> ## Documentation Index
> Fetch the complete documentation index at: https://siderolabs-fe86397c-1-11-reference.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
> Config defines the v1alpha1.Config Talos machine configuration document.
# Config
```yaml
version: v1alpha1
machine: # ...
cluster: # ...
```
| Field | Type | Description | Value(s) |
| --------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| `version` | string | Indicates the schema used to decode the contents. | `v1alpha1`
|
| `debug` | bool | Enable verbose logging to the console.
All system containers logs will flow into serial console.
**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.
`yes`
`false`
`no`
|
| `machine` | MachineConfig | Provides machine specific configuration options. | |
| `cluster` | ClusterConfig | Provides cluster specific configuration options. | |
## machine
MachineConfig represents the machine-specific config values.
```yaml
machine:
type: controlplane
# InstallConfig represents the installation options for preparing a node.
install:
disk: /dev/sda # The disk used for installations.
# Allows for supplying extra kernel args via the bootloader.
extraKernelArgs:
- console=ttyS1
- panic=10
image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
wipe: false # Indicates if the installation disk should be wiped at installation time.
# # Look up disk using disk attributes like model, size, serial and others.
# diskSelector:
# size: 4GB # Disk size.
# model: WDC* # Disk model `/sys/block//device/model`.
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
```
| Field | Type | Description | Value(s) |
| -------------------------- | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `type` | string | Defines the role of the machine within the cluster.
**Control Plane**
Control Plane node type designates the node as a control plane member.
This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.
**Worker**
Worker node type designates the node as a worker node.
This means it will be an available compute node for scheduling workloads.
This node type was previously known as "join"; that value is still supported but deprecated.
`worker`
|
| `token` | string | The `token` is used by a machine to join the PKI of the cluster.
Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.Show example(s)
`token: 328hom.uqjzh6jnn2eie9oi`The root certificate authority of the PKI.
It is composed of a base64 encoded `crt` and `key`.Show example(s)
`ca:`
` crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`The certificates issued by certificate authorities are accepted in addition to issuing 'ca'.
It is composed of a base64 encoded `crt`.Extra certificate subject alternative names for the machine's certificate.
By default, all non-loopback interface IPs are automatically added to the certificate's SANs.Show example(s)
`certSANs:`
` - 10.0.0.10`
` - 172.16.0.10`
` - 192.168.0.10`Show example(s)
`controlPlane:`
` # Controller manager machine specific configuration options.`
` controllerManager:`
` disabled: false # Disable kube-controller-manager on the node.`
` # Scheduler machine specific configuration options.`
` scheduler:`
` disabled: true # Disable kube-scheduler on the node.`Show example(s)
`kubelet:`
` image: ghcr.io/siderolabs/kubelet:v1.33.0 # The image field is an optional reference to an alternative kubelet image.`
` # The extraArgs field is used to provide additional flags to the kubelet.`
` extraArgs:`
` feature-gates: ServerSideApply=true`Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
Static pods can be used to run components which should be started before the Kubernetes control plane is up.
Talos doesn't validate the pod definition.
Updates to this field can be applied without a reboot.
See [https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/](https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/).Show example(s)
`pods:`
` - apiVersion: v1`
` kind: pod`
` metadata:`
` name: nginx`
` spec:`
` containers:`
` - image: nginx`
` name: nginx`Show example(s)
`network:`
` hostname: worker-1 # Used to statically set the hostname for the machine.`
` # interfaces is used to define the network interface configuration.`
` interfaces:`
` - interface: enp0s1 # The interface name.`
` # Assigns static IP addresses to the interface.`
` addresses:`
` - 192.168.2.0/24`
` # A list of routes associated with the interface.`
` routes:`
` - network: 0.0.0.0/0 # The route's network (destination).`
` gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).`
` metric: 1024 # The optional metric for the route.`
` mtu: 1500 # The interface's MTU.`Used to provide instructions for installations.
Note that this configuration section gets silently ignored by Talos images that are considered pre-installed.
To make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.Show example(s)
`install:`
` disk: /dev/sda # The disk used for installations.`
` # Allows for supplying extra kernel args via the bootloader.`
` extraKernelArgs:`
` - console=ttyS1`
` - panic=10`
` image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.`
` wipe: false # Indicates if the installation disk should be wiped at installation time.`Allows the addition of user specified files.
The value of `op` can be `create`, `overwrite`, or `append`.
In the case of `create`, `path` must not exist.
In the case of `overwrite`, and `append`, `path` must be a valid file.
If an `op` value of `append` is used, the existing file will be appended.
Note that the file contents are not required to be base64 encoded.Show example(s)
`files:`
` - content: '...' # The contents of the file.`
` permissions: 0o666 # The file's permissions in octal.`
` path: /tmp/file.txt # The path of the file.`
` op: append # The operation to use`The `env` field allows for the addition of environment variables.
