Config - Sidero Documentation

version: v1alpha1
machine: # ...
cluster: # ...

Field	Type	Description	Value(s)
`version`	string	Indicates the schema used to decode the contents.	`v1alpha1`
`debug`	bool	Enable verbose logging to the console. All system containers logs will flow into serial console. Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.	`true` `yes` `false` `no`
`machine`	MachineConfig	Provides machine specific configuration options.
`cluster`	ClusterConfig	Provides cluster specific configuration options.

machine

MachineConfig represents the machine-specific config values.

machine:
    type: controlplane
    # InstallConfig represents the installation options for preparing a node.
    install:
        disk: /dev/sda # The disk used for installations.
        # Allows for supplying extra kernel args via the bootloader.
        extraKernelArgs:
            - console=ttyS1
            - panic=10
        image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
        wipe: false # Indicates if the installation disk should be wiped at installation time.

        # # Look up disk using disk attributes like model, size, serial and others.
        # diskSelector:
        #     size: 4GB # Disk size.
        #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
        #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

Field	Type	Description	Value(s)
`type`	string	Defines the role of the machine within the cluster. Control Plane Control Plane node type designates the node as a control plane member. This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler. Worker Worker node type designates the node as a worker node. This means it will be an available compute node for scheduling workloads. This node type was previously known as “join”; that value is still supported but deprecated.	`controlplane` `worker`
`token`	string	The `token` is used by a machine to join the PKI of the cluster. Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity. Show example(s) `token: 328hom.uqjzh6jnn2eie9oi`
`ca`	PEMEncodedCertificateAndKey	The root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`. Show example(s) `ca:` `crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`acceptedCAs`	[]PEMEncodedCertificate	The certificates issued by certificate authorities are accepted in addition to issuing ‘ca’. It is composed of a base64 encoded `crt`.
`certSANs`	[]string	Extra certificate subject alternative names for the machine’s certificate. By default, all non-loopback interface IPs are automatically added to the certificate’s SANs. Show example(s) `certSANs:` `- 10.0.0.10` `- 172.16.0.10` `- 192.168.0.10`
`controlPlane`	MachineControlPlaneConfig	Provides machine specific control plane configuration options. Show example(s) `controlPlane:` `# Controller manager machine specific configuration options.` `controllerManager:` `disabled: false # Disable kube-controller-manager on the node.` `# Scheduler machine specific configuration options.` `scheduler:` `disabled: true # Disable kube-scheduler on the node.`
`kubelet`	KubeletConfig	Used to provide additional options to the kubelet. Show example(s) `kubelet:` `image: ghcr.io/siderolabs/kubelet:v1.33.0 # The image field is an optional reference to an alternative kubelet image.` `# The extraArgs field is used to provide additional flags to the kubelet.` `extraArgs:` `feature-gates: ServerSideApply=true`
`pods`	[]Unstructured	Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. Static pods can be used to run components which should be started before the Kubernetes control plane is up. Talos doesn’t validate the pod definition. Updates to this field can be applied without a reboot. See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/. Show example(s) `pods:` `- apiVersion: v1` `kind: pod` `metadata:` `name: nginx` `spec:` `containers:` `- image: nginx` `name: nginx`
`network`	NetworkConfig	Provides machine specific network configuration options. Show example(s) `network:` `hostname: worker-1 # Used to statically set the hostname for the machine.` `# interfaces is used to define the network interface configuration.` `interfaces:` `- interface: enp0s1 # The interface name.` `# Assigns static IP addresses to the interface.` `addresses:` `- 192.168.2.0/24` `# A list of routes associated with the interface.` `routes:` `- network: 0.0.0.0/0 # The route's network (destination).` `gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).` `metric: 1024 # The optional metric for the route.` `mtu: 1500 # The interface's MTU.`
`install`	InstallConfig	Used to provide instructions for installations. Note that this configuration section gets silently ignored by Talos images that are considered pre-installed. To make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted. Show example(s) `install:` `disk: /dev/sda # The disk used for installations.` `# Allows for supplying extra kernel args via the bootloader.` `extraKernelArgs:` `- console=ttyS1` `- panic=10` `image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.` `wipe: false # Indicates if the installation disk should be wiped at installation time.`
`files`	[]MachineFile	Allows the addition of user specified files. The value of `op` can be `create`, `overwrite`, or `append`. In the case of `create`, `path` must not exist. In the case of `overwrite`, and `append`, `path` must be a valid file. If an `op` value of `append` is used, the existing file will be appended. Note that the file contents are not required to be base64 encoded. Show example(s) `files:` `- content: '...' # The contents of the file.` `permissions: 0o666 # The file's permissions in octal.` `path: /tmp/file.txt # The path of the file.` `op: append # The operation to use`
`env`	Env	The `env` field allows for the addition of environment variables. All environment variables are set on PID 1 in addition to every service. Show example(s) `env:` `GRPC_GO_LOG_SEVERITY_LEVEL: info` `GRPC_GO_LOG_VERBOSITY_LEVEL: "99"` `https_proxy: http://SERVER:PORT/` `env:` `GRPC_GO_LOG_SEVERITY_LEVEL: error` `https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/` `env:` `https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/`	`GRPC_GO_LOG_VERBOSITY_LEVEL` `GRPC_GO_LOG_SEVERITY_LEVEL` `http_proxy` `https_proxy` `no_proxy`
`time`	TimeConfig	Used to configure the machine’s time settings. Show example(s) `time:` `disabled: false # Indicates if the time service is disabled for the machine.` `servers:` `- time.cloudflare.com` `bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.`
`sysctls`	map[string]string	Used to configure the machine’s sysctls. Show example(s) `sysctls:` `kernel.domainname: talos.dev` `net.ipv4.ip_forward: "0"` `net/ipv6/conf/eth0.100/disable_ipv6: "1"`
`sysfs`	map[string]string	Used to configure the machine’s sysfs. Show example(s) `sysfs:` `devices.system.cpu.cpu0.cpufreq.scaling_governor: performance`
`registries`	RegistriesConfig	Used to configure the machine’s container image registry mirrors. Automatically generates matching CRI configuration for registry mirrors. The `mirrors` section allows to redirect requests for images to a non-default registry, which might be a local registry or a caching mirror. The `config` section provides a way to authenticate to the registry with TLS client identity, provide registry CA, or authentication information. Authentication information has same meaning with the corresponding field in `.docker/config.json`. See also matching configuration for CRI containerd plugin. Show example(s) `registries:` `# Specifies mirror configuration for each registry host namespace.` `mirrors:` `docker.io:` `# List of endpoints (URLs) for registry mirrors to use.` `endpoints:` `- https://registry.local` `# Specifies TLS & auth configuration for HTTPS image registries.` `config:` `registry.local:` `# The TLS configuration for the registry.` `tls:` `# Enable mutual TLS authentication with the registry.` `clientIdentity:` `crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==` `# The auth configuration for this registry.` `auth:` `username: username # Optional registry authentication.` `password: password # Optional registry authentication.`
`systemDiskEncryption`	SystemDiskEncryptionConfig	Machine system disk encryption configuration. Defines each system partition encryption parameters. Show example(s) `systemDiskEncryption:` `# Ephemeral partition encryption.` `ephemeral:` `provider: luks2 # Encryption provider to use for the encryption.` `# Defines the encryption keys generation and storage method.` `keys:` `- # Deterministically generated key from the node UUID and PartitionLabel.` `nodeID:` `slot: 0 # Key slot number for LUKS2 encryption.`
`features`	FeaturesConfig	Features describe individual Talos features that can be switched on or off. Show example(s) `features:` `rbac: true # Enable role-based access control (RBAC).`
`udev`	UdevConfig	Configures the udev system. Show example(s) `udev:` `# List of udev rules to apply to the udev system` `rules:` `- SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"`
`logging`	LoggingConfig	Configures the logging system. Show example(s) `logging:` `# Logging destination.` `destinations:` `- endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".` `format: json_lines # Logs format.`
`kernel`	KernelConfig	Configures the kernel. Show example(s) `kernel:` `# Kernel modules to load.` `modules:` `- name: brtfs # Module name.`
`seccompProfiles`	[]MachineSeccompProfile	Configures the seccomp profiles for the machine. Show example(s) `seccompProfiles:` `- name: audit.json # The name field is used to provide the file name of the seccomp profile.` `# The value field is used to provide the seccomp profile.` `value:` `defaultAction: SCMP_ACT_LOG`
`baseRuntimeSpecOverrides`	Unstructured	Override (patch) settings in the default OCI runtime spec for CRI containers. It can be used to set some default container settings which are not configurable in Kubernetes, for example default ulimits. Note: this change applies to all newly created containers, and it requires a reboot to take effect. Show example(s) `baseRuntimeSpecOverrides:` `process:` `rlimits:` `- hard: 1024` `soft: 1024` `type: RLIMIT_NOFILE`
`nodeLabels`	map[string]string	Configures the node labels for the machine. Note: In the default Kubernetes configuration, worker nodes are restricted to set labels with some prefixes (see NodeRestriction admission plugin). Show example(s) `nodeLabels:` `exampleLabel: exampleLabelValue`
`nodeAnnotations`	map[string]string	Configures the node annotations for the machine. Show example(s) `nodeAnnotations:` `customer.io/rack: r13a25`
`nodeTaints`	map[string]string	Configures the node taints for the machine. Effect is optional. Note: In the default Kubernetes configuration, worker nodes are not allowed to modify the taints (see NodeRestriction admission plugin). Show example(s) `nodeTaints:` `exampleTaint: exampleTaintValue:NoSchedule`

controlPlane

MachineControlPlaneConfig machine specific configuration options.

machine:
    controlPlane:
        # Controller manager machine specific configuration options.
        controllerManager:
            disabled: false # Disable kube-controller-manager on the node.
        # Scheduler machine specific configuration options.
        scheduler:
            disabled: true # Disable kube-scheduler on the node.

Field	Type	Description	Value(s)
`controllerManager`	MachineControllerManagerConfig	Controller manager machine specific configuration options.
`scheduler`	MachineSchedulerConfig	Scheduler machine specific configuration options.

controllerManager

MachineControllerManagerConfig represents the machine specific ControllerManager config values.

Field	Type	Description	Value(s)
`disabled`	bool	Disable kube-controller-manager on the node.

scheduler

MachineSchedulerConfig represents the machine specific Scheduler config values.

