From 676db9768433027ebc6ff22a0414692ccec2ccf4 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Thu, 17 Aug 2023 19:36:18 +0400 Subject: [PATCH] docs: fork docs for Talos 1.6 Create a copy of documentation for Talos 1.6. Signed-off-by: Andrey Smirnov --- Dockerfile | 8 +- api/api.descriptors | Bin 78941 -> 79508 bytes hack/release.toml | 162 +- website/config.toml | 4 + .../v1.5/introduction/support-matrix.md | 4 +- website/content/v1.6/_index.md | 58 + website/content/v1.6/advanced/_index.md | 4 + .../v1.6/advanced/advanced-networking.md | 108 + website/content/v1.6/advanced/air-gapped.md | 164 + .../content/v1.6/advanced/building-images.md | 98 + .../v1.6/advanced/customizing-the-kernel.md | 54 + .../customizing-the-root-filesystem.md | 63 + .../content/v1.6/advanced/developing-talos.md | 334 + .../v1.6/advanced/disaster-recovery.md | 148 + .../content/v1.6/advanced/etcd-maintenance.md | 76 + .../v1.6/advanced/extension-services.md | 195 + .../v1.6/advanced/migrating-from-kubeadm.md | 137 + .../advanced/proprietary-kernel-modules.md | 65 + website/content/v1.6/advanced/static-pods.md | 100 + .../advanced/talos-api-access-from-k8s.md | 157 + .../advanced/troubleshooting-control-plane.md | 449 + .../content/v1.6/advanced/verifying-images.md | 37 + website/content/v1.6/introduction/_index.md | 4 + .../v1.6/introduction/getting-started.md | 308 + .../content/v1.6/introduction/prodnotes.md | 324 + .../content/v1.6/introduction/quickstart.md | 54 + .../v1.6/introduction/support-matrix.md | 52 + .../v1.6/introduction/system-requirements.md | 71 + .../v1.6/introduction/what-is-new/index.md | 9 + .../v1.6/introduction/what-is-talos.md | 28 + .../content/v1.6/kubernetes-guides/_index.md | 5 + .../kubernetes-guides/configuration/_index.md | 5 + .../configuration/ceph-with-rook.md | 281 + .../configuration/cluster-endpoint.md | 47 + .../configuration/deploy-metrics-server.md | 45 + .../configuration/kubeprism.md | 55 + .../configuration/pod-security.md | 170 + ...licated-local-storage-with-openebs-jiva.md | 214 + .../configuration/seccomp-profiles.md | 118 + .../configuration/storage.md | 196 + .../configuration/synology-csi.md | 259 + .../v1.6/kubernetes-guides/network/_index.md | 5 + .../network/deploying-cilium.md | 317 + .../kubernetes-guides/upgrading-kubernetes.md | 352 + website/content/v1.6/learn-more/_index.md | 4 + .../content/v1.6/learn-more/architecture.md | 56 + website/content/v1.6/learn-more/components.md | 120 + .../content/v1.6/learn-more/control-plane.md | 145 + .../v1.6/learn-more/controllers-resources.md | 230 + website/content/v1.6/learn-more/faqs.md | 50 + .../content/v1.6/learn-more/knowledge-base.md | 98 + website/content/v1.6/learn-more/kubespan.md | 207 + .../v1.6/learn-more/networking-resources.md | 434 + website/content/v1.6/learn-more/philosophy.md | 110 + .../v1.6/learn-more/process-capabilities.md | 23 + .../learn-more/talos-network-connectivity.md | 74 + website/content/v1.6/learn-more/talosctl.md | 62 + website/content/v1.6/reference/_index.md | 4 + website/content/v1.6/reference/api.md | 7524 +++++++++++++++++ website/content/v1.6/reference/cli.md | 3064 +++++++ .../content/v1.6/reference/configuration.md | 3153 +++++++ website/content/v1.6/reference/kernel.md | 242 + .../v1.6/schemas/v1alpha1_config.schema.json | 2823 +++++++ website/content/v1.6/talos-guides/_index.md | 5 + .../v1.6/talos-guides/configuration/_index.md | 5 + .../configuration/certificate-authorities.md | 23 + .../talos-guides/configuration/containerd.md | 65 + .../configuration/disk-encryption.md | 188 + .../editing-machine-configuration.md | 159 + .../talos-guides/configuration/logging.md | 404 + .../configuration/managing-pki.md | 72 + .../configuration/nvidia-fabricmanager.md | 38 + .../configuration/nvidia-gpu-proprietary.md | 162 + .../talos-guides/configuration/nvidia-gpu.md | 161 + .../talos-guides/configuration/patching.md | 340 + .../configuration/pull-through-cache.md | 171 + .../v1.6/talos-guides/configuration/rbac.md | 52 + .../configuration/system-extensions.md | 67 + .../content/v1.6/talos-guides/discovery.md | 155 + .../content/v1.6/talos-guides/howto/_index.md | 5 + .../v1.6/talos-guides/howto/scaling-down.md | 17 + .../v1.6/talos-guides/howto/scaling-up.md | 27 + .../howto/workers-on-controlplane.md | 30 + .../v1.6/talos-guides/install/_index.md | 5 + .../install/bare-metal-platforms/_index.md | 5 + .../bare-metal-platforms/digital-rebar.md | 172 + .../bare-metal-platforms/equinix-metal.md | 185 + .../install/bare-metal-platforms/iso.md | 21 + .../install/bare-metal-platforms/matchbox.md | 176 + .../bare-metal-platforms/network-config.md | 65 + .../install/bare-metal-platforms/pxe.md | 37 + .../bare-metal-platforms/secureboot.md | 239 + .../install/bare-metal-platforms/sidero.md | 10 + .../v1.6/talos-guides/install/boot-assets.md | 145 + .../install/cloud-platforms/_index.md | 5 + .../install/cloud-platforms/aws.md | 324 + .../install/cloud-platforms/azure.md | 376 + .../install/cloud-platforms/digitalocean.md | 172 + .../install/cloud-platforms/exoscale.md | 8 + .../install/cloud-platforms/gcp.md | 426 + .../install/cloud-platforms/gcp/config.yaml | 21 + .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 + .../cloud-platforms/gcp/talos-ha.jinja | 282 + .../install/cloud-platforms/hetzner.md | 248 + .../install/cloud-platforms/nocloud.md | 129 + .../install/cloud-platforms/openstack.md | 148 + .../install/cloud-platforms/oracle.md | 195 + .../install/cloud-platforms/scaleway.md | 8 + .../install/cloud-platforms/upcloud.md | 246 + .../install/cloud-platforms/vultr.md | 151 + .../install/local-platforms/_index.md | 5 + .../install/local-platforms/docker.md | 80 + .../install/local-platforms/qemu.md | 292 + .../install/local-platforms/virtualbox.md | 183 + .../install/single-board-computers/_index.md | 5 + .../single-board-computers/bananapi_m64.md | 59 + .../single-board-computers/jetson_nano.md | 119 + .../libretech_all_h3_cc_h5.md | 59 + .../single-board-computers/nanopi_r4s.md | 59 + .../install/single-board-computers/pine64.md | 59 + .../install/single-board-computers/rock64.md | 59 + .../single-board-computers/rockpi_4.md | 98 + .../single-board-computers/rockpi_4c.md | 96 + .../single-board-computers/rpi_generic.md | 103 + .../install/virtualized-platforms/_index.md | 5 + .../install/virtualized-platforms/hyper-v.md | 85 + .../install/virtualized-platforms/kvm.md | 12 + .../install/virtualized-platforms/proxmox.md | 233 + .../virtualized-platforms/vagrant-libvirt.md | 282 + .../install/virtualized-platforms/vmware.md | 315 + .../vmware/cp.patch.yaml | 12 + .../virtualized-platforms/vmware/vmware.sh | 104 + .../install/virtualized-platforms/xen.md | 9 + .../interactive-dashboard/index.md | 70 + .../interactive-dashboard-1.png | Bin 0 -> 275479 bytes .../interactive-dashboard-2.png | Bin 0 -> 91579 bytes .../interactive-dashboard-3.png | Bin 0 -> 81872 bytes .../v1.6/talos-guides/network/_index.md | 5 + .../talos-guides/network/corporate-proxies.md | 54 + .../talos-guides/network/device-selector.md | 66 + .../v1.6/talos-guides/network/kubespan.md | 216 + .../content/v1.6/talos-guides/network/vip.md | 96 + .../talos-guides/network/wireguard-network.md | 104 + .../v1.6/talos-guides/resetting-a-machine.md | 39 + .../v1.6/talos-guides/upgrading-talos.md | 168 + 145 files changed, 32972 insertions(+), 167 deletions(-) create mode 100644 website/content/v1.6/_index.md create mode 100644 website/content/v1.6/advanced/_index.md create mode 100644 website/content/v1.6/advanced/advanced-networking.md create mode 100644 website/content/v1.6/advanced/air-gapped.md create mode 100644 website/content/v1.6/advanced/building-images.md create mode 100644 website/content/v1.6/advanced/customizing-the-kernel.md create mode 100644 website/content/v1.6/advanced/customizing-the-root-filesystem.md create mode 100644 website/content/v1.6/advanced/developing-talos.md create mode 100644 website/content/v1.6/advanced/disaster-recovery.md create mode 100644 website/content/v1.6/advanced/etcd-maintenance.md create mode 100644 website/content/v1.6/advanced/extension-services.md create mode 100644 website/content/v1.6/advanced/migrating-from-kubeadm.md create mode 100644 website/content/v1.6/advanced/proprietary-kernel-modules.md create mode 100644 website/content/v1.6/advanced/static-pods.md create mode 100644 website/content/v1.6/advanced/talos-api-access-from-k8s.md create mode 100644 website/content/v1.6/advanced/troubleshooting-control-plane.md create mode 100644 website/content/v1.6/advanced/verifying-images.md create mode 100644 website/content/v1.6/introduction/_index.md create mode 100644 website/content/v1.6/introduction/getting-started.md create mode 100644 website/content/v1.6/introduction/prodnotes.md create mode 100644 website/content/v1.6/introduction/quickstart.md create mode 100644 website/content/v1.6/introduction/support-matrix.md create mode 100644 website/content/v1.6/introduction/system-requirements.md create mode 100644 website/content/v1.6/introduction/what-is-new/index.md create mode 100644 website/content/v1.6/introduction/what-is-talos.md create mode 100644 website/content/v1.6/kubernetes-guides/_index.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/_index.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/ceph-with-rook.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/cluster-endpoint.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/deploy-metrics-server.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/kubeprism.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/pod-security.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/seccomp-profiles.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/storage.md create mode 100644 website/content/v1.6/kubernetes-guides/configuration/synology-csi.md create mode 100644 website/content/v1.6/kubernetes-guides/network/_index.md create mode 100644 website/content/v1.6/kubernetes-guides/network/deploying-cilium.md create mode 100644 website/content/v1.6/kubernetes-guides/upgrading-kubernetes.md create mode 100644 website/content/v1.6/learn-more/_index.md create mode 100644 website/content/v1.6/learn-more/architecture.md create mode 100644 website/content/v1.6/learn-more/components.md create mode 100644 website/content/v1.6/learn-more/control-plane.md create mode 100644 website/content/v1.6/learn-more/controllers-resources.md create mode 100644 website/content/v1.6/learn-more/faqs.md create mode 100644 website/content/v1.6/learn-more/knowledge-base.md create mode 100644 website/content/v1.6/learn-more/kubespan.md create mode 100644 website/content/v1.6/learn-more/networking-resources.md create mode 100644 website/content/v1.6/learn-more/philosophy.md create mode 100644 website/content/v1.6/learn-more/process-capabilities.md create mode 100644 website/content/v1.6/learn-more/talos-network-connectivity.md create mode 100644 website/content/v1.6/learn-more/talosctl.md create mode 100644 website/content/v1.6/reference/_index.md create mode 100644 website/content/v1.6/reference/api.md create mode 100644 website/content/v1.6/reference/cli.md create mode 100644 website/content/v1.6/reference/configuration.md create mode 100644 website/content/v1.6/reference/kernel.md create mode 100644 website/content/v1.6/schemas/v1alpha1_config.schema.json create mode 100644 website/content/v1.6/talos-guides/_index.md create mode 100644 website/content/v1.6/talos-guides/configuration/_index.md create mode 100644 website/content/v1.6/talos-guides/configuration/certificate-authorities.md create mode 100644 website/content/v1.6/talos-guides/configuration/containerd.md create mode 100644 website/content/v1.6/talos-guides/configuration/disk-encryption.md create mode 100644 website/content/v1.6/talos-guides/configuration/editing-machine-configuration.md create mode 100644 website/content/v1.6/talos-guides/configuration/logging.md create mode 100644 website/content/v1.6/talos-guides/configuration/managing-pki.md create mode 100644 website/content/v1.6/talos-guides/configuration/nvidia-fabricmanager.md create mode 100644 website/content/v1.6/talos-guides/configuration/nvidia-gpu-proprietary.md create mode 100644 website/content/v1.6/talos-guides/configuration/nvidia-gpu.md create mode 100644 website/content/v1.6/talos-guides/configuration/patching.md create mode 100644 website/content/v1.6/talos-guides/configuration/pull-through-cache.md create mode 100644 website/content/v1.6/talos-guides/configuration/rbac.md create mode 100644 website/content/v1.6/talos-guides/configuration/system-extensions.md create mode 100644 website/content/v1.6/talos-guides/discovery.md create mode 100644 website/content/v1.6/talos-guides/howto/_index.md create mode 100644 website/content/v1.6/talos-guides/howto/scaling-down.md create mode 100644 website/content/v1.6/talos-guides/howto/scaling-up.md create mode 100644 website/content/v1.6/talos-guides/howto/workers-on-controlplane.md create mode 100644 website/content/v1.6/talos-guides/install/_index.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/_index.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/digital-rebar.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/equinix-metal.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/iso.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/matchbox.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/network-config.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/pxe.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/secureboot.md create mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/sidero.md create mode 100644 website/content/v1.6/talos-guides/install/boot-assets.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/_index.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/aws.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/azure.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/digitalocean.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/exoscale.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/gcp.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/gcp/config.yaml create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/hetzner.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/nocloud.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/openstack.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/oracle.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/scaleway.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/upcloud.md create mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/vultr.md create mode 100644 website/content/v1.6/talos-guides/install/local-platforms/_index.md create mode 100644 website/content/v1.6/talos-guides/install/local-platforms/docker.md create mode 100644 website/content/v1.6/talos-guides/install/local-platforms/qemu.md create mode 100644 website/content/v1.6/talos-guides/install/local-platforms/virtualbox.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/_index.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/bananapi_m64.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/jetson_nano.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/nanopi_r4s.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/pine64.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/rock64.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/rockpi_4.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/rockpi_4c.md create mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/rpi_generic.md create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/_index.md create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/hyper-v.md create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/kvm.md create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/proxmox.md create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/vagrant-libvirt.md create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/vmware.md create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/vmware/vmware.sh create mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/xen.md create mode 100644 website/content/v1.6/talos-guides/interactive-dashboard/index.md create mode 100644 website/content/v1.6/talos-guides/interactive-dashboard/interactive-dashboard-1.png create mode 100644 website/content/v1.6/talos-guides/interactive-dashboard/interactive-dashboard-2.png create mode 100644 website/content/v1.6/talos-guides/interactive-dashboard/interactive-dashboard-3.png create mode 100644 website/content/v1.6/talos-guides/network/_index.md create mode 100644 website/content/v1.6/talos-guides/network/corporate-proxies.md create mode 100644 website/content/v1.6/talos-guides/network/device-selector.md create mode 100644 website/content/v1.6/talos-guides/network/kubespan.md create mode 100644 website/content/v1.6/talos-guides/network/vip.md create mode 100644 website/content/v1.6/talos-guides/network/wireguard-network.md create mode 100644 website/content/v1.6/talos-guides/resetting-a-machine.md create mode 100644 website/content/v1.6/talos-guides/upgrading-talos.md diff --git a/Dockerfile b/Dockerfile index a4d628929c..a604bc095f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1007,10 +1007,10 @@ RUN protoc \ /protos/time/*.proto FROM scratch AS docs -COPY --from=docs-build /tmp/configuration.md /website/content/v1.5/reference/ -COPY --from=docs-build /tmp/cli.md /website/content/v1.5/reference/ -COPY --from=docs-build /tmp/schemas /website/content/v1.5/schemas/ -COPY --from=proto-docs-build /tmp/api.md /website/content/v1.5/reference/ +COPY --from=docs-build /tmp/configuration.md /website/content/v1.6/reference/ +COPY --from=docs-build /tmp/cli.md /website/content/v1.6/reference/ +COPY --from=docs-build /tmp/schemas /website/content/v1.6/schemas/ +COPY --from=proto-docs-build /tmp/api.md /website/content/v1.6/reference/ # The talosctl-cni-bundle builds the CNI bundle for talosctl. diff --git a/api/api.descriptors b/api/api.descriptors index f50248c52cc5023737fc9b6d5f27c4792293bfcb..0b4de0e633a4021971d8942a40665574a19e7607 100644 GIT binary patch delta 515 zcmZvZ%}T>S6or{It?4L*2C>r!w$zPK1PkIy7Ye!&H;MZprZ*+6P3mL07^lL#V1fmc}2m%G9c&*ZlAW;j#l> z!UCQ;+~wd5z%y%jHI_@DS5d?Xs-qpl#%gsUHs%rDOnL#0gH9NP9omDG`eFb!U_r=< zCIUs92#cc}=a8QLa~U6aOvLw>=W{AAJj?Ra_bqg>rv2)Z=Mt(+T1~Wvtnuz{t=9O` zaQV31gD5M2Y_f2O zGv@|da`ONe`|d3T#v(>?qlY>%gg%v0GKl${>4FUnp%vS}g*dwx$!8Vk%CxZIMWI0A t@d|?E?1j!gBMm(|53UF-KSQikMROhJB?Dq)XDZR47%T2fubb${_ycjas9*p9 delta 54 zcmV-60LlN9?F8NE1c0;w0T}|_43p957q=Q20kZ|Sf*%1(3= 0.7.0 | >= 0.6.0 | -| [CAPI Control Plane Provider Talos](https://github.com/siderolabs/cluster-api-control-plane-provider-talos) | >= 0.4.10 | >= 0.4.10 | +| [CAPI Bootstrap Provider Talos](https://github.com/siderolabs/cluster-api-bootstrap-provider-talos) | >= 0.6.1 | >= 0.6.0 | +| [CAPI Control Plane Provider Talos](https://github.com/siderolabs/cluster-api-control-plane-provider-talos) | >= 0.5.2 | >= 0.4.10 | | [Sidero](https://www.sidero.dev/) | >= 0.6.0 | >= 0.6.0 | ## Platform Tiers diff --git a/website/content/v1.6/_index.md b/website/content/v1.6/_index.md new file mode 100644 index 0000000000..a4f975284c --- /dev/null +++ b/website/content/v1.6/_index.md @@ -0,0 +1,58 @@ +--- +title: Welcome +no_list: true +linkTitle: "Documentation" +cascade: + type: docs +lastRelease: v1.6.0-alpha.0 +kubernetesRelease: "1.29.0" +prevKubernetesRelease: "1.28.0" +theilaRelease: "v0.2.1" +nvidiaContainerToolkitRelease: "v1.13.5" +nvidiaDriverRelease: "535.54.03" +iscsiToolsRelease: "v0.1.4" +preRelease: true +--- + +## Welcome + +Welcome to the Talos documentation. +If you are just getting familiar with Talos, we recommend starting here: + +- [What is Talos]({{< relref "introduction/what-is-talos" >}}): a quick description of Talos +- [Quickstart]({{< relref "introduction/quickstart" >}}): the fastest way to get a Talos cluster up and running +- [Getting Started]({{< relref "introduction/getting-started" >}}): a long-form, guided tour of getting a full Talos cluster deployed + +## Open Source + +### Community + +- GitHub: [repo](https://github.com/siderolabs/talos) +- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) +- Matrix: Join our Matrix channels: + - Community: [#talos:matrix.org](https://matrix.to/#/#talos:matrix.org) + - Support: [#talos-support:matrix.org](https://matrix.to/#/#talos-support:matrix.org) +- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/siderolabs/talos/discussions) +- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) +- Twitter: [@SideroLabs](https://twitter.com/talossystems) +- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) + +If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! +We hold a weekly meeting that all audiences are welcome to attend. + +We would appreciate your feedback so that we can make Talos even better! +To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). + +### Office Hours + +- When: Mondays at 16:30 UTC. +- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). + +You can subscribe to this meeting by joining the community forum above. + +## Enterprise + +If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. +Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. + +[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v1.6/advanced/_index.md b/website/content/v1.6/advanced/_index.md new file mode 100644 index 0000000000..3b85c2391c --- /dev/null +++ b/website/content/v1.6/advanced/_index.md @@ -0,0 +1,4 @@ +--- +title: "Advanced Guides" +weight: 60 +--- diff --git a/website/content/v1.6/advanced/advanced-networking.md b/website/content/v1.6/advanced/advanced-networking.md new file mode 100644 index 0000000000..c45d391006 --- /dev/null +++ b/website/content/v1.6/advanced/advanced-networking.md @@ -0,0 +1,108 @@ +--- +title: "Advanced Networking" +description: "How to configure advanced networking options on Talos Linux." +aliases: + - ../guides/advanced-networking +--- + +## Static Addressing + +Static addressing is comprised of specifying `addresses`, `routes` ( remember to add your default gateway ), and `interface`. +Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. + +```yaml +machine: + network: + hostname: talos + nameservers: + - 10.0.0.1 + interfaces: + - interface: eth0 + addresses: + - 10.0.0.201/8 + mtu: 8765 + routes: + - network: 0.0.0.0/0 + gateway: 10.0.0.1 + - interface: eth1 + ignore: true + time: + servers: + - time.cloudflare.com +``` + +## Additional Addresses for an Interface + +In some environments you may need to set additional addresses on an interface. +In the following example, we set two additional addresses on the loopback interface. + +```yaml +machine: + network: + interfaces: + - interface: lo + addresses: + - 192.168.0.21/24 + - 10.2.2.2/24 +``` + +## Bonding + +The following example shows how to create a bonded interface. + +```yaml +machine: + network: + interfaces: + - interface: bond0 + dhcp: true + bond: + mode: 802.3ad + lacpRate: fast + xmitHashPolicy: layer3+4 + miimon: 100 + updelay: 200 + downdelay: 200 + interfaces: + - eth0 + - eth1 +``` + +## Setting Up a Bridge + +The following example shows how to set up a bridge between two interfaces with an assigned static address. + +```yaml +machine: + network: + interfaces: + - interface: br0 + addresses: + - 192.168.0.42/24 + bridge: + stp: + enabled: true + interfaces: + - eth0 + - eth1 +``` + +## VLANs + +To setup vlans on a specific device use an array of VLANs to add. +The master device may be configured without addressing by setting dhcp to false. + +```yaml +machine: + network: + interfaces: + - interface: eth0 + dhcp: false + vlans: + - vlanId: 100 + addresses: + - "192.168.2.10/28" + routes: + - network: 0.0.0.0/0 + gateway: 192.168.2.1 +``` diff --git a/website/content/v1.6/advanced/air-gapped.md b/website/content/v1.6/advanced/air-gapped.md new file mode 100644 index 0000000000..3b686a87d5 --- /dev/null +++ b/website/content/v1.6/advanced/air-gapped.md @@ -0,0 +1,164 @@ +--- +title: "Air-gapped Environments" +description: "Setting up Talos Linux to work in environments with no internet access." +aliases: + - ../guides/air-gapped +--- + +In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. +We will use the [QEMU]({{< relref "../talos-guides/install/local-platforms/qemu" >}}) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. + +## Requirements + +The follow are requirements for this guide: + +- Docker 18.03 or greater +- Requirements for the Talos [QEMU]({{< relref "../talos-guides/install/local-platforms/qemu" >}}) cluster + +## Identifying Images + +In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) +We need to identify the images required to install and run Talos. +The same strategy can be used for images required by custom workloads running on the cluster. + +The `talosctl image default` command provides a list of default images used by the Talos cluster (with default configuration +settings). +To print the list of images, run: + +```bash +talosctl image default +``` + +This list contains images required by a default deployment of Talos. +There might be additional images required for the workloads running on this cluster, and those should be added to this list. + +## Preparing the Internal Registry + +As access to the public registries is restricted, we have to run an internal Docker registry. +In this guide, we will launch the registry on the same machine using Docker: + +```bash +$ docker run -d -p 6000:5000 --restart always --name registry-airgapped registry:2 +1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 +``` + +This registry will be accepting connections on port 6000 on the host IPs. +The registry is empty by default, so we have fill it with the images required by Talos. + +First, we pull all the images to our local Docker daemon: + +```bash +$ for image in `talosctl image default`; do docker pull $image; done +v0.15.1: Pulling from coreos/flannel +Digest: sha256:9a296fbb67790659adc3701e287adde3c59803b7fcefe354f1fc482840cdb3d9 +... +``` + +All images are now stored in the Docker daemon store: + +```bash +$ docker images +REPOSITORY TAG IMAGE ID CREATED SIZE +gcr.io/etcd-development/etcd v3.5.3 604d4f022632 6 days ago 181MB +ghcr.io/siderolabs/install-cni v1.0.0-2-gc5d3ab0 4729e54f794d 6 days ago 76MB +... +``` + +Now we need to re-tag them so that we can push them to our local registry. +We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: + +```bash +$ for image in `talosctl image default`; do \ + docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \ + done +``` + +As the next step, we push images to the internal registry: + +```bash +$ for image in `talosctl image default`; do \ + docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \ + done +``` + +We can now verify that the images are pushed to the registry: + +```bash +$ curl http://127.0.0.1:6000/v2/_catalog +{"repositories":["coredns/coredns","coreos/flannel","etcd-development/etcd","kube-apiserver","kube-controller-manager","kube-proxy","kube-scheduler","pause","siderolabs/install-cni","siderolabs/installer","siderolabs/kubelet"]} +``` + +> Note: images in the registry don't have the registry endpoint prefix anymore. + +## Launching Talos in an Air-gapped Environment + +For Talos to use the internal registry, we use the registry mirror feature to redirect all image pull requests to the internal registry. +This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. + +We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. +As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. + +Identify all registry prefixes from `talosctl image default`, for example: + +- `docker.io` +- `gcr.io` +- `ghcr.io` +- `registry.k8s.io` + +The `talosctl cluster create` command provides conveniences for common configuration options. +The only required flag for this guide is `--registry-mirror =http://10.5.0.1:6000` which redirects every pull request to the internal registry, this flag +needs to be repeated for each of the identified registry prefixes above. +The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). + +```bash +$ sudo --preserve-env=HOME talosctl cluster create --provisioner=qemu --install-image=ghcr.io/siderolabs/installer:{{< release >}} \ + --registry-mirror docker.io=http://10.5.0.1:6000 \ + --registry-mirror gcr.io=http://10.5.0.1:6000 \ + --registry-mirror ghcr.io=http://10.5.0.1:6000 \ + --registry-mirror registry.k8s.io=http://10.5.0.1:6000 \ +validating CIDR and reserving IPs +generating PKI and tokens +creating state directory in "/home/user/.talos/clusters/talos-default" +creating network talos-default +creating load balancer +creating dhcpd +creating master nodes +creating worker nodes +waiting for API +... +``` + +> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. + +You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. + +## Closing Notes + +Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. + +When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: + +```bash +machine: + ... + registries: + mirrors: + docker.io: + endpoints: + - http://10.5.0.1:6000/ + gcr.io: + endpoints: + - http://10.5.0.1:6000/ + ghcr.io: + endpoints: + - http://10.5.0.1:6000/ + registry.k8s.io: + endpoints: + - http://10.5.0.1:6000/ +... +``` + +Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. +If required, auth can be configured for the internal registry (and custom TLS certificates if needed). + +Please see [pull-through cache guide]({{< relref "../talos-guides/configuration/pull-through-cache" >}}) for an example using Harbor container registry with Talos. diff --git a/website/content/v1.6/advanced/building-images.md b/website/content/v1.6/advanced/building-images.md new file mode 100644 index 0000000000..0ebdd3ed2e --- /dev/null +++ b/website/content/v1.6/advanced/building-images.md @@ -0,0 +1,98 @@ +--- +title: "Building Custom Talos Images" +description: "How to build a custom Talos image from source." +--- + +There might be several reasons to build Talos images from source: + +* verifying the [image integrity]({{< relref "verifying-images" >}}) +* building an image with custom configuration + +## Checkout Talos Source + +```bash +git clone https://github.com/siderolabs/talos.git +``` + +If building for a specific release, checkout the corresponding tag: + +```bash +git checkout {{< release >}} +``` + +## Set up the Build Environment + +See [Developing Talos]({{< relref "developing-talos" >}}) for details on setting up the buildkit builder. + +## Architectures + +By default, Talos builds for `linux/amd64`, but you can customize that by passing `PLATFORM` variable to `make`: + +```bash +make PLATFORM=linux/arm64 # build for arm64 only +make PLATFORM=linux/arm64,linux/amd64 # build for arm64 and amd64, container images will be multi-arch +``` + +## Customizations + +Some of the build parameters can be customized by passing environment variables to `make`, e.g. `GOAMD64=v1` can be used to build +Talos images compatible with old AMD64 CPUs: + +```bash +make GOAMD64=v1 +``` + +## Building Kernel and Initramfs + +The most basic boot assets can be built with: + +```bash +make kernel initramfs +``` + +Build result will be stored as `_out/vmlinuz-` and `_out/initramfs-.xz`. + +## Building Container Images + +Talos container images should be pushed to the registry as the result of the build process. + +The default settings are: + +* `IMAGE_REGISTRY` is set to `ghcr.io` +* `USERNAME` is set to the `siderolabs` (or value of environment variable `USERNAME` if it is set) + +The image can be pushed to any registry you have access to, but the access credentials should be stored in `~/.docker/config.json` file (e.g. with `docker login`). + +Building and pushing the image can be done with: + +```bash +make installer PUSH=true IMAGE_REGISTRY=docker.io USERNAME= # ghcr.io/siderolabs/installer +make imager PUSH=true IMAGE_REGISTRY=docker.io USERNAME= # ghcr.io/siderolabs/installer +``` + +## Building ISO + +The ISO image is built with the help of `imager` container image, by default `ghcr.io/siderolabs/imager` will be used with the matching tag: + +```bash +make iso +``` + +The ISO image will be stored as `_out/talos-.iso`. + +If ISO image should be built with the custom `imager` image, it can be specified with `IMAGE_REGISTRY`/`USERNAME` variables: + +```bash +make iso IMAGE_REGISTRY=docker.io USERNAME= +``` + +## Building Disk Images + +The disk image is built with the help of `imager` container image, by default `ghcr.io/siderolabs/imager` will be used with the matching tag: + +```bash +make image-metal +``` + +Available disk images are encoded in the `image-%` target, e.g. `make image-aws`. +Same as with ISO image, the custom `imager` image can be specified with `IMAGE_REGISTRY`/`USERNAME` variables. diff --git a/website/content/v1.6/advanced/customizing-the-kernel.md b/website/content/v1.6/advanced/customizing-the-kernel.md new file mode 100644 index 0000000000..e8e64066c4 --- /dev/null +++ b/website/content/v1.6/advanced/customizing-the-kernel.md @@ -0,0 +1,54 @@ +--- +title: "Customizing the Kernel" +description: "Guide on how to customize the kernel used by Talos Linux." +aliases: + - ../guides/customizing-the-kernel +--- + +The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: + +- the decompression, and unpacking of the `initramfs.xz` +- the unsquashing of the rootfs +- the copying of new rootfs files +- the squashing of the new rootfs +- and the packing, and compression of the new `initramfs.xz` + +When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. + +Build and push your own kernel: + + ```sh + git clone https://github.com/talos-systems/pkgs.git + cd pkgs + make kernel-menuconfig USERNAME=_your_github_user_name_ + + docker login ghcr.io --username _your_github_user_name_ + make kernel USERNAME=_your_github_user_name_ PUSH=true + ``` + +Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: + +```docker +FROM scratch AS customization +# this is needed so that Talos copies base kernel modules info and default modules shipped with Talos +COPY --from= /lib/modules /kernel/lib/modules +# this copies over the custom modules +COPY --from= /lib/modules /lib/modules + +FROM ghcr.io/siderolabs/installer:latest +COPY --from= /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz +``` + +When building the image, the `customization` stage will automatically be copied into the rootfs. +The `customization` stage is not limited to a single `COPY` instruction. +In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. + +To build the image, run: + +```bash +DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t installer:kernel . +``` + +> Note: buildkit has a bug [#816](https://github.com/moby/buildkit/issues/816), to disable it use `DOCKER_BUILDKIT=0` + +Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v1.6/advanced/customizing-the-root-filesystem.md b/website/content/v1.6/advanced/customizing-the-root-filesystem.md new file mode 100644 index 0000000000..2e7eaabbed --- /dev/null +++ b/website/content/v1.6/advanced/customizing-the-root-filesystem.md @@ -0,0 +1,63 @@ +--- +title: "Customizing the Root Filesystem" +description: "How to add your own content to the immutable root file system of Talos Linux." +aliases: + - ../guides/customizing-the-root-filesystem +--- + +The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: + +- the decompression, and unpacking of the `initramfs.xz` +- the unsquashing of the rootfs +- the copying of new rootfs files +- the squashing of the new rootfs +- and the packing, and compression of the new `initramfs.xz` + +When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. + +For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. +We need to define a stage with the name `customization`: + +```docker +FROM scratch AS customization +COPY --from= +``` + +Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: + +```docker +FROM scratch AS customization +COPY --from= + +FROM ghcr.io/siderolabs/installer:latest +``` + +When building the image, the `customization` stage will automatically be copied into the rootfs. +The `customization` stage is not limited to a single `COPY` instruction. +In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. + +> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. + +To build the image, run: + +```bash +docker build --squash -t /installer:latest . +``` + +In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): + +```bash +docker build --squash --build-arg RM="[ ...]" -t /installer:latest . +``` + +This will perform a `rm -rf` on the specified paths relative to the rootfs. + +> Note: `RM` must be a whitespace delimited list. + +The resulting image can be used to: + +- generate an image for any of the supported providers +- perform bare-metall installs +- perform upgrades + +We will step through common customizations in the remainder of this section. diff --git a/website/content/v1.6/advanced/developing-talos.md b/website/content/v1.6/advanced/developing-talos.md new file mode 100644 index 0000000000..26b931cada --- /dev/null +++ b/website/content/v1.6/advanced/developing-talos.md @@ -0,0 +1,334 @@ +--- +title: "Developing Talos" +description: "Learn how to set up a development environment for local testing and hacking on Talos itself!" +aliases: + - ../learn-more/developing-talos +--- + +This guide outlines steps and tricks to develop Talos operating systems and related components. +The guide assumes Linux operating system on the development host. +Some steps might work under Mac OS X, but using Linux is highly advised. + +## Prepare + +Check out the [Talos repository](https://github.com/siderolabs/talos). + +Try running `make help` to see available `make` commands. +You would need Docker and `buildx` installed on the host. + +> Note: Usually it is better to install up to date Docker from Docker apt repositories, e.g. [Ubuntu instructions](https://docs.docker.com/engine/install/ubuntu/). +> +> If `buildx` plugin is not available with OS docker packages, it can be installed [as a plugin from GitHub releases](https://docs.docker.com/buildx/working-with-buildx/#install). + +Set up a builder with access to the host network: + +```bash + docker buildx create --driver docker-container --driver-opt network=host --name local1 --buildkitd-flags '--allow-insecure-entitlement security.insecure' --use +``` + +> Note: `network=host` allows buildx builder to access host network, so that it can push to a local container registry (see below). + +Make sure the following steps work: + +- `make talosctl` +- `make initramfs kernel` + +Set up a local docker registry: + +```bash +docker run -d -p 5005:5000 \ + --restart always \ + --name local registry:2 +``` + +Try to build and push to local registry an installer image: + +```bash +make installer IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true +``` + +Record the image name output in the step above. + +> Note: it is also possible to force a stable image tag by using `TAG` variable: `make installer IMAGE_REGISTRY=127.0.0.1:5005 TAG=v1.0.0-alpha.1 PUSH=true`. + +## Running Talos cluster + +Set up local caching docker registries (this speeds up Talos cluster boot a lot), script is in the Talos repo: + +```bash +bash hack/start-registry-proxies.sh +``` + +Start your local cluster with: + +```bash +sudo --preserve-env=HOME _out/talosctl-linux-amd64 cluster create \ + --provisioner=qemu \ + --cidr=172.20.0.0/24 \ + --registry-mirror docker.io=http://172.20.0.1:5000 \ + --registry-mirror registry.k8s.io=http://172.20.0.1:5001 \ + --registry-mirror gcr.io=http://172.20.0.1:5003 \ + --registry-mirror ghcr.io=http://172.20.0.1:5004 \ + --registry-mirror 127.0.0.1:5005=http://172.20.0.1:5005 \ + --install-image=127.0.0.1:5005/siderolabs/installer: \ + --controlplanes 3 \ + --workers 2 \ + --with-bootloader=false +``` + +- `--provisioner` selects QEMU vs. default Docker +- custom `--cidr` to make QEMU cluster use different network than default Docker setup (optional) +- `--registry-mirror` uses the caching proxies set up above to speed up boot time a lot, last one adds your local registry (installer image was pushed to it) +- `--install-image` is the image you built with `make installer` above +- `--controlplanes` & `--workers` configure cluster size, choose to match your resources; 3 controlplanes give you HA control plane; 1 controlplane is enough, never do 2 controlplanes +- `--with-bootloader=false` disables boot from disk (Talos will always boot from `_out/vmlinuz-amd64` and `_out/initramfs-amd64.xz`). + This speeds up development cycle a lot - no need to rebuild installer and perform install, rebooting is enough to get new code. + +> Note: as boot loader is not used, it's not necessary to rebuild `installer` each time (old image is fine), but sometimes it's needed (when configuration changes are done and old installer doesn't validate the config). +> +> `talosctl cluster create` derives Talos machine configuration version from the install image tag, so sometimes early in the development cycle (when new minor tag is not released yet), machine config version can be overridden with `--talos-version={{< version >}}`. + +If the `--with-bootloader=false` flag is not enabled, for Talos cluster to pick up new changes to the code (in `initramfs`), it will require a Talos upgrade (so new `installer` should be built). +With `--with-bootloader=false` flag, Talos always boots from `initramfs` in `_out/` directory, so simple reboot is enough to pick up new code changes. + +If the installation flow needs to be tested, `--with-bootloader=false` shouldn't be used. + +## Console Logs + +Watching console logs is easy with `tail`: + +```bash +tail -F ~/.talos/clusters/talos-default/talos-default-*.log +``` + +## Interacting with Talos + +Once `talosctl cluster create` finishes successfully, `talosconfig` and `kubeconfig` will be set up automatically to point to your cluster. + +Start playing with `talosctl`: + +```bash +talosctl -n 172.20.0.2 version +talosctl -n 172.20.0.3,172.20.0.4 dashboard +talosctl -n 172.20.0.4 get members +``` + +Same with `kubectl`: + +```bash +kubectl get nodes -o wide +``` + +You can deploy some Kubernetes workloads to the cluster. + +You can edit machine config on the fly with `talosctl edit mc --immediate`, config patches can be applied via `--config-patch` flags, also many features have specific flags in `talosctl cluster create`. + +## Quick Reboot + +To reboot whole cluster quickly (e.g. to pick up a change made in the code): + +```bash +for socket in ~/.talos/clusters/talos-default/talos-default-*.monitor; do echo "q" | sudo socat - unix-connect:$socket; done +``` + +Sending `q` to a single socket allows to reboot a single node. + +> Note: This command performs immediate reboot (as if the machine was powered down and immediately powered back up), for normal Talos reboot use `talosctl reboot`. + +## Development Cycle + +Fast development cycle: + +- bring up a cluster +- make code changes +- rebuild `initramfs` with `make initramfs` +- reboot a node to pick new `initramfs` +- verify code changes +- more code changes... + +Some aspects of Talos development require to enable bootloader (when working on `installer` itself), in that case quick development cycle is no longer possible, and cluster should be destroyed and recreated each time. + +## Running Integration Tests + +If integration tests were changed (or when running them for the first time), first rebuild the integration test binary: + +```bash +rm -f _out/integration-test-linux-amd64; make _out/integration-test-linux-amd64 +``` + +Running short tests against QEMU provisioned cluster: + +```bash +_out/integration-test-linux-amd64 \ + -talos.provisioner=qemu \ + -test.v \ + -talos.crashdump=false \ + -test.short \ + -talos.talosctlpath=$PWD/_out/talosctl-linux-amd64 +``` + +Whole test suite can be run removing `-test.short` flag. + +Specfic tests can be run with `-test.run=TestIntegration/api.ResetSuite`. + +## Build Flavors + +`make WITH_RACE=1` enables Go race detector, Talos runs slower and uses more memory, but memory races are detected. + +`make WITH_DEBUG=1` enables Go profiling and other debug features, useful for local development. + +## Destroying Cluster + +```bash +sudo --preserve-env=HOME ../talos/_out/talosctl-linux-amd64 cluster destroy --provisioner=qemu +``` + +This command stops QEMU and helper processes, tears down bridged network on the host, and cleans up +cluster state in `~/.talos/clusters`. + +> Note: if the host machine is rebooted, QEMU instances and helpers processes won't be started back. +> In that case it's required to clean up files in `~/.talos/clusters/` directory manually. + +## Optional + +Set up cross-build environment with: + +```bash +docker run --rm --privileged multiarch/qemu-user-static --reset -p yes +``` + +> Note: the static qemu binaries which come with Ubuntu 21.10 seem to be broken. + +## Unit tests + +Unit tests can be run in buildx with `make unit-tests`, on Ubuntu systems some tests using `loop` devices will fail because Ubuntu uses low-index `loop` devices for snaps. + +Most of the unit-tests can be run standalone as well, with regular `go test`, or using IDE integration: + +```bash +go test -v ./internal/pkg/circular/ +``` + +This provides much faster feedback loop, but some tests require either elevated privileges (running as `root`) or additional binaries available only in Talos `rootfs` (containerd tests). + +Running tests as root can be done with `-exec` flag to `go test`, but this is risky, as test code has root access and can potentially make undesired changes: + +```bash +go test -exec sudo -v ./internal/app/machined/pkg/controllers/network/... +``` + +## Go Profiling + +Build `initramfs` with debug enabled: `make initramfs WITH_DEBUG=1`. + +Launch Talos cluster with bootloader disabled, and use `go tool pprof` to capture the profile and show the output in your browser: + +```bash +go tool pprof http://172.20.0.2:9982/debug/pprof/heap +``` + +The IP address `172.20.0.2` is the address of the Talos node, and port `:9982` depends on the Go application to profile: + +- 9981: `apid` +- 9982: `machined` +- 9983: `trustd` + +## Testing Air-gapped Environments + +There is a hidden `talosctl debug air-gapped` command which launches two components: + +- HTTP proxy capable of proxying HTTP and HTTPS requests +- HTTPS server with a self-signed certificate + +The command also writes down Talos machine configuration patch to enable the HTTP proxy and add a self-signed certificate +to the list of trusted certificates: + +```shell +$ talosctl debug air-gapped --advertised-address 172.20.0.1 +2022/08/04 16:43:14 writing config patch to air-gapped-patch.yaml +2022/08/04 16:43:14 starting HTTP proxy on :8002 +2022/08/04 16:43:14 starting HTTPS server with self-signed cert on :8001 +``` + +The `--advertised-address` should match the bridge IP of the Talos node. + +Generated machine configuration patch looks like: + +```yaml +machine: + files: + - content: | + -----BEGIN CERTIFICATE----- + MIIBijCCAS+gAwIBAgIBATAKBggqhkjOPQQDAjAUMRIwEAYDVQQKEwlUZXN0IE9u + bHkwHhcNMjIwODA0MTI0MzE0WhcNMjIwODA1MTI0MzE0WjAUMRIwEAYDVQQKEwlU + ZXN0IE9ubHkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQfOJdaOFSOI1I+EeP1 + RlMpsDZJaXjFdoo5zYM5VYs3UkLyTAXAmdTi7JodydgLhty0pwLEWG4NUQAEvip6 + EmzTo3IwcDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG + AQUFBwMCMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFCwxL+BjG0pDwaH8QgKW + Ex0J2mVXMA8GA1UdEQQIMAaHBKwUAAEwCgYIKoZIzj0EAwIDSQAwRgIhAJoW0z0D + JwpjFcgCmj4zT1SbBFhRBUX64PHJpAE8J+LgAiEAvfozZG8Or6hL21+Xuf1x9oh4 + /4Hx3jozbSjgDyHOLk4= + -----END CERTIFICATE----- + permissions: 0o644 + path: /etc/ssl/certs/ca-certificates + op: append + env: + http_proxy: http://172.20.0.1:8002 + https_proxy: http://172.20.0.1:8002 + no_proxy: 172.20.0.1/24 +cluster: + extraManifests: + - https://172.20.0.1:8001/debug.yaml +``` + +The first section appends a self-signed certificate of the HTTPS server to the list of trusted certificates, +followed by the HTTP proxy setup (in-cluster traffic is excluded from the proxy). +The last section adds an extra Kubernetes manifest hosted on the HTTPS server. + +The machine configuration patch can now be used to launch a test Talos cluster: + +```shell +talosctl cluster create ... --config-patch @air-gapped-patch.yaml +``` + +The following lines should appear in the output of the `talosctl debug air-gapped` command: + +- `CONNECT discovery.talos.dev:443`: the HTTP proxy is used to talk to the discovery service +- `http: TLS handshake error from 172.20.0.2:53512: remote error: tls: bad certificate`: an expected error on Talos side, as self-signed cert is not written yet to the file +- `GET /debug.yaml`: Talos successfully fetches the extra manifest successfully + +There might be more output depending on the registry caches being used or not. + +## Running Upgrade Integration Tests + +Talos has a separate set of provision upgrade tests, which create a cluster on older versions of Talos, perform an upgrade, +and verify that the cluster is still functional. + +Build the test binary: + +```bash +rm -f _out/integration-test-provision-linux-amd64; make _out/integration-test-provision-linux-amd64 +``` + +Prepare the test artifacts for the upgrade test: + +```bash +make release-artifacts +``` + +Build and push an installer image for the development version of Talos: + +```bash +make installer IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true +``` + +Run the tests (the tests will create the cluster on the older version of Talos, perform an upgrade, and verify that the cluster is still functional): + +```bash +sudo --preserve-env=HOME _out/integration-test-provision-linux-amd64 \ + -test.v \ + -talos.talosctlpath _out/talosctl-linux-amd64 \ + -talos.provision.target-installer-registry=127.0.0.1:5005 \ + -talos.provision.registry-mirror 127.0.0.1:5005=http://172.20.0.1:5005,docker.io=http://172.20.0.1:5000,registry.k8s.io=http://172.20.0.1:5001,quay.io=http://172.20.0.1:5002,gcr.io=http://172.20.0.1:5003,ghcr.io=http://172.20.0.1:5004 \ + -talos.provision.cidr 172.20.0.0/24 +``` diff --git a/website/content/v1.6/advanced/disaster-recovery.md b/website/content/v1.6/advanced/disaster-recovery.md new file mode 100644 index 0000000000..a06c6ecad3 --- /dev/null +++ b/website/content/v1.6/advanced/disaster-recovery.md @@ -0,0 +1,148 @@ +--- +title: "Disaster Recovery" +description: "Procedure for snapshotting etcd database and recovering from catastrophic control plane failure." +aliases: + - ../guides/disaster-recovery +--- + +`etcd` database backs Kubernetes control plane state, so if the `etcd` service is unavailable, + the Kubernetes control plane goes down, and the cluster is not recoverable until `etcd` is recovered. +`etcd` builds around the consensus protocol Raft, so highly-available control plane clusters can tolerate the loss of nodes so long as more than half of the members are running and reachable. +For a three control plane node Talos cluster, this means that the cluster tolerates a failure of any single node, +but losing more than one node at the same time leads to complete loss of service. +Because of that, it is important to take routine backups of `etcd` state to have a snapshot to recover the cluster from +in case of catastrophic failure. + +## Backup + +### Snapshotting `etcd` Database + +Create a consistent snapshot of `etcd` database with `talosctl etcd snapshot` command: + +```bash +$ talosctl -n etcd snapshot db.snapshot +etcd snapshot saved to "db.snapshot" (2015264 bytes) +snapshot info: hash c25fd181, revision 4193, total keys 1287, total size 3035136 +``` + +> Note: filename `db.snapshot` is arbitrary. + +This database snapshot can be taken on any healthy control plane node (with IP address `` in the example above), +as all `etcd` instances contain exactly same data. +It is recommended to configure `etcd` snapshots to be created on some schedule to allow point-in-time recovery using the latest snapshot. + +### Disaster Database Snapshot + +If the `etcd` cluster is not healthy (for example, if quorum has already been lost), the `talosctl etcd snapshot` command might fail. +In that case, copy the database snapshot directly from the control plane node: + +```bash +talosctl -n cp /var/lib/etcd/member/snap/db . +``` + +This snapshot might not be fully consistent (if the `etcd` process is running), but it allows +for disaster recovery when latest regular snapshot is not available. + +### Machine Configuration + +Machine configuration might be required to recover the node after hardware failure. +Backup Talos node machine configuration with the command: + +```bash +talosctl -n IP get mc v1alpha1 -o yaml | yq eval '.spec' - +``` + +## Recovery + +Before starting a disaster recovery procedure, make sure that `etcd` cluster can't be recovered: + +* get `etcd` cluster member list on all healthy control plane nodes with `talosctl -n IP etcd members` command and compare across all members. +* query `etcd` health across control plane nodes with `talosctl -n IP service etcd`. + +If the quorum can be restored, restoring quorum might be a better strategy than performing full disaster recovery +procedure. + +### Latest Etcd Snapshot + +Get hold of the latest `etcd` database snapshot. +If a snapshot is not fresh enough, create a database snapshot (see above), even if the `etcd` cluster is unhealthy. + +### Init Node + +Make sure that there are no control plane nodes with machine type `init`: + +```bash +$ talosctl -n ,,... get machinetype +NODE NAMESPACE TYPE ID VERSION TYPE +172.20.0.2 config MachineType machine-type 2 controlplane +172.20.0.4 config MachineType machine-type 2 controlplane +172.20.0.3 config MachineType machine-type 2 controlplane +``` + +Init node type is deprecated, and are incompatible with `etcd` recovery procedure. +`init` node can be converted to `controlplane` type with `talosctl edit mc --mode=staged` command followed +by node reboot with `talosctl reboot` command. + +### Preparing Control Plane Nodes + +If some control plane nodes experienced hardware failure, replace them with new nodes. + +Use machine configuration backup to re-create the nodes with the same secret material and control plane settings +to allow workers to join the recovered control plane. + +If a control plane node is up but `etcd` isn't, wipe the node's [EPHEMERAL]({{< relref "../learn-more/architecture/#file-system-partitions" >}}) partition to remove the `etcd` +data directory (make sure a database snapshot is taken before doing this): + +```bash +talosctl -n reset --graceful=false --reboot --system-labels-to-wipe=EPHEMERAL +``` + +At this point, all control plane nodes should boot up, and `etcd` service should be in the `Preparing` state. + +The Kubernetes control plane endpoint should be pointed to the new control plane nodes if there were +changes to the node addresses. + +### Recovering from the Backup + +Make sure all `etcd` service instances are in `Preparing` state: + +```bash +$ talosctl -n service etcd +NODE 172.20.0.2 +ID etcd +STATE Preparing +HEALTH ? +EVENTS [Preparing]: Running pre state (17s ago) + [Waiting]: Waiting for service "cri" to be "up", time sync (18s ago) + [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", time sync (20s ago) +``` + +Execute the bootstrap command against any control plane node passing the path to the `etcd` database snapshot: + +```bash +$ talosctl -n bootstrap --recover-from=./db.snapshot +recovering from snapshot "./db.snapshot": hash c25fd181, revision 4193, total keys 1287, total size 3035136 +``` + +> Note: if database snapshot was copied out directly from the `etcd` data directory using `talosctl cp`, +> add flag `--recover-skip-hash-check` to skip integrity check on restore. + +Talos node should print matching information in the kernel log: + +```log +recovering etcd from snapshot: hash c25fd181, revision 4193, total keys 1287, total size 3035136 +{"level":"info","msg":"restoring snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/li} +{"level":"info","msg":"restored last compact revision","meta-bucket-name":"meta","meta-bucket-name-key":"finishedCompactRev","restored-compact-revision":3360} +{"level":"info","msg":"added member","cluster-id":"a3390e43eb5274e2","local-member-id":"0","added-peer-id":"eb4f6f534361855e","added-peer-peer-urls":["https:/} +{"level":"info","msg":"restored snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/lib/etcd/member/snap"} +``` + +Now `etcd` service should become healthy on the bootstrap node, Kubernetes control plane components +should start and control plane endpoint should become available. +Remaining control plane nodes join `etcd` cluster once control plane endpoint is up. + +## Single Control Plane Node Cluster + +This guide applies to the single control plane clusters as well. +In fact, it is much more important to take regular snapshots of the `etcd` database in single control plane node +case, as loss of the control plane node might render the whole cluster irrecoverable without a backup. diff --git a/website/content/v1.6/advanced/etcd-maintenance.md b/website/content/v1.6/advanced/etcd-maintenance.md new file mode 100644 index 0000000000..365b5ab9e6 --- /dev/null +++ b/website/content/v1.6/advanced/etcd-maintenance.md @@ -0,0 +1,76 @@ +--- +title: "etcd Maintenance" +description: "Operational instructions for etcd database." +--- + +`etcd` database backs Kubernetes control plane state, so `etcd` health is critical for Kubernetes availability. + +## Space Quota + +`etcd` default database space quota is set to 2 GiB by default. +If the database size exceeds the quota, `etcd` will stop operations until the issue is resolved. + +This condition can be checked with `talosctl etcd alarm list` command: + +```bash +$ talosctl -n etcd alarm list +NODE MEMBER ALARM +172.20.0.2 a49c021e76e707db NOSPACE +``` + +If the Kubernetes database contains lots of resources, space quota can be increased to match the actual usage. +The recommended maximum size is 8 GiB. + +To increase the space quota, edit the `etcd` section in the machine configuration: + +```yaml +machine: + etcd: + extraArgs: + quota-backend-bytes: 4294967296 # 4 GiB +``` + +Once the node is rebooted with the new configuration, use `talosctl etcd alarm disarm` to clear the `NOSPACE` alarm. + +## Defragmentation + +`etcd` database can become fragmented over time if there are lots of writes and deletes. +Kubernetes API server performs automatic compaction of the `etcd` database, which marks deleted space as free and ready to be reused. +However, the space is not actually freed until the database is defragmented. + +If the database is heavily fragmented (in use/db size ratio is less than 0.5), defragmentation might increase the performance. +If the database runs over the space quota (see above), but the actual in use database size is small, defragmentation is required to bring the on-disk database size below the limit. + +Current database size can be checked with `talosctl etcd status` command: + +```bash +$ talosctl -n ,, etcd status +NODE MEMBER DB SIZE IN USE LEADER RAFT INDEX RAFT TERM RAFT APPLIED INDEX LEARNER ERRORS +172.20.0.3 ecebb05b59a776f1 21 MB 6.0 MB (29.08%) ecebb05b59a776f1 53391 4 53391 false +172.20.0.2 a49c021e76e707db 17 MB 4.5 MB (26.10%) ecebb05b59a776f1 53391 4 53391 false +172.20.0.4 eb47fb33e59bf0e2 20 MB 5.9 MB (28.96%) ecebb05b59a776f1 53391 4 53391 false +``` + +If any of the nodes are over database size quota, alarms will be printed in the `ERRORS` column. + +To defragment the database, run `talosctl etcd defrag` command: + +```bash +talosctl -n etcd defrag +``` + +> Note: defragmentation is a resource-intensive operation, so it is recommended to run it on a single node at a time. +> Defragmentation to a live member blocks the system from reading and writing data while rebuilding its state. + +Once the defragmentation is complete, the database size will match closely to the in use size: + +```bash +$ talosctl -n etcd status +NODE MEMBER DB SIZE IN USE LEADER RAFT INDEX RAFT TERM RAFT APPLIED INDEX LEARNER ERRORS +172.20.0.2 a49c021e76e707db 4.5 MB 4.5 MB (100.00%) ecebb05b59a776f1 56065 4 56065 false +``` + +## Snapshotting + +Regular backups of `etcd` database should be performed to ensure that the cluster can be restored in case of a failure. +This procedure is described in the [disaster recovery]({{< relref "disaster-recovery" >}}) guide. diff --git a/website/content/v1.6/advanced/extension-services.md b/website/content/v1.6/advanced/extension-services.md new file mode 100644 index 0000000000..d16a2ed66e --- /dev/null +++ b/website/content/v1.6/advanced/extension-services.md @@ -0,0 +1,195 @@ +--- +title: "Extension Services" +description: "Use extension services in Talos Linux." +aliases: + - ../learn-more/extension-services +--- + +Talos provides a way to run additional system services early in the Talos boot process. +Extension services should be included into the Talos root filesystem (e.g. using [system extensions]({{< relref "../talos-guides/configuration/system-extensions" >}})). +Extension services run as privileged containers with ephemeral root filesystem located in the Talos root filesystem. + +Extension services can be used to use extend core features of Talos in a way that is not possible via [static pods]({{< relref "../advanced/static-pods" >}}) or +Kubernetes DaemonSets. + +Potential extension services use-cases: + +* storage: Open iSCSI, software RAID, etc. +* networking: BGP FRR, etc. +* platform integration: VMWare open VM tools, etc. + +## Configuration + +Talos on boot scans directory `/usr/local/etc/containers` for `*.yaml` files describing the extension services to run. +Format of the extension service config: + +```yaml +name: hello-world +container: + entrypoint: ./hello-world + # an optional path to a file containing environment variables + environmentFile: /var/etc/hello-world/env + environment: + - XDG_RUNTIME_DIR=/run + args: + - -f + mounts: + - # OCI Mount Spec +depends: + - service: cri + - path: /run/machined/machined.sock + - network: + - addresses + - connectivity + - hostname + - etcfiles + - time: true +restart: never|always|untilSuccess +``` + +### `name` + +Field `name` sets the service name, valid names are `[a-z0-9-_]+`. +The service container root filesystem path is derived from the `name`: `/usr/local/lib/containers/`. +The extension service will be registered as a Talos service under an `ext-` identifier. + +### `container` + +* `entrypoint` defines the container entrypoint relative to the container root filesystem (`/usr/local/lib/containers/`) +* `environmentFile` defines the path to a file containing environment variables, the service waits for the file to exist before starting +* `environment` defines the container environment variables, overrides the variables from `environmentFile` +* `args` defines the additional arguments to pass to the entrypoint +* `mounts` defines the volumes to be mounted into the container root + +#### `container.mounts` + +The section `mounts` uses the standard OCI spec: + +```yaml +- source: /var/log/audit + destination: /var/log/audit + type: bind + options: + - rshared + - bind + - ro +``` + +All requested directories will be mounted into the extension service container mount namespace. +If the `source` directory doesn't exist in the host filesystem, it will be created (only for writable paths in the Talos root filesystem). + +#### `container.security` + +The section `security` follows this example: + +```yaml +maskedPaths: + - "/should/be/masked" +readonlyPaths: + - "/path/that/should/be/readonly" + - "/another/readonly/path" +writeableRootfs: true +writeableSysfs: true +``` + +> * The rootfs is readonly by default unless `writeableRootfs: true` is set. +> * The sysfs is readonly by default unless `writeableSysfs: true` is set. +> * Masked paths if not set defaults to [containerd defaults](https://github.com/containerd/containerd/tree/main/oci/spec.go). +Masked paths will be mounted to `/dev/null`. +To set empty masked paths use: +> +> ```yaml +> container: +> security: +> maskedPaths: [] +> ``` +> +> * Read Only paths if not set defaults to [containerd defaults](https://github.com/containerd/containerd/tree/main/oci/spec.go). +Read-only paths will be mounted to `/dev/null`. +To set empty read only paths use: +> +> ```yaml +> container: +> security: +> readonlyPaths: [] +> ``` + +### `depends` + +The `depends` section describes extension service start dependencies: the service will not be started until all dependencies are met. + +Available dependencies: + +* `service: `: wait for the service `` to be running and healthy +* `path: `: wait for the `` to exist +* `network: [addresses, connectivity, hostname, etcfiles]`: wait for the specified network readiness checks to succeed +* `time: true`: wait for the NTP time sync + +### `restart` + +Field `restart` defines the service restart policy, it allows to either configure an always running service or a one-shot service: + +* `always`: restart service always +* `never`: start service only once and never restart +* `untilSuccess`: restart failing service, stop restarting on successful run + +## Example + +Example layout of the Talos root filesystem contents for the extension service: + +```text +/ +└── usr +    └── local +       ├── etc +      │   └── containers +       │     └── hello-world.yaml +       └── lib +           └── containers +          └── hello-world +          ├── hello + └── config.ini +``` + +Talos discovers the extension service configuration in `/usr/local/etc/containers/hello-world.yaml`: + +```yaml +name: hello-world +container: + entrypoint: ./hello + args: + - --config + - config.ini +depends: + - network: + - addresses +restart: always +``` + +Talos starts the container for the extension service with container root filesystem at `/usr/local/lib/containers/hello-world`: + +```text +/ +├── hello +└── config.ini +``` + +Extension service is registered as `ext-hello-world` in `talosctl services`: + +```shell +$ talosctl service ext-hello-world +NODE 172.20.0.5 +ID ext-hello-world +STATE Running +HEALTH ? +EVENTS [Running]: Started task ext-hello-world (PID 1100) for container ext-hello-world (2m47s ago) + [Preparing]: Creating service runner (2m47s ago) + [Preparing]: Running pre state (2m47s ago) + [Waiting]: Waiting for service "containerd" to be "up" (2m48s ago) + [Waiting]: Waiting for service "containerd" to be "up", network (2m49s ago) +``` + +An extension service can be started, restarted and stopped using `talosctl service ext-hello-world start|restart|stop`. +Use `talosctl logs ext-hello-world` to get the logs of the service. + +Complete example of the extension service can be found in the [extensions repository](https://github.com/talos-systems/extensions/tree/main/examples/hello-world-service). diff --git a/website/content/v1.6/advanced/migrating-from-kubeadm.md b/website/content/v1.6/advanced/migrating-from-kubeadm.md new file mode 100644 index 0000000000..1b08f404e1 --- /dev/null +++ b/website/content/v1.6/advanced/migrating-from-kubeadm.md @@ -0,0 +1,137 @@ +--- +title: "Migrating from Kubeadm" +description: "Migrating Kubeadm-based clusters to Talos." +aliases: + - ../guides/migrating-from-kubeadm +--- + +It is possible to migrate Talos from a cluster that is created using +[kubeadm](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) to Talos. + +High-level steps are the following: + +1. Collect CA certificates and a bootstrap token from a control plane node. +2. Create a Talos machine config with the CA certificates with the ones you collected. +3. Update control plane endpoint in the machine config to point to the existing control plane (i.e. your load balancer address). +4. Boot a new Talos machine and apply the machine config. +5. Verify that the new control plane node is ready. +6. Remove one of the old control plane nodes. +7. Repeat the same steps for all control plane nodes. +8. Verify that all control plane nodes are ready. +9. Repeat the same steps for all worker nodes, using the machine config generated for the workers. + +## Remarks on kube-apiserver load balancer + +While migrating to Talos, you need to make sure that your kube-apiserver load balancer is in place +and keeps pointing to the correct set of control plane nodes. + +This process depends on your load balancer setup. + +If you are using an LB that is external to the control plane nodes (e.g. cloud provider LB, F5 BIG-IP, etc.), +you need to make sure that you update the backend IPs of the load balancer to point to the control plane nodes as +you add Talos nodes and remove kubeadm-based ones. + +If your load balancing is done on the control plane nodes (e.g. keepalived + haproxy on the control plane nodes), +you can do the following: + +1. Add Talos nodes and remove kubeadm-based ones while updating the haproxy backends + to point to the newly added nodes except the last kubeadm-based control plane node. +2. Turn off keepalived to drop the virtual IP used by the kubeadm-based nodes (introduces kube-apiserver downtime). +3. Set up a virtual-IP based new load balancer on the new set of Talos control plane nodes. + Use the previous LB IP as the LB virtual IP. +4. Verify apiserver connectivity over the Talos-managed virtual IP. +5. Migrate the last control-plane node. + +## Prerequisites + +- Admin access to the kubeadm-based cluster +- Access to the `/etc/kubernetes/pki` directory (e.g. SSH & root permissions) + on the control plane nodes of the kubeadm-based cluster +- Access to kube-apiserver load-balancer configuration + +## Step-by-step guide + +1. Download `/etc/kubernetes/pki` directory from a control plane node of the kubeadm-based cluster. + +2. Create a new join token for the new control plane nodes: + + ```bash + # inside a control plane node + kubeadm token create + ``` + +3. Create Talos secrets from the PKI directory you downloaded on step 1 and the token you generated on step 2: + + ```bash + talosctl gen secrets --kubernetes-bootstrap-token --from-kubernetes-pki + ``` + +4. Create a new Talos config from the secrets: + + ```bash + talosctl gen config --with-secrets secrets.yaml https:// + ``` + +5. Collect the information about the kubeadm-based cluster from the kubeadm configmap: + + ```bash + kubectl get configmap -n kube-system kubeadm-config -oyaml + ``` + + Take note of the following information in the `ClusterConfiguration`: + - `.controlPlaneEndpoint` + - `.networking.dnsDomain` + - `.networking.podSubnet` + - `.networking.serviceSubnet` + +6. Replace the following information in the generated `controlplane.yaml`: + - `.cluster.network.cni.name` with `none` + - `.cluster.network.podSubnets[0]` with the value of the `networking.podSubnet` from the previous step + - `.cluster.network.serviceSubnets[0]` with the value of the `networking.serviceSubnet` from the previous step + - `.cluster.network.dnsDomain` with the value of the `networking.dnsDomain` from the previous step + +7. Go through the rest of `controlplane.yaml` and `worker.yaml` to customize them according to your needs, especially : + - `.cluster.secretboxEncryptionSecret` should be either removed if you don't currently use `EncryptionConfig` on your `kube-apiserver` or set to the correct value + +8. Bring up a Talos node to be the initial Talos control plane node. + +9. Apply the generated `controlplane.yaml` to the Talos control plane node: + + ```bash + talosctl --nodes apply-config --insecure --file controlplane.yaml + ``` + +10. Wait until the new control plane node joins the cluster and is ready. + + ```bash + kubectl get node -owide --watch + ``` + +11. Update your load balancer to point to the new control plane node. + +12. Drain the old control plane node you are replacing: + + ```bash + kubectl drain --delete-emptydir-data --force --ignore-daemonsets --timeout=10m + ``` + +13. Remove the old control plane node from the cluster: + + ```bash + kubectl delete node + ``` + +14. Destroy the old node: + + ```bash + # inside the node + sudo kubeadm reset --force + ``` + +15. Repeat the same steps, starting from step 7, for all control plane nodes. + +16. Repeat the same steps, starting from step 7, for all worker nodes while applying the `worker.yaml` instead and skipping the LB step: + + ```bash + talosctl --nodes apply-config --insecure --file worker.yaml + ``` diff --git a/website/content/v1.6/advanced/proprietary-kernel-modules.md b/website/content/v1.6/advanced/proprietary-kernel-modules.md new file mode 100644 index 0000000000..21e3dc308c --- /dev/null +++ b/website/content/v1.6/advanced/proprietary-kernel-modules.md @@ -0,0 +1,65 @@ +--- +title: "Proprietary Kernel Modules" +description: "Adding a proprietary kernel module to Talos Linux" +aliases: + - ../guides/adding-a-proprietary-kernel-module +--- + +1. Patching and building the kernel image + 1. Clone the `pkgs` repository from Github and check out the revision corresponding to your version of Talos Linux + + ```bash + git clone https://github.com/talos-systems/pkgs pkgs && cd pkgs + git checkout v0.8.0 + ``` + + 2. Clone the Linux kernel and check out the revision that pkgs uses (this can be found in `kernel/kernel-prepare/pkg.yaml` and it will be something like the following: `https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-x.xx.x.tar.xz`) + + ```bash + git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git && cd linux + git checkout v5.15 + ``` + + 3. Your module will need to be converted to be in-tree. + The steps for this are different depending on the complexity of the module to port, but generally it would involve moving the module source code into the `drivers` tree and creating a new Makefile and Kconfig. + 4. Stage your changes in Git with `git add -A`. + 5. Run `git diff --cached --no-prefix > foobar.patch` to generate a patch from your changes. + 6. Copy this patch to `kernel/kernel/patches` in the `pkgs` repo. + 7. Add a `patch` line in the `prepare` segment of `kernel/kernel/pkg.yaml`: + + ```bash + patch -p0 < /pkg/patches/foobar.patch + ``` + + 8. Build the kernel image. + Make sure you are logged in to `ghcr.io` before running this command, and you can change or omit `PLATFORM` depending on what you want to target. + + ```bash + make kernel PLATFORM=linux/amd64 USERNAME=your-username PUSH=true + ``` + + 9. Make a note of the image name the `make` command outputs. +2. Building the installer image + 1. Copy the following into a new `Dockerfile`: + + ```dockerfile + FROM scratch AS customization + COPY --from=ghcr.io/your-username/kernel: /lib/modules /lib/modules + + FROM ghcr.io/siderolabs/installer: + COPY --from=ghcr.io/your-username/kernel: /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz + ``` + + 2. Run to build and push the installer: + + ```bash + INSTALLER_VERSION= + IMAGE_NAME="ghcr.io/your-username/talos-installer:$INSTALLER_VERSION" + DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t "$IMAGE_NAME" . && docker push "$IMAGE_NAME" + ``` + +3. Deploying to your cluster + + ```bash + talosctl upgrade --image ghcr.io/your-username/talos-installer: --preserve=true + ``` diff --git a/website/content/v1.6/advanced/static-pods.md b/website/content/v1.6/advanced/static-pods.md new file mode 100644 index 0000000000..17d721551d --- /dev/null +++ b/website/content/v1.6/advanced/static-pods.md @@ -0,0 +1,100 @@ +--- +title: "Static Pods" +description: "Using Talos Linux to set up static pods in Kubernetes." +aliases: + - ../guides/static-pods +--- + +## Static Pods + +Static pods are run directly by the `kubelet` bypassing the Kubernetes API server checks and validations. +Most of the time `DaemonSet` is a better alternative to static pods, but some workloads need to run +before the Kubernetes API server is available or might need to bypass security restrictions imposed by the API server. + +See [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/) for more information on static pods. + +## Configuration + +Static pod definitions are specified in the Talos machine configuration: + +```yaml +machine: + pods: + - apiVersion: v1 + kind: Pod + metadata: + name: nginx + spec: + containers: + - name: nginx + image: nginx +``` + +Talos renders static pod definitions to the `kubelet` manifest directory (`/etc/kubernetes/manifests`), `kubelet` picks up the definition and launches the pod. + +Talos accepts changes to the static pod configuration without a reboot. + +## Usage + +Kubelet mirrors pod definition to the API server state, so static pods can be inspected with `kubectl get pods`, logs can be retrieved with `kubectl logs`, etc. + +```bash +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-talos-default-controlplane-2 1/1 Running 0 17s +``` + +If the API server is not available, status of the static pod can also be inspected with `talosctl containers --kubernetes`: + +```bash +$ talosctl containers --kubernetes +NODE NAMESPACE ID IMAGE PID STATUS +172.20.0.3 k8s.io default/nginx-talos-default-controlplane-2 registry.k8s.io/pause:3.6 4886 SANDBOX_READY +172.20.0.3 k8s.io └─ default/nginx-talos-default-controlplane-2:nginx:4183a7d7a771 docker.io/library/nginx:latest +... +``` + +Logs of static pods can be retrieved with `talosctl logs --kubernetes`: + +```bash +$ talosctl logs --kubernetes default/nginx-talos-default-controlplane-2:nginx:4183a7d7a771 +172.20.0.3: 2022-02-10T15:26:01.289208227Z stderr F 2022/02/10 15:26:01 [notice] 1#1: using the "epoll" event method +172.20.0.3: 2022-02-10T15:26:01.2892466Z stderr F 2022/02/10 15:26:01 [notice] 1#1: nginx/1.21.6 +172.20.0.3: 2022-02-10T15:26:01.28925723Z stderr F 2022/02/10 15:26:01 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) +``` + +## Troubleshooting + +Talos doesn't perform any validation on the static pod definitions. +If the pod isn't running, use `kubelet` logs (`talosctl logs kubelet`) to find the problem: + +```bash +$ talosctl logs kubelet +172.20.0.2: {"ts":1644505520281.427,"caller":"config/file.go:187","msg":"Could not process manifest file","path":"/etc/kubernetes/manifests/talos-default-nginx-gvisor.yaml","err":"invalid pod: [spec.containers: Required value]"} +``` + +## Resource Definitions + +Static pod definitions are available as `StaticPod` resources combined with Talos-generated control plane static pods: + +```bash +$ talosctl get staticpods +NODE NAMESPACE TYPE ID VERSION +172.20.0.3 k8s StaticPod default-nginx 1 +172.20.0.3 k8s StaticPod kube-apiserver 1 +172.20.0.3 k8s StaticPod kube-controller-manager 1 +172.20.0.3 k8s StaticPod kube-scheduler 1 +``` + +Talos assigns ID `-` to the static pods specified in the machine configuration. + +On control plane nodes status of the running static pods is available in the `StaticPodStatus` resource: + +```bash +$ talosctl get staticpodstatus +NODE NAMESPACE TYPE ID VERSION READY +172.20.0.3 k8s StaticPodStatus default/nginx-talos-default-controlplane-2 2 True +172.20.0.3 k8s StaticPodStatus kube-system/kube-apiserver-talos-default-controlplane-2 2 True +172.20.0.3 k8s StaticPodStatus kube-system/kube-controller-manager-talos-default-controlplane-2 3 True +172.20.0.3 k8s StaticPodStatus kube-system/kube-scheduler-talos-default-controlplane-2 3 True +``` diff --git a/website/content/v1.6/advanced/talos-api-access-from-k8s.md b/website/content/v1.6/advanced/talos-api-access-from-k8s.md new file mode 100644 index 0000000000..c14789e61e --- /dev/null +++ b/website/content/v1.6/advanced/talos-api-access-from-k8s.md @@ -0,0 +1,157 @@ +--- +title: "Talos API access from Kubernetes" +description: "How to access Talos API from within Kubernetes." +aliases: + - ../guides/talos-api-access-from-k8s +--- + +In this guide, we will enable the Talos feature to access the Talos API from within Kubernetes. + +## Enabling the Feature + +Edit the machine configuration to enable the feature, specifying the Kubernetes namespaces from which Talos API +can be accessed and the allowed Talos API roles. + +```bash +talosctl -n 172.20.0.2 edit machineconfig +``` + +Configure the `kubernetesTalosAPIAccess` like the following: + +```yaml +spec: + machine: + features: + kubernetesTalosAPIAccess: + enabled: true + allowedRoles: + - os:reader + allowedKubernetesNamespaces: + - default +``` + +## Injecting Talos ServiceAccount into manifests + +Create the following manifest file `deployment.yaml`: + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: talos-api-access +spec: + selector: + matchLabels: + app: talos-api-access + template: + metadata: + labels: + app: talos-api-access + spec: + containers: + - name: talos-api-access + image: alpine:3 + command: + - sh + - -c + - | + wget -O /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download//talosctl-linux-amd64 + chmod +x /usr/local/bin/talosctl + while true; talosctl -n 172.20.0.2 version; do sleep 1; done +``` + +**Note:** make sure that you replace the IP `172.20.0.2` with a valid Talos node IP. + +Use `talosctl inject serviceaccount` command to inject the Talos ServiceAccount into the manifest. + +```bash +talosctl inject serviceaccount -f deployment.yaml > deployment-injected.yaml +``` + +Inspect the generated manifest: + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: null + name: talos-api-access +spec: + selector: + matchLabels: + app: talos-api-access + strategy: {} + template: + metadata: + creationTimestamp: null + labels: + app: talos-api-access + spec: + containers: + - command: + - sh + - -c + - | + wget -O /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download//talosctl-linux-amd64 + chmod +x /usr/local/bin/talosctl + while true; talosctl -n 172.20.0.2 version; do sleep 1; done + image: alpine:3 + name: talos-api-access + resources: {} + volumeMounts: + - mountPath: /var/run/secrets/talos.dev + name: talos-secrets + tolerations: + - operator: Exists + volumes: + - name: talos-secrets + secret: + secretName: talos-api-access-talos-secrets +status: {} +--- +apiVersion: talos.dev/v1alpha1 +kind: ServiceAccount +metadata: + name: talos-api-access-talos-secrets +spec: + roles: + - os:reader +--- +``` + +As you can notice, your deployment manifest is now injected with the Talos ServiceAccount. + +## Testing API Access + +Apply the new manifest into `default` namespace: + +```bash +kubectl apply -n default -f deployment-injected.yaml +``` + +Follow the logs of the pods belong to the deployment: + +```bash +kubectl logs -n default -f -l app=talos-api-access +``` + +You'll see a repeating output similar to the following: + +```text +Client: + Tag: + SHA: .... + Built: + Go version: go1.18.4 + OS/Arch: linux/amd64 +Server: + NODE: 172.20.0.2 + Tag: + SHA: ... + Built: + Go version: go1.18.4 + OS/Arch: linux/amd64 + Enabled: RBAC +``` + +This means that the pod can talk to Talos API of node 172.20.0.2 successfully. diff --git a/website/content/v1.6/advanced/troubleshooting-control-plane.md b/website/content/v1.6/advanced/troubleshooting-control-plane.md new file mode 100644 index 0000000000..2a00eb808f --- /dev/null +++ b/website/content/v1.6/advanced/troubleshooting-control-plane.md @@ -0,0 +1,449 @@ +--- +title: "Troubleshooting Control Plane" +description: "Troubleshoot control plane failures for running cluster and bootstrap process." +aliases: + - ../guides/troubleshooting-control-plane +--- + + + +In this guide we assume that Talos client config is available and Talos API access is available. +Kubernetes client configuration can be pulled from control plane nodes with `talosctl -n kubeconfig` +(this command works before Kubernetes is fully booted). + +### What is the control plane endpoint? + +The Kubernetes control plane endpoint is the single canonical URL by which the +Kubernetes API is accessed. +Especially with high-availability (HA) control planes, this endpoint may point to a load balancer or a DNS name which may +have multiple `A` and `AAAA` records. + +Like Talos' own API, the Kubernetes API uses mutual TLS, client +certs, and a common Certificate Authority (CA). +Unlike general-purpose websites, there is no need for an upstream CA, so tools +such as cert-manager, Let's Encrypt, or products such +as validated TLS certificates are not required. +Encryption, however, _is_, and hence the URL scheme will always be `https://`. + +By default, the Kubernetes API server in Talos runs on port 6443. +As such, the control plane endpoint URLs for Talos will almost always be of the form +`https://endpoint:6443`. +(The port, since it is not the `https` default of `443` is required.) +The `endpoint` above may be a DNS name or IP address, but it should be +directed to the _set_ of all controlplane nodes, as opposed to a +single one. + +As mentioned above, this can be achieved by a number of strategies, including: + +- an external load balancer +- DNS records +- Talos-builtin shared IP ([VIP]({{< relref "../talos-guides/network/vip" >}})) +- BGP peering of a shared IP (such as with [kube-vip](https://kube-vip.io)) + +Using a DNS name here is a good idea, since it allows any other option, while offering +a layer of abstraction. +It allows the underlying IP addresses to change without impacting the +canonical URL. + +Unlike most services in Kubernetes, the API server runs with host networking, +meaning that it shares the network namespace with the host. +This means you can use the IP address(es) of the host to refer to the Kubernetes +API server. + +For availability of the API, it is important that any load balancer be aware of +the health of the backend API servers, to minimize disruptions during +common node operations like reboots and upgrades. + +It is critical that the control plane endpoint works correctly during cluster bootstrap phase, as nodes discover +each other using control plane endpoint. + +### kubelet is not running on control plane node + +The `kubelet` service should be running on control plane nodes as soon as networking is configured: + +```bash +$ talosctl -n service kubelet +NODE 172.20.0.2 +ID kubelet +STATE Running +HEALTH OK +EVENTS [Running]: Health check successful (2m54s ago) + [Running]: Health check failed: Get "http://127.0.0.1:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused (3m4s ago) + [Running]: Started task kubelet (PID 2334) for container kubelet (3m6s ago) + [Preparing]: Creating service runner (3m6s ago) + [Preparing]: Running pre state (3m15s ago) + [Waiting]: Waiting for service "timed" to be "up" (3m15s ago) + [Waiting]: Waiting for service "cri" to be "up", service "timed" to be "up" (3m16s ago) + [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m18s ago) +``` + +If the `kubelet` is not running, it may be due to invalid configuration. +Check `kubelet` logs with the `talosctl logs` command: + +```bash +$ talosctl -n logs kubelet +172.20.0.2: I0305 20:45:07.756948 2334 controller.go:101] kubelet config controller: starting controller +172.20.0.2: I0305 20:45:07.756995 2334 controller.go:267] kubelet config controller: ensuring filesystem is set up correctly +172.20.0.2: I0305 20:45:07.757000 2334 fsstore.go:59] kubelet config controller: initializing config checkpoints directory "/etc/kubernetes/kubelet/store" +``` + +### etcd is not running + +By far the most likely cause of `etcd` not running is because the cluster has +not yet been bootstrapped or because bootstrapping is currently in progress. +The `talosctl bootstrap` command must be run manually and only _once_ per +cluster, and this step is commonly missed. +Once a node is bootstrapped, it will start `etcd` and, over the course of a +minute or two (depending on the download speed of the control plane nodes), the +other control plane nodes should discover it and join themselves to the cluster. + +Also, `etcd` will only run on control plane nodes. +If a node is designated as a worker node, you should not expect `etcd` to be +running on it. + +When node boots for the first time, the `etcd` data directory (`/var/lib/etcd`) is empty, and it will only be populated when `etcd` is launched. + +If `etcd` is not running, check service `etcd` state: + +```bash +$ talosctl -n service etcd +NODE 172.20.0.2 +ID etcd +STATE Running +HEALTH OK +EVENTS [Running]: Health check successful (3m21s ago) + [Running]: Started task etcd (PID 2343) for container etcd (3m26s ago) + [Preparing]: Creating service runner (3m26s ago) + [Preparing]: Running pre state (3m26s ago) + [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m26s ago) +``` + +If service is stuck in `Preparing` state for bootstrap node, it might be related to slow network - at this stage +Talos pulls the `etcd` image from the container registry. + +If the `etcd` service is crashing and restarting, check its logs with `talosctl -n logs etcd`. +The most common reasons for crashes are: + +- wrong arguments passed via `extraArgs` in the configuration; +- booting Talos on non-empty disk with previous Talos installation, `/var/lib/etcd` contains data from old cluster. + +### etcd is not running on non-bootstrap control plane node + +The `etcd` service on control plane nodes which were not the target of the cluster bootstrap will wait until the bootstrapped control plane node has completed. +The bootstrap and discovery processes may take a few minutes to complete. +As soon as the bootstrapped node starts its Kubernetes control plane components, `kubectl get endpoints` will return the IP of bootstrapped control plane node. +At this point, the other control plane nodes will start their `etcd` services, join the cluster, and then start their own Kubernetes control plane components. + +### Kubernetes static pod definitions are not generated + +Talos should generate the static pod definitions for the Kubernetes control plane +as resources: + +```bash +$ talosctl -n get staticpods +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 k8s StaticPod kube-apiserver 1 +172.20.0.2 k8s StaticPod kube-controller-manager 1 +172.20.0.2 k8s StaticPod kube-scheduler 1 +``` + +Talos should report that the static pod definitions are rendered for the `kubelet`: + +```bash +$ talosctl -n dmesg | grep 'rendered new' +172.20.0.2: user: warning: [2023-04-26T19:17:52.550527204Z]: [talos] rendered new static pod {"component": "controller-runtime", "controller": "k8s.StaticPodServerController", "id": "kube-apiserver"} +172.20.0.2: user: warning: [2023-04-26T19:17:52.552186204Z]: [talos] rendered new static pod {"component": "controller-runtime", "controller": "k8s.StaticPodServerController", "id": "kube-controller-manager"} +172.20.0.2: user: warning: [2023-04-26T19:17:52.554607204Z]: [talos] rendered new static pod {"component": "controller-runtime", "controller": "k8s.StaticPodServerController", "id": "kube-scheduler"} +``` + +If the static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above) +and the controller runtime logs (`talosctl logs controller-runtime`). + +### Talos prints error `an error on the server ("") has prevented the request from succeeding` + +This is expected during initial cluster bootstrap and sometimes after a reboot: + +```bash +[ 70.093289] [talos] task labelNodeAsControlPlane (1/1): starting +[ 80.094038] [talos] retrying error: an error on the server ("") has prevented the request from succeeding (get nodes talos-default-controlplane-1) +``` + +Initially `kube-apiserver` component is not running yet, and it takes some time before it becomes fully up +during bootstrap (image should be pulled from the Internet, etc.) +Once the control plane endpoint is up, Talos should continue with its boot +process. + +If Talos doesn't proceed, it may be due to a configuration issue. + +In any case, the status of the control plane components on each control plane nodes can be checked with `talosctl containers -k`: + +```bash +$ talosctl -n containers --kubernetes +NODE NAMESPACE ID IMAGE PID STATUS +172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-controlplane-1 registry.k8s.io/pause:3.2 2539 SANDBOX_READY +172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-controlplane-1:kube-apiserver:51c3aad7a271 registry.k8s.io/kube-apiserver:v{{< k8s_release >}} 2572 CONTAINER_RUNNING +``` + +If `kube-apiserver` shows as `CONTAINER_EXITED`, it might have exited due to configuration error. +Logs can be checked with `taloctl logs --kubernetes` (or with `-k` as a shorthand): + +```bash +$ talosctl -n logs -k kube-system/kube-apiserver-talos-default-controlplane-1:kube-apiserver:51c3aad7a271 +172.20.0.2: 2021-03-05T20:46:13.133902064Z stderr F 2021/03/05 20:46:13 Running command: +172.20.0.2: 2021-03-05T20:46:13.133933824Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) +172.20.0.2: 2021-03-05T20:46:13.133938524Z stderr F Run from directory: +172.20.0.2: 2021-03-05T20:46:13.13394154Z stderr F Executable path: /usr/local/bin/kube-apiserver +... +``` + +### Talos prints error `nodes "talos-default-controlplane-1" not found` + +This error means that `kube-apiserver` is up and the control plane endpoint is healthy, but the `kubelet` hasn't received +its client certificate yet, and it wasn't able to register itself to Kubernetes. +The Kubernetes controller manager (`kube-controller-manager`)is responsible for monitoring the certificate +signing requests (CSRs) and issuing certificates for each of them. +The kubelet is responsible for generating and submitting the CSRs for its +associated node. + +For the `kubelet` to get its client certificate, then, the Kubernetes control plane +must be healthy: + +- the API server is running and available at the Kubernetes control plane + endpoint URL +- the controller manager is running and a leader has been elected + +The states of any CSRs can be checked with `kubectl get csr`: + +```bash +$ kubectl get csr +NAME AGE SIGNERNAME REQUESTOR CONDITION +csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued +csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued +csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued +csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued +``` + +### Talos prints error `node not ready` + +A Node in Kubernetes is marked as `Ready` only once its CNI is up. +It takes a minute or two for the CNI images to be pulled and for the CNI to start. +If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`. +Usually, CNI-related resources are created in `kube-system` namespace. + +For example, for Talos default Flannel CNI: + +```bash +$ kubectl -n kube-system get pods +NAME READY STATUS RESTARTS AGE +... +kube-flannel-25drx 1/1 Running 0 23m +kube-flannel-8lmb6 1/1 Running 0 23m +kube-flannel-gl7nx 1/1 Running 0 23m +kube-flannel-jknt9 1/1 Running 0 23m +... +``` + +### Talos prints error `x509: certificate signed by unknown authority` + +The full error might look like: + +```bash +x509: certificate signed by unknown authority (possiby because of crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes" +``` + +Usually, this occurs because the control plane endpoint points to a different +cluster than the client certificate was generated for. +If a node was recycled between clusters, make sure it was properly wiped between +uses. +If a client has multiple client configurations, make sure you are matching the correct `talosconfig` with the +correct cluster. + +### etcd is running on bootstrap node, but stuck in `pre` state on non-bootstrap nodes + +Please see question `etcd is not running on non-bootstrap control plane node`. + +### Checking `kube-controller-manager` and `kube-scheduler` + +If the control plane endpoint is up, the status of the pods can be ascertained with `kubectl`: + +```bash +$ kubectl get pods -n kube-system -l k8s-app=kube-controller-manager +NAME READY STATUS RESTARTS AGE +kube-controller-manager-talos-default-controlplane-1 1/1 Running 0 28m +kube-controller-manager-talos-default-controlplane-2 1/1 Running 0 28m +kube-controller-manager-talos-default-controlplane-3 1/1 Running 0 28m +``` + +If the control plane endpoint is not yet up, the container status of the control plane components can be queried with +`talosctl containers --kubernetes`: + +```bash +$ talosctl -n c -k +NODE NAMESPACE ID IMAGE PID STATUS +... +172.20.0.2 k8s.io kube-system/kube-controller-manager-talos-default-controlplane-1 registry.k8s.io/pause:3.2 2547 SANDBOX_READY +172.20.0.2 k8s.io └─ kube-system/kube-controller-manager-talos-default-controlplane-1:kube-controller-manager:84fc77c59e17 registry.k8s.io/kube-controller-manager:v{{< k8s_release >}} 2580 CONTAINER_RUNNING +172.20.0.2 k8s.io kube-system/kube-scheduler-talos-default-controlplane-1 registry.k8s.io/pause:3.2 2638 SANDBOX_READY +172.20.0.2 k8s.io └─ kube-system/kube-scheduler-talos-default-controlplane-1:kube-scheduler:4182a7d7f779 registry.k8s.io/kube-scheduler:v{{< k8s_release >}} 2670 CONTAINER_RUNNING +... +``` + +If some of the containers are not running, it could be that image is still being pulled. +Otherwise the process might crashing. +The logs can be checked with `talosctl logs --kubernetes `: + +```bash +$ talosctl -n logs -k kube-system/kube-controller-manager-talos-default-controlplane-1:kube-controller-manager:84fc77c59e17 +172.20.0.3: 2021-03-09T13:59:34.291667526Z stderr F 2021/03/09 13:59:34 Running command: +172.20.0.3: 2021-03-09T13:59:34.291702262Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) +172.20.0.3: 2021-03-09T13:59:34.291707121Z stderr F Run from directory: +172.20.0.3: 2021-03-09T13:59:34.291710908Z stderr F Executable path: /usr/local/bin/kube-controller-manager +172.20.0.3: 2021-03-09T13:59:34.291719163Z stderr F Args (comma-delimited): /usr/local/bin/kube-controller-manager,--allocate-node-cidrs=true,--cloud-provider=,--cluster-cidr=10.244.0.0/16,--service-cluster-ip-range=10.96.0.0/12,--cluster-signing-cert-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--cluster-signing-key-file=/system/secrets/kubernetes/kube-controller-manager/ca.key,--configure-cloud-routes=false,--kubeconfig=/system/secrets/kubernetes/kube-controller-manager/kubeconfig,--leader-elect=true,--root-ca-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--service-account-private-key-file=/system/secrets/kubernetes/kube-controller-manager/service-account.key,--profiling=false +172.20.0.3: 2021-03-09T13:59:34.293870359Z stderr F 2021/03/09 13:59:34 Now listening for interrupts +172.20.0.3: 2021-03-09T13:59:34.761113762Z stdout F I0309 13:59:34.760982 10 serving.go:331] Generated self-signed cert in-memory +... +``` + +### Checking controller runtime logs + +Talos runs a set of controllers which operate on resources to build and support the Kubernetes control plane. + +Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: + +```bash +$ talosctl -n logs controller-runtime +172.20.0.2: 2021/03/09 13:57:11 secrets.EtcdController: controller starting +172.20.0.2: 2021/03/09 13:57:11 config.MachineTypeController: controller starting +172.20.0.2: 2021/03/09 13:57:11 k8s.ManifestApplyController: controller starting +172.20.0.2: 2021/03/09 13:57:11 v1alpha1.BootstrapStatusController: controller starting +172.20.0.2: 2021/03/09 13:57:11 v1alpha1.TimeStatusController: controller starting +... +``` + +Controllers continuously run a reconcile loop, so at any time, they may be starting, failing, or restarting. +This is expected behavior. + +Things to look for: + +`k8s.KubeletStaticPodController: rendered new static pod`: static pod definitions were rendered successfully. + +`k8s.ManifestApplyController: controller failed: error creating mapping for object /v1/Secret/bootstrap-token-q9pyzr: an error on the server ("") has prevented the request from succeeding`: control plane endpoint is not up yet, bootstrap manifests can't be injected, controller is going to retry. + +`k8s.KubeletStaticPodController: controller failed: error refreshing pod status: error fetching pod status: an error on the server ("Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)") has prevented the request from succeeding`: kubelet hasn't been able to contact `kube-apiserver` yet to push pod status, controller +is going to retry. + +`k8s.ManifestApplyController: created rbac.authorization.k8s.io/v1/ClusterRole/psp:privileged`: one of the bootstrap manifests got successfully applied. + +`secrets.KubernetesController: controller failed: missing cluster.aggregatorCA secret`: Talos is running with 0.8 configuration, if the cluster was upgraded from 0.8, this is expected, and conversion process will fix machine config +automatically. +If this cluster was bootstrapped with version 0.9, machine configuration should be regenerated with 0.9 talosctl. + +If there are no new messages in the `controller-runtime` log, it means that the controllers have successfully finished reconciling, and that the current system state is the desired system state. + +### Checking static pod definitions + +Talos generates static pod definitions for the `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` +components based on its machine configuration. +These definitions can be checked as resources with `talosctl get staticpods`: + +```bash +$ talosctl -n get staticpods -o yaml +get staticpods -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: StaticPods.kubernetes.talos.dev + id: kube-apiserver + version: 2 + phase: running + finalizers: + - k8s.StaticPodStatus("kube-apiserver") +spec: + apiVersion: v1 + kind: Pod + metadata: + annotations: + talos.dev/config-version: "1" + talos.dev/secrets-version: "1" + creationTimestamp: null + labels: + k8s-app: kube-apiserver + tier: control-plane + name: kube-apiserver + namespace: kube-system +... +``` + +The status of the static pods can queried with `talosctl get staticpodstatus`: + +```bash +$ talosctl -n get staticpodstatus +NODE NAMESPACE TYPE ID VERSION READY +172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-controlplane-1 1 True +172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-controlplane-1 1 True +172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-controlplane-1 1 True +``` + +The most important status field is `READY`, which is the last column printed. +The complete status can be fetched by adding `-o yaml` flag. + +### Checking bootstrap manifests + +As part of the bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. +There are two kinds of these manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): + +```bash +$ talosctl -n get manifests +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 +172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 +172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 +172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 +172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 +172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 +172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 +172.20.0.2 controlplane Manifest 10-kube-proxy 1 +172.20.0.2 controlplane Manifest 11-core-dns 1 +172.20.0.2 controlplane Manifest 11-core-dns-svc 1 +172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 +``` + +Details of each manifest can be queried by adding `-o yaml`: + +```bash +$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: Manifests.kubernetes.talos.dev + id: 01-csr-approver-role-binding + version: 1 + phase: running +spec: + - apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: system-bootstrap-approve-node-client-csr + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:certificates.k8s.io:certificatesigningrequests:nodeclient + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:bootstrappers +``` + +### Worker node is stuck with `apid` health check failures + +Control plane nodes have enough secret material to generate `apid` server certificates, but worker nodes +depend on control plane `trustd` services to generate certificates. +Worker nodes wait for their `kubelet` to join the cluster. +Then the Talos `apid` queries the Kubernetes endpoints via control plane +endpoint to find `trustd` endpoints. +They then use `trustd` to request and receive their certificate. + +So if `apid` health checks are failing on worker node: + +- make sure control plane endpoint is healthy +- check that worker node `kubelet` joined the cluster diff --git a/website/content/v1.6/advanced/verifying-images.md b/website/content/v1.6/advanced/verifying-images.md new file mode 100644 index 0000000000..58817e306c --- /dev/null +++ b/website/content/v1.6/advanced/verifying-images.md @@ -0,0 +1,37 @@ +--- +title: "Verifying Images" +description: "Verifying Talos container image signatures." +--- + +Sidero Labs signs the container images generated for the Talos release with [cosign](https://docs.sigstore.dev/cosign/overview/): + +* `ghcr.io/siderolabs/installer` (Talos installer) +* `ghcr.io/siderolabs/talos` (Talos image for container runtime) +* `ghcr.io/siderolabs/talosctl` (`talosctl` client packaged as a container image) +* `ghcr.io/siderolabs/imager` (Talos install image generator) +* all [system extension images](https://github.com/siderolabs/extensions/) + +## Verifying Container Image Signatures + +The `cosign` tool can be used to verify the signatures of the Talos container images: + +```bash +$ cosign verify --certificate-identity-regexp '@siderolabs\.com$' --certificate-oidc-issuer https://accounts.google.com ghcr.io/siderolabs/installer:v1.4.0 + +Verification for ghcr.io/siderolabs/installer:v1.4.0 -- +The following checks were performed on each of these signatures: + - The cosign claims were validated + - Existence of the claims in the transparency log was verified offline + - The code-signing certificate was verified using trusted certificate authority certificates + +[{"critical":{"identity":{"docker-reference":"ghcr.io/siderolabs/installer"},"image":{"docker-manifest-digest":"sha256:f41795cc88f40eb1bc6b3c638c4a3123f6ef3c90627bfc35c04ebab82581e3ee"},"type":"cosign container image signature"},"optional":{"1.3.6.1.4.1.57264.1.1":"https://accounts.google.com","Bundle":{"SignedEntryTimestamp":"MEQCIERkQpgEnPWnfjUHIWO9QxC9Ute3/xJOc7TO5GUnu59xAiBKcFvrDWHoUYChT0/+gaazTrI+r0/GWSbi+Q+sEQ5AKA==","Payload":{"body":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJkYjhjYWUyMDZmODE5MDlmZmI4NjE4ZjRkNjIzM2ZlYmM3NzY5MzliOGUxZmZkMTM1ODA4ZmZjNDgwNjYwNGExIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUURQWXhiVG5vSDhJTzBEakRGRE9rNU1HUjRjMXpWMys3YWFjczNHZ2J0TG1RSWdHczN4dVByWUgwQTAvM1BSZmZydDRYNS9nOUtzQVdwdG9JbE9wSDF0NllrPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXhha05EUVd4NVowRjNTVUpCWjBsVlNIbEhaRTFQVEhkV09WbFFSbkJYUVRKb01qSjRVM1ZIZVZGM2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcE5kMDVFUlRSTlZHZDZUbXBWTlZkb1kwNU5hazEzVGtSRk5FMVVaekJPYWxVMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZaUVdKaVkwbDZUVzR3ZERBdlVEZHVUa0pNU0VscU1rbHlORTFQZGpoVVRrVjZUemNLUkVadVRXSldVbGc0TVdWdmExQnVZblJHTVZGMmRWQndTVm95VkV3NFFUUkdSMWw0YldFeGJFTk1kMkk0VEZOVWMzRlBRMEZZYzNkblowWXpUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZqYWsweUNrbGpVa1lyTkhOVmRuRk5ia3hsU0ZGMVJIRkdRakZqZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDB0M1dVUldVakJTUVZGSUwwSkRSWGRJTkVWa1dWYzFhMk50VmpWTWJrNTBZVmhLZFdJeldrRmpNbXhyV2xoS2RtSkhSbWxqZVRWcVlqSXdkd3BMVVZsTFMzZFpRa0pCUjBSMmVrRkNRVkZSWW1GSVVqQmpTRTAyVEhrNWFGa3lUblprVnpVd1kzazFibUl5T1c1aVIxVjFXVEk1ZEUxRGMwZERhWE5IQ2tGUlVVSm5OemgzUVZGblJVaFJkMkpoU0ZJd1kwaE5Oa3g1T1doWk1rNTJaRmMxTUdONU5XNWlNamx1WWtkVmRWa3lPWFJOU1VkTFFtZHZja0puUlVVS1FXUmFOVUZuVVVOQ1NIZEZaV2RDTkVGSVdVRXpWREIzWVhOaVNFVlVTbXBIVWpSamJWZGpNMEZ4U2t0WWNtcGxVRXN6TDJnMGNIbG5Remh3TjI4MFFRcEJRVWRJYkdGbVp6Um5RVUZDUVUxQlVucENSa0ZwUVdKSE5tcDZiVUkyUkZCV1dUVXlWR1JhUmtzeGVUSkhZVk5wVW14c1IydHlSRlpRVXpsSmJGTktDblJSU1doQlR6WlZkbnBFYVVOYVFXOXZSU3RLZVdwaFpFdG5hV2xLT1RGS00yb3ZZek5CUTA5clJIcFhOamxaVUUxQmIwZERRM0ZIVTAwME9VSkJUVVFLUVRKblFVMUhWVU5OUVZCSlRUVjJVbVpIY0VGVWNqQTJVR1JDTURjeFpFOXlLMHhFSzFWQ04zbExUVWRMWW10a1UxTnJaMUp5U3l0bGNuZHdVREp6ZGdvd1NGRkdiM2h0WlRkM1NYaEJUM2htWkcxTWRIQnpjazFJZGs5cWFFSmFTMVoxVG14WmRXTkJaMVF4V1VWM1ZuZHNjR2QzYTFWUFdrWjRUemRrUnpONkNtVnZOWFJ3YVdoV1kyTndWMlozUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19","integratedTime":1681843022,"logIndex":18304044,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}},"Issuer":"https://accounts.google.com","Subject":"andrey.smirnov@siderolabs.com"}}] +``` + +The image should be signed using [cosing keyless flow](https://docs.sigstore.dev/cosign/keyless/) by a Sidero Labs employee with and email from `siderolabs.com` domain. + +## Reproducible Builds + +Talos builds for `kernel`, `initramfs`, `talosctl`, ISO image, and container images are reproducible. +So you can verify that the build is the same as the one as provided on [GitHub releases page](https://github.com/siderolabs/talos/releases). + +See [building Talos images]({{< relref "building-images" >}}) for more details. diff --git a/website/content/v1.6/introduction/_index.md b/website/content/v1.6/introduction/_index.md new file mode 100644 index 0000000000..a12a4a13c0 --- /dev/null +++ b/website/content/v1.6/introduction/_index.md @@ -0,0 +1,4 @@ +--- +title: "Introduction" +weight: 10 +--- diff --git a/website/content/v1.6/introduction/getting-started.md b/website/content/v1.6/introduction/getting-started.md new file mode 100644 index 0000000000..c2a0286991 --- /dev/null +++ b/website/content/v1.6/introduction/getting-started.md @@ -0,0 +1,308 @@ +--- +title: Getting Started +weight: 30 +description: "A guide to setting up a Talos Linux cluster." +--- + +This document will walk you through installing a simple Talos Cluster with a single control plane node and one or more worker nodes, explaining some of the concepts. + +> If this is your first use of Talos Linux, we recommend the [Quickstart]({{< relref "quickstart" >}}) first, to quickly create a local virtual cluster in containers on your workstation. +> +>For a production cluster, extra steps are needed - see [Production Notes]({{< relref "prodnotes" >}}). + +Regardless of where you run Talos, the steps to create a Kubernetes cluster are: + +- boot machines off the Talos Linux image +- define the endpoint for the Kubernetes API and generate your machine configurations +- configure Talos Linux by applying machine configurations to the machines +- configure `talosctl` +- bootstrap Kubernetes + +## Prerequisites + +### `talosctl` + +`talosctl` is a CLI tool which interfaces with the Talos API. +Talos Linux has no SSH access: `talosctl` is the tool you use to interact with the operating system on the machines. + +Install `talosctl` before continuing: + +```bash +curl -sL https://talos.dev/install | sh +``` + +> Note: If you boot systems off the ISO, Talos on the ISO image runs in RAM and acts as an installer. +> The version of `talosctl` that is used to create the machine configurations controls the version of Talos Linux that is installed on the machines - NOT the image that the machines are initially booted off. +> For example, booting a machine off the Talos 1.3.7 ISO, but creating the initial configuration with `talosctl` binary of version 1.4.1, will result in a machine running Talos Linux version 1.4.1. +> +> It is advisable to use the same version of `talosctl` as the version of the boot media used. + +### Network access + +This guide assumes that the systems being installed have outgoing access to the internet, allowing them to pull installer and container images, query NTP, etc. +If needed, see the documentation on [registry proxies]({{< relref "../talos-guides/configuration/pull-through-cache" >}}), local registries, and [airgapped installation]({{< relref "../advanced/air-gapped" >}}). + +## Acquire the Talos Linux image and boot machines + +The most general way to install Talos Linux is to use the ISO image. + +The latest ISO image can be found on the Github [Releases](https://github.com/siderolabs/talos/releases) page: + +- X86: [https://github.com/siderolabs/talos/releases/download/{{< release >}}/metal-amd64.iso](https://github.com/siderolabs/talos/releases/download/{{< release >}}/metal-amd64.iso) +- ARM64: [https://github.com/siderolabs/talos/releases/download/{{< release >}}/metal-arm64.iso](https://github.com/siderolabs/talos/releases/download/{{< release >}}/metal-arm64.iso) + +When booted from the ISO, Talos will run in RAM and will not install to disk until provided a configuration. +Thus, it is safe to boot any machine from the ISO. + +At this point, you should: + +- boot one machine off the ISO to be the control plane node +- boot one or more machines off the same ISO to be the workers + +### Alternative Booting + +For network booting and self-built media, see [Production Notes]({{< relref "prodnotes#alternative-booting" >}}). +There are installation methods specific to specific platforms, such as pre-built AMIs for AWS - check the specific [Installation Guides]({{< relref "../talos-guides/install/" >}}).) + +## Define the Kubernetes Endpoint + +In order to configure Kubernetes, Talos needs to know +what the endpoint of the Kubernetes API Server will be. + +Because we are only creating a single control plane node in this guide, we can use the control plane node directly as the Kubernetes API endpoint. + +Identify the IP address or DNS name of the control plane node that was booted above, and convert it to a fully-qualified HTTPS URL endpoint address for the Kubernetes API Server which (by default) runs on port 6443. +The endpoint should be formatted like: + +- `https://192.168.0.2:6443` +- `https://kube.mycluster.mydomain.com:6443` + +> NOTE: For a production cluster, you should have three control plane nodes, and have the endpoint allocate traffic to all three - see [Production Notes]({{< relref "prodnotes#control-plane-nodes" >}}). + +## Accessing the Talos API + +Administrative tasks are performed by calling the Talos API (usually with `talosctl`) on Talos Linux control plane nodes - thus, ensure your control +plane node is directly reachable on TCP port 50000 from the workstation where you run the `talosctl` client. +This may require changing firewall rules or cloud provider access-lists. + +For production configurations, see [Production Notes]({{< relref "prodnotes#decide-the-kubernetes-endpoint" >}}). + +## Configure Talos Linux + +When Talos boots without a configuration, such as when booting off the Talos ISO, it +enters maintenance mode and waits for a configuration to be provided. + +> A configuration can be passed in on boot via kernel parameters or metadata servers. +See [Production Notes]({{< relref "prodnotes#configure-talos" >}}). + +Unlike traditional Linux, Talos Linux is *not* configured by SSHing to the server and issuing commands. +Instead, the entire state of the machine is defined by a `machine config` file which is passed to the server. +This allows machines to be managed in a declarative way, and lends itself to GitOps and modern operations paradigms. +The state of a machine is completely defined by, and can be reproduced from, the machine configuration file. + +To generate the machine configurations for a cluster, run this command on the workstation where you installed `talosctl`: + +```sh +talosctl gen config +``` + +`cluster-name` is an arbitrary name, used as a label in your local client configuration. +It should be unique in the configuration on your local workstation. + +`cluster-endpoint` is the Kubernetes Endpoint you constructed from the control plane node's IP address or DNS name above. +It should be a complete URL, with `https://` +and port. + +For example: + +```sh +$ talosctl gen config mycluster https://192.168.0.2:6443 +generating PKI and tokens +created /Users/taloswork/controlplane.yaml +created /Users/taloswork/worker.yaml +created /Users/taloswork/talosconfig +``` + +When you run this command, three files are created in your current +directory: + +- `controlplane.yaml` +- `worker.yaml` +- `talosconfig` + +The `.yaml` files are Machine Configs: they describe everything from what disk Talos should be installed on, to network settings. +The `controlplane.yaml` file also describes how Talos should form a Kubernetes cluster. + +The `talosconfig` file is your local client configuration file, used to connect to and authenticate access to the cluster. + +### Controlplane and Worker + +The two types of Machine Configs correspond to the two roles of Talos nodes, control plane nodes (which run both the Talos and Kubernetes control planes) and worker nodes (which run the workloads). + +The main difference between Controlplane Machine Config files and Worker Machine Config files is that the former contains information about how to form the +Kubernetes cluster. + +### Modifying the Machine configs + +The generated Machine Configs have defaults that work for most cases. +They use DHCP for interface configuration, and install to `/dev/sda`. + +Sometimes, you will need to modify the generated files to work with your systems. +A common case is needing to change the installation disk. +If you try to to apply the machine config to a node, and get an error like the below, you need to specify a different installation disk: + +```sh +$ talosctl apply-config --insecure -n 192.168.0.2 --file controlplane.yaml +error applying new configuration: rpc error: code = InvalidArgument desc = configuration validation failed: 1 error occurred: + * specified install disk does not exist: "/dev/sda" +``` + +You can verify which disks your nodes have by using the `talosctl disks --insecure` command. + +> Insecure mode is needed at this point as the PKI infrastructure has not yet been set up. + +For example, the `talosctl disks` command below shows that the system has a `vda` drive, not an `sda`: + +```sh +$ talosctl -n 192.168.0.2 disks --insecure +DEV MODEL SERIAL TYPE UUID WWID MODALIAS NAME SIZE BUS_PATH +/dev/vda - - HDD - - virtio:d00000002v00001AF4 - 69 GB /pci0000:00/0000:00:06.0/virtio2/ +``` + +In this case, you would modify the `controlplane.yaml` and `worker.yaml` files and edit the line: + +```yaml +install: + disk: /dev/sda # The disk used for installations. +``` + +to reflect `vda` instead of `sda`. + +>For information on customizing your machine configurations (such as to specify the version of Kubernetes), using [machine configuration patches]({{< relref "../talos-guides/configuration/patching" >}}), or customizing configurations for individual machines (such as setting static IP addresses), see the [Production Notes]({{< relref "prodnotes#customizing-machine-configuration" >}}). + +## Understand talosctl, endpoints and nodes + +It is important to understand the concept of `endpoints` and `nodes`. +In short: `endpoints` are where `talosctl` *sends* commands to, but the command *operates* on the specified `nodes`. +The endpoint will forward the command to the nodes, if needed. + +### Endpoints + +Endpoints are the IP addresses of control plane nodes, to which the `talosctl` client directly talks. + +Endpoints automatically proxy requests destined to another node in the cluster. +This means that you only need access to the control plane nodes in order to manage the rest of the cluster. + +You can pass in `--endpoints ` or `-e ` to the current `talosctl` command. + +In this tutorial setup, the endpoint will always be the single control plane node. + +### Nodes + +Nodes are the target(s) you wish to perform the operation on. + +> When specifying nodes, the IPs and/or hostnames are *as seen by the endpoint servers*, not as from the client. +> This is because all connections are proxied through the endpoints. + +You may provide `-n` or `--nodes` to any `talosctl` command to supply the node or (comma-separated) nodes on which you wish to perform the operation. + +For example, to see the containers running on node 192.168.0.200, by routing the `containers` command through the control plane endpoint 192.168.0.2: + +```bash +talosctl -e 192.168.0.2 -n 192.168.0.200 containers +``` + +To see the etcd logs on *both* nodes 192.168.0.10 and 192.168.0.11: + +```bash +talosctl -e 192.168.0.2 -n 192.168.0.10,192.168.0.11 logs etcd +``` + +For a more in-depth discussion of Endpoints and Nodes, please see [talosctl]({{< relref "../learn-more/talosctl" >}}). + +### Apply Configuration + +To apply the Machine Configs, you need to know the machines' IP addresses. + +Talos prints the IP addresses of the machines on the console during the boot process: + +```log +[4.605369] [talos] task loadConfig (1/1): this machine is reachable at: +[4.607358] [talos] task loadConfig (1/1): 192.168.0.2 +``` + +If you do not have console access, the IP address may also be discoverable from your DHCP server. + +Once you have the IP address, you can then apply the correct configuration. +Apply the `controlplane.yaml` file to the control plane node, and the `worker.yaml` file to all the worker node(s). + +```sh + talosctl apply-config --insecure \ + --nodes 192.168.0.2 \ + --file controlplane.yaml +``` + +The `--insecure` flag is necessary because the PKI infrastructure has not yet been made available to the node. +Note: the connection *will* be encrypted, but not authenticated. + +When using the `--insecure` flag, it is not necessary to specify an endpoint. + +### Default talosconfig configuration file + +You reference which configuration file to use by the `--talosconfig` parameter: + +```sh +talosctl --talosconfig=./talosconfig \ + --nodes 192.168.0.2 -e 192.168.0.2 version +``` + +Note that `talosctl` comes with tooling to help you integrate and merge this configuration into the default `talosctl` configuration file. +See [Production Notes]({{< relref "prodnotes#default-configuration-file" >}}) for more information. + +While getting started, a common mistake is referencing a configuration context for a different cluster, resulting in authentication or connection failures. +Thus it is recommended to explicitly pass in the configuration file while becoming familiar with Talos Linux. + +## Kubernetes Bootstrap + +Bootstrapping your Kubernetes cluster with Talos is as simple as calling `talosctl bootstrap` on your control plane node: + +```sh +talosctl bootstrap --nodes 192.168.0.2 --endpoint 192.168.0.2 \ + --talosconfig=./talosconfig +``` + +>The bootstrap operation should only be called **ONCE** on a **SINGLE** control plane node. +(If you have multiple control plane nodes, it doesn't matter which one you issue the bootstrap command against.) + +At this point, Talos will form an `etcd` cluster, and start the Kubernetes control plane components. + +After a few moments, you will be able to download your Kubernetes client configuration and get started: + +```sh + talosctl kubeconfig --nodes 192.168.0.2 --endpoint 192.168.0.2 +``` + +Running this command will add (merge) you new cluster into your local Kubernetes configuration. + +If you would prefer the configuration to *not* be merged into your default Kubernetes configuration file, pass in a filename: + +```sh + talosctl kubeconfig alternative-kubeconfig --nodes 192.168.0.2 --endpoint 192.168.0.2 +``` + +You should now be able to connect to Kubernetes and see your nodes: + +```sh + kubectl get nodes +``` + +And use talosctl to explore your cluster: + +```sh +talosctl --nodes 192.168.0.2 --endpoint 192.168.0.2 health \ + --talosconfig=./talosconfig +talosctl--nodes 192.168.0.2 --endpoint 192.168.0.2 dashboard \ + --talosconfig=./talosconfig +``` + +For a list of all the commands and operations that `talosctl` provides, see the [CLI reference]({{< relref "../reference/cli/#talosctl" >}}). diff --git a/website/content/v1.6/introduction/prodnotes.md b/website/content/v1.6/introduction/prodnotes.md new file mode 100644 index 0000000000..f6a421fccb --- /dev/null +++ b/website/content/v1.6/introduction/prodnotes.md @@ -0,0 +1,324 @@ +--- +title: Production Clusters +weight: 30 +description: "Recommendations for setting up a Talos Linux cluster in production." +--- + +This document explains recommendations for running Talos Linux in production. + +## Acquire the installation image + +### Alternative Booting + +For network booting and self-built media, you can use the published kernel and initramfs images: + +- X86: [vmlinuz-amd64](https://github.com/siderolabs/talos/releases/download/{{< release >}}/vmlinuz-amd64) [initramfs-amd64.xz](https://github.com/siderolabs/talos/releases/download/{{< release >}}/initramfs-amd64.xz) +- ARM64: [vmlinuz-arm64](https://github.com/siderolabs/talos/releases/download/{{< release >}}/vmlinuz-arm64) [initramfs-arm64.xz](https://github.com/siderolabs/talos/releases/download/{{< release >}}/initramfs-arm64.xz) + +Note that to use alternate booting, there are a number of required kernel parameters. +Please see the [kernel]({{< relref "../reference/kernel" >}}) docs for more information. + +## Control plane nodes + +For a production, highly available Kubernetes cluster, it is recommended to use three control plane nodes. +Using five nodes can provide greater fault tolerance, but imposes more replication overhead and can result in worse performance. + +Boot all three control plane nodes at this point. +They will boot Talos Linux, and come up in maintenance mode, awaiting a configuration. + +## Decide the Kubernetes Endpoint + +The Kubernetes API Server endpoint, in order to be highly available, should be configured in a way that uses all available control plane nodes. +There are three common ways to do this: using a load-balancer, using Talos Linux's built in VIP functionality, or using multiple DNS records. + +### Dedicated Load-balancer + +If you are using a cloud provider or have your own load-balancer +(such as HAProxy, Nginx reverse proxy, or an F5 load-balancer), a dedicated load balancer is a natural choice. +Create an appropriate frontend for the endpoint, listening on TCP port 6443, and point the backends at the addresses of each of the Talos control plane nodes. +Your Kubernetes endpoint will be the IP address or DNS name of the load balancer front end, with the port appended (e.g. https://myK8s.mydomain.io:6443). + +> Note: an HTTP load balancer can't be used, as Kubernetes API server does TLS termination and mutual TLS authentication. + +### Layer 2 VIP Shared IP + +Talos has integrated support for serving Kubernetes from a shared/virtual IP address. +This requires Layer 2 connectivity between control plane nodes. + +Choose an unused IP address on the same subnet as the control plane nodes for the