All environment variables are set on PID 1 in addition to every service.Show example(s)
`env:`
` GRPC_GO_LOG_SEVERITY_LEVEL: info`
` GRPC_GO_LOG_VERBOSITY_LEVEL: "99"`
` https_proxy: http://SERVER:PORT/`
`env:`
` GRPC_GO_LOG_SEVERITY_LEVEL: error`
` https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/`
`env:`
` https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/`
`GRPC_GO_LOG_SEVERITY_LEVEL`
`http_proxy`
`https_proxy`
`no_proxy`
|
| `time` | TimeConfig | Used to configure the machine's time settings. Show example(s)
`time:`
` disabled: false # Indicates if the time service is disabled for the machine.`
` servers:`
` - time.cloudflare.com`
` bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.`Show example(s)
`sysctls:`
` kernel.domainname: talos.dev`
` net.ipv4.ip_forward: "0"`
` net/ipv6/conf/eth0.100/disable_ipv6: "1"`Show example(s)
`sysfs:`
` devices.system.cpu.cpu0.cpufreq.scaling_governor: performance`Used to configure the machine's container image registry mirrors.
Automatically generates matching CRI configuration for registry mirrors.
The `mirrors` section allows to redirect requests for images to a non-default registry,
which might be a local registry or a caching mirror.
The `config` section provides a way to authenticate to the registry with TLS client
identity, provide registry CA, or authentication information.
Authentication information has same meaning with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).
See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md).Show example(s)
`registries:`
` # Specifies mirror configuration for each registry host namespace.`
` mirrors:`
` docker.io:`
` # List of endpoints (URLs) for registry mirrors to use.`
` endpoints:`
` - https://registry.local`
` # Specifies TLS & auth configuration for HTTPS image registries.`
` config:`
` registry.local:`
` # The TLS configuration for the registry.`
` tls:`
` # Enable mutual TLS authentication with the registry.`
` clientIdentity:`
` crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
` # The auth configuration for this registry.`
` auth:`
` username: username # Optional registry authentication.`
` password: password # Optional registry authentication.`Machine system disk encryption configuration.
Defines each system partition encryption parameters.Show example(s)
`systemDiskEncryption:`
` # Ephemeral partition encryption.`
` ephemeral:`
` provider: luks2 # Encryption provider to use for the encryption.`
` # Defines the encryption keys generation and storage method.`
` keys:`
` - # Deterministically generated key from the node UUID and PartitionLabel.`
` nodeID:`
` slot: 0 # Key slot number for LUKS2 encryption.`Show example(s)
`features:`
` rbac: true # Enable role-based access control (RBAC).`Show example(s)
`udev:`
` # List of udev rules to apply to the udev system`
` rules:`
` - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"`Show example(s)
`logging:`
` # Logging destination.`
` destinations:`
` - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".`
` format: json_lines # Logs format.`Show example(s)
`kernel:`
` # Kernel modules to load.`
` modules:`
` - name: brtfs # Module name.`Show example(s)
`seccompProfiles:`
` - name: audit.json # The name field is used to provide the file name of the seccomp profile.`
` # The value field is used to provide the seccomp profile.`
` value:`
` defaultAction: SCMP_ACT_LOG`Override (patch) settings in the default OCI runtime spec for CRI containers.
It can be used to set some default container settings which are not configurable in Kubernetes,
for example default ulimits.
Note: this change applies to all newly created containers, and it requires a reboot to take effect.Show example(s)
`baseRuntimeSpecOverrides:`
` process:`
` rlimits:`
` - hard: 1024`
` soft: 1024`
` type: RLIMIT_NOFILE`Configures the node labels for the machine.
Note: In the default Kubernetes configuration, worker nodes are restricted to set
labels with some prefixes (see [NodeRestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) admission plugin).Show example(s)
`nodeLabels:`
` exampleLabel: exampleLabelValue`Show example(s)
`nodeAnnotations:`
` customer.io/rack: r13a25`Configures the node taints for the machine. Effect is optional.
Note: In the default Kubernetes configuration, worker nodes are not allowed to
modify the taints (see [NodeRestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) admission plugin).Show example(s)
`nodeTaints:`
` exampleTaint: exampleTaintValue:NoSchedule`
**Example:**
`yaml
image: ghcr.io/siderolabs/kubelet:v1.33.0
` | |
| `clusterDNS` | \[]string | The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
**Example:**
`yaml
clusterDNS:
- 10.96.0.10
- 169.254.2.53
` | |
| `extraArgs` | map\[string]string | The `extraArgs` field is used to provide additional flags to the kubelet.
**Example:**
`yaml
extraArgs:
key: value
` | |
| `extraMounts` | \[]ExtraMount | The `extraMounts` field is used to add additional mounts to the kubelet container. Note that either `bind` or `rbind` are required in the `options`.
**Example:**
`yaml
extraMounts:
- destination: /var/lib/example
type: bind
source: /var/lib/example
options:
- bind
- rshared
- rw
` | |
| `extraConfig` | Unstructured | The `extraConfig` field is used to provide kubelet configuration overrides. Some fields are not allowed to be overridden: authentication and authorization, cgroups configuration, ports, etc.
**Example:**
`yaml
extraConfig:
serverTLSBootstrap: true
` | |
| `credentialProviderConfig` | Unstructured | The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
**Example:**
`yaml
credentialProviderConfig:
apiVersion: kubelet.config.k8s.io/v1
kind: CredentialProviderConfig
providers:
- name: ecr-credential-provider
apiVersion: credentialprovider.kubelet.k8s.io/v1
` | |
| `defaultRuntimeSeccompProfileEnabled` | bool | Enable container runtime default Seccomp profile. | `true`
`yes`
`false`
`no` |
| `registerWithFQDN` | bool | The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. This is required in clouds like AWS. | `true`
`yes`
`false`
`no` |
| `nodeIP` | KubeletNodeIPConfig | The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. This is used when a node has multiple addresses to choose from.
