL: error + https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ +{{< /highlight >}}{{< highlight yaml >}} +env: + https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ +{{< /highlight >}}
|``GRPC_GO_LOG_VERBOSITY_LEVEL``
``GRPC_GO_LOG_SEVERITY_LEVEL``
``http_proxy``
``https_proxy``
``no_proxy``
| +|`time` |TimeConfig |Used to configure the machine's time settings.
Show example(s){{< highlight yaml >}} +time: + disabled: false # Indicates if the time service is disabled for the machine. + # description: | + servers: + - time.cloudflare.com + bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. +{{< /highlight >}}
| | +|`sysctls` |map[string]string |Used to configure the machine's sysctls.
Show example(s){{< highlight yaml >}} +sysctls: + kernel.domainname: talos.dev + net.ipv4.ip_forward: "0" + net/ipv6/conf/eth0.100/disable_ipv6: "1" +{{< /highlight >}}
| | +|`sysfs` |map[string]string |Used to configure the machine's sysfs.
Show example(s){{< highlight yaml >}} +sysfs: + devices.system.cpu.cpu0.cpufreq.scaling_governor: performance +{{< /highlight >}}
| | +|`registries` |RegistriesConfig |Used to configure the machine's container image registry mirrors.

Automatically generates matching CRI configuration for registry mirrors.

The `mirrors` section allows to redirect requests for images to a non-default registry,
which might be a local registry or a caching mirror.

The `config` section provides a way to authenticate to the registry with TLS client
identity, provide registry CA, or authentication information.
Authentication information has same meaning with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).

See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md).
Show example(s){{< highlight yaml >}} +registries: + # Specifies mirror configuration for each registry host namespace. + mirrors: + docker.io: + # List of endpoints (URLs) for registry mirrors to use. + endpoints: + - https://registry.local + # Specifies TLS & auth configuration for HTTPS image registries. + config: + registry.local: + # The TLS configuration for the registry. + tls: + # Enable mutual TLS authentication with the registry. + clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # The auth configuration for this registry. + auth: + username: username # Optional registry authentication. + password: password # Optional registry authentication. +{{< /highlight >}}
| | +|`features` |FeaturesConfig |Features describe individual Talos features that can be switched on or off.
Show example(s){{< highlight yaml >}} +features: + rbac: true # Enable role-based access control (RBAC). + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system +{{< /highlight >}}
| | +|`udev` |UdevConfig |Configures the udev system.
Show example(s){{< highlight yaml >}} +udev: + # List of udev rules to apply to the udev system + rules: + - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" +{{< /highlight >}}
| | +|`logging` |LoggingConfig |Configures the logging system.
Show example(s){{< highlight yaml >}} +logging: + # Logging destination. + destinations: + - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + format: json_lines # Logs format. +{{< /highlight >}}
| | +|`kernel` |KernelConfig |Configures the kernel.
Show example(s){{< highlight yaml >}} +kernel: + # Kernel modules to load. + modules: + - name: brtfs # Module name. +{{< /highlight >}}
| | +|`seccompProfiles` |[]MachineSeccompProfile |Configures the seccomp profiles for the machine.
Show example(s){{< highlight yaml >}} +seccompProfiles: + - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # The `value` field is used to provide the seccomp profile. + value: + defaultAction: SCMP_ACT_LOG +{{< /highlight >}}
| | +|`baseRuntimeSpecOverrides` |Unstructured |Override (patch) settings in the default OCI runtime spec for CRI containers.

It can be used to set some default container settings which are not configurable in Kubernetes,
for example default ulimits.
Note: this change applies to all newly created containers, and it requires a reboot to take effect.
Show example(s){{< highlight yaml >}} +baseRuntimeSpecOverrides: + process: + rlimits: + - hard: 1024 + soft: 1024 + type: RLIMIT_NOFILE +{{< /highlight >}}
| | +|`nodeLabels` |map[string]string |Configures the node labels for the machine.

Note: In the default Kubernetes configuration, worker nodes are restricted to set
labels with some prefixes (see [NodeRestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) admission plugin).
Show example(s){{< highlight yaml >}} +nodeLabels: + exampleLabel: exampleLabelValue +{{< /highlight >}}
| | +|`nodeAnnotations` |map[string]string |Configures the node annotations for the machine.
Show example(s){{< highlight yaml >}} +nodeAnnotations: + customer.io/rack: r13a25 +{{< /highlight >}}
| | +|`nodeTaints` |map[string]string |Configures the node taints for the machine. Effect is optional.

Note: In the default Kubernetes configuration, worker nodes are not allowed to
modify the taints (see [NodeRestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) admission plugin).
Show example(s){{< highlight yaml >}} +nodeTaints: + exampleTaint: exampleTaintValue:NoSchedule +{{< /highlight >}}
| | + + + + +### controlPlane {#Config.machine.controlPlane} + +MachineControlPlaneConfig machine specific configuration options. + + + +{{< highlight yaml >}} +machine: + controlPlane: + # Controller manager machine specific configuration options. + controllerManager: + disabled: false # Disable kube-controller-manager on the node. + # Scheduler machine specific configuration options. + scheduler: + disabled: true # Disable kube-scheduler on the node. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`controllerManager` |MachineControllerManagerConfig |Controller manager machine specific configuration options. | | +|`scheduler` |MachineSchedulerConfig |Scheduler machine specific configuration options. | | + + + + +#### controllerManager {#Config.machine.controlPlane.controllerManager} + +MachineControllerManagerConfig represents the machine specific ControllerManager config values. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable kube-controller-manager on the node. | | + + + + + + +#### scheduler {#Config.machine.controlPlane.scheduler} + +MachineSchedulerConfig represents the machine specific Scheduler config values. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable kube-scheduler on the node. | | + + + + + + + + +### kubelet {#Config.machine.kubelet} + +KubeletConfig represents the kubelet config values. + + + +{{< highlight yaml >}} +machine: + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.34.0-rc.1 # The `image` field is an optional reference to an alternative kubelet image. + # The `extraArgs` field is used to provide additional flags to the kubelet. + extraArgs: + feature-gates: ServerSideApply=true + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The `image` field is an optional reference to an alternative kubelet image.
Show example(s){{< highlight yaml >}} +image: ghcr.io/siderolabs/kubelet:v1.34.0-rc.1 +{{< /highlight >}}
| | +|`clusterDNS` |[]string |The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
Show example(s){{< highlight yaml >}} +clusterDNS: + - 10.96.0.10 + - 169.254.2.53 +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |The `extraArgs` field is used to provide additional flags to the kubelet.
Show example(s){{< highlight yaml >}} +extraArgs: + key: value +{{< /highlight >}}
| | +|`extraMounts` |[]ExtraMount |The `extraMounts` field is used to add additional mounts to the kubelet container.
Note that either `bind` or `rbind` are required in the `options`.
Show example(s){{< highlight yaml >}} +extraMounts: + - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + type: bind # Type specifies the mount kind. + source: /var/lib/example # Source specifies the source path of the mount. + # Options are fstab style mount options. + options: + - bind + - rshared + - rw +{{< /highlight >}}
| | +|`extraConfig` |Unstructured |The `extraConfig` field is used to provide kubelet configuration overrides.

Some fields are not allowed to be overridden: authentication and authorization, cgroups
configuration, ports, etc.
Show example(s){{< highlight yaml >}} +extraConfig: + serverTLSBootstrap: true +{{< /highlight >}}
| | +|`credentialProviderConfig` |Unstructured |The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
Show example(s){{< highlight yaml >}} +credentialProviderConfig: + apiVersion: kubelet.config.k8s.io/v1 + kind: CredentialProviderConfig + providers: + - apiVersion: credentialprovider.kubelet.k8s.io/v1 + defaultCacheDuration: 12h + matchImages: + - '*.dkr.ecr.*.amazonaws.com' + - '*.dkr.ecr.*.amazonaws.com.cn' + - '*.dkr.ecr-fips.*.amazonaws.com' + - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + name: ecr-credential-provider +{{< /highlight >}}
| | +|`defaultRuntimeSeccompProfileEnabled` |bool |Enable container runtime default Seccomp profile. |`true`
`yes`
`false`
`no`
| +|`registerWithFQDN` |bool |The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration.
This is required in clouds like AWS. |`true`
`yes`
`false`
`no`
| +|`nodeIP` |KubeletNodeIPConfig |The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
This is used when a node has multiple addresses to choose from.
Show example(s){{< highlight yaml >}} +nodeIP: + # The `validSubnets` field configures the networks to pick kubelet node IP from. + validSubnets: + - 10.0.0.0/8 + - '!10.0.0.3/32' + - fdc7::/16 +{{< /highlight >}}
| | +|`skipNodeRegistration` |bool |The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver.
This runs kubelet as standalone and only runs static pods. |`true`
`yes`
`false`
`no`
| +|`disableManifestsDirectory` |bool |The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
It's recommended to configure static pods with the "pods" key instead. |`true`
`yes`
`false`
`no`
| + + + + +#### extraMounts[] {#Config.machine.kubelet.extraMounts.} + +ExtraMount wraps OCI Mount specification. + + + +{{< highlight yaml >}} +machine: + kubelet: + extraMounts: + - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + type: bind # Type specifies the mount kind. + source: /var/lib/example # Source specifies the source path of the mount. + # Options are fstab style mount options. + options: + - bind + - rshared + - rw +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`destination` |string |Destination is the absolute path where the mount will be placed in the container. | | +|`type` |string |Type specifies the mount kind. | | +|`source` |string |Source specifies the source path of the mount. | | +|`options` |[]string |Options are fstab style mount options. | | +|`uidMappings` |[]LinuxIDMapping |UID/GID mappings used for changing file owners w/o calling chown, fs should support it.

Every mount point could have its own mapping. | | +|`gidMappings` |[]LinuxIDMapping |UID/GID mappings used for changing file owners w/o calling chown, fs should support it.

Every mount point could have its own mapping. | | + + + + +##### uidMappings[] {#Config.machine.kubelet.extraMounts..uidMappings.} + +LinuxIDMapping represents the Linux ID mapping. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`containerID` |uint32 |ContainerID is the starting UID/GID in the container. | | +|`hostID` |uint32 |HostID is the starting UID/GID on the host to be mapped to 'ContainerID'. | | +|`size` |uint32 |Size is the number of IDs to be mapped. | | + + + + + + +##### gidMappings[] {#Config.machine.kubelet.extraMounts..gidMappings.} + +LinuxIDMapping represents the Linux ID mapping. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`containerID` |uint32 |ContainerID is the starting UID/GID in the container. | | +|`hostID` |uint32 |HostID is the starting UID/GID on the host to be mapped to 'ContainerID'. | | +|`size` |uint32 |Size is the number of IDs to be mapped. | | + + + + + + + + +#### nodeIP {#Config.machine.kubelet.nodeIP} + +KubeletNodeIPConfig represents the kubelet node IP configuration. + + + +{{< highlight yaml >}} +machine: + kubelet: + nodeIP: + # The `validSubnets` field configures the networks to pick kubelet node IP from. + validSubnets: + - 10.0.0.0/8 + - '!10.0.0.3/32' + - fdc7::/16 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`validSubnets` |[]string |The `validSubnets` field configures the networks to pick kubelet node IP from.
For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.
IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both. | | + + + + + + + + +### network {#Config.machine.network} + +NetworkConfig represents the machine's networking config values. + + + +{{< highlight yaml >}} +machine: + network: + hostname: worker-1 # Used to statically set the hostname for the machine. + # `interfaces` is used to define the network interface configuration. + interfaces: + - interface: enp0s1 # The interface name. + # Assigns static IP addresses to the interface. + addresses: + - 192.168.2.0/24 + # A list of routes associated with the interface. + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. + mtu: 1500 # The interface's MTU. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*. + # deviceSelector: + # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + + # # Bond specific options. + # bond: + # # The interfaces that make up the bond. + # interfaces: + # - enp2s0 + # - enp2s1 + # # Picks a network device using the selector. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + # mode: 802.3ad # A bond option. + # lacpRate: fast # A bond option. + + # # Bridge specific options. + # bridge: + # # The interfaces that make up the bridge. + # interfaces: + # - enxda4042ca9a51 + # - enxae2a6774c259 + # # Enable STP on this bridge. + # stp: + # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # Configure this device as a bridge port. + # bridgePort: + # master: br0 # The name of the bridge master interface + + # # Indicates if DHCP should be used to configure the interface. + # dhcp: true + + # # DHCP specific options. + # dhcpOptions: + # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # Wireguard specific configuration. + + # # wireguard server example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # listenPort: 51111 # Specifies a device's listening port. + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + # # wireguard peer example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + + # # Virtual (shared) IP address configuration. + + # # layer2 vip example + # vip: + # ip: 172.16.199.55 # Specifies the IP address to be used. + # Used to statically set the nameservers for the machine. + nameservers: + - 9.8.7.6 + - 8.7.6.5 + # Used to statically set arbitrary search domains. + searchDomains: + - example.org + - example.com + + # # Allows for extra entries to be added to the `/etc/hosts` file + # extraHostEntries: + # - ip: 192.168.1.100 # The IP of the host. + # # The host alias. + # aliases: + # - example + # - example.domain.tld + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`hostname` |string |Used to statically set the hostname for the machine. | | +|`interfaces` |[]Device |`interfaces` is used to define the network interface configuration.
By default all network interfaces will attempt a DHCP discovery.
This can be further tuned through this configuration parameter.
Show example(s){{< highlight yaml >}} +interfaces: + - interface: enp0s1 # The interface name. + # Assigns static IP addresses to the interface. + addresses: + - 192.168.2.0/24 + # A list of routes associated with the interface. + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. + mtu: 1500 # The interface's MTU. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*. + # deviceSelector: + # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + + # # Bond specific options. + # bond: + # # The interfaces that make up the bond. + # interfaces: + # - enp2s0 + # - enp2s1 + # # Picks a network device using the selector. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + # mode: 802.3ad # A bond option. + # lacpRate: fast # A bond option. + + # # Bridge specific options. + # bridge: + # # The interfaces that make up the bridge. + # interfaces: + # - enxda4042ca9a51 + # - enxae2a6774c259 + # # Enable STP on this bridge. + # stp: + # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # Configure this device as a bridge port. + # bridgePort: + # master: br0 # The name of the bridge master interface + + # # Indicates if DHCP should be used to configure the interface. + # dhcp: true + + # # DHCP specific options. + # dhcpOptions: + # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # Wireguard specific configuration. + + # # wireguard server example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # listenPort: 51111 # Specifies a device's listening port. + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + # # wireguard peer example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + + # # Virtual (shared) IP address configuration. + + # # layer2 vip example + # vip: + # ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}}
| | +|`nameservers` |[]string |Used to statically set the nameservers for the machine.
Defaults to `1.1.1.1` and `8.8.8.8`
Show example(s){{< highlight yaml >}} +nameservers: + - 8.8.8.8 + - 1.1.1.1 +{{< /highlight >}}
| | +|`searchDomains` |[]string |Used to statically set arbitrary search domains.
Show example(s){{< highlight yaml >}} +searchDomains: + - example.org + - example.com +{{< /highlight >}}
| | +|`extraHostEntries` |[]ExtraHost |Allows for extra entries to be added to the `/etc/hosts` file
Show example(s){{< highlight yaml >}} +extraHostEntries: + - ip: 192.168.1.100 # The IP of the host. + # The host alias. + aliases: + - example + - example.domain.tld +{{< /highlight >}}
| | +|`kubespan` |NetworkKubeSpan |Configures KubeSpan feature.
Show example(s){{< highlight yaml >}} +kubespan: + enabled: true # Enable the KubeSpan feature. +{{< /highlight >}}
| | +|`disableSearchDomain` |bool |Disable generating a default search domain in /etc/resolv.conf
based on the machine hostname.
Defaults to `false`. |`true`
`yes`
`false`
`no`
| + + + + +#### interfaces[] {#Config.machine.network.interfaces.} + +Device represents a network interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - interface: enp0s1 # The interface name. + # Assigns static IP addresses to the interface. + addresses: + - 192.168.2.0/24 + # A list of routes associated with the interface. + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. + mtu: 1500 # The interface's MTU. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*. + # deviceSelector: + # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + + # # Bond specific options. + # bond: + # # The interfaces that make up the bond. + # interfaces: + # - enp2s0 + # - enp2s1 + # # Picks a network device using the selector. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. + # mode: 802.3ad # A bond option. + # lacpRate: fast # A bond option. + + # # Bridge specific options. + # bridge: + # # The interfaces that make up the bridge. + # interfaces: + # - enxda4042ca9a51 + # - enxae2a6774c259 + # # Enable STP on this bridge. + # stp: + # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # Configure this device as a bridge port. + # bridgePort: + # master: br0 # The name of the bridge master interface + + # # Indicates if DHCP should be used to configure the interface. + # dhcp: true + + # # DHCP specific options. + # dhcpOptions: + # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # Wireguard specific configuration. + + # # wireguard server example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # listenPort: 51111 # Specifies a device's listening port. + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + # # wireguard peer example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + + # # Virtual (shared) IP address configuration. + + # # layer2 vip example + # vip: + # ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`interface` |string |The interface name.
Mutually exclusive with `deviceSelector`.
Show example(s){{< highlight yaml >}} +interface: enp0s3 +{{< /highlight >}}
| | +|`deviceSelector` |NetworkDeviceSelector |Picks a network device using the selector.
Mutually exclusive with `interface`.
Supports partial match using wildcard syntax.
Show example(s){{< highlight yaml >}} +deviceSelector: + busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. +{{< /highlight >}}{{< highlight yaml >}} +deviceSelector: + hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + driver: virtio_net # Kernel driver, supports matching by wildcard. +{{< /highlight >}}
| | +|`addresses` |[]string |Assigns static IP addresses to the interface.
An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).
Show example(s){{< highlight yaml >}} +addresses: + - 10.5.0.0/16 + - 192.168.3.7 +{{< /highlight >}}
| | +|`routes` |[]Route |A list of routes associated with the interface.
If used in combination with DHCP, these routes will be appended to routes returned by DHCP server.
Show example(s){{< highlight yaml >}} +routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). + - network: 10.2.0.0/16 # The route's network (destination). + gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). +{{< /highlight >}}
| | +|`bond` |Bond |Bond specific options.
Show example(s){{< highlight yaml >}} +bond: + # The interfaces that make up the bond. + interfaces: + - enp2s0 + - enp2s1 + mode: 802.3ad # A bond option. + lacpRate: fast # A bond option. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. +{{< /highlight >}}
| | +|`bridge` |Bridge |Bridge specific options.
Show example(s){{< highlight yaml >}} +bridge: + # The interfaces that make up the bridge. + interfaces: + - enxda4042ca9a51 + - enxae2a6774c259 + # Enable STP on this bridge. + stp: + enabled: true # Whether Spanning Tree Protocol (STP) is enabled. +{{< /highlight >}}
| | +|`bridgePort` |BridgePort |Configure this device as a bridge port.
This can be used to dynamically assign network interfaces to a bridge.
Show example(s){{< highlight yaml >}} +bridgePort: + master: br0 # The name of the bridge master interface +{{< /highlight >}}
| | +|`vlans` |[]Vlan |VLAN specific options. | | +|`mtu` |int |The interface's MTU.
If used in combination with DHCP, this will override any MTU settings returned from DHCP server. | | +|`dhcp` |bool |Indicates if DHCP should be used to configure the interface.
The following DHCP options are supported:

- `OptionClasslessStaticRoute`
- `OptionDomainNameServer`
- `OptionDNSDomainSearchList`
- `OptionHostName`
Show example(s){{< highlight yaml >}} +dhcp: true +{{< /highlight >}}
| | +|`ignore` |bool |Indicates if the interface should be ignored (skips configuration). | | +|`dummy` |bool |Indicates if the interface is a dummy interface.
`dummy` is used to specify that this interface should be a virtual-only, dummy interface. | | +|`dhcpOptions` |DHCPOptions |DHCP specific options.
`dhcp` *must* be set to true for these to take effect.
Show example(s){{< highlight yaml >}} +dhcpOptions: + routeMetric: 1024 # The priority of all routes received via DHCP. +{{< /highlight >}}
| | +|`wireguard` |DeviceWireguardConfig |Wireguard specific configuration.
Includes things like private key, listen port, peers.
Show example(s){{< highlight yaml >}} +wireguard: + privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + listenPort: 51111 # Specifies a device's listening port. + # Specifies a list of peer configurations to apply to a device. + peers: + - publicKey: ABCDEF... # Specifies the public key of this peer. + endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + allowedIPs: + - 192.168.1.0/24 +{{< /highlight >}}{{< highlight yaml >}} +wireguard: + privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # Specifies a list of peer configurations to apply to a device. + peers: + - publicKey: ABCDEF... # Specifies the public key of this peer. + endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + allowedIPs: + - 192.168.1.0/24 +{{< /highlight >}}
| | +|`vip` |DeviceVIPConfig |Virtual (shared) IP address configuration.
Show example(s){{< highlight yaml >}} +vip: + ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}}
| | + + + + +##### deviceSelector {#Config.machine.network.interfaces..deviceSelector} + +NetworkDeviceSelector struct describes network device selector. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - deviceSelector: + busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + network: + interfaces: + - deviceSelector: + hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + driver: virtio_net # Kernel driver, supports matching by wildcard. +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + network: + interfaces: + - deviceSelector: + - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + driver: virtio_net # Kernel driver, supports matching by wildcard. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`busPath` |string |PCI, USB bus prefix, supports matching by wildcard. | | +|`hardwareAddr` |string |Device hardware (MAC) address, supports matching by wildcard. | | +|`permanentAddr` |string |Device permanent hardware address, supports matching by wildcard.
The permanent address doesn't change when the link is enslaved to a bond,
so it's recommended to use this field for bond members. | | +|`pciID` |string |PCI ID (vendor ID, product ID), supports matching by wildcard. | | +|`driver` |string |Kernel driver, supports matching by wildcard. | | +|`physical` |bool |Select only physical devices. | | + + + + + + +##### routes[] {#Config.machine.network.interfaces..routes.} + +Route represents a network route. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). + - network: 10.2.0.0/16 # The route's network (destination). + gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`network` |string |The route's network (destination). | | +|`gateway` |string |The route's gateway (if empty, creates link scope route). | | +|`source` |string |The route's source address (optional). | | +|`metric` |uint32 |The optional metric for the route. | | +|`mtu` |uint32 |The optional MTU for the route. | | + + + + + + +##### bond {#Config.machine.network.interfaces..bond} + +Bond contains the various options for configuring a bonded interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - bond: + # The interfaces that make up the bond. + interfaces: + - enp2s0 + - enp2s1 + mode: 802.3ad # A bond option. + lacpRate: fast # A bond option. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # driver: virtio_net # Kernel driver, supports matching by wildcard. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`interfaces` |[]string |The interfaces that make up the bond. | | +|`deviceSelectors` |[]NetworkDeviceSelector |Picks a network device using the selector.
Mutually exclusive with `interfaces`.
Supports partial match using wildcard syntax.
Show example(s){{< highlight yaml >}} +deviceSelectors: + - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + driver: virtio_net # Kernel driver, supports matching by wildcard. +{{< /highlight >}}
| | +|`arpIPTarget` |[]string |A bond option.
Please see the official kernel documentation.
Not supported at the moment. | | +|`mode` |string |A bond option.
Please see the official kernel documentation. | | +|`xmitHashPolicy` |string |A bond option.
Please see the official kernel documentation. | | +|`lacpRate` |string |A bond option.
Please see the official kernel documentation. | | +|`adActorSystem` |string |A bond option.
Please see the official kernel documentation.
Not supported at the moment. | | +|`arpValidate` |string |A bond option.
Please see the official kernel documentation. | | +|`arpAllTargets` |string |A bond option.
Please see the official kernel documentation. | | +|`primary` |string |A bond option.
Please see the official kernel documentation. | | +|`primaryReselect` |string |A bond option.
Please see the official kernel documentation. | | +|`failOverMac` |string |A bond option.
Please see the official kernel documentation. | | +|`adSelect` |string |A bond option.
Please see the official kernel documentation. | | +|`miimon` |uint32 |A bond option.
Please see the official kernel documentation. | | +|`updelay` |uint32 |A bond option.
Please see the official kernel documentation. | | +|`downdelay` |uint32 |A bond option.
Please see the official kernel documentation. | | +|`arpInterval` |uint32 |A bond option.
Please see the official kernel documentation. | | +|`resendIgmp` |uint32 |A bond option.
Please see the official kernel documentation. | | +|`minLinks` |uint32 |A bond option.
Please see the official kernel documentation. | | +|`lpInterval` |uint32 |A bond option.
Please see the official kernel documentation. | | +|`packetsPerSlave` |uint32 |A bond option.
Please see the official kernel documentation. | | +|`numPeerNotif` |uint8 |A bond option.
Please see the official kernel documentation. | | +|`tlbDynamicLb` |uint8 |A bond option.
Please see the official kernel documentation. | | +|`allSlavesActive` |uint8 |A bond option.
Please see the official kernel documentation. | | +|`useCarrier` |bool |A bond option.
Please see the official kernel documentation. | | +|`adActorSysPrio` |uint16 |A bond option.
Please see the official kernel documentation. | | +|`adUserPortKey` |uint16 |A bond option.
Please see the official kernel documentation. | | +|`peerNotifyDelay` |uint32 |A bond option.
Please see the official kernel documentation. | | + + + + +###### deviceSelectors[] {#Config.machine.network.interfaces..bond.deviceSelectors.} + +NetworkDeviceSelector struct describes network device selector. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - bond: + deviceSelectors: + busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + network: + interfaces: + - bond: + deviceSelectors: + hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + driver: virtio_net # Kernel driver, supports matching by wildcard. +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + network: + interfaces: + - bond: + deviceSelectors: + - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + driver: virtio_net # Kernel driver, supports matching by wildcard. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`busPath` |string |PCI, USB bus prefix, supports matching by wildcard. | | +|`hardwareAddr` |string |Device hardware (MAC) address, supports matching by wildcard. | | +|`permanentAddr` |string |Device permanent hardware address, supports matching by wildcard.
The permanent address doesn't change when the link is enslaved to a bond,
so it's recommended to use this field for bond members. | | +|`pciID` |string |PCI ID (vendor ID, product ID), supports matching by wildcard. | | +|`driver` |string |Kernel driver, supports matching by wildcard. | | +|`physical` |bool |Select only physical devices. | | + + + + + + + + +##### bridge {#Config.machine.network.interfaces..bridge} + +Bridge contains the various options for configuring a bridge interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - bridge: + # The interfaces that make up the bridge. + interfaces: + - enxda4042ca9a51 + - enxae2a6774c259 + # Enable STP on this bridge. + stp: + enabled: true # Whether Spanning Tree Protocol (STP) is enabled. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`interfaces` |[]string |The interfaces that make up the bridge. | | +|`stp` |STP |Enable STP on this bridge.
Please see the official kernel documentation. | | +|`vlan` |BridgeVLAN |Enable VLAN-awareness on this bridge.
Please see the official kernel documentation. | | + + + + +###### stp {#Config.machine.network.interfaces..bridge.stp} + +STP contains the various options for configuring the STP properties of a bridge interface. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Whether Spanning Tree Protocol (STP) is enabled. | | + + + + + + +###### vlan {#Config.machine.network.interfaces..bridge.vlan} + +BridgeVLAN contains the various options for configuring the VLAN properties of a bridge interface. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`vlanFiltering` |bool |Whether VLAN filtering is enabled. | | + + + + + + + + +##### bridgePort {#Config.machine.network.interfaces..bridgePort} + +BridgePort contains settings for assigning a link to a bridge interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - bridgePort: + master: br0 # The name of the bridge master interface +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`master` |string |The name of the bridge master interface | | + + + + + + +##### vlans[] {#Config.machine.network.interfaces..vlans.} + +Vlan represents vlan settings for a device. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`addresses` |[]string |The addresses in CIDR notation or as plain IPs to use. | | +|`routes` |[]Route |A list of routes associated with the VLAN. | | +|`dhcp` |bool |Indicates if DHCP should be used. | | +|`vlanId` |uint16 |The VLAN's ID. | | +|`mtu` |uint32 |The VLAN's MTU. | | +|`vip` |DeviceVIPConfig |The VLAN's virtual IP address configuration. | | +|`dhcpOptions` |DHCPOptions |DHCP specific options.
`dhcp` *must* be set to true for these to take effect. | | + + + + +###### routes[] {#Config.machine.network.interfaces..vlans..routes.} + +Route represents a network route. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - vlans: + - routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). + - network: 10.2.0.0/16 # The route's network (destination). + gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`network` |string |The route's network (destination). | | +|`gateway` |string |The route's gateway (if empty, creates link scope route). | | +|`source` |string |The route's source address (optional). | | +|`metric` |uint32 |The optional metric for the route. | | +|`mtu` |uint32 |The optional MTU for the route. | | + + + + + + +###### vip {#Config.machine.network.interfaces..vlans..vip} + +DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - vlans: + - vip: + ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`ip` |string |Specifies the IP address to be used. | | +|`equinixMetal` |VIPEquinixMetalConfig |Specifies the Equinix Metal API settings to assign VIP to the node. | | +|`hcloud` |VIPHCloudConfig |Specifies the Hetzner Cloud API settings to assign VIP to the node. | | + + + + +###### equinixMetal {#Config.machine.network.interfaces..vlans..vip.equinixMetal} + +VIPEquinixMetalConfig contains settings for Equinix Metal VIP management. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`apiToken` |string |Specifies the Equinix Metal API Token. | | + + + + + + +###### hcloud {#Config.machine.network.interfaces..vlans..vip.hcloud} + +VIPHCloudConfig contains settings for Hetzner Cloud VIP management. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`apiToken` |string |Specifies the Hetzner Cloud API Token. | | + + + + + + + + +###### dhcpOptions {#Config.machine.network.interfaces..vlans..dhcpOptions} + +DHCPOptions contains options for configuring the DHCP settings for a given interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - vlans: + - dhcpOptions: + routeMetric: 1024 # The priority of all routes received via DHCP. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`routeMetric` |uint32 |The priority of all routes received via DHCP. | | +|`ipv4` |bool |Enables DHCPv4 protocol for the interface (default is enabled). | | +|`ipv6` |bool |Enables DHCPv6 protocol for the interface (default is disabled). | | +|`duidv6` |string |Set client DUID (hex string). | | + + + + + + + + +##### dhcpOptions {#Config.machine.network.interfaces..dhcpOptions} + +DHCPOptions contains options for configuring the DHCP settings for a given interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - dhcpOptions: + routeMetric: 1024 # The priority of all routes received via DHCP. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`routeMetric` |uint32 |The priority of all routes received via DHCP. | | +|`ipv4` |bool |Enables DHCPv4 protocol for the interface (default is enabled). | | +|`ipv6` |bool |Enables DHCPv6 protocol for the interface (default is disabled). | | +|`duidv6` |string |Set client DUID (hex string). | | + + + + + + +##### wireguard {#Config.machine.network.interfaces..wireguard} + +DeviceWireguardConfig contains settings for configuring Wireguard network interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - wireguard: + privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + listenPort: 51111 # Specifies a device's listening port. + # Specifies a list of peer configurations to apply to a device. + peers: + - publicKey: ABCDEF... # Specifies the public key of this peer. + endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + allowedIPs: + - 192.168.1.0/24 +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + network: + interfaces: + - wireguard: + privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # Specifies a list of peer configurations to apply to a device. + peers: + - publicKey: ABCDEF... # Specifies the public key of this peer. + endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + allowedIPs: + - 192.168.1.0/24 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`privateKey` |string |Specifies a private key configuration (base64 encoded).
Can be generated by `wg genkey`. | | +|`listenPort` |int |Specifies a device's listening port. | | +|`firewallMark` |int |Specifies a device's firewall mark. | | +|`peers` |[]DeviceWireguardPeer |Specifies a list of peer configurations to apply to a device. | | + + + + +###### peers[] {#Config.machine.network.interfaces..wireguard.peers.} + +DeviceWireguardPeer a WireGuard device peer configuration. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`publicKey` |string |Specifies the public key of this peer.
Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`. | | +|`endpoint` |string |Specifies the endpoint of this peer entry. | | +|`persistentKeepaliveInterval` |Duration |Specifies the persistent keepalive interval for this peer.
Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). | | +|`allowedIPs` |[]string |AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. | | + + + + + + + + +##### vip {#Config.machine.network.interfaces..vip} + +DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. + + + +{{< highlight yaml >}} +machine: + network: + interfaces: + - vip: + ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`ip` |string |Specifies the IP address to be used. | | +|`equinixMetal` |VIPEquinixMetalConfig |Specifies the Equinix Metal API settings to assign VIP to the node. | | +|`hcloud` |VIPHCloudConfig |Specifies the Hetzner Cloud API settings to assign VIP to the node. | | + + + + +###### equinixMetal {#Config.machine.network.interfaces..vip.equinixMetal} + +VIPEquinixMetalConfig contains settings for Equinix Metal VIP management. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`apiToken` |string |Specifies the Equinix Metal API Token. | | + + + + + + +###### hcloud {#Config.machine.network.interfaces..vip.hcloud} + +VIPHCloudConfig contains settings for Hetzner Cloud VIP management. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`apiToken` |string |Specifies the Hetzner Cloud API Token. | | + + + + + + + + + + +#### extraHostEntries[] {#Config.machine.network.extraHostEntries.} + +ExtraHost represents a host entry in /etc/hosts. + + + +{{< highlight yaml >}} +machine: + network: + extraHostEntries: + - ip: 192.168.1.100 # The IP of the host. + # The host alias. + aliases: + - example + - example.domain.tld +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`ip` |string |The IP of the host. | | +|`aliases` |[]string |The host alias. | | + + + + + + +#### kubespan {#Config.machine.network.kubespan} + +NetworkKubeSpan struct describes KubeSpan configuration. + + + +{{< highlight yaml >}} +machine: + network: + kubespan: + enabled: true # Enable the KubeSpan feature. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable the KubeSpan feature.
Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled. | | +|`advertiseKubernetesNetworks` |bool |Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.
If disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,
and KubeSpan handles the node-to-node traffic.
If enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.
When enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which
is not always the case with CNIs not relying on Kubernetes for IPAM. | | +|`allowDownPeerBypass` |bool |Skip sending traffic via KubeSpan if the peer connection state is not up.
This provides configurable choice between connectivity and security: either traffic is always
forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly
to the peer if Wireguard connection can't be established. | | +|`harvestExtraEndpoints` |bool |KubeSpan can collect and publish extra endpoints for each member of the cluster
based on Wireguard endpoint information for each peer.
This feature is disabled by default, don't enable it
with high number of peers (>50) in the KubeSpan network (performance issues). | | +|`mtu` |uint32 |KubeSpan link MTU size.
Default value is 1420. | | +|`filters` |KubeSpanFilters |KubeSpan advanced filtering of network addresses .

Settings in this section are optional, and settings apply only to the node. | | + + + + +##### filters {#Config.machine.network.kubespan.filters} + +KubeSpanFilters struct describes KubeSpan advanced network addresses filtering. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoints` |[]string |Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.

By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.

Default value: no filtering.
Show example(s){{< highlight yaml >}} +endpoints: + - 0.0.0.0/0 + - '!192.168.0.0/16' + - ::/0 +{{< /highlight >}}
| | + + + + + + + + + + +### install {#Config.machine.install} + +InstallConfig represents the installation options for preparing a node. + + + +{{< highlight yaml >}} +machine: + install: + disk: /dev/sda # The disk used for installations. + # Allows for supplying extra kernel args via the bootloader. + extraKernelArgs: + - console=ttyS1 + - panic=10 + image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disk` |string |The disk used for installations.
Show example(s){{< highlight yaml >}} +disk: /dev/sda +{{< /highlight >}}{{< highlight yaml >}} +disk: /dev/nvme0 +{{< /highlight >}}
| | +|`diskSelector` |InstallDiskSelector |Look up disk using disk attributes like model, size, serial and others.
Always has priority over `disk`.
Show example(s){{< highlight yaml >}} +diskSelector: + size: '>= 1TB' # Disk size. + model: WDC* # Disk model `/sys/block//device/model`. + + # # Disk bus path. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 + # busPath: /pci0000:00/* +{{< /highlight >}}
| | +|`extraKernelArgs` |[]string |Allows for supplying extra kernel args via the bootloader.
Existing kernel args can be removed by prefixing the argument with a `-`.
For example `-console` removes all `console=` arguments, whereas `-console=tty0` removes the `console=tty0` default argument.
If Talos is using systemd-boot as a bootloader (default for UEFI) this setting will be ignored.
Show example(s){{< highlight yaml >}} +extraKernelArgs: + - talos.platform=metal + - reboot=k +{{< /highlight >}}
| | +|`image` |string |Allows for supplying the image used to perform the installation.
Image reference for each Talos release can be found on
[GitHub releases page](https://github.com/siderolabs/talos/releases).
Show example(s){{< highlight yaml >}} +image: ghcr.io/siderolabs/installer:latest +{{< /highlight >}}
| | +|`wipe` |bool |Indicates if the installation disk should be wiped at installation time.
Defaults to `true`. |`true`
`yes`
`false`
`no`
| +|`legacyBIOSSupport` |bool |Indicates if MBR partition should be marked as bootable (active).
Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme. | | + + + + +#### diskSelector {#Config.machine.install.diskSelector} + +InstallDiskSelector represents a disk query parameters for the install disk lookup. + + + +{{< highlight yaml >}} +machine: + install: + diskSelector: + size: '>= 1TB' # Disk size. + model: WDC* # Disk model `/sys/block//device/model`. + + # # Disk bus path. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 + # busPath: /pci0000:00/* +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`size` |InstallDiskSizeMatcher |Disk size.
Show example(s){{< highlight yaml >}} +size: 4GB +{{< /highlight >}}{{< highlight yaml >}} +size: '> 1TB' +{{< /highlight >}}{{< highlight yaml >}} +size: <= 2TB +{{< /highlight >}}
| | +|`name` |string |Disk name `/sys/block//device/name`. | | +|`model` |string |Disk model `/sys/block//device/model`. | | +|`serial` |string |Disk serial number `/sys/block//serial`. | | +|`modalias` |string |Disk modalias `/sys/block//device/modalias`. | | +|`uuid` |string |Disk UUID `/sys/block//uuid`. | | +|`wwid` |string |Disk WWID `/sys/block//wwid`. | | +|`type` |InstallDiskType |Disk Type. |`ssd`
`hdd`
`nvme`
`sd`
| +|`busPath` |string |Disk bus path.
Show example(s){{< highlight yaml >}} +busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 +{{< /highlight >}}{{< highlight yaml >}} +busPath: /pci0000:00/* +{{< /highlight >}}
| | + + + + + + + + +### files[] {#Config.machine.files.} + +MachineFile represents a file to write to disk. + + + +{{< highlight yaml >}} +machine: + files: + - content: '...' # The contents of the file. + permissions: 0o666 # The file's permissions in octal. + path: /tmp/file.txt # The path of the file. + op: append # The operation to use +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`content` |string |The contents of the file. | | +|`permissions` |FileMode |The file's permissions in octal. | | +|`path` |string |The path of the file. | | +|`op` |string |The operation to use |`create`
`append`
`overwrite`
| + + + + + + +### time {#Config.machine.time} + +TimeConfig represents the options for configuring time on a machine. + + + +{{< highlight yaml >}} +machine: + time: + disabled: false # Indicates if the time service is disabled for the machine. + # description: | + servers: + - time.cloudflare.com + bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Indicates if the time service is disabled for the machine.
Defaults to `false`. | | +|`servers` |[]string |description: |
Specifies time (NTP) servers to use for setting the system time.
Defaults to `time.cloudflare.com`.

Talos can also sync to the PTP time source (e.g provided by the hypervisor),
provide the path to the PTP device as "/dev/ptp0" or "/dev/ptp_kvm".
| | +|`bootTimeout` |Duration |Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
NTP sync will be still running in the background.
Defaults to "infinity" (waiting forever for time sync) | | + + + + + + +### registries {#Config.machine.registries} + +RegistriesConfig represents the image pull options. + + + +{{< highlight yaml >}} +machine: + registries: + # Specifies mirror configuration for each registry host namespace. + mirrors: + docker.io: + # List of endpoints (URLs) for registry mirrors to use. + endpoints: + - https://registry.local + # Specifies TLS & auth configuration for HTTPS image registries. + config: + registry.local: + # The TLS configuration for the registry. + tls: + # Enable mutual TLS authentication with the registry. + clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # The auth configuration for this registry. + auth: + username: username # Optional registry authentication. + password: password # Optional registry authentication. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`mirrors` |map[string]RegistryMirrorConfig |Specifies mirror configuration for each registry host namespace.
This setting allows to configure local pull-through caching registires,
air-gapped installations, etc.

For example, when pulling an image with the reference `example.com:123/image:v1`,
the `example.com:123` key will be used to lookup the mirror configuration.

Optionally the `*` key can be used to configure a fallback mirror.

Registry name is the first segment of image identifier, with 'docker.io'
being default one.
Show example(s){{< highlight yaml >}} +mirrors: + ghcr.io: + # List of endpoints (URLs) for registry mirrors to use. + endpoints: + - https://registry.insecure + - https://ghcr.io/v2/ +{{< /highlight >}}
| | +|`config` |map[string]RegistryConfig |Specifies TLS & auth configuration for HTTPS image registries.
Mutual TLS can be enabled with 'clientIdentity' option.

The full hostname and port (if not using a default port 443)
should be used as the key.
The fallback key `*` can't be used for TLS configuration.

TLS configuration can be skipped if registry has trusted
server certificate.
Show example(s){{< highlight yaml >}} +config: + registry.insecure: + # The TLS configuration for the registry. + tls: + insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + + # # Enable mutual TLS authentication with the registry. + # clientIdentity: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # The auth configuration for this registry. + # auth: + # username: username # Optional registry authentication. + # password: password # Optional registry authentication. +{{< /highlight >}}
| | + + + + +#### mirrors.* {#Config.machine.registries.mirrors.-} + +RegistryMirrorConfig represents mirror configuration for a registry. + + + +{{< highlight yaml >}} +machine: + registries: + mirrors: + ghcr.io: + # List of endpoints (URLs) for registry mirrors to use. + endpoints: + - https://registry.insecure + - https://ghcr.io/v2/ +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoints` |[]string |List of endpoints (URLs) for registry mirrors to use.
Endpoint configures HTTP/HTTPS access mode, host name,
port and path (if path is not set, it defaults to `/v2`). | | +|`overridePath` |bool |Use the exact path specified for the endpoint (don't append /v2/).
This setting is often required for setting up multiple mirrors
on a single instance of a registry. | | +|`skipFallback` |bool |Skip fallback to the upstream endpoint, for example the mirror configuration
for `docker.io` will not fallback to `registry-1.docker.io`. | | + + + + + + +#### config.* {#Config.machine.registries.config.-} + +RegistryConfig specifies auth & TLS config per registry. + + + +{{< highlight yaml >}} +machine: + registries: + config: + registry.insecure: + # The TLS configuration for the registry. + tls: + insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + + # # Enable mutual TLS authentication with the registry. + # clientIdentity: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # The auth configuration for this registry. + # auth: + # username: username # Optional registry authentication. + # password: password # Optional registry authentication. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`tls` |RegistryTLSConfig |The TLS configuration for the registry.
Show example(s){{< highlight yaml >}} +tls: + # Enable mutual TLS authentication with the registry. + clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}{{< highlight yaml >}} +tls: + insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + + # # Enable mutual TLS authentication with the registry. + # clientIdentity: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`auth` |RegistryAuthConfig |The auth configuration for this registry.
Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.
Show example(s){{< highlight yaml >}} +auth: + username: username # Optional registry authentication. + password: password # Optional registry authentication. +{{< /highlight >}}
| | + + + + +##### tls {#Config.machine.registries.config.-.tls} + +RegistryTLSConfig specifies TLS config for HTTPS registries. + + + +{{< highlight yaml >}} +machine: + registries: + config: + example.com: + tls: + # Enable mutual TLS authentication with the registry. + clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + registries: + config: + example.com: + tls: + insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + + # # Enable mutual TLS authentication with the registry. + # clientIdentity: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`clientIdentity` |PEMEncodedCertificateAndKey |Enable mutual TLS authentication with the registry.
Client certificate and key should be base64-encoded.
Show example(s){{< highlight yaml >}} +clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`ca` |Base64Bytes |CA registry certificate to add the list of trusted certificates.
Certificate should be base64-encoded. | | +|`insecureSkipVerify` |bool |Skip TLS server certificate verification (not recommended). | | + + + + + + +##### auth {#Config.machine.registries.config.-.auth} + +RegistryAuthConfig specifies authentication configuration for a registry. + + + +{{< highlight yaml >}} +machine: + registries: + config: + example.com: + auth: + username: username # Optional registry authentication. + password: password # Optional registry authentication. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`username` |string |Optional registry authentication.
The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication). | | +|`password` |string |Optional registry authentication.
The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication). | | +|`auth` |string |Optional registry authentication.
The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication). | | +|`identityToken` |string |Optional registry authentication.
The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication). | | + + + + + + + + + + +### features {#Config.machine.features} + +FeaturesConfig describes individual Talos features that can be switched on or off. + + + +{{< highlight yaml >}} +machine: + features: + rbac: true # Enable role-based access control (RBAC). + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`rbac` |bool |Enable role-based access control (RBAC). | | +|`stableHostname` |bool |Enable stable default hostname. | | +|`kubernetesTalosAPIAccess` |KubernetesTalosAPIAccessConfig |Configure Talos API access from Kubernetes pods.

This feature is disabled if the feature config is not specified.
Show example(s){{< highlight yaml >}} +kubernetesTalosAPIAccess: + enabled: true # Enable Talos API access from Kubernetes pods. + # The list of Talos API roles which can be granted for access from Kubernetes pods. + allowedRoles: + - os:reader + # The list of Kubernetes namespaces Talos API access is available from. + allowedKubernetesNamespaces: + - kube-system +{{< /highlight >}}
| | +|`apidCheckExtKeyUsage` |bool |Enable checks for extended key usage of client certificates in apid. | | +|`diskQuotaSupport` |bool |Enable XFS project quota support for EPHEMERAL partition and user disks.
Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota. | | +|`kubePrism` |KubePrism |KubePrism - local proxy/load balancer on defined port that will distribute
requests to all API servers in the cluster. | | +|`hostDNS` |HostDNSConfig |Configures host DNS caching resolver. | | +|`imageCache` |ImageCacheConfig |Enable Image Cache feature. | | +|`nodeAddressSortAlgorithm` |string |Select the node address sort algorithm.
The 'v1' algorithm sorts addresses by the address itself.
The 'v2' algorithm prefers more specific prefixes.
If unset, defaults to 'v1'. | | + + + + +#### kubernetesTalosAPIAccess {#Config.machine.features.kubernetesTalosAPIAccess} + +KubernetesTalosAPIAccessConfig describes the configuration for the Talos API access from Kubernetes pods. + + + +{{< highlight yaml >}} +machine: + features: + kubernetesTalosAPIAccess: + enabled: true # Enable Talos API access from Kubernetes pods. + # The list of Talos API roles which can be granted for access from Kubernetes pods. + allowedRoles: + - os:reader + # The list of Kubernetes namespaces Talos API access is available from. + allowedKubernetesNamespaces: + - kube-system +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable Talos API access from Kubernetes pods. | | +|`allowedRoles` |[]string |The list of Talos API roles which can be granted for access from Kubernetes pods.

Empty list means that no roles can be granted, so access is blocked. | | +|`allowedKubernetesNamespaces` |[]string |The list of Kubernetes namespaces Talos API access is available from. | | + + + + + + +#### kubePrism {#Config.machine.features.kubePrism} + +KubePrism describes the configuration for the KubePrism load balancer. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable KubePrism support - will start local load balancing proxy. | | +|`port` |int |KubePrism port. | | + + + + + + +#### hostDNS {#Config.machine.features.hostDNS} + +HostDNSConfig describes the configuration for the host DNS resolver. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable host DNS caching resolver. | | +|`forwardKubeDNSToHost` |bool |Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.

When enabled, CoreDNS pods use host DNS server as the upstream DNS (instead of
using configured upstream DNS resolvers directly). | | +|`resolveMemberNames` |bool |Resolve member hostnames using the host DNS resolver.