Field	Type	Description	Value(s)
`disabled`	bool	Disable kube-scheduler on the node.

kubelet

KubeletConfig represents the kubelet config values.

machine:
    kubelet:
        image: ghcr.io/siderolabs/kubelet:v1.33.0 # The `image` field is an optional reference to an alternative kubelet image.
        # The `extraArgs` field is used to provide additional flags to the kubelet.
        extraArgs:
            feature-gates: ServerSideApply=true

        # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
        # clusterDNS:
        #     - 10.96.0.10
        #     - 169.254.2.53

        # # The `extraMounts` field is used to add additional mounts to the kubelet container.
        # extraMounts:
        #     - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
        #       type: bind # Type specifies the mount kind.
        #       source: /var/lib/example # Source specifies the source path of the mount.
        #       # Options are fstab style mount options.
        #       options:
        #         - bind
        #         - rshared
        #         - rw

        # # The `extraConfig` field is used to provide kubelet configuration overrides.
        # extraConfig:
        #     serverTLSBootstrap: true

        # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
        # credentialProviderConfig:
        #     apiVersion: kubelet.config.k8s.io/v1
        #     kind: CredentialProviderConfig
        #     providers:
        #         - apiVersion: credentialprovider.kubelet.k8s.io/v1
        #           defaultCacheDuration: 12h
        #           matchImages:
        #             - '*.dkr.ecr.*.amazonaws.com'
        #             - '*.dkr.ecr.*.amazonaws.com.cn'
        #             - '*.dkr.ecr-fips.*.amazonaws.com'
        #             - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
        #             - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
        #           name: ecr-credential-provider

        # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
        # nodeIP:
        #     # The `validSubnets` field configures the networks to pick kubelet node IP from.
        #     validSubnets:
        #         - 10.0.0.0/8
        #         - '!10.0.0.3/32'
        #         - fdc7::/16

Field	Type	Description	Value(s)
`image`	string	The `image` field is an optional reference to an alternative kubelet image. Example: `yaml<br/>image: ghcr.io/siderolabs/kubelet:v1.33.0<br/>`
`clusterDNS`	[]string	The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. Example: `yaml<br/>clusterDNS:<br/> - 10.96.0.10<br/> - 169.254.2.53<br/>`
`extraArgs`	map[string]string	The `extraArgs` field is used to provide additional flags to the kubelet. Example: `yaml<br/>extraArgs:<br/> key: value<br/>`
`extraMounts`	[]ExtraMount	The `extraMounts` field is used to add additional mounts to the kubelet container. Note that either `bind` or `rbind` are required in the `options`. Example: `yaml<br/>extraMounts:<br/> - destination: /var/lib/example<br/> type: bind<br/> source: /var/lib/example<br/> options:<br/> - bind<br/> - rshared<br/> - rw<br/>`
`extraConfig`	Unstructured	The `extraConfig` field is used to provide kubelet configuration overrides. Some fields are not allowed to be overridden: authentication and authorization, cgroups configuration, ports, etc. Example: `yaml<br/>extraConfig:<br/> serverTLSBootstrap: true<br/>`
`credentialProviderConfig`	Unstructured	The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. Example: `yaml<br/>credentialProviderConfig:<br/> apiVersion: kubelet.config.k8s.io/v1<br/> kind: CredentialProviderConfig<br/> providers:<br/> - name: ecr-credential-provider<br/> apiVersion: credentialprovider.kubelet.k8s.io/v1<br/>`
`defaultRuntimeSeccompProfileEnabled`	bool	Enable container runtime default Seccomp profile.	`true` `yes` `false` `no`
`registerWithFQDN`	bool	The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. This is required in clouds like AWS.	`true` `yes` `false` `no`
`nodeIP`	KubeletNodeIPConfig	The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. This is used when a node has multiple addresses to choose from. Example: `yaml<br/>nodeIP:<br/> validSubnets:<br/> - 10.0.0.0/8<br/> - '!10.0.0.3/32'<br/> - fdc7::/16<br/>`
`skipNodeRegistration`	bool	The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver. This runs kubelet as standalone and only runs static pods.	`true` `yes` `false` `no`
`disableManifestsDirectory`	bool	The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. It’s recommended to configure static pods with the “pods” key instead.	`true` `yes` `false` `no`

extraMounts[]

ExtraMount wraps OCI Mount specification.

machine:
    kubelet:
        extraMounts:
            - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
              type: bind # Type specifies the mount kind.
              source: /var/lib/example # Source specifies the source path of the mount.
              # Options are fstab style mount options.
              options:
                - bind
                - rshared
                - rw

Field	Type	Description
`destination`	string	Destination is the absolute path where the mount will be placed in the container.
`type`	string	Type specifies the mount kind.
`source`	string	Source specifies the source path of the mount.
`options`	[]string	Options are fstab style mount options.
`uidMappings`	[]LinuxIDMapping	UID/GID mappings used for changing file owners w/o calling chown, fs should support it. Every mount point could have its own mapping.
`gidMappings`	[]LinuxIDMapping	UID/GID mappings used for changing file owners w/o calling chown, fs should support it. Every mount point could have its own mapping.

uidMappings[]

LinuxIDMapping represents the Linux ID mapping.

Field	Type	Description
`containerID`	uint32	ContainerID is the starting UID/GID in the container.
`hostID`	uint32	HostID is the starting UID/GID on the host to be mapped to ‘ContainerID’.
`size`	uint32	Size is the number of IDs to be mapped.

gidMappings[]

LinuxIDMapping represents the Linux ID mapping.

Field	Type	Description
`containerID`	uint32	ContainerID is the starting UID/GID in the container.
`hostID`	uint32	HostID is the starting UID/GID on the host to be mapped to ‘ContainerID’.
`size`	uint32	Size is the number of IDs to be mapped.

nodeIP

KubeletNodeIPConfig represents the kubelet node IP configuration.

machine:
    kubelet:
        nodeIP:
            # The `validSubnets` field configures the networks to pick kubelet node IP from.
            validSubnets:
                - 10.0.0.0/8
                - '!10.0.0.3/32'
                - fdc7::/16

Field	Type	Description	Value(s)
`validSubnets`	[]string	The `validSubnets` field configures the networks to pick kubelet node IP from. For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.

network

NetworkConfig represents the machine’s networking config values.

machine:
    network:
        hostname: worker-1 # Used to statically set the hostname for the machine.
        # `interfaces` is used to define the network interface configuration.
        interfaces:
            - interface: enp0s1 # The interface name.
              # Assigns static IP addresses to the interface.
              addresses:
                - 192.168.2.0/24
              # A list of routes associated with the interface.
              routes:
                - network: 0.0.0.0/0 # The route's network (destination).
                  gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
                  metric: 1024 # The optional metric for the route.
              mtu: 1500 # The interface's MTU.

              # # Picks a network device using the selector.

              # # select a device with bus prefix 00:*.
              # deviceSelector:
              #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
              # deviceSelector:
              #     hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
              #     driver: virtio_net # Kernel driver, supports matching by wildcard.
              # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
              # deviceSelector:
              #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              #     - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
              #       driver: virtio_net # Kernel driver, supports matching by wildcard.

              # # Bond specific options.
              # bond:
              #     # The interfaces that make up the bond.
              #     interfaces:
              #         - enp2s0
              #         - enp2s1
              #     # Picks a network device using the selector.
              #     deviceSelectors:
              #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              #         - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
              #           driver: virtio_net # Kernel driver, supports matching by wildcard.
              #     mode: 802.3ad # A bond option.
              #     lacpRate: fast # A bond option.

              # # Bridge specific options.
              # bridge:
              #     # The interfaces that make up the bridge.
              #     interfaces:
              #         - enxda4042ca9a51
              #         - enxae2a6774c259
              #     # Enable STP on this bridge.
              #     stp:
              #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

              # # Configure this device as a bridge port.
              # bridgePort:
              #     master: br0 # The name of the bridge master interface

              # # Indicates if DHCP should be used to configure the interface.
              # dhcp: true

              # # DHCP specific options.
              # dhcpOptions:
              #     routeMetric: 1024 # The priority of all routes received via DHCP.

              # # Wireguard specific configuration.

              # # wireguard server example
              # wireguard:
              #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
              #     listenPort: 51111 # Specifies a device's listening port.
              #     # Specifies a list of peer configurations to apply to a device.
              #     peers:
              #         - publicKey: ABCDEF... # Specifies the public key of this peer.
              #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
              #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
              #           allowedIPs:
              #             - 192.168.1.0/24
              # # wireguard peer example
              # wireguard:
              #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
              #     # Specifies a list of peer configurations to apply to a device.
              #     peers:
              #         - publicKey: ABCDEF... # Specifies the public key of this peer.
              #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
              #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
              #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
              #           allowedIPs:
              #             - 192.168.1.0/24

              # # Virtual (shared) IP address configuration.

              # # layer2 vip example
              # vip:
              #     ip: 172.16.199.55 # Specifies the IP address to be used.
        # Used to statically set the nameservers for the machine.
        nameservers:
            - 9.8.7.6
            - 8.7.6.5
        # Used to statically set arbitrary search domains.
        searchDomains:
            - example.org
            - example.com

        # # Allows for extra entries to be added to the `/etc/hosts` file
        # extraHostEntries:
        #     - ip: 192.168.1.100 # The IP of the host.
        #       # The host alias.
        #       aliases:
        #         - example
        #         - example.domain.tld

        # # Configures KubeSpan feature.
        # kubespan:
        #     enabled: true # Enable the KubeSpan feature.

Field	Type	Description	Value(s)
`hostname`	string	Used to statically set the hostname for the machine.
`interfaces`	[]Device	`interfaces` is used to define the network interface configuration. By default all network interfaces will attempt a DHCP discovery. This can be further tuned through this configuration parameter. Show example(s) `interfaces:` `- interface: enp0s1 # The interface name.` `# Assigns static IP addresses to the interface.` `addresses:` `- 192.168.2.0/24` `# A list of routes associated with the interface.` `routes:` `- network: 0.0.0.0/0 # The route's network (destination).` `gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).` `metric: 1024 # The optional metric for the route.` `mtu: 1500 # The interface's MTU.` `# Additional interface configuration options:` `# deviceSelector, bond, bridge, dhcp, wireguard, vip`
`nameservers`	[]string	Used to statically set the nameservers for the machine. Defaults to `1.1.1.1` and `8.8.8.8` Show example(s) `nameservers:` `- 8.8.8.8` `- 1.1.1.1`
`searchDomains`	[]string	Used to statically set arbitrary search domains. Show example(s) `searchDomains:` `- example.org` `- example.com`
`extraHostEntries`	[]ExtraHost	Allows for extra entries to be added to the `/etc/hosts` file Show example(s) `extraHostEntries:` `- ip: 192.168.1.100 # The IP of the host.` `# The host alias.` `aliases:` `- example` `- example.domain.tld`
`kubespan`	NetworkKubeSpan	Configures KubeSpan feature. Show example(s) `kubespan:` `enabled: true # Enable the KubeSpan feature.`
`disableSearchDomain`	bool	Disable generating a default search domain in /etc/resolv.conf based on the machine hostname. Defaults to `false`.	`true` `yes` `false` `no`

interfaces[]

Device represents a network interface.

machine:
    network:
        interfaces:
            - interface: enp0s1 # The interface name.
              # Assigns static IP addresses to the interface.
              addresses:
                - 192.168.2.0/24
              # A list of routes associated with the interface.
              routes:
                - network: 0.0.0.0/0 # The route's network (destination).
                  gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
                  metric: 1024 # The optional metric for the route.
              mtu: 1500 # The interface's MTU.

