--- title: Configuration desription: Talos node configuration file reference. --- Package v1alpha1 configuration file contains all the options available for configuring a machine. To generate a set of basic configuration files, run: talosctl gen config --version v1alpha1 This will generate a machine config for each node type, and a talosconfig for the CLI. ## Config Config defines the v1alpha1 configuration file. ``` yaml version: v1alpha1 persist: true machine: # ... cluster: # ... ```

version string

Indicates the schema used to decode the contents. Valid values: - v1alpha1

debug bool

Enable verbose logging to the console. All system containers logs will flow into serial console. > Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. Valid values: - true - yes - false - no

persist bool

Indicates whether to pull the machine config upon every boot. Valid values: - true - yes - false - no

machine MachineConfig

Provides machine specific configuration options.

cluster ClusterConfig

Provides cluster specific configuration options.

## MachineConfig MachineConfig represents the machine-specific config values. Appears in: - Config.machine ``` yaml type: controlplane # InstallConfig represents the installation options for preparing a node. install: disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. bootloader: true # Indicates if a bootloader should be installed. wipe: false # Indicates if the installation disk should be wiped at installation time. # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. # # Allows for supplying additional system extension images to install on top of base Talos image. # extensions: ghcr.io/talos-systems/gvisor:20220117.0-v1.0.0 ```

type string

Defines the role of the machine within the cluster. #### Init Init node type designates the first control plane node to come up. You can think of it like a bootstrap node. This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. #### Control Plane Control Plane node type designates the node as a control plane member. This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. #### Worker Worker node type designates the node as a worker node. This means it will be an available compute node for scheduling workloads. This node type was previously known as "join"; that value is still supported but deprecated. Valid values: - init - controlplane - worker

token string

The `token` is used by a machine to join the PKI of the cluster. Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. > Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. Examples: ``` yaml token: 328hom.uqjzh6jnn2eie9oi ```

ca PEMEncodedCertificateAndKey

The root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`. Examples: ``` yaml ca: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u ```

certSANs []string

Extra certificate subject alternative names for the machine's certificate. By default, all non-loopback interface IPs are automatically added to the certificate's SANs. Examples: ``` yaml certSANs: - 10.0.0.10 - 172.16.0.10 - 192.168.0.10 ```

controlPlane MachineControlPlaneConfig

Provides machine specific control plane configuration options. Examples: ``` yaml controlPlane: # Controller manager machine specific configuration options. controllerManager: disabled: false # Disable kube-controller-manager on the node. # Scheduler machine specific configuration options. scheduler: disabled: true # Disable kube-scheduler on the node. ```

kubelet KubeletConfig

Used to provide additional options to the kubelet. Examples: ``` yaml kubelet: image: ghcr.io/talos-systems/kubelet:v1.23.4 # The `image` field is an optional reference to an alternative kubelet image. # The `extraArgs` field is used to provide additional flags to the kubelet. extraArgs: feature-gates: ServerSideApply=true # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: # - 10.96.0.10 # - 169.254.2.53 # # The `extraMounts` field is used to add additional mounts to the kubelet container. # extraMounts: # - destination: /var/lib/example # type: bind # source: /var/lib/example # options: # - bind # - rshared # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: # serverTLSBootstrap: true # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. # nodeIP: # # The `validSubnets` field configures the networks to pick kubelet node IP from. # validSubnets: # - 10.0.0.0/8 # - '!10.0.0.3/32' # - fdc7::/16 ```

pods []Unstructured

Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. Static pods can be used to run components which should be started before the Kubernetes control plane is up. Talos doesn't validate the pod definition. Updates to this field can be applied without a reboot. See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/. Examples: ``` yaml pods: - apiVersion: v1 kind: pod metadata: name: nginx spec: containers: - image: nginx name: nginx ```

network NetworkConfig

Provides machine specific network configuration options. Examples: ``` yaml network: hostname: worker-1 # Used to statically set the hostname for the machine. # `interfaces` is used to define the network interface configuration. interfaces: - interface: eth0 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU. # # Bond specific options. # bond: # # The interfaces that make up the bond. # interfaces: # - eth0 # - eth1 # mode: 802.3ad # A bond option. # lacpRate: fast # A bond option. # # Indicates if DHCP should be used to configure the interface. # dhcp: true # # DHCP specific options. # dhcpOptions: # routeMetric: 1024 # The priority of all routes received via DHCP. # # Wireguard specific configuration. # # wireguard server example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # listenPort: 51111 # Specifies a device's listening port. # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # wireguard peer example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # Virtual (shared) IP address configuration. # vip: # ip: 172.16.199.55 # Specifies the IP address to be used. # Used to statically set the nameservers for the machine. nameservers: - 9.8.7.6 - 8.7.6.5 # # Allows for extra entries to be added to the `/etc/hosts` file # extraHostEntries: # - ip: 192.168.1.100 # The IP of the host. # # The host alias. # aliases: # - example # - example.domain.tld # # Configures KubeSpan feature. # kubespan: # enabled: true # Enable the KubeSpan feature. ```

disks []MachineDisk

Used to partition, format and mount additional disks. Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. Note that the partitioning and formating is done only once, if and only if no existing partitions are found. If `size:` is omitted, the partition is sized to occupy the full disk. > Note: `size` is in units of bytes. Examples: ``` yaml disks: - device: /dev/sdb # The name of the disk to use. # A list of partitions to create on the disk. partitions: - mountpoint: /var/mnt/extra # Where to mount the partition. # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. # # Human readable representation. # size: 100 MB # # Precise value in bytes. # size: 1073741824 ```