**Example:**
`yaml
nodeIP:
validSubnets:
- 10.0.0.0/8
- '!10.0.0.3/32'
- fdc7::/16
` | |
| `skipNodeRegistration` | bool | The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver. This runs kubelet as standalone and only runs static pods. | `true`
`yes`
`false`
`no` |
| `disableManifestsDirectory` | bool | The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. It's recommended to configure static pods with the "pods" key instead. | `true`
`yes`
`false`
`no` |
#### extraMounts\[]
ExtraMount wraps OCI Mount specification.
```yaml
machine:
kubelet:
extraMounts:
- destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
type: bind # Type specifies the mount kind.
source: /var/lib/example # Source specifies the source path of the mount.
# Options are fstab style mount options.
options:
- bind
- rshared
- rw
```
| Field | Type | Description | Value(s) |
| ------------- | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| `destination` | string | Destination is the absolute path where the mount will be placed in the container. | |
| `type` | string | Type specifies the mount kind. | |
| `source` | string | Source specifies the source path of the mount. | |
| `options` | \[]string | Options are fstab style mount options. | |
| `uidMappings` | \[]LinuxIDMapping | UID/GID mappings used for changing file owners w/o calling chown, fs should support it.
Every mount point could have its own mapping.UID/GID mappings used for changing file owners w/o calling chown, fs should support it.
Every mount point could have its own mapping.The `validSubnets` field configures the networks to pick kubelet node IP from.
For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.
IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.`interfaces` is used to define the network interface configuration.
By default all network interfaces will attempt a DHCP discovery.
This can be further tuned through this configuration parameter.Show example(s)
`interfaces:`
` - interface: enp0s1 # The interface name.`
` # Assigns static IP addresses to the interface.`
` addresses:`
` - 192.168.2.0/24`
` # A list of routes associated with the interface.`
` routes:`
` - network: 0.0.0.0/0 # The route's network (destination).`
` gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).`
` metric: 1024 # The optional metric for the route.`
` mtu: 1500 # The interface's MTU.`
`# Additional interface configuration options:`
`# deviceSelector, bond, bridge, dhcp, wireguard, vip`Used to statically set the nameservers for the machine.
Defaults to `1.1.1.1` and `8.8.8.8`Show example(s)
`nameservers:`
` - 8.8.8.8`
` - 1.1.1.1`Show example(s)
`searchDomains:`
` - example.org`
` - example.com`Show example(s)
`extraHostEntries:`
` - ip: 192.168.1.100 # The IP of the host.`
` # The host alias.`
` aliases:`
` - example`
` - example.domain.tld`Show example(s)
`kubespan:`
` enabled: true # Enable the KubeSpan feature.`Disable generating a default search domain in /etc/resolv.conf
based on the machine hostname.
Defaults to `false`.
`yes`
`false`
`no`
|
#### interfaces\[]
Device represents a network interface.
```yaml
machine:
network:
interfaces:
- interface: enp0s1 # The interface name.
# Assigns static IP addresses to the interface.
addresses:
- 192.168.2.0/24
# A list of routes associated with the interface.
routes:
- network: 0.0.0.0/0 # The route's network (destination).
gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
metric: 1024 # The optional metric for the route.
mtu: 1500 # The interface's MTU.
# # Picks a network device using the selector.
# # select a device with bus prefix 00:*.
# deviceSelector:
# busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
# deviceSelector:
# hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# driver: virtio_net # Kernel driver, supports matching by wildcard.
# # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
# deviceSelector:
# - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# driver: virtio_net # Kernel driver, supports matching by wildcard.
# # Bond specific options.
# bond:
# # The interfaces that make up the bond.
# interfaces:
# - enp2s0
# - enp2s1
# # Picks a network device using the selector.
# deviceSelectors:
# - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# driver: virtio_net # Kernel driver, supports matching by wildcard.
# mode: 802.3ad # A bond option.
# lacpRate: fast # A bond option.
# # Bridge specific options.
# bridge:
# # The interfaces that make up the bridge.
# interfaces:
# - enxda4042ca9a51
# - enxae2a6774c259
# # Enable STP on this bridge.
# stp:
# enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
# # Configure this device as a bridge port.
# bridgePort:
# master: br0 # The name of the bridge master interface
# # Indicates if DHCP should be used to configure the interface.
# dhcp: true
# # DHCP specific options.
# dhcpOptions:
# routeMetric: 1024 # The priority of all routes received via DHCP.
# # Wireguard specific configuration.
# # wireguard server example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# listenPort: 51111 # Specifies a device's listening port.
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # wireguard peer example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
# persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # Virtual (shared) IP address configuration.
# # layer2 vip example
# vip:
# ip: 172.16.199.55 # Specifies the IP address to be used.
```
| Field | Type | Description | Value(s) |
| ---------------- | -------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| `interface` | string | The interface name.
Mutually exclusive with `deviceSelector`.Show example(s)
`interface: enp0s3`Picks a network device using the selector.
Mutually exclusive with `interface`.