              # # Picks a network device using the selector.

              # # select a device with bus prefix 00:*.
              # deviceSelector:
              #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
              # deviceSelector:
              #     hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
              #     driver: virtio_net # Kernel driver, supports matching by wildcard.
              # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
              # deviceSelector:
              #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              #     - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
              #       driver: virtio_net # Kernel driver, supports matching by wildcard.

              # # Bond specific options.
              # bond:
              #     # The interfaces that make up the bond.
              #     interfaces:
              #         - enp2s0
              #         - enp2s1
              #     # Picks a network device using the selector.
              #     deviceSelectors:
              #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              #         - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
              #           driver: virtio_net # Kernel driver, supports matching by wildcard.
              #     mode: 802.3ad # A bond option.
              #     lacpRate: fast # A bond option.

              # # Bridge specific options.
              # bridge:
              #     # The interfaces that make up the bridge.
              #     interfaces:
              #         - enxda4042ca9a51
              #         - enxae2a6774c259
              #     # Enable STP on this bridge.
              #     stp:
              #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

              # # Configure this device as a bridge port.
              # bridgePort:
              #     master: br0 # The name of the bridge master interface

              # # Indicates if DHCP should be used to configure the interface.
              # dhcp: true

              # # DHCP specific options.
              # dhcpOptions:
              #     routeMetric: 1024 # The priority of all routes received via DHCP.

              # # Wireguard specific configuration.

              # # wireguard server example
              # wireguard:
              #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
              #     listenPort: 51111 # Specifies a device's listening port.
              #     # Specifies a list of peer configurations to apply to a device.
              #     peers:
              #         - publicKey: ABCDEF... # Specifies the public key of this peer.
              #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
              #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
              #           allowedIPs:
              #             - 192.168.1.0/24
              # # wireguard peer example
              # wireguard:
              #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
              #     # Specifies a list of peer configurations to apply to a device.
              #     peers:
              #         - publicKey: ABCDEF... # Specifies the public key of this peer.
              #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
              #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
              #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
              #           allowedIPs:
              #             - 192.168.1.0/24

              # # Virtual (shared) IP address configuration.

              # # layer2 vip example
              # vip:
              #     ip: 172.16.199.55 # Specifies the IP address to be used.

Field	Type	Description
`interface`	string	The interface name. Mutually exclusive with `deviceSelector`. Show example(s) `interface: enp0s3`
`deviceSelector`	NetworkDeviceSelector	Picks a network device using the selector. Mutually exclusive with `interface`. Supports partial match using wildcard syntax. Show example(s) `deviceSelector:` `busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.` `deviceSelector:` `hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.` `driver: virtio_net # Kernel driver, supports matching by wildcard.`
`addresses`	[]string	Assigns static IP addresses to the interface. An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed). Show example(s) `addresses:` `- 10.5.0.0/16` `- 192.168.3.7`
`routes`	[]Route	A list of routes associated with the interface. If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. Show example(s) `routes:` `- network: 0.0.0.0/0 # The route's network (destination).` `gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).` `- network: 10.2.0.0/16 # The route's network (destination).` `gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).`
`bond`	Bond	Bond specific options. Show example(s) `bond:` `# The interfaces that make up the bond.` `interfaces:` `- enp2s0` `- enp2s1` `mode: 802.3ad # A bond option.` `lacpRate: fast # A bond option.` `# # Picks a network device using the selector.` `# # select a device with bus prefix 00:, a device with mac address matching :f0:ab and virtio kernel driver.` `# deviceSelectors:` `# - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.` `# - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.` `# driver: virtio_net # Kernel driver, supports matching by wildcard.`
`bridge`	Bridge	Bridge specific options. Show example(s) `bridge:` `# The interfaces that make up the bridge.` `interfaces:` `- enxda4042ca9a51` `- enxae2a6774c259` `# Enable STP on this bridge.` `stp:` `enabled: true # Whether Spanning Tree Protocol (STP) is enabled.`
`bridgePort`	BridgePort	Configure this device as a bridge port. This can be used to dynamically assign network interfaces to a bridge. Show example(s) `bridgePort:` `master: br0 # The name of the bridge master interface`
`vlans`	[]Vlan	VLAN specific options.
`mtu`	int	The interface’s MTU. If used in combination with DHCP, this will override any MTU settings returned from DHCP server.
`dhcp`	bool	Indicates if DHCP should be used to configure the interface. The following DHCP options are supported: - `OptionClasslessStaticRoute` - `OptionDomainNameServer` - `OptionDNSDomainSearchList` - `OptionHostName` Show example(s) `dhcp: true`
`ignore`	bool	Indicates if the interface should be ignored (skips configuration).
`dummy`	bool	Indicates if the interface is a dummy interface. `dummy` is used to specify that this interface should be a virtual-only, dummy interface.
`dhcpOptions`	DHCPOptions	DHCP specific options. `dhcp` must be set to true for these to take effect. Show example(s) `dhcpOptions:` `routeMetric: 1024 # The priority of all routes received via DHCP.`
`wireguard`	DeviceWireguardConfig	Wireguard specific configuration. Includes things like private key, listen port, peers. Show example(s) `wireguard:` `privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).` `listenPort: 51111 # Specifies a device's listening port.` `# Specifies a list of peer configurations to apply to a device.` `peers:` `- publicKey: ABCDEF... # Specifies the public key of this peer.` `endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.` `# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.` `allowedIPs:` `- 192.168.1.0/24` `wireguard:` `privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).` `# Specifies a list of peer configurations to apply to a device.` `peers:` `- publicKey: ABCDEF... # Specifies the public key of this peer.` `endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.` `persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.` `# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.` `allowedIPs:` `- 192.168.1.0/24`
`vip`	DeviceVIPConfig	Virtual (shared) IP address configuration. Show example(s) `vip:` `ip: 172.16.199.55 # Specifies the IP address to be used.`

deviceSelector

NetworkDeviceSelector struct describes network device selector.

machine:
    network:
        interfaces:
            - deviceSelector:
                busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.

machine:
    network:
        interfaces:
            - deviceSelector:
                hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
                driver: virtio_net # Kernel driver, supports matching by wildcard.

machine:
    network:
        interfaces:
            - deviceSelector:
                - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
                - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
                  driver: virtio_net # Kernel driver, supports matching by wildcard.

Field	Type	Description
`busPath`	string	PCI, USB bus prefix, supports matching by wildcard.
`hardwareAddr`	string	Device hardware (MAC) address, supports matching by wildcard.
`permanentAddr`	string	Device permanent hardware address, supports matching by wildcard. The permanent address doesn’t change when the link is enslaved to a bond, so it’s recommended to use this field for bond members.
`pciID`	string	PCI ID (vendor ID, product ID), supports matching by wildcard.
`driver`	string	Kernel driver, supports matching by wildcard.
`physical`	bool	Select only physical devices.

routes[]

Route represents a network route.

machine:
    network:
        interfaces:
            - routes:
                - network: 0.0.0.0/0 # The route's network (destination).
                  gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).
                - network: 10.2.0.0/16 # The route's network (destination).
                  gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).

Field	Type	Description
`network`	string	The route’s network (destination).
`gateway`	string	The route’s gateway (if empty, creates link scope route).
`source`	string	The route’s source address (optional).
`metric`	uint32	The optional metric for the route.
`mtu`	uint32	The optional MTU for the route.

bond

Bond contains the various options for configuring a bonded interface.

machine:
    network:
        interfaces:
            - bond:
                # The interfaces that make up the bond.
                interfaces:
                    - enp2s0
                    - enp2s1
                mode: 802.3ad # A bond option.
                lacpRate: fast # A bond option.

                # # Picks a network device using the selector.

                # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
                # deviceSelectors:
                #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
                #     - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
                #       driver: virtio_net # Kernel driver, supports matching by wildcard.

Field	Type	Description
`interfaces`	[]string	The interfaces that make up the bond.
`deviceSelectors`	[]NetworkDeviceSelector	Picks a network device using the selector. Mutually exclusive with `interfaces`. Supports partial match using wildcard syntax. Show example(s) `deviceSelectors:` `- busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.` `- hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.` `driver: virtio_net # Kernel driver, supports matching by wildcard.`
`arpIPTarget`	[]string	A bond option. Please see the official kernel documentation. Not supported at the moment.
`mode`	string	A bond option. Please see the official kernel documentation.
`xmitHashPolicy`	string	A bond option. Please see the official kernel documentation.
`lacpRate`	string	A bond option. Please see the official kernel documentation.
`adActorSystem`	string	A bond option. Please see the official kernel documentation. Not supported at the moment.
`arpValidate`	string	A bond option. Please see the official kernel documentation.
`arpAllTargets`	string	A bond option. Please see the official kernel documentation.
`primary`	string	A bond option. Please see the official kernel documentation.
`primaryReselect`	string	A bond option. Please see the official kernel documentation.
`failOverMac`	string	A bond option. Please see the official kernel documentation.
`adSelect`	string	A bond option. Please see the official kernel documentation.
`miimon`	uint32	A bond option. Please see the official kernel documentation.
`updelay`	uint32	A bond option. Please see the official kernel documentation.
`downdelay`	uint32	A bond option. Please see the official kernel documentation.
`arpInterval`	uint32	A bond option. Please see the official kernel documentation.
`resendIgmp`	uint32	A bond option. Please see the official kernel documentation.
`minLinks`	uint32	A bond option. Please see the official kernel documentation.
`lpInterval`	uint32	A bond option. Please see the official kernel documentation.
`packetsPerSlave`	uint32	A bond option. Please see the official kernel documentation.
`numPeerNotif`	uint8	A bond option. Please see the official kernel documentation.
`tlbDynamicLb`	uint8	A bond option. Please see the official kernel documentation.
`allSlavesActive`	uint8	A bond option. Please see the official kernel documentation.
`useCarrier`	bool	A bond option. Please see the official kernel documentation.
`adActorSysPrio`	uint16	A bond option. Please see the official kernel documentation.
`adUserPortKey`	uint16	A bond option. Please see the official kernel documentation.
`peerNotifyDelay`	uint32	A bond option. Please see the official kernel documentation.

deviceSelectors[]

NetworkDeviceSelector struct describes network device selector.

machine:
    network:
        interfaces:
            - bond:
                deviceSelectors:
                    busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.

machine:
    network:
        interfaces:
            - bond:
                deviceSelectors:
                    hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
                    driver: virtio_net # Kernel driver, supports matching by wildcard.

machine:
    network:
        interfaces:
            - bond:
                deviceSelectors:
                    - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
                    - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
                      driver: virtio_net # Kernel driver, supports matching by wildcard.

Field	Type	Description
`busPath`	string	PCI, USB bus prefix, supports matching by wildcard.
`hardwareAddr`	string	Device hardware (MAC) address, supports matching by wildcard.
`permanentAddr`	string	Device permanent hardware address, supports matching by wildcard. The permanent address doesn’t change when the link is enslaved to a bond, so it’s recommended to use this field for bond members.
`pciID`	string	PCI ID (vendor ID, product ID), supports matching by wildcard.
`driver`	string	Kernel driver, supports matching by wildcard.
`physical`	bool	Select only physical devices.

bridge

Bridge contains the various options for configuring a bridge interface.

machine:
    network:
        interfaces:
            - bridge:
                # The interfaces that make up the bridge.
                interfaces:
                    - enxda4042ca9a51
                    - enxae2a6774c259
                # Enable STP on this bridge.
                stp:
                    enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

Field	Type	Description
`interfaces`	[]string	The interfaces that make up the bridge.
`stp`	STP	Enable STP on this bridge. Please see the official kernel documentation.
`vlan`	BridgeVLAN	Enable VLAN-awareness on this bridge. Please see the official kernel documentation.

stp

STP contains the various options for configuring the STP properties of a bridge interface.