VIP. +For instance, if your control plane node IPs are: + +- 192.168.0.10 +- 192.168.0.11 +- 192.168.0.12 + +you could choose the IP `192.168.0.15` as your VIP IP address. +(Make sure that `192.168.0.15` is not used by any other machine and is excluded from DHCP ranges.) + +Once chosen, form the full HTTPS URL from this IP: + +```url +https://192.168.0.15:6443 +``` + +If you create a DNS record for this IP, note you will need to use the IP address itself, not the DNS name, to configure the shared IP (`machine.network.interfaces[].vip.ip`) in the Talos configuration. + +After the machine configurations are generated, you will want to edit the `controlplane.yaml` file to activate the VIP: + +```yaml +machine: + network: + interfaces: + - interface: enp2s0 + dhcp: true + vip: + ip: 192.168.0.15 + +``` + +For more information about using a shared IP, see the related +[Guide]({{< relref "../talos-guides/network/vip" >}}) + +### DNS records + +Add multiple A or AAAA records (one for each control plane node) to a DNS name. + +For instance, you could add: + +```dns +kube.cluster1.mydomain.com IN A 192.168.0.10 +kube.cluster1.mydomain.com IN A 192.168.0.11 +kube.cluster1.mydomain.com IN A 192.168.0.12 +``` + +where the IP addresses are those of the control plane nodes. + +Then, your endpoint would be: + +```url +https://kube.cluster1.mydomain.com:6443 +``` + +## Load balancing the Talos API + +The `talosctl` tool provides built-in client-side load-balancing across control plane nodes, so usually you do not need to configure a load balancer for the Talos API. + +However, if the control plane nodes are *not* directly reachable from the workstation where you run `talosctl`, then configure a load balancer to forward TCP port 50000 to the control plane nodes. + +> Note: Because the Talos Linux API uses gRPC and mutual TLS, it cannot be proxied by a HTTP/S proxy, but only by a TCP load balancer. + +If you create a load balancer to forward the Talos API calls, the load balancer IP or hostname will be used as the `endpoint` for `talosctl`. + +Add the load balancer IP or hostname to the `.machine.certSANs` field of the machine configuration file. + +> Do *not* use Talos Linux's built in VIP function for accessing the Talos API. +> In the event of an error in `etcd`, the VIP will not function, and you will not be able to access the Talos API to recover. + +## Configure Talos + +In many installation methods, a configuration can be passed in on boot. + +For example, Talos can be booted with the `talos.config` kernel +argument set to an HTTP(s) URL from which it should receive its +configuration. +Where a PXE server is available, this is much more efficient than +manually configuring each node. +If you do use this method, note that Talos requires a number of other +kernel commandline parameters. +See [required kernel parameters]({{< relref "../reference/kernel" >}}). + +Similarly, if creating [EC2 kubernetes clusters]({{< relref "../talos-guides/install/cloud-platforms/aws/" >}}), the configuration file can be passed in as `--user-data` to the `aws ec2 run-instances` command. +See generally the [Installation Guide]({{< relref "../talos-guides/install" >}}) for the platform being deployed. + +### Separating out secrets + +When generating the configuration files for a Talos Linux cluster, it is recommended to start with generating a secrets bundle which should be saved in a secure location. +This bundle can be used to generate machine or client configurations at any time: + +```sh +talosctl gen secrets -o secrets.yaml +``` + +Now, we can generate the machine configuration for each node: + +```sh +talosctl gen config --with-secrets secrets.yaml +``` + +Here, `cluster-name` is an arbitrary name for the cluster, used +in your local client configuration as a label. +It should be unique in the configuration on your local workstation. + +The `cluster-endpoint` is the Kubernetes Endpoint you +selected from above. +This is the Kubernetes API URL, and it should be a complete URL, with `https://` +and port. +(The default port is `6443`, but you may have configured your load balancer to forward a different port.) +For example: + +```sh +$ talosctl gen config --with-secrets secrets.yaml my-cluster https://192.168.64.15:6443 +generating PKI and tokens +created controlplane.yaml +created worker.yaml +created talosconfig +``` + +### Customizing Machine Configuration + +The generated machine configuration provides sane defaults for most cases, but can be modified to fit specific needs. + +Some machine configuration options are available as flags for the `talosctl gen config` command, +for example setting a specific Kubernetes version: + +```sh +talosctl gen config --with-secrets secrets.yaml --kubernetes-version 1.25.4 my-cluster https://192.168.64.15:6443 +``` + +Other modifications are done with [machine configuration patches]({{< relref "../talos-guides/configuration/patching" >}}). +Machine configuration patches can be applied with `talosctl gen config` command: + +```sh +talosctl gen config --with-secrets secrets.yaml --config-patch-control-plane @cni.patch my-cluster https://192.168.64.15:6443 +``` + +> Note: `@cni.patch` means that the patch is read from a file named `cni.patch`. + +#### Machine Configs as Templates + +Individual machines may need different settings: for instance, each may have a +different [static IP address]({{< relref "../advanced/advanced-networking/#static-addressing" >}}). + +When different files are needed for machines of the same type, there are two supported flows: + +1. Use the `talosctl gen config` command to generate a template, and then patch + the template for each machine with `talosctl machineconfig patch`. +2. Generate each machine configuration file separately with `talosctl gen config` while applying patches. + +For example, given a machine configuration patch which sets the static machine hostname: + +```yaml +# worker1.patch +machine: + network: + hostname: worker1 +``` + +Either of the following commands will generate a worker machine configuration file with the hostname set to `worker1`: + +```bash +$ talosctl gen config --with-secrets secrets.yaml my-cluster https://192.168.64.15:6443 +created /Users/taloswork/controlplane.yaml +created /Users/taloswork/worker.yaml +created /Users/taloswork/talosconfig +$ talosctl machineconfig patch worker.yaml --patch @worker1.patch --output worker1.yaml +``` + +```sh +talosctl gen config --with-secrets secrets.yaml --config-patch-worker @worker1.patch --output-types worker -o worker1.yaml my-cluster https://192.168.64.15:6443 +``` + +### Apply Configuration while validating the node identity + +If you have console access you can extract the server certificate fingerprint and use it for an additional layer of validation: + +```sh + talosctl apply-config --insecure \ + --nodes 192.168.0.2 \ + --cert-fingerprint xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= \ + --file cp0.yaml +``` + +Using the fingerprint allows you to be sure you are sending the configuration to the correct machine, but is completely optional. +After the configuration is applied to a node, it will reboot. +Repeat this process for each of the nodes in your cluster. + +## Further details about talosctl, endpoints and nodes + +### Endpoints + +When passed multiple endpoints, `talosctl` will automatically load balance requests to, and fail over between, all endpoints. + +You can pass in `--endpoints ,` as a comma separated list of IP/DNS addresses to the current `talosctl` command. +You can also set the `endpoints` in your `talosconfig`, by calling `talosctl config endpoint `. +Note: these are space separated, not comma separated. + +As an example, if the IP addresses of our control plane nodes are: + +- 192.168.0.2 +- 192.168.0.3 +- 192.168.0.4 + +We would set those in the `talosconfig` with: + +```sh + talosctl --talosconfig=./talosconfig \ + config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 +``` + +### Nodes + +The node is the target you wish to perform the API call on. + +It is possible to set a default set of nodes in the `talosconfig` file, but our recommendation is to explicitly pass in the node or nodes to be operated on with each `talosctl` command. +For a more in-depth discussion of Endpoints and Nodes, please see [talosctl]({{< relref "../learn-more/talosctl" >}}). + +### Default configuration file + +You can reference which configuration file to use directly with the `--talosconfig` parameter: + +```sh + talosctl --talosconfig=./talosconfig \ + --nodes 192.168.0.2 version +``` + +However, `talosctl` comes with tooling to help you integrate and merge this configuration into the default `talosctl` configuration file. +This is done with the `merge` option. + +```sh + talosctl config merge ./talosconfig +``` + +This will merge your new `talosconfig` into the default configuration file (`$XDG_CONFIG_HOME/talos/config.yaml`), creating it if necessary. +Like Kubernetes, the `talosconfig` configuration files has multiple "contexts" which correspond to multiple clusters. +The `` you chose above will be used as the context name. + +## Kubernetes Bootstrap + +Bootstrapping your Kubernetes cluster by simply calling the `bootstrap` command against any of your control plane nodes (or the loadbalancer, if used for the Talos API endpoint).: + +```sh + talosctl bootstrap --nodes 192.168.0.2 +``` + +>The bootstrap operation should only be called **ONCE** and only on a **SINGLE** control plane node! + +At this point, Talos will form an `etcd` cluster, generate all of the core Kubernetes assets, and start the Kubernetes control plane components. + +After a few moments, you will be able to download your Kubernetes client configuration and get started: + +```sh + talosctl kubeconfig +``` + +Running this command will add (merge) you new cluster into your local Kubernetes configuration. + +If you would prefer the configuration to *not* be merged into your default Kubernetes configuration file, pass in a filename: + +```sh + talosctl kubeconfig alternative-kubeconfig +``` + +You should now be able to connect to Kubernetes and see your nodes: + +```sh + kubectl get nodes +``` + +And use talosctl to explore your cluster: + +```sh + talosctl -n dashboard +``` + +For a list of all the commands and operations that `talosctl` provides, see the [CLI reference]({{< relref "../reference/cli/#talosctl" >}}). diff --git a/website/content/v1.6/introduction/quickstart.md b/website/content/v1.6/introduction/quickstart.md new file mode 100644 index 0000000000..3ccfbb8460 --- /dev/null +++ b/website/content/v1.6/introduction/quickstart.md @@ -0,0 +1,54 @@ +--- +title: Quickstart +weight: 20 +description: "A short guide on setting up a simple Talos Linux cluster locally with Docker." +--- + +## Local Docker Cluster + +The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. + +### Prerequisites + +#### `talosctl` + +Download `talosctl`: + +```bash +curl -sL https://talos.dev/install | sh +``` + +#### `kubectl` + +Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). + +### Create the Cluster + +Now run the following: + +```bash +talosctl cluster create +``` + +You can explore using Talos API commands: + +```bash +talosctl dashboard --nodes 10.5.0.2 +``` + +Verify that you can reach Kubernetes: + +```bash +$ kubectl get nodes -o wide +NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME +talos-default-controlplane-1 Ready master 115s v{{< k8s_release >}} 10.5.0.2 Talos ({{< release >}}) containerd://1.5.5 +talos-default-worker-1 Ready 115s v{{< k8s_release >}} 10.5.0.3 Talos ({{< release >}}) containerd://1.5.5 +``` + +### Destroy the Cluster + +When you are all done, remove the cluster: + +```bash +talosctl cluster destroy +``` diff --git a/website/content/v1.6/introduction/support-matrix.md b/website/content/v1.6/introduction/support-matrix.md new file mode 100644 index 0000000000..c140b23f75 --- /dev/null +++ b/website/content/v1.6/introduction/support-matrix.md @@ -0,0 +1,52 @@ +--- +title: Support Matrix +weight: 60 +description: "Table of supported Talos Linux versions and respective platforms." +--- + +| Talos Version | 1.6 | 1.5 | +|----------------------------------------------------------------------------------------------------------------|------------------------------------|------------------------------------| +| Release Date | 2023-12-15 (TBD) | 2023-08-17 (1.5.0) | +| End of Community Support | 1.7.0 release (2024-03-15, TBD) | 1.6.0 release (2023-12-15) | +| Enterprise Support | [offered by Sidero Labs Inc.](https://www.siderolabs.com/support/) | [offered by Sidero Labs Inc.](https://www.siderolabs.com/support/) | +| Kubernetes | 1.29, 1.28, 1.27 | 1.28, 1.27, 1.26 | +| Architecture | amd64, arm64 | amd64, arm64 | +| **Platforms** | | | +| - cloud | AWS, GCP, Azure, Digital Ocean, Exoscale, Hetzner, OpenStack, Oracle Cloud, Scaleway, Vultr, Upcloud | AWS, GCP, Azure, Digital Ocean, Exoscale, Hetzner, OpenStack, Oracle Cloud, Scaleway, Vultr, Upcloud | +| - bare metal | x86: BIOS, UEFI, SecureBoot; arm64: UEFI, SecureBoot; boot: ISO, PXE, disk image | x86: BIOS, UEFI; arm64: UEFI; boot: ISO, PXE, disk image | +| - virtualized | VMware, Hyper-V, KVM, Proxmox, Xen | VMware, Hyper-V, KVM, Proxmox, Xen | +| - SBCs | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Nano Pi R4S, Pine64, Pine64 Rock64, Radxa ROCK Pi 4c, Raspberry Pi 4B, Raspberry Pi Compute Module 4 | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Nano Pi R4S, Pine64, Pine64 Rock64, Radxa ROCK Pi 4c, Raspberry Pi 4B, Raspberry Pi Compute Module 4 | +| - local | Docker, QEMU | Docker, QEMU | +| **Cluster API** | | | +| [CAPI Bootstrap Provider Talos](https://github.com/siderolabs/cluster-api-bootstrap-provider-talos) | >= 0.6.2 | >= 0.6.1 | +| [CAPI Control Plane Provider Talos](https://github.com/siderolabs/cluster-api-control-plane-provider-talos) | >= 0.5.3 | >= 0.5.2 | +| [Sidero](https://www.sidero.dev/) | >= 0.6.0 | >= 0.6.0 | + +## Platform Tiers + +* Tier 1: Automated tests, high-priority fixes. +* Tier 2: Tested from time to time, medium-priority bugfixes. +* Tier 3: Not tested by core Talos team, community tested. + +### Tier 1 + +* Metal +* AWS +* GCP + +### Tier 2 + +* Azure +* Digital Ocean +* OpenStack +* VMWare + +### Tier 3 + +* Exoscale +* Hetzner +* nocloud +* Oracle Cloud +* Scaleway +* Vultr +* Upcloud diff --git a/website/content/v1.6/introduction/system-requirements.md b/website/content/v1.6/introduction/system-requirements.md new file mode 100644 index 0000000000..dbd43933d0 --- /dev/null +++ b/website/content/v1.6/introduction/system-requirements.md @@ -0,0 +1,71 @@ +--- +title: System Requirements +weight: 40 +description: "Hardware requirements for running Talos Linux." +--- + +## Minimum Requirements + + + + + + + + + + + + + + + + + + + + + + + + +
RoleMemoryCoresSystem Disk
Control Plane2 GiB210 GiB
Worker1 GiB110 GiB
+ +## Recommended + + + + + + + + + + + + + + + + + + + + + + + + +
RoleMemoryCoresSystem Disk
Control Plane4 GiB4100 GiB
Worker2 GiB2100 GiB
+ +These requirements are similar to that of Kubernetes. + +## Storage + +Talos Linux itself only requires less than 100 MB of disk space, but the EPHEMERAL partition is used to store pulled images, container work directories, and so on. +Thus a minimum is 10 GiB of disk space is required. +100 GiB is desired. +Note, however, that because Talos Linux assumes complete control of the disk it is installed on, so that it can control the partition table for image based upgrades, you cannot partition the rest of the disk for use by workloads. + +Thus it is recommended to install Talos Linux on a small, dedicated disk - using a Terabyte sized SSD for the Talos install disk would be wasteful. +Sidero Labs recommends having separate disks (apart from the Talos install disk) to be used for storage. diff --git a/website/content/v1.6/introduction/what-is-new/index.md b/website/content/v1.6/introduction/what-is-new/index.md new file mode 100644 index 0000000000..989b1e5b0d --- /dev/null +++ b/website/content/v1.6/introduction/what-is-new/index.md @@ -0,0 +1,9 @@ +--- +title: What's New in Talos 1.6 +weight: 50 +description: "List of new and shiny features in Talos Linux." +--- + +See also [upgrade notes]({{< relref "../../talos-guides/upgrading-talos/">}}) for important changes. + +TBD diff --git a/website/content/v1.6/introduction/what-is-talos.md b/website/content/v1.6/introduction/what-is-talos.md new file mode 100644 index 0000000000..d0b047d99a --- /dev/null +++ b/website/content/v1.6/introduction/what-is-talos.md @@ -0,0 +1,28 @@ +--- +title: What is Talos? +weight: 10 +description: "A quick introduction in to what Talos is and why it should be used." +--- + +Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. +Designed to be as minimal as possible while still maintaining practicality. +For these reasons, Talos has a number of features unique to it: + +- it is immutable +- it is atomic +- it is ephemeral +- it is minimal +- it is secure by default +- it is managed via a single declarative configuration file and gRPC API + +Talos can be deployed on container, cloud, virtualized, and bare metal platforms. + +## Why Talos + +In having less, Talos offers more. +Security. +Efficiency. +Resiliency. +Consistency. + +All of these areas are improved simply by having less. diff --git a/website/content/v1.6/kubernetes-guides/_index.md b/website/content/v1.6/kubernetes-guides/_index.md new file mode 100644 index 0000000000..1c9c43e365 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/_index.md @@ -0,0 +1,5 @@ +--- +title: "Kubernetes Guides" +weight: 30 +description: "Management of a Kubernetes Cluster hosted by Talos Linux" +--- diff --git a/website/content/v1.6/kubernetes-guides/configuration/_index.md b/website/content/v1.6/kubernetes-guides/configuration/_index.md new file mode 100644 index 0000000000..d449412722 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/_index.md @@ -0,0 +1,5 @@ +--- +title: "Configuration" +weight: 10 +description: "How to configure components of the Kubernetes cluster itself." +--- diff --git a/website/content/v1.6/kubernetes-guides/configuration/ceph-with-rook.md b/website/content/v1.6/kubernetes-guides/configuration/ceph-with-rook.md new file mode 100644 index 0000000000..2e27232f5b --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/ceph-with-rook.md @@ -0,0 +1,281 @@ +--- +title: "Ceph Storage cluster with Rook" +description: "Guide on how to create a simple Ceph storage cluster with Rook for Kubernetes" +aliases: + - ../../guides/configuring-ceph-with-rook +--- + +## Preparation + +Talos Linux reserves an entire disk for the OS installation, so machines with multiple available disks are needed for a reliable Ceph cluster with Rook and Talos Linux. +Rook requires that the block devices or partitions used by Ceph have no partitions or formatted filesystems before use. +Rook also requires a minimum Kubernetes version of `v1.16` and Helm `v3.0` for installation of charts. +It is highly recommended that the [Rook Ceph overview](https://rook.io/docs/rook/v1.8/ceph-storage.html) is read and understood before deploying a Ceph cluster with Rook. + +## Installation + +Creating a Ceph cluster with Rook requires two steps; first the Rook Operator needs to be installed which can be done with a Helm Chart. +The example below installs the Rook Operator into the `rook-ceph` namespace, which is the default for a Ceph cluster with Rook. + +```shell +$ helm repo add rook-release https://charts.rook.io/release +"rook-release" has been added to your repositories + +$ helm install --create-namespace --namespace rook-ceph rook-ceph rook-release/rook-ceph +W0327 17:52:44.277830 54987 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ +W0327 17:52:44.612243 54987 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ +NAME: rook-ceph +LAST DEPLOYED: Sun Mar 27 17:52:42 2022 +NAMESPACE: rook-ceph +STATUS: deployed +REVISION: 1 +TEST SUITE: None +NOTES: +The Rook Operator has been installed. Check its status by running: + kubectl --namespace rook-ceph get pods -l "app=rook-ceph-operator" + +Visit https://rook.io/docs/rook/latest for instructions on how to create and configure Rook clusters + +Important Notes: +- You must customize the 'CephCluster' resource in the sample manifests for your cluster. +- Each CephCluster must be deployed to its own namespace, the samples use `rook-ceph` for the namespace. +- The sample manifests assume you also installed the rook-ceph operator in the `rook-ceph` namespace. +- The helm chart includes all the RBAC required to create a CephCluster CRD in the same namespace. +- Any disk devices you add to the cluster in the 'CephCluster' must be empty (no filesystem and no partitions). +``` + +Once that is complete, the Ceph cluster can be installed with the official Helm Chart. +The Chart can be installed with default values, which will attempt to use all nodes in the Kubernetes cluster, and all unused disks on each node for Ceph storage, and make available block storage, object storage, as well as a shared filesystem. +Generally more specific node/device/cluster configuration is used, and the [Rook documentation](https://rook.io/docs/rook/v1.8/ceph-cluster-crd.html) explains all the available options in detail. +For this example the defaults will be adequate. + +```shell +$ helm install --create-namespace --namespace rook-ceph rook-ceph-cluster --set operatorNamespace=rook-ceph rook-release/rook-ceph-cluster +NAME: rook-ceph-cluster +LAST DEPLOYED: Sun Mar 27 18:12:46 2022 +NAMESPACE: rook-ceph +STATUS: deployed +REVISION: 1 +TEST SUITE: None +NOTES: +The Ceph Cluster has been installed. Check its status by running: + kubectl --namespace rook-ceph get cephcluster + +Visit https://rook.github.io/docs/rook/latest/ceph-cluster-crd.html for more information about the Ceph CRD. + +Important Notes: +- You can only deploy a single cluster per namespace +- If you wish to delete this cluster and start fresh, you will also have to wipe the OSD disks using `sfdisk` +``` + +Now the Ceph cluster configuration has been created, the Rook operator needs time to install the Ceph cluster and bring all the components online. +The progression of the Ceph cluster state can be followed with the following command. + +```shell +$ watch kubectl --namespace rook-ceph get cephcluster rook-ceph +Every 2.0s: kubectl --namespace rook-ceph get cephcluster rook-ceph + +NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL +rook-ceph /var/lib/rook 3 57s Progressing Configuring Ceph Mons +``` + +Depending on the size of the Ceph cluster and the availability of resources the Ceph cluster should become available, and with it the storage classes that can be used with Kubernetes Physical Volumes. + +```shell +$ kubectl --namespace rook-ceph get cephcluster rook-ceph +NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL +rook-ceph /var/lib/rook 3 40m Ready Cluster created successfully HEALTH_OK + +$ kubectl get storageclass +NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE +ceph-block (default) rook-ceph.rbd.csi.ceph.com Delete Immediate true 77m +ceph-bucket rook-ceph.ceph.rook.io/bucket Delete Immediate false 77m +ceph-filesystem rook-ceph.cephfs.csi.ceph.com Delete Immediate true 77m +``` + +## Talos Linux Considerations + +It is important to note that a Rook Ceph cluster saves cluster information directly onto the node (by default `dataDirHostPath` is set to `/var/lib/rook`). +If running only a single `mon` instance, cluster management is little bit more involved, as any time a Talos Linux node is reconfigured or upgraded, the partition that stores the `/var` [file system]({{< relref "../../learn-more/architecture#the-file-system" >}}) is wiped, but the `--preserve` option of [`talosctl upgrade`]({{< relref "../../reference/cli#talosctl-upgrade" >}}) will ensure that doesn't happen. + +By default, Rook configues Ceph to have 3 `mon` instances, in which case the data stored in `dataDirHostPath` can be regenerated from the other `mon` instances. +So when performing maintenance on a Talos Linux node with a Rook Ceph cluster (e.g. upgrading the Talos Linux version), it is imperative that care be taken to maintain the health of the Ceph cluster. +Before upgrading, you should always check the health status of the Ceph cluster to ensure that it is healthy. + +```shell +$ kubectl --namespace rook-ceph get cephclusters.ceph.rook.io rook-ceph +NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL +rook-ceph /var/lib/rook 3 98m Ready Cluster created successfully HEALTH_OK +``` + +If it is, you can begin the upgrade process for the Talos Linux node, during which time the Ceph cluster will become unhealthy as the node is reconfigured. +Before performing any other action on the Talos Linux nodes, the Ceph cluster must return to a healthy status. + +```shell +$ talosctl upgrade --nodes 172.20.15.5 --image ghcr.io/talos-systems/installer:v0.14.3 +NODE ACK STARTED +172.20.15.5 Upgrade request received 2022-03-27 20:29:55.292432887 +0200 CEST m=+10.050399758 + +$ kubectl --namespace rook-ceph get cephclusters.ceph.rook.io +NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL +rook-ceph /var/lib/rook 3 99m Progressing Configuring Ceph Mgr(s) HEALTH_WARN + +$ kubectl --namespace rook-ceph wait --timeout=1800s --for=jsonpath='{.status.ceph.health}=HEALTH_OK' rook-ceph +cephcluster.ceph.rook.io/rook-ceph condition met +``` + +The above steps need to be performed for each Talos Linux node undergoing maintenance, one at a time. + +## Cleaning Up + +### Rook Ceph Cluster Removal + +Removing a Rook Ceph cluster requires a few steps, starting with signalling to Rook that the Ceph cluster is really being destroyed. +Then all Persistent Volumes (and Claims) backed by the Ceph cluster must be deleted, followed by the Storage Classes and the Ceph storage types. + +```shell +$ kubectl --namespace rook-ceph patch cephcluster rook-ceph --type merge -p '{"spec":{"cleanupPolicy":{"confirmation":"yes-really-destroy-data"}}}' +cephcluster.ceph.rook.io/rook-ceph patched + +$ kubectl delete storageclasses ceph-block ceph-bucket ceph-filesystem +storageclass.storage.k8s.io "ceph-block" deleted +storageclass.storage.k8s.io "ceph-bucket" deleted +storageclass.storage.k8s.io "ceph-filesystem" deleted + +$ kubectl --namespace rook-ceph delete cephblockpools ceph-blockpool +cephblockpool.ceph.rook.io "ceph-blockpool" deleted + +$ kubectl --namespace rook-ceph delete cephobjectstore ceph-objectstore +cephobjectstore.ceph.rook.io "ceph-objectstore" deleted + +$ kubectl --namespace rook-ceph delete cephfilesystem ceph-filesystem +cephfilesystem.ceph.rook.io "ceph-filesystem" deleted +``` + +Once that is complete, the Ceph cluster itself can be removed, along with the Rook Ceph cluster Helm chart installation. + +```shell +$ kubectl --namespace rook-ceph delete cephcluster rook-ceph +cephcluster.ceph.rook.io "rook-ceph" deleted + +$ helm --namespace rook-ceph uninstall rook-ceph-cluster +release "rook-ceph-cluster" uninstalled +``` + +If needed, the Rook Operator can also be removed along with all the Custom Resource Definitions that it created. + +```shell +$ helm --namespace rook-ceph uninstall rook-ceph +W0328 12:41:14.998307 147203 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ +These resources were kept due to the resource policy: +[CustomResourceDefinition] cephblockpools.ceph.rook.io +[CustomResourceDefinition] cephbucketnotifications.ceph.rook.io +[CustomResourceDefinition] cephbuckettopics.ceph.rook.io +[CustomResourceDefinition] cephclients.ceph.rook.io +[CustomResourceDefinition] cephclusters.ceph.rook.io +[CustomResourceDefinition] cephfilesystemmirrors.ceph.rook.io +[CustomResourceDefinition] cephfilesystems.ceph.rook.io +[CustomResourceDefinition] cephfilesystemsubvolumegroups.ceph.rook.io +[CustomResourceDefinition] cephnfses.ceph.rook.io +[CustomResourceDefinition] cephobjectrealms.ceph.rook.io +[CustomResourceDefinition] cephobjectstores.ceph.rook.io +[CustomResourceDefinition] cephobjectstoreusers.ceph.rook.io +[CustomResourceDefinition] cephobjectzonegroups.ceph.rook.io +[CustomResourceDefinition] cephobjectzones.ceph.rook.io +[CustomResourceDefinition] cephrbdmirrors.ceph.rook.io +[CustomResourceDefinition] objectbucketclaims.objectbucket.io +[CustomResourceDefinition] objectbuckets.objectbucket.io + +release "rook-ceph" uninstalled + +$ kubectl delete crds cephblockpools.ceph.rook.io cephbucketnotifications.ceph.rook.io cephbuckettopics.ceph.rook.io \ + cephclients.ceph.rook.io cephclusters.ceph.rook.io cephfilesystemmirrors.ceph.rook.io \ + cephfilesystems.ceph.rook.io cephfilesystemsubvolumegroups.ceph.rook.io \ + cephnfses.ceph.rook.io cephobjectrealms.ceph.rook.io cephobjectstores.ceph.rook.io \ + cephobjectstoreusers.ceph.rook.io cephobjectzonegroups.ceph.rook.io cephobjectzones.ceph.rook.io \ + cephrbdmirrors.ceph.rook.io objectbucketclaims.objectbucket.io objectbuckets.objectbucket.io +customresourcedefinition.apiextensions.k8s.io "cephblockpools.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephbucketnotifications.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephbuckettopics.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephclients.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephclusters.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephfilesystemmirrors.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephfilesystems.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephfilesystemsubvolumegroups.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephnfses.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectrealms.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectstores.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectstoreusers.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectzonegroups.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephobjectzones.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "cephrbdmirrors.ceph.rook.io" deleted +customresourcedefinition.apiextensions.k8s.io "objectbucketclaims.objectbucket.io" deleted +customresourcedefinition.apiextensions.k8s.io "objectbuckets.objectbucket.io" deleted +``` + +### Talos Linux Rook Metadata Removal + +If the Rook Operator is cleanly removed following the above process, the node metadata and disks should be clean and ready to be re-used. +In the case of an unclean cluster removal, there may be still a few instances of metadata stored on the system disk, as well as the partition information on the storage disks. +First the node metadata needs to be removed, make sure to update the `nodeName` with the actual name of a storage node that needs cleaning, and `path` with the Rook configuration `dataDirHostPath` set when installing the chart. +The following will need to be repeated for each node used in the Rook Ceph cluster. + +```shell +$ cat < + volumes: + - name: rook-data-dir + hostPath: + path: + containers: + - name: disk-clean + image: busybox + securityContext: + privileged: true + volumeMounts: + - name: rook-data-dir + mountPath: /node/rook-data + command: ["/bin/sh", "-c", "rm -rf /node/rook-data/*"] +EOF +pod/disk-clean created + +$ kubectl wait --timeout=900s --for=jsonpath='{.status.phase}=Succeeded' pod disk-clean +pod/disk-clean condition met + +$ kubectl delete pod disk-clean +pod "disk-clean" deleted +``` + +Lastly, the disks themselves need the partition and filesystem data wiped before they can be reused. +Again, the following as to be repeated for each node **and** disk used in the Rook Ceph cluster, updating `nodeName` and `of=` in the `command` as needed. + +```shell +$ cat < + containers: + - name: disk-wipe + image: busybox + securityContext: + privileged: true + command: ["/bin/sh", "-c", "dd if=/dev/zero bs=1M count=100 oflag=direct of="] +EOF +pod/disk-wipe created + +$ kubectl wait --timeout=900s --for=jsonpath='{.status.phase}=Succeeded' pod disk-wipe +pod/disk-wipe condition met + +$ kubectl delete pod disk-clean +pod "disk-wipe" deleted +``` diff --git a/website/content/v1.6/kubernetes-guides/configuration/cluster-endpoint.md b/website/content/v1.6/kubernetes-guides/configuration/cluster-endpoint.md new file mode 100644 index 0000000000..2abc8147ab --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/cluster-endpoint.md @@ -0,0 +1,47 @@ +--- +title: "Cluster Endpoint" +description: "How to explicitly set up an endpoint for the cluster API" +alises: + - ../../guides/configuring-the-cluster-endpoint +--- + +In this section, we will step through the configuration of a Talos based Kubernetes cluster. +There are three major components we will configure: + +- `apid` and `talosctl` +- the controlplane nodes +- the worker nodes + +Talos enforces a high level of security by using mutual TLS for authentication and authorization. + +We recommend that the configuration of Talos be performed by a cluster owner. +A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. +They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. + +### Recommended settings + +Talos runs great out of the box, but if you tweak some minor settings it will make your life +a lot easier in the future. +This is not a requirement, but rather a document to explain some key settings. + +#### Endpoint + +To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. +This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip address to the hostname configuration. +The configuration can either be done on a Loadbalancer, or simply trough DNS. + +For example: + +> This is in the config file for the cluster e.g. controlplane.yaml and worker.yaml. +> for more details, please see: [v1alpha1 endpoint configuration]({{< relref "../../reference/configuration#controlplaneconfig" >}}) + +```yaml +..... +cluster: + controlPlane: + endpoint: https://endpoint.example.local:6443 +..... +``` + +If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) +Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v1.6/kubernetes-guides/configuration/deploy-metrics-server.md b/website/content/v1.6/kubernetes-guides/configuration/deploy-metrics-server.md new file mode 100644 index 0000000000..59986d4236 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/deploy-metrics-server.md @@ -0,0 +1,45 @@ +--- +title: "Deploying Metrics Server" +description: "In this guide you will learn how to set up metrics-server." +aliases: + - ../../guides/deploy-metrics-server +--- + +Metrics Server enables use of the [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and [Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler). +It does this by gathering metrics data from the kubelets in a cluster. +By default, the certificates in use by the kubelets will not be recognized by metrics-server. +This can be solved by either configuring metrics-server to do no validation of the TLS certificates, or by modifying the kubelet configuration to rotate its certificates and use ones that will be recognized by metrics-server. + +## Node Configuration + +To enable kubelet certificate rotation, all nodes should have the following Machine Config snippet: + +```yaml +machine: + kubelet: + extraArgs: + rotate-server-certificates: true +``` + +## Install During Bootstrap + +We will want to ensure that new certificates for the kubelets are approved automatically. +This can easily be done with the [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver), which will automatically approve the Certificate Signing Requests generated by the kubelets. + +We can have Kubelet Serving Certificate Approver and metrics-server installed on the cluster automatically during bootstrap by adding the following snippet to the Cluster Config of the node that will be handling the bootstrap process: + +```yaml +cluster: + extraManifests: + - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml + - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml +``` + +## Install After Bootstrap + +If you choose not to use `extraManifests` to install Kubelet Serving Certificate Approver and metrics-server during bootstrap, you can install them once the cluster is online using `kubectl`: + +```sh +kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml +kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml +``` diff --git a/website/content/v1.6/kubernetes-guides/configuration/kubeprism.md b/website/content/v1.6/kubernetes-guides/configuration/kubeprism.md new file mode 100644 index 0000000000..1130b2bc6e --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/kubeprism.md @@ -0,0 +1,55 @@ +--- +title: "KubePrism" +description: "Enabling in-cluster highly-available controlplane endpoint." +--- + +Kubernetes pods running in CNI mode can use the `kubernetes.default.svc` service endpoint to access the Kubernetes API server, +while pods running in host networking mode can only use the external cluster endpoint to access the Kubernetes API server. + +Kubernetes controlplane components run in host networking mode, and it is critical for them to be able to access the Kubernetes API server, +same as CNI components (when CNI requires access to Kubernetes API). + +The external cluster endpoint might be unavailable due to misconfiguration or network issues, or it might have higher latency than the internal endpoint. +A failure to access the Kubernetes API server might cause a series of issues in the cluster: pods are not scheduled, service IPs stop working, etc. + +KubePrism feature solves this problem by enabling in-cluster highly-available controlplane endpoint on every node in the cluster. + +## Enabling KubePrism + +> As of Talos 1.5, KubePrism is not enabled by default. + +To enable KubePrism, apply the following machine config patch either during the machine config generation, or to a running cluster (the patch should be applied to all nodes): + +```yaml +machine: + features: + kubeprism: + enabled: true + port: 7445 +``` + +> Note: the `port` specified should be available on every node in the cluster. + +## How it works + +Talos spins up a TCP loadbalancer on every machine on the `localhost` on the specified port which automatically picks up one of the endpoints: + +* the external cluster endpoint as specified in the machine configuration +* for controlplane machines: `https://localhost:` (`http://localhost:6443` in the default configuration) +* `https://:` for every controlplane machine (based on the information from [Cluster Discovery]({{< relref "../../talos-guides/discovery" >}})) + +KubePrism automatically filters out unhealthy (or unreachable) endpoints, and prefers lower-latency endpoints over higher-latency endpoints. + +Talos automatically reconfigures `kubelet`, `kube-scheduler` and `kube-controller-manager` to use the KubePrism endpoint. +The `kube-proxy` manifest is also reconfigured to use the KubePrism endpoint by default, but when enabling KubePrism for a running cluster the manifest should be updated +with `talosctl upgrade-k8s` command. + +When using CNI components that require access to the Kubernetes API server, the KubePrism endpoint should be passed to the CNI configuration (e.g. Cilium, Calico CNIs). + +## Notes + +As the list of endpoints for KubePrism includes the external cluster endpoint, KubePrism in the worst case scenario will behave the same as the external cluster endpoint. +For controlplane nodes, the KubePrism should pick up the `localhost` endpoint of the `kube-apiserver`, minimizing the latency. +Worker nodes might use direct address of the controlplane endpoint if the latency is lower than the latency of the external cluster endpoint. + +KubePrism listen endpoint is bound to `localhost` address, so it can't be used outside the cluster. diff --git a/website/content/v1.6/kubernetes-guides/configuration/pod-security.md b/website/content/v1.6/kubernetes-guides/configuration/pod-security.md new file mode 100644 index 0000000000..4c7b3749a9 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/pod-security.md @@ -0,0 +1,170 @@ +--- +title: "Pod Security" +description: "Enabling Pod Security Admission plugin to configure Pod Security Standards." +aliases: + - ../../guides/pod-security +--- + +Kubernetes deprecated [Pod Security Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) as of v1.21, and it is +going to be removed in v1.25. +Pod Security Policy was replaced with [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/). +Pod Security Admission is alpha in v1.22 (requires a feature gate) and beta in v1.23 (enabled by default). + +In this guide we are going to enable and configure Pod Security Admission in Talos. + +## Configuration + +Talos provides default Pod Security Admission in the machine configuration: + +```yaml +apiVersion: pod-security.admission.config.k8s.io/v1alpha1 +kind: PodSecurityConfiguration +defaults: + enforce: "baseline" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" +exemptions: + usernames: [] + runtimeClasses: [] + namespaces: [kube-system] +``` + +This is a cluster-wide configuration for the Pod Security Admission plugin: + +* by default `baseline` [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/) profile is enforced +* more strict `restricted` profile is not enforced, but API server warns about found issues + +This default policy can be modified by updating the generated machine configuration before the cluster is created or on the fly by using the `talosctl` CLI utility. + +Verify current admission plugin configuration with: + +```shell +$ talosctl get admissioncontrolconfigs.kubernetes.talos.dev admission-control -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: AdmissionControlConfigs.kubernetes.talos.dev + id: admission-control + version: 1 + owner: config.K8sControlPlaneController + phase: running + created: 2022-02-22T20:28:21Z + updated: 2022-02-22T20:28:21Z +spec: + config: + - name: PodSecurity + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration +``` + +## Usage + +Create a deployment that satisfies the `baseline` policy but gives warnings on `restricted` policy: + +```shell +$ kubectl create deployment nginx --image=nginx +Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") +deployment.apps/nginx created +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-85b98978db-j68l8 1/1 Running 0 2m3s +``` + +Create a daemonset which fails to meet requirements of the `baseline` policy: + +```yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + labels: + app: debug-container + name: debug-container + namespace: default +spec: + revisionHistoryLimit: 10 + selector: + matchLabels: + app: debug-container + template: + metadata: + creationTimestamp: null + labels: + app: debug-container + spec: + containers: + - args: + - "360000" + command: + - /bin/sleep + image: ubuntu:latest + imagePullPolicy: IfNotPresent + name: debug-container + resources: {} + securityContext: + privileged: true + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + dnsPolicy: ClusterFirstWithHostNet + hostIPC: true + hostPID: true + hostNetwork: true + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + terminationGracePeriodSeconds: 30 + updateStrategy: + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + type: RollingUpdate +``` + +```shell +$ kubectl apply -f debug.yaml +Warning: would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true, hostPID=true, hostIPC=true), privileged (container "debug-container" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "debug-container" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "debug-container" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "debug-container" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "debug-container" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") +daemonset.apps/debug-container created +``` + +Daemonset `debug-container` gets created, but no pods are scheduled: + +```shell +$ kubectl get ds +NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE +debug-container 0 0 0 0 0 34s +``` + +Pod Security Admission plugin errors are in the daemonset events: + +```shell +$ kubectl describe ds debug-container +... + Warning FailedCreate 92s daemonset-controller Error creating: pods "debug-container-kwzdj" is forbidden: violates PodSecurity "baseline:latest": host namespaces (hostNetwork=true, hostPID=true, hostIPC=true), privileged (container "debug-container" must not set securityContext.privileged=true) +``` + +Pod Security Admission configuration can also be overridden on a namespace level: + +```shell +$ kubectl label ns default pod-security.kubernetes.io/enforce=privileged +namespace/default labeled +$ kubectl get ds +NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE +debug-container 2 2 0 2 0 4s +``` + +As enforce policy was updated to the `privileged` for the `default` namespace, `debug-container` is now successfully running. diff --git a/website/content/v1.6/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md b/website/content/v1.6/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md new file mode 100644 index 0000000000..43d06aaa9a --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md @@ -0,0 +1,214 @@ +--- +title: "Local Storage" +description: "Using local storage with OpenEBS Jiva" +aliases: + - ../../guides/storage +--- + +If you want to use replicated storage leveraging disk space from a local disk with Talos Linux installed, OpenEBS Jiva is a great option. +This requires installing the [iscsi-tools](https://github.com/orgs/siderolabs/packages?tab=packages&q=iscsi-tools) [system extension]({{< relref "../../talos-guides/configuration/system-extensions" >}}). + +Since OpenEBS Jiva is a replicated storage, it's recommended to have at least three nodes where sufficient local disk space is available. +The documentation will follow installing OpenEBS Jiva via the offical Helm chart. +Since Talos is different from standard Operating Systems, the OpenEBS components need a little tweaking after the Helm installation. +Refer to the OpenEBS Jiva [documentation](https://github.com/openebs/jiva-operator/blob/develop/docs/quickstart.md) if you need further customization. + +> NB: Also note that the Talos nodes need to be upgraded with `--preserve` set while running OpenEBS Jiva, otherwise you risk losing data. +> Even though it's possible to recover data from other replicas if the node is wiped during an upgrade, this can require extra operational knowledge to recover, so it's highly recommended to use `--preserve` to avoid data loss. + +## Preparing the nodes + +Create a machine config patch with the contents below and save as `patch.yaml` + +```yaml +- op: add + path: /machine/install/extensions + value: + - image: ghcr.io/siderolabs/iscsi-tools:{{< iscsi_tools_system_extension_release >}} +- op: add + path: /machine/kubelet/extraMounts + value: + - destination: /var/openebs/local + type: bind + source: /var/openebs/local + options: + - bind + - rshared + - rw +``` + +Apply the machine config to all the nodes using talosctl: + +```bash +talosctl -e -n patch mc -p @patch.yaml +``` + +To install the system extension, the node needs to be upgraded. +If there is no new release of Talos, the node can be upgraded to the same version as the existing Talos version. + +Run the following command on each nodes subsequently: + +```bash +talosctl -e -n upgrade --image=ghcr.io/siderolabs/installer:{{< release >}} +``` + +Once the node has upgraded and booted successfully the extension status can be verfied by running the following command: + +```bash +talosctl -e -n get extensions +``` + +An output similar to below can be observed: + +```text +NODE NAMESPACE TYPE ID VERSION NAME VERSION +192.168.20.61 runtime ExtensionStatus 000.ghcr.io-siderolabs-iscsi-tools-v0.1.1 1 iscsi-tools v0.1.1 +``` + +The service status can be checked by running the following command: + +```bash +talosctl -e -n services +``` + +You should see that the `ext-tgtd` and the `ext-iscsid` services are running. + +```text +NODE SERVICE STATE HEALTH LAST CHANGE LAST EVENT +192.168.20.51 apid Running OK 64h57m15s ago Health check successful +192.168.20.51 containerd Running OK 64h57m23s ago Health check successful +192.168.20.51 cri Running OK 64h57m20s ago Health check successful +192.168.20.51 etcd Running OK 64h55m29s ago Health check successful +192.168.20.51 ext-iscsid Running ? 64h57m19s ago Started task ext-iscsid (PID 4040) for container ext-iscsid +192.168.20.51 ext-tgtd Running ? 64h57m19s ago Started task ext-tgtd (PID 3999) for container ext-tgtd +192.168.20.51 kubelet Running OK 38h14m10s ago Health check successful +192.168.20.51 machined Running ? 64h57m29s ago Service started as goroutine +192.168.20.51 trustd Running OK 64h57m19s ago Health check successful +192.168.20.51 udevd Running OK 64h57m21s ago Health check successful + +``` + +## Install OpenEBS Jiva + +```bash +helm repo add openebs-jiva https://openebs.github.io/jiva-operator +helm repo update +helm upgrade --install --create-namespace --namespace openebs --version 3.2.0 openebs-jiva openebs-jiva/jiva +``` + +This will create a storage class named `openebs-jiva-csi-default` which can be used for workloads. +The storage class named `openebs-hostpath` is used by jiva to create persistent volumes backed by local storage and then used for replicated storage by the jiva controller. + +## Patching the Namespace + +when using the default Pod Security Admissions created by Talos you need the following labels on your namespace: + +```yaml + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/warn: privileged +``` + +or via kubectl: + +```bash +kubectl label ns openebs pod-security.kubernetes.io/audit=privileged pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=privileged +``` + +## Number of Replicas + +By Default Jiva uses 3 replicas if your cluster consists of lesser nodes consider setting `defaultPolicy.replicas` to the number of nodes in your cluster e.g. 2. + +## Patching the jiva installation + +Since Jiva assumes `iscisd` to be running natively on the host and not as a Talos [extension service]({{< relref "../../advanced/extension-services.md" >}}), we need to modify the CSI node daemonset to enable it to find the PID of the `iscsid` service. +The default config map used by Jiva also needs to be modified so that it can execute `iscsiadm` commands inside the PID namespace of the `iscsid` service. + +Start by creating a configmap definition named `config.yaml` as below: + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/managed-by: pulumi + name: openebs-jiva-csi-iscsiadm + namespace: openebs +data: + iscsiadm: | + #!/bin/sh + iscsid_pid=$(pgrep iscsid) + + nsenter --mount="/proc/${iscsid_pid}/ns/mnt" --net="/proc/${iscsid_pid}/ns/net" -- /usr/local/sbin/iscsiadm "$@" +``` + +Replace the existing config map with the above config map by running the following command: + +```bash +kubectl --namespace openebs apply --filename config.yaml +``` + +Now we need to update the jiva CSI daemonset to run with `hostPID: true` so it can find the PID of the `iscsid` service, by running the following command: + +```bash +kubectl --namespace openebs patch daemonset openebs-jiva-csi-node --type=json --patch '[{"op": "add", "path": "/spec/template/spec/hostPID", "value": true}]' +``` + +## Testing a simple workload + +In order to test the Jiva installation, let's first create a PVC referencing the `openebs-jiva-csi-default` storage class: + +```yaml +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: example-jiva-csi-pvc +spec: + storageClassName: openebs-jiva-csi-default + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 4Gi +``` + +and then create a deployment using the above PVC: + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fio +spec: + selector: + matchLabels: + name: fio + replicas: 1 + strategy: + type: Recreate + rollingUpdate: null + template: + metadata: + labels: + name: fio + spec: + containers: + - name: perfrunner + image: openebs/tests-fio + command: ["/bin/bash"] + args: ["-c", "while true ;do sleep 50; done"] + volumeMounts: + - mountPath: /datadir + name: fio-vol + volumes: + - name: fio-vol + persistentVolumeClaim: + claimName: example-jiva-csi-pvc +``` + +You can clean up the test resources by running the following command: + +```bash +kubectl delete deployment fio +kubectl delete pvc example-jiva-csi-pvc +``` diff --git a/website/content/v1.6/kubernetes-guides/configuration/seccomp-profiles.md b/website/content/v1.6/kubernetes-guides/configuration/seccomp-profiles.md new file mode 100644 index 0000000000..1cff21e509 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/seccomp-profiles.md @@ -0,0 +1,118 @@ +--- +title: "Seccomp Profiles" +description: "Using custom Seccomp Profiles with Kubernetes workloads." +aliases: + - ../../guides/pod-security +--- + +Seccomp stands for secure computing mode and has been a feature of the Linux kernel since version 2.6.12. +It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel. + +Refer the [Kubernetes Seccomp Guide](https://kubernetes.io/docs/tutorials/security/seccomp/) for more details. + +In this guide we are going to configure a custom Seccomp Profile that logs all syscalls made by the workload. + +## Preparing the nodes + +Create a machine config path with the contents below and save as `patch.yaml` + +```yaml +machine: + seccompProfiles: + - name: audit.json + value: + defaultAction: SCMP_ACT_LOG +``` + +Apply the machine config to all the nodes using talosctl: + +```bash +talosctl -e -n patch mc -p @patch.yaml +``` + +This would create a seccomp profile name `audit.json` on the node at `/var/lib/kubelet/seccomp/profiles`. + +The profiles can be used by Kubernetes pods by specfying the pod `securityContext` as below: + +```yaml +spec: + securityContext: + seccompProfile: + type: Localhost + localhostProfile: profiles/audit.json +``` + +> Note that the `localhostProfile` uses the name of the profile created under `profiles` directory. +> So make sure to use path as `profiles/` + +This can be verfied by running the below commands: + +```bash +talosctl -e -n get seccompprofiles +``` + +An output similar to below can be observed: + +```text +NODE NAMESPACE TYPE ID VERSION +10.5.0.3 cri SeccompProfile audit.json 1 +``` + +The content of the seccomp profile can be viewed by running the below command: + +```bash +talosctl -e -n read /var/lib/kubelet/seccomp/profiles/audit.json +``` + +An output similar to below can be observed: + +```text +{"defaultAction":"SCMP_ACT_LOG"} +``` + +## Create a Kubernetes workload that uses the custom Seccomp Profile + +Here we'll be using an example workload from the Kubernetes [documentation](https://kubernetes.io/docs/tutorials/security/seccomp/). + +First open up a second terminal and run the following talosctl command so that we can view the Syscalls being logged in realtime: + +```bash +talosctl -e -n dmesg --follow --tail +``` + +Now deploy the example workload from the Kubernetes documentation: + +```bash +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/audit-pod.yaml +``` + +Once the pod starts running the terminal running `talosctl dmesg` command from above should log similar to below: + +```text +10.5.0.3: kern: info: [2022-07-28T11:49:42.489473063Z]: cni0: port 1(veth32488a86) entered blocking state +10.5.0.3: kern: info: [2022-07-28T11:49:42.490852063Z]: cni0: port 1(veth32488a86) entered disabled state +10.5.0.3: kern: info: [2022-07-28T11:49:42.492470063Z]: device veth32488a86 entered promiscuous mode +10.5.0.3: kern: info: [2022-07-28T11:49:42.503105063Z]: IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready +10.5.0.3: kern: info: [2022-07-28T11:49:42.503944063Z]: IPv6: ADDRCONF(NETDEV_CHANGE): veth32488a86: link becomes ready +10.5.0.3: kern: info: [2022-07-28T11:49:42.504764063Z]: cni0: port 1(veth32488a86) entered blocking state +10.5.0.3: kern: info: [2022-07-28T11:49:42.505423063Z]: cni0: port 1(veth32488a86) entered forwarding state +10.5.0.3: kern: warning: [2022-07-28T11:49:44.873616063Z]: kauditd_printk_skb: 14 callbacks suppressed +10.5.0.3: kern: notice: [2022-07-28T11:49:44.873619063Z]: audit: type=1326 audit(1659008985.445:25): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.876609063Z]: audit: type=1326 audit(1659008985.445:26): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.878789063Z]: audit: type=1326 audit(1659008985.449:27): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=257 compat=0 ip=0x55ec0657bdaa code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.886693063Z]: audit: type=1326 audit(1659008985.461:28): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=202 compat=0 ip=0x55ec06532b43 code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.888764063Z]: audit: type=1326 audit(1659008985.461:29): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=202 compat=0 ip=0x55ec06532b43 code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.891009063Z]: audit: type=1326 audit(1659008985.461:30): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=1 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.893162063Z]: audit: type=1326 audit(1659008985.461:31): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.895365063Z]: audit: type=1326 audit(1659008985.461:32): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=39 compat=0 ip=0x55ec066eb68b code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.898306063Z]: audit: type=1326 audit(1659008985.461:33): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=59 compat=0 ip=0x55ec0657be16 code=0x7ffc0000 +10.5.0.3: kern: notice: [2022-07-28T11:49:44.901518063Z]: audit: type=1326 audit(1659008985.473:34): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=158 compat=0 ip=0x455f35 code=0x7ffc0000 +``` + +## Cleanup + +You can clean up the test resources by running the following command: + +```bash +kubectl delete pod audit-pod +``` diff --git a/website/content/v1.6/kubernetes-guides/configuration/storage.md b/website/content/v1.6/kubernetes-guides/configuration/storage.md new file mode 100644 index 0000000000..1bb80a6201 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/storage.md @@ -0,0 +1,196 @@ +--- +title: "Storage" +description: "Setting up storage for a Kubernetes cluster" +aliases: + - ../../guides/storage +--- + +In Kubernetes, using storage in the right way is well-facilitated by the API. +However, unless you are running in a major public cloud, that API may not be hooked up to anything. +This frequently sends users down a rabbit hole of researching all the various options for storage backends for their platform, for Kubernetes, and for their workloads. +There are a _lot_ of options out there, and it can be fairly bewildering. + +For Talos, we try to limit the options somewhat to make the decision-making easier. + +## Public Cloud + +If you are running on a major public cloud, use their block storage. +It is easy and automatic. + +## Storage Clusters + +> **Sidero Labs** recommends having separate disks (apart from the Talos install disk) to be used for storage. + +Redundancy, scaling capabilities, reliability, speed, maintenance load, and ease of use are all factors you must consider when managing your own storage. + +Running a storage cluster can be a very good choice when managing your own storage, and there are two projects we recommend, depending on your situation. + +If you need vast amounts of storage composed of more than a dozen or so disks, we recommend you use Rook to manage Ceph. +Also, if you need _both_ mount-once _and_ mount-many capabilities, Ceph is your answer. +Ceph also bundles in an S3-compatible object store. +The down side of Ceph is that there are a lot of moving parts. + +> Please note that _most_ people should _never_ use mount-many semantics. +> NFS is pervasive because it is old and easy, _not_ because it is a good idea. +> While it may seem like a convenience at first, there are all manner of locking, performance, change control, and reliability concerns inherent in _any_ mount-many situation, so we **strongly** recommend you avoid this method. + +If your storage needs are small enough to not need Ceph, use Mayastor. + +### Rook/Ceph + +[Ceph](https://ceph.io) is the grandfather of open source storage clusters. +It is big, has a lot of pieces, and will do just about anything. +It scales better than almost any other system out there, open source or proprietary, being able to easily add and remove storage over time with no downtime, safely and easily. +It comes bundled with RadosGW, an S3-compatible object store; CephFS, a NFS-like clustered filesystem; and RBD, a block storage system. + +With the help of [Rook](https://rook.io), the vast majority of the complexity of Ceph is hidden away by a very robust operator, allowing you to control almost everything about your Ceph cluster from fairly simple Kubernetes CRDs. + +So if Ceph is so great, why not use it for everything? + +Ceph can be rather slow for small clusters. +It relies heavily on CPUs and massive parallelisation to provide good cluster performance, so if you don't have much of those dedicated to Ceph, it is not going to be well-optimised for you. +Also, if your cluster is small, just running Ceph may eat up a significant amount of the resources you have available. + +Troubleshooting Ceph can be difficult if you do not understand its architecture. +There are lots of acronyms and the documentation assumes a fair level of knowledge. +There are very good tools for inspection and debugging, but this is still frequently seen as a concern. + +### Mayastor + +[Mayastor](https://github.com/openebs/Mayastor) is an OpenEBS project built in Rust utilising the modern NVMEoF system. +(Despite the name, Mayastor does _not_ require you to have NVME drives.) +It is fast and lean but still cluster-oriented and cloud native. +Unlike most of the other OpenEBS project, it is _not_ built on the ancient iSCSI system. + +Unlike Ceph, Mayastor is _just_ a block store. +It focuses on block storage and does it well. +It is much less complicated to set up than Ceph, but you probably wouldn't want to use it for more than a few dozen disks. + +Mayastor is new, maybe _too_ new. +If you're looking for something well-tested and battle-hardened, this is not it. +However, if you're looking for something lean, future-oriented, and simpler than Ceph, it might be a great choice. + +#### Video Walkthrough + +To see a live demo of this section, see the video below: + + + +#### Prep Nodes + +Either during initial cluster creation or on running worker nodes, several machine config values should be edited. +(This information is gathered from the Mayastor [documentation](https://mayastor.gitbook.io/introduction/quickstart/preparing-the-cluster).) +We need to set the `vm.nr_hugepages` sysctl and add `openebs.io/engine=mayastor` labels to the nodes which are meant to be storage nodes. +This can be done with `talosctl patch machineconfig` or via config patches during `talosctl gen config`. + +Some examples are shown below: modify as needed. + +First create a config patch file named `mayastor-patch.yaml` with the following contents: + +```yaml +- op: add + path: /machine/sysctls + value: + vm.nr_hugepages: "1024" +- op: add + path: /machine/nodeLabels + value: + openebs.io/engine: mayastor +``` + +Using gen config + +```bash +talosctl gen config my-cluster https://mycluster.local:6443 --config-patch @mayastor-patch.yaml +``` + +Patching an existing node + +```bash +talosctl patch --mode=no-reboot machineconfig -n --patch @mayastor-patch.yaml +``` + +> Note: If you are adding/updating the `vm.nr_hugepages` on a node which already had the `openebs.io/engine=mayastor` label set, you'd need to restart kubelet so that it picks up the new value, by issuing the following command + +```bash +talosctl -n service kubelet restart +``` + +#### Deploy Mayastor + +Continue setting up [Mayastor](https://mayastor.gitbook.io/introduction/quickstart/deploy-mayastor) using the official documentation. + +### Piraeus / LINSTOR + +* [Piraeus-Operator](https://piraeus.io/) +* [LINSTOR](https://linbit.com/drbd/) +* [DRBD Extension](https://github.com/siderolabs/extensions#storage) + +#### Install Piraeus Operator V2 + +There is already a how-to for Talos: [Link](https://github.com/piraeusdatastore/piraeus-operator/blob/v2/docs/how-to/talos.md) + +#### Create first storage pool and PVC + +Before proceeding, install linstor plugin for kubectl: +https://github.com/piraeusdatastore/kubectl-linstor + +Or use [krew](https://krew.sigs.k8s.io/): `kubectl krew install linstor` + +```sh +# Create device pool on a blank (no partitation table!) disk on node01 +kubectl linstor physical-storage create-device-pool --pool-name nvme_lvm_pool LVM node01 /dev/nvme0n1 --storage-pool nvme_pool +``` + +piraeus-sc.yml + +```yaml +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: simple-nvme +parameters: + csi.storage.k8s.io/fstype: xfs + linstor.csi.linbit.com/autoPlace: "3" + linstor.csi.linbit.com/storagePool: nvme_pool +provisioner: linstor.csi.linbit.com +volumeBindingMode: WaitForFirstConsumer +``` + +```sh +# Create storage class +kubectl apply -f piraeus-sc.yml +``` + +## NFS + +NFS is an old pack animal long past its prime. +NFS is slow, has all kinds of bottlenecks involving contention, distributed locking, single points of service, and more. +However, it is supported by a wide variety of systems. +You don't want to use it unless you have to, but unfortunately, that "have to" is too frequent. + +The NFS client is part of the [`kubelet` image](https://github.com/talos-systems/kubelet) maintained by the Talos team. +This means that the version installed in your running `kubelet` is the version of NFS supported by Talos. +You can reduce some of the contention problems by parceling Persistent Volumes from separate underlying directories. + +## Object storage + +Ceph comes with an S3-compatible object store, but there are other options, as +well. +These can often be built on top of other storage backends. +For instance, you may have your block storage running with Mayastor but assign a +Pod a large Persistent Volume to serve your object store. + +One of the most popular open source add-on object stores is [MinIO](https://min.io/). + +## Others (iSCSI) + +The most common remaining systems involve iSCSI in one form or another. +These include the original OpenEBS, Rancher's Longhorn, and many proprietary systems. +iSCSI in Linux is facilitated by [open-iscsi](https://github.com/open-iscsi/open-iscsi). +This system was designed long before containers caught on, and it is not well +suited to the task, especially when coupled with a read-only host operating +system. + +iSCSI support in Talos is now supported via the [iscsi-tools](https://github.com/siderolabs/extensions/pkgs/container/iscsi-tools) [system extension]({{< relref "../../talos-guides/configuration/system-extensions" >}}) installed. +The extension enables compatibility with OpenEBS Jiva - refer to the [local storage]({{< relref "replicated-local-storage-with-openebs-jiva.md" >}}) installation guide for more information. diff --git a/website/content/v1.6/kubernetes-guides/configuration/synology-csi.md b/website/content/v1.6/kubernetes-guides/configuration/synology-csi.md new file mode 100644 index 0000000000..24954b7cf3 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/configuration/synology-csi.md @@ -0,0 +1,259 @@ +--- +title: "iSCSI Storage with Synology CSI" +description: "Automatically provision iSCSI volumes on a Synology NAS with the synology-csi driver." +aliases: + - ../../guides/synology-csi +--- + +## Background + +Synology is a company that specializes in Network Attached Storage (NAS) devices. +They provide a number of features within a simple web OS, including an LDAP server, Docker support, and (perhaps most relevant to this guide) function as an iSCSI host. +The focus of this guide is to allow a Kubernetes cluster running on Talos to provision Kubernetes storage (both dynamic or static) on a Synology NAS using a direct integration, rather than relying on an intermediary layer like Rook/Ceph or Maystor. + +This guide assumes a very basic familiarity with iSCSI terminology (LUN, iSCSI target, etc.). + +## Prerequisites + +* Synology NAS running DSM 7.0 or above +* Provisioned Talos cluster running Kubernetes v1.20 or above +* (Optional) Both [Volume Snapshot CRDs](https://github.com/kubernetes-csi/external-snapshotter/tree/v4.0.0/client/config/crd) and the [common snapshot controller](https://github.com/kubernetes-csi/external-snapshotter/tree/v4.0.0/deploy/kubernetes/snapshot-controller) must be installed in your Kubernetes cluster if you want to use the **Snapshot** feature + +## Setting up the Synology user account + +The `synology-csi` controller interacts with your NAS in two different ways: via the API and via the iSCSI protocol. +Actions such as creating a new iSCSI target or deleting an old one are accomplished via the Synology API, and require administrator access. +On the other hand, mounting the disk to a pod and reading from / writing to it will utilize iSCSI. +Because you can only authenticate with one account per DSM configured, that account needs to have admin privileges. +In order to minimize access in the case of these credentials being compromised, you should configure the account with the lease possible amount of access – explicitly specify "No Access" on all volumes when configuring the user permissions. + +## Setting up the Synology CSI + +> Note: this guide is paraphrased from the Synology CSI [readme](https://github.com/zebernst/synology-csi-talos). +> Please consult the readme for more in-depth instructions and explanations. + +Clone the git repository. + +```bash +git clone https://github.com/zebernst/synology-csi-talos.git +``` + +While Synology provides some automated scripts to deploy the CSI driver, they can be finicky especially when making changes to the source code. +We will be configuring and deploying things manually in this guide. + +The relevant files we will be touching are in the following locations: + +```text +. +├── Dockerfile +├── Makefile +├── config +│ └── client-info-template.yml +└── deploy + └── kubernetes + └── v1.20 + ├── controller.yml + ├── csi-driver.yml + ├── namespace.yml + ├── node.yml + ├── snapshotter + │ ├── snapshotter.yaml + │ └── volume-snapshot-class.yml + └── storage-class.yml +``` + +### Configure connection info + +Use `config/client-info-template.yml` as an example to configure the connection information for DSM. +You can specify **one or more** storage systems on which the CSI volumes will be created. +See below for an example: + +```yaml +--- +clients: +- host: 192.168.1.1 # ipv4 address or domain of the DSM + port: 5000 # port for connecting to the DSM + https: false # set this true to use https. you need to specify the port to DSM HTTPS port as well + username: username # username + password: password # password +``` + +Create a Kubernetes secret using the client information config file. + +```bash +kubectl create secret -n synology-csi generic client-info-secret --from-file=config/client-info.yml +``` + +Note that if you rename the secret to something other than `client-info-secret`, make sure you update the corresponding references in the deployment manifests as well. + +### Build the Talos-compatible image + +Modify the `Makefile` so that the image is built and tagged under your GitHub Container Registry username: + +```makefile +REGISTRY_NAME=ghcr.io/ +``` + +When you run `make docker-build` or `make docker-build-multiarch`, it will push the resulting image to `ghcr.io//synology-csi:v1.1.0`. +Ensure that you find and change any reference to `synology/synology-csi:v1.1.0` to point to your newly-pushed image within the deployment manifests. + +### Configure the CSI driver + +By default, the deployment manifests include one storage class and one volume snapshot class. +See below for examples: + +```yaml +--- +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + annotations: + storageclass.kubernetes.io/is-default-class: "false" + name: syno-storage +provisioner: csi.san.synology.com +parameters: + fsType: 'ext4' + dsm: '192.168.1.1' + location: '/volume1' +reclaimPolicy: Retain +allowVolumeExpansion: true +--- +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: syno-snapshot + annotations: + storageclass.kubernetes.io/is-default-class: "false" +driver: csi.san.synology.com +deletionPolicy: Delete +parameters: + description: 'Kubernetes CSI' +``` + +It can be useful to configure multiple different StorageClasses. +For example, a popular strategy is to create two nearly identical StorageClasses, with one configured with `reclaimPolicy: Retain` and the other with `reclaimPolicy: Delete`. +Alternately, a workload may require a specific filesystem, such as `ext4`. +If a Synology NAS is going to be the most common way to configure storage on your cluster, it can be convenient to add the `storageclass.kubernetes.io/is-default-class: "true"` annotation to one of your StorageClasses. + +The following table details the configurable parameters for the Synology StorageClass. + +| Name | Type | Description | Default | Supported protocols | +| ------------------------------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- | ------------------- | +| *dsm* | string | The IPv4 address of your DSM, which must be included in the `client-info.yml` for the CSI driver to log in to DSM | - | iSCSI, SMB | +| *location* | string | The location (/volume1, /volume2, ...) on DSM where the LUN for *PersistentVolume* will be created | - | iSCSI, SMB | +| *fsType* | string | The formatting file system of the *PersistentVolumes* when you mount them on the pods. This parameter only works with iSCSI. For SMB, the fsType is always ‘cifs‘. | `ext4` | iSCSI | +| *protocol* | string | The backing storage protocol. Enter ‘iscsi’ to create LUNs or ‘smb‘ to create shared folders on DSM. | `iscsi` | iSCSI, SMB | +| *csi.storage.k8s.io/node-stage-secret-name* | string | The name of node-stage-secret. Required if DSM shared folder is accessed via SMB. | - | SMB | +| *csi.storage.k8s.io/node-stage-secret-namespace* | string | The namespace of node-stage-secret. Required if DSM shared folder is accessed via SMB. | - | SMB | + +The VolumeSnapshotClass can be similarly configured with the following parameters: + +| Name | Type | Description | Default | Supported protocols | +| ------------- | ------ | -------------------------------------------- | ------- | ------------------- | +| *description* | string | The description of the snapshot on DSM | - | iSCSI | +| *is_locked* | string | Whether you want to lock the snapshot on DSM | `false` | iSCSI, SMB | + +### Apply YAML manifests + +Once you have created the desired StorageClass(es) and VolumeSnapshotClass(es), the final step is to apply the Kubernetes manifests against the cluster. +The easiest way to apply them all at once is to create a `kustomization.yaml` file in the same directory as the manifests and use Kustomize to apply: + +```bash +kubectl apply -k path/to/manifest/directory +``` + +Alternately, you can apply each manifest one-by-one: + +```bash +kubectl apply -f +``` + +## Run performance tests + +In order to test the provisioning, mounting, and performance of using a Synology NAS as Kubernetes persistent storage, use the following command: + +```bash +kubectl apply -f speedtest.yaml +``` + +Content of speedtest.yaml ([source](https://github.com/phnmnl/k8s-volume-test)) + +```yaml +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: test-claim +spec: +# storageClassName: syno-storage + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5G +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: read +spec: + template: + metadata: + name: read + labels: + app: speedtest + job: read + spec: + containers: + - name: read + image: ubuntu:xenial + command: ["dd","if=/mnt/pv/test.img","of=/dev/null","bs=8k"] + volumeMounts: + - mountPath: "/mnt/pv" + name: test-volume + volumes: + - name: test-volume + persistentVolumeClaim: + claimName: test-claim + restartPolicy: Never +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: write +spec: + template: + metadata: + name: write + labels: + app: speedtest + job: write + spec: + containers: + - name: write + image: ubuntu:xenial + command: ["dd","if=/dev/zero","of=/mnt/pv/test.img","bs=1G","count=1","oflag=dsync"] + volumeMounts: + - mountPath: "/mnt/pv" + name: test-volume + volumes: + - name: test-volume + persistentVolumeClaim: + claimName: test-claim + restartPolicy: Never +``` + +If these two jobs complete successfully, use the following commands to get the results of the speed tests: + +```bash +# Pod logs for read test: +kubectl logs -l app=speedtest,job=read + +# Pod logs for write test: +kubectl logs -l app=speedtest,job=write +``` + +When you're satisfied with the results of the test, delete the artifacts created from the speedtest: + +```bash +kubectl delete -f speedtest.yaml +``` diff --git a/website/content/v1.6/kubernetes-guides/network/_index.md b/website/content/v1.6/kubernetes-guides/network/_index.md new file mode 100644 index 0000000000..4201616739 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/network/_index.md @@ -0,0 +1,5 @@ +--- +title: "Network" +weight: 20 +description: "Managing the Kubernetes cluster networking" +--- diff --git a/website/content/v1.6/kubernetes-guides/network/deploying-cilium.md b/website/content/v1.6/kubernetes-guides/network/deploying-cilium.md new file mode 100644 index 0000000000..2c4726a05c --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/network/deploying-cilium.md @@ -0,0 +1,317 @@ +--- +title: "Deploying Cilium CNI" +description: "In this guide you will learn how to set up Cilium CNI on Talos." +aliases: + - ../../guides/deploying-cilium +--- + +> Cilium can be installed either via the `cilium` cli or using `helm`. + +This documentation will outline installing Cilium CNI v1.14.0 on Talos in six different ways. +Adhering to Talos principles we'll deploy Cilium with IPAM mode set to Kubernetes, and using the `cgroupv2` and `bpffs` mount that talos already provides. +As Talos does not allow loading kernel modules by Kubernetes workloads, `SYS_MODULE` capability needs to be dropped from the Cilium default set of values, this override can be seen in the helm/cilium cli install commands. +Each method can either install Cilium using kube proxy (default) or without: [Kubernetes Without kube-proxy](https://docs.cilium.io/en/v1.13/network/kubernetes/kubeproxy-free/) + +From Talos 1.5 we can use Cilium in combination with KubePrism. +You can read more about it in Talos 1.5 release notes. + +## Machine config preparation + +When generating the machine config for a node set the CNI to none. +For example using a config patch: + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: none +machine: + features: + kubePrism: + enabled: true + port: 7445 +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +Or if you want to deploy Cilium in strict mode without kube-proxy, you also need to disable kube proxy: + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: none + proxy: + disabled: true +machine: + features: + kubePrism: + enabled: true + port: 7445 +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +### Installation using Cilium CLI + +> Note: It is recommended to template the cilium manifest using helm and use it as part of Talos machine config, but if you want to install Cilium using the Cilium CLI, you can follow the steps below. + +Install the [Cilium CLI](https://docs.cilium.io/en/v1.13/gettingstarted/k8s-install-default/#install-the-cilium-cli) following the steps here. + +#### With kube-proxy + +```bash +cilium install \ + --helm-set=ipam.mode=kubernetes \ + --helm-set=kubeProxyReplacement=disabled \ + --helm-set=securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --helm-set=securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --helm-set=cgroup.autoMount.enabled=false \ + --helm-set=cgroup.hostRoot=/sys/fs/cgroup +``` + +#### Without kube-proxy + +```bash +cilium install \ + --helm-set=ipam.mode=kubernetes \ + --helm-set=kubeProxyReplacement=strict \ + --helm-set=securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --helm-set=securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --helm-set=cgroup.autoMount.enabled=false \ + --helm-set=cgroup.hostRoot=/sys/fs/cgroup \ + --helm-set=k8sServiceHost=localhost \ + --helm-set=k8sServicePort=7445 +``` + +### Installation using Helm + +Refer to [Installing with Helm](https://docs.cilium.io/en/v1.13/installation/k8s-install-helm/) for more information. + +First we'll need to add the helm repo for Cilium. + +```bash +helm repo add cilium https://helm.cilium.io/ +helm repo update +``` + +### Method 1: Helm install + +After applying the machine config and bootstrapping Talos will appear to hang on phase 18/19 with the message: retrying error: node not ready. +This happens because nodes in Kubernetes are only marked as ready once the CNI is up. +As there is no CNI defined, the boot process is pending and will reboot the node to retry after 10 minutes, this is expected behavior. + +During this window you can install Cilium manually by running the following: + +```bash +helm install \ + cilium \ + cilium/cilium \ + --version 1.14.0 \ + --namespace kube-system \ + --set ipam.mode=kubernetes \ + --set=kubeProxyReplacement=disabled \ + --set=securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set=securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set=cgroup.autoMount.enabled=false \ + --set=cgroup.hostRoot=/sys/fs/cgroup +``` + +Or if you want to deploy Cilium in strict mode without kube-proxy, also set some extra paramaters: + +```bash +helm install \ + cilium \ + cilium/cilium \ + --version 1.14.0 \ + --namespace kube-system \ + --set ipam.mode=kubernetes \ + --set=kubeProxyReplacement=strict \ + --set=securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set=securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set=cgroup.autoMount.enabled=false \ + --set=cgroup.hostRoot=/sys/fs/cgroup \ + --set=k8sServiceHost=localhost \ + --set=k8sServicePort=7445 +``` + +After Cilium is installed the boot process should continue and complete successfully. + +### Method 2: Helm manifests install + +Instead of directly installing Cilium you can instead first generate the manifest and then apply it: + +```bash +helm template \ + cilium \ + cilium/cilium \ + --version 1.14.0 \ + --namespace kube-system \ + --set ipam.mode=kubernetes \ + --set=kubeProxyReplacement=disabled \ + --set=securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set=securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set=cgroup.autoMount.enabled=false \ + --set=cgroup.hostRoot=/sys/fs/cgroup > cilium.yaml + +kubectl apply -f cilium.yaml +``` + +Without kube-proxy: + +```bash +export KUBERNETES_API_SERVER_ADDRESS= # e.g. 10.96.0.1 +export KUBERNETES_API_SERVER_PORT=6443 + +helm template \ + cilium \ + cilium/cilium \ + --version 1.14.0 \ + --namespace kube-system \ + --set ipam.mode=kubernetes \ + --set=kubeProxyReplacement=strict \ + --set=securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \ + --set=securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \ + --set=cgroup.autoMount.enabled=false \ + --set=cgroup.hostRoot=/sys/fs/cgroup \ + --set=k8sServiceHost=localhost \ + --set=k8sServicePort=7445 > cilium.yaml + +kubectl apply -f cilium.yaml +``` + +### Method 3: Helm manifests hosted install + +After generating `cilium.yaml` using `helm template`, instead of applying this manifest directly during the Talos boot window (before the reboot timeout). +You can also host this file somewhere and patch the machine config to apply this manifest automatically during bootstrap. +To do this patch your machine configuration to include this config instead of the above: + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: custom + urls: + - https://server.yourdomain.tld/some/path/cilium.yaml +machine: + features: + kubePrism: + enabled: true + port: 7445 +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +However, beware of the fact that the helm generated Cilium manifest contains sensitive key material. +As such you should definitely not host this somewhere publicly accessible. + +### Method 4: Helm manifests inline install + +A more secure option would be to include the `helm template` output manifest inside the machine configuration. +The machine config should be generated with CNI set to `none` + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: none +machine: + features: + kubePrism: + enabled: true + port: 7445 +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +if deploying Cilium with `kube-proxy` disabled, you can also include the following: + +Create a `patch.yaml` file with the following contents: + +```yaml +cluster: + network: + cni: + name: none + proxy: + disabled: true +machine: + features: + kubePrism: + enabled: true + port: 7445 +``` + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch @patch.yaml +``` + +To do so patch this into your machine configuration: + +``` yaml +inlineManifests: + - name: cilium + contents: | + -- + # Source: cilium/templates/cilium-agent/serviceaccount.yaml + apiVersion: v1 + kind: ServiceAccount + metadata: + name: "cilium" + namespace: kube-system + --- + # Source: cilium/templates/cilium-operator/serviceaccount.yaml + apiVersion: v1 + kind: ServiceAccount + -> Your cilium.yaml file will be pretty long.... +``` + +This will install the Cilium manifests at just the right time during bootstrap. + +Beware though: + +- Changing the namespace when templating with Helm does not generate a manifest containing the yaml to create that namespace. +As the inline manifest is processed from top to bottom make sure to manually put the namespace yaml at the start of the inline manifest. +- Only add the Cilium inline manifest to the control plane nodes machine configuration. +- Make sure all control plane nodes have an identical configuration. +- If you delete any of the generated resources they will be restored whenever a control plane node reboots. +- As a safety messure Talos only creates missing resources from inline manifests, it never deletes or updates anything. +- If you need to update a manifest make sure to first edit all control plane machine configurations and then run `talosctl upgrade-k8s` as it will take care of updating inline manifests. + +## Known issues + +- There are some gotchas when using Talos and Cilium on the Google cloud platform when using internal load balancers. +For more details: [GCP ILB support / support scope local routes to be configured](https://github.com/siderolabs/talos/issues/4109) + +## Other things to know + +- Talos has full kernel module support for eBPF, See: + - [Cilium System Requirements](https://docs.cilium.io/en/v1.13/operations/system_requirements/) + - [Talos Kernel Config AMD64](https://github.com/siderolabs/pkgs/blob/main/kernel/build/config-amd64) + - [Talos Kernel Config ARM64](https://github.com/siderolabs/pkgs/blob/main/kernel/build/config-arm64) diff --git a/website/content/v1.6/kubernetes-guides/upgrading-kubernetes.md b/website/content/v1.6/kubernetes-guides/upgrading-kubernetes.md new file mode 100644 index 0000000000..66fc550205 --- /dev/null +++ b/website/content/v1.6/kubernetes-guides/upgrading-kubernetes.md @@ -0,0 +1,352 @@ +--- +title: "Upgrading Kubernetes" +description: "Guide on how to upgrade the Kubernetes cluster from Talos Linux." +aliases: + - guides/upgrading-kubernetes +--- + +This guide covers upgrading Kubernetes on Talos Linux clusters. + +For a list of Kubernetes versions compatible with each Talos release, see the [Support Matrix]({{< relref "../introduction/support-matrix" >}}). + +For upgrading the Talos Linux operating system, see [Upgrading Talos]({{< relref "../talos-guides/upgrading-talos" >}}) + +## Video Walkthrough + +To see a demo of this process, watch this video: + + + +## Automated Kubernetes Upgrade + +The recommended method to upgrade Kubernetes is to use the `talosctl upgrade-k8s` command. +This will automatically update the components needed to upgrade Kubernetes safely. +Upgrading Kubernetes is non-disruptive to the cluster workloads. + +To trigger a Kubernetes upgrade, issue a command specifiying the version of Kubernetes to ugprade to, such as: + +`talosctl --nodes upgrade-k8s --to {{< k8s_release >}}` + +Note that the `--nodes` parameter specifies the control plane node to send the API call to, but all members of the cluster will be upgraded. + +To check what will be upgraded you can run `talosctl upgrade-k8s` with the `--dry-run` flag: + +```bash +$ talosctl --nodes upgrade-k8s --to {{< k8s_release >}} --dry-run +WARNING: found resources which are going to be deprecated/migrated in the version {{< k8s_release >}} +RESOURCE COUNT +validatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 4 +mutatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 3 +customresourcedefinitions.v1beta1.apiextensions.k8s.io 25 +apiservices.v1beta1.apiregistration.k8s.io 54 +leases.v1beta1.coordination.k8s.io 4 +automatically detected the lowest Kubernetes version {{< k8s_prev_release >}} +checking for resource APIs to be deprecated in version {{< k8s_release >}} +discovered controlplane nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] +discovered worker nodes ["172.20.0.5" "172.20.0.6"] +updating "kube-apiserver" to version "{{< k8s_release >}}" + > "172.20.0.2": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > skipped in dry-run + > "172.20.0.3": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > skipped in dry-run + > "172.20.0.4": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > skipped in dry-run +updating "kube-controller-manager" to version "{{< k8s_release >}}" + > "172.20.0.2": starting update + > update kube-controller-manager: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > skipped in dry-run + > "172.20.0.3": starting update + + + +updating manifests + > apply manifest Secret bootstrap-token-3lb63t + > apply skipped in dry run + > apply manifest ClusterRoleBinding system-bootstrap-approve-node-client-csr + > apply skipped in dry run + +``` + +To upgrade Kubernetes from v{{< k8s_prev_release >}} to v{{< k8s_release >}} run: + +```bash +$ talosctl --nodes upgrade-k8s --to {{< k8s_release >}} +automatically detected the lowest Kubernetes version {{< k8s_prev_release >}} +checking for resource APIs to be deprecated in version {{< k8s_release >}} +discovered controlplane nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] +discovered worker nodes ["172.20.0.5" "172.20.0.6"] +updating "kube-apiserver" to version "{{< k8s_release >}}" + > "172.20.0.2": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + > "172.20.0.2": machine configuration patched + > "172.20.0.2": waiting for API server state pod update + < "172.20.0.2": successfully updated + > "172.20.0.3": starting update + > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} + +``` + +This command runs in several phases: + +1. Every control plane node machine configuration is patched with the new image version for each control plane component. + Talos renders new static pod definitions on the configuration update which is picked up by the kubelet. + The command waits for the change to propagate to the API server state. +2. The command updates the `kube-proxy` daemonset with the new image version. +3. On every node in the cluster, the `kubelet` version is updated. + The command then waits for the `kubelet` service to be restarted and become healthy. + The update is verified by checking the `Node` resource state. +4. Kubernetes bootstrap manifests are re-applied to the cluster. + Updated bootstrap manifests might come with a new Talos version (e.g. CoreDNS version update), or might be the result of machine configuration change. + Note: The `upgrade-k8s` command never deletes any resources from the cluster: they should be deleted manually. + +If the command fails for any reason, it can be safely restarted to continue the upgrade process from the moment of the failure. + +## Manual Kubernetes Upgrade + +Kubernetes can be upgraded manually by following the steps outlined below. +They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. + +### Kubeconfig + +In order to edit the control plane, you need a working `kubectl` config. +If you don't already have one, you can get one by running: + +```bash +talosctl --nodes kubeconfig +``` + +### API Server + +Patch machine configuration using `talosctl patch` command: + +```bash +$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "registry.k8s.io/kube-apiserver:v{{< k8s_release >}}"}]' +patched mc at the node 172.20.0.2 +``` + +The JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. + +Also the machine configuration can be edited manually with `talosctl -n edit mc --mode=no-reboot`. + +Capture the new version of `kube-apiserver` config with: + +```bash +$ talosctl -n get kcpc kube-apiserver -o yaml +node: 172.20.0.2 +metadata: + namespace: config + type: KubernetesControlPlaneConfigs.config.talos.dev + id: kube-apiserver + version: 5 + phase: running +spec: + image: registry.k8s.io/kube-apiserver:v{{< k8s_release >}} + cloudProvider: "" + controlPlaneEndpoint: https://172.20.0.1:6443 + etcdServers: + - https://127.0.0.1:2379 + localPort: 6443 + serviceCIDR: 10.96.0.0/12 + extraArgs: {} + extraVolumes: [] +``` + +In this example, the new version is `5`. +Wait for the new pod definition to propagate to the API server state (replace `talos-default-controlplane-1` with the node name): + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-controlplane-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' +5 +``` + +Check that the pod is running: + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-controlplane-1 +NAME READY STATUS RESTARTS AGE +kube-apiserver-talos-default-controlplane-1 1/1 Running 0 16m +``` + +Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. + +### Controller Manager + +Patch machine configuration using `talosctl patch` command: + +```bash +$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "registry.k8s.io/kube-controller-manager:v{{< k8s_release >}}"}]' +patched mc at the node 172.20.0.2 +``` + +The JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. + +Capture new version of `kube-controller-manager` config with: + +```bash +$ talosctl -n get kcpc kube-controller-manager -o yaml +node: 172.20.0.2 +metadata: + namespace: config + type: KubernetesControlPlaneConfigs.config.talos.dev + id: kube-controller-manager + version: 3 + phase: running +spec: + image: registry.k8s.io/kube-controller-manager:v{{< k8s_release >}} + cloudProvider: "" + podCIDR: 10.244.0.0/16 + serviceCIDR: 10.96.0.0/12 + extraArgs: {} + extraVolumes: [] +``` + +In this example, new version is `3`. +Wait for the new pod definition to propagate to the API server state (replace `talos-default-controlplane-1` with the node name): + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-controlplane-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' +3 +``` + +Check that the pod is running: + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-controlplane-1 +NAME READY STATUS RESTARTS AGE +kube-controller-manager-talos-default-controlplane-1 1/1 Running 0 35m +``` + +Repeat this process for every control plane node, verifying that state propagated successfully between each node update. + +### Scheduler + +Patch machine configuration using `talosctl patch` command: + +```bash +$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "registry.k8s.io/kube-scheduler:v{{< k8s_release >}}"}]' +patched mc at the node 172.20.0.2 +``` + +JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. + +Capture new version of `kube-scheduler` config with: + +```bash +$ talosctl -n get kcpc kube-scheduler -o yaml +node: 172.20.0.2 +metadata: + namespace: config + type: KubernetesControlPlaneConfigs.config.talos.dev + id: kube-scheduler + version: 3 + phase: running +spec: + image: registry.k8s.io/kube-scheduler:v{{< k8s_release >}} + extraArgs: {} + extraVolumes: [] +``` + +In this example, new version is `3`. +Wait for the new pod definition to propagate to the API server state (replace `talos-default-controlplane-1` with the node name): + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-controlplane-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' +3 +``` + +Check that the pod is running: + +```bash +$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-controlplane-1 +NAME READY STATUS RESTARTS AGE +kube-scheduler-talos-default-controlplane-1 1/1 Running 0 39m +``` + +Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. + +### Proxy + +In the proxy's `DaemonSet`, change: + +```yaml +kind: DaemonSet +... +spec: + ... + template: + ... + spec: + containers: + - name: kube-proxy + image: registry.k8s.io/kube-proxy:v{{< k8s_release >}} + tolerations: + - ... +``` + +to: + +```yaml +kind: DaemonSet +... +spec: + ... + template: + ... + spec: + containers: + - name: kube-proxy + image: registry.k8s.io/kube-proxy:v{{< k8s_release >}} + tolerations: + - ... + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule +``` + +To edit the `DaemonSet`, run: + +```bash +kubectl edit daemonsets -n kube-system kube-proxy +``` + +### Bootstrap Manifests + +Bootstrap manifests can be retrieved in a format which works for `kubectl` with the following command: + +```bash +talosctl -n get manifests -o yaml | yq eval-all '.spec | .[] | splitDoc' - > manifests.yaml +``` + +Diff the manifests with the cluster: + +```bash +kubectl diff -f manifests.yaml +``` + +Apply the manifests: + +```bash +kubectl apply -f manifests.yaml +``` + +> Note: if some bootstrap resources were removed, they have to be removed from the cluster manually. + +### kubelet + +For every node, patch machine configuration with new kubelet version, wait for the kubelet to restart with new version: + +```bash +$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/siderolabs/kubelet:v{{< k8s_release >}}"}]' +patched mc at the node 172.20.0.2 +``` + +Once `kubelet` restarts with the new configuration, confirm upgrade with `kubectl get nodes `: + +```bash +$ kubectl get nodes talos-default-controlplane-1 +NAME STATUS ROLES AGE VERSION +talos-default-controlplane-1 Ready control-plane 123m v{{< k8s_release >}} +``` diff --git a/website/content/v1.6/learn-more/_index.md b/website/content/v1.6/learn-more/_index.md new file mode 100644 index 0000000000..0c6fe17a02 --- /dev/null +++ b/website/content/v1.6/learn-more/_index.md @@ -0,0 +1,4 @@ +--- +title: "Learn More" +weight: 80 +--- diff --git a/website/content/v1.6/learn-more/architecture.md b/website/content/v1.6/learn-more/architecture.md new file mode 100644 index 0000000000..f03cf76d5e --- /dev/null +++ b/website/content/v1.6/learn-more/architecture.md @@ -0,0 +1,56 @@ +--- +title: "Architecture" +weight: 20 +description: "Learn the system architecture of Talos Linux itself." +--- + +Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. + +It is atomic in that the entirety of Talos is distributed as a +single, self-contained image, which is versioned, signed, and immutable. + +It is modular in that it is composed of many separate components +which have clearly defined gRPC interfaces which facilitate internal flexibility +and external operational guarantees. + +All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. +This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. +The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. +This is a key component in reducing coupling and maintaining modularity. + +## File system partitions + +Talos uses these partitions with the following labels: + +1. **EFI** - stores EFI boot data. +1. **BIOS** - used for GRUB's second stage boot. +1. **BOOT** - used for the boot loader, stores initramfs and kernel data. +1. **META** - stores metadata about the talos node, such as node id's. +1. **STATE** - stores machine configuration, node identity data for cluster discovery and KubeSpan info +1. **EPHEMERAL** - stores ephemeral state information, mounted at `/var` + +## The File System + +One of the unique design decisions in Talos is the layout of the root file system. +There are three "layers" to the Talos root file system. +At its core the rootfs is a read-only squashfs. +The squashfs is then mounted as a loop device into memory. +This provides Talos with an immutable base. + +The next layer is a set of `tmpfs` file systems for runtime specific needs. +Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. +One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). +For example, at boot Talos will write `/system/etc/hosts` and then bind mount it over `/etc/hosts`. +This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. + +All files under `/system` are completely recreated on each boot. +For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. +The `/etc/kubernetes` is a good example of this. +Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. + +The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. +This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). +Its content survives machine reboots, but it is wiped and lost on machine upgrades and resets, unless the +`--preserve` option of [`talosctl upgrade`]({{< relref "../reference/cli#talosctl-upgrade" >}}) or the +`--system-labels-to-wipe` option of [`talosctl reset`]({{< relref "../reference/cli#talosctl-reset" >}}) +is used. diff --git a/website/content/v1.6/learn-more/components.md b/website/content/v1.6/learn-more/components.md new file mode 100644 index 0000000000..35cc020c1e --- /dev/null +++ b/website/content/v1.6/learn-more/components.md @@ -0,0 +1,120 @@ +--- +title: "Components" +weight: 40 +description: "Understand the system components that make up Talos Linux." +--- + +In this section, we discuss the various components that underpin Talos. + +## Components + +Talos Linux and Kubernetes are tightly integrated. + +![Talos Linux and Kubernetes components](/images/components.drawio.svg) + +In the following, the focus is on the Talos Linux specific components. + +| Component | Description | +| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `machined`. | +| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | +| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | +| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | +| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | +| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | + +### apid + +When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. +Apid acts as the gateway for all component interactions. +Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. + +We'll use some examples below to illustrate what `apid` is doing. + +When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. +The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. +Typically this is a public-facing server. +The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. +If `--nodes` is omitted, the first endpoint will be used. + +> Note: Typically, there will be an `endpoint` already defined in the Talos config file. +> Optionally, `nodes` can be included here as well. + +For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. + +```bash +$ talosctl -e cluster.talos.dev memory +NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE +cluster.talos.dev 7938 1768 2390 145 53 3724 6571 +``` + +In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. + +If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. + +```bash +$ talosctl -e cluster.talos.dev -n node02 memory +NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE +node02 7938 1768 2390 145 53 3724 6571 +``` + +The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. + +We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): + +```bash +$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory +NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE +node01 7938 871 4071 137 49 2945 7042 +node02 257844 14408 190796 18138 49 52589 227492 +node03 257844 1830 255186 125 49 777 254556 +``` + +The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. + +### containerd + +[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. + +Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. + +### machined + +A common theme throughout the design of Talos is minimalism. +We believe strongly in the UNIX philosophy that each program should do one job well. +The `init` included in Talos is one example of this, and we are calling it "`machined`". + +We wanted to create a focused `init` that had one job - run Kubernetes. +To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. +Only the services necessary to run Kubernetes and manage the node are available. +This includes: + +- containerd +- etcd +- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) +- networkd +- trustd +- udevd + +The `machined` process handles all machine configuration, API handling, resource and controller management. + +### kernel + +The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). + +### trustd + +Security is one of the highest priorities within Talos. +To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. +For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. + +To that end, we created `trustd`. +Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. +Once trust is established, various methods become available to the trustee. +For example, it can accept a write request from another node to place a file on disk. + +Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. + +### udevd + +Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v1.6/learn-more/control-plane.md b/website/content/v1.6/learn-more/control-plane.md new file mode 100644 index 0000000000..16fd8b08d4 --- /dev/null +++ b/website/content/v1.6/learn-more/control-plane.md @@ -0,0 +1,145 @@ +--- +title: "Control Plane" +weight: 50 +description: "Understand the Kubernetes Control Plane." +--- + +This guide provides information about the Kubernetes control plane, and details on how Talos runs and bootstraps the Kubernetes control plane. + + + +## What is a control plane node? + +A control plane node is a node which: + +- runs etcd, the Kubernetes database +- runs the Kubernetes control plane + - kube-apiserver + - kube-controller-manager + - kube-scheduler +- serves as an administrative proxy to the worker nodes + +These nodes are critical to the operation of your cluster. +Without control plane nodes, Kubernetes will not respond to changes in the +system, and certain central services may not be available. + +Talos nodes which have `.machine.type` of `controlplane` are control plane nodes. +(check via `talosctl get member`) + +Control plane nodes are tainted by default to prevent workloads from being scheduled onto them. +This is both to protect the control plane from workloads consuming resources and starving the control plane processes, and also to reduce the risk of a vulnerability exposes the control plane's credentials to a workload. + +## The Control Plane and Etcd + +A critical design concept of Kubernetes (and Talos) is the `etcd` database. + +Properly managed (which Talos Linux does), `etcd` should never have split brain or noticeable down time. +In order to do this, `etcd` maintains the concept of "membership" and of +"quorum". +To perform any operation, read or write, the database requires +quorum. +That is, a majority of members must agree on the current leader, and absenteeism (members that are down, or not reachable) +counts as a negative. +For example, if there are three members, at least two out +of the three must agree on the current leader. +If two disagree or fail to answer, the `etcd` database will lock itself +until quorum is achieved in order to protect the integrity of +the data. + +This design means that having two controlplane nodes is _worse_ than having only one, because if _either_ goes down, your database will lock (and the chance of one of two nodes going down is greater than the chance of just a single node going down). +Similarly, a 4 node etcd cluster is worse than a 3 node etcd cluster - a 4 node cluster requires 3 nodes to be up to achieve quorum (in order to have a majority), while the 3 node cluster requires 2 nodes: +i.e. both can support a single node failure and keep running - but the chance of a node failing in a 4 node cluster is higher than that in a 3 node cluster. + +Another note about etcd: due to the need to replicate data amongst members, performance of etcd _decreases_ as the cluster scales. +A 5 node cluster can commit about 5% less writes per second than a 3 node cluster running on the same hardware. + +## Recommendations for your control plane + +- Run your clusters with three or five control plane nodes. + Three is enough for most use cases. + Five will give you better availability (in that it can tolerate two node failures simultaneously), but cost you more both in the number of nodes required, and also as each node may require more hardware resources to offset the performance degradation seen in larger clusters. +- Implement good monitoring and put processes in place to deal with a failed node in a timely manner (and test them!) +- Even with robust monitoring and procedures for replacing failed nodes in place, backup etcd and your control plane node configuration to guard against unforeseen disasters. +- Monitor the performance of your etcd clusters. + If etcd performance is slow, vertically scale the nodes, not the number of nodes. +- If a control plane node fails, remove it first, then add the replacement node. + (This ensures that the failed node does not "vote" when adding in the new node, minimizing the chances of a quorum violation.) +- If replacing a node that has not failed, add the new one, then remove the old. + +## Bootstrapping the Control Plane + +Every new cluster must be bootstrapped only once, which is achieved by telling a single control plane node to initiate the bootstrap. + +Bootstrapping itself does not do anything with Kubernetes. +Bootstrapping only tells `etcd` to form a cluster, so don't judge the success of +a bootstrap by the failure of Kubernetes to start. +Kubernetes relies on `etcd`, so bootstrapping is _required_, but it is not +_sufficient_ for Kubernetes to start. +If your Kubernetes cluster fails to form for other reasons (say, a bad +configuration option or unavailable container repository), if the bootstrap API +call returns successfully, you do NOT need to bootstrap again: +just fix the config or let Kubernetes retry. + +### High-level Overview + +Talos cluster bootstrap flow: + +1. The `etcd` service is started on control plane nodes. + Instances of `etcd` on control plane nodes build the `etcd` cluster. +2. The `kubelet` service is started. +3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. +4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). +5. The `kubelet` registers the node in the API server. +6. Kubernetes control plane schedules pods on the nodes. + +### Cluster Bootstrapping + +All nodes start the `kubelet` service. +The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. + +One of the control plane nodes is chosen as the bootstrap node, and promoted using the bootstrap API (`talosctl bootstrap`). +The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. + +> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. + +Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. + +As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. +The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. +As soon as `kube-apiserver` is launched, the control plane endpoint comes up. + +The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. +The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. +The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. + +Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) + +The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. +The `etcd` cluster is now formed and consists of all control plane nodes. + +All control plane nodes render static pod manifests for the control plane components. +Each node now runs a full set of components to make the control plane HA. + +The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. + +### Scaling Up the Control Plane + +When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the +control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. + +### Scaling Down the Control Plane + +Scaling down the control plane involves removing a node from the cluster. +The most critical part is making sure that the node which is being removed leaves the etcd cluster. +The recommended way to do this is to use: + +- `talosctl -n IP.of.node.to.remove reset` +- `kubectl delete node` + +When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence, and its disks are erased. + +### Upgrading Talos on Control Plane Nodes + +When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. +The upgraded node then joins the `etcd` cluster on reboot. +So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v1.6/learn-more/controllers-resources.md b/website/content/v1.6/learn-more/controllers-resources.md new file mode 100644 index 0000000000..db2e998ba3 --- /dev/null +++ b/website/content/v1.6/learn-more/controllers-resources.md @@ -0,0 +1,230 @@ +--- +title: "Controllers and Resources" +weight: 60 +description: "Discover how Talos Linux uses the concepts on Controllers and Resources." +--- + + + +Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. +Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. +The content of this document is not required to operate Talos, but it is useful for troubleshooting. + +Starting with Talos 0.9, most of the Kubernetes control plane bootstrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). + +## Resources + +A resource captures a piece of system state. +Each resource belongs to a "Type" which defines resource contents. +Resource state can be split in two parts: + +* metadata: fixed set of fields describing resource - namespace, type, ID, etc. +* spec: contents of the resource (depends on resource type). + +Resource is uniquely identified by (`namespace`, `type`, `id`). +Namespaces provide a way to avoid conflicts on duplicate resource IDs. + +At the moment of this writing, all resources are local to the node and stored in memory. +So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). + +## Controllers + +Controllers run as independent lightweight threads in Talos. +The goal of the controller is to reconcile the state based on inputs and eventually update outputs. + +A controller can have any number of resource types (and namespaces) as inputs. +In other words, it watches specified resources for changes and reconciles when these changes occur. +A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. + +A controller has a single output: a set of resources of fixed type in a fixed namespace. +Only one controller can manage resource type in the namespace, so conflicts are avoided. + +## Querying Resources + +Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, +listing resources and watching for changes. + +Talos stores resources describing resource types and namespaces in `meta` namespace: + +```bash +$ talosctl get resourcedefinitions +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 +172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 +172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 +172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 +172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 +172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 +172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 +172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 +172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 +172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 +172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 +172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 +``` + +```bash +$ talosctl get namespaces +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 meta Namespace config 1 +172.20.0.2 meta Namespace controlplane 1 +172.20.0.2 meta Namespace meta 1 +172.20.0.2 meta Namespace runtime 1 +172.20.0.2 meta Namespace secrets 1 +``` + +Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default +namespace which is used if no namespace is given: + +```bash +$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml +node: 172.20.0.2 +metadata: + namespace: meta + type: ResourceDefinitions.meta.cosi.dev + id: resourcedefinitions.meta.cosi.dev + version: 1 + phase: running +spec: + type: ResourceDefinitions.meta.cosi.dev + displayType: ResourceDefinition + aliases: + - resourcedefinitions + - resourcedefinition + - resourcedefinitions.meta + - resourcedefinitions.meta.cosi + - rd + - rds + printColumns: [] + defaultNamespace: meta +``` + +Resource definition also contains type aliases which can be used interchangeably with canonical resource name: + +```bash +$ talosctl get ns config +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 meta Namespace config 1 +``` + +### Output + +Command `talosctl get` supports following output modes: + +* `table` (default) prints resource list as a table +* `yaml` prints pretty formatted resources with details, including full metadata spec. + This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) +* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. + This format is useful for automated processing with tools like `jq`. + +### Watching Changes + +If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. +If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information for every change: + +```bash +$ talosctl get svc -w +NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY +172.20.0.2 + runtime Service timed 2 true true +172.20.0.2 + runtime Service trustd 2 true true +172.20.0.2 + runtime Service udevd 2 true true +172.20.0.2 - runtime Service timed 2 true true +172.20.0.2 + runtime Service timed 1 true false +172.20.0.2 runtime Service timed 2 true true +``` + +Column `*` specifies event type: + +* `+` is created +* `-` is deleted +* ` ` is updated + +In YAML/JSON output, field `event` is added to the resource representation to describe the event type. + +### Examples + +Getting machine config: + +```bash +$ talosctl get machineconfig -o yaml +node: 172.20.0.2 +metadata: + namespace: config + type: MachineConfigs.config.talos.dev + id: v1alpha1 + version: 2 + phase: running +spec: + version: v1alpha1 # Indicates the schema used to decode the contents. + debug: false # Enable verbose logging to the console. + persist: true # Indicates whether to pull the machine config upon every boot. + # Provides machine specific configuration options. +... +``` + +Getting control plane static pod statuses: + +```bash +$ talosctl get staticpodstatus +NODE NAMESPACE TYPE ID VERSION READY +172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-controlplane-1 3 True +172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-controlplane-1 3 True +172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-controlplane-1 4 True +``` + +Getting static pod definition for `kube-apiserver`: + +```bash +$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml +node: 172.20.0.2 +metadata: + namespace: controlplane + type: StaticPods.kubernetes.talos.dev + id: kube-apiserver + version: 3 + phase: running + finalizers: + - k8s.StaticPodStatus("kube-apiserver") +spec: + apiVersion: v1 + kind: Pod + metadata: + annotations: + talos.dev/config-version: "1" + talos.dev/secrets-version: "2" +... +``` + +## Inspecting Controller Dependencies + +Talos can report current dependencies between controllers and resources for debugging purposes: + +```bash +$ talosctl inspect dependencies +digraph { + + n1[label="config.K8sControlPlaneController",shape="box"]; + n3[label="config.MachineTypeController",shape="box"]; + n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; +... +``` + +This outputs graph in `graphviz` format which can be rendered to PNG with command: + +```bash +talosctl inspect dependencies | dot -T png > deps.png +``` + +![Controller Dependencies](/images/controller-dependencies-v2.png) + +Graph can be enhanced by replacing resource types with actual resource instances: + +```bash +talosctl inspect dependencies --with-resources | dot -T png > deps.png +``` + +![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png) diff --git a/website/content/v1.6/learn-more/faqs.md b/website/content/v1.6/learn-more/faqs.md new file mode 100644 index 0000000000..31f4be4cf1 --- /dev/null +++ b/website/content/v1.6/learn-more/faqs.md @@ -0,0 +1,50 @@ +--- +title: "FAQs" +weight: 999 +description: "Frequently Asked Questions about Talos Linux." +--- + + + +## How is Talos different from other container optimized Linux distros? + +Talos shares a lot of attributes with other distros, but there are some important differences. +Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. +The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. +We don't ship SSH, and there is no console access. +Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. +It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. + +## Why no shell or SSH? + +Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. +We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. +That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. +We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. +Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remediation of the issue. +However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. +We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. + +## Why the name "Talos"? + +Talos was an automaton created by the Greek God of the forge to protect the island of Crete. +He would patrol the coast and enforce laws throughout the land. +We felt it was a fitting name for a security focused operating system designed to run Kubernetes. + +## Why does Talos rely on a separate configuration from Kubernetes? + +The `talosconfig` file contains client credentials to access the Talos Linux API. +Sometimes Kubernetes might be down for a number of reasons (etcd issues, misconfiguration, etc.), while Talos API access will always be available. +The Talos API is a way to access the operating system and fix issues, e.g. fixing access to Kubernetes. +When Talos Linux is running fine, using the Kubernetes APIs (via `kubeconfig`) is all you should need to deploy and manage Kubernetes workloads. + +## How Talos handles certificates ? + +During the machine config generation process, Talos generates a set of certificate authorities (CAs) that remains valid for 10 years. +Talos is responsible for managing certificates for `etcd`, Talos API (`apid`), node certificates (`kubelet`), and other components. +It also handles the automatic rotation of server-side certificates. + +However, client certificates such as `talosconfig` and `kubeconfig` are the user's responsibility, and by default, they have a validity period of 1 year. + +To renew the `talosconfig` certificate, the follow [this process]({{< relref "../talos-guides/configuration/managing-pki" >}}). +To renew `kubeconfig`, use `talosctl kubeconfig` command, and the time-to-live (TTL) is defined in the [configuration]({{< relref "../reference/configuration/#adminkubeconfigconfig" >}}). diff --git a/website/content/v1.6/learn-more/knowledge-base.md b/website/content/v1.6/learn-more/knowledge-base.md new file mode 100644 index 0000000000..34d6b60788 --- /dev/null +++ b/website/content/v1.6/learn-more/knowledge-base.md @@ -0,0 +1,98 @@ +--- +title: "Knowledge Base" +weight: 1999 +description: "Recipes for common configuration tasks with Talos Linux." +--- + +## Disabling `GracefulNodeShutdown` on a node + +Talos Linux enables [Graceful Node Shutdown](https://kubernetes.io/docs/concepts/architecture/nodes/#graceful-node-shutdown) Kubernetes feature by default. + +If this feature should be disabled, modify the `kubelet` part of the machine configuration with: + +```yaml +machine: + kubelet: + extraArgs: + feature-gates: GracefulNodeShutdown=false + extraConfig: + shutdownGracePeriod: 0s + shutdownGracePeriodCriticalPods: 0s +``` + +## Generating Talos Linux ISO image with custom kernel arguments + +Pass additional kernel arguments using `--extra-kernel-arg` flag: + +```shell +$ docker run --rm -i ghcr.io/siderolabs/imager:{{< release >}} iso --arch amd64 --tar-to-stdout --extra-kernel-arg console=ttyS1 --extra-kernel-arg console=tty0 | tar xz +2022/05/25 13:18:47 copying /usr/install/amd64/vmlinuz to /mnt/boot/vmlinuz +2022/05/25 13:18:47 copying /usr/install/amd64/initramfs.xz to /mnt/boot/initramfs.xz +2022/05/25 13:18:47 creating grub.cfg +2022/05/25 13:18:47 creating ISO +``` + +ISO will be output to the file `talos-.iso` in the current directory. + +## Logging Kubernetes audit logs with loki + +If using loki-stack helm chart to gather logs from the Kubernetes cluster, you can use the helm values to configure loki-stack to log Kubernetes API server audit logs: + +```yaml +promtail: + extraArgs: + - -config.expand-env + # this is required so that the promtail process can read the kube-apiserver audit logs written as `nobody` user + containerSecurityContext: + capabilities: + add: + - DAC_READ_SEARCH + extraVolumes: + - name: audit-logs + hostPath: + path: /var/log/audit/kube + extraVolumeMounts: + - name: audit-logs + mountPath: /var/log/audit/kube + readOnly: true + config: + snippets: + extraScrapeConfigs: | + - job_name: auditlogs + static_configs: + - targets: + - localhost + labels: + job: auditlogs + host: ${HOSTNAME} + __path__: /var/log/audit/kube/*.log +``` + +## Setting CPU scaling governer + +While its possible to set [CPU scaling governer](https://kernelnewbies.org/Linux_5.9#CPU_Frequency_scaling) via `.machine.sysfs` it's sometimes cumbersome to set it for all CPU's individually. +A more elegant approach would be set it via a kernel commandline parameter. +This also means that the options are applied way early in the boot process. + +This can be set in the machineconfig via