Supports partial match using wildcard syntax.Show example(s)
`deviceSelector:`
` busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.`
`deviceSelector:`
` hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.`
` driver: virtio_net # Kernel driver, supports matching by wildcard.`Assigns static IP addresses to the interface.
An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).Show example(s)
`addresses:`
` - 10.5.0.0/16`
` - 192.168.3.7`A list of routes associated with the interface.
If used in combination with DHCP, these routes will be appended to routes returned by DHCP server.Show example(s)
`routes:`
` - network: 0.0.0.0/0 # The route's network (destination).`
` gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).`
` - network: 10.2.0.0/16 # The route's network (destination).`
` gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).`Show example(s)
`bond:`
` # The interfaces that make up the bond.`
` interfaces:`
` - enp2s0`
` - enp2s1`
` mode: 802.3ad # A bond option.`
` lacpRate: fast # A bond option.`
` # # Picks a network device using the selector.`
` # # select a device with bus prefix 00:*, a device with mac address matching *:f0:ab and virtio kernel driver.`
` # deviceSelectors:`
` # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.`
` # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.`
` # driver: virtio_net # Kernel driver, supports matching by wildcard.`Show example(s)
`bridge:`
` # The interfaces that make up the bridge.`
` interfaces:`
` - enxda4042ca9a51`
` - enxae2a6774c259`
` # Enable STP on this bridge.`
` stp:`
` enabled: true # Whether Spanning Tree Protocol (STP) is enabled.`Configure this device as a bridge port.
This can be used to dynamically assign network interfaces to a bridge.Show example(s)
`bridgePort:`
` master: br0 # The name of the bridge master interface`The interface's MTU.
If used in combination with DHCP, this will override any MTU settings returned from DHCP server.Indicates if DHCP should be used to configure the interface.
The following DHCP options are supported:
- `OptionClasslessStaticRoute`
- `OptionDomainNameServer`
- `OptionDNSDomainSearchList`
- `OptionHostName`Show example(s)
`dhcp: true`Indicates if the interface is a dummy interface.
`dummy` is used to specify that this interface should be a virtual-only, dummy interface.DHCP specific options.
`dhcp` *must* be set to true for these to take effect.Show example(s)
`dhcpOptions:`
` routeMetric: 1024 # The priority of all routes received via DHCP.`Wireguard specific configuration.
Includes things like private key, listen port, peers.Show example(s)
`wireguard:`
` privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).`
` listenPort: 51111 # Specifies a device's listening port.`
` # Specifies a list of peer configurations to apply to a device.`
` peers:`
` - publicKey: ABCDEF... # Specifies the public key of this peer.`
` endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.`
` # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.`
` allowedIPs:`
` - 192.168.1.0/24`
`wireguard:`
` privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).`
` # Specifies a list of peer configurations to apply to a device.`
` peers:`
` - publicKey: ABCDEF... # Specifies the public key of this peer.`
` endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.`
` persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.`
` # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.`
` allowedIPs:`
` - 192.168.1.0/24`Show example(s)
`vip:`
` ip: 172.16.199.55 # Specifies the IP address to be used.`Device permanent hardware address, supports matching by wildcard.
The permanent address doesn't change when the link is enslaved to a bond,
so it's recommended to use this field for bond members.Picks a network device using the selector.
Mutually exclusive with `interfaces`.
Supports partial match using wildcard syntax.Show example(s)
`deviceSelectors:`
` - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.`
` - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.`
` driver: virtio_net # Kernel driver, supports matching by wildcard.`A bond option.
Please see the official kernel documentation.
Not supported at the moment.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.
Not supported at the moment.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.A bond option.
Please see the official kernel documentation.Device permanent hardware address, supports matching by wildcard.
The permanent address doesn't change when the link is enslaved to a bond,
so it's recommended to use this field for bond members.Enable STP on this bridge.
Please see the official kernel documentation.Enable VLAN-awareness on this bridge.
Please see the official kernel documentation.DHCP specific options.
`dhcp` *must* be set to true for these to take effect.Specifies a private key configuration (base64 encoded).
Can be generated by `wg genkey`.Specifies the public key of this peer.
Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`.Specifies the persistent keepalive interval for this peer.
Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).Enable the KubeSpan feature.
Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.
If disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,
and KubeSpan handles the node-to-node traffic.
If enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.
When enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which
is not always the case with CNIs not relying on Kubernetes for IPAM.Skip sending traffic via KubeSpan if the peer connection state is not up.
This provides configurable choice between connectivity and security: either traffic is always
forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly
to the peer if Wireguard connection can't be established.KubeSpan can collect and publish extra endpoints for each member of the cluster
based on Wireguard endpoint information for each peer.
This feature is disabled by default, don't enable it
with high number of peers (>50) in the KubeSpan network (performance issues).KubeSpan link MTU size.
Default value is 1420.KubeSpan advanced filtering of network addresses .
Settings in this section are optional, and settings apply only to the node.Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.
By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.
Default value: no filtering.Show example(s)
`endpoints:`
` - 0.0.0.0/0`
` - '!192.168.0.0/16'`
` - ::/0`Show example(s)
`disk: /dev/sda`
`disk: /dev/nvme0`Look up disk using disk attributes like model, size, serial and others.