Field	Type	Description	Value(s)
`enabled`	bool	Whether Spanning Tree Protocol (STP) is enabled.

vlan

BridgeVLAN contains the various options for configuring the VLAN properties of a bridge interface.

Field	Type	Description	Value(s)
`vlanFiltering`	bool	Whether VLAN filtering is enabled.

bridgePort

BridgePort contains settings for assigning a link to a bridge interface.

machine:
    network:
        interfaces:
            - bridgePort:
                master: br0 # The name of the bridge master interface

Field	Type	Description	Value(s)
`master`	string	The name of the bridge master interface

vlans[]

Vlan represents vlan settings for a device.

Field	Type	Description
`addresses`	[]string	The addresses in CIDR notation or as plain IPs to use.
`routes`	[]Route	A list of routes associated with the VLAN.
`dhcp`	bool	Indicates if DHCP should be used.
`vlanId`	uint16	The VLAN’s ID.
`mtu`	uint32	The VLAN’s MTU.
`vip`	DeviceVIPConfig	The VLAN’s virtual IP address configuration.
`dhcpOptions`	DHCPOptions	DHCP specific options. `dhcp` must be set to true for these to take effect.

routes[]

Route represents a network route.

machine:
    network:
        interfaces:
            - vlans:
                - routes:
                    - network: 0.0.0.0/0 # The route's network (destination).
                      gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).
                    - network: 10.2.0.0/16 # The route's network (destination).
                      gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).

Field	Type	Description
`network`	string	The route’s network (destination).
`gateway`	string	The route’s gateway (if empty, creates link scope route).
`source`	string	The route’s source address (optional).
`metric`	uint32	The optional metric for the route.
`mtu`	uint32	The optional MTU for the route.

vip

DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.

machine:
    network:
        interfaces:
            - vlans:
                - vip:
                    ip: 172.16.199.55 # Specifies the IP address to be used.

Field	Type	Description
`ip`	string	Specifies the IP address to be used.
`equinixMetal`	VIPEquinixMetalConfig	Specifies the Equinix Metal API settings to assign VIP to the node.
`hcloud`	VIPHCloudConfig	Specifies the Hetzner Cloud API settings to assign VIP to the node.

equinixMetal

VIPEquinixMetalConfig contains settings for Equinix Metal VIP management.

Field	Type	Description	Value(s)
`apiToken`	string	Specifies the Equinix Metal API Token.

hcloud

VIPHCloudConfig contains settings for Hetzner Cloud VIP management.

Field	Type	Description	Value(s)
`apiToken`	string	Specifies the Hetzner Cloud API Token.

dhcpOptions

DHCPOptions contains options for configuring the DHCP settings for a given interface.

machine:
    network:
        interfaces:
            - vlans:
                - dhcpOptions:
                    routeMetric: 1024 # The priority of all routes received via DHCP.

Field	Type	Description
`routeMetric`	uint32	The priority of all routes received via DHCP.
`ipv4`	bool	Enables DHCPv4 protocol for the interface (default is enabled).
`ipv6`	bool	Enables DHCPv6 protocol for the interface (default is disabled).
`duidv6`	string	Set client DUID (hex string).

dhcpOptions

DHCPOptions contains options for configuring the DHCP settings for a given interface.

machine:
    network:
        interfaces:
            - dhcpOptions:
                routeMetric: 1024 # The priority of all routes received via DHCP.

Field	Type	Description
`routeMetric`	uint32	The priority of all routes received via DHCP.
`ipv4`	bool	Enables DHCPv4 protocol for the interface (default is enabled).
`ipv6`	bool	Enables DHCPv6 protocol for the interface (default is disabled).
`duidv6`	string	Set client DUID (hex string).

wireguard

DeviceWireguardConfig contains settings for configuring Wireguard network interface.

machine:
    network:
        interfaces:
            - wireguard:
                privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
                listenPort: 51111 # Specifies a device's listening port.
                # Specifies a list of peer configurations to apply to a device.
                peers:
                    - publicKey: ABCDEF... # Specifies the public key of this peer.
                      endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
                      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
                      allowedIPs:
                        - 192.168.1.0/24

machine:
    network:
        interfaces:
            - wireguard:
                privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
                # Specifies a list of peer configurations to apply to a device.
                peers:
                    - publicKey: ABCDEF... # Specifies the public key of this peer.
                      endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
                      persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
                      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
                      allowedIPs:
                        - 192.168.1.0/24

Field	Type	Description
`privateKey`	string	Specifies a private key configuration (base64 encoded). Can be generated by `wg genkey`.
`listenPort`	int	Specifies a device’s listening port.
`firewallMark`	int	Specifies a device’s firewall mark.
`peers`	[]DeviceWireguardPeer	Specifies a list of peer configurations to apply to a device.

peers[]

DeviceWireguardPeer a WireGuard device peer configuration.

Field	Type	Description
`publicKey`	string	Specifies the public key of this peer. Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`.
`endpoint`	string	Specifies the endpoint of this peer entry.
`persistentKeepaliveInterval`	Duration	Specifies the persistent keepalive interval for this peer. Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).
`allowedIPs`	[]string	AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.

vip

DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.

machine:
    network:
        interfaces:
            - vip:
                ip: 172.16.199.55 # Specifies the IP address to be used.

Field	Type	Description
`ip`	string	Specifies the IP address to be used.
`equinixMetal`	VIPEquinixMetalConfig	Specifies the Equinix Metal API settings to assign VIP to the node.
`hcloud`	VIPHCloudConfig	Specifies the Hetzner Cloud API settings to assign VIP to the node.

equinixMetal

VIPEquinixMetalConfig contains settings for Equinix Metal VIP management.

Field	Type	Description	Value(s)
`apiToken`	string	Specifies the Equinix Metal API Token.

hcloud

VIPHCloudConfig contains settings for Hetzner Cloud VIP management.

Field	Type	Description	Value(s)
`apiToken`	string	Specifies the Hetzner Cloud API Token.

extraHostEntries[]

ExtraHost represents a host entry in /etc/hosts.

machine:
    network:
        extraHostEntries:
            - ip: 192.168.1.100 # The IP of the host.
              # The host alias.
              aliases:
                - example
                - example.domain.tld

Field	Type	Description	Value(s)
`ip`	string	The IP of the host.
`aliases`	[]string	The host alias.

kubespan

NetworkKubeSpan struct describes KubeSpan configuration.

machine:
    network:
        kubespan:
            enabled: true # Enable the KubeSpan feature.

Field	Type	Description
`enabled`	bool	Enable the KubeSpan feature. Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.
`advertiseKubernetesNetworks`	bool	Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node. If disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel, and KubeSpan handles the node-to-node traffic. If enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly. When enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which is not always the case with CNIs not relying on Kubernetes for IPAM.
`allowDownPeerBypass`	bool	Skip sending traffic via KubeSpan if the peer connection state is not up. This provides configurable choice between connectivity and security: either traffic is always forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly to the peer if Wireguard connection can’t be established.
`harvestExtraEndpoints`	bool	KubeSpan can collect and publish extra endpoints for each member of the cluster based on Wireguard endpoint information for each peer. This feature is disabled by default, don’t enable it with high number of peers (>50) in the KubeSpan network (performance issues).
`mtu`	uint32	KubeSpan link MTU size. Default value is 1420.
`filters`	KubeSpanFilters	KubeSpan advanced filtering of network addresses . Settings in this section are optional, and settings apply only to the node.

filters

KubeSpanFilters struct describes KubeSpan advanced network addresses filtering.

Field	Type	Description	Value(s)
`endpoints`	[]string	Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections. By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works. Default value: no filtering. Show example(s) `endpoints:` `- 0.0.0.0/0` `- '!192.168.0.0/16'` `- ::/0`

install

InstallConfig represents the installation options for preparing a node.

machine:
    install:
        disk: /dev/sda # The disk used for installations.
        # Allows for supplying extra kernel args via the bootloader.
        extraKernelArgs:
            - console=ttyS1
            - panic=10
        image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
        wipe: false # Indicates if the installation disk should be wiped at installation time.

        # # Look up disk using disk attributes like model, size, serial and others.
        # diskSelector:
        #     size: 4GB # Disk size.
        #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
        #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

Field	Type	Description	Value(s)
`disk`	string	The disk used for installations. Show example(s) `disk: /dev/sda` `disk: /dev/nvme0`
`diskSelector`	InstallDiskSelector	Look up disk using disk attributes like model, size, serial and others. Always has priority over `disk`. Show example(s) `diskSelector:` `size: '>= 1TB' # Disk size.` `model: WDC* # Disk model /sys/block/<dev>/device/model.` `# # Disk bus path.` `# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0` `# busPath: /pci0000:00/*`
`extraKernelArgs`	[]string	Allows for supplying extra kernel args via the bootloader. Existing kernel args can be removed by prefixing the argument with a `-`. For example `-console` removes all `console=<value>` arguments, whereas `-console=tty0` removes the `console=tty0` default argument. If Talos is using systemd-boot as a bootloader (default for UEFI) this setting will be ignored. Show example(s) `extraKernelArgs:` `- talos.platform=metal` `- reboot=k`
`image`	string	Allows for supplying the image used to perform the installation. Image reference for each Talos release can be found on GitHub releases page. Show example(s) `image: ghcr.io/siderolabs/installer:latest`
`wipe`	bool	Indicates if the installation disk should be wiped at installation time. Defaults to `true`.	`true` `yes` `false` `no`
`legacyBIOSSupport`	bool	Indicates if MBR partition should be marked as bootable (active). Should be enabled only for the systems with legacy BIOS that doesn’t support GPT partitioning scheme.

diskSelector

InstallDiskSelector represents a disk query parameters for the install disk lookup.

machine:
    install:
        diskSelector:
            size: '>= 1TB' # Disk size.
            model: WDC* # Disk model `/sys/block/<dev>/device/model`.