the snippet below: + +```yaml +machine: + install: + extraKernelArgs: + - cpufreq.default_governor=performance +``` + +> Note: Talos needs to be upgraded for the `extraKernelArgs` to take effect. + +## Disable `admissionControl` on control plane nodes + +Talos Linux enables admission control in the API Server by default. + +Although it is not recommended from a security point of view, admission control can be removed by patching your control plane machine configuration: + +```bash +talosctl gen config \ + my-cluster https://mycluster.local:6443 \ + --config-patch-control-plane '[{"op": "remove", "path": "/cluster/apiServer/admissionControl"}]' +``` diff --git a/website/content/v1.6/learn-more/kubespan.md b/website/content/v1.6/learn-more/kubespan.md new file mode 100644 index 0000000000..3a81aaddd6 --- /dev/null +++ b/website/content/v1.6/learn-more/kubespan.md @@ -0,0 +1,207 @@ +--- +title: "KubeSpan" +weight: 100 +description: "Understand more about KubeSpan for Talos Linux." +--- + +## WireGuard Peer Discovery + +The key pieces of information needed for WireGuard generally are: + +- the public key of the host you wish to connect to +- an IP address and port of the host you wish to connect to + +The latter is really only required of _one_ side of the pair. +Once traffic is received, that information is learned and updated by WireGuard automatically. + +Kubernetes, though, also needs to know which traffic goes to which WireGuard peer. +Because this information may be dynamic, we need a way to keep this information up to date. + +If we already have a connection to Kubernetes, it's fairly easy: we can just keep that information in Kubernetes. +Otherwise, we have to have some way to discover it. + +Talos Linux implements a multi-tiered approach to gathering this information. +Each tier can operate independently, but the amalgamation of the mechanisms produces a more robust set of connection criteria. + +These mechanisms are: + +- an external service +- a Kubernetes-based system + +See [discovery service]({{< relref "../talos-guides/discovery" >}}) to learn more about the external service. + +The Kubernetes-based system utilizes annotations on Kubernetes Nodes which describe each node's public key and local addresses. + +On top of this, KubeSpan can optionally route Pod subnets. +This is usually taken care of by the CNI, but there are many situations where the CNI fails to be able to do this itself, across networks. + +## NAT, Multiple Routes, Multiple IPs + +One of the difficulties in communicating across networks is that there is often not a single address and port which can identify a connection for each node on the system. +For instance, a node sitting on the same network might see its peer as `192.168.2.10`, but a node across the internet may see it as `2001:db8:1ef1::10`. + +We need to be able to handle any number of addresses and ports, and we also need to have a mechanism to _try_ them. +WireGuard only allows us to select one at a time. + +KubeSpan implements a controller which continuously discovers and rotates these IP:port pairs until a connection is established. +It then starts trying again if that connection ever fails. + +## Packet Routing + +After we have established a WireGuard connection, we have to make sure that the right packets get sent to the WireGuard interface. + +WireGuard supplies a convenient facility for tagging packets which come from _it_, which is great. +But in our case, we need to be able to allow traffic which both does _not_ come from WireGuard and _also_ is not destined for another Kubernetes node to flow through the normal mechanisms. + +Unlike many corporate or privacy-oriented VPNs, we need to allow general internet traffic to flow normally. + +Also, as our cluster grows, this set of IP addresses can become quite large and quite dynamic. +This would be very cumbersome and slow in `iptables`. +Luckily, the kernel supplies a convenient mechanism by which to define this arbitrarily large set of IP addresses: IP sets. + +Talos collects all of the IPs and subnets which are considered "in-cluster" and maintains these in the kernel as an IP set. + +Now that we have the IP set defined, we need to tell the kernel how to use it. + +The traditional way of doing this would be to use `iptables`. +However, there is a big problem with IPTables. +It is a common namespace in which any number of other pieces of software may dump things. +We have no surety that what we add will not be wiped out by something else (from Kubernetes itself, to the CNI, to some workload application), be rendered unusable by higher-priority rules, or just generally cause trouble and conflicts. + +Instead, we use a three-pronged system which is both more foundational and less centralised. + +NFTables offers a separately namespaced, decentralised way of marking packets for later processing based on IP sets. +Instead of a common set of well-known tables, NFTables uses hooks into the kernel's netfilter system, which are less vulnerable to being usurped, bypassed, or a source of interference than IPTables, but which are rendered down by the kernel to the same underlying XTables system. + +Our NFTables system is where we store the IP sets. +Any packet which enters the system, either by forward from inside Kubernetes or by generation from the host itself, is compared against a hash table of this IP set. +If it is matched, it is marked for later processing by our next stage. +This is a high-performance system which exists fully in the kernel and which ultimately becomes an eBPF program, so it scales well to hundreds of nodes. + +The next stage is the kernel router's route rules. +These are defined as a common ordered list of operations for the whole operating system, but they are intended to be tightly constrained and are rarely used by applications in any case. +The rules we add are very simple: if a packet is marked by our NFTables system, send it to an alternate routing table. + +This leads us to our third and final stage of packet routing. +We have a custom routing table with two rules: + +- send all IPv4 traffic to the WireGuard interface +- send all IPv6 traffic to the WireGuard interface + +So in summary, we: + +- mark packets destined for Kubernetes applications or Kubernetes nodes +- send marked packets to a special routing table +- send anything which is sent to that routing table through the WireGuard interface + +This gives us an isolated, resilient, tolerant, and non-invasive way to route Kubernetes traffic safely, automatically, and transparently through WireGuard across almost any set of network topologies. + +## Design Decisions + +### Routing + +Routing for Wireguard is a touch complicated when the set of possible peer +endpoints includes at least one member of the set of _destinations_. +That is, packets from Wireguard to a peer endpoint should not be sent to +Wireguard, lest a loop be created. + +In order to handle this situation, Wireguard provides the ability to mark +packets which it generates, so their routing can be handled separately. + +In our case, though, we actually want the inverse of this: we want to route +Wireguard packets however the normal networking routes and rules say they should +be routed, while packets destined for the other side of Wireguard Peers should +be forced into Wireguard interfaces. + +While IP Rules allow you to invert matches, they do not support matching based +on IP sets. +That means, to use simple rules, we would have to add a rule for +each destination, which could reach into hundreds or thousands of rules to +manage. +This is not really much of a performance issue, but it is a management +issue, since it is expected that we would not be the only manager of rules in +the system, and rules offer no facility to tag for ownership. + +IP Sets are supported by IPTables, and we could integrate there. +However, IPTables exists in a global namespace, which makes it fragile having +multiple parties manipulating it. +The newer NFTables replacement for IPTables, though, allows users to +independently hook into various points of XTables, keeping all such rules and +sets independent. +This means that regardless of what CNIs or other user-side routing rules may do, +our KubeSpan setup will not be messed up. + +Therefore, we utilise NFTables (which natively supports IP sets and owner +grouping) instead, to mark matching traffic which should be sent to the +Wireguard interface. +This way, we can keep all our KubeSpan set logic in one place, allowing us to +simply use a single `ip rule` match: +for our fwmark, and sending those matched packets to a separate routing table +with one rule: default to the wireguard interface. + +So we have three components: + + 1. A routing table for Wireguard-destined packets + 2. An NFTables table which defines the set of destinations packets to which will + be marked with our firewall mark. + - Hook into PreRouting (type Filter) + - Hook into Outgoing (type Route) + 3. One IP Rule which sends packets marked with our firewall mark to our Wireguard + routing table. + +### Routing Table + +The routing table (number 180 by default) is simple, containing a single route for each family: send everything through the Wireguard interface. + +### NFTables + +The logic inside NFTables is fairly simple. +First, everything is compiled into a single table: `talos_kubespan`. + +Next, two chains are set up: one for the `prerouting` hook (`kubespan_prerouting`) +and the other for the `outgoing` hook (`kubespan_outgoing`). + +We define two sets of target IP prefixes: one for IPv6 (`kubespan_targets_ipv6`) +and the other for IPv4 (`kubespan_targets_ipv4`). + +Last, we add rules to each chain which basically specify: + + 1. If the packet is marked as _from_ Wireguard, just accept it and terminate + the chain. + 2. If the packet matches an IP in either of the target IP sets, mark that + packet with the _to_ Wireguard mark. + +### Rules + +There are two route rules defined: one to match IPv6 packets and the other to +match IPv4 packets. + +These rules say the same thing for each: if the packet is marked that it should +go _to_ Wireguard, send it to the Wireguard +routing table. + +### Firewall Mark + +KubeSpan is using only two bits of the firewall mark with the mask `0x00000060`. + +> Note: if other software on the node is using the bits `0x60` of the firewall mark, this +> might cause conflicts and break KubeSpan. +> +> At the moment of the writing, it was confirmed that Calico CNI is using bits `0xffff0000` and +> Cilium CNI is using bits `0xf00`, so KubeSpan is compatible with both. +> Flannel CNI uses `0x4000` mask, so it is also compatible. + +In the routing rules table, we match on the mark `0x40` with the mask `0x60`: + +```text +32500: from all fwmark 0x40/0x60 lookup 180 +``` + +In the NFTables table, we match with the same mask `0x60` and we set the mask by only modifying +bits from the `0x60` mask: + +```text +meta mark & 0x00000060 == 0x00000020 accept +ip daddr @kubespan_targets_ipv4 meta mark set meta mark & 0xffffffdf | 0x00000040 accept +ip6 daddr @kubespan_targets_ipv6 meta mark set meta mark & 0xffffffdf | 0x00000040 accept +``` diff --git a/website/content/v1.6/learn-more/networking-resources.md b/website/content/v1.6/learn-more/networking-resources.md new file mode 100644 index 0000000000..35bf81b207 --- /dev/null +++ b/website/content/v1.6/learn-more/networking-resources.md @@ -0,0 +1,434 @@ +--- +title: "Networking Resources" +weight: 70 +description: "Delve deeper into networking of Talos Linux." +--- + +Talos network configuration subsystem is powered by [COSI]({{< relref "controllers-resources" >}}). +Talos translates network configuration from multiple sources: machine configuration, cloud metadata, network automatic configuration (e.g. DHCP) into COSI resources. + +Network configuration and network state can be inspected using `talosctl get` command. + +Network machine configuration can be modified using `talosctl edit mc` command (also variants `talosctl patch mc`, `talosctl apply-config`) without a reboot. +As API access requires network connection, [`--mode=try`]({{< relref "../talos-guides/configuration/editing-machine-configuration" >}}) +can be used to test the configuration with automatic rollback to avoid losing network access to the node. + +## Resources + +There are six basic network configuration items in Talos: + +* `Address` (IP address assigned to the interface/link); +* `Route` (route to a destination); +* `Link` (network interface/link configuration); +* `Resolver` (list of DNS servers); +* `Hostname` (node hostname and domainname); +* `TimeServer` (list of NTP servers). + +Each network configuration item has two counterparts: + +* `*Status` (e.g. `LinkStatus`) describes the current state of the system (Linux kernel state); +* `*Spec` (e.g. `LinkSpec`) defines the desired configuration. + +| Resource | Status | Spec | +|--------------------|------------------------|----------------------| +| `Address` | `AddressStatus` | `AddressSpec` | +| `Route` | `RouteStatus` | `RouteSpec` | +| `Link` | `LinkStatus` | `LinkSpec` | +| `Resolver` | `ResolverStatus` | `ResolverSpec` | +| `Hostname` | `HostnameStatus` | `HostnameSpec` | +| `TimeServer` | `TimeServerStatus` | `TimeServerSpec` | + +Status resources have aliases with the `Status` suffix removed, so for example +`AddressStatus` is also available as `Address`. + +Talos networking controllers reconcile the state so that `*Status` equals the desired `*Spec`. + +## Observing State + +The current network configuration state can be observed by querying `*Status` resources via +`talosctl`: + +```sh +$ talosctl get addresses +NODE NAMESPACE TYPE ID VERSION ADDRESS LINK +172.20.0.2 network AddressStatus eth0/172.20.0.2/24 1 172.20.0.2/24 eth0 +172.20.0.2 network AddressStatus eth0/fe80::9804:17ff:fe9d:3058/64 2 fe80::9804:17ff:fe9d:3058/64 eth0 +172.20.0.2 network AddressStatus flannel.1/10.244.4.0/32 1 10.244.4.0/32 flannel.1 +172.20.0.2 network AddressStatus flannel.1/fe80::10b5:44ff:fe62:6fb8/64 2 fe80::10b5:44ff:fe62:6fb8/64 flannel.1 +172.20.0.2 network AddressStatus lo/127.0.0.1/8 1 127.0.0.1/8 lo +172.20.0.2 network AddressStatus lo/::1/128 1 ::1/128 lo +``` + +In the output there are addresses set up by Talos (e.g. `eth0/172.20.0.2/24`) and +addresses set up by other facilities (e.g. `flannel.1/10.244.4.0/32` set up by CNI). + +Talos networking controllers watch the kernel state and update resources +accordingly. + +Additional details about the address can be accessed via the YAML output: + +```yaml +# talosctl get address eth0/172.20.0.2/24 -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: AddressStatuses.net.talos.dev + id: eth0/172.20.0.2/24 + version: 1 + owner: network.AddressStatusController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + address: 172.20.0.2/24 + local: 172.20.0.2 + broadcast: 172.20.0.255 + linkIndex: 4 + linkName: eth0 + family: inet4 + scope: global + flags: permanent +``` + +Resources can be watched for changes with the `--watch` flag to see how configuration changes over time. + +Other networking status resources can be inspected with `talosctl get routes`, `talosctl get links`, etc. +For example: + +```sh +$ talosctl get resolvers +NODE NAMESPACE TYPE ID VERSION RESOLVERS +172.20.0.2 network ResolverStatus resolvers 2 ["8.8.8.8","1.1.1.1"] +``` + +```yaml +# talosctl get links -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: LinkStatuses.net.talos.dev + id: eth0 + version: 2 + owner: network.LinkStatusController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + index: 4 + type: ether + linkIndex: 0 + flags: UP,BROADCAST,RUNNING,MULTICAST,LOWER_UP + hardwareAddr: 4e:95:8e:8f:e4:47 + broadcastAddr: ff:ff:ff:ff:ff:ff + mtu: 1500 + queueDisc: pfifo_fast + operationalState: up + kind: "" + slaveKind: "" + driver: virtio_net + linkState: true + speedMbit: 4294967295 + port: Other + duplex: Unknown +``` + +## Inspecting Configuration + +The desired networking configuration is combined from multiple sources and presented +as `*Spec` resources: + +```sh +$ talosctl get addressspecs +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 network AddressSpec eth0/172.20.0.2/24 2 +172.20.0.2 network AddressSpec lo/127.0.0.1/8 2 +172.20.0.2 network AddressSpec lo/::1/128 2 +``` + +These `AddressSpecs` are applied to the Linux kernel to reach the desired state. +If, for example, an `AddressSpec` is removed, the address is removed from the Linux network interface as well. + +`*Spec` resources can't be manipulated directly, they are generated automatically by Talos +from multiple configuration sources (see a section below for details). + +If a `*Spec` resource is queried in YAML format, some additional information is available: + +```yaml +# talosctl get addressspecs eth0/172.20.0.2/24 -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: AddressSpecs.net.talos.dev + id: eth0/172.20.0.2/24 + version: 2 + owner: network.AddressMergeController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z + finalizers: + - network.AddressSpecController +spec: + address: 172.20.0.2/24 + linkName: eth0 + family: inet4 + scope: global + flags: permanent + layer: operator +``` + +An important field is the `layer` field, which describes a configuration layer this spec is coming from: in this case, it's generated by a network operator (see below) and is set by the DHCPv4 operator. + +## Configuration Merging + +Spec resources described in the previous section show the final merged configuration state, +while initial specs are put to a different unmerged namespace `network-config`. +Spec resources in the `network-config` namespace are merged with conflict resolution to produce the final merged representation in the `network` namespace. + +Let's take `HostnameSpec` as an example. +The final merged representation is: + +```yaml +# talosctl get hostnamespec -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: HostnameSpecs.net.talos.dev + id: hostname + version: 2 + owner: network.HostnameMergeController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z + finalizers: + - network.HostnameSpecController +spec: + hostname: talos-default-controlplane-1 + domainname: "" + layer: operator +``` + +We can see that the final configuration for the hostname is `talos-default-controlplane-1`. +And this is the hostname that was actually applied. +This can be verified by querying a `HostnameStatus` resource: + +```sh +$ talosctl get hostnamestatus +NODE NAMESPACE TYPE ID VERSION HOSTNAME DOMAINNAME +172.20.0.2 network HostnameStatus hostname 1 talos-default-controlplane-1 +``` + +Initial configuration for the hostname in the `network-config` namespace is: + +```yaml +# talosctl get hostnamespec -o yaml --namespace network-config +node: 172.20.0.2 +metadata: + namespace: network-config + type: HostnameSpecs.net.talos.dev + id: default/hostname + version: 2 + owner: network.HostnameConfigController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + hostname: talos-172-20-0-2 + domainname: "" + layer: default +--- +node: 172.20.0.2 +metadata: + namespace: network-config + type: HostnameSpecs.net.talos.dev + id: dhcp4/eth0/hostname + version: 1 + owner: network.OperatorSpecController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + hostname: talos-default-controlplane-1 + domainname: "" + layer: operator +``` + +We can see that there are two specs for the hostname: + +* one from the `default` configuration layer which defines the hostname as `talos-172-20-0-2` (default driven by the default node address); +* another one from the layer `operator` that defines the hostname as `talos-default-controlplane-1` (DHCP). + +Talos merges these two specs into a final `HostnameSpec` based on the configuration layer and merge rules. +Here is the order of precedence from low to high: + +* `default` (defaults provided by Talos); +* `cmdline` (from the kernel command line); +* `platform` (driven by the cloud provider); +* `operator` (various dynamic configuration options: DHCP, Virtual IP, etc); +* `configuration` (derived from the machine configuration). + +So in our example the `operator` layer `HostnameSpec` overrides the `default` layer producing the final hostname `talos-default-controlplane-1`. + +The merge process applies to all six core networking specs. +For each spec, the `layer` controls the merge behavior +If multiple configuration specs +appear at the same layer, they can be merged together if possible, otherwise merge result +is stable but not defined (e.g. if DHCP on multiple interfaces provides two different hostnames for the node). + +`LinkSpecs` are merged across layers, so for example, machine configuration for the interface MTU overrides an MTU set by the DHCP server. + +## Network Operators + +Network operators provide dynamic network configuration which can change over time as the node is running: + +* DHCPv4 +* DHCPv6 +* Virtual IP + +Network operators produce specs for addresses, routes, links, etc., which are then merged and applied according to the rules described above. + +Operators are configured with `OperatorSpec` resources which describe when operators +should run and additional configuration for the operator: + +```yaml +# talosctl get operatorspecs -o yaml +node: 172.20.0.2 +metadata: + namespace: network + type: OperatorSpecs.net.talos.dev + id: dhcp4/eth0 + version: 1 + owner: network.OperatorConfigController + phase: running + created: 2021-06-29T20:23:18Z + updated: 2021-06-29T20:23:18Z +spec: + operator: dhcp4 + linkName: eth0 + requireUp: true + dhcp4: + routeMetric: 1024 +``` + +`OperatorSpec` resources are generated by Talos based on machine configuration mostly. +DHCP4 operator is created automatically for all physical network links which are not configured explicitly via the kernel command line or the machine configuration. +This also means that on the first boot, without a machine configuration, a DHCP request is made on all physical network interfaces by default. + +Specs generated by operators are prefixed with the operator ID (`dhcp4/eth0` in the example above) in the unmerged `network-config` namespace: + +```sh +$ talosctl -n 172.20.0.2 get addressspecs --namespace network-config +NODE NAMESPACE TYPE ID VERSION +172.20.0.2 network-config AddressSpec dhcp4/eth0/eth0/172.20.0.2/24 1 +``` + +## Other Network Resources + +There are some additional resources describing the network subsystem state. + +The `NodeAddress` resource presents node addresses excluding link-local and loopback addresses: + +```sh +$ talosctl get nodeaddresses +NODE NAMESPACE TYPE ID VERSION ADDRESSES +10.100.2.23 network NodeAddress accumulative 6 ["10.100.2.23","147.75.98.173","147.75.195.143","192.168.95.64","2604:1380:1:ca00::17"] +10.100.2.23 network NodeAddress current 5 ["10.100.2.23","147.75.98.173","192.168.95.64","2604:1380:1:ca00::17"] +10.100.2.23 network NodeAddress default 1 ["10.100.2.23"] +``` + +* `default` is the node default address; +* `current` is the set of addresses a node currently has; +* `accumulative` is the set of addresses a node had over time (it might include virtual IPs which are not owned by the node at the moment). + +`NodeAddress` resources are used to pick up the default address for `etcd` peer URL, to populate SANs field in the generated certificates, etc. + +Another important resource is `Nodename` which provides `Node` name in Kubernetes: + +```sh +$ talosctl get nodename +NODE NAMESPACE TYPE ID VERSION NODENAME +10.100.2.23 controlplane Nodename nodename 1 infra-green-cp-mmf7v +``` + +Depending on the machine configuration `nodename` might be just a hostname or the FQDN of the node. + +`NetworkStatus` aggregates the current state of the network configuration: + +```yaml +# talosctl get networkstatus -o yaml +node: 10.100.2.23 +metadata: + namespace: network + type: NetworkStatuses.net.talos.dev + id: status + version: 5 + owner: network.StatusController + phase: running + created: 2021-06-24T18:56:00Z + updated: 2021-06-24T18:56:02Z +spec: + addressReady: true + connectivityReady: true + hostnameReady: true + etcFilesReady: true +``` + +## Network Controllers + +For each of the six basic resource types, there are several controllers: + +* `*StatusController` populates `*Status` resources observing the Linux kernel state. +* `*ConfigController` produces the initial unmerged `*Spec` resources in the `network-config` namespace based on defaults, kernel command line, and machine configuration. +* `*MergeController` merges `*Spec` resources into the final representation in the `network` namespace. +* `*SpecController` applies merged `*Spec` resources to the kernel state. + +For the network operators: + +* `OperatorConfigController` produces `OperatorSpec` resources based on machine configuration and deafauls. +* `OperatorSpecController` runs network operators watching `OperatorSpec` resources and producing various `*Spec` resources in the `network-config` namespace. + +## Configuration Sources + +There are several configuration sources for the network configuration, which are described in this section. + +### Defaults + +* `lo` interface is assigned addresses `127.0.0.1/8` and `::1/128`; +* hostname is set to the `talos-` where `IP` is the default node address; +* resolvers are set to `8.8.8.8`, `1.1.1.1`; +* time servers are set to `pool.ntp.org`; +* DHCP4 operator is run on any physical interface which is not configured explicitly. + +### Cmdline + +The kernel [command line]({{< relref "../reference/kernel" >}}) is parsed for the following options: + +* `ip=` option is parsed for node IP, default gateway, hostname, DNS servers, NTP servers; +* `bond=` option is parsed for bonding interfaces and their options; +* `talos.hostname=` option is used to set node hostname; +* `talos.network.interface.ignore=` can be used to make Talos skip network interface configuration completely. + +### Platform + +Platform configuration delivers cloud environment-specific options (e.g. the hostname). + +Platform configuration is specific to the environment metadata: for example, on Equinix Metal, Talos automatically +configures public and private IPs, routing, link bonding, hostname. + +Platform configuration is cached across reboots in `/system/state/platform-network.yaml`. + +### Operator + +Network operators provide configuration for all basic resource types. + +### Machine Configuration + +The machine configuration is parsed for link configuration, addresses, routes, hostname, +resolvers and time servers. +Any changes to `.machine.network` configuration can be applied in immediate mode. + +## Network Configuration Debugging + +Most of the network controller operations and failures are logged to the kernel console, +additional logs with `debug` level are available with `talosctl logs controller-runtime` command. +If the network configuration can't be established and the API is not available, `debug` level +logs can be sent to the console with `debug: true` option in the machine configuration. diff --git a/website/content/v1.6/learn-more/philosophy.md b/website/content/v1.6/learn-more/philosophy.md new file mode 100644 index 0000000000..41a72c770e --- /dev/null +++ b/website/content/v1.6/learn-more/philosophy.md @@ -0,0 +1,110 @@ +--- +title: Philosophy +weight: 10 +description: "Learn about the philosophy behind the need for Talos Linux." +--- + +## Distributed + +Talos is intended to be operated in a distributed manner: it is built for a high-availability dataplane _first_. +Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). +Like Kubernetes, workloads are intended to be distributed across any number of compute nodes. + +There should be no single points of failure, and the level of required coordination is as low as each platform allows. + +## Immutable + +Talos takes immutability very seriously. +Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. +All images are signed and delivered as single, versioned files. +We can always run integrity checks on our image to verify that it has not been modified. + +While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. +We call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. +Thus, if all else fails, we can always wipe the disk and get back up and running. + +## Minimal + +We are always trying to reduce Talos' footprint. +Because nearly the entire OS is built from scratch in Go, we are +in a good position. +We have no shell. +We have no SSH. +We have none of the GNU utilities, not even a rollup tool such as busybox. +Everything in Talos is there because it is necessary, and +nothing is included which isn't. + +As a result, the OS right now produces a SquashFS image size of less than **80 MB**. + +## Ephemeral + +Everything Talos writes to its disk is either replicated or reconstructable. +Since the controlplane is highly available, the loss of any node will cause +neither service disruption nor loss of data. +No writes are even allowed to the vast majority of the filesystem. +We even call the writable partition "ephemeral" to keep this idea always in +focus. + +## Secure + +Talos has always been designed with security in mind. +With its immutability, its minimalism, its signing, and its componenture, we are +able to simply bypass huge classes of vulnerabilities. +Moreover, because of the way we have designed Talos, we are able to take +advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and completely disabling dynamic modules. + +There are no passwords in Talos. +All networked communication is encrypted and key-authenticated. +The Talos certificates are short-lived and automatically-rotating. +Kubernetes is always constructed with its own separate PKI structure which is +enforced. + +## Declarative + +Everything which can be configured in Talos is done through a single YAML +manifest. +There is no scripting and no procedural steps. +Everything is defined by the one declarative YAML file. +This configuration includes that of both Talos itself and the Kubernetes which +it forms. + +This is achievable because Talos is tightly focused to do one thing: run +Kubernetes, in the easiest, most secure, most reliable way it can. + +## Not based on X distro + +Talos Linux _isn't_ based on any other distribution. +We think of ourselves as being the second-generation of +container-optimised operating systems, where things like CoreOS, Flatcar, and Rancher represent the first generation (but the technology is not derived from any of those.) + +Talos Linux is actually a ground-up rewrite of the userspace, from PID 1. +We run the Linux kernel, but everything downstream of that is our own custom +code, written in Go, rigorously-tested, and published as an immutable, +integrated image. +The Linux kernel launches what we call `machined`, for instance, not `systemd`. +There is no `systemd` on our system. +There are no GNU utilities, no shell, no SSH, no packages, nothing you could associate with +any other distribution. + +## An Operating System designed for Kubernetes + +Technically, Talos Linux installs to a computer like any other operating system. +_Unlike_ other operating systems, Talos is not meant to run alone, on a +single machine. +A design goal of Talos Linux is eliminating the management +of individual nodes as much as possible. +In order to do that, Talos Linux operates as a cluster of machines, with lots of +checking and coordination between them, at all levels. + +There is only a cluster. +Talos is meant to do one thing: maintain a Kubernetes cluster, and it does this +very, very well. + +The entirety of the configuration of any machine is specified by a single +configuration file, which can often be the _same_ configuration file used +across _many_ machines. +Much like a biological system, if some component misbehaves, just cut it out and +let a replacement grow. +Rebuilds of Talos are remarkably fast, whether they be new machines, upgrades, +or reinstalls. +Never get hung up on an individual machine. diff --git a/website/content/v1.6/learn-more/process-capabilities.md b/website/content/v1.6/learn-more/process-capabilities.md new file mode 100644 index 0000000000..e08b77b754 --- /dev/null +++ b/website/content/v1.6/learn-more/process-capabilities.md @@ -0,0 +1,23 @@ +--- +title: "Process Capabilities" +weight: 105 +description: "Understand the Linux process capabilities restrictions with Talos Linux." +--- + +Linux defines a set of [process capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) that can be used to fine-tune the process permissions. + +Talos Linux for security reasons restricts any process from gaining the following capabilities: + +* `CAP_SYS_MODULE` (loading kernel modules) +* `CAP_SYS_BOOT` (rebooting the system) + +This means that any process including privileged Kubernetes pods will not be able to get these capabilities. + +If you see the following error on starting a pod, make sure it doesn't have any of the capabilities listed above in the spec: + +```text +Error: failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply caps: operation not permitted: unknown +``` + +> Note: even with `CAP_SYS_MODULE` capability, Linux kernel module loading is restricted by requiring a valid signature. +> Talos Linux creates a throw away signing key during kernel build, so it's not possible to build/sign a kernel module for Talos Linux outside of the build process. diff --git a/website/content/v1.6/learn-more/talos-network-connectivity.md b/website/content/v1.6/learn-more/talos-network-connectivity.md new file mode 100644 index 0000000000..f30d49b1a2 --- /dev/null +++ b/website/content/v1.6/learn-more/talos-network-connectivity.md @@ -0,0 +1,74 @@ +--- +title: "Network Connectivity" +weight: 80 +description: "Description of the Networking Connectivity needed by Talos Linux" +aliases: + - ../guides/configuring-network-connectivity +--- + +## Configuring Network Connectivity + +The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. +This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. + +> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kuberenetes. +> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. + +### Control plane node(s) + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
+ +> Ports marked with a `*` are not currently configurable, but that may change in the future. +> [Follow along here](https://github.com/siderolabs/talos/issues/1836). + +### Worker node(s) + + + + + + + + + + + + + + + + + + + + +
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidControl plane nodes
+ +> Ports marked with a `*` are not currently configurable, but that may change in the future. +> [Follow along here](https://github.com/siderolabs/talos/issues/1836). diff --git a/website/content/v1.6/learn-more/talosctl.md b/website/content/v1.6/learn-more/talosctl.md new file mode 100644 index 0000000000..ff5d33b4a5 --- /dev/null +++ b/website/content/v1.6/learn-more/talosctl.md @@ -0,0 +1,62 @@ +--- +title: "talosctl" +weight: 110 +description: "The design and use of the Talos Linux control application." +--- + +The `talosctl` tool acts as a reference implementation for the Talos API, but it also handles a lot of +conveniences for the use of Talos and its clusters. + +### Video Walkthrough + +To see some live examples of talosctl usage, view the following video: + + + +## Client Configuration + +Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. +Otherwise it is in `$HOME/.talos/config`. +The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. + +Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. +It also comes with some intelligent tooling to manage the merging of new contexts into the config. +The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. +You can easily overwrite instead, as well. +See the `talosctl config help` for more information. + +## Endpoints and Nodes + +![Endpoints and Nodes](/images/endpoints-and-nodes.png) + +`endpoints` are the communication endpoints to which the client directly talks. +These can be load balancers, DNS hostnames, a list of IPs, etc. +If multiple endpoints are specified, the client will automatically load +balance and fail over between them. +It is recommended that these point to the set of control plane nodes, either directly or through a load balancer. + +Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. + +Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. + +The `node` is the target node on which you wish to perform the API call. +While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is recommended not to do so, but to explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. + +> When specifying nodes, their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. +> This is because all connections are proxied first through the endpoints. + +## Kubeconfig + +The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. +By default, `talosctl` will safely merge the cluster into the default kubeconfig. +Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. +The `--force` option can be used to overwrite instead. + +You can also specify an alternate path by supplying it as a positional parameter. + +Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any +number of kubernetes clusters from the same workstation. + +## Commands + +Please see the [CLI reference]({{< relref "../reference/cli" >}}) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v1.6/reference/_index.md b/website/content/v1.6/reference/_index.md new file mode 100644 index 0000000000..d548bde028 --- /dev/null +++ b/website/content/v1.6/reference/_index.md @@ -0,0 +1,4 @@ +--- +title: "Reference" +weight: 70 +--- diff --git a/website/content/v1.6/reference/api.md b/website/content/v1.6/reference/api.md new file mode 100644 index 0000000000..8b9e662f1a --- /dev/null +++ b/website/content/v1.6/reference/api.md @@ -0,0 +1,7524 @@ +--- +title: API +description: Talos gRPC API reference. +--- + +## Table of Contents + +- [common/common.proto](#common/common.proto) + - [Data](#common.Data) + - [DataResponse](#common.DataResponse) + - [Empty](#common.Empty) + - [EmptyResponse](#common.EmptyResponse) + - [Error](#common.Error) + - [Metadata](#common.Metadata) + - [NetIP](#common.NetIP) + - [NetIPPort](#common.NetIPPort) + - [NetIPPrefix](#common.NetIPPrefix) + - [PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) + - [PEMEncodedKey](#common.PEMEncodedKey) + - [URL](#common.URL) + + - [Code](#common.Code) + - [ContainerDriver](#common.ContainerDriver) + - [ContainerdNamespace](#common.ContainerdNamespace) + + - [File-level Extensions](#common/common.proto-extensions) + +- [resource/definitions/cluster/cluster.proto](#resource/definitions/cluster/cluster.proto) + - [AffiliateSpec](#talos.resource.definitions.cluster.AffiliateSpec) + - [ConfigSpec](#talos.resource.definitions.cluster.ConfigSpec) + - [ControlPlane](#talos.resource.definitions.cluster.ControlPlane) + - [IdentitySpec](#talos.resource.definitions.cluster.IdentitySpec) + - [InfoSpec](#talos.resource.definitions.cluster.InfoSpec) + - [KubeSpanAffiliateSpec](#talos.resource.definitions.cluster.KubeSpanAffiliateSpec) + - [MemberSpec](#talos.resource.definitions.cluster.MemberSpec) + +- [resource/definitions/cri/cri.proto](#resource/definitions/cri/cri.proto) + - [SeccompProfileSpec](#talos.resource.definitions.cri.SeccompProfileSpec) + +- [resource/definitions/enums/enums.proto](#resource/definitions/enums/enums.proto) + - [KubespanPeerState](#talos.resource.definitions.enums.KubespanPeerState) + - [MachineType](#talos.resource.definitions.enums.MachineType) + - [NethelpersADSelect](#talos.resource.definitions.enums.NethelpersADSelect) + - [NethelpersARPAllTargets](#talos.resource.definitions.enums.NethelpersARPAllTargets) + - [NethelpersARPValidate](#talos.resource.definitions.enums.NethelpersARPValidate) + - [NethelpersAddressFlag](#talos.resource.definitions.enums.NethelpersAddressFlag) + - [NethelpersBondMode](#talos.resource.definitions.enums.NethelpersBondMode) + - [NethelpersBondXmitHashPolicy](#talos.resource.definitions.enums.NethelpersBondXmitHashPolicy) + - [NethelpersDuplex](#talos.resource.definitions.enums.NethelpersDuplex) + - [NethelpersFailOverMAC](#talos.resource.definitions.enums.NethelpersFailOverMAC) + - [NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) + - [NethelpersLACPRate](#talos.resource.definitions.enums.NethelpersLACPRate) + - [NethelpersLinkType](#talos.resource.definitions.enums.NethelpersLinkType) + - [NethelpersOperationalState](#talos.resource.definitions.enums.NethelpersOperationalState) + - [NethelpersPort](#talos.resource.definitions.enums.NethelpersPort) + - [NethelpersPrimaryReselect](#talos.resource.definitions.enums.NethelpersPrimaryReselect) + - [NethelpersRouteFlag](#talos.resource.definitions.enums.NethelpersRouteFlag) + - [NethelpersRouteProtocol](#talos.resource.definitions.enums.NethelpersRouteProtocol) + - [NethelpersRouteType](#talos.resource.definitions.enums.NethelpersRouteType) + - [NethelpersRoutingTable](#talos.resource.definitions.enums.NethelpersRoutingTable) + - [NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) + - [NethelpersVLANProtocol](#talos.resource.definitions.enums.NethelpersVLANProtocol) + - [NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) + - [NetworkOperator](#talos.resource.definitions.enums.NetworkOperator) + - [RuntimeMachineStage](#talos.resource.definitions.enums.RuntimeMachineStage) + +- [resource/definitions/etcd/etcd.proto](#resource/definitions/etcd/etcd.proto) + - [ConfigSpec](#talos.resource.definitions.etcd.ConfigSpec) + - [ConfigSpec.ExtraArgsEntry](#talos.resource.definitions.etcd.ConfigSpec.ExtraArgsEntry) + - [MemberSpec](#talos.resource.definitions.etcd.MemberSpec) + - [PKIStatusSpec](#talos.resource.definitions.etcd.PKIStatusSpec) + - [SpecSpec](#talos.resource.definitions.etcd.SpecSpec) + - [SpecSpec.ExtraArgsEntry](#talos.resource.definitions.etcd.SpecSpec.ExtraArgsEntry) + +- [resource/definitions/extensions/extensions.proto](#resource/definitions/extensions/extensions.proto) + - [Compatibility](#talos.resource.definitions.extensions.Compatibility) + - [Constraint](#talos.resource.definitions.extensions.Constraint) + - [Layer](#talos.resource.definitions.extensions.Layer) + - [Metadata](#talos.resource.definitions.extensions.Metadata) + +- [resource/definitions/files/files.proto](#resource/definitions/files/files.proto) + - [EtcFileSpecSpec](#talos.resource.definitions.files.EtcFileSpecSpec) + - [EtcFileStatusSpec](#talos.resource.definitions.files.EtcFileStatusSpec) + +- [resource/definitions/hardware/hardware.proto](#resource/definitions/hardware/hardware.proto) + - [MemoryModuleSpec](#talos.resource.definitions.hardware.MemoryModuleSpec) + - [ProcessorSpec](#talos.resource.definitions.hardware.ProcessorSpec) + - [SystemInformationSpec](#talos.resource.definitions.hardware.SystemInformationSpec) + +- [resource/definitions/k8s/k8s.proto](#resource/definitions/k8s/k8s.proto) + - [APIServerConfigSpec](#talos.resource.definitions.k8s.APIServerConfigSpec) + - [APIServerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.APIServerConfigSpec.EnvironmentVariablesEntry) + - [APIServerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.APIServerConfigSpec.ExtraArgsEntry) + - [AdmissionControlConfigSpec](#talos.resource.definitions.k8s.AdmissionControlConfigSpec) + - [AdmissionPluginSpec](#talos.resource.definitions.k8s.AdmissionPluginSpec) + - [AuditPolicyConfigSpec](#talos.resource.definitions.k8s.AuditPolicyConfigSpec) + - [BootstrapManifestsConfigSpec](#talos.resource.definitions.k8s.BootstrapManifestsConfigSpec) + - [ConfigStatusSpec](#talos.resource.definitions.k8s.ConfigStatusSpec) + - [ControllerManagerConfigSpec](#talos.resource.definitions.k8s.ControllerManagerConfigSpec) + - [ControllerManagerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.ControllerManagerConfigSpec.EnvironmentVariablesEntry) + - [ControllerManagerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.ControllerManagerConfigSpec.ExtraArgsEntry) + - [EndpointSpec](#talos.resource.definitions.k8s.EndpointSpec) + - [ExtraManifest](#talos.resource.definitions.k8s.ExtraManifest) + - [ExtraManifest.ExtraHeadersEntry](#talos.resource.definitions.k8s.ExtraManifest.ExtraHeadersEntry) + - [ExtraManifestsConfigSpec](#talos.resource.definitions.k8s.ExtraManifestsConfigSpec) + - [ExtraVolume](#talos.resource.definitions.k8s.ExtraVolume) + - [KubePrismConfigSpec](#talos.resource.definitions.k8s.KubePrismConfigSpec) + - [KubePrismEndpoint](#talos.resource.definitions.k8s.KubePrismEndpoint) + - [KubePrismEndpointsSpec](#talos.resource.definitions.k8s.KubePrismEndpointsSpec) + - [KubePrismStatusesSpec](#talos.resource.definitions.k8s.KubePrismStatusesSpec) + - [KubeletConfigSpec](#talos.resource.definitions.k8s.KubeletConfigSpec) + - [KubeletConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.KubeletConfigSpec.ExtraArgsEntry) + - [KubeletSpecSpec](#talos.resource.definitions.k8s.KubeletSpecSpec) + - [ManifestSpec](#talos.resource.definitions.k8s.ManifestSpec) + - [ManifestStatusSpec](#talos.resource.definitions.k8s.ManifestStatusSpec) + - [NodeIPConfigSpec](#talos.resource.definitions.k8s.NodeIPConfigSpec) + - [NodeIPSpec](#talos.resource.definitions.k8s.NodeIPSpec) + - [NodeLabelSpecSpec](#talos.resource.definitions.k8s.NodeLabelSpecSpec) + - [NodeStatusSpec](#talos.resource.definitions.k8s.NodeStatusSpec) + - [NodeStatusSpec.AnnotationsEntry](#talos.resource.definitions.k8s.NodeStatusSpec.AnnotationsEntry) + - [NodeStatusSpec.LabelsEntry](#talos.resource.definitions.k8s.NodeStatusSpec.LabelsEntry) + - [NodeTaintSpecSpec](#talos.resource.definitions.k8s.NodeTaintSpecSpec) + - [NodenameSpec](#talos.resource.definitions.k8s.NodenameSpec) + - [Resources](#talos.resource.definitions.k8s.Resources) + - [Resources.LimitsEntry](#talos.resource.definitions.k8s.Resources.LimitsEntry) + - [Resources.RequestsEntry](#talos.resource.definitions.k8s.Resources.RequestsEntry) + - [SchedulerConfigSpec](#talos.resource.definitions.k8s.SchedulerConfigSpec) + - [SchedulerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.SchedulerConfigSpec.EnvironmentVariablesEntry) + - [SchedulerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.SchedulerConfigSpec.ExtraArgsEntry) + - [SecretsStatusSpec](#talos.resource.definitions.k8s.SecretsStatusSpec) + - [SingleManifest](#talos.resource.definitions.k8s.SingleManifest) + - [StaticPodServerStatusSpec](#talos.resource.definitions.k8s.StaticPodServerStatusSpec) + - [StaticPodSpec](#talos.resource.definitions.k8s.StaticPodSpec) + - [StaticPodStatusSpec](#talos.resource.definitions.k8s.StaticPodStatusSpec) + +- [resource/definitions/kubeaccess/kubeaccess.proto](#resource/definitions/kubeaccess/kubeaccess.proto) + - [ConfigSpec](#talos.resource.definitions.kubeaccess.ConfigSpec) + +- [resource/definitions/kubespan/kubespan.proto](#resource/definitions/kubespan/kubespan.proto) + - [ConfigSpec](#talos.resource.definitions.kubespan.ConfigSpec) + - [EndpointSpec](#talos.resource.definitions.kubespan.EndpointSpec) + - [IdentitySpec](#talos.resource.definitions.kubespan.IdentitySpec) + - [PeerSpecSpec](#talos.resource.definitions.kubespan.PeerSpecSpec) + - [PeerStatusSpec](#talos.resource.definitions.kubespan.PeerStatusSpec) + +- [resource/definitions/network/network.proto](#resource/definitions/network/network.proto) + - [AddressSpecSpec](#talos.resource.definitions.network.AddressSpecSpec) + - [AddressStatusSpec](#talos.resource.definitions.network.AddressStatusSpec) + - [BondMasterSpec](#talos.resource.definitions.network.BondMasterSpec) + - [BondSlave](#talos.resource.definitions.network.BondSlave) + - [BridgeMasterSpec](#talos.resource.definitions.network.BridgeMasterSpec) + - [BridgeSlave](#talos.resource.definitions.network.BridgeSlave) + - [DHCP4OperatorSpec](#talos.resource.definitions.network.DHCP4OperatorSpec) + - [DHCP6OperatorSpec](#talos.resource.definitions.network.DHCP6OperatorSpec) + - [HardwareAddrSpec](#talos.resource.definitions.network.HardwareAddrSpec) + - [HostnameSpecSpec](#talos.resource.definitions.network.HostnameSpecSpec) + - [HostnameStatusSpec](#talos.resource.definitions.network.HostnameStatusSpec) + - [LinkRefreshSpec](#talos.resource.definitions.network.LinkRefreshSpec) + - [LinkSpecSpec](#talos.resource.definitions.network.LinkSpecSpec) + - [LinkStatusSpec](#talos.resource.definitions.network.LinkStatusSpec) + - [NodeAddressFilterSpec](#talos.resource.definitions.network.NodeAddressFilterSpec) + - [NodeAddressSpec](#talos.resource.definitions.network.NodeAddressSpec) + - [OperatorSpecSpec](#talos.resource.definitions.network.OperatorSpecSpec) + - [ProbeSpecSpec](#talos.resource.definitions.network.ProbeSpecSpec) + - [ProbeStatusSpec](#talos.resource.definitions.network.ProbeStatusSpec) + - [ResolverSpecSpec](#talos.resource.definitions.network.ResolverSpecSpec) + - [ResolverStatusSpec](#talos.resource.definitions.network.ResolverStatusSpec) + - [RouteSpecSpec](#talos.resource.definitions.network.RouteSpecSpec) + - [RouteStatusSpec](#talos.resource.definitions.network.RouteStatusSpec) + - [STPSpec](#talos.resource.definitions.network.STPSpec) + - [StatusSpec](#talos.resource.definitions.network.StatusSpec) + - [TCPProbeSpec](#talos.resource.definitions.network.TCPProbeSpec) + - [TimeServerSpecSpec](#talos.resource.definitions.network.TimeServerSpecSpec) + - [TimeServerStatusSpec](#talos.resource.definitions.network.TimeServerStatusSpec) + - [VIPEquinixMetalSpec](#talos.resource.definitions.network.VIPEquinixMetalSpec) + - [VIPHCloudSpec](#talos.resource.definitions.network.VIPHCloudSpec) + - [VIPOperatorSpec](#talos.resource.definitions.network.VIPOperatorSpec) + - [VLANSpec](#talos.resource.definitions.network.VLANSpec) + - [WireguardPeer](#talos.resource.definitions.network.WireguardPeer) + - [WireguardSpec](#talos.resource.definitions.network.WireguardSpec) + +- [resource/definitions/perf/perf.proto](#resource/definitions/perf/perf.proto) + - [CPUSpec](#talos.resource.definitions.perf.CPUSpec) + - [CPUStat](#talos.resource.definitions.perf.CPUStat) + - [MemorySpec](#talos.resource.definitions.perf.MemorySpec) + +- [resource/definitions/proto/proto.proto](#resource/definitions/proto/proto.proto) + - [Mount](#talos.resource.definitions.proto.Mount) + +- [resource/definitions/runtime/runtime.proto](#resource/definitions/runtime/runtime.proto) + - [DevicesStatusSpec](#talos.resource.definitions.runtime.DevicesStatusSpec) + - [EventSinkConfigSpec](#talos.resource.definitions.runtime.EventSinkConfigSpec) + - [KernelModuleSpecSpec](#talos.resource.definitions.runtime.KernelModuleSpecSpec) + - [KernelParamSpecSpec](#talos.resource.definitions.runtime.KernelParamSpecSpec) + - [KernelParamStatusSpec](#talos.resource.definitions.runtime.KernelParamStatusSpec) + - [KmsgLogConfigSpec](#talos.resource.definitions.runtime.KmsgLogConfigSpec) + - [MachineStatusSpec](#talos.resource.definitions.runtime.MachineStatusSpec) + - [MachineStatusStatus](#talos.resource.definitions.runtime.MachineStatusStatus) + - [MaintenanceServiceConfigSpec](#talos.resource.definitions.runtime.MaintenanceServiceConfigSpec) + - [MetaKeySpec](#talos.resource.definitions.runtime.MetaKeySpec) + - [MountStatusSpec](#talos.resource.definitions.runtime.MountStatusSpec) + - [PlatformMetadataSpec](#talos.resource.definitions.runtime.PlatformMetadataSpec) + - [SecurityStateSpec](#talos.resource.definitions.runtime.SecurityStateSpec) + - [UnmetCondition](#talos.resource.definitions.runtime.UnmetCondition) + +- [resource/definitions/secrets/secrets.proto](#resource/definitions/secrets/secrets.proto) + - [APICertsSpec](#talos.resource.definitions.secrets.APICertsSpec) + - [CertSANSpec](#talos.resource.definitions.secrets.CertSANSpec) + - [EtcdCertsSpec](#talos.resource.definitions.secrets.EtcdCertsSpec) + - [EtcdRootSpec](#talos.resource.definitions.secrets.EtcdRootSpec) + - [KubeletSpec](#talos.resource.definitions.secrets.KubeletSpec) + - [KubernetesCertsSpec](#talos.resource.definitions.secrets.KubernetesCertsSpec) + - [KubernetesDynamicCertsSpec](#talos.resource.definitions.secrets.KubernetesDynamicCertsSpec) + - [KubernetesRootSpec](#talos.resource.definitions.secrets.KubernetesRootSpec) + - [MaintenanceRootSpec](#talos.resource.definitions.secrets.MaintenanceRootSpec) + - [MaintenanceServiceCertsSpec](#talos.resource.definitions.secrets.MaintenanceServiceCertsSpec) + - [OSRootSpec](#talos.resource.definitions.secrets.OSRootSpec) + - [TrustdCertsSpec](#talos.resource.definitions.secrets.TrustdCertsSpec) + +- [resource/definitions/siderolink/siderolink.proto](#resource/definitions/siderolink/siderolink.proto) + - [ConfigSpec](#talos.resource.definitions.siderolink.ConfigSpec) + +- [resource/definitions/time/time.proto](#resource/definitions/time/time.proto) + - [AdjtimeStatusSpec](#talos.resource.definitions.time.AdjtimeStatusSpec) + - [StatusSpec](#talos.resource.definitions.time.StatusSpec) + +- [resource/definitions/v1alpha1/v1alpha1.proto](#resource/definitions/v1alpha1/v1alpha1.proto) + - [ServiceSpec](#talos.resource.definitions.v1alpha1.ServiceSpec) + +- [inspect/inspect.proto](#inspect/inspect.proto) + - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) + - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) + - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) + + - [DependencyEdgeType](#inspect.DependencyEdgeType) + + - [InspectService](#inspect.InspectService) + +- [machine/machine.proto](#machine/machine.proto) + - [AddressEvent](#machine.AddressEvent) + - [ApplyConfiguration](#machine.ApplyConfiguration) + - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) + - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) + - [BPFInstruction](#machine.BPFInstruction) + - [Bootstrap](#machine.Bootstrap) + - [BootstrapRequest](#machine.BootstrapRequest) + - [BootstrapResponse](#machine.BootstrapResponse) + - [CNIConfig](#machine.CNIConfig) + - [CPUInfo](#machine.CPUInfo) + - [CPUInfoResponse](#machine.CPUInfoResponse) + - [CPUStat](#machine.CPUStat) + - [CPUsInfo](#machine.CPUsInfo) + - [ClusterConfig](#machine.ClusterConfig) + - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) + - [ConfigLoadErrorEvent](#machine.ConfigLoadErrorEvent) + - [ConfigValidationErrorEvent](#machine.ConfigValidationErrorEvent) + - [ConnectRecord](#machine.ConnectRecord) + - [ConnectRecord.Process](#machine.ConnectRecord.Process) + - [Container](#machine.Container) + - [ContainerInfo](#machine.ContainerInfo) + - [ContainersRequest](#machine.ContainersRequest) + - [ContainersResponse](#machine.ContainersResponse) + - [ControlPlaneConfig](#machine.ControlPlaneConfig) + - [CopyRequest](#machine.CopyRequest) + - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) + - [DiskStat](#machine.DiskStat) + - [DiskStats](#machine.DiskStats) + - [DiskStatsResponse](#machine.DiskStatsResponse) + - [DiskUsageInfo](#machine.DiskUsageInfo) + - [DiskUsageRequest](#machine.DiskUsageRequest) + - [DmesgRequest](#machine.DmesgRequest) + - [EtcdAlarm](#machine.EtcdAlarm) + - [EtcdAlarmDisarm](#machine.EtcdAlarmDisarm) + - [EtcdAlarmDisarmResponse](#machine.EtcdAlarmDisarmResponse) + - [EtcdAlarmListResponse](#machine.EtcdAlarmListResponse) + - [EtcdDefragment](#machine.EtcdDefragment) + - [EtcdDefragmentResponse](#machine.EtcdDefragmentResponse) + - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) + - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) + - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) + - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) + - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) + - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) + - [EtcdMember](#machine.EtcdMember) + - [EtcdMemberAlarm](#machine.EtcdMemberAlarm) + - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) + - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) + - [EtcdMemberStatus](#machine.EtcdMemberStatus) + - [EtcdMembers](#machine.EtcdMembers) + - [EtcdRecover](#machine.EtcdRecover) + - [EtcdRecoverResponse](#machine.EtcdRecoverResponse) + - [EtcdRemoveMember](#machine.EtcdRemoveMember) + - [EtcdRemoveMemberByID](#machine.EtcdRemoveMemberByID) + - [EtcdRemoveMemberByIDRequest](#machine.EtcdRemoveMemberByIDRequest) + - [EtcdRemoveMemberByIDResponse](#machine.EtcdRemoveMemberByIDResponse) + - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) + - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) + - [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) + - [EtcdStatus](#machine.EtcdStatus) + - [EtcdStatusResponse](#machine.EtcdStatusResponse) + - [Event](#machine.Event) + - [EventsRequest](#machine.EventsRequest) + - [FeaturesInfo](#machine.FeaturesInfo) + - [FileInfo](#machine.FileInfo) + - [GenerateClientConfiguration](#machine.GenerateClientConfiguration) + - [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) + - [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) + - [GenerateConfiguration](#machine.GenerateConfiguration) + - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) + - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) + - [Hostname](#machine.Hostname) + - [HostnameResponse](#machine.HostnameResponse) + - [ImageListRequest](#machine.ImageListRequest) + - [ImageListResponse](#machine.ImageListResponse) + - [ImagePull](#machine.ImagePull) + - [ImagePullRequest](#machine.ImagePullRequest) + - [ImagePullResponse](#machine.ImagePullResponse) + - [InstallConfig](#machine.InstallConfig) + - [ListRequest](#machine.ListRequest) + - [LoadAvg](#machine.LoadAvg) + - [LoadAvgResponse](#machine.LoadAvgResponse) + - [LogsRequest](#machine.LogsRequest) + - [MachineConfig](#machine.MachineConfig) + - [MachineStatusEvent](#machine.MachineStatusEvent) + - [MachineStatusEvent.MachineStatus](#machine.MachineStatusEvent.MachineStatus) + - [MachineStatusEvent.MachineStatus.UnmetCondition](#machine.MachineStatusEvent.MachineStatus.UnmetCondition) + - [MemInfo](#machine.MemInfo) + - [Memory](#machine.Memory) + - [MemoryResponse](#machine.MemoryResponse) + - [MetaDelete](#machine.MetaDelete) + - [MetaDeleteRequest](#machine.MetaDeleteRequest) + - [MetaDeleteResponse](#machine.MetaDeleteResponse) + - [MetaWrite](#machine.MetaWrite) + - [MetaWriteRequest](#machine.MetaWriteRequest) + - [MetaWriteResponse](#machine.MetaWriteResponse) + - [MountStat](#machine.MountStat) + - [Mounts](#machine.Mounts) + - [MountsResponse](#machine.MountsResponse) + - [NetDev](#machine.NetDev) + - [Netstat](#machine.Netstat) + - [NetstatRequest](#machine.NetstatRequest) + - [NetstatRequest.Feature](#machine.NetstatRequest.Feature) + - [NetstatRequest.L4proto](#machine.NetstatRequest.L4proto) + - [NetstatRequest.NetNS](#machine.NetstatRequest.NetNS) + - [NetstatResponse](#machine.NetstatResponse) + - [NetworkConfig](#machine.NetworkConfig) + - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) + - [NetworkDeviceStats](#machine.NetworkDeviceStats) + - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) + - [PacketCaptureRequest](#machine.PacketCaptureRequest) + - [PhaseEvent](#machine.PhaseEvent) + - [PlatformInfo](#machine.PlatformInfo) + - [Process](#machine.Process) + - [ProcessInfo](#machine.ProcessInfo) + - [ProcessesResponse](#machine.ProcessesResponse) + - [ReadRequest](#machine.ReadRequest) + - [Reboot](#machine.Reboot) + - [RebootRequest](#machine.RebootRequest) + - [RebootResponse](#machine.RebootResponse) + - [Reset](#machine.Reset) + - [ResetPartitionSpec](#machine.ResetPartitionSpec) + - [ResetRequest](#machine.ResetRequest) + - [ResetResponse](#machine.ResetResponse) + - [Restart](#machine.Restart) + - [RestartEvent](#machine.RestartEvent) + - [RestartRequest](#machine.RestartRequest) + - [RestartResponse](#machine.RestartResponse) + - [Rollback](#machine.Rollback) + - [RollbackRequest](#machine.RollbackRequest) + - [RollbackResponse](#machine.RollbackResponse) + - [RouteConfig](#machine.RouteConfig) + - [SequenceEvent](#machine.SequenceEvent) + - [ServiceEvent](#machine.ServiceEvent) + - [ServiceEvents](#machine.ServiceEvents) + - [ServiceHealth](#machine.ServiceHealth) + - [ServiceInfo](#machine.ServiceInfo) + - [ServiceList](#machine.ServiceList) + - [ServiceListResponse](#machine.ServiceListResponse) + - [ServiceRestart](#machine.ServiceRestart) + - [ServiceRestartRequest](#machine.ServiceRestartRequest) + - [ServiceRestartResponse](#machine.ServiceRestartResponse) + - [ServiceStart](#machine.ServiceStart) + - [ServiceStartRequest](#machine.ServiceStartRequest) + - [ServiceStartResponse](#machine.ServiceStartResponse) + - [ServiceStateEvent](#machine.ServiceStateEvent) + - [ServiceStop](#machine.ServiceStop) + - [ServiceStopRequest](#machine.ServiceStopRequest) + - [ServiceStopResponse](#machine.ServiceStopResponse) + - [Shutdown](#machine.Shutdown) + - [ShutdownRequest](#machine.ShutdownRequest) + - [ShutdownResponse](#machine.ShutdownResponse) + - [SoftIRQStat](#machine.SoftIRQStat) + - [Stat](#machine.Stat) + - [Stats](#machine.Stats) + - [StatsRequest](#machine.StatsRequest) + - [StatsResponse](#machine.StatsResponse) + - [SystemStat](#machine.SystemStat) + - [SystemStatResponse](#machine.SystemStatResponse) + - [TaskEvent](#machine.TaskEvent) + - [Upgrade](#machine.Upgrade) + - [UpgradeRequest](#machine.UpgradeRequest) + - [UpgradeResponse](#machine.UpgradeResponse) + - [Version](#machine.Version) + - [VersionInfo](#machine.VersionInfo) + - [VersionResponse](#machine.VersionResponse) + + - [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) + - [ConnectRecord.State](#machine.ConnectRecord.State) + - [ConnectRecord.TimerActive](#machine.ConnectRecord.TimerActive) + - [EtcdMemberAlarm.AlarmType](#machine.EtcdMemberAlarm.AlarmType) + - [ListRequest.Type](#machine.ListRequest.Type) + - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) + - [MachineStatusEvent.MachineStage](#machine.MachineStatusEvent.MachineStage) + - [NetstatRequest.Filter](#machine.NetstatRequest.Filter) + - [PhaseEvent.Action](#machine.PhaseEvent.Action) + - [RebootRequest.Mode](#machine.RebootRequest.Mode) + - [ResetRequest.WipeMode](#machine.ResetRequest.WipeMode) + - [SequenceEvent.Action](#machine.SequenceEvent.Action) + - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) + - [TaskEvent.Action](#machine.TaskEvent.Action) + - [UpgradeRequest.RebootMode](#machine.UpgradeRequest.RebootMode) + + - [MachineService](#machine.MachineService) + +- [security/security.proto](#security/security.proto) + - [CertificateRequest](#securityapi.CertificateRequest) + - [CertificateResponse](#securityapi.CertificateResponse) + + - [SecurityService](#securityapi.SecurityService) + +- [storage/storage.proto](#storage/storage.proto) + - [Disk](#storage.Disk) + - [Disks](#storage.Disks) + - [DisksResponse](#storage.DisksResponse) + + - [Disk.DiskType](#storage.Disk.DiskType) + + - [StorageService](#storage.StorageService) + +- [time/time.proto](#time/time.proto) + - [Time](#time.Time) + - [TimeRequest](#time.TimeRequest) + - [TimeResponse](#time.TimeResponse) + + - [TimeService](#time.TimeService) + +- [Scalar Value Types](#scalar-value-types) + + + + +