install InstallConfig

Used to provide instructions for installations. Examples: ``` yaml install: disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. bootloader: true # Indicates if a bootloader should be installed. wipe: false # Indicates if the installation disk should be wiped at installation time. # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. # # Allows for supplying additional system extension images to install on top of base Talos image. # extensions: ghcr.io/talos-systems/gvisor:20220117.0-v1.0.0 ```

files []MachineFile

Allows the addition of user specified files. The value of `op` can be `create`, `overwrite`, or `append`. In the case of `create`, `path` must not exist. In the case of `overwrite`, and `append`, `path` must be a valid file. If an `op` value of `append` is used, the existing file will be appended. Note that the file contents are not required to be base64 encoded. > Note: The specified `path` is relative to `/var`. Examples: ``` yaml files: - content: '...' # The contents of the file. permissions: 0o666 # The file's permissions in octal. path: /tmp/file.txt # The path of the file. op: append # The operation to use ```

env Env

The `env` field allows for the addition of environment variables. All environment variables are set on PID 1 in addition to every service. Valid values: - `GRPC_GO_LOG_VERBOSITY_LEVEL` - `GRPC_GO_LOG_SEVERITY_LEVEL` - `http_proxy` - `https_proxy` - `no_proxy` Examples: ``` yaml env: GRPC_GO_LOG_SEVERITY_LEVEL: info GRPC_GO_LOG_VERBOSITY_LEVEL: "99" https_proxy: http://SERVER:PORT/ ``` ``` yaml env: GRPC_GO_LOG_SEVERITY_LEVEL: error https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ ``` ``` yaml env: https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ ```

time TimeConfig

Used to configure the machine's time settings. Examples: ``` yaml time: disabled: false # Indicates if the time service is disabled for the machine. # Specifies time (NTP) servers to use for setting the system time. servers: - time.cloudflare.com bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. ```

sysctls map[string]string

Used to configure the machine's sysctls. Examples: ``` yaml sysctls: kernel.domainname: talos.dev net.ipv4.ip_forward: "0" ```

sysfs map[string]string

Used to configure the machine's sysfs. Examples: ``` yaml sysfs: devices.system.cpu.cpu0.cpufreq.scaling_governor: performance ```

registries RegistriesConfig

Used to configure the machine's container image registry mirrors. Automatically generates matching CRI configuration for registry mirrors. The `mirrors` section allows to redirect requests for images to non-default registry, which might be local registry or caching mirror. The `config` section provides a way to authenticate to the registry with TLS client identity, provide registry CA, or authentication information. Authentication information has same meaning with the corresponding field in `.docker/config.json`. See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). Examples: ``` yaml registries: # Specifies mirror configuration for each registry. mirrors: docker.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.local # Specifies TLS & auth configuration for HTTPS image registries. config: registry.local: # The TLS configuration for the registry. tls: # Enable mutual TLS authentication with the registry. clientIdentity: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u # The auth configuration for this registry. auth: username: username # Optional registry authentication. password: password # Optional registry authentication. ```

systemDiskEncryption SystemDiskEncryptionConfig

Machine system disk encryption configuration. Defines each system partition encryption parameters. Examples: ``` yaml systemDiskEncryption: # Ephemeral partition encryption. ephemeral: provider: luks2 # Encryption provider to use for the encryption. # Defines the encryption keys generation and storage method. keys: - # Deterministically generated key from the node UUID and PartitionLabel. nodeID: {} slot: 0 # Key slot number for LUKS2 encryption. # # Cipher kind to use for the encryption. Depends on the encryption provider. # cipher: aes-xts-plain64 # # Defines the encryption sector size. # blockSize: 4096 # # Additional --perf parameters for the LUKS2 encryption. # options: # - no_read_workqueue # - no_write_workqueue ```

features FeaturesConfig

Features describe individual Talos features that can be switched on or off. Examples: ``` yaml features: rbac: true # Enable role-based access control (RBAC). ```

udev UdevConfig

Configures the udev system. Examples: ``` yaml udev: # List of udev rules to apply to the udev system rules: - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" ```

logging LoggingConfig

Configures the logging system. Examples: ``` yaml logging: # Logging destination. destinations: - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. ```

kernel KernelConfig

Configures the kernel. Examples: ``` yaml kernel: # Kernel modules to load. modules: - name: brtfs # Module name. ```

## ClusterConfig ClusterConfig represents the cluster-wide config values. Appears in: - Config.cluster ``` yaml # ControlPlaneConfig represents the control plane configuration options. controlPlane: endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. localAPIServerPort: 443 # The port that the API server listens on internally. clusterName: talos.local # ClusterNetworkConfig represents kube networking configuration options. network: # The CNI used. cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 ```

id string

Globally unique identifier for this cluster (base64 encoded random 32 bytes).

secret string

Shared secret of cluster (base64 encoded random 32 bytes). This secret is shared among cluster members but should never be sent over the network.

controlPlane ControlPlaneConfig

Provides control plane specific configuration options. Examples: ``` yaml controlPlane: endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. localAPIServerPort: 443 # The port that the API server listens on internally. ```

clusterName string

Configures the cluster's name.