            # # Disk bus path.
            # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0
            # busPath: /pci0000:00/*

Field	Type	Description	Value(s)
`size`	InstallDiskSizeMatcher	Disk size. Show example(s) `size: 4GB` `size: '> 1TB'` `size: <= 2TB`
`name`	string	Disk name `/sys/block/<dev>/device/name`.
`model`	string	Disk model `/sys/block/<dev>/device/model`.
`serial`	string	Disk serial number `/sys/block/<dev>/serial`.
`modalias`	string	Disk modalias `/sys/block/<dev>/device/modalias`.
`uuid`	string	Disk UUID `/sys/block/<dev>/uuid`.
`wwid`	string	Disk WWID `/sys/block/<dev>/wwid`.
`type`	InstallDiskType	Disk Type.	`ssd` `hdd` `nvme` `sd`
`busPath`	string	Disk bus path. Show example(s) `busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0` `busPath: /pci0000:00/*`

files[]

MachineFile represents a file to write to disk.

machine:
    files:
        - content: '...' # The contents of the file.
          permissions: 0o666 # The file's permissions in octal.
          path: /tmp/file.txt # The path of the file.
          op: append # The operation to use

Field	Type	Description	Value(s)
`content`	string	The contents of the file.
`permissions`	FileMode	The file’s permissions in octal.
`path`	string	The path of the file.
`op`	string	The operation to use	`create` `append` `overwrite`

time

TimeConfig represents the options for configuring time on a machine.

machine:
    time:
        disabled: false # Indicates if the time service is disabled for the machine.
        # description: |
        servers:
            - time.cloudflare.com
        bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.

Field	Type	Description
`disabled`	bool	Indicates if the time service is disabled for the machine. Defaults to `false`.
`servers`	[]string	Specifies time (NTP) servers to use for setting the system time. Defaults to `time.cloudflare.com`. Talos can also sync to the PTP time source (e.g provided by the hypervisor), provide the path to the PTP device as “/dev/ptp0” or “/dev/ptp_kvm”.
`bootTimeout`	Duration	Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. NTP sync will be still running in the background. Defaults to “infinity” (waiting forever for time sync)

registries

RegistriesConfig represents the image pull options.

machine:
    registries:
        # Specifies mirror configuration for each registry host namespace.
        mirrors:
            docker.io:
                # List of endpoints (URLs) for registry mirrors to use.
                endpoints:
                    - https://registry.local
        # Specifies TLS & auth configuration for HTTPS image registries.
        config:
            registry.local:
                # The TLS configuration for the registry.
                tls:
                    # Enable mutual TLS authentication with the registry.
                    clientIdentity:
                        crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                        key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
                # The auth configuration for this registry.
                auth:
                    username: username # Optional registry authentication.
                    password: password # Optional registry authentication.

Field	Type	Description	Value(s)
`mirrors`	map[string]RegistryMirrorConfig	Specifies mirror configuration for each registry host namespace. This setting allows to configure local pull-through caching registires, air-gapped installations, etc. For example, when pulling an image with the reference `example.com:123/image:v1`, the `example.com:123` key will be used to lookup the mirror configuration. Optionally the `*` key can be used to configure a fallback mirror. Registry name is the first segment of image identifier, with ‘docker.io’ being default one. Show example(s) `mirrors:` `ghcr.io:` `# List of endpoints (URLs) for registry mirrors to use.` `endpoints:` `- https://registry.insecure` `- https://ghcr.io/v2/`
`config`	map[string]RegistryConfig	Specifies TLS & auth configuration for HTTPS image registries. Mutual TLS can be enabled with ‘clientIdentity’ option. The full hostname and port (if not using a default port 443) should be used as the key. The fallback key `*` can’t be used for TLS configuration. TLS configuration can be skipped if registry has trusted server certificate. Show example(s) `config:` `registry.insecure:` `# The TLS configuration for the registry.` `tls:` `insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).` `# # Enable mutual TLS authentication with the registry.` `# clientIdentity:` `# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==` `# # The auth configuration for this registry.` `# auth:` `# username: username # Optional registry authentication.` `# password: password # Optional registry authentication.`

mirrors.*

RegistryMirrorConfig represents mirror configuration for a registry.

machine:
    registries:
        mirrors:
            ghcr.io:
                # List of endpoints (URLs) for registry mirrors to use.
                endpoints:
                    - https://registry.insecure
                    - https://ghcr.io/v2/

Field	Type	Description
`endpoints`	[]string	List of endpoints (URLs) for registry mirrors to use. Endpoint configures HTTP/HTTPS access mode, host name, port and path (if path is not set, it defaults to `/v2`).
`overridePath`	bool	Use the exact path specified for the endpoint (don’t append /v2/). This setting is often required for setting up multiple mirrors on a single instance of a registry.
`skipFallback`	bool	Skip fallback to the upstream endpoint, for example the mirror configuration for `docker.io` will not fallback to `registry-1.docker.io`.

config.*

RegistryConfig specifies auth & TLS config per registry.

machine:
    registries:
        config:
            registry.insecure:
                # The TLS configuration for the registry.
                tls:
                    insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

                    # # Enable mutual TLS authentication with the registry.
                    # clientIdentity:
                    #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                    #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

                # # The auth configuration for this registry.
                # auth:
                #     username: username # Optional registry authentication.
                #     password: password # Optional registry authentication.

Field	Type	Description	Value(s)
`tls`	RegistryTLSConfig	The TLS configuration for the registry. Show example(s) `tls:` `# Enable mutual TLS authentication with the registry.` `clientIdentity:` `crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==` `tls:` `insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).` `# # Enable mutual TLS authentication with the registry.` `# clientIdentity:` `# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`auth`	RegistryAuthConfig	The auth configuration for this registry. Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot. Show example(s) `auth:` `username: username # Optional registry authentication.` `password: password # Optional registry authentication.`

tls

RegistryTLSConfig specifies TLS config for HTTPS registries.

machine:
    registries:
        config:
            example.com:
                tls:
                    # Enable mutual TLS authentication with the registry.
                    clientIdentity:
                        crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                        key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

machine:
    registries:
        config:
            example.com:
                tls:
                    insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

                    # # Enable mutual TLS authentication with the registry.
                    # clientIdentity:
                    #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                    #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

Field	Type	Description
`clientIdentity`	PEMEncodedCertificateAndKey	Enable mutual TLS authentication with the registry. Client certificate and key should be base64-encoded. Show example(s) `clientIdentity:` `crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`ca`	Base64Bytes	CA registry certificate to add the list of trusted certificates. Certificate should be base64-encoded.
`insecureSkipVerify`	bool	Skip TLS server certificate verification (not recommended).

auth

RegistryAuthConfig specifies authentication configuration for a registry.

machine:
    registries:
        config:
            example.com:
                auth:
                    username: username # Optional registry authentication.
                    password: password # Optional registry authentication.

Field	Type	Description
`username`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in `.docker/config.json`.
`password`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in `.docker/config.json`.
`auth`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in `.docker/config.json`.
`identityToken`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in `.docker/config.json`.

systemDiskEncryption

SystemDiskEncryptionConfig specifies system disk partitions encryption settings.

machine:
    systemDiskEncryption:
        # Ephemeral partition encryption.
        ephemeral:
            provider: luks2 # Encryption provider to use for the encryption.
            # Defines the encryption keys generation and storage method.
            keys:
                - # Deterministically generated key from the node UUID and PartitionLabel.
                  nodeID: 
                  slot: 0 # Key slot number for LUKS2 encryption.

                  # # KMS managed encryption key.
                  # kms:
                  #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

            # # Cipher kind to use for the encryption. Depends on the encryption provider.
            # cipher: aes-xts-plain64

            # # Defines the encryption sector size.
            # blockSize: 4096

            # # Additional --perf parameters for the LUKS2 encryption.
            # options:
            #     - no_read_workqueue
            #     - no_write_workqueue

Field	Type	Description	Value(s)
`state`	EncryptionConfig	State partition encryption.
`ephemeral`	EncryptionConfig	Ephemeral partition encryption.

state

EncryptionConfig represents partition encryption settings.

Field	Type	Description	Value(s)
`provider`	string	Encryption provider to use for the encryption. Show example(s) `provider: luks2`
`keys`	[]EncryptionKey	Defines the encryption keys generation and storage method.
`cipher`	string	Cipher kind to use for the encryption. Depends on the encryption provider. Show example(s) `cipher: aes-xts-plain64`	`aes-xts-plain64` `xchacha12,aes-adiantum-plain64` `xchacha20,aes-adiantum-plain64`
`keySize`	uint	Defines the encryption key length.
`blockSize`	uint64	Defines the encryption sector size. Show example(s) `blockSize: 4096`
`options`	[]string	Additional —perf parameters for the LUKS2 encryption. Show example(s) `options:` `- no_read_workqueue` `- no_write_workqueue`	`no_read_workqueue` `no_write_workqueue` `same_cpu_crypt`

keys[]

EncryptionKey represents configuration for disk encryption key.

Field	Type	Description
`static`	EncryptionKeyStatic	Key which value is stored in the configuration file.
`nodeID`	EncryptionKeyNodeID	Deterministically generated key from the node UUID and PartitionLabel.
`kms`	EncryptionKeyKMS	KMS managed encryption key. Show example(s) `kms:` `endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.`
`slot`	int	Key slot number for LUKS2 encryption.
`tpm`	EncryptionKeyTPM	Enable TPM based disk encryption.

static

EncryptionKeyStatic represents throw away key type.

Field	Type	Description	Value(s)
`passphrase`	string	Defines the static passphrase value.

nodeID

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

kms

EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server.

machine:
    systemDiskEncryption:
        state:
            keys:
                - kms:
                    endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

Field	Type	Description	Value(s)
`endpoint`	string	KMS endpoint to Seal/Unseal the key.

tpm

EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM.

Field	Type	Description	Value(s)
`checkSecurebootStatusOnEnroll`	bool	Check that Secureboot is enabled in the EFI firmware. If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable.

ephemeral

EncryptionConfig represents partition encryption settings.

Field	Type	Description	Value(s)
`provider`	string	Encryption provider to use for the encryption. Show example(s) `provider: luks2`
`keys`	[]EncryptionKey	Defines the encryption keys generation and storage method.
`cipher`	string	Cipher kind to use for the encryption. Depends on the encryption provider. Show example(s) `cipher: aes-xts-plain64`	`aes-xts-plain64` `xchacha12,aes-adiantum-plain64` `xchacha20,aes-adiantum-plain64`
`keySize`	uint	Defines the encryption key length.
`blockSize`	uint64	Defines the encryption sector size. Show example(s) `blockSize: 4096`
`options`	[]string	Additional —perf parameters for the LUKS2 encryption. Show example(s) `options:` `- no_read_workqueue` `- no_write_workqueue`	`no_read_workqueue` `no_write_workqueue` `same_cpu_crypt`

keys[]

EncryptionKey represents configuration for disk encryption key.

Field	Type	Description
`static`	EncryptionKeyStatic	Key which value is stored in the configuration file.
`nodeID`	EncryptionKeyNodeID	Deterministically generated key from the node UUID and PartitionLabel.
`kms`	EncryptionKeyKMS	KMS managed encryption key. Show example(s) `kms:` `endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.`
`slot`	int	Key slot number for LUKS2 encryption.
`tpm`	EncryptionKeyTPM	Enable TPM based disk encryption.

static

EncryptionKeyStatic represents throw away key type.

Field	Type	Description	Value(s)
`passphrase`	string	Defines the static passphrase value.

nodeID

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

kms

EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server.

machine:
    systemDiskEncryption:
        ephemeral:
            keys:
                - kms:
                    endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

Field	Type	Description	Value(s)
`endpoint`	string	KMS endpoint to Seal/Unseal the key.

tpm

EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM.