When enabled, cluster member hostnames and node names are resolved using the host DNS resolver.
This requires service discovery to be enabled. | | + + + + + + +#### imageCache {#Config.machine.features.imageCache} + +ImageCacheConfig describes the configuration for the Image Cache feature. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`localEnabled` |bool |Enable local image cache. | | + + + + + + + + +### udev {#Config.machine.udev} + +UdevConfig describes how the udev system should be configured. + + + +{{< highlight yaml >}} +machine: + udev: + # List of udev rules to apply to the udev system + rules: + - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`rules` |[]string |List of udev rules to apply to the udev system | | + + + + + + +### logging {#Config.machine.logging} + +LoggingConfig struct configures Talos logging. + + + +{{< highlight yaml >}} +machine: + logging: + # Logging destination. + destinations: + - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + format: json_lines # Logs format. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`destinations` |[]LoggingDestination |Logging destination. | | + + + + +#### destinations[] {#Config.machine.logging.destinations.} + +LoggingDestination struct configures Talos logging destination. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |Endpoint |Where to send logs. Supported protocols are "tcp" and "udp".
Show example(s){{< highlight yaml >}} +endpoint: udp://127.0.0.1:12345 +{{< /highlight >}}{{< highlight yaml >}} +endpoint: tcp://1.2.3.4:12345 +{{< /highlight >}}
| | +|`format` |string |Logs format. |`json_lines`
| +|`extraTags` |map[string]string |Extra tags (key-value) pairs to attach to every log message sent. | | + + + + +##### endpoint {#Config.machine.logging.destinations..endpoint} + +Endpoint represents the endpoint URL parsed out of the machine config. + + + +{{< highlight yaml >}} +machine: + logging: + destinations: + - endpoint: https://1.2.3.4:6443 +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + logging: + destinations: + - endpoint: https://cluster1.internal:6443 +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + logging: + destinations: + - endpoint: udp://127.0.0.1:12345 +{{< /highlight >}} + +{{< highlight yaml >}} +machine: + logging: + destinations: + - endpoint: tcp://1.2.3.4:12345 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| + + + + + + + + + + +### kernel {#Config.machine.kernel} + +KernelConfig struct configures Talos Linux kernel. + + + +{{< highlight yaml >}} +machine: + kernel: + # Kernel modules to load. + modules: + - name: brtfs # Module name. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`modules` |[]KernelModuleConfig |Kernel modules to load. | | + + + + +#### modules[] {#Config.machine.kernel.modules.} + +KernelModuleConfig struct configures Linux kernel modules to load. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Module name. | | +|`parameters` |[]string |Module parameters, changes applied after reboot. | | + + + + + + + + +### seccompProfiles[] {#Config.machine.seccompProfiles.} + +MachineSeccompProfile defines seccomp profiles for the machine. + + + +{{< highlight yaml >}} +machine: + seccompProfiles: + - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # The `value` field is used to provide the seccomp profile. + value: + defaultAction: SCMP_ACT_LOG +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |The `name` field is used to provide the file name of the seccomp profile. | | +|`value` |Unstructured |The `value` field is used to provide the seccomp profile. | | + + + + + + + + +## cluster {#Config.cluster} + +ClusterConfig represents the cluster-wide config values. + + + +{{< highlight yaml >}} +cluster: + # ControlPlaneConfig represents the control plane configuration options. + controlPlane: + endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + localAPIServerPort: 443 # The port that the API server listens on internally. + clusterName: talos.local + # ClusterNetworkConfig represents kube networking configuration options. + network: + # The CNI used. + cni: + name: flannel # Name of CNI to use. + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`id` |string |Globally unique identifier for this cluster (base64 encoded random 32 bytes). | | +|`secret` |string |Shared secret of cluster (base64 encoded random 32 bytes).
This secret is shared among cluster members but should never be sent over the network. | | +|`controlPlane` |ControlPlaneConfig |Provides control plane specific configuration options.
Show example(s){{< highlight yaml >}} +controlPlane: + endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + localAPIServerPort: 443 # The port that the API server listens on internally. +{{< /highlight >}}
| | +|`clusterName` |string |Configures the cluster's name. | | +|`network` |ClusterNetworkConfig |Provides cluster specific network configuration options.
Show example(s){{< highlight yaml >}} +network: + # The CNI used. + cni: + name: flannel # Name of CNI to use. + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 +{{< /highlight >}}
| | +|`token` |string |The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
Show example(s){{< highlight yaml >}} +token: wlzjyw.bei2zfylhs2by0wd +{{< /highlight >}}
| | +|`aescbcEncryptionSecret` |string |A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
Enables encryption with AESCBC.
Show example(s){{< highlight yaml >}} +aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= +{{< /highlight >}}
| | +|`secretboxEncryptionSecret` |string |A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
Enables encryption with secretbox.
Secretbox has precedence over AESCBC.
Show example(s){{< highlight yaml >}} +secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= +{{< /highlight >}}
| | +|`ca` |PEMEncodedCertificateAndKey |The base64 encoded root certificate authority used by Kubernetes.
Show example(s){{< highlight yaml >}} +ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`acceptedCAs` |[]PEMEncodedCertificate |The list of base64 encoded accepted certificate authorities used by Kubernetes. | | +|`aggregatorCA` |PEMEncodedCertificateAndKey |The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.

This CA can be self-signed.
Show example(s){{< highlight yaml >}} +aggregatorCA: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`serviceAccount` |PEMEncodedKey |The base64 encoded private key for service account token generation.
Show example(s){{< highlight yaml >}} +serviceAccount: + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`apiServer` |APIServerConfig |API server specific configuration options.
Show example(s){{< highlight yaml >}} +apiServer: + image: registry.k8s.io/kube-apiserver:v1.34.0-rc.1 # The container image used in the API server manifest. + # Extra arguments to supply to the API server. + extraArgs: + feature-gates: ServerSideApply=true + http2-max-streams-per-connection: "32" + # Extra certificate subject alternative names for the API server's certificate. + certSANs: + - 1.2.3.4 + - 4.5.6.7 + + # # Configure the API server admission plugins. + # admissionControl: + # - name: PodSecurity # Name is the name of the admission controller. + # # Configuration is an embedded configuration object to be used as the plugin's + # configuration: + # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + # defaults: + # audit: restricted + # audit-version: latest + # enforce: baseline + # enforce-version: latest + # warn: restricted + # warn-version: latest + # exemptions: + # namespaces: + # - kube-system + # runtimeClasses: [] + # usernames: [] + # kind: PodSecurityConfiguration + + # # Configure the API server audit policy. + # auditPolicy: + # apiVersion: audit.k8s.io/v1 + # kind: Policy + # rules: + # - level: Metadata + + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s +{{< /highlight >}}
| | +|`controllerManager` |ControllerManagerConfig |Controller manager server specific configuration options.
Show example(s){{< highlight yaml >}} +controllerManager: + image: registry.k8s.io/kube-controller-manager:v1.34.0-rc.1 # The container image used in the controller manager manifest. + # Extra arguments to supply to the controller manager. + extraArgs: + feature-gates: ServerSideApply=true +{{< /highlight >}}
| | +|`proxy` |ProxyConfig |Kube-proxy server-specific configuration options
Show example(s){{< highlight yaml >}} +proxy: + image: registry.k8s.io/kube-proxy:v1.34.0-rc.1 # The container image used in the kube-proxy manifest. + mode: ipvs # proxy mode of kube-proxy. + # Extra arguments to supply to kube-proxy. + extraArgs: + proxy-mode: iptables + + # # Disable kube-proxy deployment on cluster bootstrap. + # disabled: false +{{< /highlight >}}
| | +|`scheduler` |SchedulerConfig |Scheduler server specific configuration options.
Show example(s){{< highlight yaml >}} +scheduler: + image: registry.k8s.io/kube-scheduler:v1.34.0-rc.1 # The container image used in the scheduler manifest. + # Extra arguments to supply to the scheduler. + extraArgs: + feature-gates: AllBeta=true +{{< /highlight >}}
| | +|`discovery` |ClusterDiscoveryConfig |Configures cluster member discovery.
Show example(s){{< highlight yaml >}} +discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: {} + # Service registry is using an external service to push and pull information about cluster members. + service: + endpoint: https://discovery.talos.dev/ # External service endpoint. +{{< /highlight >}}
| | +|`etcd` |EtcdConfig |Etcd specific configuration options.
Show example(s){{< highlight yaml >}} +etcd: + image: gcr.io/etcd-development/etcd:v3.6.4 # The container image used to create the etcd service. + # The `ca` is the root certificate authority of the PKI. + ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # Extra arguments to supply to etcd. + extraArgs: + election-timeout: "5000" + + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 +{{< /highlight >}}
| | +|`coreDNS` |CoreDNS |Core DNS specific configuration options.
Show example(s){{< highlight yaml >}} +coreDNS: + image: registry.k8s.io/coredns/coredns:v1.12.2 # The `image` field is an override to the default coredns image. +{{< /highlight >}}
| | +|`externalCloudProvider` |ExternalCloudProviderConfig |External cloud provider configuration.
Show example(s){{< highlight yaml >}} +externalCloudProvider: + enabled: true # Enable external cloud provider. + # A list of urls that point to additional manifests for an external cloud provider. + manifests: + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml +{{< /highlight >}}
| | +|`extraManifests` |[]string |A list of urls that point to additional manifests.
These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} +extraManifests: + - https://www.example.com/manifest1.yaml + - https://www.example.com/manifest2.yaml +{{< /highlight >}}
| | +|`extraManifestHeaders` |map[string]string |A map of key value pairs that will be added while fetching the extraManifests.
Show example(s){{< highlight yaml >}} +extraManifestHeaders: + Token: "1234567" + X-ExtraInfo: info +{{< /highlight >}}
| | +|`inlineManifests` |[]ClusterInlineManifest |A list of inline Kubernetes manifests.
These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} +inlineManifests: + - name: namespace-ci # Name of the manifest. + contents: |- # Manifest contents as a string. + apiVersion: v1 + kind: Namespace + metadata: + name: ci +{{< /highlight >}}
| | +|`adminKubeconfig` |AdminKubeconfigConfig |Settings for admin kubeconfig generation.
Certificate lifetime can be configured.
Show example(s){{< highlight yaml >}} +adminKubeconfig: + certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). +{{< /highlight >}}
| | +|`allowSchedulingOnControlPlanes` |bool |Allows running workload on control-plane nodes.
Show example(s){{< highlight yaml >}} +allowSchedulingOnControlPlanes: true +{{< /highlight >}}
|`true`
`yes`
`false`
`no`
| + + + + +### controlPlane {#Config.cluster.controlPlane} + +ControlPlaneConfig represents the control plane configuration options. + + + +{{< highlight yaml >}} +cluster: + controlPlane: + endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + localAPIServerPort: 443 # The port that the API server listens on internally. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |Endpoint |Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
It is single-valued, and may optionally include a port number.
Show example(s){{< highlight yaml >}} +endpoint: https://1.2.3.4:6443 +{{< /highlight >}}{{< highlight yaml >}} +endpoint: https://cluster1.internal:6443 +{{< /highlight >}}
| | +|`localAPIServerPort` |int |The port that the API server listens on internally.
This may be different than the port portion listed in the endpoint field above.
The default is `6443`. | | + + + + +#### endpoint {#Config.cluster.controlPlane.endpoint} + +Endpoint represents the endpoint URL parsed out of the machine config. + + + +{{< highlight yaml >}} +cluster: + controlPlane: + endpoint: https://1.2.3.4:6443 +{{< /highlight >}} + +{{< highlight yaml >}} +cluster: + controlPlane: + endpoint: https://cluster1.internal:6443 +{{< /highlight >}} + +{{< highlight yaml >}} +cluster: + controlPlane: + endpoint: udp://127.0.0.1:12345 +{{< /highlight >}} + +{{< highlight yaml >}} +cluster: + controlPlane: + endpoint: tcp://1.2.3.4:12345 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| + + + + + + + + +### network {#Config.cluster.network} + +ClusterNetworkConfig represents kube networking configuration options. + + + +{{< highlight yaml >}} +cluster: + network: + # The CNI used. + cni: + name: flannel # Name of CNI to use. + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`cni` |CNIConfig |The CNI used.
Composed of "name" and "urls".
The "name" key supports the following options: "flannel", "custom", and "none".
"flannel" uses Talos-managed Flannel CNI, and that's the default option.
"custom" uses custom manifests that should be provided in "urls".
"none" indicates that Talos will not manage any CNI installation.
Show example(s){{< highlight yaml >}} +cni: + name: custom # Name of CNI to use. + # URLs containing manifests to apply for the CNI. + urls: + - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml +{{< /highlight >}}
| | +|`dnsDomain` |string |The domain used by Kubernetes DNS.
The default is `cluster.local`
Show example(s){{< highlight yaml >}} +dnsDomain: cluster.local +{{< /highlight >}}
| | +|`podSubnets` |[]string |The pod subnet CIDR.
Show example(s){{< highlight yaml >}} +podSubnets: + - 10.244.0.0/16 +{{< /highlight >}}
| | +|`serviceSubnets` |[]string |The service subnet CIDR.
Show example(s){{< highlight yaml >}} +serviceSubnets: + - 10.96.0.0/12 +{{< /highlight >}}
| | + + + + +#### cni {#Config.cluster.network.cni} + +CNIConfig represents the CNI configuration options. + + + +{{< highlight yaml >}} +cluster: + network: + cni: + name: custom # Name of CNI to use. + # URLs containing manifests to apply for the CNI. + urls: + - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of CNI to use. |`flannel`
`custom`
`none`
| +|`urls` |[]string |URLs containing manifests to apply for the CNI.
Should be present for "custom", must be empty for "flannel" and "none". | | +|`flannel` |FlannelCNIConfig |description: |
Flannel configuration options.
| | + + + + +##### flannel {#Config.cluster.network.cni.flannel} + +FlannelCNIConfig represents the Flannel CNI configuration options. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`extraArgs` |[]string |Extra arguments for 'flanneld'.
Show example(s){{< highlight yaml >}} +extraArgs: + - --iface-can-reach=192.168.1.1 +{{< /highlight >}}
| | + + + + + + + + + + +### apiServer {#Config.cluster.apiServer} + +APIServerConfig represents the kube apiserver configuration options. + + + +{{< highlight yaml >}} +cluster: + apiServer: + image: registry.k8s.io/kube-apiserver:v1.34.0-rc.1 # The container image used in the API server manifest. + # Extra arguments to supply to the API server. + extraArgs: + feature-gates: ServerSideApply=true + http2-max-streams-per-connection: "32" + # Extra certificate subject alternative names for the API server's certificate. + certSANs: + - 1.2.3.4 + - 4.5.6.7 + + # # Configure the API server admission plugins. + # admissionControl: + # - name: PodSecurity # Name is the name of the admission controller. + # # Configuration is an embedded configuration object to be used as the plugin's + # configuration: + # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + # defaults: + # audit: restricted + # audit-version: latest + # enforce: baseline + # enforce-version: latest + # warn: restricted + # warn-version: latest + # exemptions: + # namespaces: + # - kube-system + # runtimeClasses: [] + # usernames: [] + # kind: PodSecurityConfiguration + + # # Configure the API server audit policy. + # auditPolicy: + # apiVersion: audit.k8s.io/v1 + # kind: Policy + # rules: + # - level: Metadata + + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The container image used in the API server manifest.
Show example(s){{< highlight yaml >}} +image: registry.k8s.io/kube-apiserver:v1.34.0-rc.1 +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |Extra arguments to supply to the API server. | | +|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the API server static pod. | | +|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | +|`certSANs` |[]string |Extra certificate subject alternative names for the API server's certificate. | | +|`disablePodSecurityPolicy` |bool |Disable PodSecurityPolicy in the API server and default manifests. | | +|`admissionControl` |[]AdmissionPluginConfig |Configure the API server admission plugins.
Show example(s){{< highlight yaml >}} +admissionControl: + - name: PodSecurity # Name is the name of the admission controller. + # Configuration is an embedded configuration object to be used as the plugin's + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration +{{< /highlight >}}
| | +|`auditPolicy` |Unstructured |Configure the API server audit policy.
Show example(s){{< highlight yaml >}} +auditPolicy: + apiVersion: audit.k8s.io/v1 + kind: Policy + rules: + - level: Metadata +{{< /highlight >}}
| | +|`resources` |ResourcesConfig |Configure the API server resources. | | +|`authorizationConfig` |[]AuthorizationConfigAuthorizerConfig |Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
Show example(s){{< highlight yaml >}} +authorizationConfig: + - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + name: webhook # Name is used to describe the authorizer. + # webhook is the configuration for the webhook authorizer. + webhook: + connectionInfo: + type: InClusterConfig + failurePolicy: Deny + matchConditionSubjectAccessReviewVersion: v1 + matchConditions: + - expression: has(request.resourceAttributes) + - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + subjectAccessReviewVersion: v1 + timeout: 3s + - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + name: in-cluster-authorizer # Name is used to describe the authorizer. + # webhook is the configuration for the webhook authorizer. + webhook: + connectionInfo: + type: InClusterConfig + failurePolicy: NoOpinion + matchConditionSubjectAccessReviewVersion: v1 + subjectAccessReviewVersion: v1 + timeout: 3s +{{< /highlight >}}
| | + + + + +#### extraVolumes[] {#Config.cluster.apiServer.extraVolumes.} + +VolumeMountConfig struct describes extra volume mount for the static pods. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`hostPath` |string |Path on the host.
Show example(s){{< highlight yaml >}} +hostPath: /var/lib/auth +{{< /highlight >}}
| | +|`mountPath` |string |Path in the container.
Show example(s){{< highlight yaml >}} +mountPath: /etc/kubernetes/auth +{{< /highlight >}}
| | +|`readonly` |bool |Mount the volume read only.
Show example(s){{< highlight yaml >}} +readonly: true +{{< /highlight >}}
| | + + + + + + +#### admissionControl[] {#Config.cluster.apiServer.admissionControl.} + +AdmissionPluginConfig represents the API server admission plugin configuration. + + + +{{< highlight yaml >}} +cluster: + apiServer: + admissionControl: + - name: PodSecurity # Name is the name of the admission controller. + # Configuration is an embedded configuration object to be used as the plugin's + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name is the name of the admission controller.
It must match the registered admission plugin name. | | +|`configuration` |Unstructured |Configuration is an embedded configuration object to be used as the plugin's
configuration. | | + + + + + + +#### resources {#Config.cluster.apiServer.resources} + +ResourcesConfig represents the pod resources. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`requests` |Unstructured |Requests configures the reserved cpu/memory resources.
Show example(s){{< highlight yaml >}} +requests: + cpu: 1 + memory: 1Gi +{{< /highlight >}}
| | +|`limits` |Unstructured |Limits configures the maximum cpu/memory resources a container can use.
Show example(s){{< highlight yaml >}} +limits: + cpu: 2 + memory: 2500Mi +{{< /highlight >}}
| | + + + + + + +#### authorizationConfig[] {#Config.cluster.apiServer.authorizationConfig.} + +AuthorizationConfigAuthorizerConfig represents the API server authorization config authorizer configuration. + + + +{{< highlight yaml >}} +cluster: + apiServer: + authorizationConfig: + - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + name: webhook # Name is used to describe the authorizer. + # webhook is the configuration for the webhook authorizer. + webhook: + connectionInfo: + type: InClusterConfig + failurePolicy: Deny + matchConditionSubjectAccessReviewVersion: v1 + matchConditions: + - expression: has(request.resourceAttributes) + - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + subjectAccessReviewVersion: v1 + timeout: 3s + - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + name: in-cluster-authorizer # Name is used to describe the authorizer. + # webhook is the configuration for the webhook authorizer. + webhook: + connectionInfo: + type: InClusterConfig + failurePolicy: NoOpinion + matchConditionSubjectAccessReviewVersion: v1 + subjectAccessReviewVersion: v1 + timeout: 3s +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`type` |string |Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. | | +|`name` |string |Name is used to describe the authorizer. | | +|`webhook` |Unstructured |webhook is the configuration for the webhook authorizer. | | + + + + + + + + +### controllerManager {#Config.cluster.controllerManager} + +ControllerManagerConfig represents the kube controller manager configuration options. + + + +{{< highlight yaml >}} +cluster: + controllerManager: + image: registry.k8s.io/kube-controller-manager:v1.34.0-rc.1 # The container image used in the controller manager manifest. + # Extra arguments to supply to the controller manager. + extraArgs: + feature-gates: ServerSideApply=true +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The container image used in the controller manager manifest.
Show example(s){{< highlight yaml >}} +image: registry.k8s.io/kube-controller-manager:v1.34.0-rc.1 +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |Extra arguments to supply to the controller manager. | | +|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the controller manager static pod. | | +|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | +|`resources` |ResourcesConfig |Configure the controller manager resources. | | + + + + +#### extraVolumes[] {#Config.cluster.controllerManager.extraVolumes.} + +VolumeMountConfig struct describes extra volume mount for the static pods. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`hostPath` |string |Path on the host.
Show example(s){{< highlight yaml >}} +hostPath: /var/lib/auth +{{< /highlight >}}
| | +|`mountPath` |string |Path in the container.
Show example(s){{< highlight yaml >}} +mountPath: /etc/kubernetes/auth +{{< /highlight >}}
| | +|`readonly` |bool |Mount the volume read only.
Show example(s){{< highlight yaml >}} +readonly: true +{{< /highlight >}}
| | + + + + + + +#### resources {#Config.cluster.controllerManager.resources} + +ResourcesConfig represents the pod resources. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`requests` |Unstructured |Requests configures the reserved cpu/memory resources.
Show example(s){{< highlight yaml >}} +requests: + cpu: 1 + memory: 1Gi +{{< /highlight >}}
| | +|`limits` |Unstructured |Limits configures the maximum cpu/memory resources a container can use.
Show example(s){{< highlight yaml >}} +limits: + cpu: 2 + memory: 2500Mi +{{< /highlight >}}
| | + + + + + + + + +### proxy {#Config.cluster.proxy} + +ProxyConfig represents the kube proxy configuration options. + + + +{{< highlight yaml >}} +cluster: + proxy: + image: registry.k8s.io/kube-proxy:v1.34.0-rc.1 # The container image used in the kube-proxy manifest. + mode: ipvs # proxy mode of kube-proxy. + # Extra arguments to supply to kube-proxy. + extraArgs: + proxy-mode: iptables + + # # Disable kube-proxy deployment on cluster bootstrap. + # disabled: false +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable kube-proxy deployment on cluster bootstrap.
Show example(s){{< highlight yaml >}} +disabled: false +{{< /highlight >}}
| | +|`image` |string |The container image used in the kube-proxy manifest.
Show example(s){{< highlight yaml >}} +image: registry.k8s.io/kube-proxy:v1.34.0-rc.1 +{{< /highlight >}}
| | +|`mode` |string |proxy mode of kube-proxy.
The default is 'iptables'. | | +|`extraArgs` |map[string]string |Extra arguments to supply to kube-proxy. | | + + + + + + +### scheduler {#Config.cluster.scheduler} + +SchedulerConfig represents the kube scheduler configuration options. + + + +{{< highlight yaml >}} +cluster: + scheduler: + image: registry.k8s.io/kube-scheduler:v1.34.0-rc.1 # The container image used in the scheduler manifest. + # Extra arguments to supply to the scheduler. + extraArgs: + feature-gates: AllBeta=true +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The container image used in the scheduler manifest.
Show example(s){{< highlight yaml >}} +image: registry.k8s.io/kube-scheduler:v1.34.0-rc.1 +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |Extra arguments to supply to the scheduler. | | +|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the scheduler static pod. | | +|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | +|`resources` |ResourcesConfig |Configure the scheduler resources. | | +|`config` |Unstructured |Specify custom kube-scheduler configuration. | | + + + + +#### extraVolumes[] {#Config.cluster.scheduler.extraVolumes.} + +VolumeMountConfig struct describes extra volume mount for the static pods. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`hostPath` |string |Path on the host.
Show example(s){{< highlight yaml >}} +hostPath: /var/lib/auth +{{< /highlight >}}
| | +|`mountPath` |string |Path in the container.
Show example(s){{< highlight yaml >}} +mountPath: /etc/kubernetes/auth +{{< /highlight >}}
| | +|`readonly` |bool |Mount the volume read only.
Show example(s){{< highlight yaml >}} +readonly: true +{{< /highlight >}}
| | + + + + + + +#### resources {#Config.cluster.scheduler.resources} + +ResourcesConfig represents the pod resources. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`requests` |Unstructured |Requests configures the reserved cpu/memory resources.
Show example(s){{< highlight yaml >}} +requests: + cpu: 1 + memory: 1Gi +{{< /highlight >}}
| | +|`limits` |Unstructured |Limits configures the maximum cpu/memory resources a container can use.
Show example(s){{< highlight yaml >}} +limits: + cpu: 2 + memory: 2500Mi +{{< /highlight >}}
| | + + + + + + + + +### discovery {#Config.cluster.discovery} + +ClusterDiscoveryConfig struct configures cluster membership discovery. + + + +{{< highlight yaml >}} +cluster: + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: {} + # Service registry is using an external service to push and pull information about cluster members. + service: + endpoint: https://discovery.talos.dev/ # External service endpoint. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable the cluster membership discovery feature.
Cluster discovery is based on individual registries which are configured under the registries field. | | +|`registries` |DiscoveryRegistriesConfig |Configure registries used for cluster member discovery. | | + + + + +#### registries {#Config.cluster.discovery.registries} + +DiscoveryRegistriesConfig struct configures cluster membership discovery. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`kubernetes` |RegistryKubernetesConfig |Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
as annotations on the Node resources.

This feature is deprecated as it is not compatible with Kubernetes 1.32+.
See https://github.com/siderolabs/talos/issues/9980 for more information. | | +|`service` |RegistryServiceConfig |Service registry is using an external service to push and pull information about cluster members. | | + + + + +##### kubernetes {#Config.cluster.discovery.registries.kubernetes} + +RegistryKubernetesConfig struct configures Kubernetes discovery registry. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable Kubernetes discovery registry. | | + + + + + + +##### service {#Config.cluster.discovery.registries.service} + +RegistryServiceConfig struct configures Kubernetes discovery registry. + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable external service discovery registry. | | +|`endpoint` |string |External service endpoint.
Show example(s){{< highlight yaml >}} +endpoint: https://discovery.talos.dev/ +{{< /highlight >}}
| | + + + + + + + + + + +### etcd {#Config.cluster.etcd} + +EtcdConfig represents the etcd configuration options. + + + +{{< highlight yaml >}} +cluster: + etcd: + image: gcr.io/etcd-development/etcd:v3.6.4 # The container image used to create the etcd service. + # The `ca` is the root certificate authority of the PKI. + ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # Extra arguments to supply to etcd. + extraArgs: + election-timeout: "5000" + + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The container image used to create the etcd service.
Show example(s){{< highlight yaml >}} +image: gcr.io/etcd-development/etcd:v3.6.4 +{{< /highlight >}}
| | +|`ca` |PEMEncodedCertificateAndKey |The `ca` is the root certificate authority of the PKI.
It is composed of a base64 encoded `crt` and `key`.
Show example(s){{< highlight yaml >}} +ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |Extra arguments to supply to etcd.
Note that the following args are not allowed:

- `name`
- `data-dir`
- `initial-cluster-state`
- `listen-peer-urls`
- `listen-client-urls`
- `cert-file`
- `key-file`
- `trusted-ca-file`
- `peer-client-cert-auth`
- `peer-cert-file`
- `peer-trusted-ca-file`
- `peer-key-file` | | +|`advertisedSubnets` |[]string |The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.

IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.
Show example(s){{< highlight yaml >}} +advertisedSubnets: + - 10.0.0.0/8 +{{< /highlight >}}
| | +|`listenSubnets` |[]string |The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections.

If `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to
`advertisedSubnets`.

If neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses.

IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node. | | + + + + + + +### coreDNS {#Config.cluster.coreDNS} + +CoreDNS represents the CoreDNS config values. + + + +{{< highlight yaml >}} +cluster: + coreDNS: + image: registry.k8s.io/coredns/coredns:v1.12.2 # The `image` field is an override to the default coredns image. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable coredns deployment on cluster bootstrap. | | +|`image` |string |The `image` field is an override to the default coredns image. | | + + + + + + +### externalCloudProvider {#Config.cluster.externalCloudProvider} + +ExternalCloudProviderConfig contains external cloud provider configuration. + + + +{{< highlight yaml >}} +cluster: + externalCloudProvider: + enabled: true # Enable external cloud provider. + # A list of urls that point to additional manifests for an external cloud provider. + manifests: + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable external cloud provider. |`true`
`yes`
`false`
`no`
| +|`manifests` |[]string |A list of urls that point to additional manifests for an external cloud provider.
These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} +manifests: + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml +{{< /highlight >}}
| | + + + + + + +### inlineManifests[] {#Config.cluster.inlineManifests.} + +ClusterInlineManifest struct describes inline bootstrap manifests for the user. + + + +{{< highlight yaml >}} +cluster: + inlineManifests: + - name: namespace-ci # Name of the manifest. + contents: |- # Manifest contents as a string. + apiVersion: v1 + kind: Namespace + metadata: + name: ci +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of the manifest.
Name should be unique.
Show example(s){{< highlight yaml >}} +name: csi +{{< /highlight >}}
| | +|`contents` |string |Manifest contents as a string.
Show example(s){{< highlight yaml >}} +contents: /etc/kubernetes/auth +{{< /highlight >}}
| | + + + + + + +### adminKubeconfig {#Config.cluster.adminKubeconfig} + +AdminKubeconfigConfig contains admin kubeconfig settings. + + + +{{< highlight yaml >}} +cluster: + adminKubeconfig: + certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`certLifetime` |Duration |Admin kubeconfig certificate lifetime (default is 1 year).
Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). | | + + + + + + + + + + diff --git a/website/content/v1.12/reference/kernel.md b/website/content/v1.12/reference/kernel.md new file mode 100644 index 000000000..484a711e8 --- /dev/null +++ b/website/content/v1.12/reference/kernel.md @@ -0,0 +1,288 @@ +--- +title: "Kernel" +description: "Linux kernel reference." +--- + +## Commandline Parameters + +Talos supports a number of kernel commandline parameters. Some are required for +it to operate. Others are optional and useful in certain circumstances. + +Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kspp.github.io/Recommended_Settings). + +**Required** parameters: + +* `talos.platform`: can be one of `akamai`, `aws`, `azure`, `container`, `digitalocean`, `equinixMetal`, `gcp`, `hcloud`, `metal`, `nocloud`, `openstack`, `oracle`, `scaleway`, `upcloud`, `vmware` or `vultr` +* `slab_nomerge`: required by KSPP +* `pti=on`: required by KSPP + +**Recommended** parameters: + +* `init_on_alloc=1`: advised by KSPP, enabled by default in kernel config +* `init_on_free=1`: advised by KSPP, enabled by default in kernel config + +### Available Talos-specific parameters + +#### `ip` + +Initial configuration of the interface, routes, DNS, NTP servers (multiple `ip=` kernel parameters are accepted). + +Full documentation is available in the [Linux kernel docs](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt). + +`ip=:::::::::` + +Talos will use the configuration supplied via the kernel parameter as the initial network configuration. +This parameter is useful in the environments where DHCP doesn't provide IP addresses or when default DNS and NTP servers should be overridden +before loading machine configuration. +Partial configuration can be applied as well, e.g. `ip=:::::::::` sets only the DNS and NTP servers. + +IPv6 addresses can be specified by enclosing them in the square brackets, e.g. `ip=[2001:db8::a]:[2001:db8::b]:[fe80::1]::controlplane1:eth1::[2001:4860:4860::6464]:[2001:4860:4860::64]:[2001:4860:4806::]`. + +`` can use either an IP address notation (IPv4: `255.255.255.0`, IPv6: `[ffff:ffff:ffff:ffff::0]`), or simply a number of one bits in the netmask (`24`). + +`` can be traditional interface naming scheme `eth0, eth1` or `enx`, example: `enx78e7d1ea46da` + +DHCP can be enabled by setting `` to `dhcp`, example: `ip=:::::eth0.3:dhcp`. +Alternative syntax is `ip=eth0.3:dhcp`. + +#### `bond` + +Bond interface configuration. + +Full documentation is available in the [Dracut kernel docs](https://man7.org/linux/man-pages/man7/dracut.cmdline.7.html). + +`bond=:::` + +Talos will use the `bond=` kernel parameter if supplied to set the initial bond configuration. +This parameter is useful in environments where the switch ports are suspended if the machine doesn't setup a LACP bond. + +If only the bond name is supplied, the bond will be created with `eth0` and `eth1` as slaves and bond mode set as `balance-rr` + +All these below configurations are equivalent: + +* `bond=bond0` +* `bond=bond0:` +* `bond=bond0::` +* `bond=bond0:::` +* `bond=bond0:eth0,eth1` +* `bond=bond0:eth0,eth1:balance-rr` + +An example of a bond configuration with all options specified: + +`bond=bond1:eth3,eth4:mode=802.3ad,xmit_hash_policy=layer2+3:1450` + +This will create a bond interface named `bond1` with `eth3` and `eth4` as slaves and set the bond mode to `802.3ad`, the transmit hash policy to `layer2+3` and bond interface MTU to 1450. + +#### `vlan` + +The interface vlan configuration. + +Full documentation is available in the [Dracut kernel docs](https://man7.org/linux/man-pages/man7/dracut.cmdline.7.html). + +Talos will use the `vlan=` kernel parameter if supplied to set the initial vlan configuration. +This parameter is useful in environments where the switch ports are VLAN tagged with no native VLAN. + +Only one vlan can be configured at this stage. + +An example of a vlan configuration including static ip configuration: + +`vlan=eth0.100:eth0 ip=172.20.0.2::172.20.0.1:255.255.255.0::eth0.100:::::` + +This will create a vlan interface named `eth0.100` with `eth0` as the underlying interface and set the vlan id to 100 with static IP 172.20.0.2/24 and 172.20.0.1 as default gateway. + +#### `net.ifnames=0` + +Disable the predictable network interface names by specifying `net.ifnames=0` on the kernel command line. + +#### `panic` + +The amount of time to wait after a panic before a reboot is issued. + +Talos will always reboot if it encounters an unrecoverable error. +However, when collecting debug information, it may reboot too quickly for +humans to read the logs. +This option allows the user to delay the reboot to give time to collect debug +information from the console screen. + +A value of `0` disables automatic rebooting entirely. + +#### `talos.config` + +The URL at which the machine configuration data may be found (only for `metal` platform, with the kernel parameter `talos.platform=metal`). + +This parameter supports variable substitution inside URL query values for the following case-insensitive placeholders: + +* `${uuid}` the SMBIOS UUID +* `${serial}` the SMBIOS Serial Number +* `${mac}` the MAC address of the first network interface attaining link state `up` +* `${hostname}` the hostname of the machine + +The following example + +`http://example.com/metadata?h=${hostname}&m=${mac}&s=${serial}&u=${uuid}` + +may translate to + +`http://example.com/metadata?h=myTestHostname&m=52%3A2f%3Afd%3Adf%3Afc%3Ac0&s=0OCZJ19N65&u=40dcbd19-3b10-444e-bfff-aaee44a51fda` + +For backwards compatibility we insert the system UUID into the query parameter `uuid` if its value is empty. As in +`http://example.com/metadata?uuid=` => `http://example.com/metadata?uuid=40dcbd19-3b10-444e-bfff-aaee44a51fda` + +##### `metal-iso` + +When the kernel parameter `talos.config=metal-iso` is set, Talos will attempt to load the machine configuration from any block device with a filesystem label of `metal-iso`. +Talos will look for a file named `config.yaml` in the root of the filesystem. + +For example, such ISO filesystem can be created with: + +```sh +mkdir iso/ +cp config.yaml iso/ +mkisofs -joliet -rock -volid 'metal-iso' -output config.iso iso/ +``` + +#### `talos.config.auth.*` + +Kernel parameters prefixed with `talos.config.auth.` are used to configure [OAuth2 authentication for the machine configuration]({{< relref "../advanced/machine-config-oauth" >}}). + +#### `talos.config.early` and `talos.config.inline` + +The kernel parameters `talos.config.early` and `talos.config.inline` are used to provide the initial machine configuration directly on the kernel command line. + +The difference between the two is the order of configuration loading: + +* first, the persisted configuration is loaded from the `STATE` partition, if it exists; +* `talos.config.early` is tried next; +* any platform-specific configuration source is tried next (e.g. `talos.config` for the `metal` platform, our VM user data source, etc.); +* finally, `talos.config.inline` is tried; +* if no complete configuration is found, the system will enter maintenance mode. + +For both arguments, the machine configuration should be `zstd` compressed and base64-encoded to be passed as a kernel parameter. + +> Note: The kernel command line has a limited size (4096 bytes), so this method is only suitable for small configuration documents. + +One such example is to provide [a custom CA certificate]({{< relref "../talos-guides/configuration/certificate-authorities" >}}) via `TrustedRootsConfig` in the machine configuration: + +```shell +cat config.yaml | zstd --compress --ultra -22 | base64 -w 0 +``` + +Please note that configuration from this argument is only loaded if the configuration hasn't been yet saved to `STATE` partition. + +#### `talos.platform` + +The platform name on which Talos will run. + +Valid options are: + +* `akamai` +* `aws` +* `azure` +* `container` +* `digitalocean` +* `equinixMetal` +* `gcp` +* `hcloud` +* `metal` +* `nocloud` +* `openstack` +* `oracle` +* `scaleway` +* `upcloud` +* `vmware` +* `vultr` + +#### `talos.board` + +The board name, if Talos is being used on an ARM64 SBC. + +Supported boards are: + +* `bananapi_m64`: Banana Pi M64 +* `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC +* `rock64`: Pine64 Rock64 +* ... + +#### `talos.hostname` + +The hostname to be used. +The hostname is generally specified in the machine config. +However, in some cases, the DHCP server needs to know the hostname +before the machine configuration has been acquired. + +Unless specifically required, the machine configuration should be used +instead. + +#### `talos.shutdown` + +The type of shutdown to use when Talos is told to shutdown. + +Valid options are: + +* `halt` +* `poweroff` + +#### `talos.network.interface.ignore` + +A network interface which should be ignored and not configured by Talos. + +Before a configuration is applied (early on each boot), Talos attempts to +configure each network interface by DHCP. +If there are many network interfaces on the machine which have link but no +DHCP server, this can add significant boot delays. + +This option may be specified multiple times for multiple network interfaces. + +#### `talos.experimental.wipe` + +Resets the disk before starting up the system. + +Valid options are: + +* `system` resets system disk. +* `system:EPHEMERAL,STATE` resets ephemeral and state partitions. Doing this reverts Talos into maintenance mode. + +#### `talos.auditd.disabled` + +By default, Talos runs `auditd` service capturing kernel audit events. +If you set `talos.auditd.disabled=1`, this behavior will be disabled, and you can run your own `auditd` service. + +#### `talos.dashboard.disabled` + +By default, Talos redirects kernel logs to virtual console `/dev/tty1` and starts the dashboard on `/dev/tty2`, +then switches to the dashboard tty. + +If you set `talos.dashboard.disabled=1`, this behavior will be disabled. +Kernel logs will be sent to the currently active console and the dashboard will not be started. + +It is set to be `1` by default on SBCs. + +#### `talos.environment` + +Each value of the argument sets a default environment variable. +The expected format is `key=value`. + +Example: + +```text +talos.environment=http_proxy=http://proxy.example.com:8080 talos.environment=https_proxy=http://proxy.example.com:8080 +``` + +#### `talos.device.settle_time` + +The time in Go duration format to wait for devices to settle before starting the boot process. +By default, Talos waits for `udevd` to scan and settle, but with some RAID controllers `udevd` might +report settled devices before they are actually ready. +Adding this kernel argument provides extra settle time on top of `udevd` settle time. +The maximum value is `10m` (10 minutes). + +Example: + +```text +talos.device.settle_time=3m +``` + +#### `talos.halt_if_installed` + +If set to `1`, Talos will pause the boot sequence and keeps printing a message until the boot timeout is reached if it detects that it is already installed. +This is useful if booting from ISO/PXE and you want to prevent the machine accidentally booting from the ISO/PXE after installation to the disk. diff --git a/website/content/v1.12/schemas/config.schema.json b/website/content/v1.12/schemas/config.schema.json new file mode 100644 index 000000000..1c282c308 --- /dev/null +++ b/website/content/v1.12/schemas/config.schema.json @@ -0,0 +1,4319 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://talos.dev/v1.11/schemas/config.schema.json", + "$defs": { + "block.DiskSelector": { + "properties": { + "match": { + "type": "string", + "title": "match", + "description": "The Common Expression Language (CEL) expression to match the disk.\n", + "markdownDescription": "The Common Expression Language (CEL) expression to match the disk.", + "x-intellij-html-description": "\u003cp\u003eThe Common Expression Language (CEL) expression to match the disk.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "DiskSelector selects a disk for the volume." + }, + "block.EncryptionKey": { + "properties": { + "slot": { + "type": "integer", + "title": "slot", + "description": "Key slot number for LUKS2 encryption.\n", + "markdownDescription": "Key slot number for LUKS2 encryption.", + "x-intellij-html-description": "\u003cp\u003eKey slot number for LUKS2 encryption.\u003c/p\u003e\n" + }, + "static": { + "$ref": "#/$defs/block.EncryptionKeyStatic", + "title": "static", + "description": "Key which value is stored in the configuration file.\n", + "markdownDescription": "Key which value is stored in the configuration file.", + "x-intellij-html-description": "\u003cp\u003eKey which value is stored in the configuration file.\u003c/p\u003e\n" + }, + "nodeID": { + "$ref": "#/$defs/block.EncryptionKeyNodeID", + "title": "nodeID", + "description": "Deterministically generated key from the node UUID and PartitionLabel.\n", + "markdownDescription": "Deterministically generated key from the node UUID and PartitionLabel.", + "x-intellij-html-description": "\u003cp\u003eDeterministically generated key from the node UUID and PartitionLabel.\u003c/p\u003e\n" + }, + "kms": { + "$ref": "#/$defs/block.EncryptionKeyKMS", + "title": "kms", + "description": "KMS managed encryption key.\n", + "markdownDescription": "KMS managed encryption key.", + "x-intellij-html-description": "\u003cp\u003eKMS managed encryption key.\u003c/p\u003e\n" + }, + "tpm": { + "$ref": "#/$defs/block.EncryptionKeyTPM", + "title": "tpm", + "description": "Enable TPM based disk encryption.\n", + "markdownDescription": "Enable TPM based disk encryption.", + "x-intellij-html-description": "\u003cp\u003eEnable TPM based disk encryption.\u003c/p\u003e\n" + }, + "lockToState": { + "type": "boolean", + "title": "lockToState", + "description": "Lock the disk encryption key to the random salt stored in the STATE partition. This is useful to prevent the volume from being unlocked if STATE partition is compromised or replaced. It is recommended to use this option with TPM disk encryption for non-STATE volumes.\n", + "markdownDescription": "Lock the disk encryption key to the random salt stored in the STATE partition. This is useful to prevent the volume from being unlocked if STATE partition is compromised or replaced. It is recommended to use this option with TPM disk encryption for non-STATE volumes.", + "x-intellij-html-description": "\u003cp\u003eLock the disk encryption key to the random salt stored in the STATE partition. This is useful to prevent the volume from being unlocked if STATE partition is compromised or replaced. It is recommended to use this option with TPM disk encryption for non-STATE volumes.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EncryptionKey represents configuration for disk encryption key." + }, + "block.EncryptionKeyKMS": { + "properties": { + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "KMS endpoint to Seal/Unseal the key.\n", + "markdownDescription": "KMS endpoint to Seal/Unseal the key.", + "x-intellij-html-description": "\u003cp\u003eKMS endpoint to Seal/Unseal the key.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server." + }, + "block.EncryptionKeyNodeID": { + "properties": {}, + "additionalProperties": false, + "type": "object", + "description": "EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel." + }, + "block.EncryptionKeyStatic": { + "properties": { + "passphrase": { + "type": "string", + "title": "passphrase", + "description": "Defines the static passphrase value.\n", + "markdownDescription": "Defines the static passphrase value.", + "x-intellij-html-description": "\u003cp\u003eDefines the static passphrase value.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EncryptionKeyStatic represents throw away key type." + }, + "block.EncryptionKeyTPM": { + "properties": { + "checkSecurebootStatusOnEnroll": { + "type": "boolean", + "title": "checkSecurebootStatusOnEnroll", + "description": "Check that Secureboot is enabled in the EFI firmware.\nIf Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable.\n", + "markdownDescription": "Check that Secureboot is enabled in the EFI firmware.\nIf Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable.", + "x-intellij-html-description": "\u003cp\u003eCheck that Secureboot is enabled in the EFI firmware.\nIf Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM." + }, + "block.EncryptionSpec": { + "properties": { + "provider": { + "enum": [ + "luks2" + ], + "title": "provider", + "description": "Encryption provider to use for the encryption.\n", + "markdownDescription": "Encryption provider to use for the encryption.", + "x-intellij-html-description": "\u003cp\u003eEncryption provider to use for the encryption.\u003c/p\u003e\n" + }, + "keys": { + "items": { + "$ref": "#/$defs/block.EncryptionKey" + }, + "type": "array", + "title": "keys", + "description": "Defines the encryption keys generation and storage method.\n", + "markdownDescription": "Defines the encryption keys generation and storage method.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption keys generation and storage method.\u003c/p\u003e\n" + }, + "cipher": { + "enum": [ + "aes-xts-plain64", + "xchacha12,aes-adiantum-plain64", + "xchacha20,aes-adiantum-plain64" + ], + "title": "cipher", + "description": "Cipher to use for the encryption. Depends on the encryption provider.\n", + "markdownDescription": "Cipher to use for the encryption. Depends on the encryption provider.", + "x-intellij-html-description": "\u003cp\u003eCipher to use for the encryption. Depends on the encryption provider.\u003c/p\u003e\n" + }, + "keySize": { + "type": "integer", + "title": "keySize", + "description": "Defines the encryption key length.\n", + "markdownDescription": "Defines the encryption key length.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption key length.\u003c/p\u003e\n" + }, + "blockSize": { + "type": "integer", + "title": "blockSize", + "description": "Defines the encryption sector size.\n", + "markdownDescription": "Defines the encryption sector size.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption sector size.\u003c/p\u003e\n" + }, + "options": { + "enum": [ + "no_read_workqueue", + "no_write_workqueue", + "same_cpu_crypt" + ], + "title": "options", + "description": "Additional –perf parameters for the LUKS2 encryption.\n", + "markdownDescription": "Additional --perf parameters for the LUKS2 encryption.", + "x-intellij-html-description": "\u003cp\u003eAdditional \u0026ndash;perf parameters for the LUKS2 encryption.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EncryptionSpec represents volume encryption settings." + }, + "block.ExistingVolumeConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "ExistingVolumeConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the volume.\n\nName can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.\n", + "markdownDescription": "Name of the volume.\n\nName can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.", + "x-intellij-html-description": "\u003cp\u003eName of the volume.\u003c/p\u003e\n\n\u003cp\u003eName can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.\u003c/p\u003e\n" + }, + "discovery": { + "$ref": "#/$defs/block.VolumeDiscoverySpec", + "title": "discovery", + "description": "The discovery describes how to find a volume.\n", + "markdownDescription": "The discovery describes how to find a volume.", + "x-intellij-html-description": "\u003cp\u003eThe discovery describes how to find a volume.\u003c/p\u003e\n" + }, + "mount": { + "$ref": "#/$defs/block.MountSpec", + "title": "mount", + "description": "The mount describes additional mount options.\n", + "markdownDescription": "The mount describes additional mount options.", + "x-intellij-html-description": "\u003cp\u003eThe mount describes additional mount options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "ExistingVolumeConfig is an existing volume configuration document.\\nExisting volumes allow to mount partitions (or whole disks) that were created\\noutside of Talos. Volume will be mounted under `/var/mnt/\u003cname\u003e`.\\nThe existing volume config name should not conflict with user volume names.\\n" + }, + "block.FilesystemSpec": { + "properties": { + "type": { + "enum": [ + "ext4", + "xfs" + ], + "title": "type", + "description": "Filesystem type. Default is xfs.\n", + "markdownDescription": "Filesystem type. Default is `xfs`.", + "x-intellij-html-description": "\u003cp\u003eFilesystem type. Default is \u003ccode\u003exfs\u003c/code\u003e.\u003c/p\u003e\n" + }, + "projectQuotaSupport": { + "type": "boolean", + "title": "projectQuotaSupport", + "description": "Enables project quota support, valid only for ‘xfs’ filesystem.\n\nNote: changing this value might require a full remount of the filesystem.\n", + "markdownDescription": "Enables project quota support, valid only for 'xfs' filesystem.\n\nNote: changing this value might require a full remount of the filesystem.", + "x-intellij-html-description": "\u003cp\u003eEnables project quota support, valid only for \u0026lsquo;xfs\u0026rsquo; filesystem.\u003c/p\u003e\n\n\u003cp\u003eNote: changing this value might require a full remount of the filesystem.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "FilesystemSpec configures the filesystem for the volume." + }, + "block.MountSpec": { + "properties": { + "readOnly": { + "type": "boolean", + "title": "readOnly", + "description": "Mount the volume read-only.\n", + "markdownDescription": "Mount the volume read-only.", + "x-intellij-html-description": "\u003cp\u003eMount the volume read-only.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "MountSpec describes how the volume is mounted." + }, + "block.ProvisioningSpec": { + "properties": { + "diskSelector": { + "$ref": "#/$defs/block.DiskSelector", + "title": "diskSelector", + "description": "The disk selector expression.\n", + "markdownDescription": "The disk selector expression.", + "x-intellij-html-description": "\u003cp\u003eThe disk selector expression.\u003c/p\u003e\n" + }, + "grow": { + "type": "boolean", + "title": "grow", + "description": "Should the volume grow to the size of the disk (if possible).\n", + "markdownDescription": "Should the volume grow to the size of the disk (if possible).", + "x-intellij-html-description": "\u003cp\u003eShould the volume grow to the size of the disk (if possible).\u003c/p\u003e\n" + }, + "minSize": { + "type": "string", + "title": "minSize", + "description": "The minimum size of the volume.\n\nSize is specified in bytes, but can be expressed in human readable format, e.g. 100MB.\n", + "markdownDescription": "The minimum size of the volume.\n\nSize is specified in bytes, but can be expressed in human readable format, e.g. 100MB.", + "x-intellij-html-description": "\u003cp\u003eThe minimum size of the volume.\u003c/p\u003e\n\n\u003cp\u003eSize is specified in bytes, but can be expressed in human readable format, e.g. 100MB.\u003c/p\u003e\n" + }, + "maxSize": { + "type": "string", + "title": "maxSize", + "description": "The maximum size of the volume, if not specified the volume can grow to the size of the\ndisk.\n\nSize is specified in bytes, but can be expressed in human readable format, e.g. 100MB.\n", + "markdownDescription": "The maximum size of the volume, if not specified the volume can grow to the size of the\ndisk.\n\nSize is specified in bytes, but can be expressed in human readable format, e.g. 100MB.", + "x-intellij-html-description": "\u003cp\u003eThe maximum size of the volume, if not specified the volume can grow to the size of the\ndisk.\u003c/p\u003e\n\n\u003cp\u003eSize is specified in bytes, but can be expressed in human readable format, e.g. 100MB.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ProvisioningSpec describes how the volume is provisioned." + }, + "block.RawVolumeConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "RawVolumeConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the volume.\n\nName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.\n", + "markdownDescription": "Name of the volume.\n\nName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.", + "x-intellij-html-description": "\u003cp\u003eName of the volume.\u003c/p\u003e\n\n\u003cp\u003eName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.\u003c/p\u003e\n" + }, + "provisioning": { + "$ref": "#/$defs/block.ProvisioningSpec", + "title": "provisioning", + "description": "The provisioning describes how the volume is provisioned.\n", + "markdownDescription": "The provisioning describes how the volume is provisioned.", + "x-intellij-html-description": "\u003cp\u003eThe provisioning describes how the volume is provisioned.\u003c/p\u003e\n" + }, + "encryption": { + "$ref": "#/$defs/block.EncryptionSpec", + "title": "encryption", + "description": "The encryption describes how the volume is encrypted.\n", + "markdownDescription": "The encryption describes how the volume is encrypted.", + "x-intellij-html-description": "\u003cp\u003eThe encryption describes how the volume is encrypted.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "RawVolumeConfig is a raw volume configuration document.\\nRaw volumes allow to create partitions without formatting them.\\n If you want to use local storage, user volumes is a better choice,\\n raw volumes are intended to be used with CSI provisioners.\\nThe partition label is automatically generated as `r-\u003cname\u003e`.\\n" + }, + "block.SwapVolumeConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "SwapVolumeConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the volume.\n\nName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.\n", + "markdownDescription": "Name of the volume.\n\nName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.", + "x-intellij-html-description": "\u003cp\u003eName of the volume.\u003c/p\u003e\n\n\u003cp\u003eName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.\u003c/p\u003e\n" + }, + "provisioning": { + "$ref": "#/$defs/block.ProvisioningSpec", + "title": "provisioning", + "description": "The provisioning describes how the volume is provisioned.\n", + "markdownDescription": "The provisioning describes how the volume is provisioned.", + "x-intellij-html-description": "\u003cp\u003eThe provisioning describes how the volume is provisioned.\u003c/p\u003e\n" + }, + "encryption": { + "$ref": "#/$defs/block.EncryptionSpec", + "title": "encryption", + "description": "The encryption describes how the volume is encrypted.\n", + "markdownDescription": "The encryption describes how the volume is encrypted.", + "x-intellij-html-description": "\u003cp\u003eThe encryption describes how the volume is encrypted.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "SwapVolumeConfig is a disk swap volume configuration document.\\nSwap volume is automatically allocated as a partition on the specified disk\\nand activated as swap, removing a swap volume deactivates swap.\\nThe partition label is automatically generated as `s-\u003cname\u003e`.\\n" + }, + "block.UserVolumeConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "UserVolumeConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the volume.\n\nName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.\n", + "markdownDescription": "Name of the volume.\n\nName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.", + "x-intellij-html-description": "\u003cp\u003eName of the volume.\u003c/p\u003e\n\n\u003cp\u003eName might be between 1 and 34 characters long and can only contain:\nlowercase and uppercase ASCII letters, digits, and hyphens.\u003c/p\u003e\n" + }, + "provisioning": { + "$ref": "#/$defs/block.ProvisioningSpec", + "title": "provisioning", + "description": "The provisioning describes how the volume is provisioned.\n", + "markdownDescription": "The provisioning describes how the volume is provisioned.", + "x-intellij-html-description": "\u003cp\u003eThe provisioning describes how the volume is provisioned.\u003c/p\u003e\n" + }, + "filesystem": { + "$ref": "#/$defs/block.FilesystemSpec", + "title": "filesystem", + "description": "The filesystem describes how the volume is formatted.\n", + "markdownDescription": "The filesystem describes how the volume is formatted.", + "x-intellij-html-description": "\u003cp\u003eThe filesystem describes how the volume is formatted.\u003c/p\u003e\n" + }, + "encryption": { + "$ref": "#/$defs/block.EncryptionSpec", + "title": "encryption", + "description": "The encryption describes how the volume is encrypted.\n", + "markdownDescription": "The encryption describes how the volume is encrypted.", + "x-intellij-html-description": "\u003cp\u003eThe encryption describes how the volume is encrypted.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "UserVolumeConfig is a user volume configuration document.\\nUser volume is automatically allocated as a partition on the specified disk\\nand mounted under `/var/mnt/\u003cname\u003e`.\\nThe partition label is automatically generated as `u-\u003cname\u003e`.\\n" + }, + "block.VolumeConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "VolumeConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the volume.\n", + "markdownDescription": "Name of the volume.", + "x-intellij-html-description": "\u003cp\u003eName of the volume.\u003c/p\u003e\n" + }, + "provisioning": { + "$ref": "#/$defs/block.ProvisioningSpec", + "title": "provisioning", + "description": "The provisioning describes how the volume is provisioned.\n", + "markdownDescription": "The provisioning describes how the volume is provisioned.", + "x-intellij-html-description": "\u003cp\u003eThe provisioning describes how the volume is provisioned.\u003c/p\u003e\n" + }, + "encryption": { + "$ref": "#/$defs/block.EncryptionSpec", + "title": "encryption", + "description": "The encryption describes how the volume is encrypted.\n", + "markdownDescription": "The encryption describes how the volume is encrypted.", + "x-intellij-html-description": "\u003cp\u003eThe encryption describes how the volume is encrypted.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "VolumeConfig is a system volume configuration document.\\nNote: at the moment, only `STATE`, `EPHEMERAL` and `IMAGE-CACHE` system volumes are supported.\\n" + }, + "block.VolumeDiscoverySpec": { + "properties": { + "volumeSelector": { + "$ref": "#/$defs/block.VolumeSelector", + "title": "volumeSelector", + "description": "The volume selector expression.\n", + "markdownDescription": "The volume selector expression.", + "x-intellij-html-description": "\u003cp\u003eThe volume selector expression.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "VolumeDiscoverySpec describes how the volume is discovered." + }, + "block.VolumeSelector": { + "properties": { + "match": { + "type": "string", + "title": "match", + "description": "The Common Expression Language (CEL) expression to match the volume.\n", + "markdownDescription": "The Common Expression Language (CEL) expression to match the volume.", + "x-intellij-html-description": "\u003cp\u003eThe Common Expression Language (CEL) expression to match the volume.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "VolumeSelector selects an existing volume." + }, + "block.ZswapConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "ZswapConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "maxPoolPercent": { + "type": "integer", + "title": "maxPoolPercent", + "description": "The maximum percent of memory that zswap can use.\nThis is a percentage of the total system memory.\nThe value must be between 0 and 100.\n", + "markdownDescription": "The maximum percent of memory that zswap can use.\nThis is a percentage of the total system memory.\nThe value must be between 0 and 100.", + "x-intellij-html-description": "\u003cp\u003eThe maximum percent of memory that zswap can use.\nThis is a percentage of the total system memory.\nThe value must be between 0 and 100.\u003c/p\u003e\n" + }, + "shrinkerEnabled": { + "type": "boolean", + "title": "shrinkerEnabled", + "description": "Enable the shrinker feature: kernel might move\ncold pages from zswap to swap device to free up memory\nfor other use cases.\n", + "markdownDescription": "Enable the shrinker feature: kernel might move\ncold pages from zswap to swap device to free up memory\nfor other use cases.", + "x-intellij-html-description": "\u003cp\u003eEnable the shrinker feature: kernel might move\ncold pages from zswap to swap device to free up memory\nfor other use cases.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "ZswapConfig is a zswap (compressed memory) configuration document.\\nWhen zswap is enabled, Linux kernel compresses pages that would otherwise be swapped out to disk.\\nThe compressed pages are stored in a memory pool, which is used to avoid writing to disk\\nwhen the system is under memory pressure.\\n" + }, + "extensions.ConfigFile": { + "properties": { + "content": { + "type": "string", + "title": "content", + "description": "The content of the extension service config file.\n", + "markdownDescription": "The content of the extension service config file.", + "x-intellij-html-description": "\u003cp\u003eThe content of the extension service config file.\u003c/p\u003e\n" + }, + "mountPath": { + "type": "string", + "title": "mountPath", + "description": "The mount path of the extension service config file.\n", + "markdownDescription": "The mount path of the extension service config file.", + "x-intellij-html-description": "\u003cp\u003eThe mount path of the extension service config file.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ConfigFile is a config file for extension services." + }, + "extensions.ServiceConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "ExtensionServiceConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the extension service.\n", + "markdownDescription": "Name of the extension service.", + "x-intellij-html-description": "\u003cp\u003eName of the extension service.\u003c/p\u003e\n" + }, + "configFiles": { + "items": { + "$ref": "#/$defs/extensions.ConfigFile" + }, + "type": "array", + "title": "configFiles", + "description": "The config files for the extension service.\n", + "markdownDescription": "The config files for the extension service.", + "x-intellij-html-description": "\u003cp\u003eThe config files for the extension service.\u003c/p\u003e\n" + }, + "environment": { + "items": { + "type": "string" + }, + "type": "array", + "title": "environment", + "description": "The environment for the extension service.\n", + "markdownDescription": "The environment for the extension service.", + "x-intellij-html-description": "\u003cp\u003eThe environment for the extension service.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind", + "name" + ], + "description": "ExtensionServiceConfig is a extensionserviceconfig document." + }, + "hardware.PCIDriverRebindConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "PCIDriverRebindConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "PCI device id\n", + "markdownDescription": "PCI device id", + "x-intellij-html-description": "\u003cp\u003ePCI device id\u003c/p\u003e\n" + }, + "targetDriver": { + "type": "string", + "title": "targetDriver", + "description": "Target driver to rebind the PCI device to.\n", + "markdownDescription": "Target driver to rebind the PCI device to.", + "x-intellij-html-description": "\u003cp\u003eTarget driver to rebind the PCI device to.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind", + "name", + "targetDriver" + ], + "description": "PCIDriverRebindConfig allows to configure PCI driver rebinds." + }, + "network.DefaultActionConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "NetworkDefaultActionConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "ingress": { + "enum": [ + "accept", + "block" + ], + "title": "ingress", + "description": "Default action for all not explicitly configured ingress traffic: accept or block.\n", + "markdownDescription": "Default action for all not explicitly configured ingress traffic: accept or block.", + "x-intellij-html-description": "\u003cp\u003eDefault action for all not explicitly configured ingress traffic: accept or block.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "NetworkDefaultActionConfig is a ingress firewall default action configuration document." + }, + "network.EthernetChannelsConfig": { + "properties": { + "rx": { + "type": "integer", + "title": "rx", + "description": "Number of RX channels.\n", + "markdownDescription": "Number of RX channels.", + "x-intellij-html-description": "\u003cp\u003eNumber of RX channels.\u003c/p\u003e\n" + }, + "tx": { + "type": "integer", + "title": "tx", + "description": "Number of TX channels.\n", + "markdownDescription": "Number of TX channels.", + "x-intellij-html-description": "\u003cp\u003eNumber of TX channels.\u003c/p\u003e\n" + }, + "other": { + "type": "integer", + "title": "other", + "description": "Number of other channels.\n", + "markdownDescription": "Number of other channels.", + "x-intellij-html-description": "\u003cp\u003eNumber of other channels.\u003c/p\u003e\n" + }, + "combined": { + "type": "integer", + "title": "combined", + "description": "Number of combined channels.\n", + "markdownDescription": "Number of combined channels.", + "x-intellij-html-description": "\u003cp\u003eNumber of combined channels.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EthernetChannelsConfig is a configuration for Ethernet link channels." + }, + "network.EthernetConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "EthernetConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the link (interface).\n", + "markdownDescription": "Name of the link (interface).", + "x-intellij-html-description": "\u003cp\u003eName of the link (interface).\u003c/p\u003e\n" + }, + "features": { + "patternProperties": { + ".*": { + "type": "boolean" + } + }, + "type": "object", + "title": "features", + "description": "Configuration for Ethernet features.\n\nSet of features available and whether they can be enabled or disabled is driver specific.\nUse talosctl get ethernetstatus \u0026lt;link\u0026gt; -o yaml to get the list of available features and\ntheir current status.\n", + "markdownDescription": "Configuration for Ethernet features.\n\nSet of features available and whether they can be enabled or disabled is driver specific.\nUse `talosctl get ethernetstatus \u003clink\u003e -o yaml` to get the list of available features and\ntheir current status.", + "x-intellij-html-description": "\u003cp\u003eConfiguration for Ethernet features.\u003c/p\u003e\n\n\u003cp\u003eSet of features available and whether they can be enabled or disabled is driver specific.\nUse \u003ccode\u003etalosctl get ethernetstatus \u0026lt;link\u0026gt; -o yaml\u003c/code\u003e to get the list of available features and\ntheir current status.\u003c/p\u003e\n" + }, + "rings": { + "$ref": "#/$defs/network.EthernetRingsConfig", + "title": "rings", + "description": "Configuration for Ethernet link rings.\n\nThis is similar to ethtool -G command.\n", + "markdownDescription": "Configuration for Ethernet link rings.\n\nThis is similar to `ethtool -G` command.", + "x-intellij-html-description": "\u003cp\u003eConfiguration for Ethernet link rings.\u003c/p\u003e\n\n\u003cp\u003eThis is similar to \u003ccode\u003eethtool -G\u003c/code\u003e command.\u003c/p\u003e\n" + }, + "channels": { + "$ref": "#/$defs/network.EthernetChannelsConfig", + "title": "channels", + "description": "Configuration for Ethernet link channels.\n\nThis is similar to ethtool -L command.\n", + "markdownDescription": "Configuration for Ethernet link channels.\n\nThis is similar to `ethtool -L` command.", + "x-intellij-html-description": "\u003cp\u003eConfiguration for Ethernet link channels.\u003c/p\u003e\n\n\u003cp\u003eThis is similar to \u003ccode\u003eethtool -L\u003c/code\u003e command.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind", + "name" + ], + "description": "EthernetConfig is a config document to configure Ethernet interfaces." + }, + "network.EthernetRingsConfig": { + "properties": { + "rx": { + "type": "integer", + "title": "rx", + "description": "Number of RX rings.\n", + "markdownDescription": "Number of RX rings.", + "x-intellij-html-description": "\u003cp\u003eNumber of RX rings.\u003c/p\u003e\n" + }, + "tx": { + "type": "integer", + "title": "tx", + "description": "Number of TX rings.\n", + "markdownDescription": "Number of TX rings.", + "x-intellij-html-description": "\u003cp\u003eNumber of TX rings.\u003c/p\u003e\n" + }, + "rx-mini": { + "type": "integer", + "title": "rx-mini", + "description": "Number of RX mini rings.\n", + "markdownDescription": "Number of RX mini rings.", + "x-intellij-html-description": "\u003cp\u003eNumber of RX mini rings.\u003c/p\u003e\n" + }, + "rx-jumbo": { + "type": "integer", + "title": "rx-jumbo", + "description": "Number of RX jumbo rings.\n", + "markdownDescription": "Number of RX jumbo rings.", + "x-intellij-html-description": "\u003cp\u003eNumber of RX jumbo rings.\u003c/p\u003e\n" + }, + "rx-buf-len": { + "type": "integer", + "title": "rx-buf-len", + "description": "RX buffer length.\n", + "markdownDescription": "RX buffer length.", + "x-intellij-html-description": "\u003cp\u003eRX buffer length.\u003c/p\u003e\n" + }, + "cqe-size": { + "type": "integer", + "title": "cqe-size", + "description": "CQE size.\n", + "markdownDescription": "CQE size.", + "x-intellij-html-description": "\u003cp\u003eCQE size.\u003c/p\u003e\n" + }, + "tx-push": { + "type": "boolean", + "title": "tx-push", + "description": "TX push enabled.\n", + "markdownDescription": "TX push enabled.", + "x-intellij-html-description": "\u003cp\u003eTX push enabled.\u003c/p\u003e\n" + }, + "rx-push": { + "type": "boolean", + "title": "rx-push", + "description": "RX push enabled.\n", + "markdownDescription": "RX push enabled.", + "x-intellij-html-description": "\u003cp\u003eRX push enabled.\u003c/p\u003e\n" + }, + "tx-push-buf-len": { + "type": "integer", + "title": "tx-push-buf-len", + "description": "TX push buffer length.\n", + "markdownDescription": "TX push buffer length.", + "x-intellij-html-description": "\u003cp\u003eTX push buffer length.\u003c/p\u003e\n" + }, + "tcp-data-split": { + "type": "boolean", + "title": "tcp-data-split", + "description": "TCP data split enabled.\n", + "markdownDescription": "TCP data split enabled.", + "x-intellij-html-description": "\u003cp\u003eTCP data split enabled.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EthernetRingsConfig is a configuration for Ethernet link rings." + }, + "network.IngressRule": { + "properties": { + "subnet": { + "type": "string", + "pattern": "^[0-9a-f.:]+/\\d{1,3}$", + "title": "subnet", + "description": "Subnet defines a source subnet.\n", + "markdownDescription": "Subnet defines a source subnet.", + "x-intellij-html-description": "\u003cp\u003eSubnet defines a source subnet.\u003c/p\u003e\n" + }, + "except": { + "type": "string", + "pattern": "^[0-9a-f.:]+/\\d{1,3}$", + "title": "except", + "description": "Except defines a source subnet to exclude from the rule, it gets excluded from the subnet.\n", + "markdownDescription": "Except defines a source subnet to exclude from the rule, it gets excluded from the `subnet`.", + "x-intellij-html-description": "\u003cp\u003eExcept defines a source subnet to exclude from the rule, it gets excluded from the \u003ccode\u003esubnet\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "IngressRule is a ingress rule." + }, + "network.KubespanEndpointsConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "KubeSpanEndpoints" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "extraAnnouncedEndpoints": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraAnnouncedEndpoints", + "description": "A list of extra Wireguard endpoints to announce from this machine.\n\nTalos automatically adds endpoints based on machine addresses, public IP, etc.\nThis field allows to add extra endpoints which are managed outside of Talos, e.g. NAT mapping.\n", + "markdownDescription": "A list of extra Wireguard endpoints to announce from this machine.\n\nTalos automatically adds endpoints based on machine addresses, public IP, etc.\nThis field allows to add extra endpoints which are managed outside of Talos, e.g. NAT mapping.", + "x-intellij-html-description": "\u003cp\u003eA list of extra Wireguard endpoints to announce from this machine.\u003c/p\u003e\n\n\u003cp\u003eTalos automatically adds endpoints based on machine addresses, public IP, etc.\nThis field allows to add extra endpoints which are managed outside of Talos, e.g. NAT mapping.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "KubeSpanEndpointsConfig is a config document to configure KubeSpan endpoints." + }, + "network.RuleConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "NetworkRuleConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the config document.\n", + "markdownDescription": "Name of the config document.", + "x-intellij-html-description": "\u003cp\u003eName of the config document.\u003c/p\u003e\n" + }, + "portSelector": { + "$ref": "#/$defs/network.RulePortSelector", + "title": "portSelector", + "description": "Port selector defines which ports and protocols on the host are affected by the rule.\n", + "markdownDescription": "Port selector defines which ports and protocols on the host are affected by the rule.", + "x-intellij-html-description": "\u003cp\u003ePort selector defines which ports and protocols on the host are affected by the rule.\u003c/p\u003e\n" + }, + "ingress": { + "items": { + "$ref": "#/$defs/network.IngressRule" + }, + "type": "array", + "title": "ingress", + "description": "Ingress defines which source subnets are allowed to access the host ports/protocols defined by the portSelector.\n", + "markdownDescription": "Ingress defines which source subnets are allowed to access the host ports/protocols defined by the `portSelector`.", + "x-intellij-html-description": "\u003cp\u003eIngress defines which source subnets are allowed to access the host ports/protocols defined by the \u003ccode\u003eportSelector\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind", + "name" + ], + "description": "NetworkRuleConfig is a network firewall rule config document." + }, + "network.RulePortSelector": { + "properties": { + "ports": { + "items": { + "oneOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ] + }, + "type": "array", + "title": "ports", + "description": "Ports defines a list of port ranges or single ports.\nThe port ranges are inclusive, and should not overlap.\n", + "markdownDescription": "Ports defines a list of port ranges or single ports.\nThe port ranges are inclusive, and should not overlap.", + "x-intellij-html-description": "\u003cp\u003ePorts defines a list of port ranges or single ports.\nThe port ranges are inclusive, and should not overlap.\u003c/p\u003e\n" + }, + "protocol": { + "enum": [ + "tcp", + "udp", + "icmp", + "icmpv6" + ], + "title": "protocol", + "description": "Protocol defines traffic protocol (e.g. TCP or UDP).\n", + "markdownDescription": "Protocol defines traffic protocol (e.g. TCP or UDP).", + "x-intellij-html-description": "\u003cp\u003eProtocol defines traffic protocol (e.g. TCP or UDP).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "RulePortSelector is a port selector for the network rule." + }, + "runtime.EventSinkV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "EventSinkConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "The endpoint for the event sink as ‘host:port’.\n", + "markdownDescription": "The endpoint for the event sink as 'host:port'.", + "x-intellij-html-description": "\u003cp\u003eThe endpoint for the event sink as \u0026lsquo;host:port\u0026rsquo;.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "EventSinkConfig is a event sink config document." + }, + "runtime.KmsgLogV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "KmsgLogConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the config document.\n", + "markdownDescription": "Name of the config document.", + "x-intellij-html-description": "\u003cp\u003eName of the config document.\u003c/p\u003e\n" + }, + "url": { + "type": "string", + "pattern": "^(tcp|udp)://", + "title": "url", + "description": "The URL encodes the log destination.\nThe scheme must be tcp:// or udp://.\nThe path must be empty.\nThe port is required.\n", + "markdownDescription": "The URL encodes the log destination.\nThe scheme must be tcp:// or udp://.\nThe path must be empty.\nThe port is required.", + "x-intellij-html-description": "\u003cp\u003eThe URL encodes the log destination.\nThe scheme must be tcp:// or udp://.\nThe path must be empty.\nThe port is required.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "KmsgLogConfig is a event sink config document." + }, + "runtime.WatchdogTimerV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "WatchdogTimerConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "device": { + "type": "string", + "title": "device", + "description": "Path to the watchdog device.\n", + "markdownDescription": "Path to the watchdog device.", + "x-intellij-html-description": "\u003cp\u003ePath to the watchdog device.\u003c/p\u003e\n" + }, + "timeout": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "timeout", + "description": "Timeout for the watchdog.\n\nIf Talos is unresponsive for this duration, the watchdog will reset the system.\n\nDefault value is 1 minute, minimum value is 10 seconds.\n", + "markdownDescription": "Timeout for the watchdog.\n\nIf Talos is unresponsive for this duration, the watchdog will reset the system.\n\nDefault value is 1 minute, minimum value is 10 seconds.", + "x-intellij-html-description": "\u003cp\u003eTimeout for the watchdog.\u003c/p\u003e\n\n\u003cp\u003eIf Talos is unresponsive for this duration, the watchdog will reset the system.\u003c/p\u003e\n\n\u003cp\u003eDefault value is 1 minute, minimum value is 10 seconds.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "WatchdogTimerConfig is a watchdog timer config document." + }, + "security.TrustedRootsConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "TrustedRootsConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name of the config document.\n", + "markdownDescription": "Name of the config document.", + "x-intellij-html-description": "\u003cp\u003eName of the config document.\u003c/p\u003e\n" + }, + "certificates": { + "type": "string", + "title": "certificates", + "description": "List of additional trusted certificate authorities (as PEM-encoded certificates).\n\nMultiple certificates can be provided in a single config document, separated by newline characters.\n", + "markdownDescription": "List of additional trusted certificate authorities (as PEM-encoded certificates).\n\nMultiple certificates can be provided in a single config document, separated by newline characters.", + "x-intellij-html-description": "\u003cp\u003eList of additional trusted certificate authorities (as PEM-encoded certificates).\u003c/p\u003e\n\n\u003cp\u003eMultiple certificates can be provided in a single config document, separated by newline characters.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind", + "name" + ], + "description": "TrustedRootsConfig allows to configure additional trusted CA roots." + }, + "siderolink.ConfigV1Alpha1": { + "properties": { + "apiVersion": { + "enum": [ + "v1alpha1" + ], + "title": "apiVersion", + "description": "apiVersion is the API version of the resource.\n", + "markdownDescription": "apiVersion is the API version of the resource.", + "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n" + }, + "kind": { + "enum": [ + "SideroLinkConfig" + ], + "title": "kind", + "description": "kind is the kind of the resource.\n", + "markdownDescription": "kind is the kind of the resource.", + "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n" + }, + "apiUrl": { + "type": "string", + "pattern": "^(https|grpc)://", + "title": "apiUrl", + "description": "SideroLink API URL to connect to.\n", + "markdownDescription": "SideroLink API URL to connect to.", + "x-intellij-html-description": "\u003cp\u003eSideroLink API URL to connect to.\u003c/p\u003e\n" + }, + "uniqueToken": { + "type": "string", + "title": "uniqueToken", + "description": "SideroLink unique token to use for the connection (optional).\n\nThis value is overridden with META key UniqueMachineToken.\n", + "markdownDescription": "SideroLink unique token to use for the connection (optional).\n\nThis value is overridden with META key UniqueMachineToken.", + "x-intellij-html-description": "\u003cp\u003eSideroLink unique token to use for the connection (optional).\u003c/p\u003e\n\n\u003cp\u003eThis value is overridden with META key UniqueMachineToken.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ], + "description": "SideroLinkConfig is a SideroLink connection machine configuration document." + }, + "v1alpha1.APIServerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the API server manifest.\n", + "markdownDescription": "The container image used in the API server manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the API server manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the API server.\n", + "markdownDescription": "Extra arguments to supply to the API server.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the API server.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/v1alpha1.VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the API server static pod.\n", + "markdownDescription": "Extra volumes to mount to the API server static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the API server static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "certSANs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "certSANs", + "description": "Extra certificate subject alternative names for the API server’s certificate.\n", + "markdownDescription": "Extra certificate subject alternative names for the API server's certificate.", + "x-intellij-html-description": "\u003cp\u003eExtra certificate subject alternative names for the API server\u0026rsquo;s certificate.\u003c/p\u003e\n" + }, + "disablePodSecurityPolicy": { + "type": "boolean", + "title": "disablePodSecurityPolicy", + "description": "Disable PodSecurityPolicy in the API server and default manifests.\n", + "markdownDescription": "Disable PodSecurityPolicy in the API server and default manifests.", + "x-intellij-html-description": "\u003cp\u003eDisable PodSecurityPolicy in the API server and default manifests.\u003c/p\u003e\n" + }, + "admissionControl": { + "items": { + "$ref": "#/$defs/v1alpha1.AdmissionPluginConfig" + }, + "type": "array", + "title": "admissionControl", + "description": "Configure the API server admission plugins.\n", + "markdownDescription": "Configure the API server admission plugins.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server admission plugins.\u003c/p\u003e\n" + }, + "auditPolicy": { + "type": "object", + "title": "auditPolicy", + "description": "Configure the API server audit policy.\n", + "markdownDescription": "Configure the API server audit policy.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server audit policy.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the API server resources.\n", + "markdownDescription": "Configure the API server resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server resources.\u003c/p\u003e\n" + }, + "authorizationConfig": { + "items": { + "$ref": "#/$defs/v1alpha1.AuthorizationConfigAuthorizerConfig" + }, + "type": "array", + "title": "authorizationConfig", + "description": "Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.\n", + "markdownDescription": "Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "APIServerConfig represents the kube apiserver configuration options." + }, + "v1alpha1.AdminKubeconfigConfig": { + "properties": { + "certLifetime": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "certLifetime", + "description": "Admin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).\n", + "markdownDescription": "Admin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).", + "x-intellij-html-description": "\u003cp\u003eAdmin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format (\u0026lsquo;1h\u0026rsquo; for one hour, \u0026lsquo;10m\u0026rsquo; for ten minutes).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "AdminKubeconfigConfig contains admin kubeconfig settings." + }, + "v1alpha1.AdmissionPluginConfig": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Name is the name of the admission controller.\nIt must match the registered admission plugin name.\n", + "markdownDescription": "Name is the name of the admission controller.\nIt must match the registered admission plugin name.", + "x-intellij-html-description": "\u003cp\u003eName is the name of the admission controller.\nIt must match the registered admission plugin name.\u003c/p\u003e\n" + }, + "configuration": { + "type": "object", + "title": "configuration", + "description": "Configuration is an embedded configuration object to be used as the plugin’s\nconfiguration.\n", + "markdownDescription": "Configuration is an embedded configuration object to be used as the plugin's\nconfiguration.", + "x-intellij-html-description": "\u003cp\u003eConfiguration is an embedded configuration object to be used as the plugin\u0026rsquo;s\nconfiguration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "AdmissionPluginConfig represents the API server admission plugin configuration." + }, + "v1alpha1.AuthorizationConfigAuthorizerConfig": { + "properties": { + "type": { + "type": "string", + "title": "type", + "description": "Type is the name of the authorizer. Allowed values are Node, RBAC, and Webhook.\n", + "markdownDescription": "Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.", + "x-intellij-html-description": "\u003cp\u003eType is the name of the authorizer. Allowed values are \u003ccode\u003eNode\u003c/code\u003e, \u003ccode\u003eRBAC\u003c/code\u003e, and \u003ccode\u003eWebhook\u003c/code\u003e.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Name is used to describe the authorizer.\n", + "markdownDescription": "Name is used to describe the authorizer.", + "x-intellij-html-description": "\u003cp\u003eName is used to describe the authorizer.\u003c/p\u003e\n" + }, + "webhook": { + "type": "object", + "title": "webhook", + "description": "webhook is the configuration for the webhook authorizer.\n", + "markdownDescription": "webhook is the configuration for the webhook authorizer.", + "x-intellij-html-description": "\u003cp\u003ewebhook is the configuration for the webhook authorizer.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "AuthorizationConfigAuthorizerConfig represents the API server authorization config authorizer configuration." + }, + "v1alpha1.Bond": { + "properties": { + "interfaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "interfaces", + "description": "The interfaces that make up the bond.\n", + "markdownDescription": "The interfaces that make up the bond.", + "x-intellij-html-description": "\u003cp\u003eThe interfaces that make up the bond.\u003c/p\u003e\n" + }, + "deviceSelectors": { + "items": { + "$ref": "#/$defs/v1alpha1.NetworkDeviceSelector" + }, + "type": "array", + "title": "deviceSelectors", + "description": "Picks a network device using the selector.\nMutually exclusive with interfaces.\nSupports partial match using wildcard syntax.\n", + "markdownDescription": "Picks a network device using the selector.\nMutually exclusive with `interfaces`.\nSupports partial match using wildcard syntax.", + "x-intellij-html-description": "\u003cp\u003ePicks a network device using the selector.\nMutually exclusive with \u003ccode\u003einterfaces\u003c/code\u003e.\nSupports partial match using wildcard syntax.