Always has priority over `disk`.Show example(s)
`diskSelector:`
` size: '>= 1TB' # Disk size.`
` model: WDC* # Disk model /sys/block//device/model.`
` # # Disk bus path.`
` # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0`
` # busPath: /pci0000:00/*`Allows for supplying extra kernel args via the bootloader.
Existing kernel args can be removed by prefixing the argument with a `-`.
For example `-console` removes all `console=` arguments, whereas `-console=tty0` removes the `console=tty0` default argument.
If Talos is using systemd-boot as a bootloader (default for UEFI) this setting will be ignored.Show example(s)
`extraKernelArgs:`
` - talos.platform=metal`
` - reboot=k`Allows for supplying the image used to perform the installation.
Image reference for each Talos release can be found on
[GitHub releases page](https://github.com/siderolabs/talos/releases).Show example(s)
`image: ghcr.io/siderolabs/installer:latest`Indicates if the installation disk should be wiped at installation time.
Defaults to `true`.
`yes`
`false`
`no`
|
| `legacyBIOSSupport` | bool | Indicates if MBR partition should be marked as bootable (active).
Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.Show example(s)
`size: 4GB`
`size: '> 1TB'`
`size: <= 2TB`
`hdd`
`nvme`
`sd`
|
| `busPath` | string | Disk bus path. Show example(s)
`busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0`
`busPath: /pci0000:00/*`
`append`
`overwrite`
|
### time
TimeConfig represents the options for configuring time on a machine.
```yaml
machine:
time:
disabled: false # Indicates if the time service is disabled for the machine.
# description: |
servers:
- time.cloudflare.com
bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
```
| Field | Type | Description | Value(s) |
| ------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| `disabled` | bool | Indicates if the time service is disabled for the machine.
Defaults to `false`.Specifies time (NTP) servers to use for setting the system time.
Defaults to `time.cloudflare.com`.
Talos can also sync to the PTP time source (e.g provided by the hypervisor),
provide the path to the PTP device as "/dev/ptp0" or "/dev/ptp\_kvm".Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
NTP sync will be still running in the background.
Defaults to "infinity" (waiting forever for time sync)Specifies mirror configuration for each registry host namespace.
This setting allows to configure local pull-through caching registires,
air-gapped installations, etc.
For example, when pulling an image with the reference `example.com:123/image:v1`,
the `example.com:123` key will be used to lookup the mirror configuration.
Optionally the `*` key can be used to configure a fallback mirror.
Registry name is the first segment of image identifier, with 'docker.io'
being default one.Show example(s)
`mirrors:`
` ghcr.io:`
` # List of endpoints (URLs) for registry mirrors to use.`
` endpoints:`
` - https://registry.insecure`
` - https://ghcr.io/v2/`Specifies TLS & auth configuration for HTTPS image registries.
Mutual TLS can be enabled with 'clientIdentity' option.
The full hostname and port (if not using a default port 443)
should be used as the key.
The fallback key `*` can't be used for TLS configuration.
TLS configuration can be skipped if registry has trusted
server certificate.Show example(s)
`config:`
` registry.insecure:`
` # The TLS configuration for the registry.`
` tls:`
` insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).`
` # # Enable mutual TLS authentication with the registry.`
` # clientIdentity:`
` # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
` # # The auth configuration for this registry.`
` # auth:`
` # username: username # Optional registry authentication.`
` # password: password # Optional registry authentication.`List of endpoints (URLs) for registry mirrors to use.
Endpoint configures HTTP/HTTPS access mode, host name,
port and path (if path is not set, it defaults to `/v2`).Use the exact path specified for the endpoint (don't append /v2/).
This setting is often required for setting up multiple mirrors
on a single instance of a registry.Skip fallback to the upstream endpoint, for example the mirror configuration
for `docker.io` will not fallback to `registry-1.docker.io`.Show example(s)
`tls:`
` # Enable mutual TLS authentication with the registry.`
` clientIdentity:`
` crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`tls:`
` insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).`
` # # Enable mutual TLS authentication with the registry.`
` # clientIdentity:`
` # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`The auth configuration for this registry.
Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.Show example(s)
`auth:`
` username: username # Optional registry authentication.`
` password: password # Optional registry authentication.`Enable mutual TLS authentication with the registry.
Client certificate and key should be base64-encoded.Show example(s)
`clientIdentity:`
` crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`CA registry certificate to add the list of trusted certificates.
Certificate should be base64-encoded.Optional registry authentication.
The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).Optional registry authentication.
The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).Optional registry authentication.
The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).Optional registry authentication.
The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).Show example(s)
`provider: luks2`Show example(s)
`cipher: aes-xts-plain64`
`xchacha12,aes-adiantum-plain64`
`xchacha20,aes-adiantum-plain64`
|
| `keySize` | uint | Defines the encryption key length. | |
| `blockSize` | uint64 | Defines the encryption sector size. Show example(s)
`blockSize: 4096`Show example(s)
`options:`
` - no_read_workqueue`
` - no_write_workqueue`
`no_write_workqueue`
`same_cpu_crypt`
|
##### keys\[]
EncryptionKey represents configuration for disk encryption key.
| Field | Type | Description | Value(s) |
| -------- | ----------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| `static` | EncryptionKeyStatic | Key which value is stored in the configuration file. | |
| `nodeID` | EncryptionKeyNodeID | Deterministically generated key from the node UUID and PartitionLabel. | |
| `kms` | EncryptionKeyKMS | KMS managed encryption key. Show example(s)
`kms:`
` endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.`Check that Secureboot is enabled in the EFI firmware.