Field	Type	Description	Value(s)
`checkSecurebootStatusOnEnroll`	bool	Check that Secureboot is enabled in the EFI firmware. If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable.

features

FeaturesConfig describes individual Talos features that can be switched on or off.

machine:
    features:
        rbac: true # Enable role-based access control (RBAC).

        # # Configure Talos API access from Kubernetes pods.
        # kubernetesTalosAPIAccess:
        #     enabled: true # Enable Talos API access from Kubernetes pods.
        #     # The list of Talos API roles which can be granted for access from Kubernetes pods.
        #     allowedRoles:
        #         - os:reader
        #     # The list of Kubernetes namespaces Talos API access is available from.
        #     allowedKubernetesNamespaces:
        #         - kube-system

Field	Type	Description
`rbac`	bool	Enable role-based access control (RBAC).
`stableHostname`	bool	Enable stable default hostname.
`kubernetesTalosAPIAccess`	KubernetesTalosAPIAccessConfig	Configure Talos API access from Kubernetes pods. This feature is disabled if the feature config is not specified. Show example(s) `kubernetesTalosAPIAccess:` `enabled: true # Enable Talos API access from Kubernetes pods.` `# The list of Talos API roles which can be granted for access from Kubernetes pods.` `allowedRoles:` `- os:reader` `# The list of Kubernetes namespaces Talos API access is available from.` `allowedKubernetesNamespaces:` `- kube-system`
`apidCheckExtKeyUsage`	bool	Enable checks for extended key usage of client certificates in apid.
`diskQuotaSupport`	bool	Enable XFS project quota support for EPHEMERAL partition and user disks. Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota.
`kubePrism`	KubePrism	KubePrism - local proxy/load balancer on defined port that will distribute requests to all API servers in the cluster.
`hostDNS`	HostDNSConfig	Configures host DNS caching resolver.
`imageCache`	ImageCacheConfig	Enable Image Cache feature.
`nodeAddressSortAlgorithm`	string	Select the node address sort algorithm. The ‘v1’ algorithm sorts addresses by the address itself. The ‘v2’ algorithm prefers more specific prefixes. If unset, defaults to ‘v1’.

kubernetesTalosAPIAccess

KubernetesTalosAPIAccessConfig describes the configuration for the Talos API access from Kubernetes pods.

machine:
    features:
        kubernetesTalosAPIAccess:
            enabled: true # Enable Talos API access from Kubernetes pods.
            # The list of Talos API roles which can be granted for access from Kubernetes pods.
            allowedRoles:
                - os:reader
            # The list of Kubernetes namespaces Talos API access is available from.
            allowedKubernetesNamespaces:
                - kube-system

Field	Type	Description
`enabled`	bool	Enable Talos API access from Kubernetes pods.
`allowedRoles`	[]string	The list of Talos API roles which can be granted for access from Kubernetes pods. Empty list means that no roles can be granted, so access is blocked.
`allowedKubernetesNamespaces`	[]string	The list of Kubernetes namespaces Talos API access is available from.

kubePrism

KubePrism describes the configuration for the KubePrism load balancer.

Field	Type	Description	Value(s)
`enabled`	bool	Enable KubePrism support - will start local load balancing proxy.
`port`	int	KubePrism port.

hostDNS

HostDNSConfig describes the configuration for the host DNS resolver.

Field	Type	Description
`enabled`	bool	Enable host DNS caching resolver.
`forwardKubeDNSToHost`	bool	Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. When enabled, CoreDNS pods use host DNS server as the upstream DNS (instead of using configured upstream DNS resolvers directly).
`resolveMemberNames`	bool	Resolve member hostnames using the host DNS resolver. When enabled, cluster member hostnames and node names are resolved using the host DNS resolver. This requires service discovery to be enabled.

imageCache

ImageCacheConfig describes the configuration for the Image Cache feature.

Field	Type	Description	Value(s)
`localEnabled`	bool	Enable local image cache.

udev

UdevConfig describes how the udev system should be configured.

machine:
    udev:
        # List of udev rules to apply to the udev system
        rules:
            - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"

Field	Type	Description	Value(s)
`rules`	[]string	List of udev rules to apply to the udev system

logging

LoggingConfig struct configures Talos logging.

machine:
    logging:
        # Logging destination.
        destinations:
            - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
              format: json_lines # Logs format.

Field	Type	Description	Value(s)
`destinations`	[]LoggingDestination	Logging destination.

destinations[]

LoggingDestination struct configures Talos logging destination.

Field	Type	Description	Value(s)
`endpoint`	Endpoint	Where to send logs. Supported protocols are “tcp” and “udp”. Show example(s) `endpoint: udp://127.0.0.1:12345` `endpoint: tcp://1.2.3.4:12345`
`format`	string	Logs format.	`json_lines`
`extraTags`	map[string]string	Extra tags (key-value) pairs to attach to every log message sent.

endpoint

Endpoint represents the endpoint URL parsed out of the machine config.

machine:
    logging:
        destinations:
            - endpoint: https://1.2.3.4:6443

machine:
    logging:
        destinations:
            - endpoint: https://cluster1.internal:6443

machine:
    logging:
        destinations:
            - endpoint: udp://127.0.0.1:12345

machine:
    logging:
        destinations:
            - endpoint: tcp://1.2.3.4:12345

Field	Type	Description	Value(s)

kernel

KernelConfig struct configures Talos Linux kernel.

machine:
    kernel:
        # Kernel modules to load.
        modules:
            - name: brtfs # Module name.

Field	Type	Description	Value(s)
`modules`	[]KernelModuleConfig	Kernel modules to load.

modules[]

KernelModuleConfig struct configures Linux kernel modules to load.

Field	Type	Description	Value(s)
`name`	string	Module name.
`parameters`	[]string	Module parameters, changes applied after reboot.

seccompProfiles[]

MachineSeccompProfile defines seccomp profiles for the machine.

machine:
    seccompProfiles:
        - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
          # The `value` field is used to provide the seccomp profile.
          value:
            defaultAction: SCMP_ACT_LOG

Field	Type	Description	Value(s)
`name`	string	The `name` field is used to provide the file name of the seccomp profile.
`value`	Unstructured	The `value` field is used to provide the seccomp profile.

cluster

ClusterConfig represents the cluster-wide config values.

cluster:
    # ControlPlaneConfig represents the control plane configuration options.
    controlPlane:
        endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
        localAPIServerPort: 443 # The port that the API server listens on internally.
    clusterName: talos.local
    # ClusterNetworkConfig represents kube networking configuration options.
    network:
        # The CNI used.
        cni:
            name: flannel # Name of CNI to use.
        dnsDomain: cluster.local # The domain used by Kubernetes DNS.
        # The pod subnet CIDR.
        podSubnets:
            - 10.244.0.0/16
        # The service subnet CIDR.
        serviceSubnets:
            - 10.96.0.0/12

Field	Type	Description	Value(s)
`id`	string	Globally unique identifier for this cluster (base64 encoded random 32 bytes).
`secret`	string	Shared secret of cluster (base64 encoded random 32 bytes). This secret is shared among cluster members but should never be sent over the network.
`controlPlane`	ControlPlaneConfig	Provides control plane specific configuration options. Show example(s) `controlPlane:` `endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.` `localAPIServerPort: 443 # The port that the API server listens on internally.`
`clusterName`	string	Configures the cluster’s name.
`network`	ClusterNetworkConfig	Provides cluster specific network configuration options. Show example(s) `network:` `# The CNI used.` `cni:` `name: flannel # Name of CNI to use.` `dnsDomain: cluster.local # The domain used by Kubernetes DNS.` `# The pod subnet CIDR.` `podSubnets:` `- 10.244.0.0/16` `# The service subnet CIDR.` `serviceSubnets:` `- 10.96.0.0/12`
`token`	string	The bootstrap token used to join the cluster. Show example(s) `token: wlzjyw.bei2zfylhs2by0wd`
`aescbcEncryptionSecret`	string	A key used for the encryption of secret data at rest. Enables encryption with AESCBC. Show example(s) `aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=`
`secretboxEncryptionSecret`	string	A key used for the encryption of secret data at rest. Enables encryption with secretbox. Secretbox has precedence over AESCBC. Show example(s) `secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=`
`ca`	PEMEncodedCertificateAndKey	The base64 encoded root certificate authority used by Kubernetes. Show example(s) `ca:` `crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`acceptedCAs`	[]PEMEncodedCertificate	The list of base64 encoded accepted certificate authorities used by Kubernetes.
`aggregatorCA`	PEMEncodedCertificateAndKey	The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. This CA can be self-signed. Show example(s) `aggregatorCA:` `crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`serviceAccount`	PEMEncodedKey	The base64 encoded private key for service account token generation. Show example(s) `serviceAccount:` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`apiServer`	APIServerConfig	API server specific configuration options. Show example(s) `apiServer:` `image: registry.k8s.io/kube-apiserver:v1.33.0 # The container image used in the API server manifest.` `# Extra arguments to supply to the API server.` `extraArgs:` `feature-gates: ServerSideApply=true` `http2-max-streams-per-connection: "32"` `# Extra certificate subject alternative names for the API server's certificate.` `certSANs:` `- 1.2.3.4` `- 4.5.6.7`
`controllerManager`	ControllerManagerConfig	Controller manager server specific configuration options. Show example(s) `controllerManager:` `image: registry.k8s.io/kube-controller-manager:v1.33.0 # The container image used in the controller manager manifest.` `# Extra arguments to supply to the controller manager.` `extraArgs:` `feature-gates: ServerSideApply=true`
`proxy`	ProxyConfig	Kube-proxy server-specific configuration options Show example(s) `proxy:` `image: registry.k8s.io/kube-proxy:v1.33.0 # The container image used in the kube-proxy manifest.` `mode: ipvs # proxy mode of kube-proxy.` `# Extra arguments to supply to kube-proxy.` `extraArgs:` `proxy-mode: iptables`
`scheduler`	SchedulerConfig	Scheduler server specific configuration options. Show example(s) `scheduler:` `image: registry.k8s.io/kube-scheduler:v1.33.0 # The container image used in the scheduler manifest.` `# Extra arguments to supply to the scheduler.` `extraArgs:` `feature-gates: AllBeta=true`
`discovery`	ClusterDiscoveryConfig	Configures cluster member discovery. Show example(s) `discovery:` `enabled: true # Enable the cluster membership discovery feature.` `# Configure registries used for cluster member discovery.` `registries:` `# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information` `kubernetes:` `# Service registry is using an external service to push and pull information about cluster members.` `service:` `endpoint: https://discovery.talos.dev/ # External service endpoint.`
`etcd`	EtcdConfig	Etcd specific configuration options. Show example(s) `etcd:` `image: gcr.io/etcd-development/etcd:v3.5.21 # The container image used to create the etcd service.` `# The ca is the root certificate authority of the PKI.` `ca:` `crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==` `# Extra arguments to supply to etcd.` `extraArgs:` `election-timeout: "5000"`
`coreDNS`	CoreDNS	Core DNS specific configuration options. Show example(s) `coreDNS:` `image: registry.k8s.io/coredns/coredns:v1.12.1 # The image field is an override to the default coredns image.`
`externalCloudProvider`	ExternalCloudProviderConfig	External cloud provider configuration. Show example(s) `externalCloudProvider:` `enabled: true # Enable external cloud provider.` `# A list of urls that point to additional manifests for an external cloud provider.` `manifests:` `- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml` `- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml`
`extraManifests`	[]string	A list of urls that point to additional manifests. These will get automatically deployed as part of the bootstrap. Show example(s) `extraManifests:` `- https://www.example.com/manifest1.yaml` `- https://www.example.com/manifest2.yaml`
`extraManifestHeaders`	map[string]string	A map of key value pairs that will be added while fetching the extraManifests. Show example(s) `extraManifestHeaders:` `Token: "1234567"` `X-ExtraInfo: info`
`inlineManifests`	[]ClusterInlineManifest	A list of inline Kubernetes manifests. These will get automatically deployed as part of the bootstrap. Show example(s) `inlineManifests: [{ name: "namespace-ci", contents: "apiVersion: v1\nkind: Namespace\nmetadata:\n name: ci" }]`
`adminKubeconfig`	AdminKubeconfigConfig	Settings for admin kubeconfig generation. Certificate lifetime can be configured. Show example(s) `adminKubeconfig:` `certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).`
`allowSchedulingOnControlPlanes`	bool	Allows running workload on control-plane nodes. Show example(s) `allowSchedulingOnControlPlanes: true`	`true` `yes` `false` `no`

controlPlane

ControlPlaneConfig represents the control plane configuration options.