network ClusterNetworkConfig

Provides cluster specific network configuration options. Examples: ``` yaml network: # The CNI used. cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 ```

token string

The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. Examples: ``` yaml token: wlzjyw.bei2zfylhs2by0wd ```

aescbcEncryptionSecret string

The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). Examples: ``` yaml aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= ```

ca PEMEncodedCertificateAndKey

The base64 encoded root certificate authority used by Kubernetes. Examples: ``` yaml ca: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u ```

aggregatorCA PEMEncodedCertificateAndKey

The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. This CA can be self-signed. Examples: ``` yaml aggregatorCA: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u ```

serviceAccount PEMEncodedKey

The base64 encoded private key for service account token generation. Examples: ``` yaml serviceAccount: key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u ```

apiServer APIServerConfig

API server specific configuration options. Examples: ``` yaml apiServer: image: k8s.gcr.io/kube-apiserver:v1.23.4 # The container image used in the API server manifest. # Extra arguments to supply to the API server. extraArgs: feature-gates: ServerSideApply=true http2-max-streams-per-connection: "32" # Extra certificate subject alternative names for the API server's certificate. certSANs: - 1.2.3.4 - 4.5.6.7 # # Configure the API server admission plugins. # admissionControl: # - name: PodSecurity # Name is the name of the admission controller. # # Configuration is an embedded configuration object to be used as the plugin's # configuration: # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 # defaults: # audit: restricted # audit-version: latest # enforce: baseline # enforce-version: latest # warn: restricted # warn-version: latest # exemptions: # namespaces: # - kube-system # runtimeClasses: [] # usernames: [] # kind: PodSecurityConfiguration ```

controllerManager ControllerManagerConfig

Controller manager server specific configuration options. Examples: ``` yaml controllerManager: image: k8s.gcr.io/kube-controller-manager:v1.23.4 # The container image used in the controller manager manifest. # Extra arguments to supply to the controller manager. extraArgs: feature-gates: ServerSideApply=true ```

proxy ProxyConfig

Kube-proxy server-specific configuration options Examples: ``` yaml proxy: image: k8s.gcr.io/kube-proxy:v1.23.4 # The container image used in the kube-proxy manifest. mode: ipvs # proxy mode of kube-proxy. # Extra arguments to supply to kube-proxy. extraArgs: proxy-mode: iptables ```

scheduler SchedulerConfig

Scheduler server specific configuration options. Examples: ``` yaml scheduler: image: k8s.gcr.io/kube-scheduler:v1.23.4 # The container image used in the scheduler manifest. # Extra arguments to supply to the scheduler. extraArgs: feature-gates: AllBeta=true ```

discovery ClusterDiscoveryConfig

Configures cluster member discovery. Examples: ``` yaml discovery: enabled: true # Enable the cluster membership discovery feature. # Configure registries used for cluster member discovery. registries: # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: {} # Service registry is using an external service to push and pull information about cluster members. service: endpoint: https://discovery.talos.dev/ # External service endpoint. ```

etcd EtcdConfig

Etcd specific configuration options. Examples: ``` yaml etcd: image: gcr.io/etcd-development/etcd:v3.5.2 # The container image used to create the etcd service. # The `ca` is the root certificate authority of the PKI. ca: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u # Extra arguments to supply to etcd. extraArgs: election-timeout: "5000" # # The subnet from which the advertise URL should be. # subnet: 10.0.0.0/8 ```

coreDNS CoreDNS

Core DNS specific configuration options. Examples: ``` yaml coreDNS: image: docker.io/coredns/coredns:1.9.0 # The `image` field is an override to the default coredns image. ```

externalCloudProvider ExternalCloudProviderConfig

External cloud provider configuration. Examples: ``` yaml externalCloudProvider: enabled: true # Enable external cloud provider. # A list of urls that point to additional manifests for an external cloud provider. manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml ```

extraManifests []string

A list of urls that point to additional manifests. These will get automatically deployed as part of the bootstrap. Examples: ``` yaml extraManifests: - https://www.example.com/manifest1.yaml - https://www.example.com/manifest2.yaml ```

extraManifestHeaders map[string]string

A map of key value pairs that will be added while fetching the extraManifests. Examples: ``` yaml extraManifestHeaders: Token: "1234567" X-ExtraInfo: info ```

inlineManifests ClusterInlineManifests

A list of inline Kubernetes manifests. These will get automatically deployed as part of the bootstrap. Examples: ``` yaml inlineManifests: - name: namespace-ci # Name of the manifest. contents: |- # Manifest contents as a string. apiVersion: v1 kind: Namespace metadata: name: ci ```

adminKubeconfig AdminKubeconfigConfig

Settings for admin kubeconfig generation. Certificate lifetime can be configured. Examples: ``` yaml adminKubeconfig: certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). ```

allowSchedulingOnMasters bool

Allows running workload on master nodes. Valid values: - true - yes - false - no

## ExtraMount ExtraMount wraps OCI Mount specification. Appears in: - KubeletConfig.extraMounts ``` yaml - destination: /var/lib/example type: bind source: /var/lib/example options: - bind - rshared - rw ``` ## MachineControlPlaneConfig MachineControlPlaneConfig machine specific configuration options. Appears in: - MachineConfig.controlPlane ``` yaml # Controller manager machine specific configuration options. controllerManager: disabled: false # Disable kube-controller-manager on the node. # Scheduler machine specific configuration options. scheduler: disabled: true # Disable kube-scheduler on the node. ```

controllerManager MachineControllerManagerConfig

Controller manager machine specific configuration options.

scheduler MachineSchedulerConfig

Scheduler machine specific configuration options.

## MachineControllerManagerConfig MachineControllerManagerConfig represents the machine specific ControllerManager config values. Appears in: - MachineControlPlaneConfig.controllerManager

disabled bool

Disable kube-controller-manager on the node.

## MachineSchedulerConfig MachineSchedulerConfig represents the machine specific Scheduler config values. Appears in: - MachineControlPlaneConfig.scheduler

disabled bool

Disable kube-scheduler on the node.