\u003c/p\u003e\n" + }, + "arpIPTarget": { + "items": { + "type": "string" + }, + "type": "array", + "title": "arpIPTarget", + "description": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\u003c/p\u003e\n" + }, + "mode": { + "type": "string", + "title": "mode", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "xmitHashPolicy": { + "type": "string", + "title": "xmitHashPolicy", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "lacpRate": { + "type": "string", + "title": "lacpRate", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adActorSystem": { + "type": "string", + "title": "adActorSystem", + "description": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\u003c/p\u003e\n" + }, + "arpValidate": { + "type": "string", + "title": "arpValidate", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "arpAllTargets": { + "type": "string", + "title": "arpAllTargets", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "primary": { + "type": "string", + "title": "primary", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "primaryReselect": { + "type": "string", + "title": "primaryReselect", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "failOverMac": { + "type": "string", + "title": "failOverMac", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adSelect": { + "type": "string", + "title": "adSelect", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "miimon": { + "type": "integer", + "title": "miimon", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "updelay": { + "type": "integer", + "title": "updelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "downdelay": { + "type": "integer", + "title": "downdelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "arpInterval": { + "type": "integer", + "title": "arpInterval", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "resendIgmp": { + "type": "integer", + "title": "resendIgmp", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "minLinks": { + "type": "integer", + "title": "minLinks", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "lpInterval": { + "type": "integer", + "title": "lpInterval", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "packetsPerSlave": { + "type": "integer", + "title": "packetsPerSlave", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "numPeerNotif": { + "type": "integer", + "title": "numPeerNotif", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "tlbDynamicLb": { + "type": "integer", + "title": "tlbDynamicLb", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "allSlavesActive": { + "type": "integer", + "title": "allSlavesActive", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "useCarrier": { + "type": "boolean", + "title": "useCarrier", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adActorSysPrio": { + "type": "integer", + "title": "adActorSysPrio", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adUserPortKey": { + "type": "integer", + "title": "adUserPortKey", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "peerNotifyDelay": { + "type": "integer", + "title": "peerNotifyDelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "Bond contains the various options for configuring a bonded interface." + }, + "v1alpha1.Bridge": { + "properties": { + "interfaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "interfaces", + "description": "The interfaces that make up the bridge.\n", + "markdownDescription": "The interfaces that make up the bridge.", + "x-intellij-html-description": "\u003cp\u003eThe interfaces that make up the bridge.\u003c/p\u003e\n" + }, + "stp": { + "$ref": "#/$defs/v1alpha1.STP", + "title": "stp", + "description": "Enable STP on this bridge.\nPlease see the official kernel documentation.\n", + "markdownDescription": "Enable STP on this bridge.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eEnable STP on this bridge.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "vlan": { + "$ref": "#/$defs/v1alpha1.BridgeVLAN", + "title": "vlan", + "description": "Enable VLAN-awareness on this bridge.\nPlease see the official kernel documentation.\n", + "markdownDescription": "Enable VLAN-awareness on this bridge.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eEnable VLAN-awareness on this bridge.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "Bridge contains the various options for configuring a bridge interface." + }, + "v1alpha1.BridgePort": { + "properties": { + "master": { + "type": "string", + "title": "master", + "description": "The name of the bridge master interface\n", + "markdownDescription": "The name of the bridge master interface", + "x-intellij-html-description": "\u003cp\u003eThe name of the bridge master interface\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "BridgePort contains settings for assigning a link to a bridge interface." + }, + "v1alpha1.BridgeVLAN": { + "properties": { + "vlanFiltering": { + "type": "boolean", + "title": "vlanFiltering", + "description": "Whether VLAN filtering is enabled.\n", + "markdownDescription": "Whether VLAN filtering is enabled.", + "x-intellij-html-description": "\u003cp\u003eWhether VLAN filtering is enabled.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "BridgeVLAN contains the various options for configuring the VLAN properties of a bridge interface." + }, + "v1alpha1.CNIConfig": { + "properties": { + "name": { + "enum": [ + "flannel", + "custom", + "none" + ], + "title": "name", + "description": "Name of CNI to use.\n", + "markdownDescription": "Name of CNI to use.", + "x-intellij-html-description": "\u003cp\u003eName of CNI to use.\u003c/p\u003e\n" + }, + "urls": { + "items": { + "type": "string" + }, + "type": "array", + "title": "urls", + "description": "URLs containing manifests to apply for the CNI.\nShould be present for “custom”, must be empty for “flannel” and “none”.\n", + "markdownDescription": "URLs containing manifests to apply for the CNI.\nShould be present for \"custom\", must be empty for \"flannel\" and \"none\".", + "x-intellij-html-description": "\u003cp\u003eURLs containing manifests to apply for the CNI.\nShould be present for \u0026ldquo;custom\u0026rdquo;, must be empty for \u0026ldquo;flannel\u0026rdquo; and \u0026ldquo;none\u0026rdquo;.\u003c/p\u003e\n" + }, + "flannel": { + "$ref": "#/$defs/v1alpha1.FlannelCNIConfig", + "title": "flannel", + "description": "description: |\nFlannel configuration options.\n", + "markdownDescription": "description: |\nFlannel configuration options.", + "x-intellij-html-description": "\u003cp\u003edescription: |\nFlannel configuration options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "CNIConfig represents the CNI configuration options." + }, + "v1alpha1.ClusterConfig": { + "properties": { + "id": { + "type": "string", + "title": "id", + "description": "Globally unique identifier for this cluster (base64 encoded random 32 bytes).\n", + "markdownDescription": "Globally unique identifier for this cluster (base64 encoded random 32 bytes).", + "x-intellij-html-description": "\u003cp\u003eGlobally unique identifier for this cluster (base64 encoded random 32 bytes).\u003c/p\u003e\n" + }, + "secret": { + "type": "string", + "title": "secret", + "description": "Shared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.\n", + "markdownDescription": "Shared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.", + "x-intellij-html-description": "\u003cp\u003eShared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.\u003c/p\u003e\n" + }, + "controlPlane": { + "$ref": "#/$defs/v1alpha1.ControlPlaneConfig", + "title": "controlPlane", + "description": "Provides control plane specific configuration options.\n", + "markdownDescription": "Provides control plane specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides control plane specific configuration options.\u003c/p\u003e\n" + }, + "clusterName": { + "type": "string", + "title": "clusterName", + "description": "Configures the cluster’s name.\n", + "markdownDescription": "Configures the cluster's name.", + "x-intellij-html-description": "\u003cp\u003eConfigures the cluster\u0026rsquo;s name.\u003c/p\u003e\n" + }, + "network": { + "$ref": "#/$defs/v1alpha1.ClusterNetworkConfig", + "title": "network", + "description": "Provides cluster specific network configuration options.\n", + "markdownDescription": "Provides cluster specific network configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides cluster specific network configuration options.\u003c/p\u003e\n" + }, + "token": { + "type": "string", + "title": "token", + "description": "The bootstrap token used to join the cluster.\n", + "markdownDescription": "The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ca href=\"https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/\" target=\"_blank\"\u003ebootstrap token\u003c/a\u003e used to join the cluster.\u003c/p\u003e\n" + }, + "aescbcEncryptionSecret": { + "type": "string", + "title": "aescbcEncryptionSecret", + "description": "A key used for the encryption of secret data at rest.\nEnables encryption with AESCBC.\n", + "markdownDescription": "A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\nEnables encryption with AESCBC.", + "x-intellij-html-description": "\u003cp\u003eA key used for the \u003ca href=\"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\" target=\"_blank\"\u003eencryption of secret data at rest\u003c/a\u003e.\nEnables encryption with AESCBC.\u003c/p\u003e\n" + }, + "secretboxEncryptionSecret": { + "type": "string", + "title": "secretboxEncryptionSecret", + "description": "A key used for the encryption of secret data at rest.\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.\n", + "markdownDescription": "A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.", + "x-intellij-html-description": "\u003cp\u003eA key used for the \u003ca href=\"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\" target=\"_blank\"\u003eencryption of secret data at rest\u003c/a\u003e.\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The base64 encoded root certificate authority used by Kubernetes.\n", + "markdownDescription": "The base64 encoded root certificate authority used by Kubernetes.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded root certificate authority used by Kubernetes.\u003c/p\u003e\n" + }, + "acceptedCAs": { + "properties": { + "crt": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "acceptedCAs", + "description": "The list of base64 encoded accepted certificate authorities used by Kubernetes.\n", + "markdownDescription": "The list of base64 encoded accepted certificate authorities used by Kubernetes.", + "x-intellij-html-description": "\u003cp\u003eThe list of base64 encoded accepted certificate authorities used by Kubernetes.\u003c/p\u003e\n" + }, + "aggregatorCA": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "aggregatorCA", + "description": "The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n\nThis CA can be self-signed.\n", + "markdownDescription": "The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n\nThis CA can be self-signed.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\u003c/p\u003e\n\n\u003cp\u003eThis CA can be self-signed.\u003c/p\u003e\n" + }, + "serviceAccount": { + "properties": { + "key": { + "additionalProperties": false, + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "serviceAccount", + "description": "The base64 encoded private key for service account token generation.\n", + "markdownDescription": "The base64 encoded private key for service account token generation.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded private key for service account token generation.\u003c/p\u003e\n" + }, + "apiServer": { + "$ref": "#/$defs/v1alpha1.APIServerConfig", + "title": "apiServer", + "description": "API server specific configuration options.\n", + "markdownDescription": "API server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eAPI server specific configuration options.\u003c/p\u003e\n" + }, + "controllerManager": { + "$ref": "#/$defs/v1alpha1.ControllerManagerConfig", + "title": "controllerManager", + "description": "Controller manager server specific configuration options.\n", + "markdownDescription": "Controller manager server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eController manager server specific configuration options.\u003c/p\u003e\n" + }, + "proxy": { + "$ref": "#/$defs/v1alpha1.ProxyConfig", + "title": "proxy", + "description": "Kube-proxy server-specific configuration options\n", + "markdownDescription": "Kube-proxy server-specific configuration options", + "x-intellij-html-description": "\u003cp\u003eKube-proxy server-specific configuration options\u003c/p\u003e\n" + }, + "scheduler": { + "$ref": "#/$defs/v1alpha1.SchedulerConfig", + "title": "scheduler", + "description": "Scheduler server specific configuration options.\n", + "markdownDescription": "Scheduler server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eScheduler server specific configuration options.\u003c/p\u003e\n" + }, + "discovery": { + "$ref": "#/$defs/v1alpha1.ClusterDiscoveryConfig", + "title": "discovery", + "description": "Configures cluster member discovery.\n", + "markdownDescription": "Configures cluster member discovery.", + "x-intellij-html-description": "\u003cp\u003eConfigures cluster member discovery.\u003c/p\u003e\n" + }, + "etcd": { + "$ref": "#/$defs/v1alpha1.EtcdConfig", + "title": "etcd", + "description": "Etcd specific configuration options.\n", + "markdownDescription": "Etcd specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eEtcd specific configuration options.\u003c/p\u003e\n" + }, + "coreDNS": { + "$ref": "#/$defs/v1alpha1.CoreDNS", + "title": "coreDNS", + "description": "Core DNS specific configuration options.\n", + "markdownDescription": "Core DNS specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eCore DNS specific configuration options.\u003c/p\u003e\n" + }, + "externalCloudProvider": { + "$ref": "#/$defs/v1alpha1.ExternalCloudProviderConfig", + "title": "externalCloudProvider", + "description": "External cloud provider configuration.\n", + "markdownDescription": "External cloud provider configuration.", + "x-intellij-html-description": "\u003cp\u003eExternal cloud provider configuration.\u003c/p\u003e\n" + }, + "extraManifests": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraManifests", + "description": "A list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + }, + "extraManifestHeaders": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraManifestHeaders", + "description": "A map of key value pairs that will be added while fetching the extraManifests.\n", + "markdownDescription": "A map of key value pairs that will be added while fetching the extraManifests.", + "x-intellij-html-description": "\u003cp\u003eA map of key value pairs that will be added while fetching the extraManifests.\u003c/p\u003e\n" + }, + "inlineManifests": { + "items": { + "$ref": "#/$defs/v1alpha1.ClusterInlineManifest" + }, + "type": "array", + "title": "inlineManifests", + "description": "A list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + }, + "adminKubeconfig": { + "$ref": "#/$defs/v1alpha1.AdminKubeconfigConfig", + "title": "adminKubeconfig", + "description": "Settings for admin kubeconfig generation.\nCertificate lifetime can be configured.\n", + "markdownDescription": "Settings for admin kubeconfig generation.\nCertificate lifetime can be configured.", + "x-intellij-html-description": "\u003cp\u003eSettings for admin kubeconfig generation.\nCertificate lifetime can be configured.\u003c/p\u003e\n" + }, + "allowSchedulingOnControlPlanes": { + "type": "boolean", + "title": "allowSchedulingOnControlPlanes", + "description": "Allows running workload on control-plane nodes.\n", + "markdownDescription": "Allows running workload on control-plane nodes.", + "x-intellij-html-description": "\u003cp\u003eAllows running workload on control-plane nodes.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ClusterConfig represents the cluster-wide config values." + }, + "v1alpha1.ClusterDiscoveryConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.\n", + "markdownDescription": "Enable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.", + "x-intellij-html-description": "\u003cp\u003eEnable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.\u003c/p\u003e\n" + }, + "registries": { + "$ref": "#/$defs/v1alpha1.DiscoveryRegistriesConfig", + "title": "registries", + "description": "Configure registries used for cluster member discovery.\n", + "markdownDescription": "Configure registries used for cluster member discovery.", + "x-intellij-html-description": "\u003cp\u003eConfigure registries used for cluster member discovery.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ClusterDiscoveryConfig struct configures cluster membership discovery." + }, + "v1alpha1.ClusterInlineManifest": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Name of the manifest.\nName should be unique.\n", + "markdownDescription": "Name of the manifest.\nName should be unique.", + "x-intellij-html-description": "\u003cp\u003eName of the manifest.\nName should be unique.\u003c/p\u003e\n" + }, + "contents": { + "type": "string", + "title": "contents", + "description": "Manifest contents as a string.\n", + "markdownDescription": "Manifest contents as a string.", + "x-intellij-html-description": "\u003cp\u003eManifest contents as a string.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ClusterInlineManifest struct describes inline bootstrap manifests for the user." + }, + "v1alpha1.ClusterNetworkConfig": { + "properties": { + "cni": { + "$ref": "#/$defs/v1alpha1.CNIConfig", + "title": "cni", + "description": "The CNI used.\nComposed of “name” and “urls”.\nThe “name” key supports the following options: “flannel”, “custom”, and “none”.\n“flannel” uses Talos-managed Flannel CNI, and that’s the default option.\n“custom” uses custom manifests that should be provided in “urls”.\n“none” indicates that Talos will not manage any CNI installation.\n", + "markdownDescription": "The CNI used.\nComposed of \"name\" and \"urls\".\nThe \"name\" key supports the following options: \"flannel\", \"custom\", and \"none\".\n\"flannel\" uses Talos-managed Flannel CNI, and that's the default option.\n\"custom\" uses custom manifests that should be provided in \"urls\".\n\"none\" indicates that Talos will not manage any CNI installation.", + "x-intellij-html-description": "\u003cp\u003eThe CNI used.\nComposed of \u0026ldquo;name\u0026rdquo; and \u0026ldquo;urls\u0026rdquo;.\nThe \u0026ldquo;name\u0026rdquo; key supports the following options: \u0026ldquo;flannel\u0026rdquo;, \u0026ldquo;custom\u0026rdquo;, and \u0026ldquo;none\u0026rdquo;.\n\u0026ldquo;flannel\u0026rdquo; uses Talos-managed Flannel CNI, and that\u0026rsquo;s the default option.\n\u0026ldquo;custom\u0026rdquo; uses custom manifests that should be provided in \u0026ldquo;urls\u0026rdquo;.\n\u0026ldquo;none\u0026rdquo; indicates that Talos will not manage any CNI installation.\u003c/p\u003e\n" + }, + "dnsDomain": { + "type": "string", + "title": "dnsDomain", + "description": "The domain used by Kubernetes DNS.\nThe default is cluster.local\n", + "markdownDescription": "The domain used by Kubernetes DNS.\nThe default is `cluster.local`", + "x-intellij-html-description": "\u003cp\u003eThe domain used by Kubernetes DNS.\nThe default is \u003ccode\u003ecluster.local\u003c/code\u003e\u003c/p\u003e\n" + }, + "podSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "podSubnets", + "description": "The pod subnet CIDR.\n", + "markdownDescription": "The pod subnet CIDR.", + "x-intellij-html-description": "\u003cp\u003eThe pod subnet CIDR.\u003c/p\u003e\n" + }, + "serviceSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "serviceSubnets", + "description": "The service subnet CIDR.\n", + "markdownDescription": "The service subnet CIDR.", + "x-intellij-html-description": "\u003cp\u003eThe service subnet CIDR.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ClusterNetworkConfig represents kube networking configuration options." + }, + "v1alpha1.Config": { + "properties": { + "version": { + "enum": [ + "v1alpha1" + ], + "title": "version", + "description": "Indicates the schema used to decode the contents.\n", + "markdownDescription": "Indicates the schema used to decode the contents.", + "x-intellij-html-description": "\u003cp\u003eIndicates the schema used to decode the contents.\u003c/p\u003e\n" + }, + "debug": { + "type": "boolean", + "title": "debug", + "description": "Enable verbose logging to the console.\nAll system containers logs will flow into serial console.\n\nNote: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.\n", + "markdownDescription": "Enable verbose logging to the console.\nAll system containers logs will flow into serial console.\n\n**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.", + "x-intellij-html-description": "\u003cp\u003eEnable verbose logging to the console.\nAll system containers logs will flow into serial console.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.\u003c/p\u003e\n" + }, + "machine": { + "$ref": "#/$defs/v1alpha1.MachineConfig", + "title": "machine", + "description": "Provides machine specific configuration options.\n", + "markdownDescription": "Provides machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific configuration options.\u003c/p\u003e\n" + }, + "cluster": { + "$ref": "#/$defs/v1alpha1.ClusterConfig", + "title": "cluster", + "description": "Provides cluster specific configuration options.\n", + "markdownDescription": "Provides cluster specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides cluster specific configuration options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "Config defines the v1alpha1.Config Talos machine configuration document." + }, + "v1alpha1.ControlPlaneConfig": { + "properties": { + "endpoint": { + "type": "string", + "pattern": "^https://", + "format": "uri", + "title": "endpoint", + "description": "Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.\n", + "markdownDescription": "Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.", + "x-intellij-html-description": "\u003cp\u003eEndpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.\u003c/p\u003e\n" + }, + "localAPIServerPort": { + "type": "integer", + "title": "localAPIServerPort", + "description": "The port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is 6443.\n", + "markdownDescription": "The port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is `6443`.", + "x-intellij-html-description": "\u003cp\u003eThe port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is \u003ccode\u003e6443\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ControlPlaneConfig represents the control plane configuration options." + }, + "v1alpha1.ControllerManagerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the controller manager manifest.\n", + "markdownDescription": "The container image used in the controller manager manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the controller manager manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the controller manager.\n", + "markdownDescription": "Extra arguments to supply to the controller manager.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the controller manager.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/v1alpha1.VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the controller manager static pod.\n", + "markdownDescription": "Extra volumes to mount to the controller manager static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the controller manager static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the controller manager resources.\n", + "markdownDescription": "Configure the controller manager resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the controller manager resources.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ControllerManagerConfig represents the kube controller manager configuration options." + }, + "v1alpha1.CoreDNS": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable coredns deployment on cluster bootstrap.\n", + "markdownDescription": "Disable coredns deployment on cluster bootstrap.", + "x-intellij-html-description": "\u003cp\u003eDisable coredns deployment on cluster bootstrap.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "The image field is an override to the default coredns image.\n", + "markdownDescription": "The `image` field is an override to the default coredns image.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an override to the default coredns image.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "CoreDNS represents the CoreDNS config values." + }, + "v1alpha1.DHCPOptions": { + "properties": { + "routeMetric": { + "type": "integer", + "title": "routeMetric", + "description": "The priority of all routes received via DHCP.\n", + "markdownDescription": "The priority of all routes received via DHCP.", + "x-intellij-html-description": "\u003cp\u003eThe priority of all routes received via DHCP.\u003c/p\u003e\n" + }, + "ipv4": { + "type": "boolean", + "title": "ipv4", + "description": "Enables DHCPv4 protocol for the interface (default is enabled).\n", + "markdownDescription": "Enables DHCPv4 protocol for the interface (default is enabled).", + "x-intellij-html-description": "\u003cp\u003eEnables DHCPv4 protocol for the interface (default is enabled).\u003c/p\u003e\n" + }, + "ipv6": { + "type": "boolean", + "title": "ipv6", + "description": "Enables DHCPv6 protocol for the interface (default is disabled).\n", + "markdownDescription": "Enables DHCPv6 protocol for the interface (default is disabled).", + "x-intellij-html-description": "\u003cp\u003eEnables DHCPv6 protocol for the interface (default is disabled).\u003c/p\u003e\n" + }, + "duidv6": { + "type": "string", + "title": "duidv6", + "description": "Set client DUID (hex string).\n", + "markdownDescription": "Set client DUID (hex string).", + "x-intellij-html-description": "\u003cp\u003eSet client DUID (hex string).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "DHCPOptions contains options for configuring the DHCP settings for a given interface." + }, + "v1alpha1.Device": { + "properties": { + "interface": { + "type": "string", + "title": "interface", + "description": "The interface name.\nMutually exclusive with deviceSelector.\n", + "markdownDescription": "The interface name.\nMutually exclusive with `deviceSelector`.", + "x-intellij-html-description": "\u003cp\u003eThe interface name.\nMutually exclusive with \u003ccode\u003edeviceSelector\u003c/code\u003e.\u003c/p\u003e\n" + }, + "deviceSelector": { + "$ref": "#/$defs/v1alpha1.NetworkDeviceSelector", + "title": "deviceSelector", + "description": "Picks a network device using the selector.\nMutually exclusive with interface.\nSupports partial match using wildcard syntax.\n", + "markdownDescription": "Picks a network device using the selector.\nMutually exclusive with `interface`.\nSupports partial match using wildcard syntax.", + "x-intellij-html-description": "\u003cp\u003ePicks a network device using the selector.\nMutually exclusive with \u003ccode\u003einterface\u003c/code\u003e.\nSupports partial match using wildcard syntax.\u003c/p\u003e\n" + }, + "addresses": { + "items": { + "type": "string" + }, + "type": "array", + "title": "addresses", + "description": "Assigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).\n", + "markdownDescription": "Assigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).", + "x-intellij-html-description": "\u003cp\u003eAssigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).\u003c/p\u003e\n" + }, + "routes": { + "items": { + "$ref": "#/$defs/v1alpha1.Route" + }, + "type": "array", + "title": "routes", + "description": "A list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.\n", + "markdownDescription": "A list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.", + "x-intellij-html-description": "\u003cp\u003eA list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.\u003c/p\u003e\n" + }, + "bond": { + "$ref": "#/$defs/v1alpha1.Bond", + "title": "bond", + "description": "Bond specific options.\n", + "markdownDescription": "Bond specific options.", + "x-intellij-html-description": "\u003cp\u003eBond specific options.\u003c/p\u003e\n" + }, + "bridge": { + "$ref": "#/$defs/v1alpha1.Bridge", + "title": "bridge", + "description": "Bridge specific options.\n", + "markdownDescription": "Bridge specific options.", + "x-intellij-html-description": "\u003cp\u003eBridge specific options.\u003c/p\u003e\n" + }, + "bridgePort": { + "$ref": "#/$defs/v1alpha1.BridgePort", + "title": "bridgePort", + "description": "Configure this device as a bridge port.\nThis can be used to dynamically assign network interfaces to a bridge.\n", + "markdownDescription": "Configure this device as a bridge port.\nThis can be used to dynamically assign network interfaces to a bridge.", + "x-intellij-html-description": "\u003cp\u003eConfigure this device as a bridge port.\nThis can be used to dynamically assign network interfaces to a bridge.\u003c/p\u003e\n" + }, + "vlans": { + "items": { + "$ref": "#/$defs/v1alpha1.Vlan" + }, + "type": "array", + "title": "vlans", + "description": "VLAN specific options.\n", + "markdownDescription": "VLAN specific options.", + "x-intellij-html-description": "\u003cp\u003eVLAN specific options.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The interface’s MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.\n", + "markdownDescription": "The interface's MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.", + "x-intellij-html-description": "\u003cp\u003eThe interface\u0026rsquo;s MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.\u003c/p\u003e\n" + }, + "dhcp": { + "type": "boolean", + "title": "dhcp", + "description": "Indicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\n\n\nOptionClasslessStaticRoute\nOptionDomainNameServer\nOptionDNSDomainSearchList\nOptionHostName\n\n", + "markdownDescription": "Indicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\n\n- `OptionClasslessStaticRoute`\n- `OptionDomainNameServer`\n- `OptionDNSDomainSearchList`\n- `OptionHostName`", + "x-intellij-html-description": "\u003cp\u003eIndicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eOptionClasslessStaticRoute\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionDomainNameServer\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionDNSDomainSearchList\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionHostName\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n" + }, + "ignore": { + "type": "boolean", + "title": "ignore", + "description": "Indicates if the interface should be ignored (skips configuration).\n", + "markdownDescription": "Indicates if the interface should be ignored (skips configuration).", + "x-intellij-html-description": "\u003cp\u003eIndicates if the interface should be ignored (skips configuration).\u003c/p\u003e\n" + }, + "dummy": { + "type": "boolean", + "title": "dummy", + "description": "Indicates if the interface is a dummy interface.\ndummy is used to specify that this interface should be a virtual-only, dummy interface.\n", + "markdownDescription": "Indicates if the interface is a dummy interface.\n`dummy` is used to specify that this interface should be a virtual-only, dummy interface.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the interface is a dummy interface.\n\u003ccode\u003edummy\u003c/code\u003e is used to specify that this interface should be a virtual-only, dummy interface.\u003c/p\u003e\n" + }, + "dhcpOptions": { + "$ref": "#/$defs/v1alpha1.DHCPOptions", + "title": "dhcpOptions", + "description": "DHCP specific options.\ndhcp must be set to true for these to take effect.\n", + "markdownDescription": "DHCP specific options.\n`dhcp` *must* be set to true for these to take effect.", + "x-intellij-html-description": "\u003cp\u003eDHCP specific options.\n\u003ccode\u003edhcp\u003c/code\u003e \u003cem\u003emust\u003c/em\u003e be set to true for these to take effect.\u003c/p\u003e\n" + }, + "wireguard": { + "$ref": "#/$defs/v1alpha1.DeviceWireguardConfig", + "title": "wireguard", + "description": "Wireguard specific configuration.\nIncludes things like private key, listen port, peers.\n", + "markdownDescription": "Wireguard specific configuration.\nIncludes things like private key, listen port, peers.", + "x-intellij-html-description": "\u003cp\u003eWireguard specific configuration.\nIncludes things like private key, listen port, peers.\u003c/p\u003e\n" + }, + "vip": { + "$ref": "#/$defs/v1alpha1.DeviceVIPConfig", + "title": "vip", + "description": "Virtual (shared) IP address configuration.\n", + "markdownDescription": "Virtual (shared) IP address configuration.", + "x-intellij-html-description": "\u003cp\u003eVirtual (shared) IP address configuration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "Device represents a network interface." + }, + "v1alpha1.DeviceVIPConfig": { + "properties": { + "ip": { + "type": "string", + "title": "ip", + "description": "Specifies the IP address to be used.\n", + "markdownDescription": "Specifies the IP address to be used.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the IP address to be used.\u003c/p\u003e\n" + }, + "equinixMetal": { + "$ref": "#/$defs/v1alpha1.VIPEquinixMetalConfig", + "title": "equinixMetal", + "description": "Specifies the Equinix Metal API settings to assign VIP to the node.\n", + "markdownDescription": "Specifies the Equinix Metal API settings to assign VIP to the node.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Equinix Metal API settings to assign VIP to the node.\u003c/p\u003e\n" + }, + "hcloud": { + "$ref": "#/$defs/v1alpha1.VIPHCloudConfig", + "title": "hcloud", + "description": "Specifies the Hetzner Cloud API settings to assign VIP to the node.\n", + "markdownDescription": "Specifies the Hetzner Cloud API settings to assign VIP to the node.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Hetzner Cloud API settings to assign VIP to the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface." + }, + "v1alpha1.DeviceWireguardConfig": { + "properties": { + "privateKey": { + "type": "string", + "title": "privateKey", + "description": "Specifies a private key configuration (base64 encoded).\nCan be generated by wg genkey.\n", + "markdownDescription": "Specifies a private key configuration (base64 encoded).\nCan be generated by `wg genkey`.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a private key configuration (base64 encoded).\nCan be generated by \u003ccode\u003ewg genkey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "listenPort": { + "type": "integer", + "title": "listenPort", + "description": "Specifies a device’s listening port.\n", + "markdownDescription": "Specifies a device's listening port.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a device\u0026rsquo;s listening port.\u003c/p\u003e\n" + }, + "firewallMark": { + "type": "integer", + "title": "firewallMark", + "description": "Specifies a device’s firewall mark.\n", + "markdownDescription": "Specifies a device's firewall mark.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a device\u0026rsquo;s firewall mark.\u003c/p\u003e\n" + }, + "peers": { + "items": { + "$ref": "#/$defs/v1alpha1.DeviceWireguardPeer" + }, + "type": "array", + "title": "peers", + "description": "Specifies a list of peer configurations to apply to a device.\n", + "markdownDescription": "Specifies a list of peer configurations to apply to a device.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a list of peer configurations to apply to a device.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "DeviceWireguardConfig contains settings for configuring Wireguard network interface." + }, + "v1alpha1.DeviceWireguardPeer": { + "properties": { + "publicKey": { + "type": "string", + "title": "publicKey", + "description": "Specifies the public key of this peer.\nCan be extracted from private key by running wg pubkey \u0026lt; private.key \u0026gt; public.key \u0026amp;\u0026amp; cat public.key.\n", + "markdownDescription": "Specifies the public key of this peer.\nCan be extracted from private key by running `wg pubkey \u003c private.key \u003e public.key \u0026\u0026 cat public.key`.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the public key of this peer.\nCan be extracted from private key by running \u003ccode\u003ewg pubkey \u0026lt; private.key \u0026gt; public.key \u0026amp;\u0026amp; cat public.key\u003c/code\u003e.\u003c/p\u003e\n" + }, + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "Specifies the endpoint of this peer entry.\n", + "markdownDescription": "Specifies the endpoint of this peer entry.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the endpoint of this peer entry.\u003c/p\u003e\n" + }, + "persistentKeepaliveInterval": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "persistentKeepaliveInterval", + "description": "Specifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).\n", + "markdownDescription": "Specifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).", + "x-intellij-html-description": "\u003cp\u003eSpecifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format (\u0026lsquo;1h\u0026rsquo; for one hour, \u0026lsquo;10m\u0026rsquo; for ten minutes).\u003c/p\u003e\n" + }, + "allowedIPs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedIPs", + "description": "AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\n", + "markdownDescription": "AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.", + "x-intellij-html-description": "\u003cp\u003eAllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "DeviceWireguardPeer a WireGuard device peer configuration." + }, + "v1alpha1.DiscoveryRegistriesConfig": { + "properties": { + "kubernetes": { + "$ref": "#/$defs/v1alpha1.RegistryKubernetesConfig", + "title": "kubernetes", + "description": "Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\n\nThis feature is deprecated as it is not compatible with Kubernetes 1.32+.\nSee https://github.com/siderolabs/talos/issues/9980 for more information.\n", + "markdownDescription": "Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\n\nThis feature is deprecated as it is not compatible with Kubernetes 1.32+.\nSee https://github.com/siderolabs/talos/issues/9980 for more information.", + "x-intellij-html-description": "\u003cp\u003eKubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\u003c/p\u003e\n\n\u003cp\u003eThis feature is deprecated as it is not compatible with Kubernetes 1.32+.\nSee \u003ca href=\"https://github.com/siderolabs/talos/issues/9980\" target=\"_blank\"\u003ehttps://github.com/siderolabs/talos/issues/9980\u003c/a\u003e for more information.\u003c/p\u003e\n" + }, + "service": { + "$ref": "#/$defs/v1alpha1.RegistryServiceConfig", + "title": "service", + "description": "Service registry is using an external service to push and pull information about cluster members.\n", + "markdownDescription": "Service registry is using an external service to push and pull information about cluster members.", + "x-intellij-html-description": "\u003cp\u003eService registry is using an external service to push and pull information about cluster members.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "DiscoveryRegistriesConfig struct configures cluster membership discovery." + }, + "v1alpha1.Endpoint": { + "properties": {}, + "additionalProperties": false, + "type": "object", + "description": "Endpoint represents the endpoint URL parsed out of the machine config." + }, + "v1alpha1.EtcdConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used to create the etcd service.\n", + "markdownDescription": "The container image used to create the etcd service.", + "x-intellij-html-description": "\u003cp\u003eThe container image used to create the etcd service.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The ca is the root certificate authority of the PKI.\nIt is composed of a base64 encoded crt and key.\n", + "markdownDescription": "The `ca` is the root certificate authority of the PKI.\nIt is composed of a base64 encoded `crt` and `key`.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eca\u003c/code\u003e is the root certificate authority of the PKI.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e and \u003ccode\u003ekey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to etcd.\nNote that the following args are not allowed:\n\n\nname\ndata-dir\ninitial-cluster-state\nlisten-peer-urls\nlisten-client-urls\ncert-file\nkey-file\ntrusted-ca-file\npeer-client-cert-auth\npeer-cert-file\npeer-trusted-ca-file\npeer-key-file\n\n", + "markdownDescription": "Extra arguments to supply to etcd.\nNote that the following args are not allowed:\n\n- `name`\n- `data-dir`\n- `initial-cluster-state`\n- `listen-peer-urls`\n- `listen-client-urls`\n- `cert-file`\n- `key-file`\n- `trusted-ca-file`\n- `peer-client-cert-auth`\n- `peer-cert-file`\n- `peer-trusted-ca-file`\n- `peer-key-file`", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to etcd.\nNote that the following args are not allowed:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ename\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003edata-dir\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003einitial-cluster-state\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elisten-peer-urls\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elisten-client-urls\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ecert-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ekey-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etrusted-ca-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-client-cert-auth\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-cert-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-trusted-ca-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-key-file\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n" + }, + "advertisedSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "advertisedSubnets", + "description": "The advertisedSubnets field configures the networks to pick etcd advertised IP from.\n\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\n", + "markdownDescription": "The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.\n\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eadvertisedSubnets\u003c/code\u003e field configures the networks to pick etcd advertised IP from.\u003c/p\u003e\n\n\u003cp\u003eIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\u003c/p\u003e\n" + }, + "listenSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "listenSubnets", + "description": "The listenSubnets field configures the networks for the etcd to listen for peer and client connections.\n\nIf listenSubnets is not set, but advertisedSubnets is set, listenSubnets defaults to\nadvertisedSubnets.\n\nIf neither advertisedSubnets nor listenSubnets is set, listenSubnets defaults to listen on all addresses.\n\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\n", + "markdownDescription": "The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections.\n\nIf `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to\n`advertisedSubnets`.\n\nIf neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses.\n\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003elistenSubnets\u003c/code\u003e field configures the networks for the etcd to listen for peer and client connections.\u003c/p\u003e\n\n\u003cp\u003eIf \u003ccode\u003elistenSubnets\u003c/code\u003e is not set, but \u003ccode\u003eadvertisedSubnets\u003c/code\u003e is set, \u003ccode\u003elistenSubnets\u003c/code\u003e defaults to\n\u003ccode\u003eadvertisedSubnets\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003eIf neither \u003ccode\u003eadvertisedSubnets\u003c/code\u003e nor \u003ccode\u003elistenSubnets\u003c/code\u003e is set, \u003ccode\u003elistenSubnets\u003c/code\u003e defaults to listen on all addresses.\u003c/p\u003e\n\n\u003cp\u003eIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EtcdConfig represents the etcd configuration options." + }, + "v1alpha1.ExternalCloudProviderConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable external cloud provider.\n", + "markdownDescription": "Enable external cloud provider.", + "x-intellij-html-description": "\u003cp\u003eEnable external cloud provider.\u003c/p\u003e\n" + }, + "manifests": { + "items": { + "type": "string" + }, + "type": "array", + "title": "manifests", + "description": "A list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ExternalCloudProviderConfig contains external cloud provider configuration." + }, + "v1alpha1.ExtraHost": { + "properties": { + "ip": { + "type": "string", + "title": "ip", + "description": "The IP of the host.\n", + "markdownDescription": "The IP of the host.", + "x-intellij-html-description": "\u003cp\u003eThe IP of the host.\u003c/p\u003e\n" + }, + "aliases": { + "items": { + "type": "string" + }, + "type": "array", + "title": "aliases", + "description": "The host alias.\n", + "markdownDescription": "The host alias.", + "x-intellij-html-description": "\u003cp\u003eThe host alias.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ExtraHost represents a host entry in /etc/hosts." + }, + "v1alpha1.ExtraMount": { + "properties": { + "destination": { + "type": "string", + "title": "destination", + "description": "Destination is the absolute path where the mount will be placed in the container.\n", + "markdownDescription": "Destination is the absolute path where the mount will be placed in the container.", + "x-intellij-html-description": "\u003cp\u003eDestination is the absolute path where the mount will be placed in the container.\u003c/p\u003e\n" + }, + "type": { + "type": "string", + "title": "type", + "description": "Type specifies the mount kind.\n", + "markdownDescription": "Type specifies the mount kind.", + "x-intellij-html-description": "\u003cp\u003eType specifies the mount kind.\u003c/p\u003e\n" + }, + "source": { + "type": "string", + "title": "source", + "description": "Source specifies the source path of the mount.\n", + "markdownDescription": "Source specifies the source path of the mount.", + "x-intellij-html-description": "\u003cp\u003eSource specifies the source path of the mount.\u003c/p\u003e\n" + }, + "options": { + "items": { + "type": "string" + }, + "type": "array", + "title": "options", + "description": "Options are fstab style mount options.\n", + "markdownDescription": "Options are fstab style mount options.", + "x-intellij-html-description": "\u003cp\u003eOptions are fstab style mount options.\u003c/p\u003e\n" + }, + "uidMappings": { + "items": { + "$ref": "#/$defs/v1alpha1.LinuxIDMapping" + }, + "type": "array", + "title": "uidMappings", + "description": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.\n", + "markdownDescription": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.", + "x-intellij-html-description": "\u003cp\u003eUID/GID mappings used for changing file owners w/o calling chown, fs should support it.\u003c/p\u003e\n\n\u003cp\u003eEvery mount point could have its own mapping.\u003c/p\u003e\n" + }, + "gidMappings": { + "items": { + "$ref": "#/$defs/v1alpha1.LinuxIDMapping" + }, + "type": "array", + "title": "gidMappings", + "description": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.\n", + "markdownDescription": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.", + "x-intellij-html-description": "\u003cp\u003eUID/GID mappings used for changing file owners w/o calling chown, fs should support it.\u003c/p\u003e\n\n\u003cp\u003eEvery mount point could have its own mapping.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ExtraMount wraps OCI Mount specification." + }, + "v1alpha1.FeaturesConfig": { + "properties": { + "rbac": { + "type": "boolean", + "title": "rbac", + "description": "Enable role-based access control (RBAC).\n", + "markdownDescription": "Enable role-based access control (RBAC).", + "x-intellij-html-description": "\u003cp\u003eEnable role-based access control (RBAC).\u003c/p\u003e\n" + }, + "stableHostname": { + "type": "boolean", + "title": "stableHostname", + "description": "Enable stable default hostname.\n", + "markdownDescription": "Enable stable default hostname.", + "x-intellij-html-description": "\u003cp\u003eEnable stable default hostname.\u003c/p\u003e\n" + }, + "kubernetesTalosAPIAccess": { + "$ref": "#/$defs/v1alpha1.KubernetesTalosAPIAccessConfig", + "title": "kubernetesTalosAPIAccess", + "description": "Configure Talos API access from Kubernetes pods.\n\nThis feature is disabled if the feature config is not specified.\n", + "markdownDescription": "Configure Talos API access from Kubernetes pods.\n\nThis feature is disabled if the feature config is not specified.", + "x-intellij-html-description": "\u003cp\u003eConfigure Talos API access from Kubernetes pods.\u003c/p\u003e\n\n\u003cp\u003eThis feature is disabled if the feature config is not specified.\u003c/p\u003e\n" + }, + "apidCheckExtKeyUsage": { + "type": "boolean", + "title": "apidCheckExtKeyUsage", + "description": "Enable checks for extended key usage of client certificates in apid.\n", + "markdownDescription": "Enable checks for extended key usage of client certificates in apid.", + "x-intellij-html-description": "\u003cp\u003eEnable checks for extended key usage of client certificates in apid.\u003c/p\u003e\n" + }, + "diskQuotaSupport": { + "type": "boolean", + "title": "diskQuotaSupport", + "description": "Enable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.\n", + "markdownDescription": "Enable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.", + "x-intellij-html-description": "\u003cp\u003eEnable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.\u003c/p\u003e\n" + }, + "kubePrism": { + "$ref": "#/$defs/v1alpha1.KubePrism", + "title": "kubePrism", + "description": "KubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.\n", + "markdownDescription": "KubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.", + "x-intellij-html-description": "\u003cp\u003eKubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.\u003c/p\u003e\n" + }, + "hostDNS": { + "$ref": "#/$defs/v1alpha1.HostDNSConfig", + "title": "hostDNS", + "description": "Configures host DNS caching resolver.\n", + "markdownDescription": "Configures host DNS caching resolver.", + "x-intellij-html-description": "\u003cp\u003eConfigures host DNS caching resolver.\u003c/p\u003e\n" + }, + "imageCache": { + "$ref": "#/$defs/v1alpha1.ImageCacheConfig", + "title": "imageCache", + "description": "Enable Image Cache feature.\n", + "markdownDescription": "Enable Image Cache feature.", + "x-intellij-html-description": "\u003cp\u003eEnable Image Cache feature.\u003c/p\u003e\n" + }, + "nodeAddressSortAlgorithm": { + "type": "string", + "title": "nodeAddressSortAlgorithm", + "description": "Select the node address sort algorithm.\nThe ‘v1’ algorithm sorts addresses by the address itself.\nThe ‘v2’ algorithm prefers more specific prefixes.\nIf unset, defaults to ‘v1’.\n", + "markdownDescription": "Select the node address sort algorithm.\nThe 'v1' algorithm sorts addresses by the address itself.\nThe 'v2' algorithm prefers more specific prefixes.\nIf unset, defaults to 'v1'.", + "x-intellij-html-description": "\u003cp\u003eSelect the node address sort algorithm.\nThe \u0026lsquo;v1\u0026rsquo; algorithm sorts addresses by the address itself.\nThe \u0026lsquo;v2\u0026rsquo; algorithm prefers more specific prefixes.\nIf unset, defaults to \u0026lsquo;v1\u0026rsquo;.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "FeaturesConfig describes individual Talos features that can be switched on or off." + }, + "v1alpha1.FlannelCNIConfig": { + "properties": { + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraArgs", + "description": "Extra arguments for ‘flanneld’.\n", + "markdownDescription": "Extra arguments for 'flanneld'.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments for \u0026lsquo;flanneld\u0026rsquo;.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "FlannelCNIConfig represents the Flannel CNI configuration options." + }, + "v1alpha1.HostDNSConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable host DNS caching resolver.\n", + "markdownDescription": "Enable host DNS caching resolver.", + "x-intellij-html-description": "\u003cp\u003eEnable host DNS caching resolver.\u003c/p\u003e\n" + }, + "forwardKubeDNSToHost": { + "type": "boolean", + "title": "forwardKubeDNSToHost", + "description": "Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.\n\nWhen enabled, CoreDNS pods use host DNS server as the upstream DNS (instead of\nusing configured upstream DNS resolvers directly).\n", + "markdownDescription": "Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.\n\nWhen enabled, CoreDNS pods use host DNS server as the upstream DNS (instead of\nusing configured upstream DNS resolvers directly).", + "x-intellij-html-description": "\u003cp\u003eUse the host DNS resolver as upstream for Kubernetes CoreDNS pods.\u003c/p\u003e\n\n\u003cp\u003eWhen enabled, CoreDNS pods use host DNS server as the upstream DNS (instead of\nusing configured upstream DNS resolvers directly).\u003c/p\u003e\n" + }, + "resolveMemberNames": { + "type": "boolean", + "title": "resolveMemberNames", + "description": "Resolve member hostnames using the host DNS resolver.\n\nWhen enabled, cluster member hostnames and node names are resolved using the host DNS resolver.\nThis requires service discovery to be enabled.\n", + "markdownDescription": "Resolve member hostnames using the host DNS resolver.\n\nWhen enabled, cluster member hostnames and node names are resolved using the host DNS resolver.\nThis requires service discovery to be enabled.", + "x-intellij-html-description": "\u003cp\u003eResolve member hostnames using the host DNS resolver.\u003c/p\u003e\n\n\u003cp\u003eWhen enabled, cluster member hostnames and node names are resolved using the host DNS resolver.\nThis requires service discovery to be enabled.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "HostDNSConfig describes the configuration for the host DNS resolver." + }, + "v1alpha1.ImageCacheConfig": { + "properties": { + "localEnabled": { + "type": "boolean", + "title": "localEnabled", + "description": "Enable local image cache.\n", + "markdownDescription": "Enable local image cache.", + "x-intellij-html-description": "\u003cp\u003eEnable local image cache.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ImageCacheConfig describes the configuration for the Image Cache feature." + }, + "v1alpha1.InstallConfig": { + "properties": { + "disk": { + "type": "string", + "title": "disk", + "description": "The disk used for installations.\n", + "markdownDescription": "The disk used for installations.", + "x-intellij-html-description": "\u003cp\u003eThe disk used for installations.\u003c/p\u003e\n" + }, + "diskSelector": { + "$ref": "#/$defs/v1alpha1.InstallDiskSelector", + "title": "diskSelector", + "description": "Look up disk using disk attributes like model, size, serial and others.\nAlways has priority over disk.\n", + "markdownDescription": "Look up disk using disk attributes like model, size, serial and others.\nAlways has priority over `disk`.", + "x-intellij-html-description": "\u003cp\u003eLook up disk using disk attributes like model, size, serial and others.\nAlways has priority over \u003ccode\u003edisk\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraKernelArgs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraKernelArgs", + "description": "Allows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a -.\nFor example -console removes all console=\u0026lt;value\u0026gt; arguments, whereas -console=tty0 removes the console=tty0 default argument.\nIf Talos is using systemd-boot as a bootloader (default for UEFI) this setting will be ignored.\n", + "markdownDescription": "Allows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a `-`.\nFor example `-console` removes all `console=\u003cvalue\u003e` arguments, whereas `-console=tty0` removes the `console=tty0` default argument.\nIf Talos is using systemd-boot as a bootloader (default for UEFI) this setting will be ignored.", + "x-intellij-html-description": "\u003cp\u003eAllows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a \u003ccode\u003e-\u003c/code\u003e.\nFor example \u003ccode\u003e-console\u003c/code\u003e removes all \u003ccode\u003econsole=\u0026lt;value\u0026gt;\u003c/code\u003e arguments, whereas \u003ccode\u003e-console=tty0\u003c/code\u003e removes the \u003ccode\u003econsole=tty0\u003c/code\u003e default argument.\nIf Talos is using systemd-boot as a bootloader (default for UEFI) this setting will be ignored.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "Allows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\nGitHub releases page.\n", + "markdownDescription": "Allows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\n[GitHub releases page](https://github.com/siderolabs/talos/releases).", + "x-intellij-html-description": "\u003cp\u003eAllows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\n\u003ca href=\"https://github.com/siderolabs/talos/releases\" target=\"_blank\"\u003eGitHub releases page\u003c/a\u003e.\u003c/p\u003e\n" + }, + "wipe": { + "type": "boolean", + "title": "wipe", + "description": "Indicates if the installation disk should be wiped at installation time.\nDefaults to true.\n", + "markdownDescription": "Indicates if the installation disk should be wiped at installation time.\nDefaults to `true`.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the installation disk should be wiped at installation time.\nDefaults to \u003ccode\u003etrue\u003c/code\u003e.\u003c/p\u003e\n" + }, + "legacyBIOSSupport": { + "type": "boolean", + "title": "legacyBIOSSupport", + "description": "Indicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn’t support GPT partitioning scheme.\n", + "markdownDescription": "Indicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.", + "x-intellij-html-description": "\u003cp\u003eIndicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn\u0026rsquo;t support GPT partitioning scheme.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "InstallConfig represents the installation options for preparing a node." + }, + "v1alpha1.InstallDiskSelector": { + "properties": { + "size": { + "type": "string", + "title": "size", + "description": "Disk size.\n", + "markdownDescription": "Disk size.", + "x-intellij-html-description": "\u003cp\u003eDisk size.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Disk name /sys/block/\u0026lt;dev\u0026gt;/device/name.\n", + "markdownDescription": "Disk name `/sys/block/\u003cdev\u003e/device/name`.", + "x-intellij-html-description": "\u003cp\u003eDisk name \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/name\u003c/code\u003e.\u003c/p\u003e\n" + }, + "model": { + "type": "string", + "title": "model", + "description": "Disk model /sys/block/\u0026lt;dev\u0026gt;/device/model.\n", + "markdownDescription": "Disk model `/sys/block/\u003cdev\u003e/device/model`.", + "x-intellij-html-description": "\u003cp\u003eDisk model \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/model\u003c/code\u003e.\u003c/p\u003e\n" + }, + "serial": { + "type": "string", + "title": "serial", + "description": "Disk serial number /sys/block/\u0026lt;dev\u0026gt;/serial.\n", + "markdownDescription": "Disk serial number `/sys/block/\u003cdev\u003e/serial`.", + "x-intellij-html-description": "\u003cp\u003eDisk serial number \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/serial\u003c/code\u003e.\u003c/p\u003e\n" + }, + "modalias": { + "type": "string", + "title": "modalias", + "description": "Disk modalias /sys/block/\u0026lt;dev\u0026gt;/device/modalias.\n", + "markdownDescription": "Disk modalias `/sys/block/\u003cdev\u003e/device/modalias`.", + "x-intellij-html-description": "\u003cp\u003eDisk modalias \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/modalias\u003c/code\u003e.\u003c/p\u003e\n" + }, + "uuid": { + "type": "string", + "title": "uuid", + "description": "Disk UUID /sys/block/\u0026lt;dev\u0026gt;/uuid.\n", + "markdownDescription": "Disk UUID `/sys/block/\u003cdev\u003e/uuid`.", + "x-intellij-html-description": "\u003cp\u003eDisk UUID \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/uuid\u003c/code\u003e.\u003c/p\u003e\n" + }, + "wwid": { + "type": "string", + "title": "wwid", + "description": "Disk WWID /sys/block/\u0026lt;dev\u0026gt;/wwid.\n", + "markdownDescription": "Disk WWID `/sys/block/\u003cdev\u003e/wwid`.", + "x-intellij-html-description": "\u003cp\u003eDisk WWID \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/wwid\u003c/code\u003e.\u003c/p\u003e\n" + }, + "type": { + "enum": [ + "ssd", + "hdd", + "nvme", + "sd" + ], + "title": "type", + "description": "Disk Type.\n", + "markdownDescription": "Disk Type.", + "x-intellij-html-description": "\u003cp\u003eDisk Type.\u003c/p\u003e\n" + }, + "busPath": { + "type": "string", + "title": "busPath", + "description": "Disk bus path.\n", + "markdownDescription": "Disk bus path.", + "x-intellij-html-description": "\u003cp\u003eDisk bus path.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "InstallDiskSelector represents a disk query parameters for the install disk lookup." + }, + "v1alpha1.KernelConfig": { + "properties": { + "modules": { + "items": { + "$ref": "#/$defs/v1alpha1.KernelModuleConfig" + }, + "type": "array", + "title": "modules", + "description": "Kernel modules to load.\n", + "markdownDescription": "Kernel modules to load.", + "x-intellij-html-description": "\u003cp\u003eKernel modules to load.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KernelConfig struct configures Talos Linux kernel." + }, + "v1alpha1.KernelModuleConfig": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Module name.\n", + "markdownDescription": "Module name.", + "x-intellij-html-description": "\u003cp\u003eModule name.\u003c/p\u003e\n" + }, + "parameters": { + "items": { + "type": "string" + }, + "type": "array", + "title": "parameters", + "description": "Module parameters, changes applied after reboot.\n", + "markdownDescription": "Module parameters, changes applied after reboot.", + "x-intellij-html-description": "\u003cp\u003eModule parameters, changes applied after reboot.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KernelModuleConfig struct configures Linux kernel modules to load." + }, + "v1alpha1.KubePrism": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable KubePrism support - will start local load balancing proxy.\n", + "markdownDescription": "Enable KubePrism support - will start local load balancing proxy.", + "x-intellij-html-description": "\u003cp\u003eEnable KubePrism support - will start local load balancing proxy.\u003c/p\u003e\n" + }, + "port": { + "type": "integer", + "title": "port", + "description": "KubePrism port.\n", + "markdownDescription": "KubePrism port.", + "x-intellij-html-description": "\u003cp\u003eKubePrism port.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KubePrism describes the configuration for the KubePrism load balancer." + }, + "v1alpha1.KubeSpanFilters": { + "properties": { + "endpoints": { + "items": { + "type": "string" + }, + "type": "array", + "title": "endpoints", + "description": "Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\n\nBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\n\nDefault value: no filtering.\n", + "markdownDescription": "Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\n\nBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\n\nDefault value: no filtering.", + "x-intellij-html-description": "\u003cp\u003eFilter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\u003c/p\u003e\n\n\u003cp\u003eBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\u003c/p\u003e\n\n\u003cp\u003eDefault value: no filtering.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KubeSpanFilters struct describes KubeSpan advanced network addresses filtering." + }, + "v1alpha1.KubeletConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The image field is an optional reference to an alternative kubelet image.\n", + "markdownDescription": "The `image` field is an optional reference to an alternative kubelet image.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an optional reference to an alternative kubelet image.