If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable.Show example(s)
`provider: luks2`Show example(s)
`cipher: aes-xts-plain64`
`xchacha12,aes-adiantum-plain64`
`xchacha20,aes-adiantum-plain64`
|
| `keySize` | uint | Defines the encryption key length. | |
| `blockSize` | uint64 | Defines the encryption sector size. Show example(s)
`blockSize: 4096`Show example(s)
`options:`
` - no_read_workqueue`
` - no_write_workqueue`
`no_write_workqueue`
`same_cpu_crypt`
|
##### keys\[]
EncryptionKey represents configuration for disk encryption key.
| Field | Type | Description | Value(s) |
| -------- | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| `static` | EncryptionKeyStatic | Key which value is stored in the configuration file. | |
| `nodeID` | EncryptionKeyNodeID | Deterministically generated key from the node UUID and PartitionLabel. | |
| `kms` | EncryptionKeyKMS | KMS managed encryption key. Show example(s)
`kms:`
` endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.`Check that Secureboot is enabled in the EFI firmware.
If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable.Configure Talos API access from Kubernetes pods.
This feature is disabled if the feature config is not specified.Show example(s)
`kubernetesTalosAPIAccess:`
` enabled: true # Enable Talos API access from Kubernetes pods.`
` # The list of Talos API roles which can be granted for access from Kubernetes pods.`
` allowedRoles:`
` - os:reader`
` # The list of Kubernetes namespaces Talos API access is available from.`
` allowedKubernetesNamespaces:`
` - kube-system`Enable XFS project quota support for EPHEMERAL partition and user disks.
Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota.KubePrism - local proxy/load balancer on defined port that will distribute
requests to all API servers in the cluster.Select the node address sort algorithm.
The 'v1' algorithm sorts addresses by the address itself.
The 'v2' algorithm prefers more specific prefixes.
If unset, defaults to 'v1'.The list of Talos API roles which can be granted for access from Kubernetes pods.
Empty list means that no roles can be granted, so access is blocked.Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
When enabled, CoreDNS pods use host DNS server as the upstream DNS (instead of
using configured upstream DNS resolvers directly).Resolve member hostnames using the host DNS resolver.
When enabled, cluster member hostnames and node names are resolved using the host DNS resolver.
This requires service discovery to be enabled.Show example(s)
`endpoint: udp://127.0.0.1:12345`
`endpoint: tcp://1.2.3.4:12345`
|
| `extraTags` | map\[string]string | Extra tags (key-value) pairs to attach to every log message sent. | |
##### endpoint
Endpoint represents the endpoint URL parsed out of the machine config.
```yaml
machine:
logging:
destinations:
- endpoint: https://1.2.3.4:6443
```
```yaml
machine:
logging:
destinations:
- endpoint: https://cluster1.internal:6443
```
```yaml
machine:
logging:
destinations:
- endpoint: udp://127.0.0.1:12345
```
```yaml
machine:
logging:
destinations:
- endpoint: tcp://1.2.3.4:12345
```
| Field | Type | Description | Value(s) |
| ----- | ---- | ----------- | -------- |
### kernel
KernelConfig struct configures Talos Linux kernel.
```yaml
machine:
kernel:
# Kernel modules to load.
modules:
- name: brtfs # Module name.
```
| Field | Type | Description | Value(s) |
| --------- | ------------------------------------------------------------------- | ----------------------- | -------- |
| `modules` | \[]KernelModuleConfig | Kernel modules to load. | |
#### modules\[]
KernelModuleConfig struct configures Linux kernel modules to load.
| Field | Type | Description | Value(s) |
| ------------ | --------- | ------------------------------------------------ | -------- |
| `name` | string | Module name. | |
| `parameters` | \[]string | Module parameters, changes applied after reboot. | |
### seccompProfiles\[]
MachineSeccompProfile defines seccomp profiles for the machine.
```yaml
machine:
seccompProfiles:
- name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
# The `value` field is used to provide the seccomp profile.
value:
defaultAction: SCMP_ACT_LOG
```
| Field | Type | Description | Value(s) |
| ------- | ------------ | ------------------------------------------------------------------------- | -------- |
| `name` | string | The `name` field is used to provide the file name of the seccomp profile. | |
| `value` | Unstructured | The `value` field is used to provide the seccomp profile. | |
## cluster
ClusterConfig represents the cluster-wide config values.
```yaml
cluster:
# ControlPlaneConfig represents the control plane configuration options.
controlPlane:
endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
localAPIServerPort: 443 # The port that the API server listens on internally.
clusterName: talos.local
# ClusterNetworkConfig represents kube networking configuration options.
network:
# The CNI used.
cni:
name: flannel # Name of CNI to use.
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
- 10.244.0.0/16
# The service subnet CIDR.
serviceSubnets:
- 10.96.0.0/12
```
| Field | Type | Description | Value(s) |
| -------------------------------- | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| `id` | string | Globally unique identifier for this cluster (base64 encoded random 32 bytes). | |
| `secret` | string | Shared secret of cluster (base64 encoded random 32 bytes).