## KubeletConfig KubeletConfig represents the kubelet config values. Appears in: - MachineConfig.kubelet ``` yaml image: ghcr.io/talos-systems/kubelet:v1.23.4 # The `image` field is an optional reference to an alternative kubelet image. # The `extraArgs` field is used to provide additional flags to the kubelet. extraArgs: feature-gates: ServerSideApply=true # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: # - 10.96.0.10 # - 169.254.2.53 # # The `extraMounts` field is used to add additional mounts to the kubelet container. # extraMounts: # - destination: /var/lib/example # type: bind # source: /var/lib/example # options: # - bind # - rshared # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: # serverTLSBootstrap: true # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. # nodeIP: # # The `validSubnets` field configures the networks to pick kubelet node IP from. # validSubnets: # - 10.0.0.0/8 # - '!10.0.0.3/32' # - fdc7::/16 ```

image string

The `image` field is an optional reference to an alternative kubelet image. Examples: ``` yaml image: ghcr.io/talos-systems/kubelet:v1.23.4 ```

clusterDNS []string

The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. Examples: ``` yaml clusterDNS: - 10.96.0.10 - 169.254.2.53 ```

extraArgs map[string]string

The `extraArgs` field is used to provide additional flags to the kubelet. Examples: ``` yaml extraArgs: key: value ```

extraMounts []ExtraMount

The `extraMounts` field is used to add additional mounts to the kubelet container. Note that either `bind` or `rbind` are required in the `options`. Examples: ``` yaml extraMounts: - destination: /var/lib/example type: bind source: /var/lib/example options: - bind - rshared - rw ```

extraConfig Unstructured

The `extraConfig` field is used to provide kubelet configuration overrides. Some fields are not allowed to be overridden: authentication and authorization, cgroups configuration, ports, etc. Examples: ``` yaml extraConfig: serverTLSBootstrap: true ```

registerWithFQDN bool

The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. This is required in clouds like AWS. Valid values: - true - yes - false - no

nodeIP KubeletNodeIPConfig

The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. This is used when a node has multiple addresses to choose from. Examples: ``` yaml nodeIP: # The `validSubnets` field configures the networks to pick kubelet node IP from. validSubnets: - 10.0.0.0/8 - '!10.0.0.3/32' - fdc7::/16 ```

## KubeletNodeIPConfig KubeletNodeIPConfig represents the kubelet node IP configuration. Appears in: - KubeletConfig.nodeIP ``` yaml # The `validSubnets` field configures the networks to pick kubelet node IP from. validSubnets: - 10.0.0.0/8 - '!10.0.0.3/32' - fdc7::/16 ```

validSubnets []string

The `validSubnets` field configures the networks to pick kubelet node IP from. For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.

## NetworkConfig NetworkConfig represents the machine's networking config values. Appears in: - MachineConfig.network ``` yaml hostname: worker-1 # Used to statically set the hostname for the machine. # `interfaces` is used to define the network interface configuration. interfaces: - interface: eth0 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU. # # Bond specific options. # bond: # # The interfaces that make up the bond. # interfaces: # - eth0 # - eth1 # mode: 802.3ad # A bond option. # lacpRate: fast # A bond option. # # Indicates if DHCP should be used to configure the interface. # dhcp: true # # DHCP specific options. # dhcpOptions: # routeMetric: 1024 # The priority of all routes received via DHCP. # # Wireguard specific configuration. # # wireguard server example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # listenPort: 51111 # Specifies a device's listening port. # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # wireguard peer example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # Virtual (shared) IP address configuration. # vip: # ip: 172.16.199.55 # Specifies the IP address to be used. # Used to statically set the nameservers for the machine. nameservers: - 9.8.7.6 - 8.7.6.5 # # Allows for extra entries to be added to the `/etc/hosts` file # extraHostEntries: # - ip: 192.168.1.100 # The IP of the host. # # The host alias. # aliases: # - example # - example.domain.tld # # Configures KubeSpan feature. # kubespan: # enabled: true # Enable the KubeSpan feature. ```

hostname string

Used to statically set the hostname for the machine.

interfaces []Device

`interfaces` is used to define the network interface configuration. By default all network interfaces will attempt a DHCP discovery. This can be further tuned through this configuration parameter. Examples: ``` yaml interfaces: - interface: eth0 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU. # # Bond specific options. # bond: # # The interfaces that make up the bond. # interfaces: # - eth0 # - eth1 # mode: 802.3ad # A bond option. # lacpRate: fast # A bond option. # # Indicates if DHCP should be used to configure the interface. # dhcp: true # # DHCP specific options. # dhcpOptions: # routeMetric: 1024 # The priority of all routes received via DHCP. # # Wireguard specific configuration. # # wireguard server example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # listenPort: 51111 # Specifies a device's listening port. # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # wireguard peer example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # Virtual (shared) IP address configuration. # vip: # ip: 172.16.199.55 # Specifies the IP address to be used. ```

nameservers []string

Used to statically set the nameservers for the machine. Defaults to `1.1.1.1` and `8.8.8.8` Examples: ``` yaml nameservers: - 8.8.8.8 - 1.1.1.1 ```

extraHostEntries []ExtraHost

Allows for extra entries to be added to the `/etc/hosts` file Examples: ``` yaml extraHostEntries: - ip: 192.168.1.100 # The IP of the host. # The host alias. aliases: - example - example.domain.tld ```

kubespan NetworkKubeSpan

Configures KubeSpan feature. Examples: ``` yaml kubespan: enabled: true # Enable the KubeSpan feature. ```