Top

+ +## common/common.proto + + + + + +### Data + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [Metadata](#common.Metadata) | | | +| bytes | [bytes](#bytes) | | | + + + + + + + + +### DataResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Data](#common.Data) | repeated | | + + + + + + + + +### Empty + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [Metadata](#common.Metadata) | | | + + + + + + + + +### EmptyResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Empty](#common.Empty) | repeated | | + + + + + + + + +### Error + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| code | [Code](#common.Code) | | | +| message | [string](#string) | | | +| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | + + + + + + + + +### Metadata +Common metadata message nested in all reply message types + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | +| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | +| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | + + + + + + + + +### NetIP + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ip | [bytes](#bytes) | | | + + + + + + + + +### NetIPPort + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ip | [bytes](#bytes) | | | +| port | [int32](#int32) | | | + + + + + + + + +### NetIPPrefix + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ip | [bytes](#bytes) | | | +| prefix_length | [int32](#int32) | | | + + + + + + + + +### PEMEncodedCertificateAndKey + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| crt | [bytes](#bytes) | | | +| key | [bytes](#bytes) | | | + + + + + + + + +### PEMEncodedKey + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [bytes](#bytes) | | | + + + + + + + + +### URL + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| full_path | [string](#string) | | | + + + + + + + + + + +### Code + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| FATAL | 0 | | +| LOCKED | 1 | | +| CANCELED | 2 | | + + + + + +### ContainerDriver + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| CONTAINERD | 0 | | +| CRI | 1 | | + + + + + +### ContainerdNamespace + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NS_UNKNOWN | 0 | | +| NS_SYSTEM | 1 | | +| NS_CRI | 2 | | + + + + + + + +### File-level Extensions +| Extension | Type | Base | Number | Description | +| --------- | ---- | ---- | ------ | ----------- | +| remove_deprecated_enum | string | .google.protobuf.EnumOptions | 93117 | Indicates the Talos version when this deprecated enum will be removed from API. | +| remove_deprecated_enum_value | string | .google.protobuf.EnumValueOptions | 93117 | Indicates the Talos version when this deprecated enum value will be removed from API. | +| remove_deprecated_field | string | .google.protobuf.FieldOptions | 93117 | Indicates the Talos version when this deprecated filed will be removed from API. | +| remove_deprecated_message | string | .google.protobuf.MessageOptions | 93117 | Indicates the Talos version when this deprecated message will be removed from API. | +| remove_deprecated_method | string | .google.protobuf.MethodOptions | 93117 | Indicates the Talos version when this deprecated method will be removed from API. | +| remove_deprecated_service | string | .google.protobuf.ServiceOptions | 93117 | Indicates the Talos version when this deprecated service will be removed from API. | + + + + + + + + +

Top

+ +## resource/definitions/cluster/cluster.proto + + + + + +### AffiliateSpec +AffiliateSpec describes Affiliate state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| node_id | [string](#string) | | | +| addresses | [common.NetIP](#common.NetIP) | repeated | | +| hostname | [string](#string) | | | +| nodename | [string](#string) | | | +| operating_system | [string](#string) | | | +| machine_type | [talos.resource.definitions.enums.MachineType](#talos.resource.definitions.enums.MachineType) | | | +| kube_span | [KubeSpanAffiliateSpec](#talos.resource.definitions.cluster.KubeSpanAffiliateSpec) | | | +| control_plane | [ControlPlane](#talos.resource.definitions.cluster.ControlPlane) | | | + + + + + + + + +### ConfigSpec +ConfigSpec describes KubeSpan configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| discovery_enabled | [bool](#bool) | | | +| registry_kubernetes_enabled | [bool](#bool) | | | +| registry_service_enabled | [bool](#bool) | | | +| service_endpoint | [string](#string) | | | +| service_endpoint_insecure | [bool](#bool) | | | +| service_encryption_key | [bytes](#bytes) | | | +| service_cluster_id | [string](#string) | | | + + + + + + + + +### ControlPlane +ControlPlane describes ControlPlane data if any. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| api_server_port | [int64](#int64) | | | + + + + + + + + +### IdentitySpec +IdentitySpec describes status of rendered secrets. + +Note: IdentitySpec is persisted on disk in the STATE partition, +so YAML serialization should be kept backwards compatible. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| node_id | [string](#string) | | | + + + + + + + + +### InfoSpec +InfoSpec describes cluster information. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| cluster_id | [string](#string) | | | +| cluster_name | [string](#string) | | | + + + + + + + + +### KubeSpanAffiliateSpec +KubeSpanAffiliateSpec describes additional information specific for the KubeSpan. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| public_key | [string](#string) | | | +| address | [common.NetIP](#common.NetIP) | | | +| additional_addresses | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| endpoints | [common.NetIPPort](#common.NetIPPort) | repeated | | + + + + + + + + +### MemberSpec +MemberSpec describes Member state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| node_id | [string](#string) | | | +| addresses | [common.NetIP](#common.NetIP) | repeated | | +| hostname | [string](#string) | | | +| machine_type | [talos.resource.definitions.enums.MachineType](#talos.resource.definitions.enums.MachineType) | | | +| operating_system | [string](#string) | | | +| control_plane | [ControlPlane](#talos.resource.definitions.cluster.ControlPlane) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/cri/cri.proto + + + + + +### SeccompProfileSpec +SeccompProfileSpec represents the SeccompProfile. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| value | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/enums/enums.proto + + + + + + + +### KubespanPeerState +KubespanPeerState is KubeSpan peer current state. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| PEER_STATE_UNKNOWN | 0 | | +| PEER_STATE_UP | 1 | | +| PEER_STATE_DOWN | 2 | | + + + + + +### MachineType +MachineType represents a machine type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TYPE_UNKNOWN | 0 | TypeUnknown represents undefined node type, when there is no machine configuration yet. | +| TYPE_INIT | 1 | TypeInit type designates the first control plane node to come up. You can think of it like a bootstrap node. This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. | +| TYPE_CONTROL_PLANE | 2 | TypeControlPlane designates the node as a control plane member. This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler. | +| TYPE_WORKER | 3 | TypeWorker designates the node as a worker node. This means it will be an available compute node for scheduling workloads. | + + + + + +### NethelpersADSelect +NethelpersADSelect is ADSelect. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| AD_SELECT_STABLE | 0 | | +| AD_SELECT_BANDWIDTH | 1 | | +| AD_SELECT_COUNT | 2 | | + + + + + +### NethelpersARPAllTargets +NethelpersARPAllTargets is an ARP targets mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ARP_ALL_TARGETS_ANY | 0 | | +| ARP_ALL_TARGETS_ALL | 1 | | + + + + + +### NethelpersARPValidate +NethelpersARPValidate is an ARP Validation mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ARP_VALIDATE_NONE | 0 | | +| ARP_VALIDATE_ACTIVE | 1 | | +| ARP_VALIDATE_BACKUP | 2 | | +| ARP_VALIDATE_ALL | 3 | | + + + + + +### NethelpersAddressFlag +NethelpersAddressFlag wraps IFF_* constants. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_ADDRESSFLAG_UNSPECIFIED | 0 | | +| ADDRESS_TEMPORARY | 1 | | +| ADDRESS_NO_DAD | 2 | | +| ADDRESS_OPTIMISTIC | 4 | | +| ADDRESS_DAD_FAILED | 8 | | +| ADDRESS_HOME | 16 | | +| ADDRESS_DEPRECATED | 32 | | +| ADDRESS_TENTATIVE | 64 | | +| ADDRESS_PERMANENT | 128 | | +| ADDRESS_MANAGEMENT_TEMP | 256 | | +| ADDRESS_NO_PREFIX_ROUTE | 512 | | +| ADDRESS_MC_AUTO_JOIN | 1024 | | +| ADDRESS_STABLE_PRIVACY | 2048 | | + + + + + +### NethelpersBondMode +NethelpersBondMode is a bond mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| BOND_MODE_ROUNDROBIN | 0 | | +| BOND_MODE_ACTIVE_BACKUP | 1 | | +| BOND_MODE_XOR | 2 | | +| BOND_MODE_BROADCAST | 3 | | +| BOND_MODE8023_AD | 4 | | +| BOND_MODE_TLB | 5 | | +| BOND_MODE_ALB | 6 | | + + + + + +### NethelpersBondXmitHashPolicy +NethelpersBondXmitHashPolicy is a bond hash policy. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| BOND_XMIT_POLICY_LAYER2 | 0 | | +| BOND_XMIT_POLICY_LAYER34 | 1 | | +| BOND_XMIT_POLICY_LAYER23 | 2 | | +| BOND_XMIT_POLICY_ENCAP23 | 3 | | +| BOND_XMIT_POLICY_ENCAP34 | 4 | | + + + + + +### NethelpersDuplex +NethelpersDuplex wraps ethtool.Duplex for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| HALF | 0 | | +| FULL | 1 | | +| UNKNOWN | 255 | | + + + + + +### NethelpersFailOverMAC +NethelpersFailOverMAC is a MAC failover mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| FAIL_OVER_MAC_NONE | 0 | | +| FAIL_OVER_MAC_ACTIVE | 1 | | +| FAIL_OVER_MAC_FOLLOW | 2 | | + + + + + +### NethelpersFamily +NethelpersFamily is a network family. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_FAMILY_UNSPECIFIED | 0 | | +| FAMILY_INET4 | 2 | | +| FAMILY_INET6 | 10 | | + + + + + +### NethelpersLACPRate +NethelpersLACPRate is a LACP rate. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| LACP_RATE_SLOW | 0 | | +| LACP_RATE_FAST | 1 | | + + + + + +### NethelpersLinkType +NethelpersLinkType is a link type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| LINK_NETROM | 0 | | +| LINK_ETHER | 1 | | +| LINK_EETHER | 2 | | +| LINK_AX25 | 3 | | +| LINK_PRONET | 4 | | +| LINK_CHAOS | 5 | | +| LINK_IEE802 | 6 | | +| LINK_ARCNET | 7 | | +| LINK_ATALK | 8 | | +| LINK_DLCI | 15 | | +| LINK_ATM | 19 | | +| LINK_METRICOM | 23 | | +| LINK_IEEE1394 | 24 | | +| LINK_EUI64 | 27 | | +| LINK_INFINIBAND | 32 | | +| LINK_SLIP | 256 | | +| LINK_CSLIP | 257 | | +| LINK_SLIP6 | 258 | | +| LINK_CSLIP6 | 259 | | +| LINK_RSRVD | 260 | | +| LINK_ADAPT | 264 | | +| LINK_ROSE | 270 | | +| LINK_X25 | 271 | | +| LINK_HWX25 | 272 | | +| LINK_CAN | 280 | | +| LINK_PPP | 512 | | +| LINK_CISCO | 513 | | +| LINK_HDLC | 513 | | +| LINK_LAPB | 516 | | +| LINK_DDCMP | 517 | | +| LINK_RAWHDLC | 518 | | +| LINK_TUNNEL | 768 | | +| LINK_TUNNEL6 | 769 | | +| LINK_FRAD | 770 | | +| LINK_SKIP | 771 | | +| LINK_LOOPBCK | 772 | | +| LINK_LOCALTLK | 773 | | +| LINK_FDDI | 774 | | +| LINK_BIF | 775 | | +| LINK_SIT | 776 | | +| LINK_IPDDP | 777 | | +| LINK_IPGRE | 778 | | +| LINK_PIMREG | 779 | | +| LINK_HIPPI | 780 | | +| LINK_ASH | 781 | | +| LINK_ECONET | 782 | | +| LINK_IRDA | 783 | | +| LINK_FCPP | 784 | | +| LINK_FCAL | 785 | | +| LINK_FCPL | 786 | | +| LINK_FCFABRIC | 787 | | +| LINK_FCFABRIC1 | 788 | | +| LINK_FCFABRIC2 | 789 | | +| LINK_FCFABRIC3 | 790 | | +| LINK_FCFABRIC4 | 791 | | +| LINK_FCFABRIC5 | 792 | | +| LINK_FCFABRIC6 | 793 | | +| LINK_FCFABRIC7 | 794 | | +| LINK_FCFABRIC8 | 795 | | +| LINK_FCFABRIC9 | 796 | | +| LINK_FCFABRIC10 | 797 | | +| LINK_FCFABRIC11 | 798 | | +| LINK_FCFABRIC12 | 799 | | +| LINK_IEE802TR | 800 | | +| LINK_IEE80211 | 801 | | +| LINK_IEE80211PRISM | 802 | | +| LINK_IEE80211_RADIOTAP | 803 | | +| LINK_IEE8021154 | 804 | | +| LINK_IEE8021154MONITOR | 805 | | +| LINK_PHONET | 820 | | +| LINK_PHONETPIPE | 821 | | +| LINK_CAIF | 822 | | +| LINK_IP6GRE | 823 | | +| LINK_NETLINK | 824 | | +| LINK6_LOWPAN | 825 | | +| LINK_VOID | 65535 | | +| LINK_NONE | 65534 | | + + + + + +### NethelpersOperationalState +NethelpersOperationalState wraps rtnetlink.OperationalState for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OPER_STATE_UNKNOWN | 0 | | +| OPER_STATE_NOT_PRESENT | 1 | | +| OPER_STATE_DOWN | 2 | | +| OPER_STATE_LOWER_LAYER_DOWN | 3 | | +| OPER_STATE_TESTING | 4 | | +| OPER_STATE_DORMANT | 5 | | +| OPER_STATE_UP | 6 | | + + + + + +### NethelpersPort +NethelpersPort wraps ethtool.Port for YAML marshaling. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TWISTED_PAIR | 0 | | +| AUI | 1 | | +| MII | 2 | | +| FIBRE | 3 | | +| BNC | 4 | | +| DIRECT_ATTACH | 5 | | +| NONE | 239 | | +| OTHER | 255 | | + + + + + +### NethelpersPrimaryReselect +NethelpersPrimaryReselect is an ARP targets mode. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| PRIMARY_RESELECT_ALWAYS | 0 | | +| PRIMARY_RESELECT_BETTER | 1 | | +| PRIMARY_RESELECT_FAILURE | 2 | | + + + + + +### NethelpersRouteFlag +NethelpersRouteFlag wraps RTM_F_* constants. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_ROUTEFLAG_UNSPECIFIED | 0 | | +| ROUTE_NOTIFY | 256 | | +| ROUTE_CLONED | 512 | | +| ROUTE_EQUALIZE | 1024 | | +| ROUTE_PREFIX | 2048 | | +| ROUTE_LOOKUP_TABLE | 4096 | | +| ROUTE_FIB_MATCH | 8192 | | +| ROUTE_OFFLOAD | 16384 | | +| ROUTE_TRAP | 32768 | | + + + + + +### NethelpersRouteProtocol +NethelpersRouteProtocol is a routing protocol. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| PROTOCOL_UNSPEC | 0 | | +| PROTOCOL_REDIRECT | 1 | | +| PROTOCOL_KERNEL | 2 | | +| PROTOCOL_BOOT | 3 | | +| PROTOCOL_STATIC | 4 | | +| PROTOCOL_RA | 9 | | +| PROTOCOL_MRT | 10 | | +| PROTOCOL_ZEBRA | 11 | | +| PROTOCOL_BIRD | 12 | | +| PROTOCOL_DNROUTED | 13 | | +| PROTOCOL_XORP | 14 | | +| PROTOCOL_NTK | 15 | | +| PROTOCOL_DHCP | 16 | | +| PROTOCOL_MRTD | 17 | | +| PROTOCOL_KEEPALIVED | 18 | | +| PROTOCOL_BABEL | 42 | | +| PROTOCOL_OPENR | 99 | | +| PROTOCOL_BGP | 186 | | +| PROTOCOL_ISIS | 187 | | +| PROTOCOL_OSPF | 188 | | +| PROTOCOL_RIP | 189 | | +| PROTOCOL_EIGRP | 192 | | + + + + + +### NethelpersRouteType +NethelpersRouteType is a route type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TYPE_UNSPEC | 0 | | +| TYPE_UNICAST | 1 | | +| TYPE_LOCAL | 2 | | +| TYPE_BROADCAST | 3 | | +| TYPE_ANYCAST | 4 | | +| TYPE_MULTICAST | 5 | | +| TYPE_BLACKHOLE | 6 | | +| TYPE_UNREACHABLE | 7 | | +| TYPE_PROHIBIT | 8 | | +| TYPE_THROW | 9 | | +| TYPE_NAT | 10 | | +| TYPE_X_RESOLVE | 11 | | + + + + + +### NethelpersRoutingTable +NethelpersRoutingTable is a routing table ID. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TABLE_UNSPEC | 0 | | +| TABLE_DEFAULT | 253 | | +| TABLE_MAIN | 254 | | +| TABLE_LOCAL | 255 | | + + + + + +### NethelpersScope +NethelpersScope is an address scope. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| SCOPE_GLOBAL | 0 | | +| SCOPE_SITE | 200 | | +| SCOPE_LINK | 253 | | +| SCOPE_HOST | 254 | | +| SCOPE_NOWHERE | 255 | | + + + + + +### NethelpersVLANProtocol +NethelpersVLANProtocol is a VLAN protocol. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NETHELPERS_VLANPROTOCOL_UNSPECIFIED | 0 | | +| VLAN_PROTOCOL8021_Q | 33024 | | +| VLAN_PROTOCOL8021_AD | 34984 | | + + + + + +### NetworkConfigLayer +NetworkConfigLayer describes network configuration layers, with lowest priority first. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| CONFIG_DEFAULT | 0 | | +| CONFIG_CMDLINE | 1 | | +| CONFIG_PLATFORM | 2 | | +| CONFIG_OPERATOR | 3 | | +| CONFIG_MACHINE_CONFIGURATION | 4 | | + + + + + +### NetworkOperator +NetworkOperator enumerates Talos network operators. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OPERATOR_DHCP4 | 0 | | +| OPERATOR_DHCP6 | 1 | | +| OPERATOR_VIP | 2 | | + + + + + +### RuntimeMachineStage +RuntimeMachineStage describes the stage of the machine boot/run process. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| MACHINE_STAGE_UNKNOWN | 0 | | +| MACHINE_STAGE_BOOTING | 1 | | +| MACHINE_STAGE_INSTALLING | 2 | | +| MACHINE_STAGE_MAINTENANCE | 3 | | +| MACHINE_STAGE_RUNNING | 4 | | +| MACHINE_STAGE_REBOOTING | 5 | | +| MACHINE_STAGE_SHUTTING_DOWN | 6 | | +| MACHINE_STAGE_RESETTING | 7 | | +| MACHINE_STAGE_UPGRADING | 8 | | + + + + + + + + + + + +

Top

+ +## resource/definitions/etcd/etcd.proto + + + + + +### ConfigSpec +ConfigSpec describes (some) configuration settings of etcd. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| advertise_valid_subnets | [string](#string) | repeated | | +| advertise_exclude_subnets | [string](#string) | repeated | | +| image | [string](#string) | | | +| extra_args | [ConfigSpec.ExtraArgsEntry](#talos.resource.definitions.etcd.ConfigSpec.ExtraArgsEntry) | repeated | | +| listen_valid_subnets | [string](#string) | repeated | | +| listen_exclude_subnets | [string](#string) | repeated | | + + + + + + + + +### ConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### MemberSpec +MemberSpec holds information about an etcd member. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member_id | [string](#string) | | | + + + + + + + + +### PKIStatusSpec +PKIStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| version | [string](#string) | | | + + + + + + + + +### SpecSpec +SpecSpec describes (some) Specuration settings of etcd. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| advertised_addresses | [common.NetIP](#common.NetIP) | repeated | | +| image | [string](#string) | | | +| extra_args | [SpecSpec.ExtraArgsEntry](#talos.resource.definitions.etcd.SpecSpec.ExtraArgsEntry) | repeated | | +| listen_peer_addresses | [common.NetIP](#common.NetIP) | repeated | | +| listen_client_addresses | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### SpecSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/extensions/extensions.proto + + + + + +### Compatibility +Compatibility describes extension compatibility. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| talos | [Constraint](#talos.resource.definitions.extensions.Constraint) | | | + + + + + + + + +### Constraint +Constraint describes compatibility constraint. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| version | [string](#string) | | | + + + + + + + + +### Layer +Layer defines overlay mount layer. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| metadata | [Metadata](#talos.resource.definitions.extensions.Metadata) | | | + + + + + + + + +### Metadata +Metadata describes base extension metadata. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| version | [string](#string) | | | +| author | [string](#string) | | | +| description | [string](#string) | | | +| compatibility | [Compatibility](#talos.resource.definitions.extensions.Compatibility) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/files/files.proto + + + + + +### EtcFileSpecSpec +EtcFileSpecSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| contents | [bytes](#bytes) | | | +| mode | [uint32](#uint32) | | | + + + + + + + + +### EtcFileStatusSpec +EtcFileStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| spec_version | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/hardware/hardware.proto + + + + + +### MemoryModuleSpec +MemoryModuleSpec represents a single Memory. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| size | [uint32](#uint32) | | | +| device_locator | [string](#string) | | | +| bank_locator | [string](#string) | | | +| speed | [uint32](#uint32) | | | +| manufacturer | [string](#string) | | | +| serial_number | [string](#string) | | | +| asset_tag | [string](#string) | | | +| product_name | [string](#string) | | | + + + + + + + + +### ProcessorSpec +ProcessorSpec represents a single processor. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| socket | [string](#string) | | | +| manufacturer | [string](#string) | | | +| product_name | [string](#string) | | | +| max_speed | [uint32](#uint32) | | | +| boot_speed | [uint32](#uint32) | | | +| status | [uint32](#uint32) | | | +| serial_number | [string](#string) | | | +| asset_tag | [string](#string) | | | +| part_number | [string](#string) | | | +| core_count | [uint32](#uint32) | | | +| core_enabled | [uint32](#uint32) | | | +| thread_count | [uint32](#uint32) | | | + + + + + + + + +### SystemInformationSpec +SystemInformationSpec represents the system information obtained from smbios. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| manufacturer | [string](#string) | | | +| product_name | [string](#string) | | | +| version | [string](#string) | | | +| serial_number | [string](#string) | | | +| uuid | [string](#string) | | | +| wake_up_type | [string](#string) | | | +| sku_number | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/k8s/k8s.proto + + + + + +### APIServerConfigSpec +APIServerConfigSpec is configuration for kube-apiserver. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| cloud_provider | [string](#string) | | | +| control_plane_endpoint | [string](#string) | | | +| etcd_servers | [string](#string) | repeated | | +| local_port | [int64](#int64) | | | +| service_cid_rs | [string](#string) | repeated | | +| extra_args | [APIServerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.APIServerConfigSpec.ExtraArgsEntry) | repeated | | +| extra_volumes | [ExtraVolume](#talos.resource.definitions.k8s.ExtraVolume) | repeated | | +| environment_variables | [APIServerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.APIServerConfigSpec.EnvironmentVariablesEntry) | repeated | | +| pod_security_policy_enabled | [bool](#bool) | | | +| advertised_address | [string](#string) | | | +| resources | [Resources](#talos.resource.definitions.k8s.Resources) | | | + + + + + + + + +### APIServerConfigSpec.EnvironmentVariablesEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### APIServerConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### AdmissionControlConfigSpec +AdmissionControlConfigSpec is configuration for kube-apiserver. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| config | [AdmissionPluginSpec](#talos.resource.definitions.k8s.AdmissionPluginSpec) | repeated | | + + + + + + + + +### AdmissionPluginSpec +AdmissionPluginSpec is a single admission plugin configuration Admission Control plugins. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| configuration | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### AuditPolicyConfigSpec +AuditPolicyConfigSpec is audit policy configuration for kube-apiserver. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| config | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### BootstrapManifestsConfigSpec +BootstrapManifestsConfigSpec is configuration for bootstrap manifests. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| server | [string](#string) | | | +| cluster_domain | [string](#string) | | | +| pod_cid_rs | [string](#string) | repeated | | +| proxy_enabled | [bool](#bool) | | | +| proxy_image | [string](#string) | | | +| proxy_args | [string](#string) | repeated | | +| core_dns_enabled | [bool](#bool) | | | +| core_dns_image | [string](#string) | | | +| dns_service_ip | [string](#string) | | | +| dns_service_i_pv6 | [string](#string) | | | +| flannel_enabled | [bool](#bool) | | | +| flannel_image | [string](#string) | | | +| flannel_cni_image | [string](#string) | | | +| pod_security_policy_enabled | [bool](#bool) | | | +| talos_api_service_enabled | [bool](#bool) | | | + + + + + + + + +### ConfigStatusSpec +ConfigStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| version | [string](#string) | | | + + + + + + + + +### ControllerManagerConfigSpec +ControllerManagerConfigSpec is configuration for kube-controller-manager. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| image | [string](#string) | | | +| cloud_provider | [string](#string) | | | +| pod_cid_rs | [string](#string) | repeated | | +| service_cid_rs | [string](#string) | repeated | | +| extra_args | [ControllerManagerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.ControllerManagerConfigSpec.ExtraArgsEntry) | repeated | | +| extra_volumes | [ExtraVolume](#talos.resource.definitions.k8s.ExtraVolume) | repeated | | +| environment_variables | [ControllerManagerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.ControllerManagerConfigSpec.EnvironmentVariablesEntry) | repeated | | +| resources | [Resources](#talos.resource.definitions.k8s.Resources) | | | + + + + + + + + +### ControllerManagerConfigSpec.EnvironmentVariablesEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### ControllerManagerConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### EndpointSpec +EndpointSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| addresses | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### ExtraManifest +ExtraManifest defines a single extra manifest to download. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| url | [string](#string) | | | +| priority | [string](#string) | | | +| extra_headers | [ExtraManifest.ExtraHeadersEntry](#talos.resource.definitions.k8s.ExtraManifest.ExtraHeadersEntry) | repeated | | +| inline_manifest | [string](#string) | | | + + + + + + + + +### ExtraManifest.ExtraHeadersEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### ExtraManifestsConfigSpec +ExtraManifestsConfigSpec is configuration for extra bootstrap manifests. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| extra_manifests | [ExtraManifest](#talos.resource.definitions.k8s.ExtraManifest) | repeated | | + + + + + + + + +### ExtraVolume +ExtraVolume is a configuration of extra volume. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| host_path | [string](#string) | | | +| mount_path | [string](#string) | | | +| read_only | [bool](#bool) | | | + + + + + + + + +### KubePrismConfigSpec +KubePrismConfigSpec describes KubePrismConfig data. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| host | [string](#string) | | | +| port | [int64](#int64) | | | +| endpoints | [KubePrismEndpoint](#talos.resource.definitions.k8s.KubePrismEndpoint) | repeated | | + + + + + + + + +### KubePrismEndpoint +KubePrismEndpoint holds data for control plane endpoint. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| host | [string](#string) | | | +| port | [uint32](#uint32) | | | + + + + + + + + +### KubePrismEndpointsSpec +KubePrismEndpointsSpec describes KubePrismEndpoints configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoints | [KubePrismEndpoint](#talos.resource.definitions.k8s.KubePrismEndpoint) | repeated | | + + + + + + + + +### KubePrismStatusesSpec +KubePrismStatusesSpec describes KubePrismStatuses data. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| host | [string](#string) | | | +| healthy | [bool](#bool) | | | + + + + + + + + +### KubeletConfigSpec +KubeletConfigSpec holds the source of kubelet configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| cluster_dns | [string](#string) | repeated | | +| cluster_domain | [string](#string) | | | +| extra_args | [KubeletConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.KubeletConfigSpec.ExtraArgsEntry) | repeated | | +| extra_mounts | [talos.resource.definitions.proto.Mount](#talos.resource.definitions.proto.Mount) | repeated | | +| extra_config | [google.protobuf.Struct](#google.protobuf.Struct) | | | +| cloud_provider_external | [bool](#bool) | | | +| default_runtime_seccomp_enabled | [bool](#bool) | | | +| skip_node_registration | [bool](#bool) | | | +| static_pod_list_url | [string](#string) | | | +| disable_manifests_directory | [bool](#bool) | | | +| enable_fs_quota_monitoring | [bool](#bool) | | | + + + + + + + + +### KubeletConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### KubeletSpecSpec +KubeletSpecSpec holds the source of kubelet configuration. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| args | [string](#string) | repeated | | +| extra_mounts | [talos.resource.definitions.proto.Mount](#talos.resource.definitions.proto.Mount) | repeated | | +| expected_nodename | [string](#string) | | | +| config | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### ManifestSpec +ManifestSpec holds the Kubernetes resources spec. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| items | [SingleManifest](#talos.resource.definitions.k8s.SingleManifest) | repeated | | + + + + + + + + +### ManifestStatusSpec +ManifestStatusSpec describes manifest application status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| manifests_applied | [string](#string) | repeated | | + + + + + + + + +### NodeIPConfigSpec +NodeIPConfigSpec holds the Node IP specification. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| valid_subnets | [string](#string) | repeated | | +| exclude_subnets | [string](#string) | repeated | | + + + + + + + + +### NodeIPSpec +NodeIPSpec holds the Node IP specification. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| addresses | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### NodeLabelSpecSpec +NodeLabelSpecSpec represents a label that's attached to a Talos node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodeStatusSpec +NodeStatusSpec describes Kubernetes NodeStatus. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| nodename | [string](#string) | | | +| node_ready | [bool](#bool) | | | +| unschedulable | [bool](#bool) | | | +| labels | [NodeStatusSpec.LabelsEntry](#talos.resource.definitions.k8s.NodeStatusSpec.LabelsEntry) | repeated | | +| annotations | [NodeStatusSpec.AnnotationsEntry](#talos.resource.definitions.k8s.NodeStatusSpec.AnnotationsEntry) | repeated | | + + + + + + + + +### NodeStatusSpec.AnnotationsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodeStatusSpec.LabelsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodeTaintSpecSpec +NodeTaintSpecSpec represents a label that's attached to a Talos node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| effect | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### NodenameSpec +NodenameSpec describes Kubernetes nodename. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| nodename | [string](#string) | | | +| hostname_version | [string](#string) | | | +| skip_node_registration | [bool](#bool) | | | + + + + + + + + +### Resources +Resources is a configuration of cpu and memory resources. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| requests | [Resources.RequestsEntry](#talos.resource.definitions.k8s.Resources.RequestsEntry) | repeated | | +| limits | [Resources.LimitsEntry](#talos.resource.definitions.k8s.Resources.LimitsEntry) | repeated | | + + + + + + + + +### Resources.LimitsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### Resources.RequestsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### SchedulerConfigSpec +SchedulerConfigSpec is configuration for kube-scheduler. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| image | [string](#string) | | | +| extra_args | [SchedulerConfigSpec.ExtraArgsEntry](#talos.resource.definitions.k8s.SchedulerConfigSpec.ExtraArgsEntry) | repeated | | +| extra_volumes | [ExtraVolume](#talos.resource.definitions.k8s.ExtraVolume) | repeated | | +| environment_variables | [SchedulerConfigSpec.EnvironmentVariablesEntry](#talos.resource.definitions.k8s.SchedulerConfigSpec.EnvironmentVariablesEntry) | repeated | | +| resources | [Resources](#talos.resource.definitions.k8s.Resources) | | | + + + + + + + + +### SchedulerConfigSpec.EnvironmentVariablesEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### SchedulerConfigSpec.ExtraArgsEntry + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [string](#string) | | | +| value | [string](#string) | | | + + + + + + + + +### SecretsStatusSpec +SecretsStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| version | [string](#string) | | | + + + + + + + + +### SingleManifest +SingleManifest is a single manifest. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| object | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### StaticPodServerStatusSpec +StaticPodServerStatusSpec describes static pod spec, it contains marshaled *v1.Pod spec. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| url | [string](#string) | | | + + + + + + + + +### StaticPodSpec +StaticPodSpec describes static pod spec, it contains marshaled *v1.Pod spec. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pod | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + +### StaticPodStatusSpec +StaticPodStatusSpec describes kubelet static pod status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pod_status | [google.protobuf.Struct](#google.protobuf.Struct) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/kubeaccess/kubeaccess.proto + + + + + +### ConfigSpec +ConfigSpec describes KubeSpan configuration.. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| allowed_api_roles | [string](#string) | repeated | | +| allowed_kubernetes_namespaces | [string](#string) | repeated | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/kubespan/kubespan.proto + + + + + +### ConfigSpec +ConfigSpec describes KubeSpan configuration.. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | +| cluster_id | [string](#string) | | | +| shared_secret | [string](#string) | | | +| force_routing | [bool](#bool) | | | +| advertise_kubernetes_networks | [bool](#bool) | | | +| mtu | [uint32](#uint32) | | | +| endpoint_filters | [string](#string) | repeated | | + + + + + + + + +### EndpointSpec +EndpointSpec describes Endpoint state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| affiliate_id | [string](#string) | | | +| endpoint | [common.NetIPPort](#common.NetIPPort) | | | + + + + + + + + +### IdentitySpec +IdentitySpec describes KubeSpan keys and address. + +Note: IdentitySpec is persisted on disk in the STATE partition, +so YAML serialization should be kept backwards compatible. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| subnet | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| private_key | [string](#string) | | | +| public_key | [string](#string) | | | + + + + + + + + +### PeerSpecSpec +PeerSpecSpec describes PeerSpec state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address | [common.NetIP](#common.NetIP) | | | +| allowed_ips | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| endpoints | [common.NetIPPort](#common.NetIPPort) | repeated | | +| label | [string](#string) | | | + + + + + + + + +### PeerStatusSpec +PeerStatusSpec describes PeerStatus state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [common.NetIPPort](#common.NetIPPort) | | | +| label | [string](#string) | | | +| state | [talos.resource.definitions.enums.KubespanPeerState](#talos.resource.definitions.enums.KubespanPeerState) | | | +| receive_bytes | [int64](#int64) | | | +| transmit_bytes | [int64](#int64) | | | +| last_handshake_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | +| last_used_endpoint | [common.NetIPPort](#common.NetIPPort) | | | +| last_endpoint_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/network/network.proto + + + + + +### AddressSpecSpec +AddressSpecSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| link_name | [string](#string) | | | +| family | [talos.resource.definitions.enums.NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) | | | +| scope | [talos.resource.definitions.enums.NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) | | | +| flags | [uint32](#uint32) | | | +| announce_with_arp | [bool](#bool) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### AddressStatusSpec +AddressStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| local | [common.NetIP](#common.NetIP) | | | +| broadcast | [common.NetIP](#common.NetIP) | | | +| anycast | [common.NetIP](#common.NetIP) | | | +| multicast | [common.NetIP](#common.NetIP) | | | +| link_index | [uint32](#uint32) | | | +| link_name | [string](#string) | | | +| family | [talos.resource.definitions.enums.NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) | | | +| scope | [talos.resource.definitions.enums.NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) | | | +| flags | [uint32](#uint32) | | | + + + + + + + + +### BondMasterSpec +BondMasterSpec describes bond settings if Kind == "bond". + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mode | [talos.resource.definitions.enums.NethelpersBondMode](#talos.resource.definitions.enums.NethelpersBondMode) | | | +| hash_policy | [talos.resource.definitions.enums.NethelpersBondXmitHashPolicy](#talos.resource.definitions.enums.NethelpersBondXmitHashPolicy) | | | +| lacp_rate | [talos.resource.definitions.enums.NethelpersLACPRate](#talos.resource.definitions.enums.NethelpersLACPRate) | | | +| arp_validate | [talos.resource.definitions.enums.NethelpersARPValidate](#talos.resource.definitions.enums.NethelpersARPValidate) | | | +| arp_all_targets | [talos.resource.definitions.enums.NethelpersARPAllTargets](#talos.resource.definitions.enums.NethelpersARPAllTargets) | | | +| primary_index | [uint32](#uint32) | | | +| primary_reselect | [talos.resource.definitions.enums.NethelpersPrimaryReselect](#talos.resource.definitions.enums.NethelpersPrimaryReselect) | | | +| fail_over_mac | [talos.resource.definitions.enums.NethelpersFailOverMAC](#talos.resource.definitions.enums.NethelpersFailOverMAC) | | | +| ad_select | [talos.resource.definitions.enums.NethelpersADSelect](#talos.resource.definitions.enums.NethelpersADSelect) | | | +| mii_mon | [uint32](#uint32) | | | +| up_delay | [uint32](#uint32) | | | +| down_delay | [uint32](#uint32) | | | +| arp_interval | [uint32](#uint32) | | | +| resend_igmp | [uint32](#uint32) | | | +| min_links | [uint32](#uint32) | | | +| lp_interval | [uint32](#uint32) | | | +| packets_per_slave | [uint32](#uint32) | | | +| num_peer_notif | [fixed32](#fixed32) | | | +| tlb_dynamic_lb | [fixed32](#fixed32) | | | +| all_slaves_active | [fixed32](#fixed32) | | | +| use_carrier | [bool](#bool) | | | +| ad_actor_sys_prio | [fixed32](#fixed32) | | | +| ad_user_port_key | [fixed32](#fixed32) | | | +| peer_notify_delay | [uint32](#uint32) | | | + + + + + + + + +### BondSlave +BondSlave contains a bond's master name and slave index. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| master_name | [string](#string) | | | +| slave_index | [int64](#int64) | | | + + + + + + + + +### BridgeMasterSpec +BridgeMasterSpec describes bridge settings if Kind == "bridge". + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| stp | [STPSpec](#talos.resource.definitions.network.STPSpec) | | | + + + + + + + + +### BridgeSlave +BridgeSlave contains a bond's master name and slave index. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| master_name | [string](#string) | | | + + + + + + + + +### DHCP4OperatorSpec +DHCP4OperatorSpec describes DHCP4 operator options. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| route_metric | [uint32](#uint32) | | | +| skip_hostname_request | [bool](#bool) | | | + + + + + + + + +### DHCP6OperatorSpec +DHCP6OperatorSpec describes DHCP6 operator options. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| duid | [string](#string) | | | +| route_metric | [uint32](#uint32) | | | +| skip_hostname_request | [bool](#bool) | | | + + + + + + + + +### HardwareAddrSpec +HardwareAddrSpec describes spec for the link. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| hardware_addr | [bytes](#bytes) | | | + + + + + + + + +### HostnameSpecSpec +HostnameSpecSpec describes node hostname. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | | +| domainname | [string](#string) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### HostnameStatusSpec +HostnameStatusSpec describes node hostname. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | | +| domainname | [string](#string) | | | + + + + + + + + +### LinkRefreshSpec +LinkRefreshSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| generation | [int64](#int64) | | | + + + + + + + + +### LinkSpecSpec +LinkSpecSpec describes spec for the link. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| logical | [bool](#bool) | | | +| up | [bool](#bool) | | | +| mtu | [uint32](#uint32) | | | +| kind | [string](#string) | | | +| type | [talos.resource.definitions.enums.NethelpersLinkType](#talos.resource.definitions.enums.NethelpersLinkType) | | | +| parent_name | [string](#string) | | | +| bond_slave | [BondSlave](#talos.resource.definitions.network.BondSlave) | | | +| bridge_slave | [BridgeSlave](#talos.resource.definitions.network.BridgeSlave) | | | +| vlan | [VLANSpec](#talos.resource.definitions.network.VLANSpec) | | | +| bond_master | [BondMasterSpec](#talos.resource.definitions.network.BondMasterSpec) | | | +| bridge_master | [BridgeMasterSpec](#talos.resource.definitions.network.BridgeMasterSpec) | | | +| wireguard | [WireguardSpec](#talos.resource.definitions.network.WireguardSpec) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### LinkStatusSpec +LinkStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| index | [uint32](#uint32) | | | +| type | [talos.resource.definitions.enums.NethelpersLinkType](#talos.resource.definitions.enums.NethelpersLinkType) | | | +| link_index | [uint32](#uint32) | | | +| flags | [uint32](#uint32) | | | +| hardware_addr | [bytes](#bytes) | | | +| broadcast_addr | [bytes](#bytes) | | | +| mtu | [uint32](#uint32) | | | +| queue_disc | [string](#string) | | | +| master_index | [uint32](#uint32) | | | +| operational_state | [talos.resource.definitions.enums.NethelpersOperationalState](#talos.resource.definitions.enums.NethelpersOperationalState) | | | +| kind | [string](#string) | | | +| slave_kind | [string](#string) | | | +| bus_path | [string](#string) | | | +| pciid | [string](#string) | | | +| driver | [string](#string) | | | +| driver_version | [string](#string) | | | +| firmware_version | [string](#string) | | | +| product_id | [string](#string) | | | +| vendor_id | [string](#string) | | | +| product | [string](#string) | | | +| vendor | [string](#string) | | | +| link_state | [bool](#bool) | | | +| speed_megabits | [int64](#int64) | | | +| port | [talos.resource.definitions.enums.NethelpersPort](#talos.resource.definitions.enums.NethelpersPort) | | | +| duplex | [talos.resource.definitions.enums.NethelpersDuplex](#talos.resource.definitions.enums.NethelpersDuplex) | | | +| vlan | [VLANSpec](#talos.resource.definitions.network.VLANSpec) | | | +| bridge_master | [BridgeMasterSpec](#talos.resource.definitions.network.BridgeMasterSpec) | | | +| bond_master | [BondMasterSpec](#talos.resource.definitions.network.BondMasterSpec) | | | +| wireguard | [WireguardSpec](#talos.resource.definitions.network.WireguardSpec) | | | +| permanent_addr | [bytes](#bytes) | | | + + + + + + + + +### NodeAddressFilterSpec +NodeAddressFilterSpec describes a filter for NodeAddresses. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| include_subnets | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | +| exclude_subnets | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | + + + + + + + + +### NodeAddressSpec +NodeAddressSpec describes a set of node addresses. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| addresses | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | + + + + + + + + +### OperatorSpecSpec +OperatorSpecSpec describes DNS resolvers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| operator | [talos.resource.definitions.enums.NetworkOperator](#talos.resource.definitions.enums.NetworkOperator) | | | +| link_name | [string](#string) | | | +| require_up | [bool](#bool) | | | +| dhcp4 | [DHCP4OperatorSpec](#talos.resource.definitions.network.DHCP4OperatorSpec) | | | +| dhcp6 | [DHCP6OperatorSpec](#talos.resource.definitions.network.DHCP6OperatorSpec) | | | +| vip | [VIPOperatorSpec](#talos.resource.definitions.network.VIPOperatorSpec) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### ProbeSpecSpec +ProbeSpecSpec describes the Probe. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| interval | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| failure_threshold | [int64](#int64) | | | +| tcp | [TCPProbeSpec](#talos.resource.definitions.network.TCPProbeSpec) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### ProbeStatusSpec +ProbeStatusSpec describes the Probe. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| success | [bool](#bool) | | | +| last_error | [string](#string) | | | + + + + + + + + +### ResolverSpecSpec +ResolverSpecSpec describes DNS resolvers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| dns_servers | [common.NetIP](#common.NetIP) | repeated | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### ResolverStatusSpec +ResolverStatusSpec describes DNS resolvers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| dns_servers | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### RouteSpecSpec +RouteSpecSpec describes the route. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| family | [talos.resource.definitions.enums.NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) | | | +| destination | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| source | [common.NetIP](#common.NetIP) | | | +| gateway | [common.NetIP](#common.NetIP) | | | +| out_link_name | [string](#string) | | | +| table | [talos.resource.definitions.enums.NethelpersRoutingTable](#talos.resource.definitions.enums.NethelpersRoutingTable) | | | +| priority | [uint32](#uint32) | | | +| scope | [talos.resource.definitions.enums.NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) | | | +| type | [talos.resource.definitions.enums.NethelpersRouteType](#talos.resource.definitions.enums.NethelpersRouteType) | | | +| flags | [uint32](#uint32) | | | +| protocol | [talos.resource.definitions.enums.NethelpersRouteProtocol](#talos.resource.definitions.enums.NethelpersRouteProtocol) | | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | +| mtu | [uint32](#uint32) | | | + + + + + + + + +### RouteStatusSpec +RouteStatusSpec describes status of rendered secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| family | [talos.resource.definitions.enums.NethelpersFamily](#talos.resource.definitions.enums.NethelpersFamily) | | | +| destination | [common.NetIPPrefix](#common.NetIPPrefix) | | | +| source | [common.NetIP](#common.NetIP) | | | +| gateway | [common.NetIP](#common.NetIP) | | | +| out_link_index | [uint32](#uint32) | | | +| out_link_name | [string](#string) | | | +| table | [talos.resource.definitions.enums.NethelpersRoutingTable](#talos.resource.definitions.enums.NethelpersRoutingTable) | | | +| priority | [uint32](#uint32) | | | +| scope | [talos.resource.definitions.enums.NethelpersScope](#talos.resource.definitions.enums.NethelpersScope) | | | +| type | [talos.resource.definitions.enums.NethelpersRouteType](#talos.resource.definitions.enums.NethelpersRouteType) | | | +| flags | [uint32](#uint32) | | | +| protocol | [talos.resource.definitions.enums.NethelpersRouteProtocol](#talos.resource.definitions.enums.NethelpersRouteProtocol) | | | +| mtu | [uint32](#uint32) | | | + + + + + + + + +### STPSpec +STPSpec describes Spanning Tree Protocol (STP) settings of a bridge. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| enabled | [bool](#bool) | | | + + + + + + + + +### StatusSpec +StatusSpec describes network state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| address_ready | [bool](#bool) | | | +| connectivity_ready | [bool](#bool) | | | +| hostname_ready | [bool](#bool) | | | +| etc_files_ready | [bool](#bool) | | | + + + + + + + + +### TCPProbeSpec +TCPProbeSpec describes the TCP Probe. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [string](#string) | | | +| timeout | [google.protobuf.Duration](#google.protobuf.Duration) | | | + + + + + + + + +### TimeServerSpecSpec +TimeServerSpecSpec describes NTP servers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ntp_servers | [string](#string) | repeated | | +| config_layer | [talos.resource.definitions.enums.NetworkConfigLayer](#talos.resource.definitions.enums.NetworkConfigLayer) | | | + + + + + + + + +### TimeServerStatusSpec +TimeServerStatusSpec describes NTP servers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ntp_servers | [string](#string) | repeated | | + + + + + + + + +### VIPEquinixMetalSpec +VIPEquinixMetalSpec describes virtual (elastic) IP settings for Equinix Metal. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| project_id | [string](#string) | | | +| device_id | [string](#string) | | | +| api_token | [string](#string) | | | + + + + + + + + +### VIPHCloudSpec +VIPHCloudSpec describes virtual (elastic) IP settings for Hetzner Cloud. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| device_id | [int64](#int64) | | | +| network_id | [int64](#int64) | | | +| api_token | [string](#string) | | | + + + + + + + + +### VIPOperatorSpec +VIPOperatorSpec describes virtual IP operator options. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ip | [common.NetIP](#common.NetIP) | | | +| gratuitous_arp | [bool](#bool) | | | +| equinix_metal | [VIPEquinixMetalSpec](#talos.resource.definitions.network.VIPEquinixMetalSpec) | | | +| h_cloud | [VIPHCloudSpec](#talos.resource.definitions.network.VIPHCloudSpec) | | | + + + + + + + + +### VLANSpec +VLANSpec describes VLAN settings if Kind == "vlan". + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| vid | [fixed32](#fixed32) | | | +| protocol | [talos.resource.definitions.enums.NethelpersVLANProtocol](#talos.resource.definitions.enums.NethelpersVLANProtocol) | | | + + + + + + + + +### WireguardPeer +WireguardPeer describes a single peer. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| public_key | [string](#string) | | | +| preshared_key | [string](#string) | | | +| endpoint | [string](#string) | | | +| persistent_keepalive_interval | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| allowed_ips | [common.NetIPPrefix](#common.NetIPPrefix) | repeated | | + + + + + + + + +### WireguardSpec +WireguardSpec describes Wireguard settings if Kind == "wireguard". + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| private_key | [string](#string) | | | +| public_key | [string](#string) | | | +| listen_port | [int64](#int64) | | | +| firewall_mark | [int64](#int64) | | | +| peers | [WireguardPeer](#talos.resource.definitions.network.WireguardPeer) | repeated | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/perf/perf.proto + + + + + +### CPUSpec +CPUSpec represents the last CPU stats snapshot. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| cpu | [CPUStat](#talos.resource.definitions.perf.CPUStat) | repeated | | +| cpu_total | [CPUStat](#talos.resource.definitions.perf.CPUStat) | | | +| irq_total | [uint64](#uint64) | | | +| context_switches | [uint64](#uint64) | | | +| process_created | [uint64](#uint64) | | | +| process_running | [uint64](#uint64) | | | +| process_blocked | [uint64](#uint64) | | | +| soft_irq_total | [uint64](#uint64) | | | + + + + + + + + +### CPUStat +CPUStat represents a single cpu stat. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| user | [double](#double) | | | +| nice | [double](#double) | | | +| system | [double](#double) | | | +| idle | [double](#double) | | | +| iowait | [double](#double) | | | +| irq | [double](#double) | | | +| soft_irq | [double](#double) | | | +| steal | [double](#double) | | | +| guest | [double](#double) | | | +| guest_nice | [double](#double) | | | + + + + + + + + +### MemorySpec +MemorySpec represents the last Memory stats snapshot. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mem_total | [uint64](#uint64) | | | +| mem_used | [uint64](#uint64) | | | +| mem_available | [uint64](#uint64) | | | +| buffers | [uint64](#uint64) | | | +| cached | [uint64](#uint64) | | | +| swap_cached | [uint64](#uint64) | | | +| active | [uint64](#uint64) | | | +| inactive | [uint64](#uint64) | | | +| active_anon | [uint64](#uint64) | | | +| inactive_anon | [uint64](#uint64) | | | +| active_file | [uint64](#uint64) | | | +| inactive_file | [uint64](#uint64) | | | +| unevictable | [uint64](#uint64) | | | +| mlocked | [uint64](#uint64) | | | +| swap_total | [uint64](#uint64) | | | +| swap_free | [uint64](#uint64) | | | +| dirty | [uint64](#uint64) | | | +| writeback | [uint64](#uint64) | | | +| anon_pages | [uint64](#uint64) | | | +| mapped | [uint64](#uint64) | | | +| shmem | [uint64](#uint64) | | | +| slab | [uint64](#uint64) | | | +| s_reclaimable | [uint64](#uint64) | | | +| s_unreclaim | [uint64](#uint64) | | | +| kernel_stack | [uint64](#uint64) | | | +| page_tables | [uint64](#uint64) | | | +| nf_sunstable | [uint64](#uint64) | | | +| bounce | [uint64](#uint64) | | | +| writeback_tmp | [uint64](#uint64) | | | +| commit_limit | [uint64](#uint64) | | | +| committed_as | [uint64](#uint64) | | | +| vmalloc_total | [uint64](#uint64) | | | +| vmalloc_used | [uint64](#uint64) | | | +| vmalloc_chunk | [uint64](#uint64) | | | +| hardware_corrupted | [uint64](#uint64) | | | +| anon_huge_pages | [uint64](#uint64) | | | +| shmem_huge_pages | [uint64](#uint64) | | | +| shmem_pmd_mapped | [uint64](#uint64) | | | +| cma_total | [uint64](#uint64) | | | +| cma_free | [uint64](#uint64) | | | +| huge_pages_total | [uint64](#uint64) | | | +| huge_pages_free | [uint64](#uint64) | | | +| huge_pages_rsvd | [uint64](#uint64) | | | +| huge_pages_surp | [uint64](#uint64) | | | +| hugepagesize | [uint64](#uint64) | | | +| direct_map4k | [uint64](#uint64) | | | +| direct_map2m | [uint64](#uint64) | | | +| direct_map1g | [uint64](#uint64) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/proto/proto.proto + + + + + +### Mount +Mount specifies a mount for a container. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| destination | [string](#string) | | | +| type | [string](#string) | | | +| source | [string](#string) | | | +| options | [string](#string) | repeated | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/runtime/runtime.proto + + + + + +### DevicesStatusSpec +DevicesStatusSpec is the spec for devices status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | + + + + + + + + +### EventSinkConfigSpec +EventSinkConfigSpec describes configuration of Talos event log streaming. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [string](#string) | | | + + + + + + + + +### KernelModuleSpecSpec +KernelModuleSpecSpec describes Linux kernel module to load. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| parameters | [string](#string) | repeated | | + + + + + + + + +### KernelParamSpecSpec +KernelParamSpecSpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| value | [string](#string) | | | +| ignore_errors | [bool](#bool) | | | + + + + + + + + +### KernelParamStatusSpec +KernelParamStatusSpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| current | [string](#string) | | | +| default | [string](#string) | | | +| unsupported | [bool](#bool) | | | + + + + + + + + +### KmsgLogConfigSpec +KmsgLogConfigSpec describes configuration for kmsg log streaming. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| destinations | [common.URL](#common.URL) | repeated | | + + + + + + + + +### MachineStatusSpec +MachineStatusSpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| stage | [talos.resource.definitions.enums.RuntimeMachineStage](#talos.resource.definitions.enums.RuntimeMachineStage) | | | +| status | [MachineStatusStatus](#talos.resource.definitions.runtime.MachineStatusStatus) | | | + + + + + + + + +### MachineStatusStatus +MachineStatusStatus describes machine current status at the stage. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| unmet_conditions | [UnmetCondition](#talos.resource.definitions.runtime.UnmetCondition) | repeated | | + + + + + + + + +### MaintenanceServiceConfigSpec +MaintenanceServiceConfigSpec describes configuration for maintenance service API. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| listen_address | [string](#string) | | | +| reachable_addresses | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### MetaKeySpec +MetaKeySpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| value | [string](#string) | | | + + + + + + + + +### MountStatusSpec +MountStatusSpec describes status of the defined sysctls. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| source | [string](#string) | | | +| target | [string](#string) | | | +| filesystem_type | [string](#string) | | | +| options | [string](#string) | repeated | | +| encrypted | [bool](#bool) | | | + + + + + + + + +### PlatformMetadataSpec +PlatformMetadataSpec describes platform metadata properties. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| platform | [string](#string) | | | +| hostname | [string](#string) | | | +| region | [string](#string) | | | +| zone | [string](#string) | | | +| instance_type | [string](#string) | | | +| instance_id | [string](#string) | | | +| provider_id | [string](#string) | | | +| spot | [bool](#bool) | | | + + + + + + + + +### SecurityStateSpec +SecurityStateSpec describes the security state resource properties. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| secure_boot | [bool](#bool) | | | +| uki_signing_key_fingerprint | [string](#string) | | | +| pcr_signing_key_fingerprint | [string](#string) | | | + + + + + + + + +### UnmetCondition +UnmetCondition is a failure which prevents machine from being ready at the stage. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| reason | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/secrets/secrets.proto + + + + + +### APICertsSpec +APICertsSpec describes etcd certs secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| client | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### CertSANSpec +CertSANSpec describes fields of the cert SANs. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| i_ps | [common.NetIP](#common.NetIP) | repeated | | +| dns_names | [string](#string) | repeated | | +| fqdn | [string](#string) | | | + + + + + + + + +### EtcdCertsSpec +EtcdCertsSpec describes etcd certs secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| etcd | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| etcd_peer | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| etcd_admin | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| etcd_api_server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### EtcdRootSpec +EtcdRootSpec describes etcd CA secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| etcd_ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### KubeletSpec +KubeletSpec describes root Kubernetes secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [common.URL](#common.URL) | | | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| bootstrap_token_id | [string](#string) | | | +| bootstrap_token_secret | [string](#string) | | | + + + + + + + + +### KubernetesCertsSpec +KubernetesCertsSpec describes generated Kubernetes certificates. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| scheduler_kubeconfig | [string](#string) | | | +| controller_manager_kubeconfig | [string](#string) | | | +| localhost_admin_kubeconfig | [string](#string) | | | +| admin_kubeconfig | [string](#string) | | | + + + + + + + + +### KubernetesDynamicCertsSpec +KubernetesDynamicCertsSpec describes generated KubernetesCerts certificates. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| api_server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| api_server_kubelet_client | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| front_proxy | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### KubernetesRootSpec +KubernetesRootSpec describes root Kubernetes secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| endpoint | [common.URL](#common.URL) | | | +| local_endpoint | [common.URL](#common.URL) | | | +| cert_sa_ns | [string](#string) | repeated | | +| dns_domain | [string](#string) | | | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| service_account | [common.PEMEncodedKey](#common.PEMEncodedKey) | | | +| aggregator_ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| aescbc_encryption_secret | [string](#string) | | | +| bootstrap_token_id | [string](#string) | | | +| bootstrap_token_secret | [string](#string) | | | +| secretbox_encryption_secret | [string](#string) | | | +| api_server_ips | [common.NetIP](#common.NetIP) | repeated | | + + + + + + + + +### MaintenanceRootSpec +MaintenanceRootSpec describes maintenance service CA. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### MaintenanceServiceCertsSpec +MaintenanceServiceCertsSpec describes maintenance service certs secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + +### OSRootSpec +OSRootSpec describes operating system CA. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| cert_sani_ps | [common.NetIP](#common.NetIP) | repeated | | +| cert_sandns_names | [string](#string) | repeated | | +| token | [string](#string) | | | + + + + + + + + +### TrustdCertsSpec +TrustdCertsSpec describes etcd certs secrets. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | +| server | [common.PEMEncodedCertificateAndKey](#common.PEMEncodedCertificateAndKey) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/siderolink/siderolink.proto + + + + + +### ConfigSpec +ConfigSpec describes KubeSpan configuration.. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| api_endpoint | [string](#string) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/time/time.proto + + + + + +### AdjtimeStatusSpec +AdjtimeStatusSpec describes Linux internal adjtime state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| offset | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| frequency_adjustment_ratio | [double](#double) | | | +| max_error | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| est_error | [google.protobuf.Duration](#google.protobuf.Duration) | | | +| status | [string](#string) | | | +| constant | [int64](#int64) | | | +| sync_status | [bool](#bool) | | | +| state | [string](#string) | | | + + + + + + + + +### StatusSpec +StatusSpec describes time sync state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| synced | [bool](#bool) | | | +| epoch | [int64](#int64) | | | +| sync_disabled | [bool](#bool) | | | + + + + + + + + + + + + + + + + +