cluster:
    controlPlane:
        endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
        localAPIServerPort: 443 # The port that the API server listens on internally.

Field	Type	Description	Value(s)
`endpoint`	Endpoint	Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. It is single-valued, and may optionally include a port number. Show example(s) `endpoint: https://1.2.3.4:6443` `endpoint: https://cluster1.internal:6443`
`localAPIServerPort`	int	The port that the API server listens on internally. This may be different than the port portion listed in the endpoint field above. The default is `6443`.

endpoint

Endpoint represents the endpoint URL parsed out of the machine config.

cluster:
    controlPlane:
        endpoint: https://1.2.3.4:6443

cluster:
    controlPlane:
        endpoint: https://cluster1.internal:6443

cluster:
    controlPlane:
        endpoint: udp://127.0.0.1:12345

cluster:
    controlPlane:
        endpoint: tcp://1.2.3.4:12345

Field	Type	Description	Value(s)

network

ClusterNetworkConfig represents kube networking configuration options.

cluster:
    network:
        # The CNI used.
        cni:
            name: flannel # Name of CNI to use.
        dnsDomain: cluster.local # The domain used by Kubernetes DNS.
        # The pod subnet CIDR.
        podSubnets:
            - 10.244.0.0/16
        # The service subnet CIDR.
        serviceSubnets:
            - 10.96.0.0/12

Field	Type	Description
`cni`	CNIConfig	The CNI used. Composed of “name” and “urls”. The “name” key supports the following options: “flannel”, “custom”, and “none”. “flannel” uses Talos-managed Flannel CNI, and that’s the default option. ”custom” uses custom manifests that should be provided in “urls”. “none” indicates that Talos will not manage any CNI installation. Show example(s) `cni:` `name: custom # Name of CNI to use.` `# URLs containing manifests to apply for the CNI.` `urls:` `- https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml`
`dnsDomain`	string	The domain used by Kubernetes DNS. The default is `cluster.local` Show example(s) `dnsDomain: cluster.local`
`podSubnets`	[]string	The pod subnet CIDR. Show example(s) `podSubnets:` `- 10.244.0.0/16`
`serviceSubnets`	[]string	The service subnet CIDR. Show example(s) `serviceSubnets:` `- 10.96.0.0/12`

cni

CNIConfig represents the CNI configuration options.

cluster:
    network:
        cni:
            name: custom # Name of CNI to use.
            # URLs containing manifests to apply for the CNI.
            urls:
                - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml

Field	Type	Description	Value(s)
`name`	string	Name of CNI to use.	`flannel` `custom` `none`
`urls`	[]string	URLs containing manifests to apply for the CNI. Should be present for “custom”, must be empty for “flannel” and “none”.
`flannel`	FlannelCNIConfig	Flannel configuration options.

flannel

FlannelCNIConfig represents the Flannel CNI configuration options.

Field	Type	Description	Value(s)
`extraArgs`	[]string	Extra arguments for ‘flanneld’. Show example(s) `extraArgs:` `- --iface-can-reach=192.168.1.1`

apiServer

APIServerConfig represents the kube apiserver configuration options.

cluster:
    apiServer:
        image: registry.k8s.io/kube-apiserver:v1.33.0 # The container image used in the API server manifest.
        # Extra arguments to supply to the API server.
        extraArgs:
            feature-gates: ServerSideApply=true
            http2-max-streams-per-connection: "32"
        # Extra certificate subject alternative names for the API server's certificate.
        certSANs:
            - 1.2.3.4
            - 4.5.6.7

        # # Configure the API server admission plugins.
        # admissionControl:
        #     - name: PodSecurity # Name is the name of the admission controller.
        #       # Configuration is an embedded configuration object to be used as the plugin's
        #       configuration:
        #         apiVersion: pod-security.admission.config.k8s.io/v1alpha1
        #         defaults:
        #             audit: restricted
        #             audit-version: latest
        #             enforce: baseline
        #             enforce-version: latest
        #             warn: restricted
        #             warn-version: latest
        #         exemptions:
        #             namespaces:
        #                 - kube-system
        #             runtimeClasses: []
        #             usernames: []
        #         kind: PodSecurityConfiguration

        # # Configure the API server audit policy.
        # auditPolicy:
        #     apiVersion: audit.k8s.io/v1
        #     kind: Policy
        #     rules:
        #         - level: Metadata

        # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
        # authorizationConfig:
        #     - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
        #       name: webhook # Name is used to describe the authorizer.
        #       # webhook is the configuration for the webhook authorizer.
        #       webhook:
        #         connectionInfo:
        #             type: InClusterConfig
        #         failurePolicy: Deny
        #         matchConditionSubjectAccessReviewVersion: v1
        #         matchConditions:
        #             - expression: has(request.resourceAttributes)
        #             - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
        #         subjectAccessReviewVersion: v1
        #         timeout: 3s
        #     - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
        #       name: in-cluster-authorizer # Name is used to describe the authorizer.
        #       # webhook is the configuration for the webhook authorizer.
        #       webhook:
        #         connectionInfo:
        #             type: InClusterConfig
        #         failurePolicy: NoOpinion
        #         matchConditionSubjectAccessReviewVersion: v1
        #         subjectAccessReviewVersion: v1
        #         timeout: 3s

Field	Type	Description
`image`	string	The container image used in the API server manifest. Show example(s) `image: registry.k8s.io/kube-apiserver:v1.33.0`
`extraArgs`	map[string]string	Extra arguments to supply to the API server.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the API server static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.
`certSANs`	[]string	Extra certificate subject alternative names for the API server’s certificate.
`disablePodSecurityPolicy`	bool	Disable PodSecurityPolicy in the API server and default manifests.
`admissionControl`	[]AdmissionPluginConfig	Configure the API server admission plugins. Show example(s) `admissionControl:` `- name: PodSecurity # Name is the name of the admission controller.` `# Configuration is an embedded configuration object to be used as the plugin's` `configuration:` `apiVersion: pod-security.admission.config.k8s.io/v1alpha1` `defaults:` `audit: restricted` `audit-version: latest` `enforce: baseline` `enforce-version: latest` `warn: restricted` `warn-version: latest` `exemptions:` `namespaces:` `- kube-system` `runtimeClasses: []` `usernames: []` `kind: PodSecurityConfiguration`
`auditPolicy`	Unstructured	Configure the API server audit policy. Show example(s) `auditPolicy:` `apiVersion: audit.k8s.io/v1` `kind: Policy` `rules:` `- level: Metadata`
`resources`	ResourcesConfig	Configure the API server resources.
`authorizationConfig`	[]AuthorizationConfigAuthorizerConfig	Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. Show example(s) `authorizationConfig:` `- type: Webhook # Type is the name of the authorizer. Allowed values are Node, RBAC, and Webhook.` `name: webhook # Name is used to describe the authorizer.` `# webhook is the configuration for the webhook authorizer.` `webhook:` `connectionInfo:` `type: InClusterConfig` `failurePolicy: Deny` `matchConditionSubjectAccessReviewVersion: v1` `matchConditions:` `- expression: has(request.resourceAttributes)` `- expression: '!(''system:serviceaccounts:kube-system'' in request.groups)'` `subjectAccessReviewVersion: v1` `timeout: 3s` `- type: Webhook # Type is the name of the authorizer. Allowed values are Node, RBAC, and Webhook.` `name: in-cluster-authorizer # Name is used to describe the authorizer.` `# webhook is the configuration for the webhook authorizer.` `webhook:` `connectionInfo:` `type: InClusterConfig` `failurePolicy: NoOpinion` `matchConditionSubjectAccessReviewVersion: v1` `subjectAccessReviewVersion: v1` `timeout: 3s`

extraVolumes[]

VolumeMountConfig struct describes extra volume mount for the static pods.

Field	Type	Description
`hostPath`	string	Path on the host. Show example(s) `hostPath: /var/lib/auth`
`mountPath`	string	Path in the container. Show example(s) `mountPath: /etc/kubernetes/auth`
`readonly`	bool	Mount the volume read only. Show example(s) `readonly: true`

admissionControl[]

AdmissionPluginConfig represents the API server admission plugin configuration.

cluster:
    apiServer:
        admissionControl:
            - name: PodSecurity # Name is the name of the admission controller.
              # Configuration is an embedded configuration object to be used as the plugin's
              configuration:
                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
                defaults:
                    audit: restricted
                    audit-version: latest
                    enforce: baseline
                    enforce-version: latest
                    warn: restricted
                    warn-version: latest
                exemptions:
                    namespaces:
                        - kube-system
                    runtimeClasses: []
                    usernames: []
                kind: PodSecurityConfiguration

Field	Type	Description	Value(s)
`name`	string	Name is the name of the admission controller. It must match the registered admission plugin name.
`configuration`	Unstructured	Configuration is an embedded configuration object to be used as the plugin’s configuration.

resources

ResourcesConfig represents the pod resources.