## InstallConfig InstallConfig represents the installation options for preparing a node. Appears in: - MachineConfig.install ``` yaml disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. bootloader: true # Indicates if a bootloader should be installed. wipe: false # Indicates if the installation disk should be wiped at installation time. # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. # # Allows for supplying additional system extension images to install on top of base Talos image. # extensions: ghcr.io/talos-systems/gvisor:20220117.0-v1.0.0 ```

disk string

The disk used for installations. Examples: ``` yaml disk: /dev/sda ``` ``` yaml disk: /dev/nvme0 ```

diskSelector InstallDiskSelector

Look up disk using disk attributes like model, size, serial and others. Always has priority over `disk`. Examples: ``` yaml diskSelector: size: 4GB # Disk size. model: WDC* # Disk model `/sys/block//device/model`. busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. ```

extraKernelArgs []string

Allows for supplying extra kernel args via the bootloader. Examples: ``` yaml extraKernelArgs: - talos.platform=metal - reboot=k ```

image string

Allows for supplying the image used to perform the installation. Image reference for each Talos release can be found on [GitHub releases page](https://github.com/talos-systems/talos/releases). Examples: ``` yaml image: ghcr.io/talos-systems/installer:latest ```

extensions []InstallExtensionConfig

Allows for supplying additional system extension images to install on top of base Talos image. Examples: ``` yaml extensions: ghcr.io/talos-systems/gvisor:20220117.0-v1.0.0 ```

bootloader bool

Indicates if a bootloader should be installed. Valid values: - true - yes - false - no

wipe bool

Indicates if the installation disk should be wiped at installation time. Defaults to `true`. Valid values: - true - yes - false - no

legacyBIOSSupport bool

Indicates if MBR partition should be marked as bootable (active). Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.

## InstallDiskSelector InstallDiskSelector represents a disk query parameters for the install disk lookup. Appears in: - InstallConfig.diskSelector ``` yaml size: 4GB # Disk size. model: WDC* # Disk model `/sys/block//device/model`. busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. ```

size InstallDiskSizeMatcher

Disk size. Examples: ``` yaml size: 4GB ``` ``` yaml size: '> 1TB' ``` ``` yaml size: <= 2TB ```

name string

Disk name `/sys/block//device/name`.

model string

Disk model `/sys/block//device/model`.

serial string

Disk serial number `/sys/block//serial`.

modalias string

Disk modalias `/sys/block//device/modalias`.

uuid string

Disk UUID `/sys/block//uuid`.

wwid string

Disk WWID `/sys/block//wwid`.

type InstallDiskType

Disk Type. Valid values: - ssd - hdd - nvme - sd

busPath string

Disk bus path. Examples: ``` yaml busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 ``` ``` yaml busPath: /pci0000:00/* ```

## InstallExtensionConfig InstallExtensionConfig represents a configuration for a system extension. Appears in: - InstallConfig.extensions ``` yaml ghcr.io/talos-systems/gvisor:20220117.0-v1.0.0 ```

image string

System extension image.

## TimeConfig TimeConfig represents the options for configuring time on a machine. Appears in: - MachineConfig.time ``` yaml disabled: false # Indicates if the time service is disabled for the machine. # Specifies time (NTP) servers to use for setting the system time. servers: - time.cloudflare.com bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. ```

disabled bool

Indicates if the time service is disabled for the machine. Defaults to `false`.

servers []string

Specifies time (NTP) servers to use for setting the system time. Defaults to `pool.ntp.org`

bootTimeout Duration

Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. NTP sync will be still running in the background. Defaults to "infinity" (waiting forever for time sync)

## RegistriesConfig RegistriesConfig represents the image pull options. Appears in: - MachineConfig.registries ``` yaml # Specifies mirror configuration for each registry. mirrors: docker.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.local # Specifies TLS & auth configuration for HTTPS image registries. config: registry.local: # The TLS configuration for the registry. tls: # Enable mutual TLS authentication with the registry. clientIdentity: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u # The auth configuration for this registry. auth: username: username # Optional registry authentication. password: password # Optional registry authentication. ```

mirrors map[string]RegistryMirrorConfig

Specifies mirror configuration for each registry. This setting allows to use local pull-through caching registires, air-gapped installations, etc. Registry name is the first segment of image identifier, with 'docker.io' being default one. To catch any registry names not specified explicitly, use '*'. Examples: ``` yaml mirrors: ghcr.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.insecure - https://ghcr.io/v2/ ```

config map[string]RegistryConfig

Specifies TLS & auth configuration for HTTPS image registries. Mutual TLS can be enabled with 'clientIdentity' option. TLS configuration can be skipped if registry has trusted server certificate. Examples: ``` yaml config: registry.insecure: # The TLS configuration for the registry. tls: insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). # # Enable mutual TLS authentication with the registry. # clientIdentity: # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u # # The auth configuration for this registry. # auth: # username: username # Optional registry authentication. # password: password # Optional registry authentication. ```

## PodCheckpointer PodCheckpointer represents the pod-checkpointer config values.

image string

The `image` field is an override to the default pod-checkpointer image.

## CoreDNS CoreDNS represents the CoreDNS config values. Appears in: - ClusterConfig.coreDNS ``` yaml image: docker.io/coredns/coredns:1.9.0 # The `image` field is an override to the default coredns image. ```

disabled bool

Disable coredns deployment on cluster bootstrap.

image string

The `image` field is an override to the default coredns image.

## Endpoint Endpoint represents the endpoint URL parsed out of the machine config. Appears in: - ControlPlaneConfig.endpoint - LoggingDestination.endpoint ``` yaml https://1.2.3.4:6443 ``` ``` yaml https://cluster1.internal:6443 ``` ``` yaml udp://127.0.0.1:12345 ``` ``` yaml tcp://1.2.3.4:12345 ``` ## ControlPlaneConfig ControlPlaneConfig represents the control plane configuration options. Appears in: - ClusterConfig.controlPlane ``` yaml endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. localAPIServerPort: 443 # The port that the API server listens on internally. ```

endpoint Endpoint

Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. It is single-valued, and may optionally include a port number. Examples: ``` yaml endpoint: https://1.2.3.4:6443 ``` ``` yaml endpoint: https://cluster1.internal:6443 ```

localAPIServerPort int

The port that the API server listens on internally. This may be different than the port portion listed in the endpoint field above. The default is `6443`.