Top

+ +## resource/definitions/v1alpha1/v1alpha1.proto + + + + + +### ServiceSpec +ServiceSpec describe service state. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| running | [bool](#bool) | | | +| healthy | [bool](#bool) | | | +| unknown | [bool](#bool) | | | + + + + + + + + + + + + + + + + +

Top

+ +## inspect/inspect.proto + + + + + +### ControllerDependencyEdge + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| controller_name | [string](#string) | | | +| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | +| resource_namespace | [string](#string) | | | +| resource_type | [string](#string) | | | +| resource_id | [string](#string) | | | + + + + + + + + +### ControllerRuntimeDependenciesResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | + + + + + + + + +### ControllerRuntimeDependency +The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | + + + + + + + + + + +### DependencyEdgeType + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OUTPUT_EXCLUSIVE | 0 | | +| OUTPUT_SHARED | 3 | | +| INPUT_STRONG | 1 | | +| INPUT_WEAK | 2 | | +| INPUT_DESTROY_READY | 4 | | + + + + + + + + + +### InspectService +The inspect service definition. + +InspectService provides auxiliary API to inspect OS internals. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | + + + + + + +

Top

+ +## machine/machine.proto + + + + + +### AddressEvent +AddressEvent reports node endpoints aggregated from k8s.Endpoints and network.Hostname. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | | +| addresses | [string](#string) | repeated | | + + + + + + + + +### ApplyConfiguration +ApplyConfigurationResponse describes the response to a configuration request. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| warnings | [string](#string) | repeated | Configuration validation warnings. | +| mode | [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) | | States which mode was actually chosen. | +| mode_details | [string](#string) | | Human-readable message explaining the result of the apply configuration call. | + + + + + + + + +### ApplyConfigurationRequest +rpc applyConfiguration +ApplyConfiguration describes a request to assert a new configuration upon a +node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| data | [bytes](#bytes) | | | +| mode | [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) | | | +| dry_run | [bool](#bool) | | | +| try_mode_timeout | [google.protobuf.Duration](#google.protobuf.Duration) | | | + + + + + + + + +### ApplyConfigurationResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | + + + + + + + + +### BPFInstruction + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| op | [uint32](#uint32) | | | +| jt | [uint32](#uint32) | | | +| jf | [uint32](#uint32) | | | +| k | [uint32](#uint32) | | | + + + + + + + + +### Bootstrap +The bootstrap message containing the bootstrap status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### BootstrapRequest +rpc Bootstrap + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| recover_etcd | [bool](#bool) | | Enable etcd recovery from the snapshot. + +Snapshot should be uploaded before this call via EtcdRecover RPC. | +| recover_skip_hash_check | [bool](#bool) | | Skip hash check on the snapshot (etcd). + +Enable this when recovering from data directory copy to skip integrity check. | + + + + + + + + +### BootstrapResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Bootstrap](#machine.Bootstrap) | repeated | | + + + + + + + + +### CNIConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| urls | [string](#string) | repeated | | + + + + + + + + +### CPUInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| processor | [uint32](#uint32) | | | +| vendor_id | [string](#string) | | | +| cpu_family | [string](#string) | | | +| model | [string](#string) | | | +| model_name | [string](#string) | | | +| stepping | [string](#string) | | | +| microcode | [string](#string) | | | +| cpu_mhz | [double](#double) | | | +| cache_size | [string](#string) | | | +| physical_id | [string](#string) | | | +| siblings | [uint32](#uint32) | | | +| core_id | [string](#string) | | | +| cpu_cores | [uint32](#uint32) | | | +| apic_id | [string](#string) | | | +| initial_apic_id | [string](#string) | | | +| fpu | [string](#string) | | | +| fpu_exception | [string](#string) | | | +| cpu_id_level | [uint32](#uint32) | | | +| wp | [string](#string) | | | +| flags | [string](#string) | repeated | | +| bugs | [string](#string) | repeated | | +| bogo_mips | [double](#double) | | | +| cl_flush_size | [uint32](#uint32) | | | +| cache_alignment | [uint32](#uint32) | | | +| address_sizes | [string](#string) | | | +| power_management | [string](#string) | | | + + + + + + + + +### CPUInfoResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | + + + + + + + + +### CPUStat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| user | [double](#double) | | | +| nice | [double](#double) | | | +| system | [double](#double) | | | +| idle | [double](#double) | | | +| iowait | [double](#double) | | | +| irq | [double](#double) | | | +| soft_irq | [double](#double) | | | +| steal | [double](#double) | | | +| guest | [double](#double) | | | +| guest_nice | [double](#double) | | | + + + + + + + + +### CPUsInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | + + + + + + + + +### ClusterConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | +| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | +| allow_scheduling_on_control_planes | [bool](#bool) | | | + + + + + + + + +### ClusterNetworkConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| dns_domain | [string](#string) | | | +| cni_config | [CNIConfig](#machine.CNIConfig) | | | + + + + + + + + +### ConfigLoadErrorEvent +ConfigLoadErrorEvent is reported when the config loading has failed. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| error | [string](#string) | | | + + + + + + + + +### ConfigValidationErrorEvent +ConfigValidationErrorEvent is reported when config validation has failed. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| error | [string](#string) | | | + + + + + + + + +### ConnectRecord + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| l4proto | [string](#string) | | | +| localip | [string](#string) | | | +| localport | [uint32](#uint32) | | | +| remoteip | [string](#string) | | | +| remoteport | [uint32](#uint32) | | | +| state | [ConnectRecord.State](#machine.ConnectRecord.State) | | | +| txqueue | [uint64](#uint64) | | | +| rxqueue | [uint64](#uint64) | | | +| tr | [ConnectRecord.TimerActive](#machine.ConnectRecord.TimerActive) | | | +| timerwhen | [uint64](#uint64) | | | +| retrnsmt | [uint64](#uint64) | | | +| uid | [uint32](#uint32) | | | +| timeout | [uint64](#uint64) | | | +| inode | [uint64](#uint64) | | | +| ref | [uint64](#uint64) | | | +| pointer | [uint64](#uint64) | | | +| process | [ConnectRecord.Process](#machine.ConnectRecord.Process) | | | +| netns | [string](#string) | | | + + + + + + + + +### ConnectRecord.Process + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pid | [uint32](#uint32) | | | +| name | [string](#string) | | | + + + + + + + + +### Container +The messages message containing the requested containers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | + + + + + + + + +### ContainerInfo +The messages message containing the requested containers. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| id | [string](#string) | | | +| image | [string](#string) | | | +| pid | [uint32](#uint32) | | | +| status | [string](#string) | | | +| pod_id | [string](#string) | | | +| name | [string](#string) | | | +| network_namespace | [string](#string) | | | + + + + + + + + +### ContainersRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | + + + + + + + + +### ContainersResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Container](#machine.Container) | repeated | | + + + + + + + + +### ControlPlaneConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| endpoint | [string](#string) | | | + + + + + + + + +### CopyRequest +CopyRequest describes a request to copy data out of Talos node + +Copy produces .tar.gz archive which is streamed back to the caller + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | + + + + + + + + +### DHCPOptionsConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| route_metric | [uint32](#uint32) | | | + + + + + + + + +### DiskStat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| read_completed | [uint64](#uint64) | | | +| read_merged | [uint64](#uint64) | | | +| read_sectors | [uint64](#uint64) | | | +| read_time_ms | [uint64](#uint64) | | | +| write_completed | [uint64](#uint64) | | | +| write_merged | [uint64](#uint64) | | | +| write_sectors | [uint64](#uint64) | | | +| write_time_ms | [uint64](#uint64) | | | +| io_in_progress | [uint64](#uint64) | | | +| io_time_ms | [uint64](#uint64) | | | +| io_time_weighted_ms | [uint64](#uint64) | | | +| discard_completed | [uint64](#uint64) | | | +| discard_merged | [uint64](#uint64) | | | +| discard_sectors | [uint64](#uint64) | | | +| discard_time_ms | [uint64](#uint64) | | | + + + + + + + + +### DiskStats + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| total | [DiskStat](#machine.DiskStat) | | | +| devices | [DiskStat](#machine.DiskStat) | repeated | | + + + + + + + + +### DiskStatsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [DiskStats](#machine.DiskStats) | repeated | | + + + + + + + + +### DiskUsageInfo +DiskUsageInfo describes a file or directory's information for du command + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | +| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | +| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | +| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | + + + + + + + + +### DiskUsageRequest +DiskUsageRequest describes a request to list disk usage of directories and regular files + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | +| all | [bool](#bool) | | All write sizes for all files, not just directories. | +| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | +| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | + + + + + + + + +### DmesgRequest +dmesg + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| follow | [bool](#bool) | | | +| tail | [bool](#bool) | | | + + + + + + + + +### EtcdAlarm + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| member_alarms | [EtcdMemberAlarm](#machine.EtcdMemberAlarm) | repeated | | + + + + + + + + +### EtcdAlarmDisarm + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| member_alarms | [EtcdMemberAlarm](#machine.EtcdMemberAlarm) | repeated | | + + + + + + + + +### EtcdAlarmDisarmResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdAlarmDisarm](#machine.EtcdAlarmDisarm) | repeated | | + + + + + + + + +### EtcdAlarmListResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdAlarm](#machine.EtcdAlarm) | repeated | | + + + + + + + + +### EtcdDefragment + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdDefragmentResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdDefragment](#machine.EtcdDefragment) | repeated | | + + + + + + + + +### EtcdForfeitLeadership + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| member | [string](#string) | | | + + + + + + + + +### EtcdForfeitLeadershipRequest + + + + + + + + + +### EtcdForfeitLeadershipResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | + + + + + + + + +### EtcdLeaveCluster + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdLeaveClusterRequest + + + + + + + + + +### EtcdLeaveClusterResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | + + + + + + + + +### EtcdMember +EtcdMember describes a single etcd member. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [uint64](#uint64) | | member ID. | +| hostname | [string](#string) | | human-readable name of the member. | +| peer_urls | [string](#string) | repeated | the list of URLs the member exposes to clients for communication. | +| client_urls | [string](#string) | repeated | the list of URLs the member exposes to the cluster for communication. | +| is_learner | [bool](#bool) | | learner flag | + + + + + + + + +### EtcdMemberAlarm + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member_id | [uint64](#uint64) | | | +| alarm | [EtcdMemberAlarm.AlarmType](#machine.EtcdMemberAlarm.AlarmType) | | | + + + + + + + + +### EtcdMemberListRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| query_local | [bool](#bool) | | | + + + + + + + + +### EtcdMemberListResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdMembers](#machine.EtcdMembers) | repeated | | + + + + + + + + +### EtcdMemberStatus + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member_id | [uint64](#uint64) | | | +| protocol_version | [string](#string) | | | +| db_size | [int64](#int64) | | | +| db_size_in_use | [int64](#int64) | | | +| leader | [uint64](#uint64) | | | +| raft_index | [uint64](#uint64) | | | +| raft_term | [uint64](#uint64) | | | +| raft_applied_index | [uint64](#uint64) | | | +| errors | [string](#string) | repeated | | +| is_learner | [bool](#bool) | | | + + + + + + + + +### EtcdMembers +EtcdMembers contains the list of members registered on the host. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| legacy_members | [string](#string) | repeated | list of member hostnames. | +| members | [EtcdMember](#machine.EtcdMember) | repeated | the list of etcd members registered on the node. | + + + + + + + + +### EtcdRecover + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdRecoverResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdRecover](#machine.EtcdRecover) | repeated | | + + + + + + + + +### EtcdRemoveMember + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdRemoveMemberByID + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### EtcdRemoveMemberByIDRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member_id | [uint64](#uint64) | | | + + + + + + + + +### EtcdRemoveMemberByIDResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdRemoveMemberByID](#machine.EtcdRemoveMemberByID) | repeated | | + + + + + + + + +### EtcdRemoveMemberRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| member | [string](#string) | | | + + + + + + + + +### EtcdRemoveMemberResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | + + + + + + + + +### EtcdSnapshotRequest + + + + + + + + + +### EtcdStatus + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| member_status | [EtcdMemberStatus](#machine.EtcdMemberStatus) | | | + + + + + + + + +### EtcdStatusResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [EtcdStatus](#machine.EtcdStatus) | repeated | | + + + + + + + + +### Event + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| data | [google.protobuf.Any](#google.protobuf.Any) | | | +| id | [string](#string) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### EventsRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| tail_events | [int32](#int32) | | | +| tail_id | [string](#string) | | | +| tail_seconds | [int32](#int32) | | | +| with_actor_id | [string](#string) | | | + + + + + + + + +### FeaturesInfo +FeaturesInfo describes individual Talos features that can be switched on or off. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| rbac | [bool](#bool) | | RBAC is true if role-based access control is enabled. | + + + + + + + + +### FileInfo +FileInfo describes a file or directory's information + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | +| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | +| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | +| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified | +| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | +| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | +| link | [string](#string) | | Link is filled with symlink target | +| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | +| uid | [uint32](#uint32) | | Owner uid | +| gid | [uint32](#uint32) | | Owner gid | + + + + + + + + +### GenerateClientConfiguration + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| ca | [bytes](#bytes) | | PEM-encoded CA certificate. | +| crt | [bytes](#bytes) | | PEM-encoded generated client certificate. | +| key | [bytes](#bytes) | | PEM-encoded generated client key. | +| talosconfig | [bytes](#bytes) | | Client configuration (talosconfig) file content. | + + + + + + + + +### GenerateClientConfigurationRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| roles | [string](#string) | repeated | Roles in the generated client certificate. | +| crt_ttl | [google.protobuf.Duration](#google.protobuf.Duration) | | Client certificate TTL. | + + + + + + + + +### GenerateClientConfigurationResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [GenerateClientConfiguration](#machine.GenerateClientConfiguration) | repeated | | + + + + + + + + +### GenerateConfiguration +GenerateConfiguration describes the response to a generate configuration request. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| data | [bytes](#bytes) | repeated | | +| talosconfig | [bytes](#bytes) | | | + + + + + + + + +### GenerateConfigurationRequest +GenerateConfigurationRequest describes a request to generate a new configuration +on a node. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| config_version | [string](#string) | | | +| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | +| machine_config | [MachineConfig](#machine.MachineConfig) | | | +| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### GenerateConfigurationResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | + + + + + + + + +### Hostname + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| hostname | [string](#string) | | | + + + + + + + + +### HostnameResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Hostname](#machine.Hostname) | repeated | | + + + + + + + + +### ImageListRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [common.ContainerdNamespace](#common.ContainerdNamespace) | | Containerd namespace to use. | + + + + + + + + +### ImageListResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| name | [string](#string) | | | +| digest | [string](#string) | | | +| size | [int64](#int64) | | | +| created_at | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### ImagePull + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### ImagePullRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [common.ContainerdNamespace](#common.ContainerdNamespace) | | Containerd namespace to use. | +| reference | [string](#string) | | Image reference to pull. | + + + + + + + + +### ImagePullResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ImagePull](#machine.ImagePull) | repeated | | + + + + + + + + +### InstallConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| install_disk | [string](#string) | | | +| install_image | [string](#string) | | | + + + + + + + + +### ListRequest +ListRequest describes a request to list the contents of a directory. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | +| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | +| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | +| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | + + + + + + + + +### LoadAvg + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| load1 | [double](#double) | | | +| load5 | [double](#double) | | | +| load15 | [double](#double) | | | + + + + + + + + +### LoadAvgResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [LoadAvg](#machine.LoadAvg) | repeated | | + + + + + + + + +### LogsRequest +rpc logs +The request message containing the process name. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| id | [string](#string) | | | +| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | +| follow | [bool](#bool) | | | +| tail_lines | [int32](#int32) | | | + + + + + + + + +### MachineConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | +| install_config | [InstallConfig](#machine.InstallConfig) | | | +| network_config | [NetworkConfig](#machine.NetworkConfig) | | | +| kubernetes_version | [string](#string) | | | + + + + + + + + +### MachineStatusEvent +MachineStatusEvent reports changes to the MachineStatus resource. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| stage | [MachineStatusEvent.MachineStage](#machine.MachineStatusEvent.MachineStage) | | | +| status | [MachineStatusEvent.MachineStatus](#machine.MachineStatusEvent.MachineStatus) | | | + + + + + + + + +### MachineStatusEvent.MachineStatus + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ready | [bool](#bool) | | | +| unmet_conditions | [MachineStatusEvent.MachineStatus.UnmetCondition](#machine.MachineStatusEvent.MachineStatus.UnmetCondition) | repeated | | + + + + + + + + +### MachineStatusEvent.MachineStatus.UnmetCondition + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| reason | [string](#string) | | | + + + + + + + + +### MemInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| memtotal | [uint64](#uint64) | | | +| memfree | [uint64](#uint64) | | | +| memavailable | [uint64](#uint64) | | | +| buffers | [uint64](#uint64) | | | +| cached | [uint64](#uint64) | | | +| swapcached | [uint64](#uint64) | | | +| active | [uint64](#uint64) | | | +| inactive | [uint64](#uint64) | | | +| activeanon | [uint64](#uint64) | | | +| inactiveanon | [uint64](#uint64) | | | +| activefile | [uint64](#uint64) | | | +| inactivefile | [uint64](#uint64) | | | +| unevictable | [uint64](#uint64) | | | +| mlocked | [uint64](#uint64) | | | +| swaptotal | [uint64](#uint64) | | | +| swapfree | [uint64](#uint64) | | | +| dirty | [uint64](#uint64) | | | +| writeback | [uint64](#uint64) | | | +| anonpages | [uint64](#uint64) | | | +| mapped | [uint64](#uint64) | | | +| shmem | [uint64](#uint64) | | | +| slab | [uint64](#uint64) | | | +| sreclaimable | [uint64](#uint64) | | | +| sunreclaim | [uint64](#uint64) | | | +| kernelstack | [uint64](#uint64) | | | +| pagetables | [uint64](#uint64) | | | +| nfsunstable | [uint64](#uint64) | | | +| bounce | [uint64](#uint64) | | | +| writebacktmp | [uint64](#uint64) | | | +| commitlimit | [uint64](#uint64) | | | +| committedas | [uint64](#uint64) | | | +| vmalloctotal | [uint64](#uint64) | | | +| vmallocused | [uint64](#uint64) | | | +| vmallocchunk | [uint64](#uint64) | | | +| hardwarecorrupted | [uint64](#uint64) | | | +| anonhugepages | [uint64](#uint64) | | | +| shmemhugepages | [uint64](#uint64) | | | +| shmempmdmapped | [uint64](#uint64) | | | +| cmatotal | [uint64](#uint64) | | | +| cmafree | [uint64](#uint64) | | | +| hugepagestotal | [uint64](#uint64) | | | +| hugepagesfree | [uint64](#uint64) | | | +| hugepagesrsvd | [uint64](#uint64) | | | +| hugepagessurp | [uint64](#uint64) | | | +| hugepagesize | [uint64](#uint64) | | | +| directmap4k | [uint64](#uint64) | | | +| directmap2m | [uint64](#uint64) | | | +| directmap1g | [uint64](#uint64) | | | + + + + + + + + +### Memory + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| meminfo | [MemInfo](#machine.MemInfo) | | | + + + + + + + + +### MemoryResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Memory](#machine.Memory) | repeated | | + + + + + + + + +### MetaDelete + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### MetaDeleteRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [uint32](#uint32) | | | + + + + + + + + +### MetaDeleteResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [MetaDelete](#machine.MetaDelete) | repeated | | + + + + + + + + +### MetaWrite + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### MetaWriteRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| key | [uint32](#uint32) | | | +| value | [bytes](#bytes) | | | + + + + + + + + +### MetaWriteResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [MetaWrite](#machine.MetaWrite) | repeated | | + + + + + + + + +### MountStat +The messages message containing the requested processes. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| filesystem | [string](#string) | | | +| size | [uint64](#uint64) | | | +| available | [uint64](#uint64) | | | +| mounted_on | [string](#string) | | | + + + + + + + + +### Mounts +The messages message containing the requested df stats. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| stats | [MountStat](#machine.MountStat) | repeated | | + + + + + + + + +### MountsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Mounts](#machine.Mounts) | repeated | | + + + + + + + + +### NetDev + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| rx_bytes | [uint64](#uint64) | | | +| rx_packets | [uint64](#uint64) | | | +| rx_errors | [uint64](#uint64) | | | +| rx_dropped | [uint64](#uint64) | | | +| rx_fifo | [uint64](#uint64) | | | +| rx_frame | [uint64](#uint64) | | | +| rx_compressed | [uint64](#uint64) | | | +| rx_multicast | [uint64](#uint64) | | | +| tx_bytes | [uint64](#uint64) | | | +| tx_packets | [uint64](#uint64) | | | +| tx_errors | [uint64](#uint64) | | | +| tx_dropped | [uint64](#uint64) | | | +| tx_fifo | [uint64](#uint64) | | | +| tx_collisions | [uint64](#uint64) | | | +| tx_carrier | [uint64](#uint64) | | | +| tx_compressed | [uint64](#uint64) | | | + + + + + + + + +### Netstat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| connectrecord | [ConnectRecord](#machine.ConnectRecord) | repeated | | + + + + + + + + +### NetstatRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| filter | [NetstatRequest.Filter](#machine.NetstatRequest.Filter) | | | +| feature | [NetstatRequest.Feature](#machine.NetstatRequest.Feature) | | | +| l4proto | [NetstatRequest.L4proto](#machine.NetstatRequest.L4proto) | | | +| netns | [NetstatRequest.NetNS](#machine.NetstatRequest.NetNS) | | | + + + + + + + + +### NetstatRequest.Feature + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pid | [bool](#bool) | | | + + + + + + + + +### NetstatRequest.L4proto + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| tcp | [bool](#bool) | | | +| tcp6 | [bool](#bool) | | | +| udp | [bool](#bool) | | | +| udp6 | [bool](#bool) | | | +| udplite | [bool](#bool) | | | +| udplite6 | [bool](#bool) | | | +| raw | [bool](#bool) | | | +| raw6 | [bool](#bool) | | | + + + + + + + + +### NetstatRequest.NetNS + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostnetwork | [bool](#bool) | | | +| netns | [string](#string) | repeated | | +| allnetns | [bool](#bool) | | | + + + + + + + + +### NetstatResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Netstat](#machine.Netstat) | repeated | | + + + + + + + + +### NetworkConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hostname | [string](#string) | | | +| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | + + + + + + + + +### NetworkDeviceConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| interface | [string](#string) | | | +| cidr | [string](#string) | | | +| mtu | [int32](#int32) | | | +| dhcp | [bool](#bool) | | | +| ignore | [bool](#bool) | | | +| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | +| routes | [RouteConfig](#machine.RouteConfig) | repeated | | + + + + + + + + +### NetworkDeviceStats + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| total | [NetDev](#machine.NetDev) | | | +| devices | [NetDev](#machine.NetDev) | repeated | | + + + + + + + + +### NetworkDeviceStatsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | + + + + + + + + +### PacketCaptureRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| interface | [string](#string) | | Interface name to perform packet capture on. | +| promiscuous | [bool](#bool) | | Enable promiscuous mode. | +| snap_len | [uint32](#uint32) | | Snap length in bytes. | +| bpf_filter | [BPFInstruction](#machine.BPFInstruction) | repeated | BPF filter. | + + + + + + + + +### PhaseEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| phase | [string](#string) | | | +| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | + + + + + + + + +### PlatformInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| name | [string](#string) | | | +| mode | [string](#string) | | | + + + + + + + + +### Process + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | + + + + + + + + +### ProcessInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| pid | [int32](#int32) | | | +| ppid | [int32](#int32) | | | +| state | [string](#string) | | | +| threads | [int32](#int32) | | | +| cpu_time | [double](#double) | | | +| virtual_memory | [uint64](#uint64) | | | +| resident_memory | [uint64](#uint64) | | | +| command | [string](#string) | | | +| executable | [string](#string) | | | +| args | [string](#string) | | | + + + + + + + + +### ProcessesResponse +rpc processes + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Process](#machine.Process) | repeated | | + + + + + + + + +### ReadRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| path | [string](#string) | | | + + + + + + + + +### Reboot +The reboot message containing the reboot status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### RebootRequest +rpc reboot + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| mode | [RebootRequest.Mode](#machine.RebootRequest.Mode) | | | + + + + + + + + +### RebootResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Reboot](#machine.Reboot) | repeated | | + + + + + + + + +### Reset +The reset message containing the restart status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### ResetPartitionSpec +rpc reset + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| label | [string](#string) | | | +| wipe | [bool](#bool) | | | + + + + + + + + +### ResetRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | +| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | +| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | +| user_disks_to_wipe | [string](#string) | repeated | UserDisksToWipe lists specific connected block devices to be reset (wiped). | +| mode | [ResetRequest.WipeMode](#machine.ResetRequest.WipeMode) | | WipeMode defines which devices should be wiped. | + + + + + + + + +### ResetResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Reset](#machine.Reset) | repeated | | + + + + + + + + +### Restart + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### RestartEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| cmd | [int64](#int64) | | | + + + + + + + + +### RestartRequest +rpc restart +The request message containing the process to restart. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| id | [string](#string) | | | +| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | + + + + + + + + +### RestartResponse +The messages message containing the restart status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Restart](#machine.Restart) | repeated | | + + + + + + + + +### Rollback + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | + + + + + + + + +### RollbackRequest +rpc rollback + + + + + + + + +### RollbackResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Rollback](#machine.Rollback) | repeated | | + + + + + + + + +### RouteConfig + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| network | [string](#string) | | | +| gateway | [string](#string) | | | +| metric | [uint32](#uint32) | | | + + + + + + + + +### SequenceEvent +rpc events + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| sequence | [string](#string) | | | +| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | +| error | [common.Error](#common.Error) | | | + + + + + + + + +### ServiceEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| msg | [string](#string) | | | +| state | [string](#string) | | | +| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### ServiceEvents + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | + + + + + + + + +### ServiceHealth + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| unknown | [bool](#bool) | | | +| healthy | [bool](#bool) | | | +| last_message | [string](#string) | | | +| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### ServiceInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [string](#string) | | | +| state | [string](#string) | | | +| events | [ServiceEvents](#machine.ServiceEvents) | | | +| health | [ServiceHealth](#machine.ServiceHealth) | | | + + + + + + + + +### ServiceList +rpc servicelist + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | + + + + + + + + +### ServiceListResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ServiceList](#machine.ServiceList) | repeated | | + + + + + + + + +### ServiceRestart + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| resp | [string](#string) | | | + + + + + + + + +### ServiceRestartRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [string](#string) | | | + + + + + + + + +### ServiceRestartResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | + + + + + + + + +### ServiceStart + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| resp | [string](#string) | | | + + + + + + + + +### ServiceStartRequest +rpc servicestart + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [string](#string) | | | + + + + + + + + +### ServiceStartResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ServiceStart](#machine.ServiceStart) | repeated | | + + + + + + + + +### ServiceStateEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| service | [string](#string) | | | +| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | +| message | [string](#string) | | | +| health | [ServiceHealth](#machine.ServiceHealth) | | | + + + + + + + + +### ServiceStop + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| resp | [string](#string) | | | + + + + + + + + +### ServiceStopRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| id | [string](#string) | | | + + + + + + + + +### ServiceStopResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [ServiceStop](#machine.ServiceStop) | repeated | | + + + + + + + + +### Shutdown +rpc shutdown +The messages message containing the shutdown status. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### ShutdownRequest + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| force | [bool](#bool) | | Force indicates whether node should shutdown without first cordening and draining | + + + + + + + + +### ShutdownResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Shutdown](#machine.Shutdown) | repeated | | + + + + + + + + +### SoftIRQStat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| hi | [uint64](#uint64) | | | +| timer | [uint64](#uint64) | | | +| net_tx | [uint64](#uint64) | | | +| net_rx | [uint64](#uint64) | | | +| block | [uint64](#uint64) | | | +| block_io_poll | [uint64](#uint64) | | | +| tasklet | [uint64](#uint64) | | | +| sched | [uint64](#uint64) | | | +| hrtimer | [uint64](#uint64) | | | +| rcu | [uint64](#uint64) | | | + + + + + + + + +### Stat +The messages message containing the requested stat. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| id | [string](#string) | | | +| memory_usage | [uint64](#uint64) | | | +| cpu_usage | [uint64](#uint64) | | | +| pod_id | [string](#string) | | | +| name | [string](#string) | | | + + + + + + + + +### Stats +The messages message containing the requested stats. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| stats | [Stat](#machine.Stat) | repeated | | + + + + + + + + +### StatsRequest +The request message containing the containerd namespace. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| namespace | [string](#string) | | | +| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | + + + + + + + + +### StatsResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Stats](#machine.Stats) | repeated | | + + + + + + + + +### SystemStat + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| boot_time | [uint64](#uint64) | | | +| cpu_total | [CPUStat](#machine.CPUStat) | | | +| cpu | [CPUStat](#machine.CPUStat) | repeated | | +| irq_total | [uint64](#uint64) | | | +| irq | [uint64](#uint64) | repeated | | +| context_switches | [uint64](#uint64) | | | +| process_created | [uint64](#uint64) | | | +| process_running | [uint64](#uint64) | | | +| process_blocked | [uint64](#uint64) | | | +| soft_irq_total | [uint64](#uint64) | | | +| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | + + + + + + + + +### SystemStatResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [SystemStat](#machine.SystemStat) | repeated | | + + + + + + + + +### TaskEvent + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| task | [string](#string) | | | +| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | + + + + + + + + +### Upgrade + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| ack | [string](#string) | | | +| actor_id | [string](#string) | | | + + + + + + + + +### UpgradeRequest +rpc upgrade + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| image | [string](#string) | | | +| preserve | [bool](#bool) | | | +| stage | [bool](#bool) | | | +| force | [bool](#bool) | | | +| reboot_mode | [UpgradeRequest.RebootMode](#machine.UpgradeRequest.RebootMode) | | | + + + + + + + + +### UpgradeResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Upgrade](#machine.Upgrade) | repeated | | + + + + + + + + +### Version + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| version | [VersionInfo](#machine.VersionInfo) | | | +| platform | [PlatformInfo](#machine.PlatformInfo) | | | +| features | [FeaturesInfo](#machine.FeaturesInfo) | | Features describe individual Talos features that can be switched on or off. | + + + + + + + + +### VersionInfo + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| tag | [string](#string) | | | +| sha | [string](#string) | | | +| built | [string](#string) | | | +| go_version | [string](#string) | | | +| os | [string](#string) | | | +| arch | [string](#string) | | | + + + + + + + + +### VersionResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Version](#machine.Version) | repeated | | + + + + + + + + + + +### ApplyConfigurationRequest.Mode + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| REBOOT | 0 | | +| AUTO | 1 | | +| NO_REBOOT | 2 | | +| STAGED | 3 | | +| TRY | 4 | | + + + + + +### ConnectRecord.State + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| RESERVED | 0 | | +| ESTABLISHED | 1 | | +| SYN_SENT | 2 | | +| SYN_RECV | 3 | | +| FIN_WAIT1 | 4 | | +| FIN_WAIT2 | 5 | | +| TIME_WAIT | 6 | | +| CLOSE | 7 | | +| CLOSEWAIT | 8 | | +| LASTACK | 9 | | +| LISTEN | 10 | | +| CLOSING | 11 | | + + + + + +### ConnectRecord.TimerActive + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| OFF | 0 | | +| ON | 1 | | +| KEEPALIVE | 2 | | +| TIMEWAIT | 3 | | +| PROBE | 4 | | + + + + + +### EtcdMemberAlarm.AlarmType + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NONE | 0 | | +| NOSPACE | 1 | | +| CORRUPT | 2 | | + + + + + +### ListRequest.Type +File type. + +| Name | Number | Description | +| ---- | ------ | ----------- | +| REGULAR | 0 | Regular file (not directory, symlink, etc). | +| DIRECTORY | 1 | Directory. | +| SYMLINK | 2 | Symbolic link. | + + + + + +### MachineConfig.MachineType + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| TYPE_UNKNOWN | 0 | | +| TYPE_INIT | 1 | | +| TYPE_CONTROL_PLANE | 2 | | +| TYPE_WORKER | 3 | | + + + + + +### MachineStatusEvent.MachineStage + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| UNKNOWN | 0 | | +| BOOTING | 1 | | +| INSTALLING | 2 | | +| MAINTENANCE | 3 | | +| RUNNING | 4 | | +| REBOOTING | 5 | | +| SHUTTING_DOWN | 6 | | +| RESETTING | 7 | | +| UPGRADING | 8 | | + + + + + +### NetstatRequest.Filter + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ALL | 0 | | +| CONNECTED | 1 | | +| LISTENING | 2 | | + + + + + +### PhaseEvent.Action + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| START | 0 | | +| STOP | 1 | | + + + + + +### RebootRequest.Mode + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| DEFAULT | 0 | | +| POWERCYCLE | 1 | | + + + + + +### ResetRequest.WipeMode + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| ALL | 0 | | +| SYSTEM_DISK | 1 | | +| USER_DISKS | 2 | | + + + + + +### SequenceEvent.Action + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| NOOP | 0 | | +| START | 1 | | +| STOP | 2 | | + + + + + +### ServiceStateEvent.Action + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| INITIALIZED | 0 | | +| PREPARING | 1 | | +| WAITING | 2 | | +| RUNNING | 3 | | +| STOPPING | 4 | | +| FINISHED | 5 | | +| FAILED | 6 | | +| SKIPPED | 7 | | + + + + + +### TaskEvent.Action + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| START | 0 | | +| STOP | 1 | | + + + + + +### UpgradeRequest.RebootMode + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| DEFAULT | 0 | | +| POWERCYCLE | 1 | | + + + + + + + + + +### MachineService +The machine service definition. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | +| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | Bootstrap method makes control plane node enter etcd bootstrap mode. + +Node aborts etcd join sequence and creates single-node etcd cluster. + +If recover_etcd argument is specified, etcd is recovered from a snapshot uploaded with EtcdRecover. | +| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | +| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | +| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | +| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | +| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | +| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | +| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | +| EtcdRemoveMember | [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) | [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) | EtcdRemoveMember removes a member from the etcd cluster by hostname. + +Please use EtcdRemoveMemberByID instead. | +| EtcdRemoveMemberByID | [EtcdRemoveMemberByIDRequest](#machine.EtcdRemoveMemberByIDRequest) | [EtcdRemoveMemberByIDResponse](#machine.EtcdRemoveMemberByIDResponse) | EtcdRemoveMemberByID removes a member from the etcd cluster identified by member ID. + +This API should be used to remove members which don't have an associated Talos node anymore. To remove a member with a running Talos node, use EtcdLeaveCluster API on the node to be removed. | +| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | +| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | +| EtcdRecover | [.common.Data](#common.Data) stream | [EtcdRecoverResponse](#machine.EtcdRecoverResponse) | EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot to the node. + +Snapshot can be later used to recover the cluster via Bootstrap method. | +| EtcdSnapshot | [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) | [.common.Data](#common.Data) stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client. + +This method is available only on control plane nodes (which run etcd). | +| EtcdAlarmList | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdAlarmListResponse](#machine.EtcdAlarmListResponse) | EtcdAlarmList lists etcd alarms for the current node. + +This method is available only on control plane nodes (which run etcd). | +| EtcdAlarmDisarm | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdAlarmDisarmResponse](#machine.EtcdAlarmDisarmResponse) | EtcdAlarmDisarm disarms etcd alarms for the current node. + +This method is available only on control plane nodes (which run etcd). | +| EtcdDefragment | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdDefragmentResponse](#machine.EtcdDefragmentResponse) | EtcdDefragment defragments etcd data directory for the current node. + +Defragmentation is a resource-heavy operation, so it should only run on a specific node. + +This method is available only on control plane nodes (which run etcd). | +| EtcdStatus | [.google.protobuf.Empty](#google.protobuf.Empty) | [EtcdStatusResponse](#machine.EtcdStatusResponse) | EtcdStatus returns etcd status for the current member. + +This method is available only on control plane nodes (which run etcd). | +| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | +| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | +| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | +| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | +| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | +| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | +| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | +| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | +| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | +| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | +| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | +| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | +| Reboot | [RebootRequest](#machine.RebootRequest) | [RebootResponse](#machine.RebootResponse) | | +| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | +| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | +| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | +| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | +| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | +| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | +| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | +| Shutdown | [ShutdownRequest](#machine.ShutdownRequest) | [ShutdownResponse](#machine.ShutdownResponse) | | +| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | +| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | +| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | +| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | +| GenerateClientConfiguration | [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) | [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) | GenerateClientConfiguration generates talosctl client configuration (talosconfig). | +| PacketCapture | [PacketCaptureRequest](#machine.PacketCaptureRequest) | [.common.Data](#common.Data) stream | PacketCapture performs packet capture and streams back pcap file. | +| Netstat | [NetstatRequest](#machine.NetstatRequest) | [NetstatResponse](#machine.NetstatResponse) | Netstat provides information about network connections. | +| MetaWrite | [MetaWriteRequest](#machine.MetaWriteRequest) | [MetaWriteResponse](#machine.MetaWriteResponse) | MetaWrite writes a META key-value pair. | +| MetaDelete | [MetaDeleteRequest](#machine.MetaDeleteRequest) | [MetaDeleteResponse](#machine.MetaDeleteResponse) | MetaDelete deletes a META key. | +| ImageList | [ImageListRequest](#machine.ImageListRequest) | [ImageListResponse](#machine.ImageListResponse) stream | ImageList lists images in the CRI. | +| ImagePull | [ImagePullRequest](#machine.ImagePullRequest) | [ImagePullResponse](#machine.ImagePullResponse) | ImagePull pulls an image into the CRI. | + + + + + + +