\u003c/p\u003e\n" + }, + "clusterDNS": { + "items": { + "type": "string" + }, + "type": "array", + "title": "clusterDNS", + "description": "The ClusterDNS field is an optional reference to an alternative kubelet clusterDNS ip list.\n", + "markdownDescription": "The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eClusterDNS\u003c/code\u003e field is an optional reference to an alternative kubelet clusterDNS ip list.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "The extraArgs field is used to provide additional flags to the kubelet.\n", + "markdownDescription": "The `extraArgs` field is used to provide additional flags to the kubelet.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraArgs\u003c/code\u003e field is used to provide additional flags to the kubelet.\u003c/p\u003e\n" + }, + "extraMounts": { + "items": { + "$ref": "#/$defs/v1alpha1.ExtraMount" + }, + "type": "array", + "title": "extraMounts", + "description": "The extraMounts field is used to add additional mounts to the kubelet container.\nNote that either bind or rbind are required in the options.\n", + "markdownDescription": "The `extraMounts` field is used to add additional mounts to the kubelet container.\nNote that either `bind` or `rbind` are required in the `options`.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraMounts\u003c/code\u003e field is used to add additional mounts to the kubelet container.\nNote that either \u003ccode\u003ebind\u003c/code\u003e or \u003ccode\u003erbind\u003c/code\u003e are required in the \u003ccode\u003eoptions\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraConfig": { + "type": "object", + "title": "extraConfig", + "description": "The extraConfig field is used to provide kubelet configuration overrides.\n\nSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.\n", + "markdownDescription": "The `extraConfig` field is used to provide kubelet configuration overrides.\n\nSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraConfig\u003c/code\u003e field is used to provide kubelet configuration overrides.\u003c/p\u003e\n\n\u003cp\u003eSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.\u003c/p\u003e\n" + }, + "credentialProviderConfig": { + "type": "object", + "title": "credentialProviderConfig", + "description": "The KubeletCredentialProviderConfig field is used to provide kubelet credential configuration.\n", + "markdownDescription": "The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eKubeletCredentialProviderConfig\u003c/code\u003e field is used to provide kubelet credential configuration.\u003c/p\u003e\n" + }, + "defaultRuntimeSeccompProfileEnabled": { + "type": "boolean", + "title": "defaultRuntimeSeccompProfileEnabled", + "description": "Enable container runtime default Seccomp profile.\n", + "markdownDescription": "Enable container runtime default Seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eEnable container runtime default Seccomp profile.\u003c/p\u003e\n" + }, + "registerWithFQDN": { + "type": "boolean", + "title": "registerWithFQDN", + "description": "The registerWithFQDN field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.\n", + "markdownDescription": "The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eregisterWithFQDN\u003c/code\u003e field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.\u003c/p\u003e\n" + }, + "nodeIP": { + "$ref": "#/$defs/v1alpha1.KubeletNodeIPConfig", + "title": "nodeIP", + "description": "The nodeIP field is used to configure --node-ip flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.\n", + "markdownDescription": "The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003enodeIP\u003c/code\u003e field is used to configure \u003ccode\u003e--node-ip\u003c/code\u003e flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.\u003c/p\u003e\n" + }, + "skipNodeRegistration": { + "type": "boolean", + "title": "skipNodeRegistration", + "description": "The skipNodeRegistration is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.\n", + "markdownDescription": "The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eskipNodeRegistration\u003c/code\u003e is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.\u003c/p\u003e\n" + }, + "disableManifestsDirectory": { + "type": "boolean", + "title": "disableManifestsDirectory", + "description": "The disableManifestsDirectory field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt’s recommended to configure static pods with the “pods” key instead.\n", + "markdownDescription": "The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt's recommended to configure static pods with the \"pods\" key instead.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003edisableManifestsDirectory\u003c/code\u003e field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt\u0026rsquo;s recommended to configure static pods with the \u0026ldquo;pods\u0026rdquo; key instead.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KubeletConfig represents the kubelet config values." + }, + "v1alpha1.KubeletNodeIPConfig": { + "properties": { + "validSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "validSubnets", + "description": "The validSubnets field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.\n", + "markdownDescription": "The `validSubnets` field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003evalidSubnets\u003c/code\u003e field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KubeletNodeIPConfig represents the kubelet node IP configuration." + }, + "v1alpha1.KubernetesTalosAPIAccessConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable Talos API access from Kubernetes pods.\n", + "markdownDescription": "Enable Talos API access from Kubernetes pods.", + "x-intellij-html-description": "\u003cp\u003eEnable Talos API access from Kubernetes pods.\u003c/p\u003e\n" + }, + "allowedRoles": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedRoles", + "description": "The list of Talos API roles which can be granted for access from Kubernetes pods.\n\nEmpty list means that no roles can be granted, so access is blocked.\n", + "markdownDescription": "The list of Talos API roles which can be granted for access from Kubernetes pods.\n\nEmpty list means that no roles can be granted, so access is blocked.", + "x-intellij-html-description": "\u003cp\u003eThe list of Talos API roles which can be granted for access from Kubernetes pods.\u003c/p\u003e\n\n\u003cp\u003eEmpty list means that no roles can be granted, so access is blocked.\u003c/p\u003e\n" + }, + "allowedKubernetesNamespaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedKubernetesNamespaces", + "description": "The list of Kubernetes namespaces Talos API access is available from.\n", + "markdownDescription": "The list of Kubernetes namespaces Talos API access is available from.", + "x-intellij-html-description": "\u003cp\u003eThe list of Kubernetes namespaces Talos API access is available from.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KubernetesTalosAPIAccessConfig describes the configuration for the Talos API access from Kubernetes pods." + }, + "v1alpha1.LinuxIDMapping": { + "properties": { + "containerID": { + "type": "integer", + "title": "containerID", + "description": "ContainerID is the starting UID/GID in the container.\n", + "markdownDescription": "ContainerID is the starting UID/GID in the container.", + "x-intellij-html-description": "\u003cp\u003eContainerID is the starting UID/GID in the container.\u003c/p\u003e\n" + }, + "hostID": { + "type": "integer", + "title": "hostID", + "description": "HostID is the starting UID/GID on the host to be mapped to ‘ContainerID’.\n", + "markdownDescription": "HostID is the starting UID/GID on the host to be mapped to 'ContainerID'.", + "x-intellij-html-description": "\u003cp\u003eHostID is the starting UID/GID on the host to be mapped to \u0026lsquo;ContainerID\u0026rsquo;.\u003c/p\u003e\n" + }, + "size": { + "type": "integer", + "title": "size", + "description": "Size is the number of IDs to be mapped.\n", + "markdownDescription": "Size is the number of IDs to be mapped.", + "x-intellij-html-description": "\u003cp\u003eSize is the number of IDs to be mapped.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "LinuxIDMapping represents the Linux ID mapping." + }, + "v1alpha1.LoggingConfig": { + "properties": { + "destinations": { + "items": { + "$ref": "#/$defs/v1alpha1.LoggingDestination" + }, + "type": "array", + "title": "destinations", + "description": "Logging destination.\n", + "markdownDescription": "Logging destination.", + "x-intellij-html-description": "\u003cp\u003eLogging destination.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "LoggingConfig struct configures Talos logging." + }, + "v1alpha1.LoggingDestination": { + "properties": { + "endpoint": { + "$ref": "#/$defs/v1alpha1.Endpoint", + "title": "endpoint", + "description": "Where to send logs. Supported protocols are “tcp” and “udp”.\n", + "markdownDescription": "Where to send logs. Supported protocols are \"tcp\" and \"udp\".", + "x-intellij-html-description": "\u003cp\u003eWhere to send logs. Supported protocols are \u0026ldquo;tcp\u0026rdquo; and \u0026ldquo;udp\u0026rdquo;.\u003c/p\u003e\n" + }, + "format": { + "enum": [ + "json_lines" + ], + "title": "format", + "description": "Logs format.\n", + "markdownDescription": "Logs format.", + "x-intellij-html-description": "\u003cp\u003eLogs format.\u003c/p\u003e\n" + }, + "extraTags": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraTags", + "description": "Extra tags (key-value) pairs to attach to every log message sent.\n", + "markdownDescription": "Extra tags (key-value) pairs to attach to every log message sent.", + "x-intellij-html-description": "\u003cp\u003eExtra tags (key-value) pairs to attach to every log message sent.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "LoggingDestination struct configures Talos logging destination." + }, + "v1alpha1.MachineConfig": { + "properties": { + "type": { + "enum": [ + "controlplane", + "worker" + ], + "title": "type", + "description": "Defines the role of the machine within the cluster.\n\nControl Plane\n\nControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\n\nWorker\n\nWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\n\nThis node type was previously known as “join”; that value is still supported but deprecated.\n", + "markdownDescription": "Defines the role of the machine within the cluster.\n\n**Control Plane**\n\nControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\n\n**Worker**\n\nWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\n\nThis node type was previously known as \"join\"; that value is still supported but deprecated.", + "x-intellij-html-description": "\u003cp\u003eDefines the role of the machine within the cluster.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eControl Plane\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWorker\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\u003c/p\u003e\n\n\u003cp\u003eThis node type was previously known as \u0026ldquo;join\u0026rdquo;; that value is still supported but deprecated.\u003c/p\u003e\n" + }, + "token": { + "type": "string", + "title": "token", + "description": "The token is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity.\n", + "markdownDescription": "The `token` is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003etoken\u003c/code\u003e is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its\u0026rsquo; identity.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The root certificate authority of the PKI.\nIt is composed of a base64 encoded crt and key.\n", + "markdownDescription": "The root certificate authority of the PKI.\nIt is composed of a base64 encoded `crt` and `key`.", + "x-intellij-html-description": "\u003cp\u003eThe root certificate authority of the PKI.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e and \u003ccode\u003ekey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "acceptedCAs": { + "properties": { + "crt": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "acceptedCAs", + "description": "The certificates issued by certificate authorities are accepted in addition to issuing ‘ca’.\nIt is composed of a base64 encoded crt`.\n", + "markdownDescription": "The certificates issued by certificate authorities are accepted in addition to issuing 'ca'.\nIt is composed of a base64 encoded `crt``.", + "x-intellij-html-description": "\u003cp\u003eThe certificates issued by certificate authorities are accepted in addition to issuing \u0026lsquo;ca\u0026rsquo;.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e`.\u003c/p\u003e\n" + }, + "certSANs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "certSANs", + "description": "Extra certificate subject alternative names for the machine’s certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate’s SANs.\n", + "markdownDescription": "Extra certificate subject alternative names for the machine's certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate's SANs.", + "x-intellij-html-description": "\u003cp\u003eExtra certificate subject alternative names for the machine\u0026rsquo;s certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate\u0026rsquo;s SANs.\u003c/p\u003e\n" + }, + "controlPlane": { + "$ref": "#/$defs/v1alpha1.MachineControlPlaneConfig", + "title": "controlPlane", + "description": "Provides machine specific control plane configuration options.\n", + "markdownDescription": "Provides machine specific control plane configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific control plane configuration options.\u003c/p\u003e\n" + }, + "kubelet": { + "$ref": "#/$defs/v1alpha1.KubeletConfig", + "title": "kubelet", + "description": "Used to provide additional options to the kubelet.\n", + "markdownDescription": "Used to provide additional options to the kubelet.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide additional options to the kubelet.\u003c/p\u003e\n" + }, + "pods": { + "items": { + "type": "object" + }, + "type": "array", + "title": "pods", + "description": "Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\nStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn’t validate the pod definition.\nUpdates to this field can be applied without a reboot.\n\nSee https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.\n", + "markdownDescription": "Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\nStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn't validate the pod definition.\nUpdates to this field can be applied without a reboot.\n\nSee https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\u003c/p\u003e\n\n\u003cp\u003eStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn\u0026rsquo;t validate the pod definition.\nUpdates to this field can be applied without a reboot.\u003c/p\u003e\n\n\u003cp\u003eSee \u003ca href=\"https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/\" target=\"_blank\"\u003ehttps://kubernetes.io/docs/tasks/configure-pod-container/static-pod/\u003c/a\u003e.\u003c/p\u003e\n" + }, + "network": { + "$ref": "#/$defs/v1alpha1.NetworkConfig", + "title": "network", + "description": "Provides machine specific network configuration options.\n", + "markdownDescription": "Provides machine specific network configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific network configuration options.\u003c/p\u003e\n" + }, + "install": { + "$ref": "#/$defs/v1alpha1.InstallConfig", + "title": "install", + "description": "Used to provide instructions for installations.\n\nNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.\n", + "markdownDescription": "Used to provide instructions for installations.\n\nNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide instructions for installations.\u003c/p\u003e\n\n\u003cp\u003eNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.\u003c/p\u003e\n" + }, + "files": { + "items": { + "$ref": "#/$defs/v1alpha1.MachineFile" + }, + "type": "array", + "title": "files", + "description": "Allows the addition of user specified files.\nThe value of op can be create, overwrite, or append.\nIn the case of create, path must not exist.\nIn the case of overwrite, and append, path must be a valid file.\nIf an op value of append is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.\n", + "markdownDescription": "Allows the addition of user specified files.\nThe value of `op` can be `create`, `overwrite`, or `append`.\nIn the case of `create`, `path` must not exist.\nIn the case of `overwrite`, and `append`, `path` must be a valid file.\nIf an `op` value of `append` is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.", + "x-intellij-html-description": "\u003cp\u003eAllows the addition of user specified files.\nThe value of \u003ccode\u003eop\u003c/code\u003e can be \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003eoverwrite\u003c/code\u003e, or \u003ccode\u003eappend\u003c/code\u003e.\nIn the case of \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e must not exist.\nIn the case of \u003ccode\u003eoverwrite\u003c/code\u003e, and \u003ccode\u003eappend\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e must be a valid file.\nIf an \u003ccode\u003eop\u003c/code\u003e value of \u003ccode\u003eappend\u003c/code\u003e is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.\u003c/p\u003e\n" + }, + "time": { + "$ref": "#/$defs/v1alpha1.TimeConfig", + "title": "time", + "description": "Used to configure the machine’s time settings.\n", + "markdownDescription": "Used to configure the machine's time settings.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s time settings.\u003c/p\u003e\n" + }, + "sysctls": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "sysctls", + "description": "Used to configure the machine’s sysctls.\n", + "markdownDescription": "Used to configure the machine's sysctls.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s sysctls.\u003c/p\u003e\n" + }, + "sysfs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "sysfs", + "description": "Used to configure the machine’s sysfs.\n", + "markdownDescription": "Used to configure the machine's sysfs.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s sysfs.\u003c/p\u003e\n" + }, + "registries": { + "$ref": "#/$defs/v1alpha1.RegistriesConfig", + "title": "registries", + "description": "Used to configure the machine’s container image registry mirrors.\n\nAutomatically generates matching CRI configuration for registry mirrors.\n\nThe mirrors section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\n\nThe config section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in .docker/config.json.\n\nSee also matching configuration for CRI containerd plugin.\n", + "markdownDescription": "Used to configure the machine's container image registry mirrors.\n\nAutomatically generates matching CRI configuration for registry mirrors.\n\nThe `mirrors` section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\n\nThe `config` section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).\n\nSee also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md).", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s container image registry mirrors.\u003c/p\u003e\n\n\u003cp\u003eAutomatically generates matching CRI configuration for registry mirrors.\u003c/p\u003e\n\n\u003cp\u003eThe \u003ccode\u003emirrors\u003c/code\u003e section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\u003c/p\u003e\n\n\u003cp\u003eThe \u003ccode\u003econfig\u003c/code\u003e section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eSee also matching configuration for \u003ca href=\"https://github.com/containerd/cri/blob/master/docs/registry.md\" target=\"_blank\"\u003eCRI containerd plugin\u003c/a\u003e.\u003c/p\u003e\n" + }, + "features": { + "$ref": "#/$defs/v1alpha1.FeaturesConfig", + "title": "features", + "description": "Features describe individual Talos features that can be switched on or off.\n", + "markdownDescription": "Features describe individual Talos features that can be switched on or off.", + "x-intellij-html-description": "\u003cp\u003eFeatures describe individual Talos features that can be switched on or off.\u003c/p\u003e\n" + }, + "udev": { + "$ref": "#/$defs/v1alpha1.UdevConfig", + "title": "udev", + "description": "Configures the udev system.\n", + "markdownDescription": "Configures the udev system.", + "x-intellij-html-description": "\u003cp\u003eConfigures the udev system.\u003c/p\u003e\n" + }, + "logging": { + "$ref": "#/$defs/v1alpha1.LoggingConfig", + "title": "logging", + "description": "Configures the logging system.\n", + "markdownDescription": "Configures the logging system.", + "x-intellij-html-description": "\u003cp\u003eConfigures the logging system.\u003c/p\u003e\n" + }, + "kernel": { + "$ref": "#/$defs/v1alpha1.KernelConfig", + "title": "kernel", + "description": "Configures the kernel.\n", + "markdownDescription": "Configures the kernel.", + "x-intellij-html-description": "\u003cp\u003eConfigures the kernel.\u003c/p\u003e\n" + }, + "seccompProfiles": { + "items": { + "$ref": "#/$defs/v1alpha1.MachineSeccompProfile" + }, + "type": "array", + "title": "seccompProfiles", + "description": "Configures the seccomp profiles for the machine.\n", + "markdownDescription": "Configures the seccomp profiles for the machine.", + "x-intellij-html-description": "\u003cp\u003eConfigures the seccomp profiles for the machine.\u003c/p\u003e\n" + }, + "baseRuntimeSpecOverrides": { + "type": "object", + "title": "baseRuntimeSpecOverrides", + "description": "Override (patch) settings in the default OCI runtime spec for CRI containers.\n\nIt can be used to set some default container settings which are not configurable in Kubernetes,\nfor example default ulimits.\nNote: this change applies to all newly created containers, and it requires a reboot to take effect.\n", + "markdownDescription": "Override (patch) settings in the default OCI runtime spec for CRI containers.\n\nIt can be used to set some default container settings which are not configurable in Kubernetes,\nfor example default ulimits.\nNote: this change applies to all newly created containers, and it requires a reboot to take effect.", + "x-intellij-html-description": "\u003cp\u003eOverride (patch) settings in the default OCI runtime spec for CRI containers.\u003c/p\u003e\n\n\u003cp\u003eIt can be used to set some default container settings which are not configurable in Kubernetes,\nfor example default ulimits.\nNote: this change applies to all newly created containers, and it requires a reboot to take effect.\u003c/p\u003e\n" + }, + "nodeLabels": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "nodeLabels", + "description": "Configures the node labels for the machine.\n\nNote: In the default Kubernetes configuration, worker nodes are restricted to set\nlabels with some prefixes (see NodeRestriction admission plugin).\n", + "markdownDescription": "Configures the node labels for the machine.\n\nNote: In the default Kubernetes configuration, worker nodes are restricted to set\nlabels with some prefixes (see [NodeRestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) admission plugin).", + "x-intellij-html-description": "\u003cp\u003eConfigures the node labels for the machine.\u003c/p\u003e\n\n\u003cp\u003eNote: In the default Kubernetes configuration, worker nodes are restricted to set\nlabels with some prefixes (see \u003ca href=\"https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction\" target=\"_blank\"\u003eNodeRestriction\u003c/a\u003e admission plugin).\u003c/p\u003e\n" + }, + "nodeAnnotations": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "nodeAnnotations", + "description": "Configures the node annotations for the machine.\n", + "markdownDescription": "Configures the node annotations for the machine.", + "x-intellij-html-description": "\u003cp\u003eConfigures the node annotations for the machine.\u003c/p\u003e\n" + }, + "nodeTaints": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "nodeTaints", + "description": "Configures the node taints for the machine. Effect is optional.\n\nNote: In the default Kubernetes configuration, worker nodes are not allowed to\nmodify the taints (see NodeRestriction admission plugin).\n", + "markdownDescription": "Configures the node taints for the machine. Effect is optional.\n\nNote: In the default Kubernetes configuration, worker nodes are not allowed to\nmodify the taints (see [NodeRestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) admission plugin).", + "x-intellij-html-description": "\u003cp\u003eConfigures the node taints for the machine. Effect is optional.\u003c/p\u003e\n\n\u003cp\u003eNote: In the default Kubernetes configuration, worker nodes are not allowed to\nmodify the taints (see \u003ca href=\"https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction\" target=\"_blank\"\u003eNodeRestriction\u003c/a\u003e admission plugin).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "MachineConfig represents the machine-specific config values." + }, + "v1alpha1.MachineControlPlaneConfig": { + "properties": { + "controllerManager": { + "$ref": "#/$defs/v1alpha1.MachineControllerManagerConfig", + "title": "controllerManager", + "description": "Controller manager machine specific configuration options.\n", + "markdownDescription": "Controller manager machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eController manager machine specific configuration options.\u003c/p\u003e\n" + }, + "scheduler": { + "$ref": "#/$defs/v1alpha1.MachineSchedulerConfig", + "title": "scheduler", + "description": "Scheduler machine specific configuration options.\n", + "markdownDescription": "Scheduler machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eScheduler machine specific configuration options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "MachineControlPlaneConfig machine specific configuration options." + }, + "v1alpha1.MachineControllerManagerConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-controller-manager on the node.\n", + "markdownDescription": "Disable kube-controller-manager on the node.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-controller-manager on the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "MachineControllerManagerConfig represents the machine specific ControllerManager config values." + }, + "v1alpha1.MachineFile": { + "properties": { + "content": { + "type": "string", + "title": "content", + "description": "The contents of the file.\n", + "markdownDescription": "The contents of the file.", + "x-intellij-html-description": "\u003cp\u003eThe contents of the file.\u003c/p\u003e\n" + }, + "permissions": { + "type": "integer", + "title": "permissions", + "description": "The file’s permissions in octal.\n", + "markdownDescription": "The file's permissions in octal.", + "x-intellij-html-description": "\u003cp\u003eThe file\u0026rsquo;s permissions in octal.\u003c/p\u003e\n" + }, + "path": { + "type": "string", + "title": "path", + "description": "The path of the file.\n", + "markdownDescription": "The path of the file.", + "x-intellij-html-description": "\u003cp\u003eThe path of the file.\u003c/p\u003e\n" + }, + "op": { + "enum": [ + "create", + "append", + "overwrite" + ], + "title": "op", + "description": "The operation to use\n", + "markdownDescription": "The operation to use", + "x-intellij-html-description": "\u003cp\u003eThe operation to use\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "MachineFile represents a file to write to disk." + }, + "v1alpha1.MachineSchedulerConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-scheduler on the node.\n", + "markdownDescription": "Disable kube-scheduler on the node.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-scheduler on the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "MachineSchedulerConfig represents the machine specific Scheduler config values." + }, + "v1alpha1.MachineSeccompProfile": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "The name field is used to provide the file name of the seccomp profile.\n", + "markdownDescription": "The `name` field is used to provide the file name of the seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003ename\u003c/code\u003e field is used to provide the file name of the seccomp profile.\u003c/p\u003e\n" + }, + "value": { + "type": "object", + "title": "value", + "description": "The value field is used to provide the seccomp profile.\n", + "markdownDescription": "The `value` field is used to provide the seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003evalue\u003c/code\u003e field is used to provide the seccomp profile.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "MachineSeccompProfile defines seccomp profiles for the machine." + }, + "v1alpha1.NetworkConfig": { + "properties": { + "hostname": { + "type": "string", + "title": "hostname", + "description": "Used to statically set the hostname for the machine.\n", + "markdownDescription": "Used to statically set the hostname for the machine.", + "x-intellij-html-description": "\u003cp\u003eUsed to statically set the hostname for the machine.\u003c/p\u003e\n" + }, + "interfaces": { + "items": { + "$ref": "#/$defs/v1alpha1.Device" + }, + "type": "array", + "title": "interfaces", + "description": "interfaces is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.\n", + "markdownDescription": "`interfaces` is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.", + "x-intellij-html-description": "\u003cp\u003e\u003ccode\u003einterfaces\u003c/code\u003e is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.\u003c/p\u003e\n" + }, + "nameservers": { + "items": { + "type": "string" + }, + "type": "array", + "title": "nameservers", + "description": "Used to statically set the nameservers for the machine.\nDefaults to 1.1.1.1 and 8.8.8.8\n", + "markdownDescription": "Used to statically set the nameservers for the machine.\nDefaults to `1.1.1.1` and `8.8.8.8`", + "x-intellij-html-description": "\u003cp\u003eUsed to statically set the nameservers for the machine.\nDefaults to \u003ccode\u003e1.1.1.1\u003c/code\u003e and \u003ccode\u003e8.8.8.8\u003c/code\u003e\u003c/p\u003e\n" + }, + "searchDomains": { + "items": { + "type": "string" + }, + "type": "array", + "title": "searchDomains", + "description": "Used to statically set arbitrary search domains.\n", + "markdownDescription": "Used to statically set arbitrary search domains.", + "x-intellij-html-description": "\u003cp\u003eUsed to statically set arbitrary search domains.\u003c/p\u003e\n" + }, + "extraHostEntries": { + "items": { + "$ref": "#/$defs/v1alpha1.ExtraHost" + }, + "type": "array", + "title": "extraHostEntries", + "description": "Allows for extra entries to be added to the /etc/hosts file\n", + "markdownDescription": "Allows for extra entries to be added to the `/etc/hosts` file", + "x-intellij-html-description": "\u003cp\u003eAllows for extra entries to be added to the \u003ccode\u003e/etc/hosts\u003c/code\u003e file\u003c/p\u003e\n" + }, + "kubespan": { + "$ref": "#/$defs/v1alpha1.NetworkKubeSpan", + "title": "kubespan", + "description": "Configures KubeSpan feature.\n", + "markdownDescription": "Configures KubeSpan feature.", + "x-intellij-html-description": "\u003cp\u003eConfigures KubeSpan feature.\u003c/p\u003e\n" + }, + "disableSearchDomain": { + "type": "boolean", + "title": "disableSearchDomain", + "description": "Disable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to false.\n", + "markdownDescription": "Disable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to `false`.", + "x-intellij-html-description": "\u003cp\u003eDisable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "NetworkConfig represents the machine's networking config values." + }, + "v1alpha1.NetworkDeviceSelector": { + "properties": { + "busPath": { + "type": "string", + "title": "busPath", + "description": "PCI, USB bus prefix, supports matching by wildcard.\n", + "markdownDescription": "PCI, USB bus prefix, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003ePCI, USB bus prefix, supports matching by wildcard.\u003c/p\u003e\n" + }, + "hardwareAddr": { + "type": "string", + "title": "hardwareAddr", + "description": "Device hardware (MAC) address, supports matching by wildcard.\n", + "markdownDescription": "Device hardware (MAC) address, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003eDevice hardware (MAC) address, supports matching by wildcard.\u003c/p\u003e\n" + }, + "permanentAddr": { + "type": "string", + "title": "permanentAddr", + "description": "Device permanent hardware address, supports matching by wildcard.\nThe permanent address doesn’t change when the link is enslaved to a bond,\nso it’s recommended to use this field for bond members.\n", + "markdownDescription": "Device permanent hardware address, supports matching by wildcard.\nThe permanent address doesn't change when the link is enslaved to a bond,\nso it's recommended to use this field for bond members.", + "x-intellij-html-description": "\u003cp\u003eDevice permanent hardware address, supports matching by wildcard.\nThe permanent address doesn\u0026rsquo;t change when the link is enslaved to a bond,\nso it\u0026rsquo;s recommended to use this field for bond members.\u003c/p\u003e\n" + }, + "pciID": { + "type": "string", + "title": "pciID", + "description": "PCI ID (vendor ID, product ID), supports matching by wildcard.\n", + "markdownDescription": "PCI ID (vendor ID, product ID), supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003ePCI ID (vendor ID, product ID), supports matching by wildcard.\u003c/p\u003e\n" + }, + "driver": { + "type": "string", + "title": "driver", + "description": "Kernel driver, supports matching by wildcard.\n", + "markdownDescription": "Kernel driver, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003eKernel driver, supports matching by wildcard.\u003c/p\u003e\n" + }, + "physical": { + "type": "boolean", + "title": "physical", + "description": "Select only physical devices.\n", + "markdownDescription": "Select only physical devices.", + "x-intellij-html-description": "\u003cp\u003eSelect only physical devices.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "NetworkDeviceSelector struct describes network device selector." + }, + "v1alpha1.NetworkKubeSpan": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.\n", + "markdownDescription": "Enable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.", + "x-intellij-html-description": "\u003cp\u003eEnable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.\u003c/p\u003e\n" + }, + "advertiseKubernetesNetworks": { + "type": "boolean", + "title": "advertiseKubernetesNetworks", + "description": "Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.\n", + "markdownDescription": "Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.", + "x-intellij-html-description": "\u003cp\u003eControl whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.\u003c/p\u003e\n" + }, + "allowDownPeerBypass": { + "type": "boolean", + "title": "allowDownPeerBypass", + "description": "Skip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can’t be established.\n", + "markdownDescription": "Skip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can't be established.", + "x-intellij-html-description": "\u003cp\u003eSkip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can\u0026rsquo;t be established.\u003c/p\u003e\n" + }, + "harvestExtraEndpoints": { + "type": "boolean", + "title": "harvestExtraEndpoints", + "description": "KubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is disabled by default, don’t enable it\nwith high number of peers (\u0026gt;50) in the KubeSpan network (performance issues).\n", + "markdownDescription": "KubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is disabled by default, don't enable it\nwith high number of peers (\u003e50) in the KubeSpan network (performance issues).", + "x-intellij-html-description": "\u003cp\u003eKubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is disabled by default, don\u0026rsquo;t enable it\nwith high number of peers (\u0026gt;50) in the KubeSpan network (performance issues).\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "KubeSpan link MTU size.\nDefault value is 1420.\n", + "markdownDescription": "KubeSpan link MTU size.\nDefault value is 1420.", + "x-intellij-html-description": "\u003cp\u003eKubeSpan link MTU size.\nDefault value is 1420.\u003c/p\u003e\n" + }, + "filters": { + "$ref": "#/$defs/v1alpha1.KubeSpanFilters", + "title": "filters", + "description": "KubeSpan advanced filtering of network addresses .\n\nSettings in this section are optional, and settings apply only to the node.\n", + "markdownDescription": "KubeSpan advanced filtering of network addresses .\n\nSettings in this section are optional, and settings apply only to the node.", + "x-intellij-html-description": "\u003cp\u003eKubeSpan advanced filtering of network addresses .\u003c/p\u003e\n\n\u003cp\u003eSettings in this section are optional, and settings apply only to the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "NetworkKubeSpan struct describes KubeSpan configuration." + }, + "v1alpha1.ProxyConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-proxy deployment on cluster bootstrap.\n", + "markdownDescription": "Disable kube-proxy deployment on cluster bootstrap.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-proxy deployment on cluster bootstrap.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the kube-proxy manifest.\n", + "markdownDescription": "The container image used in the kube-proxy manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the kube-proxy manifest.\u003c/p\u003e\n" + }, + "mode": { + "type": "string", + "title": "mode", + "description": "proxy mode of kube-proxy.\nThe default is ‘iptables’.\n", + "markdownDescription": "proxy mode of kube-proxy.\nThe default is 'iptables'.", + "x-intellij-html-description": "\u003cp\u003eproxy mode of kube-proxy.\nThe default is \u0026lsquo;iptables\u0026rsquo;.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to kube-proxy.\n", + "markdownDescription": "Extra arguments to supply to kube-proxy.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to kube-proxy.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ProxyConfig represents the kube proxy configuration options." + }, + "v1alpha1.RegistriesConfig": { + "properties": { + "mirrors": { + "patternProperties": { + ".*": { + "$ref": "#/$defs/v1alpha1.RegistryMirrorConfig" + } + }, + "type": "object", + "title": "mirrors", + "description": "Specifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\n\nFor example, when pulling an image with the reference example.com:123/image:v1,\nthe example.com:123 key will be used to lookup the mirror configuration.\n\nOptionally the * key can be used to configure a fallback mirror.\n\nRegistry name is the first segment of image identifier, with ‘docker.io’\nbeing default one.\n", + "markdownDescription": "Specifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\n\nFor example, when pulling an image with the reference `example.com:123/image:v1`,\nthe `example.com:123` key will be used to lookup the mirror configuration.\n\nOptionally the `*` key can be used to configure a fallback mirror.\n\nRegistry name is the first segment of image identifier, with 'docker.io'\nbeing default one.", + "x-intellij-html-description": "\u003cp\u003eSpecifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\u003c/p\u003e\n\n\u003cp\u003eFor example, when pulling an image with the reference \u003ccode\u003eexample.com:123/image:v1\u003c/code\u003e,\nthe \u003ccode\u003eexample.com:123\u003c/code\u003e key will be used to lookup the mirror configuration.\u003c/p\u003e\n\n\u003cp\u003eOptionally the \u003ccode\u003e*\u003c/code\u003e key can be used to configure a fallback mirror.\u003c/p\u003e\n\n\u003cp\u003eRegistry name is the first segment of image identifier, with \u0026lsquo;docker.io\u0026rsquo;\nbeing default one.\u003c/p\u003e\n" + }, + "config": { + "patternProperties": { + ".*": { + "$ref": "#/$defs/v1alpha1.RegistryConfig" + } + }, + "type": "object", + "title": "config", + "description": "Specifies TLS \u0026amp; auth configuration for HTTPS image registries.\nMutual TLS can be enabled with ‘clientIdentity’ option.\n\nThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key * can’t be used for TLS configuration.\n\nTLS configuration can be skipped if registry has trusted\nserver certificate.\n", + "markdownDescription": "Specifies TLS \u0026 auth configuration for HTTPS image registries.\nMutual TLS can be enabled with 'clientIdentity' option.\n\nThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key `*` can't be used for TLS configuration.\n\nTLS configuration can be skipped if registry has trusted\nserver certificate.", + "x-intellij-html-description": "\u003cp\u003eSpecifies TLS \u0026amp; auth configuration for HTTPS image registries.\nMutual TLS can be enabled with \u0026lsquo;clientIdentity\u0026rsquo; option.\u003c/p\u003e\n\n\u003cp\u003eThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key \u003ccode\u003e*\u003c/code\u003e can\u0026rsquo;t be used for TLS configuration.\u003c/p\u003e\n\n\u003cp\u003eTLS configuration can be skipped if registry has trusted\nserver certificate.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "RegistriesConfig represents the image pull options." + }, + "v1alpha1.RegistryAuthConfig": { + "properties": { + "username": { + "type": "string", + "title": "username", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "password": { + "type": "string", + "title": "password", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "auth": { + "type": "string", + "title": "auth", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "identityToken": { + "type": "string", + "title": "identityToken", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "RegistryAuthConfig specifies authentication configuration for a registry." + }, + "v1alpha1.RegistryConfig": { + "properties": { + "tls": { + "$ref": "#/$defs/v1alpha1.RegistryTLSConfig", + "title": "tls", + "description": "The TLS configuration for the registry.\n", + "markdownDescription": "The TLS configuration for the registry.", + "x-intellij-html-description": "\u003cp\u003eThe TLS configuration for the registry.\u003c/p\u003e\n" + }, + "auth": { + "$ref": "#/$defs/v1alpha1.RegistryAuthConfig", + "title": "auth", + "description": "The auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.\n", + "markdownDescription": "The auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.", + "x-intellij-html-description": "\u003cp\u003eThe auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "RegistryConfig specifies auth \u0026 TLS config per registry." + }, + "v1alpha1.RegistryKubernetesConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable Kubernetes discovery registry.\n", + "markdownDescription": "Disable Kubernetes discovery registry.", + "x-intellij-html-description": "\u003cp\u003eDisable Kubernetes discovery registry.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "RegistryKubernetesConfig struct configures Kubernetes discovery registry." + }, + "v1alpha1.RegistryMirrorConfig": { + "properties": { + "endpoints": { + "items": { + "type": "string" + }, + "type": "array", + "title": "endpoints", + "description": "List of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to /v2).\n", + "markdownDescription": "List of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to `/v2`).", + "x-intellij-html-description": "\u003cp\u003eList of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to \u003ccode\u003e/v2\u003c/code\u003e).\u003c/p\u003e\n" + }, + "overridePath": { + "type": "boolean", + "title": "overridePath", + "description": "Use the exact path specified for the endpoint (don’t append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.\n", + "markdownDescription": "Use the exact path specified for the endpoint (don't append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.", + "x-intellij-html-description": "\u003cp\u003eUse the exact path specified for the endpoint (don\u0026rsquo;t append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.\u003c/p\u003e\n" + }, + "skipFallback": { + "type": "boolean", + "title": "skipFallback", + "description": "Skip fallback to the upstream endpoint, for example the mirror configuration\nfor docker.io will not fallback to registry-1.docker.io.\n", + "markdownDescription": "Skip fallback to the upstream endpoint, for example the mirror configuration\nfor `docker.io` will not fallback to `registry-1.docker.io`.", + "x-intellij-html-description": "\u003cp\u003eSkip fallback to the upstream endpoint, for example the mirror configuration\nfor \u003ccode\u003edocker.io\u003c/code\u003e will not fallback to \u003ccode\u003eregistry-1.docker.io\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "RegistryMirrorConfig represents mirror configuration for a registry." + }, + "v1alpha1.RegistryServiceConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable external service discovery registry.\n", + "markdownDescription": "Disable external service discovery registry.", + "x-intellij-html-description": "\u003cp\u003eDisable external service discovery registry.\u003c/p\u003e\n" + }, + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "External service endpoint.\n", + "markdownDescription": "External service endpoint.", + "x-intellij-html-description": "\u003cp\u003eExternal service endpoint.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "RegistryServiceConfig struct configures Kubernetes discovery registry." + }, + "v1alpha1.RegistryTLSConfig": { + "properties": { + "clientIdentity": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "clientIdentity", + "description": "Enable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.\n", + "markdownDescription": "Enable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.", + "x-intellij-html-description": "\u003cp\u003eEnable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.\u003c/p\u003e\n" + }, + "ca": { + "type": "string", + "title": "ca", + "description": "CA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.\n", + "markdownDescription": "CA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.", + "x-intellij-html-description": "\u003cp\u003eCA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.\u003c/p\u003e\n" + }, + "insecureSkipVerify": { + "type": "boolean", + "title": "insecureSkipVerify", + "description": "Skip TLS server certificate verification (not recommended).\n", + "markdownDescription": "Skip TLS server certificate verification (not recommended).", + "x-intellij-html-description": "\u003cp\u003eSkip TLS server certificate verification (not recommended).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "RegistryTLSConfig specifies TLS config for HTTPS registries." + }, + "v1alpha1.ResourcesConfig": { + "properties": { + "requests": { + "type": "object", + "title": "requests", + "description": "Requests configures the reserved cpu/memory resources.\n", + "markdownDescription": "Requests configures the reserved cpu/memory resources.", + "x-intellij-html-description": "\u003cp\u003eRequests configures the reserved cpu/memory resources.\u003c/p\u003e\n" + }, + "limits": { + "type": "object", + "title": "limits", + "description": "Limits configures the maximum cpu/memory resources a container can use.\n", + "markdownDescription": "Limits configures the maximum cpu/memory resources a container can use.", + "x-intellij-html-description": "\u003cp\u003eLimits configures the maximum cpu/memory resources a container can use.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ResourcesConfig represents the pod resources." + }, + "v1alpha1.Route": { + "properties": { + "network": { + "type": "string", + "title": "network", + "description": "The route’s network (destination).\n", + "markdownDescription": "The route's network (destination).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s network (destination).\u003c/p\u003e\n" + }, + "gateway": { + "type": "string", + "title": "gateway", + "description": "The route’s gateway (if empty, creates link scope route).\n", + "markdownDescription": "The route's gateway (if empty, creates link scope route).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s gateway (if empty, creates link scope route).\u003c/p\u003e\n" + }, + "source": { + "type": "string", + "title": "source", + "description": "The route’s source address (optional).\n", + "markdownDescription": "The route's source address (optional).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s source address (optional).\u003c/p\u003e\n" + }, + "metric": { + "type": "integer", + "title": "metric", + "description": "The optional metric for the route.\n", + "markdownDescription": "The optional metric for the route.", + "x-intellij-html-description": "\u003cp\u003eThe optional metric for the route.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The optional MTU for the route.\n", + "markdownDescription": "The optional MTU for the route.", + "x-intellij-html-description": "\u003cp\u003eThe optional MTU for the route.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "Route represents a network route." + }, + "v1alpha1.STP": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Whether Spanning Tree Protocol (STP) is enabled.\n", + "markdownDescription": "Whether Spanning Tree Protocol (STP) is enabled.", + "x-intellij-html-description": "\u003cp\u003eWhether Spanning Tree Protocol (STP) is enabled.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "STP contains the various options for configuring the STP properties of a bridge interface." + }, + "v1alpha1.SchedulerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the scheduler manifest.\n", + "markdownDescription": "The container image used in the scheduler manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the scheduler manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the scheduler.\n", + "markdownDescription": "Extra arguments to supply to the scheduler.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the scheduler.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/v1alpha1.VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the scheduler static pod.\n", + "markdownDescription": "Extra volumes to mount to the scheduler static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the scheduler static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the scheduler resources.\n", + "markdownDescription": "Configure the scheduler resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the scheduler resources.\u003c/p\u003e\n" + }, + "config": { + "type": "object", + "title": "config", + "description": "Specify custom kube-scheduler configuration.\n", + "markdownDescription": "Specify custom kube-scheduler configuration.", + "x-intellij-html-description": "\u003cp\u003eSpecify custom kube-scheduler configuration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "SchedulerConfig represents the kube scheduler configuration options." + }, + "v1alpha1.TimeConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Indicates if the time service is disabled for the machine.\nDefaults to false.\n", + "markdownDescription": "Indicates if the time service is disabled for the machine.\nDefaults to `false`.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the time service is disabled for the machine.\nDefaults to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n" + }, + "servers": { + "items": { + "type": "string" + }, + "type": "array", + "title": "servers", + "description": "description: |\n Specifies time (NTP) servers to use for setting the system time.\n Defaults to time.cloudflare.com.\n\nTalos can also sync to the PTP time source (e.g provided by the hypervisor),\n provide the path to the PTP device as “/dev/ptp0” or “/dev/ptp_kvm”.\n", + "markdownDescription": "description: |\n Specifies time (NTP) servers to use for setting the system time.\n Defaults to `time.cloudflare.com`.\n\n Talos can also sync to the PTP time source (e.g provided by the hypervisor),\n provide the path to the PTP device as \"/dev/ptp0\" or \"/dev/ptp_kvm\".", + "x-intellij-html-description": "\u003cp\u003edescription: |\n Specifies time (NTP) servers to use for setting the system time.\n Defaults to \u003ccode\u003etime.cloudflare.com\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003eTalos can also sync to the PTP time source (e.g provided by the hypervisor),\n provide the path to the PTP device as \u0026ldquo;/dev/ptp0\u0026rdquo; or \u0026ldquo;/dev/ptp_kvm\u0026rdquo;.\u003c/p\u003e\n" + }, + "bootTimeout": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "bootTimeout", + "description": "Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to “infinity” (waiting forever for time sync)\n", + "markdownDescription": "Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to \"infinity\" (waiting forever for time sync)", + "x-intellij-html-description": "\u003cp\u003eSpecifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to \u0026ldquo;infinity\u0026rdquo; (waiting forever for time sync)\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "TimeConfig represents the options for configuring time on a machine." + }, + "v1alpha1.UdevConfig": { + "properties": { + "rules": { + "items": { + "type": "string" + }, + "type": "array", + "title": "rules", + "description": "List of udev rules to apply to the udev system\n", + "markdownDescription": "List of udev rules to apply to the udev system", + "x-intellij-html-description": "\u003cp\u003eList of udev rules to apply to the udev system\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "UdevConfig describes how the udev system should be configured." + }, + "v1alpha1.VIPEquinixMetalConfig": { + "properties": { + "apiToken": { + "type": "string", + "title": "apiToken", + "description": "Specifies the Equinix Metal API Token.\n", + "markdownDescription": "Specifies the Equinix Metal API Token.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Equinix Metal API Token.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "VIPEquinixMetalConfig contains settings for Equinix Metal VIP management." + }, + "v1alpha1.VIPHCloudConfig": { + "properties": { + "apiToken": { + "type": "string", + "title": "apiToken", + "description": "Specifies the Hetzner Cloud API Token.\n", + "markdownDescription": "Specifies the Hetzner Cloud API Token.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Hetzner Cloud API Token.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "VIPHCloudConfig contains settings for Hetzner Cloud VIP management." + }, + "v1alpha1.Vlan": { + "properties": { + "addresses": { + "items": { + "type": "string" + }, + "type": "array", + "title": "addresses", + "description": "The addresses in CIDR notation or as plain IPs to use.\n", + "markdownDescription": "The addresses in CIDR notation or as plain IPs to use.", + "x-intellij-html-description": "\u003cp\u003eThe addresses in CIDR notation or as plain IPs to use.\u003c/p\u003e\n" + }, + "routes": { + "items": { + "$ref": "#/$defs/v1alpha1.Route" + }, + "type": "array", + "title": "routes", + "description": "A list of routes associated with the VLAN.\n", + "markdownDescription": "A list of routes associated with the VLAN.", + "x-intellij-html-description": "\u003cp\u003eA list of routes associated with the VLAN.\u003c/p\u003e\n" + }, + "dhcp": { + "type": "boolean", + "title": "dhcp", + "description": "Indicates if DHCP should be used.\n", + "markdownDescription": "Indicates if DHCP should be used.", + "x-intellij-html-description": "\u003cp\u003eIndicates if DHCP should be used.\u003c/p\u003e\n" + }, + "vlanId": { + "type": "integer", + "title": "vlanId", + "description": "The VLAN’s ID.\n", + "markdownDescription": "The VLAN's ID.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s ID.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The VLAN’s MTU.\n", + "markdownDescription": "The VLAN's MTU.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s MTU.\u003c/p\u003e\n" + }, + "vip": { + "$ref": "#/$defs/v1alpha1.DeviceVIPConfig", + "title": "vip", + "description": "The VLAN’s virtual IP address configuration.\n", + "markdownDescription": "The VLAN's virtual IP address configuration.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s virtual IP address configuration.\u003c/p\u003e\n" + }, + "dhcpOptions": { + "$ref": "#/$defs/v1alpha1.DHCPOptions", + "title": "dhcpOptions", + "description": "DHCP specific options.\ndhcp must be set to true for these to take effect.\n", + "markdownDescription": "DHCP specific options.\n`dhcp` *must* be set to true for these to take effect.", + "x-intellij-html-description": "\u003cp\u003eDHCP specific options.\n\u003ccode\u003edhcp\u003c/code\u003e \u003cem\u003emust\u003c/em\u003e be set to true for these to take effect.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "Vlan represents vlan settings for a device." + }, + "v1alpha1.VolumeMountConfig": { + "properties": { + "hostPath": { + "type": "string", + "title": "hostPath", + "description": "Path on the host.\n", + "markdownDescription": "Path on the host.", + "x-intellij-html-description": "\u003cp\u003ePath on the host.\u003c/p\u003e\n" + }, + "mountPath": { + "type": "string", + "title": "mountPath", + "description": "Path in the container.\n", + "markdownDescription": "Path in the container.", + "x-intellij-html-description": "\u003cp\u003ePath in the container.\u003c/p\u003e\n" + }, + "readonly": { + "type": "boolean", + "title": "readonly", + "description": "Mount the volume read only.\n", + "markdownDescription": "Mount the volume read only.", + "x-intellij-html-description": "\u003cp\u003eMount the volume read only.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object", + "description": "VolumeMountConfig struct describes extra volume mount for the static pods." + } + }, + "oneOf": [ + { + "$ref": "#/$defs/block.ExistingVolumeConfigV1Alpha1" + }, + { + "$ref": "#/$defs/block.RawVolumeConfigV1Alpha1" + }, + { + "$ref": "#/$defs/block.SwapVolumeConfigV1Alpha1" + }, + { + "$ref": "#/$defs/block.UserVolumeConfigV1Alpha1" + }, + { + "$ref": "#/$defs/block.VolumeConfigV1Alpha1" + }, + { + "$ref": "#/$defs/block.ZswapConfigV1Alpha1" + }, + { + "$ref": "#/$defs/extensions.ServiceConfigV1Alpha1" + }, + { + "$ref": "#/$defs/hardware.PCIDriverRebindConfigV1Alpha1" + }, + { + "$ref": "#/$defs/network.DefaultActionConfigV1Alpha1" + }, + { + "$ref": "#/$defs/network.EthernetConfigV1Alpha1" + }, + { + "$ref": "#/$defs/network.KubespanEndpointsConfigV1Alpha1" + }, + { + "$ref": "#/$defs/network.RuleConfigV1Alpha1" + }, + { + "$ref": "#/$defs/runtime.EventSinkV1Alpha1" + }, + { + "$ref": "#/$defs/runtime.KmsgLogV1Alpha1" + }, + { + "$ref": "#/$defs/runtime.WatchdogTimerV1Alpha1" + }, + { + "$ref": "#/$defs/security.TrustedRootsConfigV1Alpha1" + }, + { + "$ref": "#/$defs/siderolink.ConfigV1Alpha1" + }, + { + "$ref": "#/$defs/v1alpha1.Config" + } + ] +} \ No newline at end of file diff --git a/website/content/v1.12/schemas/v1alpha1_config.schema.json b/website/content/v1.12/schemas/v1alpha1_config.schema.json new file mode 100644 index 000000000..38c7320ff --- /dev/null +++ b/website/content/v1.12/schemas/v1alpha1_config.schema.json @@ -0,0 +1,2931 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://talos.dev/v1.6/schemas/v1alpha1_config.schema.json", + "$ref": "#/$defs/Config", + "$defs": { + "APIServerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the API server manifest.\n", + "markdownDescription": "The container image used in the API server manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the API server manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the API server.\n", + "markdownDescription": "Extra arguments to supply to the API server.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the API server.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the API server static pod.\n", + "markdownDescription": "Extra volumes to mount to the API server static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the API server static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "certSANs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "certSANs", + "description": "Extra certificate subject alternative names for the API server’s certificate.\n", + "markdownDescription": "Extra certificate subject alternative names for the API server's certificate.", + "x-intellij-html-description": "\u003cp\u003eExtra certificate subject alternative names for the API server\u0026rsquo;s certificate.\u003c/p\u003e\n" + }, + "disablePodSecurityPolicy": { + "type": "boolean", + "title": "disablePodSecurityPolicy", + "description": "Disable PodSecurityPolicy in the API server and default manifests.\n", + "markdownDescription": "Disable PodSecurityPolicy in the API server and default manifests.", + "x-intellij-html-description": "\u003cp\u003eDisable PodSecurityPolicy in the API server and default manifests.\u003c/p\u003e\n" + }, + "admissionControl": { + "items": { + "$ref": "#/$defs/AdmissionPluginConfig" + }, + "type": "array", + "title": "admissionControl", + "description": "Configure the API server admission plugins.\n", + "markdownDescription": "Configure the API server admission plugins.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server admission plugins.\u003c/p\u003e\n" + }, + "auditPolicy": { + "type": "object", + "title": "auditPolicy", + "description": "Configure the API server audit policy.\n", + "markdownDescription": "Configure the API server audit policy.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server audit policy.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the API server resources.\n", + "markdownDescription": "Configure the API server resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server resources.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "AdminKubeconfigConfig": { + "properties": { + "certLifetime": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "certLifetime", + "description": "Admin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).\n", + "markdownDescription": "Admin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).", + "x-intellij-html-description": "\u003cp\u003eAdmin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format (\u0026lsquo;1h\u0026rsquo; for one hour, \u0026lsquo;10m\u0026rsquo; for ten minutes).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "AdmissionPluginConfig": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Name is the name of the admission controller.\nIt must match the registered admission plugin name.\n", + "markdownDescription": "Name is the name of the admission controller.\nIt must match the registered admission plugin name.", + "x-intellij-html-description": "\u003cp\u003eName is the name of the admission controller.\nIt must match the registered admission plugin name.\u003c/p\u003e\n" + }, + "configuration": { + "type": "object", + "title": "configuration", + "description": "Configuration is an embedded configuration object to be used as the plugin’s\nconfiguration.