## APIServerConfig APIServerConfig represents the kube apiserver configuration options. Appears in: - ClusterConfig.apiServer ``` yaml image: k8s.gcr.io/kube-apiserver:v1.23.4 # The container image used in the API server manifest. # Extra arguments to supply to the API server. extraArgs: feature-gates: ServerSideApply=true http2-max-streams-per-connection: "32" # Extra certificate subject alternative names for the API server's certificate. certSANs: - 1.2.3.4 - 4.5.6.7 # # Configure the API server admission plugins. # admissionControl: # - name: PodSecurity # Name is the name of the admission controller. # # Configuration is an embedded configuration object to be used as the plugin's # configuration: # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 # defaults: # audit: restricted # audit-version: latest # enforce: baseline # enforce-version: latest # warn: restricted # warn-version: latest # exemptions: # namespaces: # - kube-system # runtimeClasses: [] # usernames: [] # kind: PodSecurityConfiguration ```

image string

The container image used in the API server manifest. Examples: ``` yaml image: k8s.gcr.io/kube-apiserver:v1.23.4 ```

extraArgs map[string]string

Extra arguments to supply to the API server.

extraVolumes []VolumeMountConfig

Extra volumes to mount to the API server static pod.

env Env

The `env` field allows for the addition of environment variables for the control plane component.

certSANs []string

Extra certificate subject alternative names for the API server's certificate.

disablePodSecurityPolicy bool

Disable PodSecurityPolicy in the API server and default manifests.

admissionControl []AdmissionPluginConfig

Configure the API server admission plugins. Examples: ``` yaml admissionControl: - name: PodSecurity # Name is the name of the admission controller. # Configuration is an embedded configuration object to be used as the plugin's configuration: apiVersion: pod-security.admission.config.k8s.io/v1alpha1 defaults: audit: restricted audit-version: latest enforce: baseline enforce-version: latest warn: restricted warn-version: latest exemptions: namespaces: - kube-system runtimeClasses: [] usernames: [] kind: PodSecurityConfiguration ```

## AdmissionPluginConfig AdmissionPluginConfig represents the API server admission plugin configuration. Appears in: - APIServerConfig.admissionControl ``` yaml - name: PodSecurity # Name is the name of the admission controller. # Configuration is an embedded configuration object to be used as the plugin's configuration: apiVersion: pod-security.admission.config.k8s.io/v1alpha1 defaults: audit: restricted audit-version: latest enforce: baseline enforce-version: latest warn: restricted warn-version: latest exemptions: namespaces: - kube-system runtimeClasses: [] usernames: [] kind: PodSecurityConfiguration ```

name string

Name is the name of the admission controller. It must match the registered admission plugin name.

configuration Unstructured

Configuration is an embedded configuration object to be used as the plugin's configuration.

## ControllerManagerConfig ControllerManagerConfig represents the kube controller manager configuration options. Appears in: - ClusterConfig.controllerManager ``` yaml image: k8s.gcr.io/kube-controller-manager:v1.23.4 # The container image used in the controller manager manifest. # Extra arguments to supply to the controller manager. extraArgs: feature-gates: ServerSideApply=true ```

image string

The container image used in the controller manager manifest. Examples: ``` yaml image: k8s.gcr.io/kube-controller-manager:v1.23.4 ```

extraArgs map[string]string

Extra arguments to supply to the controller manager.

extraVolumes []VolumeMountConfig

Extra volumes to mount to the controller manager static pod.

env Env

The `env` field allows for the addition of environment variables for the control plane component.

## ProxyConfig ProxyConfig represents the kube proxy configuration options. Appears in: - ClusterConfig.proxy ``` yaml image: k8s.gcr.io/kube-proxy:v1.23.4 # The container image used in the kube-proxy manifest. mode: ipvs # proxy mode of kube-proxy. # Extra arguments to supply to kube-proxy. extraArgs: proxy-mode: iptables ```

disabled bool

Disable kube-proxy deployment on cluster bootstrap. Examples: ``` yaml disabled: false ```

image string

The container image used in the kube-proxy manifest. Examples: ``` yaml image: k8s.gcr.io/kube-proxy:v1.23.4 ```

mode string

proxy mode of kube-proxy. The default is 'iptables'.

extraArgs map[string]string

Extra arguments to supply to kube-proxy.

## SchedulerConfig SchedulerConfig represents the kube scheduler configuration options. Appears in: - ClusterConfig.scheduler ``` yaml image: k8s.gcr.io/kube-scheduler:v1.23.4 # The container image used in the scheduler manifest. # Extra arguments to supply to the scheduler. extraArgs: feature-gates: AllBeta=true ```

image string

The container image used in the scheduler manifest. Examples: ``` yaml image: k8s.gcr.io/kube-scheduler:v1.23.4 ```

extraArgs map[string]string

Extra arguments to supply to the scheduler.

extraVolumes []VolumeMountConfig

Extra volumes to mount to the scheduler static pod.

env Env

The `env` field allows for the addition of environment variables for the control plane component.