This secret is shared among cluster members but should never be sent over the network.Show example(s)
`controlPlane:`
` endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.`
` localAPIServerPort: 443 # The port that the API server listens on internally.`Show example(s)
`network:`
` # The CNI used.`
` cni:`
` name: flannel # Name of CNI to use.`
` dnsDomain: cluster.local # The domain used by Kubernetes DNS.`
` # The pod subnet CIDR.`
` podSubnets:`
` - 10.244.0.0/16`
` # The service subnet CIDR.`
` serviceSubnets:`
` - 10.96.0.0/12`Show example(s)
`token: wlzjyw.bei2zfylhs2by0wd`A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
Enables encryption with AESCBC.Show example(s)
`aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=`A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
Enables encryption with secretbox.
Secretbox has precedence over AESCBC.Show example(s)
`secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=`Show example(s)
`ca:`
` crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
This CA can be self-signed.Show example(s)
`aggregatorCA:`
` crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`Show example(s)
`serviceAccount:`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`Show example(s)
`apiServer:`
` image: registry.k8s.io/kube-apiserver:v1.33.0 # The container image used in the API server manifest.`
` # Extra arguments to supply to the API server.`
` extraArgs:`
` feature-gates: ServerSideApply=true`
` http2-max-streams-per-connection: "32"`
` # Extra certificate subject alternative names for the API server's certificate.`
` certSANs:`
` - 1.2.3.4`
` - 4.5.6.7`Show example(s)
`controllerManager:`
` image: registry.k8s.io/kube-controller-manager:v1.33.0 # The container image used in the controller manager manifest.`
` # Extra arguments to supply to the controller manager.`
` extraArgs:`
` feature-gates: ServerSideApply=true`Show example(s)
`proxy:`
` image: registry.k8s.io/kube-proxy:v1.33.0 # The container image used in the kube-proxy manifest.`
` mode: ipvs # proxy mode of kube-proxy.`
` # Extra arguments to supply to kube-proxy.`
` extraArgs:`
` proxy-mode: iptables`Show example(s)
`scheduler:`
` image: registry.k8s.io/kube-scheduler:v1.33.0 # The container image used in the scheduler manifest.`
` # Extra arguments to supply to the scheduler.`
` extraArgs:`
` feature-gates: AllBeta=true`Show example(s)
`discovery:`
` enabled: true # Enable the cluster membership discovery feature.`
` # Configure registries used for cluster member discovery.`
` registries:`
` # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information`
` kubernetes:`
` # Service registry is using an external service to push and pull information about cluster members.`
` service:`
` endpoint: https://discovery.talos.dev/ # External service endpoint.`Show example(s)
`etcd:`
` image: gcr.io/etcd-development/etcd:v3.5.21 # The container image used to create the etcd service.`
` # The ca is the root certificate authority of the PKI.`
` ca:`
` crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
` # Extra arguments to supply to etcd.`
` extraArgs:`
` election-timeout: "5000"`Show example(s)
`coreDNS:`
` image: registry.k8s.io/coredns/coredns:v1.12.1 # The image field is an override to the default coredns image.`Show example(s)
`externalCloudProvider:`
` enabled: true # Enable external cloud provider.`
` # A list of urls that point to additional manifests for an external cloud provider.`
` manifests:`
` - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml`
` - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml`A list of urls that point to additional manifests.
These will get automatically deployed as part of the bootstrap.Show example(s)
`extraManifests:`
` - https://www.example.com/manifest1.yaml`
` - https://www.example.com/manifest2.yaml`Show example(s)
`extraManifestHeaders:`
` Token: "1234567"`
` X-ExtraInfo: info`A list of inline Kubernetes manifests.
These will get automatically deployed as part of the bootstrap.Show example(s)
`inlineManifests: [{ name: "namespace-ci", contents: "apiVersion: v1\nkind: Namespace\nmetadata:\n name: ci" }]`Settings for admin kubeconfig generation.
Certificate lifetime can be configured.Show example(s)
`adminKubeconfig:`
` certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).`Show example(s)
`allowSchedulingOnControlPlanes: true`
`yes`
`false`
`no`
|
### controlPlane
ControlPlaneConfig represents the control plane configuration options.
```yaml
cluster:
controlPlane:
endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
localAPIServerPort: 443 # The port that the API server listens on internally.
```
| Field | Type | Description | Value(s) |
| -------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| `endpoint` | Endpoint | Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
It is single-valued, and may optionally include a port number.Show example(s)
`endpoint: https://1.2.3.4:6443`
`endpoint: https://cluster1.internal:6443`The port that the API server listens on internally.
This may be different than the port portion listed in the endpoint field above.
The default is `6443`.The CNI used.
Composed of "name" and "urls".
The "name" key supports the following options: "flannel", "custom", and "none".
"flannel" uses Talos-managed Flannel CNI, and that's the default option.
"custom" uses custom manifests that should be provided in "urls".
"none" indicates that Talos will not manage any CNI installation.Show example(s)
`cni:`
` name: custom # Name of CNI to use.`
` # URLs containing manifests to apply for the CNI.`
` urls:`
` - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml`The domain used by Kubernetes DNS.
The default is `cluster.local`Show example(s)
`dnsDomain: cluster.local`Show example(s)
`podSubnets:`
` - 10.244.0.0/16`Show example(s)
`serviceSubnets:`
` - 10.96.0.0/12`
`custom`
`none`
|
| `urls` | \[]string | URLs containing manifests to apply for the CNI.