\n", + "markdownDescription": "Configuration is an embedded configuration object to be used as the plugin's\nconfiguration.", + "x-intellij-html-description": "\u003cp\u003eConfiguration is an embedded configuration object to be used as the plugin\u0026rsquo;s\nconfiguration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Bond": { + "properties": { + "interfaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "interfaces", + "description": "The interfaces that make up the bond.\n", + "markdownDescription": "The interfaces that make up the bond.", + "x-intellij-html-description": "\u003cp\u003eThe interfaces that make up the bond.\u003c/p\u003e\n" + }, + "deviceSelectors": { + "items": { + "$ref": "#/$defs/NetworkDeviceSelector" + }, + "type": "array", + "title": "deviceSelectors", + "description": "Picks a network device using the selector.\nMutually exclusive with interfaces.\nSupports partial match using wildcard syntax.\n", + "markdownDescription": "Picks a network device using the selector.\nMutually exclusive with `interfaces`.\nSupports partial match using wildcard syntax.", + "x-intellij-html-description": "\u003cp\u003ePicks a network device using the selector.\nMutually exclusive with \u003ccode\u003einterfaces\u003c/code\u003e.\nSupports partial match using wildcard syntax.\u003c/p\u003e\n" + }, + "arpIPTarget": { + "items": { + "type": "string" + }, + "type": "array", + "title": "arpIPTarget", + "description": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\u003c/p\u003e\n" + }, + "mode": { + "type": "string", + "title": "mode", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "xmitHashPolicy": { + "type": "string", + "title": "xmitHashPolicy", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "lacpRate": { + "type": "string", + "title": "lacpRate", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adActorSystem": { + "type": "string", + "title": "adActorSystem", + "description": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\u003c/p\u003e\n" + }, + "arpValidate": { + "type": "string", + "title": "arpValidate", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "arpAllTargets": { + "type": "string", + "title": "arpAllTargets", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "primary": { + "type": "string", + "title": "primary", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "primaryReselect": { + "type": "string", + "title": "primaryReselect", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "failOverMac": { + "type": "string", + "title": "failOverMac", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adSelect": { + "type": "string", + "title": "adSelect", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "miimon": { + "type": "integer", + "title": "miimon", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "updelay": { + "type": "integer", + "title": "updelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "downdelay": { + "type": "integer", + "title": "downdelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "arpInterval": { + "type": "integer", + "title": "arpInterval", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "resendIgmp": { + "type": "integer", + "title": "resendIgmp", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "minLinks": { + "type": "integer", + "title": "minLinks", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "lpInterval": { + "type": "integer", + "title": "lpInterval", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "packetsPerSlave": { + "type": "integer", + "title": "packetsPerSlave", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "numPeerNotif": { + "type": "integer", + "title": "numPeerNotif", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "tlbDynamicLb": { + "type": "integer", + "title": "tlbDynamicLb", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "allSlavesActive": { + "type": "integer", + "title": "allSlavesActive", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "useCarrier": { + "type": "boolean", + "title": "useCarrier", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adActorSysPrio": { + "type": "integer", + "title": "adActorSysPrio", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adUserPortKey": { + "type": "integer", + "title": "adUserPortKey", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "peerNotifyDelay": { + "type": "integer", + "title": "peerNotifyDelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Bridge": { + "properties": { + "interfaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "interfaces", + "description": "The interfaces that make up the bridge.\n", + "markdownDescription": "The interfaces that make up the bridge.", + "x-intellij-html-description": "\u003cp\u003eThe interfaces that make up the bridge.\u003c/p\u003e\n" + }, + "stp": { + "$ref": "#/$defs/STP", + "title": "stp", + "description": "A bridge option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bridge option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bridge option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "CNIConfig": { + "properties": { + "name": { + "enum": [ + "flannel", + "custom", + "none" + ], + "title": "name", + "description": "Name of CNI to use.\n", + "markdownDescription": "Name of CNI to use.", + "x-intellij-html-description": "\u003cp\u003eName of CNI to use.\u003c/p\u003e\n" + }, + "urls": { + "items": { + "type": "string" + }, + "type": "array", + "title": "urls", + "description": "URLs containing manifests to apply for the CNI.\nShould be present for “custom”, must be empty for “flannel” and “none”.\n", + "markdownDescription": "URLs containing manifests to apply for the CNI.\nShould be present for \"custom\", must be empty for \"flannel\" and \"none\".", + "x-intellij-html-description": "\u003cp\u003eURLs containing manifests to apply for the CNI.\nShould be present for \u0026ldquo;custom\u0026rdquo;, must be empty for \u0026ldquo;flannel\u0026rdquo; and \u0026ldquo;none\u0026rdquo;.\u003c/p\u003e\n" + }, + "flannel": { + "$ref": "#/$defs/FlannelCNIConfig", + "title": "flannel", + "description": "description: |\nFlannel configuration options.\n", + "markdownDescription": "description: |\nFlannel configuration options.", + "x-intellij-html-description": "\u003cp\u003edescription: |\nFlannel configuration options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterConfig": { + "properties": { + "id": { + "type": "string", + "title": "id", + "description": "Globally unique identifier for this cluster (base64 encoded random 32 bytes).\n", + "markdownDescription": "Globally unique identifier for this cluster (base64 encoded random 32 bytes).", + "x-intellij-html-description": "\u003cp\u003eGlobally unique identifier for this cluster (base64 encoded random 32 bytes).\u003c/p\u003e\n" + }, + "secret": { + "type": "string", + "title": "secret", + "description": "Shared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.\n", + "markdownDescription": "Shared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.", + "x-intellij-html-description": "\u003cp\u003eShared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.\u003c/p\u003e\n" + }, + "controlPlane": { + "$ref": "#/$defs/ControlPlaneConfig", + "title": "controlPlane", + "description": "Provides control plane specific configuration options.\n", + "markdownDescription": "Provides control plane specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides control plane specific configuration options.\u003c/p\u003e\n" + }, + "clusterName": { + "type": "string", + "title": "clusterName", + "description": "Configures the cluster’s name.\n", + "markdownDescription": "Configures the cluster's name.", + "x-intellij-html-description": "\u003cp\u003eConfigures the cluster\u0026rsquo;s name.\u003c/p\u003e\n" + }, + "network": { + "$ref": "#/$defs/ClusterNetworkConfig", + "title": "network", + "description": "Provides cluster specific network configuration options.\n", + "markdownDescription": "Provides cluster specific network configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides cluster specific network configuration options.\u003c/p\u003e\n" + }, + "token": { + "type": "string", + "title": "token", + "description": "The bootstrap token used to join the cluster.\n", + "markdownDescription": "The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ca href=\"https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/\" target=\"_blank\"\u003ebootstrap token\u003c/a\u003e used to join the cluster.\u003c/p\u003e\n" + }, + "aescbcEncryptionSecret": { + "type": "string", + "title": "aescbcEncryptionSecret", + "description": "A key used for the encryption of secret data at rest.\nEnables encryption with AESCBC.\n", + "markdownDescription": "A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\nEnables encryption with AESCBC.", + "x-intellij-html-description": "\u003cp\u003eA key used for the \u003ca href=\"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\" target=\"_blank\"\u003eencryption of secret data at rest\u003c/a\u003e.\nEnables encryption with AESCBC.\u003c/p\u003e\n" + }, + "secretboxEncryptionSecret": { + "type": "string", + "title": "secretboxEncryptionSecret", + "description": "A key used for the encryption of secret data at rest.\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.\n", + "markdownDescription": "A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.", + "x-intellij-html-description": "\u003cp\u003eA key used for the \u003ca href=\"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\" target=\"_blank\"\u003eencryption of secret data at rest\u003c/a\u003e.\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The base64 encoded root certificate authority used by Kubernetes.\n", + "markdownDescription": "The base64 encoded root certificate authority used by Kubernetes.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded root certificate authority used by Kubernetes.\u003c/p\u003e\n" + }, + "aggregatorCA": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "aggregatorCA", + "description": "The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n\nThis CA can be self-signed.\n", + "markdownDescription": "The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n\nThis CA can be self-signed.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\u003c/p\u003e\n\n\u003cp\u003eThis CA can be self-signed.\u003c/p\u003e\n" + }, + "serviceAccount": { + "properties": { + "key": { + "additionalProperties": false, + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "serviceAccount", + "description": "The base64 encoded private key for service account token generation.\n", + "markdownDescription": "The base64 encoded private key for service account token generation.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded private key for service account token generation.\u003c/p\u003e\n" + }, + "apiServer": { + "$ref": "#/$defs/APIServerConfig", + "title": "apiServer", + "description": "API server specific configuration options.\n", + "markdownDescription": "API server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eAPI server specific configuration options.\u003c/p\u003e\n" + }, + "controllerManager": { + "$ref": "#/$defs/ControllerManagerConfig", + "title": "controllerManager", + "description": "Controller manager server specific configuration options.\n", + "markdownDescription": "Controller manager server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eController manager server specific configuration options.\u003c/p\u003e\n" + }, + "proxy": { + "$ref": "#/$defs/ProxyConfig", + "title": "proxy", + "description": "Kube-proxy server-specific configuration options\n", + "markdownDescription": "Kube-proxy server-specific configuration options", + "x-intellij-html-description": "\u003cp\u003eKube-proxy server-specific configuration options\u003c/p\u003e\n" + }, + "scheduler": { + "$ref": "#/$defs/SchedulerConfig", + "title": "scheduler", + "description": "Scheduler server specific configuration options.\n", + "markdownDescription": "Scheduler server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eScheduler server specific configuration options.\u003c/p\u003e\n" + }, + "discovery": { + "$ref": "#/$defs/ClusterDiscoveryConfig", + "title": "discovery", + "description": "Configures cluster member discovery.\n", + "markdownDescription": "Configures cluster member discovery.", + "x-intellij-html-description": "\u003cp\u003eConfigures cluster member discovery.\u003c/p\u003e\n" + }, + "etcd": { + "$ref": "#/$defs/EtcdConfig", + "title": "etcd", + "description": "Etcd specific configuration options.\n", + "markdownDescription": "Etcd specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eEtcd specific configuration options.\u003c/p\u003e\n" + }, + "coreDNS": { + "$ref": "#/$defs/CoreDNS", + "title": "coreDNS", + "description": "Core DNS specific configuration options.\n", + "markdownDescription": "Core DNS specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eCore DNS specific configuration options.\u003c/p\u003e\n" + }, + "externalCloudProvider": { + "$ref": "#/$defs/ExternalCloudProviderConfig", + "title": "externalCloudProvider", + "description": "External cloud provider configuration.\n", + "markdownDescription": "External cloud provider configuration.", + "x-intellij-html-description": "\u003cp\u003eExternal cloud provider configuration.\u003c/p\u003e\n" + }, + "extraManifests": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraManifests", + "description": "A list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + }, + "extraManifestHeaders": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraManifestHeaders", + "description": "A map of key value pairs that will be added while fetching the extraManifests.\n", + "markdownDescription": "A map of key value pairs that will be added while fetching the extraManifests.", + "x-intellij-html-description": "\u003cp\u003eA map of key value pairs that will be added while fetching the extraManifests.\u003c/p\u003e\n" + }, + "inlineManifests": { + "items": { + "$ref": "#/$defs/ClusterInlineManifest" + }, + "type": "array", + "title": "inlineManifests", + "description": "A list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + }, + "adminKubeconfig": { + "$ref": "#/$defs/AdminKubeconfigConfig", + "title": "adminKubeconfig", + "description": "Settings for admin kubeconfig generation.\nCertificate lifetime can be configured.\n", + "markdownDescription": "Settings for admin kubeconfig generation.\nCertificate lifetime can be configured.", + "x-intellij-html-description": "\u003cp\u003eSettings for admin kubeconfig generation.\nCertificate lifetime can be configured.\u003c/p\u003e\n" + }, + "allowSchedulingOnControlPlanes": { + "type": "boolean", + "title": "allowSchedulingOnControlPlanes", + "description": "Allows running workload on control-plane nodes.\n", + "markdownDescription": "Allows running workload on control-plane nodes.", + "x-intellij-html-description": "\u003cp\u003eAllows running workload on control-plane nodes.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterDiscoveryConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.\n", + "markdownDescription": "Enable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.", + "x-intellij-html-description": "\u003cp\u003eEnable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.\u003c/p\u003e\n" + }, + "registries": { + "$ref": "#/$defs/DiscoveryRegistriesConfig", + "title": "registries", + "description": "Configure registries used for cluster member discovery.\n", + "markdownDescription": "Configure registries used for cluster member discovery.", + "x-intellij-html-description": "\u003cp\u003eConfigure registries used for cluster member discovery.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterInlineManifest": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Name of the manifest.\nName should be unique.\n", + "markdownDescription": "Name of the manifest.\nName should be unique.", + "x-intellij-html-description": "\u003cp\u003eName of the manifest.\nName should be unique.\u003c/p\u003e\n" + }, + "contents": { + "type": "string", + "title": "contents", + "description": "Manifest contents as a string.\n", + "markdownDescription": "Manifest contents as a string.", + "x-intellij-html-description": "\u003cp\u003eManifest contents as a string.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterNetworkConfig": { + "properties": { + "cni": { + "$ref": "#/$defs/CNIConfig", + "title": "cni", + "description": "The CNI used.\nComposed of “name” and “urls”.\nThe “name” key supports the following options: “flannel”, “custom”, and “none”.\n“flannel” uses Talos-managed Flannel CNI, and that’s the default option.\n“custom” uses custom manifests that should be provided in “urls”.\n“none” indicates that Talos will not manage any CNI installation.\n", + "markdownDescription": "The CNI used.\nComposed of \"name\" and \"urls\".\nThe \"name\" key supports the following options: \"flannel\", \"custom\", and \"none\".\n\"flannel\" uses Talos-managed Flannel CNI, and that's the default option.\n\"custom\" uses custom manifests that should be provided in \"urls\".\n\"none\" indicates that Talos will not manage any CNI installation.", + "x-intellij-html-description": "\u003cp\u003eThe CNI used.\nComposed of \u0026ldquo;name\u0026rdquo; and \u0026ldquo;urls\u0026rdquo;.\nThe \u0026ldquo;name\u0026rdquo; key supports the following options: \u0026ldquo;flannel\u0026rdquo;, \u0026ldquo;custom\u0026rdquo;, and \u0026ldquo;none\u0026rdquo;.\n\u0026ldquo;flannel\u0026rdquo; uses Talos-managed Flannel CNI, and that\u0026rsquo;s the default option.\n\u0026ldquo;custom\u0026rdquo; uses custom manifests that should be provided in \u0026ldquo;urls\u0026rdquo;.\n\u0026ldquo;none\u0026rdquo; indicates that Talos will not manage any CNI installation.\u003c/p\u003e\n" + }, + "dnsDomain": { + "type": "string", + "title": "dnsDomain", + "description": "The domain used by Kubernetes DNS.\nThe default is cluster.local\n", + "markdownDescription": "The domain used by Kubernetes DNS.\nThe default is `cluster.local`", + "x-intellij-html-description": "\u003cp\u003eThe domain used by Kubernetes DNS.\nThe default is \u003ccode\u003ecluster.local\u003c/code\u003e\u003c/p\u003e\n" + }, + "podSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "podSubnets", + "description": "The pod subnet CIDR.\n", + "markdownDescription": "The pod subnet CIDR.", + "x-intellij-html-description": "\u003cp\u003eThe pod subnet CIDR.\u003c/p\u003e\n" + }, + "serviceSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "serviceSubnets", + "description": "The service subnet CIDR.\n", + "markdownDescription": "The service subnet CIDR.", + "x-intellij-html-description": "\u003cp\u003eThe service subnet CIDR.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Config": { + "properties": { + "version": { + "enum": [ + "v1alpha1" + ], + "title": "version", + "description": "Indicates the schema used to decode the contents.\n", + "markdownDescription": "Indicates the schema used to decode the contents.", + "x-intellij-html-description": "\u003cp\u003eIndicates the schema used to decode the contents.\u003c/p\u003e\n" + }, + "debug": { + "type": "boolean", + "title": "debug", + "description": "Enable verbose logging to the console.\nAll system containers logs will flow into serial console.\n\nNote: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.\n", + "markdownDescription": "Enable verbose logging to the console.\nAll system containers logs will flow into serial console.\n\n**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.", + "x-intellij-html-description": "\u003cp\u003eEnable verbose logging to the console.\nAll system containers logs will flow into serial console.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.\u003c/p\u003e\n" + }, + "machine": { + "$ref": "#/$defs/MachineConfig", + "title": "machine", + "description": "Provides machine specific configuration options.\n", + "markdownDescription": "Provides machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific configuration options.\u003c/p\u003e\n" + }, + "cluster": { + "$ref": "#/$defs/ClusterConfig", + "title": "cluster", + "description": "Provides cluster specific configuration options.\n", + "markdownDescription": "Provides cluster specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides cluster specific configuration options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneConfig": { + "properties": { + "endpoint": { + "type": "string", + "pattern": "^https://", + "format": "uri", + "title": "endpoint", + "description": "Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.\n", + "markdownDescription": "Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.", + "x-intellij-html-description": "\u003cp\u003eEndpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.\u003c/p\u003e\n" + }, + "localAPIServerPort": { + "type": "integer", + "title": "localAPIServerPort", + "description": "The port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is 6443.\n", + "markdownDescription": "The port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is `6443`.", + "x-intellij-html-description": "\u003cp\u003eThe port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is \u003ccode\u003e6443\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControllerManagerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the controller manager manifest.\n", + "markdownDescription": "The container image used in the controller manager manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the controller manager manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the controller manager.\n", + "markdownDescription": "Extra arguments to supply to the controller manager.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the controller manager.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the controller manager static pod.\n", + "markdownDescription": "Extra volumes to mount to the controller manager static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the controller manager static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the controller manager resources.\n", + "markdownDescription": "Configure the controller manager resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the controller manager resources.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "CoreDNS": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable coredns deployment on cluster bootstrap.\n", + "markdownDescription": "Disable coredns deployment on cluster bootstrap.", + "x-intellij-html-description": "\u003cp\u003eDisable coredns deployment on cluster bootstrap.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "The image field is an override to the default coredns image.\n", + "markdownDescription": "The `image` field is an override to the default coredns image.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an override to the default coredns image.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DHCPOptions": { + "properties": { + "routeMetric": { + "type": "integer", + "title": "routeMetric", + "description": "The priority of all routes received via DHCP.\n", + "markdownDescription": "The priority of all routes received via DHCP.", + "x-intellij-html-description": "\u003cp\u003eThe priority of all routes received via DHCP.\u003c/p\u003e\n" + }, + "ipv4": { + "type": "boolean", + "title": "ipv4", + "description": "Enables DHCPv4 protocol for the interface (default is enabled).\n", + "markdownDescription": "Enables DHCPv4 protocol for the interface (default is enabled).", + "x-intellij-html-description": "\u003cp\u003eEnables DHCPv4 protocol for the interface (default is enabled).\u003c/p\u003e\n" + }, + "ipv6": { + "type": "boolean", + "title": "ipv6", + "description": "Enables DHCPv6 protocol for the interface (default is disabled).\n", + "markdownDescription": "Enables DHCPv6 protocol for the interface (default is disabled).", + "x-intellij-html-description": "\u003cp\u003eEnables DHCPv6 protocol for the interface (default is disabled).\u003c/p\u003e\n" + }, + "duidv6": { + "type": "string", + "title": "duidv6", + "description": "Set client DUID (hex string).\n", + "markdownDescription": "Set client DUID (hex string).", + "x-intellij-html-description": "\u003cp\u003eSet client DUID (hex string).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Device": { + "properties": { + "interface": { + "type": "string", + "title": "interface", + "description": "The interface name.\nMutually exclusive with deviceSelector.\n", + "markdownDescription": "The interface name.\nMutually exclusive with `deviceSelector`.", + "x-intellij-html-description": "\u003cp\u003eThe interface name.\nMutually exclusive with \u003ccode\u003edeviceSelector\u003c/code\u003e.\u003c/p\u003e\n" + }, + "deviceSelector": { + "$ref": "#/$defs/NetworkDeviceSelector", + "title": "deviceSelector", + "description": "Picks a network device using the selector.\nMutually exclusive with interface.\nSupports partial match using wildcard syntax.\n", + "markdownDescription": "Picks a network device using the selector.\nMutually exclusive with `interface`.\nSupports partial match using wildcard syntax.", + "x-intellij-html-description": "\u003cp\u003ePicks a network device using the selector.\nMutually exclusive with \u003ccode\u003einterface\u003c/code\u003e.\nSupports partial match using wildcard syntax.\u003c/p\u003e\n" + }, + "addresses": { + "items": { + "type": "string" + }, + "type": "array", + "title": "addresses", + "description": "Assigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).\n", + "markdownDescription": "Assigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).", + "x-intellij-html-description": "\u003cp\u003eAssigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).\u003c/p\u003e\n" + }, + "routes": { + "items": { + "$ref": "#/$defs/Route" + }, + "type": "array", + "title": "routes", + "description": "A list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.\n", + "markdownDescription": "A list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.", + "x-intellij-html-description": "\u003cp\u003eA list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.\u003c/p\u003e\n" + }, + "bond": { + "$ref": "#/$defs/Bond", + "title": "bond", + "description": "Bond specific options.\n", + "markdownDescription": "Bond specific options.", + "x-intellij-html-description": "\u003cp\u003eBond specific options.\u003c/p\u003e\n" + }, + "bridge": { + "$ref": "#/$defs/Bridge", + "title": "bridge", + "description": "Bridge specific options.\n", + "markdownDescription": "Bridge specific options.", + "x-intellij-html-description": "\u003cp\u003eBridge specific options.\u003c/p\u003e\n" + }, + "vlans": { + "items": { + "$ref": "#/$defs/Vlan" + }, + "type": "array", + "title": "vlans", + "description": "VLAN specific options.\n", + "markdownDescription": "VLAN specific options.", + "x-intellij-html-description": "\u003cp\u003eVLAN specific options.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The interface’s MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.\n", + "markdownDescription": "The interface's MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.", + "x-intellij-html-description": "\u003cp\u003eThe interface\u0026rsquo;s MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.\u003c/p\u003e\n" + }, + "dhcp": { + "type": "boolean", + "title": "dhcp", + "description": "Indicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\n\n\nOptionClasslessStaticRoute\nOptionDomainNameServer\nOptionDNSDomainSearchList\nOptionHostName\n\n", + "markdownDescription": "Indicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\n\n- `OptionClasslessStaticRoute`\n- `OptionDomainNameServer`\n- `OptionDNSDomainSearchList`\n- `OptionHostName`", + "x-intellij-html-description": "\u003cp\u003eIndicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eOptionClasslessStaticRoute\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionDomainNameServer\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionDNSDomainSearchList\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionHostName\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n" + }, + "ignore": { + "type": "boolean", + "title": "ignore", + "description": "Indicates if the interface should be ignored (skips configuration).\n", + "markdownDescription": "Indicates if the interface should be ignored (skips configuration).", + "x-intellij-html-description": "\u003cp\u003eIndicates if the interface should be ignored (skips configuration).\u003c/p\u003e\n" + }, + "dummy": { + "type": "boolean", + "title": "dummy", + "description": "Indicates if the interface is a dummy interface.\ndummy is used to specify that this interface should be a virtual-only, dummy interface.\n", + "markdownDescription": "Indicates if the interface is a dummy interface.\n`dummy` is used to specify that this interface should be a virtual-only, dummy interface.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the interface is a dummy interface.\n\u003ccode\u003edummy\u003c/code\u003e is used to specify that this interface should be a virtual-only, dummy interface.\u003c/p\u003e\n" + }, + "dhcpOptions": { + "$ref": "#/$defs/DHCPOptions", + "title": "dhcpOptions", + "description": "DHCP specific options.\ndhcp must be set to true for these to take effect.\n", + "markdownDescription": "DHCP specific options.\n`dhcp` *must* be set to true for these to take effect.", + "x-intellij-html-description": "\u003cp\u003eDHCP specific options.\n\u003ccode\u003edhcp\u003c/code\u003e \u003cem\u003emust\u003c/em\u003e be set to true for these to take effect.\u003c/p\u003e\n" + }, + "wireguard": { + "$ref": "#/$defs/DeviceWireguardConfig", + "title": "wireguard", + "description": "Wireguard specific configuration.\nIncludes things like private key, listen port, peers.\n", + "markdownDescription": "Wireguard specific configuration.\nIncludes things like private key, listen port, peers.", + "x-intellij-html-description": "\u003cp\u003eWireguard specific configuration.\nIncludes things like private key, listen port, peers.\u003c/p\u003e\n" + }, + "vip": { + "$ref": "#/$defs/DeviceVIPConfig", + "title": "vip", + "description": "Virtual (shared) IP address configuration.\n", + "markdownDescription": "Virtual (shared) IP address configuration.", + "x-intellij-html-description": "\u003cp\u003eVirtual (shared) IP address configuration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DeviceVIPConfig": { + "properties": { + "ip": { + "type": "string", + "title": "ip", + "description": "Specifies the IP address to be used.\n", + "markdownDescription": "Specifies the IP address to be used.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the IP address to be used.\u003c/p\u003e\n" + }, + "equinixMetal": { + "$ref": "#/$defs/VIPEquinixMetalConfig", + "title": "equinixMetal", + "description": "Specifies the Equinix Metal API settings to assign VIP to the node.\n", + "markdownDescription": "Specifies the Equinix Metal API settings to assign VIP to the node.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Equinix Metal API settings to assign VIP to the node.\u003c/p\u003e\n" + }, + "hcloud": { + "$ref": "#/$defs/VIPHCloudConfig", + "title": "hcloud", + "description": "Specifies the Hetzner Cloud API settings to assign VIP to the node.\n", + "markdownDescription": "Specifies the Hetzner Cloud API settings to assign VIP to the node.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Hetzner Cloud API settings to assign VIP to the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DeviceWireguardConfig": { + "properties": { + "privateKey": { + "type": "string", + "title": "privateKey", + "description": "Specifies a private key configuration (base64 encoded).\nCan be generated by wg genkey.\n", + "markdownDescription": "Specifies a private key configuration (base64 encoded).\nCan be generated by `wg genkey`.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a private key configuration (base64 encoded).\nCan be generated by \u003ccode\u003ewg genkey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "listenPort": { + "type": "integer", + "title": "listenPort", + "description": "Specifies a device’s listening port.\n", + "markdownDescription": "Specifies a device's listening port.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a device\u0026rsquo;s listening port.\u003c/p\u003e\n" + }, + "firewallMark": { + "type": "integer", + "title": "firewallMark", + "description": "Specifies a device’s firewall mark.\n", + "markdownDescription": "Specifies a device's firewall mark.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a device\u0026rsquo;s firewall mark.\u003c/p\u003e\n" + }, + "peers": { + "items": { + "$ref": "#/$defs/DeviceWireguardPeer" + }, + "type": "array", + "title": "peers", + "description": "Specifies a list of peer configurations to apply to a device.\n", + "markdownDescription": "Specifies a list of peer configurations to apply to a device.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a list of peer configurations to apply to a device.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DeviceWireguardPeer": { + "properties": { + "publicKey": { + "type": "string", + "title": "publicKey", + "description": "Specifies the public key of this peer.\nCan be extracted from private key by running wg pubkey \u0026lt; private.key \u0026gt; public.key \u0026amp;\u0026amp; cat public.key.\n", + "markdownDescription": "Specifies the public key of this peer.\nCan be extracted from private key by running `wg pubkey \u003c private.key \u003e public.key \u0026\u0026 cat public.key`.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the public key of this peer.\nCan be extracted from private key by running \u003ccode\u003ewg pubkey \u0026lt; private.key \u0026gt; public.key \u0026amp;\u0026amp; cat public.key\u003c/code\u003e.\u003c/p\u003e\n" + }, + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "Specifies the endpoint of this peer entry.\n", + "markdownDescription": "Specifies the endpoint of this peer entry.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the endpoint of this peer entry.\u003c/p\u003e\n" + }, + "persistentKeepaliveInterval": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "persistentKeepaliveInterval", + "description": "Specifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).\n", + "markdownDescription": "Specifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).", + "x-intellij-html-description": "\u003cp\u003eSpecifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format (\u0026lsquo;1h\u0026rsquo; for one hour, \u0026lsquo;10m\u0026rsquo; for ten minutes).\u003c/p\u003e\n" + }, + "allowedIPs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedIPs", + "description": "AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\n", + "markdownDescription": "AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.", + "x-intellij-html-description": "\u003cp\u003eAllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DiscoveryRegistriesConfig": { + "properties": { + "kubernetes": { + "$ref": "#/$defs/RegistryKubernetesConfig", + "title": "kubernetes", + "description": "Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\n", + "markdownDescription": "Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.", + "x-intellij-html-description": "\u003cp\u003eKubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\u003c/p\u003e\n" + }, + "service": { + "$ref": "#/$defs/RegistryServiceConfig", + "title": "service", + "description": "Service registry is using an external service to push and pull information about cluster members.\n", + "markdownDescription": "Service registry is using an external service to push and pull information about cluster members.", + "x-intellij-html-description": "\u003cp\u003eService registry is using an external service to push and pull information about cluster members.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DiskPartition": { + "properties": { + "size": { + "type": "integer", + "title": "size", + "description": "The size of partition: either bytes or human readable representation. If size: is omitted, the partition is sized to occupy the full disk.\n", + "markdownDescription": "The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.", + "x-intellij-html-description": "\u003cp\u003eThe size of partition: either bytes or human readable representation. If \u003ccode\u003esize:\u003c/code\u003e is omitted, the partition is sized to occupy the full disk.\u003c/p\u003e\n" + }, + "mountpoint": { + "type": "string", + "title": "mountpoint", + "description": "Where to mount the partition.\n", + "markdownDescription": "Where to mount the partition.", + "x-intellij-html-description": "\u003cp\u003eWhere to mount the partition.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionConfig": { + "properties": { + "provider": { + "type": "string", + "title": "provider", + "description": "Encryption provider to use for the encryption.\n", + "markdownDescription": "Encryption provider to use for the encryption.", + "x-intellij-html-description": "\u003cp\u003eEncryption provider to use for the encryption.\u003c/p\u003e\n" + }, + "keys": { + "items": { + "$ref": "#/$defs/EncryptionKey" + }, + "type": "array", + "title": "keys", + "description": "Defines the encryption keys generation and storage method.\n", + "markdownDescription": "Defines the encryption keys generation and storage method.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption keys generation and storage method.\u003c/p\u003e\n" + }, + "cipher": { + "enum": [ + "aes-xts-plain64", + "xchacha12,aes-adiantum-plain64", + "xchacha20,aes-adiantum-plain64" + ], + "title": "cipher", + "description": "Cipher kind to use for the encryption. Depends on the encryption provider.\n", + "markdownDescription": "Cipher kind to use for the encryption. Depends on the encryption provider.", + "x-intellij-html-description": "\u003cp\u003eCipher kind to use for the encryption. Depends on the encryption provider.\u003c/p\u003e\n" + }, + "keySize": { + "type": "integer", + "title": "keySize", + "description": "Defines the encryption key length.\n", + "markdownDescription": "Defines the encryption key length.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption key length.\u003c/p\u003e\n" + }, + "blockSize": { + "type": "integer", + "title": "blockSize", + "description": "Defines the encryption sector size.\n", + "markdownDescription": "Defines the encryption sector size.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption sector size.\u003c/p\u003e\n" + }, + "options": { + "enum": [ + "no_read_workqueue", + "no_write_workqueue", + "same_cpu_crypt" + ], + "title": "options", + "description": "Additional –perf parameters for the LUKS2 encryption.\n", + "markdownDescription": "Additional --perf parameters for the LUKS2 encryption.", + "x-intellij-html-description": "\u003cp\u003eAdditional \u0026ndash;perf parameters for the LUKS2 encryption.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKey": { + "properties": { + "static": { + "$ref": "#/$defs/EncryptionKeyStatic", + "title": "static", + "description": "Key which value is stored in the configuration file.\n", + "markdownDescription": "Key which value is stored in the configuration file.", + "x-intellij-html-description": "\u003cp\u003eKey which value is stored in the configuration file.\u003c/p\u003e\n" + }, + "nodeID": { + "$ref": "#/$defs/EncryptionKeyNodeID", + "title": "nodeID", + "description": "Deterministically generated key from the node UUID and PartitionLabel.\n", + "markdownDescription": "Deterministically generated key from the node UUID and PartitionLabel.", + "x-intellij-html-description": "\u003cp\u003eDeterministically generated key from the node UUID and PartitionLabel.\u003c/p\u003e\n" + }, + "kms": { + "$ref": "#/$defs/EncryptionKeyKMS", + "title": "kms", + "description": "KMS managed encryption key.\n", + "markdownDescription": "KMS managed encryption key.", + "x-intellij-html-description": "\u003cp\u003eKMS managed encryption key.\u003c/p\u003e\n" + }, + "slot": { + "type": "integer", + "title": "slot", + "description": "Key slot number for LUKS2 encryption.\n", + "markdownDescription": "Key slot number for LUKS2 encryption.", + "x-intellij-html-description": "\u003cp\u003eKey slot number for LUKS2 encryption.\u003c/p\u003e\n" + }, + "tpm": { + "$ref": "#/$defs/EncryptionKeyTPM", + "title": "tpm", + "description": "Enable TPM based disk encryption.\n", + "markdownDescription": "Enable TPM based disk encryption.", + "x-intellij-html-description": "\u003cp\u003eEnable TPM based disk encryption.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKeyKMS": { + "properties": { + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "KMS endpoint to Seal/Unseal the key.\n", + "markdownDescription": "KMS endpoint to Seal/Unseal the key.", + "x-intellij-html-description": "\u003cp\u003eKMS endpoint to Seal/Unseal the key.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKeyNodeID": { + "properties": {}, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKeyStatic": { + "properties": { + "passphrase": { + "type": "string", + "title": "passphrase", + "description": "Defines the static passphrase value.\n", + "markdownDescription": "Defines the static passphrase value.", + "x-intellij-html-description": "\u003cp\u003eDefines the static passphrase value.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKeyTPM": { + "properties": {}, + "additionalProperties": false, + "type": "object" + }, + "Endpoint": { + "properties": {}, + "additionalProperties": false, + "type": "object" + }, + "EtcdConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used to create the etcd service.\n", + "markdownDescription": "The container image used to create the etcd service.", + "x-intellij-html-description": "\u003cp\u003eThe container image used to create the etcd service.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The ca is the root certificate authority of the PKI.\nIt is composed of a base64 encoded crt and key.\n", + "markdownDescription": "The `ca` is the root certificate authority of the PKI.\nIt is composed of a base64 encoded `crt` and `key`.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eca\u003c/code\u003e is the root certificate authority of the PKI.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e and \u003ccode\u003ekey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to etcd.\nNote that the following args are not allowed:\n\n\nname\ndata-dir\ninitial-cluster-state\nlisten-peer-urls\nlisten-client-urls\ncert-file\nkey-file\ntrusted-ca-file\npeer-client-cert-auth\npeer-cert-file\npeer-trusted-ca-file\npeer-key-file\n\n", + "markdownDescription": "Extra arguments to supply to etcd.\nNote that the following args are not allowed:\n\n- `name`\n- `data-dir`\n- `initial-cluster-state`\n- `listen-peer-urls`\n- `listen-client-urls`\n- `cert-file`\n- `key-file`\n- `trusted-ca-file`\n- `peer-client-cert-auth`\n- `peer-cert-file`\n- `peer-trusted-ca-file`\n- `peer-key-file`", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to etcd.\nNote that the following args are not allowed:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ename\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003edata-dir\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003einitial-cluster-state\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elisten-peer-urls\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elisten-client-urls\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ecert-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ekey-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etrusted-ca-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-client-cert-auth\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-cert-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-trusted-ca-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-key-file\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n" + }, + "advertisedSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "advertisedSubnets", + "description": "The advertisedSubnets field configures the networks to pick etcd advertised IP from.\n\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\n", + "markdownDescription": "The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.\n\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eadvertisedSubnets\u003c/code\u003e field configures the networks to pick etcd advertised IP from.\u003c/p\u003e\n\n\u003cp\u003eIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\u003c/p\u003e\n" + }, + "listenSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "listenSubnets", + "description": "The listenSubnets field configures the networks for the etcd to listen for peer and client connections.\n\nIf listenSubnets is not set, but advertisedSubnets is set, listenSubnets defaults to\nadvertisedSubnets.\n\nIf neither advertisedSubnets nor listenSubnets is set, listenSubnets defaults to listen on all addresses.\n\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\n", + "markdownDescription": "The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections.\n\nIf `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to\n`advertisedSubnets`.\n\nIf neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses.\n\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003elistenSubnets\u003c/code\u003e field configures the networks for the etcd to listen for peer and client connections.\u003c/p\u003e\n\n\u003cp\u003eIf \u003ccode\u003elistenSubnets\u003c/code\u003e is not set, but \u003ccode\u003eadvertisedSubnets\u003c/code\u003e is set, \u003ccode\u003elistenSubnets\u003c/code\u003e defaults to\n\u003ccode\u003eadvertisedSubnets\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003eIf neither \u003ccode\u003eadvertisedSubnets\u003c/code\u003e nor \u003ccode\u003elistenSubnets\u003c/code\u003e is set, \u003ccode\u003elistenSubnets\u003c/code\u003e defaults to listen on all addresses.\u003c/p\u003e\n\n\u003cp\u003eIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalCloudProviderConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable external cloud provider.\n", + "markdownDescription": "Enable external cloud provider.", + "x-intellij-html-description": "\u003cp\u003eEnable external cloud provider.\u003c/p\u003e\n" + }, + "manifests": { + "items": { + "type": "string" + }, + "type": "array", + "title": "manifests", + "description": "A list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExtraHost": { + "properties": { + "ip": { + "type": "string", + "title": "ip", + "description": "The IP of the host.\n", + "markdownDescription": "The IP of the host.", + "x-intellij-html-description": "\u003cp\u003eThe IP of the host.\u003c/p\u003e\n" + }, + "aliases": { + "items": { + "type": "string" + }, + "type": "array", + "title": "aliases", + "description": "The host alias.\n", + "markdownDescription": "The host alias.", + "x-intellij-html-description": "\u003cp\u003eThe host alias.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExtraMount": { + "properties": { + "destination": { + "type": "string", + "title": "destination", + "description": "Destination is the absolute path where the mount will be placed in the container.\n", + "markdownDescription": "Destination is the absolute path where the mount will be placed in the container.", + "x-intellij-html-description": "\u003cp\u003eDestination is the absolute path where the mount will be placed in the container.\u003c/p\u003e\n" + }, + "type": { + "type": "string", + "title": "type", + "description": "Type specifies the mount kind.\n", + "markdownDescription": "Type specifies the mount kind.", + "x-intellij-html-description": "\u003cp\u003eType specifies the mount kind.\u003c/p\u003e\n" + }, + "source": { + "type": "string", + "title": "source", + "description": "Source specifies the source path of the mount.\n", + "markdownDescription": "Source specifies the source path of the mount.", + "x-intellij-html-description": "\u003cp\u003eSource specifies the source path of the mount.\u003c/p\u003e\n" + }, + "options": { + "items": { + "type": "string" + }, + "type": "array", + "title": "options", + "description": "Options are fstab style mount options.\n", + "markdownDescription": "Options are fstab style mount options.", + "x-intellij-html-description": "\u003cp\u003eOptions are fstab style mount options.\u003c/p\u003e\n" + }, + "uidMappings": { + "items": { + "$ref": "#/$defs/LinuxIDMapping" + }, + "type": "array", + "title": "uidMappings", + "description": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.\n", + "markdownDescription": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.", + "x-intellij-html-description": "\u003cp\u003eUID/GID mappings used for changing file owners w/o calling chown, fs should support it.\u003c/p\u003e\n\n\u003cp\u003eEvery mount point could have its own mapping.\u003c/p\u003e\n" + }, + "gidMappings": { + "items": { + "$ref": "#/$defs/LinuxIDMapping" + }, + "type": "array", + "title": "gidMappings", + "description": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.\n", + "markdownDescription": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.", + "x-intellij-html-description": "\u003cp\u003eUID/GID mappings used for changing file owners w/o calling chown, fs should support it.\u003c/p\u003e\n\n\u003cp\u003eEvery mount point could have its own mapping.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "FeaturesConfig": { + "properties": { + "rbac": { + "type": "boolean", + "title": "rbac", + "description": "Enable role-based access control (RBAC).\n", + "markdownDescription": "Enable role-based access control (RBAC).", + "x-intellij-html-description": "\u003cp\u003eEnable role-based access control (RBAC).\u003c/p\u003e\n" + }, + "stableHostname": { + "type": "boolean", + "title": "stableHostname", + "description": "Enable stable default hostname.\n", + "markdownDescription": "Enable stable default hostname.", + "x-intellij-html-description": "\u003cp\u003eEnable stable default hostname.\u003c/p\u003e\n" + }, + "kubernetesTalosAPIAccess": { + "$ref": "#/$defs/KubernetesTalosAPIAccessConfig", + "title": "kubernetesTalosAPIAccess", + "description": "Configure Talos API access from Kubernetes pods.\n\nThis feature is disabled if the feature config is not specified.\n", + "markdownDescription": "Configure Talos API access from Kubernetes pods.\n\nThis feature is disabled if the feature config is not specified.", + "x-intellij-html-description": "\u003cp\u003eConfigure Talos API access from Kubernetes pods.\u003c/p\u003e\n\n\u003cp\u003eThis feature is disabled if the feature config is not specified.\u003c/p\u003e\n" + }, + "apidCheckExtKeyUsage": { + "type": "boolean", + "title": "apidCheckExtKeyUsage", + "description": "Enable checks for extended key usage of client certificates in apid.\n", + "markdownDescription": "Enable checks for extended key usage of client certificates in apid.", + "x-intellij-html-description": "\u003cp\u003eEnable checks for extended key usage of client certificates in apid.\u003c/p\u003e\n" + }, + "diskQuotaSupport": { + "type": "boolean", + "title": "diskQuotaSupport", + "description": "Enable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.\n", + "markdownDescription": "Enable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.", + "x-intellij-html-description": "\u003cp\u003eEnable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.\u003c/p\u003e\n" + }, + "kubePrism": { + "$ref": "#/$defs/KubePrism", + "title": "kubePrism", + "description": "KubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.\n", + "markdownDescription": "KubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.", + "x-intellij-html-description": "\u003cp\u003eKubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "FlannelCNIConfig": { + "properties": { + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraArgs", + "description": "Extra arguments for ‘flanneld’.\n", + "markdownDescription": "Extra arguments for 'flanneld'.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments for \u0026lsquo;flanneld\u0026rsquo;.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "InstallConfig": { + "properties": { + "disk": { + "type": "string", + "title": "disk", + "description": "The disk used for installations.\n", + "markdownDescription": "The disk used for installations.", + "x-intellij-html-description": "\u003cp\u003eThe disk used for installations.\u003c/p\u003e\n" + }, + "diskSelector": { + "$ref": "#/$defs/InstallDiskSelector", + "title": "diskSelector", + "description": "Look up disk using disk attributes like model, size, serial and others.\nAlways has priority over disk.\n", + "markdownDescription": "Look up disk using disk attributes like model, size, serial and others.\nAlways has priority over `disk`.", + "x-intellij-html-description": "\u003cp\u003eLook up disk using disk attributes like model, size, serial and others.\nAlways has priority over \u003ccode\u003edisk\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraKernelArgs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraKernelArgs", + "description": "Allows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a -.\nFor example -console removes all console=\u0026lt;value\u0026gt; arguments, whereas -console=tty0 removes the console=tty0 default argument.\n", + "markdownDescription": "Allows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a `-`.\nFor example `-console` removes all `console=\u003cvalue\u003e` arguments, whereas `-console=tty0` removes the `console=tty0` default argument.", + "x-intellij-html-description": "\u003cp\u003eAllows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a \u003ccode\u003e-\u003c/code\u003e.\nFor example \u003ccode\u003e-console\u003c/code\u003e removes all \u003ccode\u003econsole=\u0026lt;value\u0026gt;\u003c/code\u003e arguments, whereas \u003ccode\u003e-console=tty0\u003c/code\u003e removes the \u003ccode\u003econsole=tty0\u003c/code\u003e default argument.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "Allows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\nGitHub releases page.\n", + "markdownDescription": "Allows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\n[GitHub releases page](https://github.com/siderolabs/talos/releases).", + "x-intellij-html-description": "\u003cp\u003eAllows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\n\u003ca href=\"https://github.com/siderolabs/talos/releases\" target=\"_blank\"\u003eGitHub releases page\u003c/a\u003e.\u003c/p\u003e\n" + }, + "extensions": { + "items": { + "$ref": "#/$defs/InstallExtensionConfig" + }, + "type": "array", + "title": "extensions", + "description": "Allows for supplying additional system extension images to install on top of base Talos image.\n", + "markdownDescription": "Allows for supplying additional system extension images to install on top of base Talos image.", + "x-intellij-html-description": "\u003cp\u003eAllows for supplying additional system extension images to install on top of base Talos image.\u003c/p\u003e\n" + }, + "wipe": { + "type": "boolean", + "title": "wipe", + "description": "Indicates if the installation disk should be wiped at installation time.\nDefaults to true.\n", + "markdownDescription": "Indicates if the installation disk should be wiped at installation time.\nDefaults to `true`.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the installation disk should be wiped at installation time.\nDefaults to \u003ccode\u003etrue\u003c/code\u003e.\u003c/p\u003e\n" + }, + "legacyBIOSSupport": { + "type": "boolean", + "title": "legacyBIOSSupport", + "description": "Indicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn’t support GPT partitioning scheme.\n", + "markdownDescription": "Indicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.", + "x-intellij-html-description": "\u003cp\u003eIndicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn\u0026rsquo;t support GPT partitioning scheme.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "InstallDiskSelector": { + "properties": { + "size": { + "type": "string", + "title": "size", + "description": "Disk size.\n", + "markdownDescription": "Disk size.", + "x-intellij-html-description": "\u003cp\u003eDisk size.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Disk name /sys/block/\u0026lt;dev\u0026gt;/device/name.\n", + "markdownDescription": "Disk name `/sys/block/\u003cdev\u003e/device/name`.", + "x-intellij-html-description": "\u003cp\u003eDisk name \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/name\u003c/code\u003e.\u003c/p\u003e\n" + }, + "model": { + "type": "string", + "title": "model", + "description": "Disk model /sys/block/\u0026lt;dev\u0026gt;/device/model.\n", + "markdownDescription": "Disk model `/sys/block/\u003cdev\u003e/device/model`.", + "x-intellij-html-description": "\u003cp\u003eDisk model \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/model\u003c/code\u003e.\u003c/p\u003e\n" + }, + "serial": { + "type": "string", + "title": "serial", + "description": "Disk serial number /sys/block/\u0026lt;dev\u0026gt;/serial.\n", + "markdownDescription": "Disk serial number `/sys/block/\u003cdev\u003e/serial`.", + "x-intellij-html-description": "\u003cp\u003eDisk serial number \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/serial\u003c/code\u003e.\u003c/p\u003e\n" + }, + "modalias": { + "type": "string", + "title": "modalias", + "description": "Disk modalias /sys/block/\u0026lt;dev\u0026gt;/device/modalias.\n", + "markdownDescription": "Disk modalias `/sys/block/\u003cdev\u003e/device/modalias`.", + "x-intellij-html-description": "\u003cp\u003eDisk modalias \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/modalias\u003c/code\u003e.\u003c/p\u003e\n" + }, + "uuid": { + "type": "string", + "title": "uuid", + "description": "Disk UUID /sys/block/\u0026lt;dev\u0026gt;/uuid.\n", + "markdownDescription": "Disk UUID `/sys/block/\u003cdev\u003e/uuid`.", + "x-intellij-html-description": "\u003cp\u003eDisk UUID \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/uuid\u003c/code\u003e.\u003c/p\u003e\n" + }, + "wwid": { + "type": "string", + "title": "wwid", + "description": "Disk WWID /sys/block/\u0026lt;dev\u0026gt;/wwid.\n", + "markdownDescription": "Disk WWID `/sys/block/\u003cdev\u003e/wwid`.", + "x-intellij-html-description": "\u003cp\u003eDisk WWID \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/wwid\u003c/code\u003e.\u003c/p\u003e\n" + }, + "type": { + "enum": [ + "ssd", + "hdd", + "nvme", + "sd" + ], + "title": "type", + "description": "Disk Type.\n", + "markdownDescription": "Disk Type.", + "x-intellij-html-description": "\u003cp\u003eDisk Type.\u003c/p\u003e\n" + }, + "busPath": { + "type": "string", + "title": "busPath", + "description": "Disk bus path.\n", + "markdownDescription": "Disk bus path.", + "x-intellij-html-description": "\u003cp\u003eDisk bus path.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "InstallExtensionConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "System extension image.\n", + "markdownDescription": "System extension image.", + "x-intellij-html-description": "\u003cp\u003eSystem extension image.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KernelConfig": { + "properties": { + "modules": { + "items": { + "$ref": "#/$defs/KernelModuleConfig" + }, + "type": "array", + "title": "modules", + "description": "Kernel modules to load.\n", + "markdownDescription": "Kernel modules to load.", + "x-intellij-html-description": "\u003cp\u003eKernel modules to load.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KernelModuleConfig": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Module name.\n", + "markdownDescription": "Module name.", + "x-intellij-html-description": "\u003cp\u003eModule name.\u003c/p\u003e\n" + }, + "parameters": { + "items": { + "type": "string" + }, + "type": "array", + "title": "parameters", + "description": "Module parameters, changes applied after reboot.\n", + "markdownDescription": "Module parameters, changes applied after reboot.", + "x-intellij-html-description": "\u003cp\u003eModule parameters, changes applied after reboot.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubePrism": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable KubePrism support - will start local load balacing proxy.\n", + "markdownDescription": "Enable KubePrism support - will start local load balacing proxy.", + "x-intellij-html-description": "\u003cp\u003eEnable KubePrism support - will start local load balacing proxy.\u003c/p\u003e\n" + }, + "port": { + "type": "integer", + "title": "port", + "description": "KubePrism port.\n", + "markdownDescription": "KubePrism port.", + "x-intellij-html-description": "\u003cp\u003eKubePrism port.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeSpanFilters": { + "properties": { + "endpoints": { + "items": { + "type": "string" + }, + "type": "array", + "title": "endpoints", + "description": "Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\n\nBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\n\nDefault value: no filtering.\n", + "markdownDescription": "Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\n\nBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\n\nDefault value: no filtering.", + "x-intellij-html-description": "\u003cp\u003eFilter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\u003c/p\u003e\n\n\u003cp\u003eBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\u003c/p\u003e\n\n\u003cp\u003eDefault value: no filtering.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeletConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The image field is an optional reference to an alternative kubelet image.\n", + "markdownDescription": "The `image` field is an optional reference to an alternative kubelet image.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an optional reference to an alternative kubelet image.\u003c/p\u003e\n" + }, + "clusterDNS": { + "items": { + "type": "string" + }, + "type": "array", + "title": "clusterDNS", + "description": "The ClusterDNS field is an optional reference to an alternative kubelet clusterDNS ip list.\n", + "markdownDescription": "The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eClusterDNS\u003c/code\u003e field is an optional reference to an alternative kubelet clusterDNS ip list.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "The extraArgs field is used to provide additional flags to the kubelet.\n", + "markdownDescription": "The `extraArgs` field is used to provide additional flags to the kubelet.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraArgs\u003c/code\u003e field is used to provide additional flags to the kubelet.\u003c/p\u003e\n" + }, + "extraMounts": { + "items": { + "$ref": "#/$defs/ExtraMount" + }, + "type": "array", + "title": "extraMounts", + "description": "The extraMounts field is used to add additional mounts to the kubelet container.\nNote that either bind or rbind are required in the options.\n", + "markdownDescription": "The `extraMounts` field is used to add additional mounts to the kubelet container.\nNote that either `bind` or `rbind` are required in the `options`.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraMounts\u003c/code\u003e field is used to add additional mounts to the kubelet container.