Field	Type	Description	Value(s)
`requests`	Unstructured	Requests configures the reserved cpu/memory resources. Show example(s) `requests:` `cpu: 1` `memory: 1Gi`
`limits`	Unstructured	Limits configures the maximum cpu/memory resources a container can use. Show example(s) `limits:` `cpu: 2` `memory: 2500Mi`

authorizationConfig[]

AuthorizationConfigAuthorizerConfig represents the API server authorization config authorizer configuration.

cluster:
    apiServer:
        authorizationConfig:
            - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
              name: webhook # Name is used to describe the authorizer.
              # webhook is the configuration for the webhook authorizer.
              webhook:
                connectionInfo:
                    type: InClusterConfig
                failurePolicy: Deny
                matchConditionSubjectAccessReviewVersion: v1
                matchConditions:
                    - expression: has(request.resourceAttributes)
                    - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
                subjectAccessReviewVersion: v1
                timeout: 3s
            - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
              name: in-cluster-authorizer # Name is used to describe the authorizer.
              # webhook is the configuration for the webhook authorizer.
              webhook:
                connectionInfo:
                    type: InClusterConfig
                failurePolicy: NoOpinion
                matchConditionSubjectAccessReviewVersion: v1
                subjectAccessReviewVersion: v1
                timeout: 3s

Field	Type	Description
`type`	string	Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
`name`	string	Name is used to describe the authorizer.
`webhook`	Unstructured	webhook is the configuration for the webhook authorizer.

controllerManager

ControllerManagerConfig represents the kube controller manager configuration options.

cluster:
    controllerManager:
        image: registry.k8s.io/kube-controller-manager:v1.33.0 # The container image used in the controller manager manifest.
        # Extra arguments to supply to the controller manager.
        extraArgs:
            feature-gates: ServerSideApply=true

Field	Type	Description
`image`	string	The container image used in the controller manager manifest. Show example(s) `image: registry.k8s.io/kube-controller-manager:v1.33.0`
`extraArgs`	map[string]string	Extra arguments to supply to the controller manager.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the controller manager static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.
`resources`	ResourcesConfig	Configure the controller manager resources.

extraVolumes[]

VolumeMountConfig struct describes extra volume mount for the static pods.

Field	Type	Description
`hostPath`	string	Path on the host. Show example(s) `hostPath: /var/lib/auth`
`mountPath`	string	Path in the container. Show example(s) `mountPath: /etc/kubernetes/auth`
`readonly`	bool	Mount the volume read only. Show example(s) `readonly: true`

resources

ResourcesConfig represents the pod resources.

Field	Type	Description	Value(s)
`requests`	Unstructured	Requests configures the reserved cpu/memory resources. Show example(s) `requests:` `cpu: 1` `memory: 1Gi`
`limits`	Unstructured	Limits configures the maximum cpu/memory resources a container can use. Show example(s) `limits:` `cpu: 2` `memory: 2500Mi`

proxy

ProxyConfig represents the kube proxy configuration options.

cluster:
    proxy:
        image: registry.k8s.io/kube-proxy:v1.33.0 # The container image used in the kube-proxy manifest.
        mode: ipvs # proxy mode of kube-proxy.
        # Extra arguments to supply to kube-proxy.
        extraArgs:
            proxy-mode: iptables

        # # Disable kube-proxy deployment on cluster bootstrap.
        # disabled: false

Field	Type	Description
`disabled`	bool	Disable kube-proxy deployment on cluster bootstrap. Show example(s) `disabled: false`
`image`	string	The container image used in the kube-proxy manifest. Show example(s) `image: registry.k8s.io/kube-proxy:v1.33.0`
`mode`	string	proxy mode of kube-proxy. The default is ‘iptables’.
`extraArgs`	map[string]string	Extra arguments to supply to kube-proxy.

scheduler

SchedulerConfig represents the kube scheduler configuration options.

cluster:
    scheduler:
        image: registry.k8s.io/kube-scheduler:v1.33.0 # The container image used in the scheduler manifest.
        # Extra arguments to supply to the scheduler.
        extraArgs:
            feature-gates: AllBeta=true

Field	Type	Description
`image`	string	The container image used in the scheduler manifest. Show example(s) `image: registry.k8s.io/kube-scheduler:v1.33.0`
`extraArgs`	map[string]string	Extra arguments to supply to the scheduler.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the scheduler static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.
`resources`	ResourcesConfig	Configure the scheduler resources.
`config`	Unstructured	Specify custom kube-scheduler configuration.

extraVolumes[]

VolumeMountConfig struct describes extra volume mount for the static pods.

Field	Type	Description
`hostPath`	string	Path on the host. Show example(s) `hostPath: /var/lib/auth`
`mountPath`	string	Path in the container. Show example(s) `mountPath: /etc/kubernetes/auth`
`readonly`	bool	Mount the volume read only. Show example(s) `readonly: true`

resources

ResourcesConfig represents the pod resources.

Field	Type	Description	Value(s)
`requests`	Unstructured	Requests configures the reserved cpu/memory resources. Show example(s) `requests:` `cpu: 1` `memory: 1Gi`
`limits`	Unstructured	Limits configures the maximum cpu/memory resources a container can use. Show example(s) `limits:` `cpu: 2` `memory: 2500Mi`

discovery

ClusterDiscoveryConfig struct configures cluster membership discovery.

cluster:
    discovery:
        enabled: true # Enable the cluster membership discovery feature.
        # Configure registries used for cluster member discovery.
        registries:
            # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
            kubernetes: 
            # Service registry is using an external service to push and pull information about cluster members.
            service:
                endpoint: https://discovery.talos.dev/ # External service endpoint.

Field	Type	Description	Value(s)
`enabled`	bool	Enable the cluster membership discovery feature. Cluster discovery is based on individual registries which are configured under the registries field.
`registries`	DiscoveryRegistriesConfig	Configure registries used for cluster member discovery.

registries

DiscoveryRegistriesConfig struct configures cluster membership discovery.

Field	Type	Description	Value(s)
`kubernetes`	RegistryKubernetesConfig	Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information as annotations on the Node resources. This feature is deprecated as it is not compatible with Kubernetes 1.32+. See https://github.com/siderolabs/talos/issues/9980 for more information.
`service`	RegistryServiceConfig	Service registry is using an external service to push and pull information about cluster members.

kubernetes

RegistryKubernetesConfig struct configures Kubernetes discovery registry.

Field	Type	Description	Value(s)
`disabled`	bool	Disable Kubernetes discovery registry.

service

RegistryServiceConfig struct configures Kubernetes discovery registry.

Field	Type	Description	Value(s)
`disabled`	bool	Disable external service discovery registry.
`endpoint`	string	External service endpoint. Show example(s) `endpoint: https://discovery.talos.dev/`

etcd

EtcdConfig represents the etcd configuration options.

cluster:
    etcd:
        image: gcr.io/etcd-development/etcd:v3.5.21 # The container image used to create the etcd service.
        # The `ca` is the root certificate authority of the PKI.
        ca:
            crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
            key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
        # Extra arguments to supply to etcd.
        extraArgs:
            election-timeout: "5000"

        # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
        # advertisedSubnets:
        #     - 10.0.0.0/8

Field	Type	Description
`image`	string	The container image used to create the etcd service. Show example(s) `image: gcr.io/etcd-development/etcd:v3.5.21`
`ca`	PEMEncodedCertificateAndKey	The `ca` is the root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`. Show example(s) `ca:` `crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t` `key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`extraArgs`	map[string]string	Extra arguments to supply to etcd. Note that the following args are not allowed: - `name` - `data-dir` - `initial-cluster-state` - `listen-peer-urls` - `listen-client-urls` - `cert-file` - `key-file` - `trusted-ca-file` - `peer-client-cert-auth` - `peer-cert-file` - `peer-trusted-ca-file` - `peer-key-file`
`advertisedSubnets`	[]string	The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node. Show example(s) `advertisedSubnets:` `- 10.0.0.0/8`
`listenSubnets`	[]string	The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections. If `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to `advertisedSubnets`. If neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node.

coreDNS

CoreDNS represents the CoreDNS config values.

cluster:
    coreDNS:
        image: registry.k8s.io/coredns/coredns:v1.12.1 # The `image` field is an override to the default coredns image.

Field	Type	Description	Value(s)
`disabled`	bool	Disable coredns deployment on cluster bootstrap.
`image`	string	The `image` field is an override to the default coredns image.

externalCloudProvider

ExternalCloudProviderConfig contains external cloud provider configuration.

cluster:
    externalCloudProvider:
        enabled: true # Enable external cloud provider.
        # A list of urls that point to additional manifests for an external cloud provider.
        manifests:
            - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
            - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml

Field	Type	Description	Value(s)
`enabled`	bool	Enable external cloud provider.	`true` `yes` `false` `no`
`manifests`	[]string	A list of urls that point to additional manifests for an external cloud provider. These will get automatically deployed as part of the bootstrap. Show example(s) `manifests:` `- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml` `- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml`

inlineManifests[]

ClusterInlineManifest struct describes inline bootstrap manifests for the user.

cluster:
    inlineManifests:
        - name: namespace-ci # Name of the manifest.
          contents: |- # Manifest contents as a string.
            apiVersion: v1
            kind: Namespace
            metadata:
            	name: ci

Field	Type	Description	Value(s)
`name`	string	Name of the manifest. Name should be unique. Show example(s) `name: csi`
`contents`	string	Manifest contents as a string. Show example(s) `contents: /etc/kubernetes/auth`

adminKubeconfig

AdminKubeconfigConfig contains admin kubeconfig settings.

cluster:
    adminKubeconfig:
        certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).

Field	Type	Description	Value(s)
`certLifetime`	Duration	Admin kubeconfig certificate lifetime (default is 1 year). Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).

​machine

​controlPlane

​controllerManager

​scheduler

​kubelet

​extraMounts[]

uidMappings[]

gidMappings[]

​nodeIP

​network

​interfaces[]

deviceSelector

routes[]

bond

deviceSelectors[]

bridge

stp

vlan

bridgePort

vlans[]

routes[]

vip

equinixMetal

hcloud

dhcpOptions

dhcpOptions

wireguard

peers[]

vip

equinixMetal

hcloud

​extraHostEntries[]

​kubespan

filters

​install

​diskSelector

​files[]

​time

​registries

​mirrors.*

​config.*

tls

auth

​systemDiskEncryption

​state

keys[]

static

nodeID

kms

tpm

​ephemeral

keys[]

static

nodeID

kms

tpm

​features

​kubernetesTalosAPIAccess

​kubePrism

​hostDNS

​imageCache

​udev

​logging

​destinations[]

endpoint

​kernel

​modules[]

​seccompProfiles[]

​cluster

​controlPlane

​endpoint

​network

​cni

flannel

​apiServer

​extraVolumes[]

​admissionControl[]

​resources

​authorizationConfig[]

​controllerManager

machine

controlPlane

controllerManager

scheduler

kubelet

extraMounts[]

nodeIP

network

interfaces[]

extraHostEntries[]

kubespan

install

diskSelector

files[]

time

registries

mirrors.*

config.*

systemDiskEncryption

state

ephemeral

features

kubernetesTalosAPIAccess

kubePrism

hostDNS

imageCache

udev

logging

destinations[]

kernel

modules[]

seccompProfiles[]

cluster

controlPlane

endpoint

network

cni

apiServer

extraVolumes[]

admissionControl[]

resources

authorizationConfig[]

controllerManager

extraVolumes[]

resources

proxy

scheduler

extraVolumes[]

resources

discovery

registries

etcd

coreDNS

externalCloudProvider

inlineManifests[]

adminKubeconfig