Should be present for "custom", must be empty for "flannel" and "none".Flannel configuration options.
Show example(s)
`extraArgs:`
` - --iface-can-reach=192.168.1.1`Show example(s)
`image: registry.k8s.io/kube-apiserver:v1.33.0`Show example(s)
`admissionControl:`
` - name: PodSecurity # Name is the name of the admission controller.`
` # Configuration is an embedded configuration object to be used as the plugin's`
` configuration:`
` apiVersion: pod-security.admission.config.k8s.io/v1alpha1`
` defaults:`
` audit: restricted`
` audit-version: latest`
` enforce: baseline`
` enforce-version: latest`
` warn: restricted`
` warn-version: latest`
` exemptions:`
` namespaces:`
` - kube-system`
` runtimeClasses: []`
` usernames: []`
` kind: PodSecurityConfiguration`Show example(s)
`auditPolicy:`
` apiVersion: audit.k8s.io/v1`
` kind: Policy`
` rules:`
` - level: Metadata`Show example(s)
`authorizationConfig:`
` - type: Webhook # Type is the name of the authorizer. Allowed values are Node, RBAC, and Webhook.`
` name: webhook # Name is used to describe the authorizer.`
` # webhook is the configuration for the webhook authorizer.`
` webhook:`
` connectionInfo:`
` type: InClusterConfig`
` failurePolicy: Deny`
` matchConditionSubjectAccessReviewVersion: v1`
` matchConditions:`
` - expression: has(request.resourceAttributes)`
` - expression: '!(''system:serviceaccounts:kube-system'' in request.groups)'`
` subjectAccessReviewVersion: v1`
` timeout: 3s`
` - type: Webhook # Type is the name of the authorizer. Allowed values are Node, RBAC, and Webhook.`
` name: in-cluster-authorizer # Name is used to describe the authorizer.`
` # webhook is the configuration for the webhook authorizer.`
` webhook:`
` connectionInfo:`
` type: InClusterConfig`
` failurePolicy: NoOpinion`
` matchConditionSubjectAccessReviewVersion: v1`
` subjectAccessReviewVersion: v1`
` timeout: 3s`Show example(s)
`hostPath: /var/lib/auth`Show example(s)
`mountPath: /etc/kubernetes/auth`Show example(s)
`readonly: true`Name is the name of the admission controller.
It must match the registered admission plugin name.Configuration is an embedded configuration object to be used as the plugin's
configuration.Show example(s)
`requests:`
` cpu: 1`
` memory: 1Gi`Show example(s)
`limits:`
` cpu: 2`
` memory: 2500Mi`Show example(s)
`image: registry.k8s.io/kube-controller-manager:v1.33.0`Show example(s)
`hostPath: /var/lib/auth`Show example(s)
`mountPath: /etc/kubernetes/auth`Show example(s)
`readonly: true`Show example(s)
`requests:`
` cpu: 1`
` memory: 1Gi`Show example(s)
`limits:`
` cpu: 2`
` memory: 2500Mi`Show example(s)
`disabled: false`Show example(s)
`image: registry.k8s.io/kube-proxy:v1.33.0`proxy mode of kube-proxy.
The default is 'iptables'.Show example(s)
`image: registry.k8s.io/kube-scheduler:v1.33.0`Show example(s)
`hostPath: /var/lib/auth`Show example(s)
`mountPath: /etc/kubernetes/auth`Show example(s)
`readonly: true`Show example(s)
`requests:`
` cpu: 1`
` memory: 1Gi`Show example(s)
`limits:`
` cpu: 2`
` memory: 2500Mi`Enable the cluster membership discovery feature.
Cluster discovery is based on individual registries which are configured under the registries field.Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
as annotations on the Node resources.
This feature is deprecated as it is not compatible with Kubernetes 1.32+.
See [https://github.com/siderolabs/talos/issues/9980](https://github.com/siderolabs/talos/issues/9980) for more information.Show example(s)
`endpoint: https://discovery.talos.dev/`Show example(s)
`image: gcr.io/etcd-development/etcd:v3.5.21`The `ca` is the root certificate authority of the PKI.
It is composed of a base64 encoded `crt` and `key`.Show example(s)
`ca:`
` crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t`
` key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`Extra arguments to supply to etcd.
Note that the following args are not allowed:
- `name`
- `data-dir`
- `initial-cluster-state`
- `listen-peer-urls`
- `listen-client-urls`
- `cert-file`
- `key-file`
- `trusted-ca-file`
- `peer-client-cert-auth`
- `peer-cert-file`
- `peer-trusted-ca-file`
- `peer-key-file`The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.Show example(s)
`advertisedSubnets:`
` - 10.0.0.0/8`The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections.
If `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to
`advertisedSubnets`.
If neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses.
IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.
`yes`
`false`
`no`
|
| `manifests` | \[]string | A list of urls that point to additional manifests for an external cloud provider.
These will get automatically deployed as part of the bootstrap.Show example(s)
`manifests:`
` - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml`
` - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml`Name of the manifest.
Name should be unique.Show example(s)
`name: csi`Show example(s)
`contents: /etc/kubernetes/auth`Admin kubeconfig certificate lifetime (default is 1 year).
Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).