\nNote that either \u003ccode\u003ebind\u003c/code\u003e or \u003ccode\u003erbind\u003c/code\u003e are required in the \u003ccode\u003eoptions\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraConfig": { + "type": "object", + "title": "extraConfig", + "description": "The extraConfig field is used to provide kubelet configuration overrides.\n\nSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.\n", + "markdownDescription": "The `extraConfig` field is used to provide kubelet configuration overrides.\n\nSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraConfig\u003c/code\u003e field is used to provide kubelet configuration overrides.\u003c/p\u003e\n\n\u003cp\u003eSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.\u003c/p\u003e\n" + }, + "credentialProviderConfig": { + "type": "object", + "title": "credentialProviderConfig", + "description": "The KubeletCredentialProviderConfig field is used to provide kubelet credential configuration.\n", + "markdownDescription": "The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eKubeletCredentialProviderConfig\u003c/code\u003e field is used to provide kubelet credential configuration.\u003c/p\u003e\n" + }, + "defaultRuntimeSeccompProfileEnabled": { + "type": "boolean", + "title": "defaultRuntimeSeccompProfileEnabled", + "description": "Enable container runtime default Seccomp profile.\n", + "markdownDescription": "Enable container runtime default Seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eEnable container runtime default Seccomp profile.\u003c/p\u003e\n" + }, + "registerWithFQDN": { + "type": "boolean", + "title": "registerWithFQDN", + "description": "The registerWithFQDN field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.\n", + "markdownDescription": "The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eregisterWithFQDN\u003c/code\u003e field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.\u003c/p\u003e\n" + }, + "nodeIP": { + "$ref": "#/$defs/KubeletNodeIPConfig", + "title": "nodeIP", + "description": "The nodeIP field is used to configure --node-ip flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.\n", + "markdownDescription": "The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003enodeIP\u003c/code\u003e field is used to configure \u003ccode\u003e--node-ip\u003c/code\u003e flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.\u003c/p\u003e\n" + }, + "skipNodeRegistration": { + "type": "boolean", + "title": "skipNodeRegistration", + "description": "The skipNodeRegistration is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.\n", + "markdownDescription": "The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eskipNodeRegistration\u003c/code\u003e is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.\u003c/p\u003e\n" + }, + "disableManifestsDirectory": { + "type": "boolean", + "title": "disableManifestsDirectory", + "description": "The disableManifestsDirectory field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt’s recommended to configure static pods with the “pods” key instead.\n", + "markdownDescription": "The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt's recommended to configure static pods with the \"pods\" key instead.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003edisableManifestsDirectory\u003c/code\u003e field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt\u0026rsquo;s recommended to configure static pods with the \u0026ldquo;pods\u0026rdquo; key instead.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeletNodeIPConfig": { + "properties": { + "validSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "validSubnets", + "description": "The validSubnets field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.\n", + "markdownDescription": "The `validSubnets` field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003evalidSubnets\u003c/code\u003e field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubernetesTalosAPIAccessConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable Talos API access from Kubernetes pods.\n", + "markdownDescription": "Enable Talos API access from Kubernetes pods.", + "x-intellij-html-description": "\u003cp\u003eEnable Talos API access from Kubernetes pods.\u003c/p\u003e\n" + }, + "allowedRoles": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedRoles", + "description": "The list of Talos API roles which can be granted for access from Kubernetes pods.\n\nEmpty list means that no roles can be granted, so access is blocked.\n", + "markdownDescription": "The list of Talos API roles which can be granted for access from Kubernetes pods.\n\nEmpty list means that no roles can be granted, so access is blocked.", + "x-intellij-html-description": "\u003cp\u003eThe list of Talos API roles which can be granted for access from Kubernetes pods.\u003c/p\u003e\n\n\u003cp\u003eEmpty list means that no roles can be granted, so access is blocked.\u003c/p\u003e\n" + }, + "allowedKubernetesNamespaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedKubernetesNamespaces", + "description": "The list of Kubernetes namespaces Talos API access is available from.\n", + "markdownDescription": "The list of Kubernetes namespaces Talos API access is available from.", + "x-intellij-html-description": "\u003cp\u003eThe list of Kubernetes namespaces Talos API access is available from.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "LinuxIDMapping": { + "properties": { + "containerID": { + "type": "integer", + "title": "containerID", + "description": "ContainerID is the starting UID/GID in the container.\n", + "markdownDescription": "ContainerID is the starting UID/GID in the container.", + "x-intellij-html-description": "\u003cp\u003eContainerID is the starting UID/GID in the container.\u003c/p\u003e\n" + }, + "hostID": { + "type": "integer", + "title": "hostID", + "description": "HostID is the starting UID/GID on the host to be mapped to ‘ContainerID’.\n", + "markdownDescription": "HostID is the starting UID/GID on the host to be mapped to 'ContainerID'.", + "x-intellij-html-description": "\u003cp\u003eHostID is the starting UID/GID on the host to be mapped to \u0026lsquo;ContainerID\u0026rsquo;.\u003c/p\u003e\n" + }, + "size": { + "type": "integer", + "title": "size", + "description": "Size is the number of IDs to be mapped.\n", + "markdownDescription": "Size is the number of IDs to be mapped.", + "x-intellij-html-description": "\u003cp\u003eSize is the number of IDs to be mapped.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "LoggingConfig": { + "properties": { + "destinations": { + "items": { + "$ref": "#/$defs/LoggingDestination" + }, + "type": "array", + "title": "destinations", + "description": "Logging destination.\n", + "markdownDescription": "Logging destination.", + "x-intellij-html-description": "\u003cp\u003eLogging destination.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "LoggingDestination": { + "properties": { + "endpoint": { + "$ref": "#/$defs/Endpoint", + "title": "endpoint", + "description": "Where to send logs. Supported protocols are “tcp” and “udp”.\n", + "markdownDescription": "Where to send logs. Supported protocols are \"tcp\" and \"udp\".", + "x-intellij-html-description": "\u003cp\u003eWhere to send logs. Supported protocols are \u0026ldquo;tcp\u0026rdquo; and \u0026ldquo;udp\u0026rdquo;.\u003c/p\u003e\n" + }, + "format": { + "enum": [ + "json_lines" + ], + "title": "format", + "description": "Logs format.\n", + "markdownDescription": "Logs format.", + "x-intellij-html-description": "\u003cp\u003eLogs format.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineConfig": { + "properties": { + "type": { + "enum": [ + "controlplane", + "worker" + ], + "title": "type", + "description": "Defines the role of the machine within the cluster.\n\nControl Plane\n\nControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\n\nWorker\n\nWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\n\nThis node type was previously known as “join”; that value is still supported but deprecated.\n", + "markdownDescription": "Defines the role of the machine within the cluster.\n\n**Control Plane**\n\nControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\n\n**Worker**\n\nWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\n\nThis node type was previously known as \"join\"; that value is still supported but deprecated.", + "x-intellij-html-description": "\u003cp\u003eDefines the role of the machine within the cluster.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eControl Plane\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWorker\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\u003c/p\u003e\n\n\u003cp\u003eThis node type was previously known as \u0026ldquo;join\u0026rdquo;; that value is still supported but deprecated.\u003c/p\u003e\n" + }, + "token": { + "type": "string", + "title": "token", + "description": "The token is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity.\n", + "markdownDescription": "The `token` is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003etoken\u003c/code\u003e is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its\u0026rsquo; identity.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The root certificate authority of the PKI.\nIt is composed of a base64 encoded crt and key.\n", + "markdownDescription": "The root certificate authority of the PKI.\nIt is composed of a base64 encoded `crt` and `key`.", + "x-intellij-html-description": "\u003cp\u003eThe root certificate authority of the PKI.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e and \u003ccode\u003ekey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "certSANs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "certSANs", + "description": "Extra certificate subject alternative names for the machine’s certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate’s SANs.\n", + "markdownDescription": "Extra certificate subject alternative names for the machine's certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate's SANs.", + "x-intellij-html-description": "\u003cp\u003eExtra certificate subject alternative names for the machine\u0026rsquo;s certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate\u0026rsquo;s SANs.\u003c/p\u003e\n" + }, + "controlPlane": { + "$ref": "#/$defs/MachineControlPlaneConfig", + "title": "controlPlane", + "description": "Provides machine specific control plane configuration options.\n", + "markdownDescription": "Provides machine specific control plane configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific control plane configuration options.\u003c/p\u003e\n" + }, + "kubelet": { + "$ref": "#/$defs/KubeletConfig", + "title": "kubelet", + "description": "Used to provide additional options to the kubelet.\n", + "markdownDescription": "Used to provide additional options to the kubelet.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide additional options to the kubelet.\u003c/p\u003e\n" + }, + "pods": { + "items": { + "type": "object" + }, + "type": "array", + "title": "pods", + "description": "Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\nStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn’t validate the pod definition.\nUpdates to this field can be applied without a reboot.\n\nSee https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.\n", + "markdownDescription": "Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\nStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn't validate the pod definition.\nUpdates to this field can be applied without a reboot.\n\nSee https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\u003c/p\u003e\n\n\u003cp\u003eStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn\u0026rsquo;t validate the pod definition.\nUpdates to this field can be applied without a reboot.\u003c/p\u003e\n\n\u003cp\u003eSee \u003ca href=\"https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/\" target=\"_blank\"\u003ehttps://kubernetes.io/docs/tasks/configure-pod-container/static-pod/\u003c/a\u003e.\u003c/p\u003e\n" + }, + "network": { + "$ref": "#/$defs/NetworkConfig", + "title": "network", + "description": "Provides machine specific network configuration options.\n", + "markdownDescription": "Provides machine specific network configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific network configuration options.\u003c/p\u003e\n" + }, + "disks": { + "items": { + "$ref": "#/$defs/MachineDisk" + }, + "type": "array", + "title": "disks", + "description": "Used to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of /var, mounts are only valid if they are under /var.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf size: is omitted, the partition is sized to occupy the full disk.\n", + "markdownDescription": "Used to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf `size:` is omitted, the partition is sized to occupy the full disk.", + "x-intellij-html-description": "\u003cp\u003eUsed to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of \u003ccode\u003e/var\u003c/code\u003e, mounts are only valid if they are under \u003ccode\u003e/var\u003c/code\u003e.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf \u003ccode\u003esize:\u003c/code\u003e is omitted, the partition is sized to occupy the full disk.\u003c/p\u003e\n" + }, + "install": { + "$ref": "#/$defs/InstallConfig", + "title": "install", + "description": "Used to provide instructions for installations.\n\nNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.\n", + "markdownDescription": "Used to provide instructions for installations.\n\nNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide instructions for installations.\u003c/p\u003e\n\n\u003cp\u003eNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.\u003c/p\u003e\n" + }, + "files": { + "items": { + "$ref": "#/$defs/MachineFile" + }, + "type": "array", + "title": "files", + "description": "Allows the addition of user specified files.\nThe value of op can be create, overwrite, or append.\nIn the case of create, path must not exist.\nIn the case of overwrite, and append, path must be a valid file.\nIf an op value of append is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.\n", + "markdownDescription": "Allows the addition of user specified files.\nThe value of `op` can be `create`, `overwrite`, or `append`.\nIn the case of `create`, `path` must not exist.\nIn the case of `overwrite`, and `append`, `path` must be a valid file.\nIf an `op` value of `append` is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.", + "x-intellij-html-description": "\u003cp\u003eAllows the addition of user specified files.\nThe value of \u003ccode\u003eop\u003c/code\u003e can be \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003eoverwrite\u003c/code\u003e, or \u003ccode\u003eappend\u003c/code\u003e.\nIn the case of \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e must not exist.\nIn the case of \u003ccode\u003eoverwrite\u003c/code\u003e, and \u003ccode\u003eappend\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e must be a valid file.\nIf an \u003ccode\u003eop\u003c/code\u003e value of \u003ccode\u003eappend\u003c/code\u003e is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.\u003c/p\u003e\n" + }, + "time": { + "$ref": "#/$defs/TimeConfig", + "title": "time", + "description": "Used to configure the machine’s time settings.\n", + "markdownDescription": "Used to configure the machine's time settings.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s time settings.\u003c/p\u003e\n" + }, + "sysctls": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "sysctls", + "description": "Used to configure the machine’s sysctls.\n", + "markdownDescription": "Used to configure the machine's sysctls.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s sysctls.\u003c/p\u003e\n" + }, + "sysfs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "sysfs", + "description": "Used to configure the machine’s sysfs.\n", + "markdownDescription": "Used to configure the machine's sysfs.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s sysfs.\u003c/p\u003e\n" + }, + "registries": { + "$ref": "#/$defs/RegistriesConfig", + "title": "registries", + "description": "Used to configure the machine’s container image registry mirrors.\n\nAutomatically generates matching CRI configuration for registry mirrors.\n\nThe mirrors section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\n\nThe config section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in .docker/config.json.\n\nSee also matching configuration for CRI containerd plugin.\n", + "markdownDescription": "Used to configure the machine's container image registry mirrors.\n\nAutomatically generates matching CRI configuration for registry mirrors.\n\nThe `mirrors` section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\n\nThe `config` section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).\n\nSee also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md).", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s container image registry mirrors.\u003c/p\u003e\n\n\u003cp\u003eAutomatically generates matching CRI configuration for registry mirrors.\u003c/p\u003e\n\n\u003cp\u003eThe \u003ccode\u003emirrors\u003c/code\u003e section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\u003c/p\u003e\n\n\u003cp\u003eThe \u003ccode\u003econfig\u003c/code\u003e section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eSee also matching configuration for \u003ca href=\"https://github.com/containerd/cri/blob/master/docs/registry.md\" target=\"_blank\"\u003eCRI containerd plugin\u003c/a\u003e.\u003c/p\u003e\n" + }, + "systemDiskEncryption": { + "$ref": "#/$defs/SystemDiskEncryptionConfig", + "title": "systemDiskEncryption", + "description": "Machine system disk encryption configuration.\nDefines each system partition encryption parameters.\n", + "markdownDescription": "Machine system disk encryption configuration.\nDefines each system partition encryption parameters.", + "x-intellij-html-description": "\u003cp\u003eMachine system disk encryption configuration.\nDefines each system partition encryption parameters.\u003c/p\u003e\n" + }, + "features": { + "$ref": "#/$defs/FeaturesConfig", + "title": "features", + "description": "Features describe individual Talos features that can be switched on or off.\n", + "markdownDescription": "Features describe individual Talos features that can be switched on or off.", + "x-intellij-html-description": "\u003cp\u003eFeatures describe individual Talos features that can be switched on or off.\u003c/p\u003e\n" + }, + "udev": { + "$ref": "#/$defs/UdevConfig", + "title": "udev", + "description": "Configures the udev system.\n", + "markdownDescription": "Configures the udev system.", + "x-intellij-html-description": "\u003cp\u003eConfigures the udev system.\u003c/p\u003e\n" + }, + "logging": { + "$ref": "#/$defs/LoggingConfig", + "title": "logging", + "description": "Configures the logging system.\n", + "markdownDescription": "Configures the logging system.", + "x-intellij-html-description": "\u003cp\u003eConfigures the logging system.\u003c/p\u003e\n" + }, + "kernel": { + "$ref": "#/$defs/KernelConfig", + "title": "kernel", + "description": "Configures the kernel.\n", + "markdownDescription": "Configures the kernel.", + "x-intellij-html-description": "\u003cp\u003eConfigures the kernel.\u003c/p\u003e\n" + }, + "seccompProfiles": { + "items": { + "$ref": "#/$defs/MachineSeccompProfile" + }, + "type": "array", + "title": "seccompProfiles", + "description": "Configures the seccomp profiles for the machine.\n", + "markdownDescription": "Configures the seccomp profiles for the machine.", + "x-intellij-html-description": "\u003cp\u003eConfigures the seccomp profiles for the machine.\u003c/p\u003e\n" + }, + "nodeLabels": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "nodeLabels", + "description": "Configures the node labels for the machine.\n", + "markdownDescription": "Configures the node labels for the machine.", + "x-intellij-html-description": "\u003cp\u003eConfigures the node labels for the machine.\u003c/p\u003e\n" + }, + "nodeTaints": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "nodeTaints", + "description": "Configures the node taints for the machine. Effect is optional.\n", + "markdownDescription": "Configures the node taints for the machine. Effect is optional.", + "x-intellij-html-description": "\u003cp\u003eConfigures the node taints for the machine. Effect is optional.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineControlPlaneConfig": { + "properties": { + "controllerManager": { + "$ref": "#/$defs/MachineControllerManagerConfig", + "title": "controllerManager", + "description": "Controller manager machine specific configuration options.\n", + "markdownDescription": "Controller manager machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eController manager machine specific configuration options.\u003c/p\u003e\n" + }, + "scheduler": { + "$ref": "#/$defs/MachineSchedulerConfig", + "title": "scheduler", + "description": "Scheduler machine specific configuration options.\n", + "markdownDescription": "Scheduler machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eScheduler machine specific configuration options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineControllerManagerConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-controller-manager on the node.\n", + "markdownDescription": "Disable kube-controller-manager on the node.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-controller-manager on the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineDisk": { + "properties": { + "device": { + "type": "string", + "title": "device", + "description": "The name of the disk to use.\n", + "markdownDescription": "The name of the disk to use.", + "x-intellij-html-description": "\u003cp\u003eThe name of the disk to use.\u003c/p\u003e\n" + }, + "partitions": { + "items": { + "$ref": "#/$defs/DiskPartition" + }, + "type": "array", + "title": "partitions", + "description": "A list of partitions to create on the disk.\n", + "markdownDescription": "A list of partitions to create on the disk.", + "x-intellij-html-description": "\u003cp\u003eA list of partitions to create on the disk.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineFile": { + "properties": { + "content": { + "type": "string", + "title": "content", + "description": "The contents of the file.\n", + "markdownDescription": "The contents of the file.", + "x-intellij-html-description": "\u003cp\u003eThe contents of the file.\u003c/p\u003e\n" + }, + "permissions": { + "type": "integer", + "title": "permissions", + "description": "The file’s permissions in octal.\n", + "markdownDescription": "The file's permissions in octal.", + "x-intellij-html-description": "\u003cp\u003eThe file\u0026rsquo;s permissions in octal.\u003c/p\u003e\n" + }, + "path": { + "type": "string", + "title": "path", + "description": "The path of the file.\n", + "markdownDescription": "The path of the file.", + "x-intellij-html-description": "\u003cp\u003eThe path of the file.\u003c/p\u003e\n" + }, + "op": { + "enum": [ + "create", + "append", + "overwrite" + ], + "title": "op", + "description": "The operation to use\n", + "markdownDescription": "The operation to use", + "x-intellij-html-description": "\u003cp\u003eThe operation to use\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineSchedulerConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-scheduler on the node.\n", + "markdownDescription": "Disable kube-scheduler on the node.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-scheduler on the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineSeccompProfile": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "The name field is used to provide the file name of the seccomp profile.\n", + "markdownDescription": "The `name` field is used to provide the file name of the seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003ename\u003c/code\u003e field is used to provide the file name of the seccomp profile.\u003c/p\u003e\n" + }, + "value": { + "type": "object", + "title": "value", + "description": "The value field is used to provide the seccomp profile.\n", + "markdownDescription": "The `value` field is used to provide the seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003evalue\u003c/code\u003e field is used to provide the seccomp profile.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkConfig": { + "properties": { + "hostname": { + "type": "string", + "title": "hostname", + "description": "Used to statically set the hostname for the machine.\n", + "markdownDescription": "Used to statically set the hostname for the machine.", + "x-intellij-html-description": "\u003cp\u003eUsed to statically set the hostname for the machine.\u003c/p\u003e\n" + }, + "interfaces": { + "items": { + "$ref": "#/$defs/Device" + }, + "type": "array", + "title": "interfaces", + "description": "interfaces is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.\n", + "markdownDescription": "`interfaces` is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.", + "x-intellij-html-description": "\u003cp\u003e\u003ccode\u003einterfaces\u003c/code\u003e is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.\u003c/p\u003e\n" + }, + "nameservers": { + "items": { + "type": "string" + }, + "type": "array", + "title": "nameservers", + "description": "Used to statically set the nameservers for the machine.\nDefaults to 1.1.1.1 and 8.8.8.8\n", + "markdownDescription": "Used to statically set the nameservers for the machine.\nDefaults to `1.1.1.1` and `8.8.8.8`", + "x-intellij-html-description": "\u003cp\u003eUsed to statically set the nameservers for the machine.\nDefaults to \u003ccode\u003e1.1.1.1\u003c/code\u003e and \u003ccode\u003e8.8.8.8\u003c/code\u003e\u003c/p\u003e\n" + }, + "extraHostEntries": { + "items": { + "$ref": "#/$defs/ExtraHost" + }, + "type": "array", + "title": "extraHostEntries", + "description": "Allows for extra entries to be added to the /etc/hosts file\n", + "markdownDescription": "Allows for extra entries to be added to the `/etc/hosts` file", + "x-intellij-html-description": "\u003cp\u003eAllows for extra entries to be added to the \u003ccode\u003e/etc/hosts\u003c/code\u003e file\u003c/p\u003e\n" + }, + "kubespan": { + "$ref": "#/$defs/NetworkKubeSpan", + "title": "kubespan", + "description": "Configures KubeSpan feature.\n", + "markdownDescription": "Configures KubeSpan feature.", + "x-intellij-html-description": "\u003cp\u003eConfigures KubeSpan feature.\u003c/p\u003e\n" + }, + "disableSearchDomain": { + "type": "boolean", + "title": "disableSearchDomain", + "description": "Disable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to false.\n", + "markdownDescription": "Disable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to `false`.", + "x-intellij-html-description": "\u003cp\u003eDisable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkDeviceSelector": { + "properties": { + "busPath": { + "type": "string", + "title": "busPath", + "description": "PCI, USB bus prefix, supports matching by wildcard.\n", + "markdownDescription": "PCI, USB bus prefix, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003ePCI, USB bus prefix, supports matching by wildcard.\u003c/p\u003e\n" + }, + "hardwareAddr": { + "type": "string", + "title": "hardwareAddr", + "description": "Device hardware address, supports matching by wildcard.\n", + "markdownDescription": "Device hardware address, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003eDevice hardware address, supports matching by wildcard.\u003c/p\u003e\n" + }, + "pciID": { + "type": "string", + "title": "pciID", + "description": "PCI ID (vendor ID, product ID), supports matching by wildcard.\n", + "markdownDescription": "PCI ID (vendor ID, product ID), supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003ePCI ID (vendor ID, product ID), supports matching by wildcard.\u003c/p\u003e\n" + }, + "driver": { + "type": "string", + "title": "driver", + "description": "Kernel driver, supports matching by wildcard.\n", + "markdownDescription": "Kernel driver, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003eKernel driver, supports matching by wildcard.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkKubeSpan": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.\n", + "markdownDescription": "Enable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.", + "x-intellij-html-description": "\u003cp\u003eEnable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.\u003c/p\u003e\n" + }, + "advertiseKubernetesNetworks": { + "type": "boolean", + "title": "advertiseKubernetesNetworks", + "description": "Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.\n", + "markdownDescription": "Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.", + "x-intellij-html-description": "\u003cp\u003eControl whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.\u003c/p\u003e\n" + }, + "allowDownPeerBypass": { + "type": "boolean", + "title": "allowDownPeerBypass", + "description": "Skip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can’t be established.\n", + "markdownDescription": "Skip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can't be established.", + "x-intellij-html-description": "\u003cp\u003eSkip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can\u0026rsquo;t be established.\u003c/p\u003e\n" + }, + "harvestExtraEndpoints": { + "type": "boolean", + "title": "harvestExtraEndpoints", + "description": "KubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is enabled by default to help discover additional endpoints,\nbut with high number of peers (\u0026gt;50) in the KubeSpan network it can cause performance issues.\n", + "markdownDescription": "KubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is enabled by default to help discover additional endpoints,\nbut with high number of peers (\u003e50) in the KubeSpan network it can cause performance issues.", + "x-intellij-html-description": "\u003cp\u003eKubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is enabled by default to help discover additional endpoints,\nbut with high number of peers (\u0026gt;50) in the KubeSpan network it can cause performance issues.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "KubeSpan link MTU size.\nDefault value is 1420.\n", + "markdownDescription": "KubeSpan link MTU size.\nDefault value is 1420.", + "x-intellij-html-description": "\u003cp\u003eKubeSpan link MTU size.\nDefault value is 1420.\u003c/p\u003e\n" + }, + "filters": { + "$ref": "#/$defs/KubeSpanFilters", + "title": "filters", + "description": "KubeSpan advanced filtering of network addresses .\n\nSettings in this section are optional, and settings apply only to the node.\n", + "markdownDescription": "KubeSpan advanced filtering of network addresses .\n\nSettings in this section are optional, and settings apply only to the node.", + "x-intellij-html-description": "\u003cp\u003eKubeSpan advanced filtering of network addresses .\u003c/p\u003e\n\n\u003cp\u003eSettings in this section are optional, and settings apply only to the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ProxyConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-proxy deployment on cluster bootstrap.\n", + "markdownDescription": "Disable kube-proxy deployment on cluster bootstrap.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-proxy deployment on cluster bootstrap.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the kube-proxy manifest.\n", + "markdownDescription": "The container image used in the kube-proxy manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the kube-proxy manifest.\u003c/p\u003e\n" + }, + "mode": { + "type": "string", + "title": "mode", + "description": "proxy mode of kube-proxy.\nThe default is ‘iptables’.\n", + "markdownDescription": "proxy mode of kube-proxy.\nThe default is 'iptables'.", + "x-intellij-html-description": "\u003cp\u003eproxy mode of kube-proxy.\nThe default is \u0026lsquo;iptables\u0026rsquo;.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to kube-proxy.\n", + "markdownDescription": "Extra arguments to supply to kube-proxy.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to kube-proxy.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistriesConfig": { + "properties": { + "mirrors": { + "patternProperties": { + ".*": { + "$ref": "#/$defs/RegistryMirrorConfig" + } + }, + "type": "object", + "title": "mirrors", + "description": "Specifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\n\nFor example, when pulling an image with the reference example.com:123/image:v1,\nthe example.com:123 key will be used to lookup the mirror configuration.\n\nOptionally the * key can be used to configure a fallback mirror.\n\nRegistry name is the first segment of image identifier, with ‘docker.io’\nbeing default one.\n", + "markdownDescription": "Specifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\n\nFor example, when pulling an image with the reference `example.com:123/image:v1`,\nthe `example.com:123` key will be used to lookup the mirror configuration.\n\nOptionally the `*` key can be used to configure a fallback mirror.\n\nRegistry name is the first segment of image identifier, with 'docker.io'\nbeing default one.", + "x-intellij-html-description": "\u003cp\u003eSpecifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\u003c/p\u003e\n\n\u003cp\u003eFor example, when pulling an image with the reference \u003ccode\u003eexample.com:123/image:v1\u003c/code\u003e,\nthe \u003ccode\u003eexample.com:123\u003c/code\u003e key will be used to lookup the mirror configuration.\u003c/p\u003e\n\n\u003cp\u003eOptionally the \u003ccode\u003e*\u003c/code\u003e key can be used to configure a fallback mirror.\u003c/p\u003e\n\n\u003cp\u003eRegistry name is the first segment of image identifier, with \u0026lsquo;docker.io\u0026rsquo;\nbeing default one.\u003c/p\u003e\n" + }, + "config": { + "patternProperties": { + ".*": { + "$ref": "#/$defs/RegistryConfig" + } + }, + "type": "object", + "title": "config", + "description": "Specifies TLS \u0026amp; auth configuration for HTTPS image registries.\nMutual TLS can be enabled with ‘clientIdentity’ option.\n\nThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key * can’t be used for TLS configuration.\n\nTLS configuration can be skipped if registry has trusted\nserver certificate.\n", + "markdownDescription": "Specifies TLS \u0026 auth configuration for HTTPS image registries.\nMutual TLS can be enabled with 'clientIdentity' option.\n\nThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key `*` can't be used for TLS configuration.\n\nTLS configuration can be skipped if registry has trusted\nserver certificate.", + "x-intellij-html-description": "\u003cp\u003eSpecifies TLS \u0026amp; auth configuration for HTTPS image registries.\nMutual TLS can be enabled with \u0026lsquo;clientIdentity\u0026rsquo; option.\u003c/p\u003e\n\n\u003cp\u003eThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key \u003ccode\u003e*\u003c/code\u003e can\u0026rsquo;t be used for TLS configuration.\u003c/p\u003e\n\n\u003cp\u003eTLS configuration can be skipped if registry has trusted\nserver certificate.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryAuthConfig": { + "properties": { + "username": { + "type": "string", + "title": "username", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "password": { + "type": "string", + "title": "password", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "auth": { + "type": "string", + "title": "auth", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "identityToken": { + "type": "string", + "title": "identityToken", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryConfig": { + "properties": { + "tls": { + "$ref": "#/$defs/RegistryTLSConfig", + "title": "tls", + "description": "The TLS configuration for the registry.\n", + "markdownDescription": "The TLS configuration for the registry.", + "x-intellij-html-description": "\u003cp\u003eThe TLS configuration for the registry.\u003c/p\u003e\n" + }, + "auth": { + "$ref": "#/$defs/RegistryAuthConfig", + "title": "auth", + "description": "The auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.\n", + "markdownDescription": "The auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.", + "x-intellij-html-description": "\u003cp\u003eThe auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryKubernetesConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable Kubernetes discovery registry.\n", + "markdownDescription": "Disable Kubernetes discovery registry.", + "x-intellij-html-description": "\u003cp\u003eDisable Kubernetes discovery registry.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryMirrorConfig": { + "properties": { + "endpoints": { + "items": { + "type": "string" + }, + "type": "array", + "title": "endpoints", + "description": "List of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to /v2).\n", + "markdownDescription": "List of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to `/v2`).", + "x-intellij-html-description": "\u003cp\u003eList of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to \u003ccode\u003e/v2\u003c/code\u003e).\u003c/p\u003e\n" + }, + "overridePath": { + "type": "boolean", + "title": "overridePath", + "description": "Use the exact path specified for the endpoint (don’t append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.\n", + "markdownDescription": "Use the exact path specified for the endpoint (don't append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.", + "x-intellij-html-description": "\u003cp\u003eUse the exact path specified for the endpoint (don\u0026rsquo;t append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryServiceConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable external service discovery registry.\n", + "markdownDescription": "Disable external service discovery registry.", + "x-intellij-html-description": "\u003cp\u003eDisable external service discovery registry.\u003c/p\u003e\n" + }, + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "External service endpoint.\n", + "markdownDescription": "External service endpoint.", + "x-intellij-html-description": "\u003cp\u003eExternal service endpoint.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryTLSConfig": { + "properties": { + "clientIdentity": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "clientIdentity", + "description": "Enable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.\n", + "markdownDescription": "Enable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.", + "x-intellij-html-description": "\u003cp\u003eEnable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.\u003c/p\u003e\n" + }, + "ca": { + "type": "string", + "title": "ca", + "description": "CA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.\n", + "markdownDescription": "CA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.", + "x-intellij-html-description": "\u003cp\u003eCA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.\u003c/p\u003e\n" + }, + "insecureSkipVerify": { + "type": "boolean", + "title": "insecureSkipVerify", + "description": "Skip TLS server certificate verification (not recommended).\n", + "markdownDescription": "Skip TLS server certificate verification (not recommended).", + "x-intellij-html-description": "\u003cp\u003eSkip TLS server certificate verification (not recommended).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ResourcesConfig": { + "properties": { + "requests": { + "$ref": "#/$defs/Unstructured", + "title": "requests", + "description": "Requests configures the reserved cpu/memory resources.\n", + "markdownDescription": "Requests configures the reserved cpu/memory resources.", + "x-intellij-html-description": "\u003cp\u003eRequests configures the reserved cpu/memory resources.\u003c/p\u003e\n" + }, + "limits": { + "$ref": "#/$defs/Unstructured", + "title": "limits", + "description": "Limits configures the maximum cpu/memory resources a container can use.\n", + "markdownDescription": "Limits configures the maximum cpu/memory resources a container can use.", + "x-intellij-html-description": "\u003cp\u003eLimits configures the maximum cpu/memory resources a container can use.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Route": { + "properties": { + "network": { + "type": "string", + "title": "network", + "description": "The route’s network (destination).\n", + "markdownDescription": "The route's network (destination).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s network (destination).\u003c/p\u003e\n" + }, + "gateway": { + "type": "string", + "title": "gateway", + "description": "The route’s gateway (if empty, creates link scope route).\n", + "markdownDescription": "The route's gateway (if empty, creates link scope route).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s gateway (if empty, creates link scope route).\u003c/p\u003e\n" + }, + "source": { + "type": "string", + "title": "source", + "description": "The route’s source address (optional).\n", + "markdownDescription": "The route's source address (optional).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s source address (optional).\u003c/p\u003e\n" + }, + "metric": { + "type": "integer", + "title": "metric", + "description": "The optional metric for the route.\n", + "markdownDescription": "The optional metric for the route.", + "x-intellij-html-description": "\u003cp\u003eThe optional metric for the route.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The optional MTU for the route.\n", + "markdownDescription": "The optional MTU for the route.", + "x-intellij-html-description": "\u003cp\u003eThe optional MTU for the route.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "STP": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Whether Spanning Tree Protocol (STP) is enabled.\n", + "markdownDescription": "Whether Spanning Tree Protocol (STP) is enabled.", + "x-intellij-html-description": "\u003cp\u003eWhether Spanning Tree Protocol (STP) is enabled.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "SchedulerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the scheduler manifest.\n", + "markdownDescription": "The container image used in the scheduler manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the scheduler manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the scheduler.\n", + "markdownDescription": "Extra arguments to supply to the scheduler.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the scheduler.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the scheduler static pod.\n", + "markdownDescription": "Extra volumes to mount to the scheduler static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the scheduler static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the scheduler resources.\n", + "markdownDescription": "Configure the scheduler resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the scheduler resources.\u003c/p\u003e\n" + }, + "config": { + "type": "object", + "title": "config", + "description": "Specify custom kube-scheduler configuration.\n", + "markdownDescription": "Specify custom kube-scheduler configuration.", + "x-intellij-html-description": "\u003cp\u003eSpecify custom kube-scheduler configuration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "SystemDiskEncryptionConfig": { + "properties": { + "state": { + "$ref": "#/$defs/EncryptionConfig", + "title": "state", + "description": "State partition encryption.\n", + "markdownDescription": "State partition encryption.", + "x-intellij-html-description": "\u003cp\u003eState partition encryption.\u003c/p\u003e\n" + }, + "ephemeral": { + "$ref": "#/$defs/EncryptionConfig", + "title": "ephemeral", + "description": "Ephemeral partition encryption.\n", + "markdownDescription": "Ephemeral partition encryption.", + "x-intellij-html-description": "\u003cp\u003eEphemeral partition encryption.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "TimeConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Indicates if the time service is disabled for the machine.\nDefaults to false.\n", + "markdownDescription": "Indicates if the time service is disabled for the machine.\nDefaults to `false`.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the time service is disabled for the machine.\nDefaults to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n" + }, + "servers": { + "items": { + "type": "string" + }, + "type": "array", + "title": "servers", + "description": "Specifies time (NTP) servers to use for setting the system time.\nDefaults to pool.ntp.org\n", + "markdownDescription": "Specifies time (NTP) servers to use for setting the system time.\nDefaults to `pool.ntp.org`", + "x-intellij-html-description": "\u003cp\u003eSpecifies time (NTP) servers to use for setting the system time.\nDefaults to \u003ccode\u003epool.ntp.org\u003c/code\u003e\u003c/p\u003e\n" + }, + "bootTimeout": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "bootTimeout", + "description": "Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to “infinity” (waiting forever for time sync)\n", + "markdownDescription": "Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to \"infinity\" (waiting forever for time sync)", + "x-intellij-html-description": "\u003cp\u003eSpecifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to \u0026ldquo;infinity\u0026rdquo; (waiting forever for time sync)\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "UdevConfig": { + "properties": { + "rules": { + "items": { + "type": "string" + }, + "type": "array", + "title": "rules", + "description": "List of udev rules to apply to the udev system\n", + "markdownDescription": "List of udev rules to apply to the udev system", + "x-intellij-html-description": "\u003cp\u003eList of udev rules to apply to the udev system\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "VIPEquinixMetalConfig": { + "properties": { + "apiToken": { + "type": "string", + "title": "apiToken", + "description": "Specifies the Equinix Metal API Token.\n", + "markdownDescription": "Specifies the Equinix Metal API Token.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Equinix Metal API Token.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "VIPHCloudConfig": { + "properties": { + "apiToken": { + "type": "string", + "title": "apiToken", + "description": "Specifies the Hetzner Cloud API Token.\n", + "markdownDescription": "Specifies the Hetzner Cloud API Token.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Hetzner Cloud API Token.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Vlan": { + "properties": { + "addresses": { + "items": { + "type": "string" + }, + "type": "array", + "title": "addresses", + "description": "The addresses in CIDR notation or as plain IPs to use.\n", + "markdownDescription": "The addresses in CIDR notation or as plain IPs to use.", + "x-intellij-html-description": "\u003cp\u003eThe addresses in CIDR notation or as plain IPs to use.\u003c/p\u003e\n" + }, + "routes": { + "items": { + "$ref": "#/$defs/Route" + }, + "type": "array", + "title": "routes", + "description": "A list of routes associated with the VLAN.\n", + "markdownDescription": "A list of routes associated with the VLAN.", + "x-intellij-html-description": "\u003cp\u003eA list of routes associated with the VLAN.\u003c/p\u003e\n" + }, + "dhcp": { + "type": "boolean", + "title": "dhcp", + "description": "Indicates if DHCP should be used.\n", + "markdownDescription": "Indicates if DHCP should be used.", + "x-intellij-html-description": "\u003cp\u003eIndicates if DHCP should be used.\u003c/p\u003e\n" + }, + "vlanId": { + "type": "integer", + "title": "vlanId", + "description": "The VLAN’s ID.\n", + "markdownDescription": "The VLAN's ID.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s ID.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The VLAN’s MTU.\n", + "markdownDescription": "The VLAN's MTU.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s MTU.\u003c/p\u003e\n" + }, + "vip": { + "$ref": "#/$defs/DeviceVIPConfig", + "title": "vip", + "description": "The VLAN’s virtual IP address configuration.\n", + "markdownDescription": "The VLAN's virtual IP address configuration.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s virtual IP address configuration.\u003c/p\u003e\n" + }, + "dhcpOptions": { + "$ref": "#/$defs/DHCPOptions", + "title": "dhcpOptions", + "description": "DHCP specific options.\ndhcp must be set to true for these to take effect.\n", + "markdownDescription": "DHCP specific options.\n`dhcp` *must* be set to true for these to take effect.", + "x-intellij-html-description": "\u003cp\u003eDHCP specific options.\n\u003ccode\u003edhcp\u003c/code\u003e \u003cem\u003emust\u003c/em\u003e be set to true for these to take effect.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "VolumeMountConfig": { + "properties": { + "hostPath": { + "type": "string", + "title": "hostPath", + "description": "Path on the host.\n", + "markdownDescription": "Path on the host.", + "x-intellij-html-description": "\u003cp\u003ePath on the host.\u003c/p\u003e\n" + }, + "mountPath": { + "type": "string", + "title": "mountPath", + "description": "Path in the container.\n", + "markdownDescription": "Path in the container.", + "x-intellij-html-description": "\u003cp\u003ePath in the container.\u003c/p\u003e\n" + }, + "readonly": { + "type": "boolean", + "title": "readonly", + "description": "Mount the volume read only.\n", + "markdownDescription": "Mount the volume read only.", + "x-intellij-html-description": "\u003cp\u003eMount the volume read only.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + } + } +} \ No newline at end of file diff --git a/website/content/v1.12/talos-guides/_index.md b/website/content/v1.12/talos-guides/_index.md new file mode 100644 index 000000000..1596f8566 --- /dev/null +++ b/website/content/v1.12/talos-guides/_index.md @@ -0,0 +1,5 @@ +--- +title: Talos Linux Guides +weight: 20 +description: "Documentation on how to manage Talos Linux" +--- diff --git a/website/content/v1.12/talos-guides/configuration/_index.md b/website/content/v1.12/talos-guides/configuration/_index.md new file mode 100644 index 000000000..a3ced180e --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/_index.md @@ -0,0 +1,5 @@ +--- +title: "Configuration" +weight: 20 +description: "Guides on how to configure Talos Linux machines" +--- diff --git a/website/content/v1.12/talos-guides/configuration/certificate-authorities.md b/website/content/v1.12/talos-guides/configuration/certificate-authorities.md new file mode 100644 index 000000000..cb784bbd6 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/certificate-authorities.md @@ -0,0 +1,28 @@ +--- +title: "Custom Certificate Authorities" +description: "How to supply custom certificate authorities" +aliases: + - ../../guides/configuring-certificate-authorities +--- + +## Appending the Certificate Authority + +Append additional certificate authorities to the system's trusted certificate store by [patching]({{< relref "./patching" >}}) the machine configuration with the following +[document]({{< relref "../../reference/configuration/security/trustedrootsconfig" >}}): + +```yaml +apiVersion: v1alpha1 +kind: TrustedRootsConfig +name: custom-ca +certificates: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- +``` + +Multiple documents can be appended, and multiple CA certificates might be present in each configuration document. + +This configuration can be also applied in maintenance mode. + +Please note that if the `STATE` partition is encrypted, the CA certificates will be only be loaded after the partition is unlocked. +So the encryption method should allow unlocking the partition without the need for a CA certificate. diff --git a/website/content/v1.12/talos-guides/configuration/containerd.md b/website/content/v1.12/talos-guides/configuration/containerd.md new file mode 100644 index 000000000..5090926e8 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/containerd.md @@ -0,0 +1,101 @@ +--- +title: "Containerd" +description: "Customize Containerd Settings" +aliases: + - ../../guides/configuring-containerd +--- + +The base containerd configuration expects to merge in any additional configs present in `/etc/cri/conf.d/20-customization.part`. + +## Examples + +### Exposing Metrics + +Patch the machine config by adding the following: + +```yaml +machine: + files: + - content: | + [metrics] + address = "0.0.0.0:11234" + path: /etc/cri/conf.d/20-customization.part + op: create +``` + +Once the server reboots, metrics are now available: + +```bash +$ curl ${IP}:11234/v1/metrics +# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive +# TYPE container_blkio_io_service_bytes_recursive_bytes gauge +container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 +container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 +... +... +``` + +### Pause Image + +This change is often required for air-gapped environments, as `containerd` CRI plugin has a reference to the `pause` image which is used +to create pods, and it can't be controlled with Kubernetes pod definitions. + +```yaml +machine: + files: + - content: | + [plugins] + [plugins."io.containerd.cri.v1.images".pinned_images] + sandbox = "registry.k8s.io/pause:3.8" + path: /etc/cri/conf.d/20-customization.part + op: create +``` + +Now the `pause` image is set to `registry.k8s.io/pause:3.8`: + +```bash +$ talosctl containers --kubernetes +NODE NAMESPACE ID IMAGE PID STATUS +172.20.0.5 k8s.io kube-system/kube-flannel-6hfck registry.k8s.io/pause:3.8 1773 SANDBOX_READY +172.20.0.5 k8s.io └─ kube-system/kube-flannel-6hfck:install-cni:bc39fec3cbac ghcr.io/siderolabs/install-cni:v1.3.0-alpha.0-2-gb155fa0 0 CONTAINER_EXITED +172.20.0.5 k8s.io └─ kube-system/kube-flannel-6hfck:install-config:5c3989353b98 ghcr.io/siderolabs/flannel:v0.20.1 0 CONTAINER_EXITED +172.20.0.5 k8s.io └─ kube-system/kube-flannel-6hfck:kube-flannel:116c67b50da8 ghcr.io/siderolabs/flannel:v0.20.1 2092 CONTAINER_RUNNING +172.20.0.5 k8s.io kube-system/kube-proxy-xp7jq registry.k8s.io/pause:3.8 1780 SANDBOX_READY +172.20.0.5 k8s.io └─ kube-system/kube-proxy-xp7jq:kube-proxy:84fc77c59e17 registry.k8s.io/kube-proxy:v1.26.0-alpha.3 1843 CONTAINER_RUNNING +``` + +### Set CDI plugin Spec Dirs to writable directories + +By default Containerd configures CDI to read discovered hardware devices from `["/etc/cdi", "/var/run/cdi"]`. +Since /etc is not writable in Talos, CDI does not work for Dynamic Resource Allocation out of the box. +To be able to use CDI and DRA modify the cdi spec dirs to writable locations like so: + +```yaml +machine: + files: + - path: /etc/cri/conf.d/20-customization.part + op: create + content: | + [plugins."io.containerd.cri.v1.runtime"] + cdi_spec_dirs = ["/var/cdi/static", "/var/cdi/dynamic"] +``` + +Also change the cdi spec dirs configuration in your Dynamic Resource Allocation driver, since it needs to place the discovered hardware device specs in these folders. + +### Enabling NRI Plugins + +By default, Talos disables [NRI](https://github.com/containerd/containerd/blob/main/docs/NRI.md) plugins in `containerd`, as they might have security implications. +However, if you need to enable them, you can do so by adding the following configuration: + +```yaml +machine: + files: + - content: | + [plugins] + [plugins."io.containerd.nri.v1.nri"] + disable = false + path: /etc/cri/conf.d/20-customization.part + op: create +``` + +After applying the configuration, the NRI plugins can be deployed, for example plugins from [this repository](https://containers.github.io/nri-plugins/stable/docs/index.html). diff --git a/website/content/v1.12/talos-guides/configuration/disk-encryption.md b/website/content/v1.12/talos-guides/configuration/disk-encryption.md new file mode 100644 index 000000000..d1c139d1b --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-encryption.md @@ -0,0 +1,238 @@ +--- +title: "Disk Encryption" +description: "Guide on using disk encryption" +aliases: + - ../../guides/disk-encryption +--- + +Talos Linux supports disk encryption for system volumes, and for user volumes. + +System volumes include the `STATE` and `EPHEMERAL` partitions: + +- `STATE` contains the most sensitive node data: secrets and certs. +- `EPHEMERAL` may contain sensitive workload data. + +Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. +The operating system will run additional setup steps when encryption is enabled. + +If the disk encryption is enabled for the `STATE` partition, the system will: + +- Save `STATE` encryption config as JSON in the `META` partition. +- Before mounting the `STATE` partition, load encryption configs either from the machine config or from the `META` partition. + Note that the machine config is always preferred over the `META` one. +- Before mounting the `STATE` partition, format and encrypt it. + This occurs only if the `STATE` partition is empty and has no filesystem. + +If the disk encryption is enabled for the `EPHEMERAL` partition, the system will: + +- Get the encryption config from the machine config. +- Before mounting the `EPHEMERAL` partition, encrypt and format it. + This occurs only if the `EPHEMERAL` partition is empty and has no filesystem. + +Talos Linux supports four encryption methods, which can be combined together for a single partition: + +- `static` - encrypt with the static passphrase (weakest protection, for `STATE` partition encryption it means that the passphrase will be stored in the `META` partition). +- `nodeID` - encrypt with the key derived from the node UUID (weak, it is designed to protect against data being leaked or recovered from a drive that has been removed from a Talos Linux node). +- `kms` - encrypt using key sealed with network KMS (strong, but requires network access to decrypt the data.) +- `tpm` - encrypt with the key derived from the TPM (strong, when used with [SecureBoot]({{< relref "../install/bare-metal-platforms/secureboot" >}})). + +> Note: `nodeID` encryption is not designed to protect against attacks where physical access to the machine, including the drive, is available. +> It uses the hardware characteristics of the machine in order to decrypt the data, so drives that have been removed, or recycled from a cloud environment or attached to a different virtual machine, will maintain their protection and encryption. +> +> Note: When using KMS encryption for `STATE` partition the network configuration can't be provided via the machine configuration, as KMS requires network connectivity before `STATE` partition is unlocked. +> Also custom CA certificates cannot be used for the KMS server, as these are stored in the `STATE` partition as well. + +## Configuration + +Disk encryption is disabled by default. + +For system volumes, disk encryption is configured with the [`VolumeConfig`]({{< relref "../../reference/configuration/block/volumeconfig" >}}) machine configuration document, +while for user volumes it is configured with the [`UserVolumeConfig`]({{< relref "../../reference/configuration/block/uservolumeconfig" >}}) document. + +To enable disk encryption you should patch the machine configuration, for example for the `STATE` and `EPHEMERAL` partitions using `nodeID` encryption: + +```yaml +apiVersion: v1alpha1 +kind: VolumeConfig +name: STATE +encryption: + provider: luks2 + keys: + - nodeID: {} + slot: 0 +--- +apiVersion: v1alpha1 +kind: VolumeConfig +name: EPHEMERAL +encryption: + provider: luks2 + keys: + - nodeID: {} + slot: 0 +``` + +For user volumes, the configuration is similar, but you should use the `UserVolumeConfig` kind: + +```yaml +apiVersion: v1alpha1 +kind: UserVolumeConfig +name: my-user-volume +encryption: + provider: luks2 + keys: + - nodeID: {} + slot: 0 +``` + +### Encryption Keys + +> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. +> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. + +LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. +Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. +So if you update the keys list, keep at least one key that is not changed to be used for key management. + +When you define a key you should specify the key kind and the `slot`: + +```yaml +apiVersion: v1alpha1 +kind: VolumeConfig +name: STATE +encryption: + keys: + - nodeID: {} # key kind + slot: 1 +--- +apiVersion: v1alpha1 +kind: VolumeConfig +name: EPHEMERAL +encryption: + keys: + - static: + passphrase: supersecret + slot: 0 + lockToSTATE: true +``` + +Take a note that key order does not play any role on which key slot is used. +Every key must always have a slot defined. + +### Encryption Key Kinds + +Talos supports two kinds of keys: + +- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). +- `static` which you define right in the configuration. +- `kms` which is sealed with the network KMS. +- `tpm` which is sealed using the TPM and protected with SecureBoot. + +> Note: The `STATE` volume encryption configuration will be stored cleartext in `META` volume, so +> it is not secure to use `static` keys for `STATE` volume. +> Other volumes can use `static` keys as long as `STATE` partition itself is encrypted. + +Every key kind also supports `lockToSTATE` option, which means that the key will be locked to the contents of the `STATE` partition: + +- if the `STATE` partition is wiped/replaced with new contents, locked to `STATE` volumes will not be unlockable anymore. +- Talos Linux generates a random salt, and stores in the `STATE` partition, which will be mixed into the key derivation function. + +It is recommended to use `lockToSTATE` for the `EPHEMERAL` partition and user volumes, so that the data on these partitions is not accessible if the `STATE` partition is wiped or replaced. +If you would like non-`STATE` volumes to survive `STATE` partition wipe, do not enable `lockToSTATE` option. + +### Key Rotation + +In order to completely rotate keys, it is necessary to do `talosctl apply-config` a couple of times, since there is a need to always maintain a single working key while changing the other keys around it. + +Key rotation can only be handled after a reboot, so the system can re-encrypt the partitions with the new keys, and some encryption types (TPM) can only be used after the initial boot. + +So, for example, first add a new key: + +```yaml +apiVersion: v1alpha1 +kind: VolumeConfig +name: EPHEMERAL +encryption: + keys: + - static: + passphrase: oldkey + slot: 0 + - static: + passphrase: newkey + slot: 1 +``` + +Run: + +```bash +talosctl apply-config -n --mode=reboot -f config.yaml +``` + +Then remove the old key: + +```yaml +apiVersion: v1alpha1 +kind: VolumeConfig +name: EPHEMERAL +encryption: + keys: + - static: + passphrase: newkey + slot: 1 +``` + +Run: + +```bash +talosctl apply-config -n --mode=reboot -f config.yaml +``` + +## Going from Unencrypted to Encrypted and Vice Versa + +### Ephemeral Partition + +There is no in-place encryption support for the partitions right now, so to avoid losing data only empty partitions can be encrypted. + +As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. + +- `apply-config` should be called with `--mode=staged`. +- Partition should be wiped after `apply-config`, but before the reboot. + +Edit your machine config and add the