## EtcdConfig EtcdConfig represents the etcd configuration options. Appears in: - ClusterConfig.etcd ``` yaml image: gcr.io/etcd-development/etcd:v3.5.2 # The container image used to create the etcd service. # The `ca` is the root certificate authority of the PKI. ca: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u # Extra arguments to supply to etcd. extraArgs: election-timeout: "5000" # # The subnet from which the advertise URL should be. # subnet: 10.0.0.0/8 ```

image string

The container image used to create the etcd service. Examples: ``` yaml image: gcr.io/etcd-development/etcd:v3.5.2 ```

ca PEMEncodedCertificateAndKey

The `ca` is the root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`. Examples: ``` yaml ca: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u ```

extraArgs map[string]string

Extra arguments to supply to etcd. Note that the following args are not allowed: - `name` - `data-dir` - `initial-cluster-state` - `listen-peer-urls` - `listen-client-urls` - `cert-file` - `key-file` - `trusted-ca-file` - `peer-client-cert-auth` - `peer-cert-file` - `peer-trusted-ca-file` - `peer-key-file`

subnet string

The subnet from which the advertise URL should be. Examples: ``` yaml subnet: 10.0.0.0/8 ```

## ClusterNetworkConfig ClusterNetworkConfig represents kube networking configuration options. Appears in: - ClusterConfig.network ``` yaml # The CNI used. cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 ```

cni CNIConfig

The CNI used. Composed of "name" and "urls". The "name" key supports the following options: "flannel", "custom", and "none". "flannel" uses Talos-managed Flannel CNI, and that's the default option. "custom" uses custom manifests that should be provided in "urls". "none" indicates that Talos will not manage any CNI installation. Examples: ``` yaml cni: name: custom # Name of CNI to use. # URLs containing manifests to apply for the CNI. urls: - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml ```

dnsDomain string

The domain used by Kubernetes DNS. The default is `cluster.local` Examples: ``` yaml dnsDomain: cluser.local ```

podSubnets []string

The pod subnet CIDR. Examples: ``` yaml podSubnets: - 10.244.0.0/16 ```

serviceSubnets []string

The service subnet CIDR. Examples: ``` yaml serviceSubnets: - 10.96.0.0/12 ```

## CNIConfig CNIConfig represents the CNI configuration options. Appears in: - ClusterNetworkConfig.cni ``` yaml name: custom # Name of CNI to use. # URLs containing manifests to apply for the CNI. urls: - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml ```

name string

Name of CNI to use. Valid values: - flannel - custom - none

urls []string

URLs containing manifests to apply for the CNI. Should be present for "custom", must be empty for "flannel" and "none".

## ExternalCloudProviderConfig ExternalCloudProviderConfig contains external cloud provider configuration. Appears in: - ClusterConfig.externalCloudProvider ``` yaml enabled: true # Enable external cloud provider. # A list of urls that point to additional manifests for an external cloud provider. manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml ```

enabled bool

Enable external cloud provider. Valid values: - true - yes - false - no

manifests []string

A list of urls that point to additional manifests for an external cloud provider. These will get automatically deployed as part of the bootstrap. Examples: ``` yaml manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml ```

## AdminKubeconfigConfig AdminKubeconfigConfig contains admin kubeconfig settings. Appears in: - ClusterConfig.adminKubeconfig ``` yaml certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). ```

certLifetime Duration

Admin kubeconfig certificate lifetime (default is 1 year). Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).

## MachineDisk MachineDisk represents the options available for partitioning, formatting, and mounting extra disks. Appears in: - MachineConfig.disks ``` yaml - device: /dev/sdb # The name of the disk to use. # A list of partitions to create on the disk. partitions: - mountpoint: /var/mnt/extra # Where to mount the partition. # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. # # Human readable representation. # size: 100 MB # # Precise value in bytes. # size: 1073741824 ```

device string

The name of the disk to use.

partitions []DiskPartition

A list of partitions to create on the disk.

## DiskPartition DiskPartition represents the options for a disk partition. Appears in: - MachineDisk.partitions

size DiskSize

The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. Examples: ``` yaml size: 100 MB ``` ``` yaml size: 1073741824 ```

mountpoint string

Where to mount the partition.

## EncryptionConfig EncryptionConfig represents partition encryption settings. Appears in: - SystemDiskEncryptionConfig.state - SystemDiskEncryptionConfig.ephemeral

provider string

Encryption provider to use for the encryption. Examples: ``` yaml provider: luks2 ```

keys []EncryptionKey

Defines the encryption keys generation and storage method.

cipher string

Cipher kind to use for the encryption. Depends on the encryption provider. Valid values: - aes-xts-plain64 - xchacha12,aes-adiantum-plain64 - xchacha20,aes-adiantum-plain64 Examples: ``` yaml cipher: aes-xts-plain64 ```

keySize uint

Defines the encryption key length.

blockSize uint64

Defines the encryption sector size. Examples: ``` yaml blockSize: 4096 ```

options []string

Additional --perf parameters for the LUKS2 encryption. Valid values: - no_read_workqueue - no_write_workqueue - same_cpu_crypt Examples: ``` yaml options: - no_read_workqueue - no_write_workqueue ```

## EncryptionKey EncryptionKey represents configuration for disk encryption key. Appears in: - EncryptionConfig.keys

static EncryptionKeyStatic

Key which value is stored in the configuration file.

nodeID EncryptionKeyNodeID

Deterministically generated key from the node UUID and PartitionLabel.

slot int

Key slot number for LUKS2 encryption.

## EncryptionKeyStatic EncryptionKeyStatic represents throw away key type. Appears in: - EncryptionKey.static

passphrase string

Defines the static passphrase value.

## EncryptionKeyNodeID EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. Appears in: - EncryptionKey.nodeID ## MachineFile MachineFile represents a file to write to disk. Appears in: - MachineConfig.files ``` yaml - content: '...' # The contents of the file. permissions: 0o666 # The file's permissions in octal. path: /tmp/file.txt # The path of the file. op: append # The operation to use ```

content string

The contents of the file.

permissions FileMode

The file's permissions in octal.

path string

The path of the file.

op string

The operation to use Valid values: - create - append - overwrite

## ExtraHost ExtraHost represents a host entry in /etc/hosts. Appears in: - NetworkConfig.extraHostEntries ``` yaml - ip: 192.168.1.100 # The IP of the host. # The host alias. aliases: - example - example.domain.tld ```

ip string

The IP of the host.

aliases []string

The host alias.