encryption configuration: + +```bash +vim config.yaml +``` + +Apply the configuration with `--mode=staged`: + +```bash +talosctl apply-config -f config.yaml -n --mode=staged +``` + +Wipe the partition you're going to encrypt: + +```bash +talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true +``` + +That's it! +After you run the last command, the partition will be wiped and the node will reboot. +During the next boot the system will encrypt the partition. + +### State Partition + +Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. + +The flow should be to first wipe the STATE partition: + +```bash +talosctl reset --system-labels-to-wipe STATE -n --reboot=true +``` + +Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: + +```bash +talosctl apply-config --insecure -n -f config.yaml +``` + +After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v1.12/talos-guides/configuration/disk-management/_index.md b/website/content/v1.12/talos-guides/configuration/disk-management/_index.md new file mode 100644 index 000000000..7fd6c02b4 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-management/_index.md @@ -0,0 +1,29 @@ +--- +title: "Disk Management" +description: "Guide on managing disks" +aliases: + - ../../guides/disk-management +--- + +This guide provides an overview of the disk management features in Talos Linux. + +## Disk and Volume Discovery + +See [Disk Layout]({{< relref "layout" >}}) for details on the disk layout and how to observe discovered disks and volumes. + +## Volume Management + +Talos Linux implements disk management through the concept of volumes. +A volume represents a provisioned, located, mounted, or unmounted entity, such as a disk, partition, or a directory/overlay mount. + +Talos Linux has [built-in (system) volumes]({{< relref "system" >}}), which can be partially configured by the user, and user-defined volumes, which are fully configurable by the user. +User volumes come in several flavors: + +* [User Volumes]({{< relref "user" >}}) - for dynamically allocated local storage for Kubernetes workloads. +* [Raw Volumes]({{< relref "raw" >}}) - for allocating unformatted storage (e.g. to be used with CSIs). +* [Existing Volumes]({{< relref "existing" >}}) - for mounting pre-existing partitions or disks. + +For information on allocating swap space, see [Swap Management]({{< relref "../swap" >}}). + +Configuration documents related to volume management are located in the [`block` group]({{< relref "../../../reference/configuration/block" >}}), see [common configuration]({{< relref "common" >}}) for common fields +in volume configuration documents. diff --git a/website/content/v1.12/talos-guides/configuration/disk-management/common.md b/website/content/v1.12/talos-guides/configuration/disk-management/common.md new file mode 100644 index 000000000..28a8b3b33 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-management/common.md @@ -0,0 +1,131 @@ +--- +title: "Common Configuration" +description: "Common elements of volume configuration." +weight: 100 +--- + +Several configuration documents share common elements for configuring volumes in Talos Linux: + +* [`VolumeConfig`]({{< relref "../../../reference/configuration/block/volumeconfig" >}}) +* [`UserVolumeConfig`]({{< relref "../../../reference/configuration/block/uservolumeconfig" >}}) +* [`RawVolumeConfig`]({{< relref "../../../reference/configuration/block/rawvolumeconfig" >}}) +* [`SwapVolumeConfig`]({{< relref "../../../reference/configuration/block/swapvolumeconfig" >}}) + +## Disk Selector + +The `diskSelector` field is utilized to choose the disk where the volume will be provisioned. +It is a [Common Expression Language (CEL)](https://cel.dev/) expression that evaluates against the available disks. +The volume will be provisioned on the first disk that matches the expression and has sufficient free space for the volume. + +The expression is evaluated in the following context: + +* `system_disk` (`bool`) - indicates if the disk is the system disk +* `disk` (`Disks.block.talos.dev`) - the disk resource being evaluated + +> Note: The `system_disk` variable is only populated after Talos installation, so you might see an error about `system_disk` not being defined +> before installation finishes. + +For the disk resource, any field available in the resource specification can be used (use `talosctl get disks -o yaml` to see the output for your machine): + +```yaml +dev_path: /dev/nvme0n1 +size: 10485760000 +pretty_size: 10 GB +io_size: 512 +sector_size: 512 +readonly: false +cdrom: false +model: QEMU NVMe Ctrl +serial: deadbeef +wwid: nvme.1b36-6465616462656566-51454d55204e564d65204374726c-00000001 +bus_path: /pci0000:00/0000:00:09.0/nvme +sub_system: /sys/class/block +transport: nvme +symlinks: + - /dev/disk/by-diskseq/11 + - /dev/disk/by-id/ata-QEMU_HARDDISK_QM00001 + - /dev/disk/by-path/pci-0000:00:1f.2-ata-1 + - /dev/disk/by-path/pci-0000:00:1f.2-ata-1.0 +``` + +Additionally, constants for disk size multipliers are available: + +* `KiB`, `MiB`, `GiB`, `TiB`, `PiB`, `EiB` - binary size multipliers (1024) +* `kB`, `MB`, `GB`, `TB`, `PB`, `EB` - decimal size multipliers (1000) + +The disk expression is evaluated against each available disk, and the expression should either return `true` or `false`. +If the expression returns `true`, the disk is selected for provisioning. + +> Note: In CEL, signed and unsigned integers are not interchangeable. +> Disk sizes are represented as unsigned integers, so suffix `u` should be used in constants to avoid type mismatch, e.g. `disk.size > 10u * GiB`. + +Examples of disk selector expressions: + +* `disk.transport == 'nvme'`: select the NVMe disks only +* `disk.transport == 'scsi' && disk.size < 2u * TiB`: select SCSI disks smaller than 2 TiB +* `disk.serial.startsWith('deadbeef') && !cdrom`: select disks with serial number starting with `deadbeef` and not of CD-ROM type +* `'/dev/disk/by-path/pci-0000:00:1f.2-ata-1' in disk.symlinks`: select disks with a specific stable symlink + +## Minimum and Maximum Size + +The `minSize` and `maxSize` fields define the minimum and maximum size of the volume, respectively. +Talos Linux will always ensure that the volume is at least `minSize` in size and will not exceed `maxSize`. +If `maxSize` is not set, the volume will grow to utilize the maximum available space on the disk. + +If `grow` is set to `true`, the volume will automatically grow to utilize the maximum available space on the disk on each boot. + +Setting `minSize` might influence disk selection - if the disk does not have enough free space to satisfy the minimum size requirement, it will not be selected for provisioning. + +## Volume Selector + +The `volumeSelector` field is a CEL expression that allows you to match existing volumes based on their properties. +It is evaluated against the available volumes, and the first volume that matches the expression will be picked up. + +The expression is evaluated in the following context: + +* `volume` (`DiscoveredVolumes.block.talos.dev`) - the volume resource being evaluated +* `disk` (`Disks.block.talos.dev`) - the disk resource where the volume is located + +For the `disk` field, see [Disk Selector](#disk-selector) above. +For the `volume` field, any field available in the resource specification can be used (use `talosctl get discoveredvolumes -o yaml` to see the output for your machine): + +```yaml +metadata: + namespace: runtime + type: DiscoveredVolumes.block.talos.dev + id: vda4 + version: 1 + owner: block.DiscoveryController + phase: running + created: 2025-07-21T13:10:56Z + updated: 2025-07-21T13:10:56Z +spec: + dev_path: /dev/vda4 + type: partition + device_path: /sys/devices/pci0000:00/0000:00:07.0/virtio4/block/vda/vda4 + parent: vda + parent_dev_path: /dev/vda + size: 5179965440 + pretty_size: 5.2 GB + sector_size: 512 + io_size: 512 + name: xfs + uuid: 2f115241-781f-4817-a373-fc957d63326f + label: EPHEMERAL + block_size: 512 + filesystem_block_size: 4096 + probed_size: 5112856576 + partition_uuid: 73111630-87ed-4aad-bffb-af6d0f55ab3c + partition_type: 0fc63daf-8483-4772-8e79-3d69d8477de4 + partition_label: EPHEMERAL + partition_index: 4 +``` + +The size multipliers constants are also available for the volume selector expression. + +Examples of volume selector expressions: + +* `volume.partition_label == 'MY-DATA'`: match volumes with partition label `MY-DATA` +* `volume.name == 'xfs' && volume.size > 1000u * TB`: match XFS volumes larger than 1000 TB +* `volume.name == 'xfs' && disk.transport == 'nvme'`: match XFS volumes on NVMe disks +* `volume.partition_index == 2 && disk.serial == 'SERIAL123'`: match second partition on a disk with serial number `SERIAL123` diff --git a/website/content/v1.12/talos-guides/configuration/disk-management/existing.md b/website/content/v1.12/talos-guides/configuration/disk-management/existing.md new file mode 100644 index 000000000..2f9d3ad29 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-management/existing.md @@ -0,0 +1,48 @@ +--- +title: "Existing Volumes" +description: "Configuring existing volumes to mount migrated or pre-existing partitions and disks." +weight: 50 +--- + +Existing volumes allow mounting pre-existing partitions or disks that are already formatted and contain data. +This is useful for migrating data from another system or reusing existing disks without reformatting them. + +Existing volumes match a partition or a disk using a [volume selector]({{< relref "common#volume-selector" >}}) expression. + +Existing volumes are mounted under `/var/mnt/`, and this location gets automatically propagated into the `kubelet` container to provide additional features like `subPath` mounts. + +> Note: If you need to allocate a volume to be mounted to a container, please see [User Volumes]({{< relref "user" >}}) guide. + +### Declaring Existing Volumes + +To declare an existing volume, append the following [document]({{< relref "../../../reference/configuration/block/existingvolumeconfig" >}}) to the machine configuration: + +```yaml +# existing-volume.patch.yaml +apiVersion: v1alpha1 +kind: ExistingVolumeConfig +name: my-data-volume +discovery: + volumeSelector: + match: volume.partition_label == "MY-DATA" + +``` + +For example, this machine configuration patch can be applied using the following command: + +```bash +talosctl --nodes patch mc --patch @raw-volume.patch.yaml +``` + +In this example, a existing partition with partition label `MY-DATA` will be mounted as under `/var/mnt/my-data-volume`. + +The status of the volume can be checked using the following command: + +```bash +$ talosctl get volumestatus e-my-data-volume # note e- prefix +NODE NAMESPACE TYPE ID VERSION TYPE PHASE LOCATION SIZE +172.20.0.5 runtime VolumeStatus e-my-data-volume 1 partition ready /dev/sda1 2.0 GB +``` + +If the volume is no longer needed, it can be removed by deleting the `ExistingVolumeConfig` document from the machine configuration. +Talos will automatically unmount the volume, but it will not try to wipe the underlying data. diff --git a/website/content/v1.12/talos-guides/configuration/disk-management/layout.md b/website/content/v1.12/talos-guides/configuration/disk-management/layout.md new file mode 100644 index 000000000..433f79772 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-management/layout.md @@ -0,0 +1,159 @@ +--- +title: "Disk Layout" +description: "Guide on disk layout, observing discovered disks and volumes." +weight: 10 +--- + +Talos Linux provides tools to observe available disks and volumes on the machine. + +## Listing Disks + +To obtain a list of all available block devices (disks) on the machine, you can use the following command: + +```bash +$ talosctl get disks +NODE NAMESPACE TYPE ID VERSION SIZE READ ONLY TRANSPORT ROTATIONAL WWID MODEL SERIAL +172.20.0.5 runtime Disk loop0 1 75 MB true +172.20.0.5 runtime Disk nvme0n1 1 10 GB false nvme nvme.1b36-6465616462656566-51454d55204e564d65204374726c-00000001 QEMU NVMe Ctrl deadbeef +172.20.0.5 runtime Disk sda 1 10 GB false virtio true QEMU HARDDISK +172.20.0.5 runtime Disk sdb 1 10 GB false sata true t10.ATA QEMU HARDDISK QM00013 QEMU HARDDISK +172.20.0.5 runtime Disk sdc 1 10 GB false sata true t10.ATA QEMU HARDDISK QM00001 QEMU HARDDISK +172.20.0.5 runtime Disk vda 1 13 GB false virtio true +``` + +To obtain detailed information about a specific disk, execute the following command: + +```yaml +# talosctl get disk sda -o yaml +node: 172.20.0.5 +metadata: + namespace: runtime + type: Disks.block.talos.dev + id: sda + version: 1 + owner: block.DisksController + phase: running + created: 2024-08-29T13:06:43Z + updated: 2024-08-29T13:06:43Z +spec: + dev_path: /dev/sda + size: 10485760000 + human_size: 10 GB + io_size: 512 + sector_size: 512 + readonly: false + cdrom: false + model: QEMU HARDDISK + modalias: scsi:t-0x00 + bus_path: /pci0000:00/0000:00:07.0/virtio4/host1/target1:0:0/1:0:0:0 + sub_system: /sys/class/block + transport: virtio + rotational: true + symlinks: + - /dev/disk/by-diskseq/10 + - /dev/disk/by-path/pci-0000:00:07.0 + - /dev/disk/by-path/virtio-pci-0000:00:07.0 +``` + +## Discovered Volumes + +Talos Linux monitors all block devices and partitions on the machine. +Details about these devices, including their type, can be found in the `DiscoveredVolume` resource. + +```bash +$ talosctl get discoveredvolumes +NODE NAMESPACE TYPE ID VERSION TYPE SIZE DISCOVERED LABEL PARTITIONLABEL +172.20.0.5 runtime DiscoveredVolume dm-0 1 disk 88 MB xfs STATE +172.20.0.5 runtime DiscoveredVolume loop0 1 disk 75 MB squashfs +172.20.0.5 runtime DiscoveredVolume nvme0n1 1 disk 10 GB +172.20.0.5 runtime DiscoveredVolume sda 1 disk 10 GB +172.20.0.5 runtime DiscoveredVolume sdb 1 disk 10 GB +172.20.0.5 runtime DiscoveredVolume sdc 1 disk 2.1 GB gpt +172.20.0.5 runtime DiscoveredVolume sdc1 1 partition 957 MB xfs +172.20.0.5 runtime DiscoveredVolume sdc2 1 partition 957 MB xfs +172.20.0.5 runtime DiscoveredVolume sdd 1 disk 1.0 GB gpt +172.20.0.5 runtime DiscoveredVolume sdd1 1 partition 957 MB xfs +172.20.0.5 runtime DiscoveredVolume sde 1 disk 10 GB +172.20.0.5 runtime DiscoveredVolume vda 1 disk 13 GB gpt +172.20.0.5 runtime DiscoveredVolume vda1 1 partition 105 MB vfat EFI +172.20.0.5 runtime DiscoveredVolume vda2 1 partition 1.0 MB BIOS +172.20.0.5 runtime DiscoveredVolume vda3 1 partition 982 MB xfs BOOT BOOT +172.20.0.5 runtime DiscoveredVolume vda4 2 partition 1.0 MB talosmeta META +172.20.0.5 runtime DiscoveredVolume vda5 1 partition 105 MB luks STATE +172.20.0.5 runtime DiscoveredVolume vda6 1 partition 12 GB xfs EPHEMERAL EPHEMERAL +``` + +Talos Linux has built-in automatic detection for various filesystem types and GPT partition tables. +Currently, the following filesystem types are supported: + +- `bluestore` (Ceph) +- `ext2`, `ext3`, `ext4` +- `iso9660` +- `luks` (LUKS encrypted partition) +- `lvm2` +- `squashfs` +- `swap` +- `talosmeta` (Talos Linux META partition) +- `vfat` +- `xfs` +- `zfs` + +The discovered volumes can include both Talos-managed volumes and any other volumes present on the machine, such as Ceph volumes. + +## Disk Layout + +The default disk layout for Talos installation is as follows: + +```text ++-----------------------------------------------------------------------------+ +| Physical Disk (1TB) | ++=============+===========+==========+========================================+ +| EFI (boot) | META | STATE | EPHEMERAL (spans the rest of the disk) | +| [~1GB] | [~1MB] | [~100MB] | [~998GB] | ++-------------+-----------+----------+----------------------------------------+ +``` + +In this diagram: + +- `EFI`: the EFI partition used for booting the system. +- `META`: the partition used for storing Talos metadata. +- `STATE`: the partition used for storing the system state, including machine configuration. +- `EPHEMERAL`: the partition used for storing container data, downloaded images, logs, `etcd` data (for controlplane nodes) etc. + +Talos Linux hardcodes the partition layout for the `EFI`, `META`, and `STATE` partitions. +The `EPHEMERAL` partition by default consumes all unallocated space, but it can be created on another disk or resized. + +The `EPHEMERAL` partition is a catch-all location for storing data, while it might be desired to segregate the data into different partitions. +Talos supports creating additional user volumes to be used for different purposes: e.g. local storage for various applications, specific volumes per applications, etc. + +### Single Disk Layout + +```text ++-------------------------------------------------------------------------------------------------------+ +| Physical Disk (1TB) | ++=============+===========+==========+============+===========+===============+=========================+ +| EFI (boot) | META | STATE | EPHEMERAL | ceph-data | local-storage | << Unallocated Space >> | +| [~1GB] | [~1MB] | [~100MB] | [~200GB] | [~100GB] | [~200GB] | [~500GB] | ++-------------+-----------+----------+------------+-----------+---------------+-------------------------+ +``` + +In this layout, the `EPHEMERAL` partition was limited to 200GB, and two additional partitions were created for `ceph-data` and `local-storage`. + +### Multiple Disk Layout + +```text ++---------------------------------------------------------------------------------------+ +| Physical Disk 1 (1TB) | ++=============+===========+==========+============+===========+=========================+ +| EFI (boot) | META | STATE | EPHEMERAL | ceph-data | << Unallocated Space >> | +| [~1GB] | [~1MB] | [~100MB] | [~500GB] | [~100GB] | [~400GB] | ++-------------+-----------+----------+------------+-----------+-------------------------+ +| Physical Disk 2 (1TB) | ++===============+=======================================================================+ +| local-storage | << Unallocated Space >> | +| [~500GB] | [~500GB] | ++---------------+-----------------------------------------------------------------------+ +``` + +In this layout, the `EPHEMERAL` partition was limited to 500GB, and two additional partitions were created for `ceph-data` and `local-storage`, +and they were created on different disks. diff --git a/website/content/v1.12/talos-guides/configuration/disk-management/raw.md b/website/content/v1.12/talos-guides/configuration/disk-management/raw.md new file mode 100644 index 000000000..146dccd5d --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-management/raw.md @@ -0,0 +1,73 @@ +--- +title: "Raw Volumes" +description: "Configuring raw volumes to allocate unformatted storage." +weight: 40 +--- + +Raw Volumes allow allocate an unformatted partition, label it, and make it available for use by advanced storage drivers like Container Storage Interface (CSI) drivers. + +When a raw volume configuration is applied, Talos Linux will either locate an existing volume or provision a new one. +The volume will be created on the disk which satisfies the `diskSelector` expression and has enough free space to satisfy the `minSize` requirement. + +The raw volume is identified by a unique name, which is used both as a mount location and as a label for the volume. +The volume name must be unique across all raw volumes, and it should be between 1 and 34 characters long, and can only contain ASCII letters, digits, and `-` (dash) characters. + +The volume label is derived from the volume name as `r-`, and it is used to identify the volume on the disk after initial provisioning. + +Disk encryption can be optionally enabled for raw volumes. + +> Note: If you need to allocate a volume to be mounted to a container, please see [User Volumes]({{< relref "user" >}}) guide. + +### Creating Raw Volumes + +To create a raw volume, append the following [document]({{< relref "../../../reference/configuration/block/rawvolumeconfig" >}}) to the machine configuration: + +```yaml +# raw-volume.patch.yaml +apiVersion: v1alpha1 +kind: RawVolumeConfig +name: openebs-vol1 +provisioning: + diskSelector: + match: "!system_disk" + minSize: 2GB + maxSize: 2GB +``` + +For example, this machine configuration patch can be applied using the following command: + +```bash +talosctl --nodes patch mc --patch @raw-volume.patch.yaml +``` + +In this example, a raw volume named `openebs-vol1` is created on the first disk which is not the system disk and has `2GB` of disk space available. +The volume will be created as a partition with a size of `2GB`. + +The status of the volume can be checked using the following command: + +```bash +$ talosctl get volumestatus r-openebs-vol1 # note r- prefix +NODE NAMESPACE TYPE ID VERSION TYPE PHASE LOCATION SIZE +172.20.0.5 runtime VolumeStatus r-openebs-vol1 1 partition ready /dev/sda1 2.0 GB +``` + +This volume can be referenced using a stable symlink `/dev/disk/by-partlabel/r-openebs-vol1`, which is created automatically by Talos Linux. + +### Removing Raw Volumes + +Before removing a raw volume, ensure that it is not used anymore. + +In order to remove a raw volume, first remove the configuration document from the machine configuration. +The `VolumeStatus` resource will be removed automatically by Talos Linux. + +> Note: The actual disk data hasn't been removed yet, so you can re-apply the raw volume configuration back +> and it will be re-provisioned on the same disk. + +To wipe the disk data, and make it allocatable again, use the following command: + +```bash +talosctl wipe disk sda1 --drop-partition +``` + +The `sda1` is the partition name, and it can be obtained from the `VolumeStatus` resource before the raw volume is removed, +or from the `DiscoveredVolume` resource any time later. diff --git a/website/content/v1.12/talos-guides/configuration/disk-management/resources.md b/website/content/v1.12/talos-guides/configuration/disk-management/resources.md new file mode 100644 index 000000000..19b5d55d5 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-management/resources.md @@ -0,0 +1,164 @@ +--- +title: "Resources" +description: "Resources created by Talos Linux while processing volume configuration." +weight: 200 +--- + +This section contains information about the resources created by Talos Linux to manage volumes on the machine. +This information is useful for understanding how Talos Linux manages volumes and how to debug issues related to volumes. + +## Volumes + +The configuration of volumes is defined using the `VolumeConfig` resource, while the current state of volumes is stored in the `VolumeStatus` resource. + +### Volume Configuration + +The volume configuration is managed by Talos Linux based on machine configuration. +To see configured volumes, use the following command: + +```bash +$ talosctl get volumeconfigs +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 runtime VolumeConfig /etc/cni 2 +172.20.0.2 runtime VolumeConfig /var/run 2 +172.20.0.2 runtime VolumeConfig EPHEMERAL 2 +172.20.0.2 runtime VolumeConfig ETCD 2 +172.20.0.2 runtime VolumeConfig META 2 +172.20.0.2 runtime VolumeConfig STATE 3 +172.20.0.2 runtime VolumeConfig u-extra 2 +172.20.0.2 runtime VolumeConfig u-p1 2 +172.20.0.2 runtime VolumeConfig u-p2 2 +``` + +In the provided output, the volumes `EPHEMERAL`, `META`, and `STATE` are system volumes managed by Talos, while `u-extra`, `u-p1` and `u-p2` are user configured volumes. + +To get details about a specific volume configuration, use the following command: + +```yaml +# talosctl get volumeconfig STATE -o yaml +node: 172.20.0.5 +metadata: + namespace: runtime + type: VolumeConfigs.block.talos.dev + id: STATE + version: 4 + owner: block.VolumeConfigController + phase: running + created: 2024-08-29T13:22:04Z + updated: 2024-08-29T13:22:17Z + finalizers: + - block.VolumeManagerController +spec: + type: partition + provisioning: + wave: -1 + diskSelector: + match: system_disk + partitionSpec: + minSize: 104857600 + maxSize: 104857600 + grow: false + label: STATE + typeUUID: 0FC63DAF-8483-4772-8E79-3D69D8477DE4 + filesystemSpec: + type: xfs + label: STATE + encryption: + provider: luks2 + keys: + - slot: 0 + type: nodeID + locator: + match: volume.partition_label == "STATE" + mount: + targetPath: /system/state +``` + +### Volume Status + +Current volume status can be obtained using the following command: + +```bash +$ talosctl get volumestatus +NODE NAMESPACE TYPE ID VERSION TYPE PHASE LOCATION SIZE +172.20.0.2 runtime VolumeStatus /etc/cni 3 overlay ready +172.20.0.2 runtime VolumeStatus EPHEMERAL 6 partition ready /dev/vda4 5.2 GB +172.20.0.2 runtime VolumeStatus ETCD 2 directory ready +172.20.0.2 runtime VolumeStatus META 3 partition ready /dev/vda2 1.0 MB +172.20.0.2 runtime VolumeStatus STATE 6 partition ready /dev/vda3 105 MB +172.20.0.2 runtime VolumeStatus u-extra 2 partition ready /dev/sda1 350 MB +172.20.0.2 runtime VolumeStatus u-p1 2 partition ready /dev/sdb1 350 MB +172.20.0.2 runtime VolumeStatus u-p2 2 partition ready /dev/sdb2 350 MB +``` + +Each volume goes through different phases during its lifecycle: + +- `waiting`: the volume is waiting to be provisioned +- `missing`: all disks have been discovered, but the volume cannot be found +- `located`: the volume is found without prior provisioning +- `provisioned`: the volume has been provisioned (e.g., partitioned, resized if necessary) +- `prepared`: the encrypted volume is open +- `ready`: the volume is formatted and ready to be mounted +- `closed`: the encrypted volume is closed, and ready to be unmounted + +## Mounts + +Volumes are mounted when they are ready to be used, mounts are tracked in two resources: `MountRequest` describes the desired mount, while `MountStatus` describes the current state of the mount. + +### Mount Request + +Mount requests are created automatically by Talos Linux based on the volume configuration, service configuration, etc. + +To see the current mount requests, you can use the following command: + +```bash +$ talosctl get mountrequests +NODE NAMESPACE TYPE ID VERSION VOLUME PARENT REQUESTERS +172.20.0.5 runtime MountRequest /etc/cni 2 /etc/cni ["service/cri"] +172.20.0.5 runtime MountRequest /etc/kubernetes 2 /etc/kubernetes ["service/cri"] +172.20.0.5 runtime MountRequest /opt 2 /opt ["service/cri"] +172.20.0.5 runtime MountRequest /usr/libexec/kubernetes 2 /usr/libexec/kubernetes ["service/cri"] +172.20.0.5 runtime MountRequest /var/lib 3 /var/lib EPHEMERAL ["service/cri","service/kubelet"] +172.20.0.5 runtime MountRequest /var/lib/cni 2 /var/lib/cni /var/lib ["service/cri"] +172.20.0.5 runtime MountRequest /var/lib/containerd 2 /var/lib/containerd /var/lib ["service/cri"] +172.20.0.5 runtime MountRequest /var/lib/kubelet 2 /var/lib/kubelet /var/lib ["service/kubelet"] +172.20.0.5 runtime MountRequest /var/lib/kubelet/seccomp 2 /var/lib/kubelet/seccomp /var/lib/kubelet ["service/kubelet"] +172.20.0.5 runtime MountRequest /var/lib/kubelet/seccomp/profiles 2 /var/lib/kubelet/seccomp/profiles /var/lib/kubelet/seccomp ["service/kubelet"] +172.20.0.5 runtime MountRequest /var/log 2 /var/log EPHEMERAL ["service/kubelet"] +172.20.0.5 runtime MountRequest /var/log/audit 2 /var/log/audit /var/log ["service/kubelet"] +172.20.0.5 runtime MountRequest /var/log/audit/kube 2 /var/log/audit/kube /var/log/audit ["service/kubelet"] +172.20.0.5 runtime MountRequest /var/log/containers 2 /var/log/containers /var/log ["service/kubelet"] +172.20.0.5 runtime MountRequest /var/log/pods 2 /var/log/pods /var/log ["service/kubelet"] +172.20.0.5 runtime MountRequest /var/mnt 3 /var/mnt EPHEMERAL ["block.UserVolumeConfigController","service/kubelet"] +172.20.0.5 runtime MountRequest /var/run 2 /var/run ["service/cri"] +172.20.0.5 runtime MountRequest /var/run/lock 2 /var/run/lock /var/run ["service/cri"] +172.20.0.5 runtime MountRequest EPHEMERAL 2 EPHEMERAL ["sequencer"] +``` + +### Mount Status + +As the volumes are mounted, the status of the mounts is updated in the `MountStatus` resource: + +```bash +$ talosctl get mountstatus +NODE NAMESPACE TYPE ID VERSION SOURCE TARGET FILESYSTEM VOLUME +172.20.0.5 runtime MountStatus /etc/cni 2 /etc/cni none /etc/cni +172.20.0.5 runtime MountStatus /etc/kubernetes 2 /etc/kubernetes none /etc/kubernetes +172.20.0.5 runtime MountStatus /opt 2 /opt none /opt +172.20.0.5 runtime MountStatus /usr/libexec/kubernetes 2 /usr/libexec/kubernetes none /usr/libexec/kubernetes +172.20.0.5 runtime MountStatus /var/lib 6 /var/lib none /var/lib +172.20.0.5 runtime MountStatus /var/lib/cni 2 /var/lib/cni none /var/lib/cni +172.20.0.5 runtime MountStatus /var/lib/containerd 2 /var/lib/containerd none /var/lib/containerd +172.20.0.5 runtime MountStatus /var/lib/kubelet 3 /var/lib/kubelet none /var/lib/kubelet +172.20.0.5 runtime MountStatus /var/lib/kubelet/seccomp 3 /var/lib/kubelet/seccomp none /var/lib/kubelet/seccomp +172.20.0.5 runtime MountStatus /var/lib/kubelet/seccomp/profiles 2 /var/lib/kubelet/seccomp/profiles none /var/lib/kubelet/seccomp/profiles +172.20.0.5 runtime MountStatus /var/log 5 /var/log none /var/log +172.20.0.5 runtime MountStatus /var/log/audit 3 /var/log/audit none /var/log/audit +172.20.0.5 runtime MountStatus /var/log/audit/kube 2 /var/log/audit/kube none /var/log/audit/kube +172.20.0.5 runtime MountStatus /var/log/containers 2 /var/log/containers none /var/log/containers +172.20.0.5 runtime MountStatus /var/log/pods 2 /var/log/pods none /var/log/pods +172.20.0.5 runtime MountStatus /var/mnt 3 /var/mnt none /var/mnt +172.20.0.5 runtime MountStatus /var/run 3 /var/run none /var/run +172.20.0.5 runtime MountStatus /var/run/lock 2 /var/run/lock none /var/run/lock +172.20.0.5 runtime MountStatus EPHEMERAL 5 /dev/vda4 /var xfs EPHEMERAL +``` diff --git a/website/content/v1.12/talos-guides/configuration/disk-management/system.md b/website/content/v1.12/talos-guides/configuration/disk-management/system.md new file mode 100644 index 000000000..0b7d60f7e --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-management/system.md @@ -0,0 +1,72 @@ +--- +title: "System Volumes" +description: "Configuring Talos Linux system volumes, for example `EPHEMERAL` volume." +weight: 20 +--- + +Talos Linux has a set of system volumes that are used for various purposes, such as storing the system state, ephemeral data, and more. +This guide provides an overview of the system volumes and how to configure them. + +## `EPHEMERAL` Volume + +The `EPHEMERAL` volume is a system volume that is used for storing ephemeral data, such as container data, downloaded images, logs, and `etcd` data (for controlplane nodes). + +> Note: The volume configuration in the machine configuration is only applied when the volume has not been provisioned yet. +> So applying changes after the initial provisioning will not have any effect. + +To configure the `EPHEMERAL` (`/var`) volume, append the following [document]({{< relref "../../../reference/configuration/block/volumeconfig" >}}) to the machine configuration: + +```yaml +apiVersion: v1alpha1 +kind: VolumeConfig +name: EPHEMERAL +provisioning: + diskSelector: + match: disk.transport == 'nvme' + minSize: 2GB + maxSize: 40GB + grow: false +``` + +Every field in the `VolumeConfig` resource is optional, and if a field is not specified, the default value is used. +The default built-in values are: + +```yaml +provisioning: + diskSelector: + match: system_disk + minSize: 2GiB + grow: true +``` + +By default, the `EPHEMERAL` volume is provisioned on the system disk, which is the disk where Talos Linux is installed. +It has a minimum size of 2 GiB and automatically grows to utilize the maximum available space on the disk. + +If you would like to keep the `EPHEMERAL` volume on the system disk but limit its size to 40 GiB, you can set the `maxSize` field to `40GiB`: + +```yaml +apiVersion: v1alpha1 +kind: VolumeConfig +name: EPHEMERAL +provisioning: + maxSize: 40GiB +``` + +If you want to create a separate partition for `EPHEMERAL` on a different disk, you can set the `diskSelector` field to select the desired disk: + +```yaml +apiVersion: v1alpha1 +kind: VolumeConfig +name: EPHEMERAL +provisioning: + diskSelector: + match: disk.transport == 'nvme' && !system_disk +``` + +> Note: Currently, encryption for `EPHEMERAL` and `STATE` volumes is configured using [another config document]({{< relref "../../../reference/configuration/v1alpha1/config#Config.machine.systemDiskEncryption" >}}). + +## `IMAGECACHE` Volume + +This system volume is not provisioned by default, and it only gets created if the [Image Cache]({{< relref "../image-cache" >}}) feature is enabled. + +See [Image Cache configuration]({{< relref "../image-cache#configuration" >}}) for more details. diff --git a/website/content/v1.12/talos-guides/configuration/disk-management/user.md b/website/content/v1.12/talos-guides/configuration/disk-management/user.md new file mode 100644 index 000000000..1110e58c7 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/disk-management/user.md @@ -0,0 +1,101 @@ +--- +title: "User Volumes" +description: "Configuring user volumes to allocate local storage for Kubernetes workloads." +weight: 30 +--- + +User Volumes allow to treat available disk space as a pool of allocatable resource, which can be dynamically allocated to different applications. +The user volumes are supposed to be used mostly for `hostPath` mounts in Kubernetes, but they can be used for other purposes as well. + +When a user volume configuration is applied, Talos Linux will either locate an existing volume or provision a new one. +The volume will be created on the disk which satisfies the `diskSelector` expression and has enough free space to satisfy the `minSize` requirement. + +The user volume is identified by a unique name, which is used both as a mount location and as a label for the volume. +The volume name must be unique across all user volumes, and it should be between 1 and 34 characters long, and can only contain ASCII letters, digits, and `-` (dash) characters. + +The volume label is derived from the volume name as `u-`, and it is used to identify the volume on the disk after initial provisioning. +The volume mount location is `/var/mnt/`, and it gets automatically propagated into the `kubelet` container to provide additional features like `subPath` mounts. + +Disk encryption can be optionally enabled for user volumes. + +## Creating User Volumes + +To create a user volume, append the following [document]({{< relref "../../../reference/configuration/block/uservolumeconfig" >}}) to the machine configuration: + +```yaml +# user-volume.patch.yaml +apiVersion: v1alpha1 +kind: UserVolumeConfig +name: ceph-data +provisioning: + diskSelector: + match: disk.transport == 'nvme' + minSize: 100GB + maxSize: 200GB +``` + +For example, this machine configuration patch can be applied using the following command: + +```bash +talosctl --nodes patch mc --patch @user-volume.patch.yaml +``` + +In this example, a user volume named `ceph-data` is created on the first NVMe disk which has `100GB` of disk space available, and it will be created as maximum +of `200GB` if that space is available. + +The status of the volume can be checked using the following command: + +```bash +$ talosctl get volumestatus u-ceph-data # note u- prefix +NAMESPACE TYPE ID VERSION TYPE PHASE LOCATION SIZE +runtime VolumeStatus u-ceph-data 2 partition ready /dev/nvme0n1p2 200 GB +``` + +If the volume fails to be provisioned, use the `-o yaml` flag to get additional details. + +The volume is immediately mounted to `/var/mnt/ceph-data`: + +```bash +$ talosctl get mountstatus +NAMESPACE TYPE ID VERSION SOURCE TARGET FILESYSTEM VOLUME +runtime MountStatus u-ceph-data 2 /dev/nvme0n1p2 /var/mnt/ceph-data xfs u-ceph-data +``` + +It can be used in a Kubernetes pod as a `hostPath` mount: + +```yaml +kind: Pod +spec: + containers: + - name: ceph + volumeMounts: + - mountPath: /var/lib/ceph + name: ceph-data + volumes: + - name: ceph-data + hostPath: + path: /var/mnt/ceph-data +``` + +Please note, the path inside the container can be different from the path on the host. + +## Removing User Volumes + +Before removing a user volume, ensure that it is not mounted in any Kubernetes pod. + +In order to remove a user volume, first remove the configuration document from the machine configuration. +The `VolumeStatus` and `MountStatus` resources will be removed automatically by Talos Linux. + +> Note: The actual disk data hasn't been removed yet, so you can re-apply the user volume configuration back +> and it will be re-provisioned on the same disk. + +To wipe the disk data, and make it allocatable again, use the following command: + +```bash +talosctl wipe disk nvme0n1p2 --drop-partition +``` + +The `nvme0n1p2` is the partition name, and it can be obtained from the `VolumeStatus` resource before the user volume is removed, +or from the `DiscoveredVolume` resource any time later. + +> Note: If the `wipe disk` command fails with `blockdevice is in use by volume`, it means the user volume has not been removed from the machine configuration. diff --git a/website/content/v1.12/talos-guides/configuration/editing-machine-configuration.md b/website/content/v1.12/talos-guides/configuration/editing-machine-configuration.md new file mode 100644 index 000000000..aa191ec04 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/editing-machine-configuration.md @@ -0,0 +1,164 @@ +--- +title: "Editing Machine Configuration" +description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." +aliases: + - ../../guides/editing-machine-configuration +--- + +Talos node state is fully defined by [machine configuration]({{< relref "../../reference/configuration" >}}). +Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. + +There are three `talosctl` commands which facilitate machine configuration updates: + +* `talosctl apply-config` to apply configuration from the file +* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back +* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch + +Each of these commands can operate in one of four modes: + +* apply change in automatic mode (default): reboot if the change can't be applied without a reboot, otherwise apply the change immediately +* apply change with a reboot (`--mode=reboot`): update configuration, reboot Talos node to apply configuration change +* apply change immediately (`--mode=no-reboot` flag): change is applied immediately without a reboot, fails if the change contains any fields that can not be updated without a reboot +* apply change on next reboot (`--mode=staged`): change is staged to be applied after a reboot, but node is not rebooted +* apply change with automatic revert (`--mode=try`): change is applied immediately (if not possible, returns an error), and reverts it automatically in 1 minute if no configuration update is applied +* apply change in the interactive mode (`--mode=interactive`; only for `talosctl apply-config`): launches TUI based interactive installer + +> Note: applying change on next reboot (`--mode=staged`) doesn't modify current node configuration, so next call to +> `talosctl edit machineconfig --mode=staged` will not see changes + +Additionally, there is also `talosctl get machineconfig v1alpha1 -o jsonpath='{.spec}'`, which retrieves the current node configuration API resource and return just the machine configuration in the `.spec` field. +It can be used to modify the configuration locally before being applied to the node. + +The list of config changes allowed to be applied immediately in Talos {{< release >}}: + +* `.debug` +* `.cluster` +* `.machine.time` +* `.machine.ca` +* `.machine.acceptedCAs` +* `.machine.certCANs` +* `.machine.install` (configuration is only applied during install/upgrade) +* `.machine.network` +* `.machine.nodeAnnotations` +* `.machine.nodeLabels` +* `.machine.nodeTaints` +* `.machine.sysfs` +* `.machine.sysctls` +* `.machine.logging` +* `.machine.controlplane` +* `.machine.kubelet` +* `.machine.pods` +* `.machine.kernel` +* `.machine.registries` (CRI containerd plugin will not pick up the registry authentication settings without a reboot) +* `.machine.features.kubernetesTalosAPIAccess` +* `.machine.features.hostDNS` +* `.machine.features.imageCache` +* `.machine.features.kubePrism` +* `.machine.features.nodeAddressSortAlgorithm` + +### `talosctl apply-config` + +This command is traditionally used to submit initial machine configuration generated by `talosctl gen config` to the node. + +It can also be used to apply configuration to running nodes. +The initial YAML for this is typically obtained using `talosctl get machineconfig v1alpha1 -o jsonpath='{.spec}' > machineconfig.yaml`. + +Example: + +```bash +talosctl -n apply-config -f config.yaml +``` + +Command `apply-config` can also be invoked as `apply machineconfig`: + +```bash +talosctl -n apply machineconfig -f config.yaml +``` + +Applying machine configuration immediately (without a reboot): + +```bash +talosctl -n IP apply machineconfig -f config.yaml --mode=no-reboot +``` + +Starting the interactive installer: + +```bash +talosctl -n IP apply machineconfig --mode=interactive +``` + +> Note: when a Talos node is running in the maintenance mode it's necessary to provide `--insecure (-i)` flag to connect to the API and apply the config. + +### `talosctl edit machineconfig` + +Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. +If config hasn't been changed in the editor (or if updated config is empty), update is not applied. + +> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. +> If environment variables are missing, `vi` editor is used by default. + +Example: + +```bash +talosctl -n edit machineconfig +``` + +Configuration can be edited for multiple nodes if multiple IP addresses are specified: + +```bash +talosctl -n ,,... edit machineconfig +``` + +Applying machine configuration change immediately (without a reboot): + +```bash +talosctl -n edit machineconfig --mode=no-reboot +``` + +### `talosctl patch machineconfig` + +Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies a set of [JSON patches](http://jsonpatch.com/) to the configuration and writes the result back to the node. + +Example, updating kubelet version (in auto mode): + +```bash +$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/siderolabs/kubelet:v{{< k8s_release >}}"}]' +patched mc at the node +``` + +Updating kube-apiserver version in immediate mode (without a reboot): + +```bash +$ talosctl -n patch machineconfig --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "registry.k8s.io/kube-apiserver:v{{< k8s_release >}}"}]' +patched mc at the node +``` + +A patch might be applied to multiple nodes when multiple IPs are specified: + +```bash +talosctl -n ,,... patch machineconfig -p '[{...}]' +``` + +Patches can also be sourced from files using `@file` syntax: + +```bash +talosctl -n patch machineconfig -p @kubelet-patch.json -p @manifest-patch.json +``` + +It might be easier to store patches in YAML format vs. the default JSON format. +Talos can detect file format automatically: + +```yaml +# kubelet-patch.yaml +- op: replace + path: /machine/kubelet/image + value: ghcr.io/siderolabs/kubelet:v{{< k8s_release >}} +``` + +```bash +talosctl -n patch machineconfig -p @kubelet-patch.yaml +``` + +### Recovering from Node Boot Failures + +If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. diff --git a/website/content/v1.12/talos-guides/configuration/image-cache.md b/website/content/v1.12/talos-guides/configuration/image-cache.md new file mode 100644 index 000000000..2cee95ae0 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/image-cache.md @@ -0,0 +1,160 @@ +--- +title: "Image Cache" +description: "How to enable and configure Talos image cache feature." +--- + +Talos Image Cache feature allows to provide container images to the nodes without the need to pull them from the Internet. +This feature is useful in environments with limited or no Internet access. + +Image Cache is local to the machine, and automatically managed by Talos if enabled. + +## Preparing Image Cache + +First, build a list of image references that need to be cached. +The `talosctl images default` might be used as a starting point, but it should be customized to include additional images (e.g. custom CNI, workload images, etc.) + +```bash +talosctl images default > images.txt +cat extra-images.txt >> images.txt +``` + +Next, prepare an OCI image which contains all cached images: + +```bash +cat images.txt | talosctl images cache-create --image-cache-path ./image-cache.oci --images=- +``` + +> Note: The `cache-create` supports a `--layer-cache` flag to additionally cache the pulled images layers on the filesystem. +> This is useful to speed up repeated calls for `cache-create` with the same images. + +The OCI image cache directory might be used directly (`./image-cache.oci`) or pushed itself to a container registry of your choice (e.g. with `crane push`). + +Example of pushing the OCI image cache directory to a container registry: + +```bash +crane push ./image-cache.oci my.registry/image-cache:my-cache +``` + +## Building Boot Assets + +The image cache is provided to Talos via the boot assets. +There are two supported boot asset types for the Image Cache: ISO and disk image. + +### ISO + +In case of ISO, the image cache is bundled with a Talos ISO image, it will be available for the initial install and (if configured) copied to the +disk during the installation process. + +The ISO image can built with the [imager]({{< relref "../install/boot-assets#imager" >}}) by passing an additional `--image-cache` flag: + +```bash +mkdir -p _out/ +docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out -v $PWD/image-cache.oci:/image-cache.oci:ro -v /dev:/dev --privileged ghcr.io/siderolabs/imager:{{< release >}} iso --image-cache /image-cache.oci +``` + +> Note: If the image cache was pushed to a container registry, the `--image-cache` flag should point to the image reference. +> SecureBoot ISO is supported as well. + +The ISO image can be utilized in the following ways (which allows both booting Talos and using the image cache): + +* Using a physical or virtual CD/DVD drive. +* Copying the ISO image to a USB drive using `dd`. +* Copying the contents of the ISO image to a FAT-formatted USB drive with a volume label that starts with `TALOS_`, such as `TALOS_1` (only for UEFI systems). + +> Note: Third-party boot loaders, such as Ventoy, are not supported as Talos will not be able to access the image cache. + +### Disk Image + +In case of disk image, the image cache is included in the disk image itself, and on boot it would be used immediately by the Talos. + +The disk image can be built with the [imager]({{< relref "../install/boot-assets#imager" >}}) by passing an additional `--image-cache` flag: + +```bash +mkdir -p _out/ +docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out -v $PWD/image-cache.oci:/image-cache.oci:ro -v /dev:/dev --privileged ghcr.io/siderolabs/imager:{{< release >}} metal --image-cache /image-cache.oci +``` + +> Note: If the image cache was pushed to a container registry, the `--image-cache` flag should point to the image reference. + +For a disk image, the `IMAGECACHE` partition will use all available space on the disk image (excluding the mandatory boot partitions). +Therefore, you may need to adjust the disk image size using the `--image-disk-size` flag to ensure the `IMAGECACHE` partition is large enough to accommodate the image cache contents, for example, `--image-disk-size=4GiB`. + +Upon boot, Talos will expand the disk image to utilize the full disk size. + +## Configuration + +The image cache feature (for security reasons) should be explicitly enabled in the Talos configuration: + +```yaml +machine: + features: + imageCache: + localEnabled: true +``` + +Once enabled, Talos Linux will automatically look for the image cache contents either on the disk or in the ISO image. + +If the image cache is bundled with the ISO, the disk volume size for the image cache should be configured to copy the image cache to the disk during the installation process: + +```yaml +apiVersion: v1alpha1 +kind: VolumeConfig +name: IMAGECACHE +provisioning: + diskSelector: + match: 'system_disk' + minSize: 2GB + maxSize: 2GB +``` + +The default settings for the `IMAGECACHE` volume are as follows (note that a configuration should still be provided to enable the image cache volume provisioning): + +* `minSize: 500MB` +* `maxSize: 1GB` +* `diskSelector: match: system_disk` + +In this example, image cache volume is provisioned on the system disk with a fixed size of 2GB. +The size of the volume should be adjusted to fit the image cache. +You can see the size of your cache by looking at the size of the image-cache.oci folder with `du -sh image-cache.oci`. + +If the disk image is used, the `IMAGECACHE` volume doesn't need to be configured, as the image cache volume is already present in the disk image. + +See [disk management]({{< relref "./disk-management/system" >}}) for more information on volume configuration. + +## Troubleshooting + +When the image cache is enabled, Talos will block on boot waiting for the image cache to be available: + +```text +task install (1/1): waiting for the image cache +``` + +After the initial install from an ISO, the image cache will be copied to the disk and will be available for the subsequent boots: + +```text +task install (1/1): waiting for the image cache copy +copying image cache {"component": "controller-runtime", "controller": "cri.ImageCacheConfigController", "source": "/system/imagecache/iso/imagecache", "target": "/system/imagecache/disk"} +image cache copied {"component": "controller-runtime", "controller": "cri.ImageCacheConfigController", "size": "414 MiB"} +``` + +The current status of the image cache can be checked via the `ImageCacheConfig` resource: + +```yaml +# talosctl get imagecacheconfig -o yaml +spec: + status: ready + copyStatus: ready + roots: + - /system/imagecache/disk + - /system/imagecache/iso/imagecache +``` + +The `status` field indicates the readiness of the image cache, and the `copyStatus` field indicates the readiness of the image cache copy. +The `roots` field contains the paths to the image cache contents, in this example both on-disk and ISO caches are available. +Image cache roots are used in order they are listed. + +You can get logs from the registry to see if images are being "hit" (a.k.a. cached) or "missed" (a.k.a. pulled from upstream). + +```bash +talosctl logs registryd +``` diff --git a/website/content/v1.12/talos-guides/configuration/insecure.md b/website/content/v1.12/talos-guides/configuration/insecure.md new file mode 100644 index 000000000..f378534b1 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/insecure.md @@ -0,0 +1,105 @@ +--- +title: "The insecure flag" +description: "Learn how to use the insecure flag." +--- + +The `--insecure` flag is a per-command argument that allows the `talosctl` client to communicate with the Talos API when a node is in maintenance mode, that is, before it has been configured with a machine configuration. + +Talos normally uses mutual TLS (mTLS) for all API communications. +This means that both the `talosctl` client and the node verify each other’s identity using certificates provided in the machine configuration. + +However, when a node is in maintenance mode, it still serves the Talos API over TLS, but with some key differences: + +* The node uses a self-signed TLS certificate. +* The client (talosctl) does not present a certificate. +* Neither side can verify the other's identity. + +In this case, the `--insecure` flag tells `talosctl` to skip verifying the server’s certificate, allowing the connection to proceed. + +Only a small subset of Talos API commands support the --insecure flag, specifically those required for initial setup and maintenance operations. + +However, once you've applied a machine config, you must stop using the `--insecure` flag for all subsequent operations. +The node will now expect secure communication using certificates stored in a talosconfig file. + +**Note**: The `--insecure` flag is used in a different context by the `talosctl image cache-create` command. +This command is not used for interacting with the Talos node, but for allowing access to insecure image registries that do not support TLS. + +## In Omni-Managed Clusters + +The `--insecure` flag works differently when you're using Omni to manage Talos clusters. + +Here, the flag is used for nodes that haven't joined a cluster yet. +These nodes will only listen for communication over the SideroLink connection, a secure, point-to-point connection between Omni and the Talos node. + +So the SideroLink connection is the only way you can run commands against a node connected to Omni. + +This architecture provides a unique security advantage because if a machine is managed by Omni, you cannot send configurations to it from another machine without authentication, even if they are on the same network. +This is because the Talos machine does not listen on any general network interface and only communicates with Omni through the secure SideroLink tunnel. + +## Supported Commands With the insecure Flag + +The following commands can be used with the --insecure flag: + +`talosctl apply-config` + +Use this command alongside the `--insecure` flag to apply a machine configuration for the first time. + +`talosctl version` + +Check the Talos version running on the node. + +`talosctl get` + +Retrieves resources from the node. +Verify which resources are retrievable in `--insecure` mode by following these steps: + +1. Set your Talos node IP address as a variable (replace `` with the IP address of your Talos node): + + ```bash + NODE_IP= + + ``` + +1. List resources available in `--insecure` mode: + + ```bash + talosctl get rd --insecure --nodes $NODE_IP -o json \ + | jq -r 'select(.spec.sensitivity == null) | .spec.aliases[0]' + + ``` + +1. List resources not available in `--insecure` mode: + + ```bash + talosctl get rd --insecure --nodes $NODE_IP -o json \ + | jq -r 'select(.spec.sensitivity != null) | .spec.aliases[0]' + + ``` + +`talosctl meta` + +Manages key-value pairs in the META partition. + +`talosctl reset` + +Resets the nodes in Omni. + +`talosctl wipe disk` + +Erase data from disk partitions on a Talos node. + +Refer to the [CLI reference]({{< relref "../../reference/cli/" >}}) for full CLI details. + +## Usage Example + +Here is an example of how to use the `--insecure` flag in Talos: + +```bash +# First time applying configuration (requires --insecure) + +talosctl apply-config --insecure --nodes 192.168.1.100 --file controlplane.yaml + +# After configuration is applied, subsequent commands are secure + +talosctl get disks --nodes 192.168.1.100 --talosconfig=./talosconfig +``` diff --git a/website/content/v1.12/talos-guides/configuration/logging.md b/website/content/v1.12/talos-guides/configuration/logging.md new file mode 100644 index 000000000..013575b40 --- /dev/null +++ b/website/content/v1.12/talos-guides/configuration/logging.md @@ -0,0 +1,435 @@ +--- +title: "Logging" +description: "Dealing with Talos Linux logs." +aliases: + - ../../guides/logging +--- + +## Viewing logs + +Kernel messages can be retrieved with `talosctl dmesg` command: + +```sh +$ talosctl -n 172.20.1.2 dmesg + +172.20.1.2: kern: info: [2021-11-10T10:09:37.662764956Z]: Command line: init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on reboot=k panic=1 talos.shutdown=halt talos.platform=metal talos.config=http://172.20.1.1:40101/config.yaml +[...] +``` + +Service logs can be retrieved with `talosctl logs` command: + +```sh +$ talosctl -n 172.20.1.2 services + +NODE SERVICE STATE HEALTH LAST CHANGE LAST EVENT +172.20.1.2 apid Running OK 19m27s ago Health check successful +172.20.1.2 containerd Running OK 19m29s ago Health check successful +172.20.1.2 cri Running OK 19m27s ago Health check successful +172.20.1.2 etcd Running OK 19m22s ago Health check successful +172.20.1.2 kubelet Running OK 19m20s ago Health check successful +172.20.1.2 machined Running ? 19m30s ago Service started as goroutine +172.20.1.2 trustd Running OK 19m27s ago Health check successful +172.20.1.2 udevd Running OK 19m28s ago Health check successful + +$ talosctl -n 172.20.1.2 logs machined + +172.20.1.2: [talos] task setupLogger (1/1): done, 106.109µs +172.20.1.2: [talos] phase logger (1/7): done, 564.476µs +[...] +``` + +Container logs for Kubernetes pods can be retrieved with `talosctl logs -k` command: + +```sh +$ talosctl -n 172.20.1.2 containers -k +NODE NAMESPACE ID IMAGE PID STATUS +172.20.1.2 k8s.io kube-system/kube-flannel-dk6d5 registry.k8s.io/pause:3.6 1329 SANDBOX_READY +172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:install-cni:f1d4cf68feb9 ghcr.io/siderolabs/install-cni:v0.7.0-alpha.0-1-g2bb2efc 0 CONTAINER_EXITED +172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:install-config:bc39fec3cbac quay.io/coreos/flannel:v0.13.0 0 CONTAINER_EXITED +172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:kube-flannel:5c3989353b98 quay.io/coreos/flannel:v0.13.0 1610 CONTAINER_RUNNING +172.20.1.2 k8s.io kube-system/kube-proxy-gfkqj registry.k8s.io/pause:3.5 1311 SANDBOX_READY +172.20.1.2 k8s.io └─ kube-system/kube-proxy-gfkqj:kube-proxy:ad5e8ddc7e7f registry.k8s.io/kube-proxy:v{{< k8s_release >}} 1379 CONTAINER_RUNNING + +$ talosctl -n 172.20.1.2 logs -k kube-system/kube-proxy-gfkqj:kube-proxy:ad5e8ddc7e7f +172.20.1.2: 2021-11-30T19:13:20.567825192Z stderr F I1130 19:13:20.567737 1 server_others.go:138] "Detected node IP" address="172.20.0.3" +172.20.1.2: 2021-11-30T19:13:20.599684397Z stderr F I1130 19:13:20.599613 1 server_others.go:206] "Using iptables Proxier" +[...] +``` + +If some host workloads (e.g. system extensions) send syslog messages, they can be retrieved with `talosctl logs syslogd` command. + +## Sending logs + +### Service logs + +You can enable logs sendings in machine configuration: + +```yaml +machine: + logging: + destinations: + - endpoint: "udp://127.0.0.1:12345/" + format: "json_lines" + - endpoint: "tcp://host:5044/" + format: "json_lines" +``` + +Several destinations can be specified. +Supported protocols are UDP and TCP. +The only currently supported format is `json_lines`: + +```json +{ + "msg": "[talos] apply config request: immediate true, on reboot false", + "talos-level": "info", + "talos-service": "machined", + "talos-time": "2021-11-10T10:48:49.294858021Z" +} +``` + +Messages are newline-separated when sent over TCP. +Over UDP messages are sent with one message per packet. +`msg`, `talos-level`, `talos-service`, and `talos-time` fields are always present; there may be additional fields. + +Every message sent can be enhanced with additional fields by using the `extraTags` field in the machine configuration: + +```yaml +machine: + logging: + destinations: + - endpoint: "udp://127.0.0.1:12345/" + format: "json_lines" + extraTags: + server: s03-rack07 +``` + +The specified `extraTags` are added to every message sent to the destination verbatim. + +> `syslog` is considered a service in Talos, and so messages/logs sent to syslog (e.g., by system extensions) are considered +> service logs and will be sent to any configured remote receivers without further configuration. + +### Kernel logs + +Kernel log delivery can be enabled with the `talos.logging.kernel` kernel command line argument, which can be specified +in the `.machine.installer.extraKernelArgs`: + +```yaml +machine: + install: + extraKernelArgs: + - talos.logging.kernel=tcp://host:5044/ +``` + +Also kernel logs delivery can be configured using the [document]({{< relref "../../reference/configuration/runtime/kmsglogconfig.md" >}}) in machine configuration: + +```yaml +apiVersion: v1alpha1 +kind: KmsgLogConfig +name: remote-log +url: tcp://host:5044/ +``` + +Kernel log destination is specified in the same way as service log endpoint. +The only supported format is `json_lines`. + +Sample message: + +```json +{ + "clock":6252819, // time relative to the kernel boot time + "facility":"user", + "msg":"[talos] task startAllServices (1/1): waiting for 6 services\n", + "priority":"warning", + "seq":711, + "talos-level":"warn", // Talos-translated `priority` into common logging level + "talos-time":"2021-11-26T16:53:21.3258698Z" // Talos-translated `clock` using current time +} +``` + +> `extraKernelArgs` in the machine configuration are only applied on Talos upgrades, not just by applying the config. +> (Upgrading to the same version is fine). + +### Filebeat example + +To forward logs to other Log collection services, one way to do this is sending +them to a [Filebeat](https://www.elastic.co/beats/filebeat) running in the +cluster itself (in the host network), which takes care of forwarding it to +other endpoints (and the necessary transformations). + +If [Elastic Cloud on Kubernetes](https://www.elastic.co/elastic-cloud-kubernetes) +is being used, the following Beat (custom resource) configuration might be +helpful: + +```yaml +apiVersion: beat.k8s.elastic.co/v1beta1 +kind: Beat +metadata: + name: talos +spec: + type: filebeat + version: 7.15.1 + elasticsearchRef: + name: talos + config: + filebeat.inputs: + - type: "udp" + host: "127.0.0.1:12345" + processors: + - decode_json_fields: + fields: ["message"] + target: "" + - timestamp: + field: "talos-time" + layouts: + - "2006-01-02T15:04:05.999999999Z07:00" + - drop_fields: + fields: ["message", "talos-time"] + - rename: + fields: + - from: "msg" + to: "message" + + daemonSet: + updateStrategy: + rollingUpdate: + maxUnavailable: 100% + podTemplate: + spec: + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true + securityContext: + runAsUser: 0 + containers: + - name: filebeat + ports: + - protocol: UDP + containerPort: 12345 + hostPort: 12345 +``` + +The input configuration ensures that messages and timestamps are extracted properly. +Refer to the Filebeat documentation on how to forward logs to other outputs. + +Also note the `hostNetwork: true` in the `daemonSet` configuration. + +This ensures filebeat uses the host network, and listens on `127.0.0.1:12345` +(UDP) on every machine, which can then be specified as a logging endpoint in +the machine configuration. + +### Fluent-bit example + +First, we'll create a value file for the `fluentd-bit` Helm chart. + +```yaml +# fluentd-bit.yaml + +podAnnotations: + fluentbit.io/exclude: 'true' + +extraPorts: + - port: 12345 + containerPort: 12345 + protocol: TCP + name: talos + +config: + service: | + [SERVICE] + Flush 5 + Daemon Off + Log_Level warn + Parsers_File custom_parsers.conf + HTTP_Server On + HTTP_Listen 0.0.0.0 + HTTP_Port 2020 + + inputs: | + [INPUT] + Name tcp + Listen 0.0.0.0 + Port 12345 + Format json + Tag talos.* + + [INPUT] + Name tail + Alias kubernetes + Path /var/log/containers/*.log + Parser containerd + Tag kubernetes.* + + [INPUT] + Name tail + Alias audit + Path /var/log/audit/kube/*.log + Parser audit + Tag audit.* + + filters: | + [FILTER] + Name kubernetes + Alias kubernetes + Match kubernetes.* + Kube_Tag_Prefix kubernetes.var.log.containers. + Use_Kubelet Off + Merge_Log On + Merge_Log_Trim On + Keep_Log Off + K8S-Logging.Parser Off + K8S-Logging.Exclude On + Annotations Off + Labels On + + [FILTER] + Name modify + Match kubernetes.* + Add source kubernetes + Remove logtag + + customParsers: | + [PARSER] + Name audit + Format json + Time_Key requestReceivedTimestamp + Time_Format %Y-%m-%dT%H:%M:%S.%L%z + + [PARSER] + Name containerd + Format regex + Regex ^(?