## Device Device represents a network interface. Appears in: - NetworkConfig.interfaces ``` yaml - interface: eth0 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU. # # Bond specific options. # bond: # # The interfaces that make up the bond. # interfaces: # - eth0 # - eth1 # mode: 802.3ad # A bond option. # lacpRate: fast # A bond option. # # Indicates if DHCP should be used to configure the interface. # dhcp: true # # DHCP specific options. # dhcpOptions: # routeMetric: 1024 # The priority of all routes received via DHCP. # # Wireguard specific configuration. # # wireguard server example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # listenPort: 51111 # Specifies a device's listening port. # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # wireguard peer example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # Virtual (shared) IP address configuration. # vip: # ip: 172.16.199.55 # Specifies the IP address to be used. ```

interface string

The interface name. Examples: ``` yaml interface: eth0 ```

addresses []string

Assigns static IP addresses to the interface. An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed). Examples: ``` yaml addresses: - 10.5.0.0/16 - 192.168.3.7 ```

routes []Route

A list of routes associated with the interface. If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. Examples: ``` yaml routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). - network: 10.2.0.0/16 # The route's network (destination). gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). ```

bond Bond

Bond specific options. Examples: ``` yaml bond: # The interfaces that make up the bond. interfaces: - eth0 - eth1 mode: 802.3ad # A bond option. lacpRate: fast # A bond option. ```

vlans []Vlan

VLAN specific options.

mtu int

The interface's MTU. If used in combination with DHCP, this will override any MTU settings returned from DHCP server.

dhcp bool

Indicates if DHCP should be used to configure the interface. The following DHCP options are supported: - `OptionClasslessStaticRoute` - `OptionDomainNameServer` - `OptionDNSDomainSearchList` - `OptionHostName` Examples: ``` yaml dhcp: true ```

ignore bool

Indicates if the interface should be ignored (skips configuration).

dummy bool

Indicates if the interface is a dummy interface. `dummy` is used to specify that this interface should be a virtual-only, dummy interface.

dhcpOptions DHCPOptions

DHCP specific options. `dhcp` *must* be set to true for these to take effect. Examples: ``` yaml dhcpOptions: routeMetric: 1024 # The priority of all routes received via DHCP. ```

wireguard DeviceWireguardConfig

Wireguard specific configuration. Includes things like private key, listen port, peers. Examples: ``` yaml wireguard: privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). listenPort: 51111 # Specifies a device's listening port. # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 ``` ``` yaml wireguard: privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 ```

vip DeviceVIPConfig

Virtual (shared) IP address configuration. Examples: ``` yaml vip: ip: 172.16.199.55 # Specifies the IP address to be used. ```

## DHCPOptions DHCPOptions contains options for configuring the DHCP settings for a given interface. Appears in: - Device.dhcpOptions ``` yaml routeMetric: 1024 # The priority of all routes received via DHCP. ```

routeMetric uint32

The priority of all routes received via DHCP.

ipv4 bool

Enables DHCPv4 protocol for the interface (default is enabled).

ipv6 bool

Enables DHCPv6 protocol for the interface (default is disabled).

## DeviceWireguardConfig DeviceWireguardConfig contains settings for configuring Wireguard network interface. Appears in: - Device.wireguard ``` yaml privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). listenPort: 51111 # Specifies a device's listening port. # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 ``` ``` yaml privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 ```

privateKey string

Specifies a private key configuration (base64 encoded). Can be generated by `wg genkey`.

listenPort int

Specifies a device's listening port.

firewallMark int

Specifies a device's firewall mark.

peers []DeviceWireguardPeer

Specifies a list of peer configurations to apply to a device.

## DeviceWireguardPeer DeviceWireguardPeer a WireGuard device peer configuration. Appears in: - DeviceWireguardConfig.peers

publicKey string

Specifies the public key of this peer. Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`.

endpoint string

Specifies the endpoint of this peer entry.

persistentKeepaliveInterval Duration

Specifies the persistent keepalive interval for this peer. Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).

allowedIPs []string

AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.

## DeviceVIPConfig DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. Appears in: - Device.vip - Vlan.vip ``` yaml ip: 172.16.199.55 # Specifies the IP address to be used. ```

ip string

Specifies the IP address to be used.

equinixMetal VIPEquinixMetalConfig

Specifies the Equinix Metal API settings to assign VIP to the node.

hcloud VIPHCloudConfig

Specifies the Hetzner Cloud API settings to assign VIP to the node.

## VIPEquinixMetalConfig VIPEquinixMetalConfig contains settings for Equinix Metal VIP management. Appears in: - DeviceVIPConfig.equinixMetal

apiToken string

Specifies the Equinix Metal API Token.

## VIPHCloudConfig VIPHCloudConfig contains settings for Hetzner Cloud VIP management. Appears in: - DeviceVIPConfig.hcloud

apiToken string

Specifies the Hetzner Cloud API Token.

## Bond Bond contains the various options for configuring a bonded interface. Appears in: - Device.bond ``` yaml # The interfaces that make up the bond. interfaces: - eth0 - eth1 mode: 802.3ad # A bond option. lacpRate: fast # A bond option. ```

interfaces []string

The interfaces that make up the bond.

arpIPTarget []string

A bond option. Please see the official kernel documentation. Not supported at the moment.

mode string