Top

+ +## security/security.proto + + + + + +### CertificateRequest +The request message containing the certificate signing request. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| csr | [bytes](#bytes) | | Certificate Signing Request in PEM format. | + + + + + + + + +### CertificateResponse +The response message containing signed certificate. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| ca | [bytes](#bytes) | | Certificate of the CA that signed the requested certificate in PEM format. | +| crt | [bytes](#bytes) | | Signed X.509 requested certificate in PEM format. | + + + + + + + + + + + + + + +### SecurityService +The security service definition. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | + + + + + + +

Top

+ +## storage/storage.proto + + + + + +### Disk +Disk represents a disk. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | +| model | [string](#string) | | Model idicates the disk model. | +| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | +| name | [string](#string) | | Name as in `/sys/block//device/name`. | +| serial | [string](#string) | | Serial as in `/sys/block//device/serial`. | +| modalias | [string](#string) | | Modalias as in `/sys/block//device/modalias`. | +| uuid | [string](#string) | | Uuid as in `/sys/block//device/uuid`. | +| wwid | [string](#string) | | Wwid as in `/sys/block//device/wwid`. | +| type | [Disk.DiskType](#storage.Disk.DiskType) | | Type is a type of the disk: nvme, ssd, hdd, sd card. | +| bus_path | [string](#string) | | BusPath is the bus path of the disk. | +| system_disk | [bool](#bool) | | SystemDisk indicates that the disk is used as Talos system disk. | +| subsystem | [string](#string) | | Subsystem is the symlink path in the `/sys/block//subsystem`. | + + + + + + + + +### Disks +DisksResponse represents the response of the `Disks` RPC. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| disks | [Disk](#storage.Disk) | repeated | | + + + + + + + + +### DisksResponse + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Disks](#storage.Disks) | repeated | | + + + + + + + + + + +### Disk.DiskType + + +| Name | Number | Description | +| ---- | ------ | ----------- | +| UNKNOWN | 0 | | +| SSD | 1 | | +| HDD | 2 | | +| NVME | 3 | | +| SD | 4 | | + + + + + + + + + +### StorageService +StorageService represents the storage service. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | + + + + + + +

Top

+ +## time/time.proto + + + + + +### Time + + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| metadata | [common.Metadata](#common.Metadata) | | | +| server | [string](#string) | | | +| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | +| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | + + + + + + + + +### TimeRequest +The response message containing the ntp server + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| server | [string](#string) | | | + + + + + + + + +### TimeResponse +The response message containing the ntp server, time, and offset + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| messages | [Time](#time.Time) | repeated | | + + + + + + + + + + + + + + +### TimeService +The time service definition. + +| Method Name | Request Type | Response Type | Description | +| ----------- | ------------ | ------------- | ------------| +| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | +| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | + + + + + +## Scalar Value Types + +| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | +| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | +| double | | double | double | float | float64 | double | float | Float | +| float | | float | float | float | float32 | float | float | Float | +| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | +| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | +| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | +| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | +| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | +| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | +| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | +| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | +| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | +| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | +| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | +| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | +| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | + diff --git a/website/content/v1.6/reference/cli.md b/website/content/v1.6/reference/cli.md new file mode 100644 index 0000000000..2b7b5da01d --- /dev/null +++ b/website/content/v1.6/reference/cli.md @@ -0,0 +1,3064 @@ +--- +title: CLI +desription: Talosctl CLI tool reference. +--- + + + +## talosctl apply-config + +Apply a new configuration to a node + +``` +talosctl apply-config [flags] +``` + +### Options + +``` + --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) + -p, --config-patch strings the list of config patches to apply to the local config file before sending it to the node + --dry-run check how the config change will be applied in dry-run mode + -f, --file string the filename of the updated configuration + -h, --help help for apply-config + -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service + -m, --mode auto, interactive, no-reboot, reboot, staged, try apply config mode (default auto) + --timeout duration the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl bootstrap + +Bootstrap the etcd cluster on the specified node. + +### Synopsis + +When Talos cluster is created etcd service on control plane nodes enter the join loop waiting +to join etcd peers from other control plane nodes. One node should be picked as the boostrap node. +When boostrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. +Other control plane nodes will join etcd cluster once Kubernetes is boostrapped on the bootstrap node. + +This command should not be used when "init" type node are used. + +Talos etcd cluster can be recovered from a known snapshot with '--recover-from=' flag. + +``` +talosctl bootstrap [flags] +``` + +### Options + +``` + -h, --help help for bootstrap + --recover-from string recover etcd cluster from the snapshot + --recover-skip-hash-check skip integrity check when recovering etcd (use when recovering from data directory copy) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl cluster create + +Creates a local docker-based or QEMU-based kubernetes cluster + +``` +talosctl cluster create [flags] +``` + +### Options + +``` + --arch string cluster architecture (default "amd64") + --bad-rtc launch VM with bad RTC state (QEMU only) + --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") + --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) + --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v1.5.0-alpha.3/talosctl-cni-bundle-${ARCH}.tar.gz") + --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") + --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") + --config-patch stringArray patch generated machineconfigs (applied to all node types), use @file to read a patch from file + --config-patch-control-plane stringArray patch generated machineconfigs (applied to 'init' and 'controlplane' types) + --config-patch-worker stringArray patch generated machineconfigs (applied to 'worker' type) + --control-plane-port int control plane port (load balancer and local API port) (default 6443) + --controlplanes int the number of controlplanes to create (default 1) + --cpus string the share of CPUs as fraction (each control plane/VM) (default "2.0") + --cpus-workers string the share of CPUs as fraction (each worker/VM) (default "2.0") + --crashdump print debug crashdump to stderr when cluster startup fails + --custom-cni-url string install custom CNI from the URL (Talos cluster) + --disable-dhcp-hostname skip announcing hostname via DHCP (QEMU only) + --disk int default limit on disk size in MB (each VM) (default 6144) + --disk-encryption-key-types stringArray encryption key types to use for disk encryption (uuid, kms) (default [uuid]) + --disk-image-path string disk image to use + --dns-domain string the dns domain to use for cluster (default "cluster.local") + --docker-disable-ipv6 skip enabling IPv6 in containers (Docker only) + --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") + --encrypt-ephemeral enable ephemeral partition encryption + --encrypt-state enable state partition encryption + --endpoint string use endpoint instead of provider defaults + -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) + --extra-boot-kernel-args string add extra kernel args to the initial boot from vmlinuz and initramfs (QEMU only) + --extra-disks int number of extra disks to create for each worker VM + --extra-disks-size int default limit on disk size in MB (each VM) (default 5120) + --extra-uefi-search-paths strings additional search paths for UEFI firmware (only applies when UEFI is enabled) + -h, --help help for create + --image string the image to use (default "ghcr.io/siderolabs/talos:latest") + --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint + --initrd-path string initramfs image to use (default "_out/initramfs-${ARCH}.xz") + -i, --input-dir string location of pre-generated config files + --install-image string the installer image to use (default "ghcr.io/siderolabs/installer:latest") + --ipv4 enable IPv4 network in the cluster (default true) + --ipv6 enable IPv6 network in the cluster (QEMU provisioner only) + --iso-path string the ISO path to use for the initial boot (VM only) + --kubeprism-port int KubePrism port (defaults to 0 - disabled) + --kubernetes-version string desired kubernetes version to run (default "1.28.0") + --memory int the limit on memory usage in MB (each control plane/VM) (default 2048) + --memory-workers int the limit on memory usage in MB (each worker/VM) (default 2048) + --mtu int MTU of the cluster network (default 1500) + --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) + --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for + --registry-mirror strings list of registry mirrors to use in format: = + --skip-boot-phase-finished-check skip waiting for node to finish boot phase + --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory + --skip-kubeconfig skip merging kubeconfig from the created cluster + --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. + --use-vip use a virtual IP for the controlplane endpoint instead of the loadbalancer + --user-disk strings list of disks to create for each VM in format: ::: + --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") + --wait wait for the cluster to be ready before returning (default true) + --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) + --wireguard-cidr string CIDR of the wireguard network + --with-apply-config enable apply config when the VM is starting in maintenance mode + --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) + --with-cluster-discovery enable cluster discovery (default true) + --with-debug enable debug in Talos config to send service logs to the console + --with-init-node create the cluster with an init node + --with-kubespan enable KubeSpan system + --with-network-bandwidth int specify bandwidth restriction (in kbps) on the bridge interface when creating a qemu cluster + --with-network-chaos enable to use network chaos parameters when creating a qemu cluster + --with-network-jitter duration specify jitter on the bridge interface when creating a qemu cluster + --with-network-latency duration specify latency on the bridge interface when creating a qemu cluster + --with-network-packet-corrupt float specify percent of corrupt packets on the bridge interface when creating a qemu cluster. e.g. 50% = 0.50 (default: 0.0) + --with-network-packet-loss float specify percent of packet loss on the bridge interface when creating a qemu cluster. e.g. 50% = 0.50 (default: 0.0) + --with-network-packet-reorder float specify percent of reordered packets on the bridge interface when creating a qemu cluster. e.g. 50% = 0.50 (default: 0.0) + --with-tpm2 enable TPM2 emulation support using swtpm + --with-uefi enable UEFI on x86_64 architecture (default true) + --workers int the number of workers to create (default 1) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --name string the name of the cluster (default "talos-default") + -n, --nodes strings target the specified nodes + --provisioner string Talos cluster provisioner to use (default "docker") + --state string directory path to store cluster state (default "/home/user/.talos/clusters") +``` + +### SEE ALSO + +* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters + +## talosctl cluster destroy + +Destroys a local docker-based or firecracker-based kubernetes cluster + +``` +talosctl cluster destroy [flags] +``` + +### Options + +``` + -f, --force force deletion of cluster directory if there were errors + -h, --help help for destroy +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --name string the name of the cluster (default "talos-default") + -n, --nodes strings target the specified nodes + --provisioner string Talos cluster provisioner to use (default "docker") + --state string directory path to store cluster state (default "/home/user/.talos/clusters") + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters + +## talosctl cluster show + +Shows info about a local provisioned kubernetes cluster + +``` +talosctl cluster show [flags] +``` + +### Options + +``` + -h, --help help for show +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --name string the name of the cluster (default "talos-default") + -n, --nodes strings target the specified nodes + --provisioner string Talos cluster provisioner to use (default "docker") + --state string directory path to store cluster state (default "/home/user/.talos/clusters") + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters + +## talosctl cluster + +A collection of commands for managing local docker-based or QEMU-based clusters + +### Options + +``` + -h, --help help for cluster + --name string the name of the cluster (default "talos-default") + --provisioner string Talos cluster provisioner to use (default "docker") + --state string directory path to store cluster state (default "/home/user/.talos/clusters") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster +* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster +* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster + +## talosctl completion + +Output shell completion code for the specified shell (bash, fish or zsh) + +### Synopsis + +Output shell completion code for the specified shell (bash, fish or zsh). +The shell code must be evaluated to provide interactive +completion of talosctl commands. This can be done by sourcing it from +the .bash_profile. + +Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 + +``` +talosctl completion SHELL [flags] +``` + +### Examples + +``` +# Installing bash completion on macOS using homebrew +## If running Bash 3.2 included with macOS + brew install bash-completion +## or, if running Bash 4.1+ + brew install bash-completion@2 +## If talosctl is installed via homebrew, this should start working immediately. +## If you've installed via other means, you may need add the completion to your completion directory + talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl + +# Installing bash completion on Linux +## If bash-completion is not installed on Linux, please install the 'bash-completion' package +## via your distribution's package manager. +## Load the talosctl completion code for bash into the current shell + source <(talosctl completion bash) +## Write bash completion code to a file and source if from .bash_profile + talosctl completion bash > ~/.talos/completion.bash.inc + printf " + # talosctl shell completion + source '$HOME/.talos/completion.bash.inc' + " >> $HOME/.bash_profile + source $HOME/.bash_profile +# Load the talosctl completion code for fish[1] into the current shell + talosctl completion fish | source +# Set the talosctl completion code for fish[1] to autoload on startup + talosctl completion fish > ~/.config/fish/completions/talosctl.fish +# Load the talosctl completion code for zsh[1] into the current shell + source <(talosctl completion zsh) +# Set the talosctl completion code for zsh[1] to autoload on startup + talosctl completion zsh > "${fpath[1]}/_talosctl" +``` + +### Options + +``` + -h, --help help for completion +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl config add + +Add a new context + +``` +talosctl config add [flags] +``` + +### Options + +``` + --ca string the path to the CA certificate + --crt string the path to the certificate + -h, --help help for add + --key string the path to the key +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config context + +Set the current context + +``` +talosctl config context [flags] +``` + +### Options + +``` + -h, --help help for context +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config contexts + +List defined contexts + +``` +talosctl config contexts [flags] +``` + +### Options + +``` + -h, --help help for contexts +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config endpoint + +Set the endpoint(s) for the current context + +``` +talosctl config endpoint ... [flags] +``` + +### Options + +``` + -h, --help help for endpoint +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config info + +Show information about the current context + +``` +talosctl config info [flags] +``` + +### Options + +``` + -h, --help help for info +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config merge + +Merge additional contexts from another client configuration file + +### Synopsis + +Contexts with the same name are renamed while merging configs. + +``` +talosctl config merge [flags] +``` + +### Options + +``` + -h, --help help for merge +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config new + +Generate a new client configuration file + +``` +talosctl config new [] [flags] +``` + +### Options + +``` + --crt-ttl duration certificate TTL (default 87600h0m0s) + -h, --help help for new + --roles strings roles (default [os:admin]) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config node + +Set the node(s) for the current context + +``` +talosctl config node ... [flags] +``` + +### Options + +``` + -h, --help help for node +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config remove + +Remove contexts + +``` +talosctl config remove [flags] +``` + +### Options + +``` + --dry-run dry run + -h, --help help for remove + -y, --noconfirm do not ask for confirmation +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) + +## talosctl config + +Manage the client configuration file (talosconfig) + +### Options + +``` + -h, --help help for config +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl config add](#talosctl-config-add) - Add a new context +* [talosctl config context](#talosctl-config-context) - Set the current context +* [talosctl config contexts](#talosctl-config-contexts) - List defined contexts +* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context +* [talosctl config info](#talosctl-config-info) - Show information about the current context +* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another client configuration file +* [talosctl config new](#talosctl-config-new) - Generate a new client configuration file +* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context +* [talosctl config remove](#talosctl-config-remove) - Remove contexts + +## talosctl conformance kubernetes + +Run Kubernetes conformance tests + +``` +talosctl conformance kubernetes [flags] +``` + +### Options + +``` + -h, --help help for kubernetes + --mode string conformance test mode: [fast, certified] (default "fast") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl conformance](#talosctl-conformance) - Run conformance tests + +## talosctl conformance + +Run conformance tests + +### Options + +``` + -h, --help help for conformance +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl conformance kubernetes](#talosctl-conformance-kubernetes) - Run Kubernetes conformance tests + +## talosctl containers + +List containers + +``` +talosctl containers [flags] +``` + +### Options + +``` + -h, --help help for containers + -k, --kubernetes use the k8s.io containerd namespace +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl copy + +Copy data out from the node + +### Synopsis + +Creates an .tar.gz archive at the node starting at and +streams it back to the client. + +If '-' is given for , archive is written to stdout. +Otherwise archive is extracted to which should be an empty directory or +talosctl creates a directory if doesn't exist. Command doesn't preserve +ownership and access mode for the files in extract mode, while streamed .tar archive +captures ownership and permission bits. + +``` +talosctl copy -| [flags] +``` + +### Options + +``` + -h, --help help for copy +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl dashboard + +Cluster dashboard with node overview, logs and real-time metrics + +### Synopsis + +Provide a text-based UI to navigate node overview, logs and real-time metrics. + +Keyboard shortcuts: + + - h, : switch one node to the left + - l, : switch one node to the right + - j, : scroll logs/process list down + - k, : scroll logs/process list up + - : scroll logs/process list half page down + - : scroll logs/process list half page up + - : scroll logs/process list one page down + - : scroll logs/process list one page up + + +``` +talosctl dashboard [flags] +``` + +### Options + +``` + -h, --help help for dashboard + -d, --update-interval duration interval between updates (default 3s) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl disks + +Get the list of disks from /sys/block on the machine + +``` +talosctl disks [flags] +``` + +### Options + +``` + -h, --help help for disks + -i, --insecure get disks using the insecure (encrypted with no auth) maintenance service +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl dmesg + +Retrieve kernel logs + +``` +talosctl dmesg [flags] +``` + +### Options + +``` + -f, --follow specify if the kernel log should be streamed + -h, --help help for dmesg + --tail specify if only new messages should be sent (makes sense only when combined with --follow) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl edit + +Edit a resource from the default editor. + +### Synopsis + +The edit command allows you to directly edit any API resource +you can retrieve via the command line tools. + +It will open the editor defined by your TALOS_EDITOR, +or EDITOR environment variables, or fall back to 'vi' for Linux +or 'notepad' for Windows. + +``` +talosctl edit [] [flags] +``` + +### Options + +``` + --dry-run do not apply the change after editing and print the change summary instead + -h, --help help for edit + -m, --mode auto, no-reboot, reboot, staged, try apply config mode (default auto) + --namespace string resource namespace (default is to use default namespace per resource) + --timeout duration the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl etcd alarm disarm + +Disarm the etcd alarms for the node. + +``` +talosctl etcd alarm disarm [flags] +``` + +### Options + +``` + -h, --help help for disarm +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd alarm](#talosctl-etcd-alarm) - Manage etcd alarms + +## talosctl etcd alarm list + +List the etcd alarms for the node. + +``` +talosctl etcd alarm list [flags] +``` + +### Options + +``` + -h, --help help for list +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd alarm](#talosctl-etcd-alarm) - Manage etcd alarms + +## talosctl etcd alarm + +Manage etcd alarms + +### Options + +``` + -h, --help help for alarm +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd +* [talosctl etcd alarm disarm](#talosctl-etcd-alarm-disarm) - Disarm the etcd alarms for the node. +* [talosctl etcd alarm list](#talosctl-etcd-alarm-list) - List the etcd alarms for the node. + +## talosctl etcd defrag + +Defragment etcd database on the node + +### Synopsis + +Defragmentation is a maintenance operation that releases unused space from the etcd database file. +Defragmentation is a resource heavy operation and should be performed only when necessary on a single node at a time. + +``` +talosctl etcd defrag [flags] +``` + +### Options + +``` + -h, --help help for defrag +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd forfeit-leadership + +Tell node to forfeit etcd cluster leadership + +``` +talosctl etcd forfeit-leadership [flags] +``` + +### Options + +``` + -h, --help help for forfeit-leadership +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd leave + +Tell nodes to leave etcd cluster + +``` +talosctl etcd leave [flags] +``` + +### Options + +``` + -h, --help help for leave +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd members + +Get the list of etcd cluster members + +``` +talosctl etcd members [flags] +``` + +### Options + +``` + -h, --help help for members +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd remove-member + +Remove the node from etcd cluster + +### Synopsis + +Use this command only if you want to remove a member which is in broken state. +If there is no access to the node, or the node can't access etcd to call etcd leave. +Always prefer etcd leave over this command. +It's always better to use member ID than hostname, as hostname might not be set consistently. + +``` +talosctl etcd remove-member | [flags] +``` + +### Options + +``` + -h, --help help for remove-member +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd snapshot + +Stream snapshot of the etcd node to the path. + +``` +talosctl etcd snapshot [flags] +``` + +### Options + +``` + -h, --help help for snapshot +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd status + +Get the status of etcd cluster member + +### Synopsis + +Returns the status of etcd member on the node, use multiple nodes to get status of all members. + +``` +talosctl etcd status [flags] +``` + +### Options + +``` + -h, --help help for status +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl etcd](#talosctl-etcd) - Manage etcd + +## talosctl etcd + +Manage etcd + +### Options + +``` + -h, --help help for etcd +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl etcd alarm](#talosctl-etcd-alarm) - Manage etcd alarms +* [talosctl etcd defrag](#talosctl-etcd-defrag) - Defragment etcd database on the node +* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership +* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster +* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members +* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster +* [talosctl etcd snapshot](#talosctl-etcd-snapshot) - Stream snapshot of the etcd node to the path. +* [talosctl etcd status](#talosctl-etcd-status) - Get the status of etcd cluster member + +## talosctl events + +Stream runtime events + +``` +talosctl events [flags] +``` + +### Options + +``` + --actor-id string filter events by the specified actor ID (default is no filter) + --duration duration show events for the past duration interval (one second resolution, default is to show no history) + -h, --help help for events + --since string show events after the specified event ID (default is to show no history) + --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl gen ca + +Generates a self-signed X.509 certificate authority + +``` +talosctl gen ca [flags] +``` + +### Options + +``` + -h, --help help for ca + --hours int the hours from now on which the certificate validity period ends (default 87600) + --organization string X.509 distinguished name for the Organization + --rsa generate in RSA format +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen config + +Generates a set of configuration files for Talos cluster + +### Synopsis + +The cluster endpoint is the URL for the Kubernetes API. If you decide to use +a control plane node, common in a single node control plane setup, use port 6443 as +this is the port that the API server binds to on every control plane node. For an HA +setup, usually involving a load balancer, use the IP and port of the load balancer. + +``` +talosctl gen config [flags] +``` + +### Options + +``` + --additional-sans strings additional Subject-Alt-Names for the APIServer certificate + --config-patch stringArray patch generated machineconfigs (applied to all node types), use @file to read a patch from file + --config-patch-control-plane stringArray patch generated machineconfigs (applied to 'init' and 'controlplane' types) + --config-patch-worker stringArray patch generated machineconfigs (applied to 'worker' type) + --dns-domain string the dns domain to use for cluster (default "cluster.local") + -h, --help help for config + --install-disk string the disk to install to (default "/dev/sda") + --install-image string the image used to perform an installation (default "ghcr.io/siderolabs/installer:latest") + --kubernetes-version string desired kubernetes version to run (default "1.28.0") + -o, --output string destination to output generated files. when multiple output types are specified, it must be a directory. for a single output type, it must either be a file path, or "-" for stdout + -t, --output-types strings types of outputs to be generated. valid types are: ["controlplane" "worker" "talosconfig"] (default [controlplane,worker,talosconfig]) + -p, --persist the desired persist value for configs (default true) + --registry-mirror strings list of registry mirrors to use in format: = + --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) + --version string the desired machine config version to generate (default "v1alpha1") + --with-cluster-discovery enable cluster discovery feature (default true) + --with-docs renders all machine configs adding the documentation for each field (default true) + --with-examples renders all machine configs with the commented examples (default true) + --with-kubespan enable KubeSpan feature + --with-secrets string use a secrets file generated using 'gen secrets' +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen crt + +Generates an X.509 Ed25519 certificate + +``` +talosctl gen crt [flags] +``` + +### Options + +``` + --ca string path to the PEM encoded CERTIFICATE + --csr string path to the PEM encoded CERTIFICATE REQUEST + -h, --help help for crt + --hours int the hours from now on which the certificate validity period ends (default 24) + --name string the basename of the generated file +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen csr + +Generates a CSR using an Ed25519 private key + +``` +talosctl gen csr [flags] +``` + +### Options + +``` + -h, --help help for csr + --ip string generate the certificate for this IP address + --key string path to the PEM encoded EC or RSA PRIVATE KEY + --roles strings roles (default [os:admin]) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen key + +Generates an Ed25519 private key + +``` +talosctl gen key [flags] +``` + +### Options + +``` + -h, --help help for key + --name string the basename of the generated file +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen keypair + +Generates an X.509 Ed25519 key pair + +``` +talosctl gen keypair [flags] +``` + +### Options + +``` + -h, --help help for keypair + --ip string generate the certificate for this IP address + --organization string X.509 distinguished name for the Organization +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen secrets + +Generates a secrets bundle file which can later be used to generate a config + +``` +talosctl gen secrets [flags] +``` + +### Options + +``` + -p, --from-kubernetes-pki string use a Kubernetes PKI directory (e.g. /etc/kubernetes/pki) as input + -h, --help help for secrets + -t, --kubernetes-bootstrap-token string use the provided bootstrap token as input + -o, --output-file string path of the output file (default "secrets.yaml") + --talos-version string the desired Talos version to generate secrets bundle for (backwards compatibility, e.g. v0.8) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys + +## talosctl gen secureboot database + +Generates a UEFI database to enroll the signing certificate + +``` +talosctl gen secureboot database [flags] +``` + +### Options + +``` + --enrolled-certificate string path to the certificate to enroll (default "_out/uki-signing-cert.pem") + -h, --help help for database + --signing-certificate string path to the certificate used to sign the database (default "_out/uki-signing-cert.pem") + --signing-key string path to the key used to sign the database (default "_out/uki-signing-key.pem") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + -o, --output string path to the directory storing the generated files (default "_out") + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen secureboot](#talosctl-gen-secureboot) - Generates secrets for the SecureBoot process + +## talosctl gen secureboot pcr + +Generates a key which is used to sign TPM PCR values + +``` +talosctl gen secureboot pcr [flags] +``` + +### Options + +``` + -h, --help help for pcr +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + -o, --output string path to the directory storing the generated files (default "_out") + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen secureboot](#talosctl-gen-secureboot) - Generates secrets for the SecureBoot process + +## talosctl gen secureboot uki + +Generates a certificate which is used to sign boot assets (UKI) + +``` +talosctl gen secureboot uki [flags] +``` + +### Options + +``` + --common-name string common name for the certificate (default "Test UKI Signing Key") + -h, --help help for uki +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + -o, --output string path to the directory storing the generated files (default "_out") + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen secureboot](#talosctl-gen-secureboot) - Generates secrets for the SecureBoot process + +## talosctl gen secureboot + +Generates secrets for the SecureBoot process + +### Options + +``` + -h, --help help for secureboot + -o, --output string path to the directory storing the generated files (default "_out") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -f, --force will overwrite existing files + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys +* [talosctl gen secureboot database](#talosctl-gen-secureboot-database) - Generates a UEFI database to enroll the signing certificate +* [talosctl gen secureboot pcr](#talosctl-gen-secureboot-pcr) - Generates a key which is used to sign TPM PCR values +* [talosctl gen secureboot uki](#talosctl-gen-secureboot-uki) - Generates a certificate which is used to sign boot assets (UKI) + +## talosctl gen + +Generate CAs, certificates, and private keys + +### Options + +``` + -f, --force will overwrite existing files + -h, --help help for gen +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority +* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster +* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate +* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key +* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key +* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair +* [talosctl gen secrets](#talosctl-gen-secrets) - Generates a secrets bundle file which can later be used to generate a config +* [talosctl gen secureboot](#talosctl-gen-secureboot) - Generates secrets for the SecureBoot process + +## talosctl get + +Get a specific resource or list of resources (use 'talosctl get rd' to see all available resource types). + +### Synopsis + +Similar to 'kubectl get', 'talosctl get' returns a set of resources from the OS. +To get a list of all available resource definitions, issue 'talosctl get rd' + +``` +talosctl get [] [flags] +``` + +### Options + +``` + -h, --help help for get + -i, --insecure get resources using the insecure (encrypted with no auth) maintenance service + --namespace string resource namespace (default is to use default namespace per resource) + -o, --output string output mode (json, table, yaml, jsonpath) (default "table") + -w, --watch watch resource changes +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl health + +Check cluster health + +``` +talosctl health [flags] +``` + +### Options + +``` + --control-plane-nodes strings specify IPs of control plane nodes + -h, --help help for health + --init-node string specify IPs of init node + --k8s-endpoint string use endpoint instead of kubeconfig default + --run-e2e run Kubernetes e2e test + --server run server-side check (default true) + --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) + --worker-nodes strings specify IPs of worker nodes +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl image default + +List the default images used by Talos + +``` +talosctl image default [flags] +``` + +### Options + +``` + -h, --help help for default +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl image](#talosctl-image) - Manage CRI containter images + +## talosctl image list + +List CRI images + +``` +talosctl image list [flags] +``` + +### Options + +``` + -h, --help help for list +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl image](#talosctl-image) - Manage CRI containter images + +## talosctl image pull + +Pull an image into CRI + +``` +talosctl image pull [flags] +``` + +### Options + +``` + -h, --help help for pull +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl image](#talosctl-image) - Manage CRI containter images + +## talosctl image + +Manage CRI containter images + +### Options + +``` + -h, --help help for image + --namespace system namespace to use: system (etcd and kubelet images) or `cri` for all Kubernetes workloads (default "cri") +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl image default](#talosctl-image-default) - List the default images used by Talos +* [talosctl image list](#talosctl-image-list) - List CRI images +* [talosctl image pull](#talosctl-image-pull) - Pull an image into CRI + +## talosctl inject serviceaccount + +Inject Talos API ServiceAccount into Kubernetes manifests + +``` +talosctl inject serviceaccount [--roles=','] -f [flags] +``` + +### Examples + +``` +talosctl inject serviceaccount --roles="os:admin" -f deployment.yaml > deployment-injected.yaml + +Alternatively, stdin can be piped to the command: +cat deployment.yaml | talosctl inject serviceaccount --roles="os:admin" -f - > deployment-injected.yaml + +``` + +### Options + +``` + -f, --file string file with Kubernetes manifests to be injected with ServiceAccount + -h, --help help for serviceaccount + -r, --roles strings roles to add to the generated ServiceAccount manifests (default [os:reader]) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl inject](#talosctl-inject) - Inject Talos API resources into Kubernetes manifests + +## talosctl inject + +Inject Talos API resources into Kubernetes manifests + +### Options + +``` + -h, --help help for inject +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl inject serviceaccount](#talosctl-inject-serviceaccount) - Inject Talos API ServiceAccount into Kubernetes manifests + +## talosctl inspect dependencies + +Inspect controller-resource dependencies as graphviz graph. + +### Synopsis + +Inspect controller-resource dependencies as graphviz graph. + +Pipe the output of the command through the "dot" program (part of graphviz package) +to render the graph: + + talosctl inspect dependencies | dot -Tpng > graph.png + + +``` +talosctl inspect dependencies [flags] +``` + +### Options + +``` + -h, --help help for dependencies + --with-resources display live resource information with dependencies +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos + +## talosctl inspect + +Inspect internals of Talos + +### Options + +``` + -h, --help help for inspect +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. + +## talosctl kubeconfig + +Download the admin kubeconfig from the node + +### Synopsis + +Download the admin kubeconfig from the node. +If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. +Otherwise kubeconfig will be written to PWD or [local-path] if specified. + +``` +talosctl kubeconfig [local-path] [flags] +``` + +### Options + +``` + -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge + --force-context-name string Force context name for kubeconfig merge + -h, --help help for kubeconfig + -m, --merge Merge with existing kubeconfig (default true) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl list + +Retrieve a directory listing + +``` +talosctl list [path] [flags] +``` + +### Options + +``` + -d, --depth int32 maximum recursion depth (default 1) + -h, --help help for list + -H, --humanize humanize size and time in the output + -l, --long display additional file details + -r, --recurse recurse into subdirectories + -t, --type strings filter by specified types: + f regular file + d directory + l, L symbolic link +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl logs + +Retrieve logs for a service + +``` +talosctl logs [flags] +``` + +### Options + +``` + -f, --follow specify if the logs should be streamed + -h, --help help for logs + -k, --kubernetes use the k8s.io containerd namespace + --tail int32 lines of log file to display (default is to show from the beginning) (default -1) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl machineconfig gen + +Generates a set of configuration files for Talos cluster + +### Synopsis + +The cluster endpoint is the URL for the Kubernetes API. If you decide to use +a control plane node, common in a single node control plane setup, use port 6443 as +this is the port that the API server binds to on every control plane node. For an HA +setup, usually involving a load balancer, use the IP and port of the load balancer. + +``` +talosctl machineconfig gen [flags] +``` + +### Options + +``` + -h, --help help for gen +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl machineconfig](#talosctl-machineconfig) - Machine config related commands + +## talosctl machineconfig patch + +Patch a machine config + +``` +talosctl machineconfig patch [flags] +``` + +### Options + +``` + -h, --help help for patch + -o, --output string output destination. if not specified, output will be printed to stdout + -p, --patch stringArray patch generated machineconfigs (applied to all node types), use @file to read a patch from file +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl machineconfig](#talosctl-machineconfig) - Machine config related commands + +## talosctl machineconfig + +Machine config related commands + +### Options + +``` + -h, --help help for machineconfig +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl machineconfig gen](#talosctl-machineconfig-gen) - Generates a set of configuration files for Talos cluster +* [talosctl machineconfig patch](#talosctl-machineconfig-patch) - Patch a machine config + +## talosctl memory + +Show memory usage + +``` +talosctl memory [flags] +``` + +### Options + +``` + -h, --help help for memory + -v, --verbose display extended memory statistics +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl meta delete + +Delete a key from the META partition. + +``` +talosctl meta delete key [flags] +``` + +### Options + +``` + -h, --help help for delete +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl meta](#talosctl-meta) - Write and delete keys in the META partition + +## talosctl meta write + +Write a key-value pair to the META partition. + +``` +talosctl meta write key value [flags] +``` + +### Options + +``` + -h, --help help for write +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl meta](#talosctl-meta) - Write and delete keys in the META partition + +## talosctl meta + +Write and delete keys in the META partition + +### Options + +``` + -h, --help help for meta +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos +* [talosctl meta delete](#talosctl-meta-delete) - Delete a key from the META partition. +* [talosctl meta write](#talosctl-meta-write) - Write a key-value pair to the META partition. + +## talosctl mounts + +List mounts + +``` +talosctl mounts [flags] +``` + +### Options + +``` + -h, --help help for mounts +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl netstat + +Show network connections and sockets + +### Synopsis + +Show network connections and sockets. + +You can pass an optional argument to view a specific pod's connections. +To do this, format the argument as "namespace/pod". +Note that only pods with a pod network namespace are allowed. +If you don't pass an argument, the command will show host connections. + +``` +talosctl netstat [flags] +``` + +### Options + +``` + -a, --all display all sockets states (default: connected) + -x, --extend show detailed socket information + -h, --help help for netstat + -4, --ipv4 display only ipv4 sockets + -6, --ipv6 display only ipv6 sockets + -l, --listening display listening server sockets + -k, --pods show sockets used by Kubernetes pods + -p, --programs show process using socket + -w, --raw display only RAW sockets + -t, --tcp display only TCP sockets + -o, --timers display timers + -u, --udp display only UDP sockets + -U, --udplite display only UDPLite sockets + -v, --verbose display sockets of all supported transport protocols +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl patch + +Update field(s) of a resource using a JSON patch. + +``` +talosctl patch [] [flags] +``` + +### Options + +``` + --dry-run print the change summary and patch preview without applying the changes + -h, --help help for patch + -m, --mode auto, no-reboot, reboot, staged, try apply config mode (default auto) + --namespace string resource namespace (default is to use default namespace per resource) + -p, --patch stringArray the patch to be applied to the resource file, use @file to read a patch from file. + --patch-file string a file containing a patch to be applied to the resource. + --timeout duration the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl pcap + +Capture the network packets from the node. + +### Synopsis + +The command launches packet capture on the node and streams back the packets as raw pcap file. + +Default behavior is to decode the packets with internal decoder to stdout: + + talosctl pcap -i eth0 + +Raw pcap file can be saved with --output flag: + + talosctl pcap -i eth0 --output eth0.pcap + +Output can be piped to tcpdump: + + talosctl pcap -i eth0 -o - | tcpdump -vvv -r - + + BPF filter can be applied, but it has to compiled to BPF instructions first using tcpdump. + Correct link type should be specified for the tcpdump: EN10MB for Ethernet links and RAW + for e.g. Wireguard tunnels: + + talosctl pcap -i eth0 --bpf-filter "$(tcpdump -dd -y EN10MB 'tcp and dst port 80')" + + talosctl pcap -i kubespan --bpf-filter "$(tcpdump -dd -y RAW 'port 50000')" + +As packet capture is transmitted over the network, it is recommended to filter out the Talos API traffic, +e.g. by excluding packets with the port 50000. + + +``` +talosctl pcap [flags] +``` + +### Options + +``` + --bpf-filter string bpf filter to apply, tcpdump -dd format + --duration duration duration of the capture + -h, --help help for pcap + -i, --interface string interface name to capture packets on (default "eth0") + -o, --output string if not set, decode packets to stdout; if set write raw pcap data to a file, use '-' for stdout + --promiscuous put interface into promiscuous mode + -s, --snaplen int maximum packet size to capture (default 65536) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl processes + +List running processes + +``` +talosctl processes [flags] +``` + +### Options + +``` + -h, --help help for processes + -s, --sort string Column to sort output by. [rss|cpu] (default "rss") + -w, --watch Stream running processes +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl read + +Read a file on the machine + +``` +talosctl read [flags] +``` + +### Options + +``` + -h, --help help for read +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl reboot + +Reboot a node + +``` +talosctl reboot [flags] +``` + +### Options + +``` + --debug debug operation from kernel logs. --wait is set to true when this flag is set + -h, --help help for reboot + -m, --mode string select the reboot mode: "default", "powercycle" (skips kexec) (default "default") + --timeout duration time to wait for the operation is complete if --debug or --wait is set (default 30m0s) + --wait wait for the operation to complete, tracking its progress. always set to true when --debug is set (default true) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl reset + +Reset a node + +``` +talosctl reset [flags] +``` + +### Options + +``` + --debug debug operation from kernel logs. --wait is set to true when this flag is set + --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) + -h, --help help for reset + --insecure reset using the insecure (encrypted with no auth) maintenance service + --reboot if true, reboot the node after resetting instead of shutting down + --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact + --timeout duration time to wait for the operation is complete if --debug or --wait is set (default 30m0s) + --user-disks-to-wipe strings if set, wipes defined devices in the list + --wait wait for the operation to complete, tracking its progress. always set to true when --debug is set (default true) + --wipe-mode all, system-disk, user-disks disk reset mode (default all) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl restart + +Restart a process + +``` +talosctl restart [flags] +``` + +### Options + +``` + -h, --help help for restart + -k, --kubernetes use the k8s.io containerd namespace +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl rollback + +Rollback a node to the previous installation + +``` +talosctl rollback [flags] +``` + +### Options + +``` + -h, --help help for rollback +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl service + +Retrieve the state of a service (or all services), control service state + +### Synopsis + +Service control command. If run without arguments, lists all the services and their state. +If service ID is specified, default action 'status' is executed which shows status of a single list service. +With actions 'start', 'stop', 'restart', service state is updated respectively. + +``` +talosctl service [ [start|stop|restart|status]] [flags] +``` + +### Options + +``` + -h, --help help for service +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl shutdown + +Shutdown a node + +``` +talosctl shutdown [flags] +``` + +### Options + +``` + --debug debug operation from kernel logs. --wait is set to true when this flag is set + --force if true, force a node to shutdown without a cordon/drain + -h, --help help for shutdown + --timeout duration time to wait for the operation is complete if --debug or --wait is set (default 30m0s) + --wait wait for the operation to complete, tracking its progress. always set to true when --debug is set (default true) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl stats + +Get container stats + +``` +talosctl stats [flags] +``` + +### Options + +``` + -h, --help help for stats + -k, --kubernetes use the k8s.io containerd namespace +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl support + +Dump debug information about the cluster + +### Synopsis + +Generated bundle contains the following debug information: + +- For each node: + + - Kernel logs. + - All Talos internal services logs. + - All kube-system pods logs. + - Talos COSI resources without secrets. + - COSI runtime state graph. + - Processes snapshot. + - IO pressure snapshot. + - Mounts list. + - PCI devices info. + - Talos version. + +- For the cluster: + + - Kubernetes nodes and kube-system pods manifests. + + +``` +talosctl support [flags] +``` + +### Options + +``` + -h, --help help for support + -w, --num-workers int number of workers per node (default 1) + -O, --output string output file to write support archive to + -v, --verbose verbose output +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl time + +Gets current server time + +``` +talosctl time [--check server] [flags] +``` + +### Options + +``` + -c, --check string checks server time against specified ntp server + -h, --help help for time +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl upgrade + +Upgrade Talos on the target node + +``` +talosctl upgrade [flags] +``` + +### Options + +``` + --debug debug operation from kernel logs. --wait is set to true when this flag is set + -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) + -h, --help help for upgrade + -i, --image string the container image to use for performing the install (default "ghcr.io/siderolabs/installer:v1.5.0-alpha.3") + --insecure upgrade using the insecure (encrypted with no auth) maintenance service + -p, --preserve preserve data + -m, --reboot-mode string select the reboot mode during upgrade. Mode "powercycle" bypasses kexec. Valid values are: ["default" "powercycle"]. (default "default") + -s, --stage stage the upgrade to perform it after a reboot + --timeout duration time to wait for the operation is complete if --debug or --wait is set (default 30m0s) + --wait wait for the operation to complete, tracking its progress. always set to true when --debug is set (default true) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl upgrade-k8s + +Upgrade Kubernetes control plane in the Talos cluster. + +### Synopsis + +Command runs upgrade of Kubernetes control plane components between specified versions. + +``` +talosctl upgrade-k8s [flags] +``` + +### Options + +``` + --dry-run skip the actual upgrade and show the upgrade plan instead + --endpoint string the cluster control plane endpoint + --from string the Kubernetes control plane version to upgrade from + -h, --help help for upgrade-k8s + --pre-pull-images pre-pull images before upgrade (default true) + --to string the Kubernetes control plane version to upgrade to (default "1.28.0") + --upgrade-kubelet upgrade kubelet service (default true) +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl usage + +Retrieve a disk usage + +``` +talosctl usage [path1] [path2] ... [pathN] [flags] +``` + +### Options + +``` + -a, --all write counts for all files, not just directories + -d, --depth int32 maximum recursion depth + -h, --help help for usage + -H, --humanize humanize size and time in the output + -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl validate + +Validate config + +``` +talosctl validate [flags] +``` + +### Options + +``` + -c, --config string the path of the config file + -h, --help help for validate + -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) + --strict treat validation warnings as errors +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl version + +Prints the version + +``` +talosctl version [flags] +``` + +### Options + +``` + --client Print client version only + -h, --help help for version + -i, --insecure use Talos maintenance mode API + --short Print the short version +``` + +### Options inherited from parent commands + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos + +## talosctl + +A CLI for out-of-band management of Kubernetes nodes created by Talos + +### Options + +``` + --cluster string Cluster to connect to if a proxy endpoint is used. + --context string Context to be used in command + -e, --endpoints strings override default endpoints in Talos configuration + -h, --help help for talosctl + -n, --nodes strings target the specified nodes + --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order. +``` + +### SEE ALSO + +* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node +* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the etcd cluster on the specified node. +* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters +* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash, fish or zsh) +* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) +* [talosctl conformance](#talosctl-conformance) - Run conformance tests +* [talosctl containers](#talosctl-containers) - List containers +* [talosctl copy](#talosctl-copy) - Copy data out from the node +* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with node overview, logs and real-time metrics +* [talosctl disks](#talosctl-disks) - Get the list of disks from /sys/block on the machine +* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs +* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. +* [talosctl etcd](#talosctl-etcd) - Manage etcd +* [talosctl events](#talosctl-events) - Stream runtime events +* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys +* [talosctl get](#talosctl-get) - Get a specific resource or list of resources (use 'talosctl get rd' to see all available resource types). +* [talosctl health](#talosctl-health) - Check cluster health +* [talosctl image](#talosctl-image) - Manage CRI containter images +* [talosctl inject](#talosctl-inject) - Inject Talos API resources into Kubernetes manifests +* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos +* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node +* [talosctl list](#talosctl-list) - Retrieve a directory listing +* [talosctl logs](#talosctl-logs) - Retrieve logs for a service +* [talosctl machineconfig](#talosctl-machineconfig) - Machine config related commands +* [talosctl memory](#talosctl-memory) - Show memory usage +* [talosctl meta](#talosctl-meta) - Write and delete keys in the META partition +* [talosctl mounts](#talosctl-mounts) - List mounts +* [talosctl netstat](#talosctl-netstat) - Show network connections and sockets +* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. +* [talosctl pcap](#talosctl-pcap) - Capture the network packets from the node. +* [talosctl processes](#talosctl-processes) - List running processes +* [talosctl read](#talosctl-read) - Read a file on the machine +* [talosctl reboot](#talosctl-reboot) - Reboot a node +* [talosctl reset](#talosctl-reset) - Reset a node +* [talosctl restart](#talosctl-restart) - Restart a process +* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation +* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state +* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node +* [talosctl stats](#talosctl-stats) - Get container stats +* [talosctl support](#talosctl-support) - Dump debug information about the cluster +* [talosctl time](#talosctl-time) - Gets current server time +* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node +* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. +* [talosctl usage](#talosctl-usage) - Retrieve a disk usage +* [talosctl validate](#talosctl-validate) - Validate config +* [talosctl version](#talosctl-version) - Prints the version + diff --git a/website/content/v1.6/reference/configuration.md b/website/content/v1.6/reference/configuration.md new file mode 100644 index 0000000000..e2f04916aa --- /dev/null +++ b/website/content/v1.6/reference/configuration.md @@ -0,0 +1,3153 @@ +--- +title: Configuration +desription: Talos node configuration file reference. +--- + + + + +Package v1alpha1 configuration file contains all the options available for configuring a machine. + +To generate a set of basic configuration files, run: + + talosctl gen config --version v1alpha1 + +This will generate a machine config for each node type, and a talosconfig for the CLI. + +--- +## Config +Config defines the v1alpha1 configuration file. + + + + +{{< highlight yaml >}} +version: v1alpha1 +persist: true +machine: # ... +cluster: # ... +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`version` |string |Indicates the schema used to decode the contents. |`v1alpha1`
| +|`debug` |bool |
Enable verbose logging to the console.All system containers logs will flow into serial console.

**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.
|`true`
`yes`
`false`
`no`
| +|`persist` |bool |
description: | Indicates whether to pull the machine config upon every boot.

**Note**: this option is deprecated and it will be removed in Talos 1.6.
values:
- true
- yes
- false
- no
| | +|`machine` |MachineConfig |Provides machine specific configuration options. | | +|`cluster` |ClusterConfig |Provides cluster specific configuration options. | | + + + +--- +## MachineConfig +MachineConfig represents the machine-specific config values. + +Appears in: + +- Config.machine + + + +{{< highlight yaml >}} +type: controlplane +# InstallConfig represents the installation options for preparing a node. +install: + disk: /dev/sda # The disk used for installations. + # Allows for supplying extra kernel args via the bootloader. + extraKernelArgs: + - console=ttyS1 + - panic=10 + image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + + # # Allows for supplying additional system extension images to install on top of base Talos image. + # extensions: + # - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`type` |string |
Defines the role of the machine within the cluster.
**Control Plane**

Control Plane node type designates the node as a control plane member.
This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.

**Worker**

Worker node type designates the node as a worker node.
This means it will be an available compute node for scheduling workloads.

This node type was previously known as "join"; that value is still supported but deprecated.
|`controlplane`
`worker`
| +|`token` |string |
The `token` is used by a machine to join the PKI of the cluster.Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.
Show example(s){{< highlight yaml >}} +token: 328hom.uqjzh6jnn2eie9oi +{{< /highlight >}}
| | +|`ca` |PEMEncodedCertificateAndKey |
The root certificate authority of the PKI.It is composed of a base64 encoded `crt` and `key`.
Show example(s){{< highlight yaml >}} +ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`certSANs` |[]string |
Extra certificate subject alternative names for the machine's certificate.By default, all non-loopback interface IPs are automatically added to the certificate's SANs.
Show example(s){{< highlight yaml >}} +certSANs: + - 10.0.0.10 + - 172.16.0.10 + - 192.168.0.10 +{{< /highlight >}}
| | +|`controlPlane` |MachineControlPlaneConfig |Provides machine specific control plane configuration options.
Show example(s){{< highlight yaml >}} +controlPlane: + # Controller manager machine specific configuration options. + controllerManager: + disabled: false # Disable kube-controller-manager on the node. + # Scheduler machine specific configuration options. + scheduler: + disabled: true # Disable kube-scheduler on the node. +{{< /highlight >}}
| | +|`kubelet` |KubeletConfig |Used to provide additional options to the kubelet.
Show example(s){{< highlight yaml >}} +kubelet: + image: ghcr.io/siderolabs/kubelet:v1.28.0 # The `image` field is an optional reference to an alternative kubelet image. + # The `extraArgs` field is used to provide additional flags to the kubelet. + extraArgs: + feature-gates: ServerSideApply=true + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example + # type: bind + # source: /var/lib/example + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 +{{< /highlight >}}
| | +|`pods` |[]Unstructured |
Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
Static pods can be used to run components which should be started before the Kubernetes control plane is up.
Talos doesn't validate the pod definition.
Updates to this field can be applied without a reboot.

See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.
Show example(s){{< highlight yaml >}} +pods: + - apiVersion: v1 + kind: pod + metadata: + name: nginx + spec: + containers: + - image: nginx + name: nginx +{{< /highlight >}}
| | +|`network` |NetworkConfig |Provides machine specific network configuration options.
Show example(s){{< highlight yaml >}} +network: + hostname: worker-1 # Used to statically set the hostname for the machine. + # `interfaces` is used to define the network interface configuration. + interfaces: + - interface: enp0s1 # The interface name. + # Assigns static IP addresses to the interface. + addresses: + - 192.168.2.0/24 + # A list of routes associated with the interface. + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. + mtu: 1500 # The interface's MTU. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*. + # deviceSelector: + # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + + # # Bond specific options. + # bond: + # # The interfaces that make up the bond. + # interfaces: + # - enp2s0 + # - enp2s1 + # # Picks a network device using the selector. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + # mode: 802.3ad # A bond option. + # lacpRate: fast # A bond option. + + # # Bridge specific options. + # bridge: + # # The interfaces that make up the bridge. + # interfaces: + # - enxda4042ca9a51 + # - enxae2a6774c259 + # # A bridge option. + # stp: + # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # Indicates if DHCP should be used to configure the interface. + # dhcp: true + + # # DHCP specific options. + # dhcpOptions: + # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # Wireguard specific configuration. + + # # wireguard server example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # listenPort: 51111 # Specifies a device's listening port. + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + # # wireguard peer example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + + # # Virtual (shared) IP address configuration. + + # # layer2 vip example + # vip: + # ip: 172.16.199.55 # Specifies the IP address to be used. + # Used to statically set the nameservers for the machine. + nameservers: + - 9.8.7.6 + - 8.7.6.5 + + # # Allows for extra entries to be added to the `/etc/hosts` file + # extraHostEntries: + # - ip: 192.168.1.100 # The IP of the host. + # # The host alias. + # aliases: + # - example + # - example.domain.tld + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. +{{< /highlight >}}
| | +|`disks` |[]MachineDisk |
Used to partition, format and mount additional disks.Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`.
Note that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.
If `size:` is omitted, the partition is sized to occupy the full disk.
Show example(s){{< highlight yaml >}} +disks: + - device: /dev/sdb # The name of the disk to use. + # A list of partitions to create on the disk. + partitions: + - mountpoint: /var/mnt/extra # Where to mount the partition. + + # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. + + # # Human readable representation. + # size: 100 MB + # # Precise value in bytes. + # size: 1073741824 +{{< /highlight >}}
| | +|`install` |InstallConfig |
Used to provide instructions for installations.
Note that this configuration section gets silently ignored by Talos images that are considered pre-installed.
To make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.
Show example(s){{< highlight yaml >}} +install: + disk: /dev/sda # The disk used for installations. + # Allows for supplying extra kernel args via the bootloader. + extraKernelArgs: + - console=ttyS1 + - panic=10 + image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + + # # Allows for supplying additional system extension images to install on top of base Talos image. + # extensions: + # - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image. +{{< /highlight >}}
| | +|`files` |[]MachineFile |
Allows the addition of user specified files.The value of `op` can be `create`, `overwrite`, or `append`.
In the case of `create`, `path` must not exist.
In the case of `overwrite`, and `append`, `path` must be a valid file.
If an `op` value of `append` is used, the existing file will be appended.
Note that the file contents are not required to be base64 encoded.
Show example(s){{< highlight yaml >}} +files: + - content: '...' # The contents of the file. + permissions: 0o666 # The file's permissions in octal. + path: /tmp/file.txt # The path of the file. + op: append # The operation to use +{{< /highlight >}}
| | +|`env` |Env |
The `env` field allows for the addition of environment variables.All environment variables are set on PID 1 in addition to every service.
Show example(s){{< highlight yaml >}} +env: + GRPC_GO_LOG_SEVERITY_LEVEL: info + GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + https_proxy: http://SERVER:PORT/ +{{< /highlight >}}{{< highlight yaml >}} +env: + GRPC_GO_LOG_SEVERITY_LEVEL: error + https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ +{{< /highlight >}}{{< highlight yaml >}} +env: + https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ +{{< /highlight >}}
|``GRPC_GO_LOG_VERBOSITY_LEVEL``
``GRPC_GO_LOG_SEVERITY_LEVEL``
``http_proxy``
``https_proxy``
``no_proxy``
| +|`time` |TimeConfig |Used to configure the machine's time settings.
Show example(s){{< highlight yaml >}} +time: + disabled: false # Indicates if the time service is disabled for the machine. + # Specifies time (NTP) servers to use for setting the system time. + servers: + - time.cloudflare.com + bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. +{{< /highlight >}}
| | +|`sysctls` |map[string]string |Used to configure the machine's sysctls.
Show example(s){{< highlight yaml >}} +sysctls: + kernel.domainname: talos.dev + net.ipv4.ip_forward: "0" +{{< /highlight >}}
| | +|`sysfs` |map[string]string |Used to configure the machine's sysfs.
Show example(s){{< highlight yaml >}} +sysfs: + devices.system.cpu.cpu0.cpufreq.scaling_governor: performance +{{< /highlight >}}
| | +|`registries` |RegistriesConfig |
Used to configure the machine's container image registry mirrors.
Automatically generates matching CRI configuration for registry mirrors.

The `mirrors` section allows to redirect requests for images to a non-default registry,
which might be a local registry or a caching mirror.

The `config` section provides a way to authenticate to the registry with TLS client
identity, provide registry CA, or authentication information.
Authentication information has same meaning with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).

See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md).
Show example(s){{< highlight yaml >}} +registries: + # Specifies mirror configuration for each registry host namespace. + mirrors: + docker.io: + # List of endpoints (URLs) for registry mirrors to use. + endpoints: + - https://registry.local + # Specifies TLS & auth configuration for HTTPS image registries. + config: + registry.local: + # The TLS configuration for the registry. + tls: + # Enable mutual TLS authentication with the registry. + clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # The auth configuration for this registry. + auth: + username: username # Optional registry authentication. + password: password # Optional registry authentication. +{{< /highlight >}}
| | +|`systemDiskEncryption` |SystemDiskEncryptionConfig |
Machine system disk encryption configuration.Defines each system partition encryption parameters.
Show example(s){{< highlight yaml >}} +systemDiskEncryption: + # Ephemeral partition encryption. + ephemeral: + provider: luks2 # Encryption provider to use for the encryption. + # Defines the encryption keys generation and storage method. + keys: + - # Deterministically generated key from the node UUID and PartitionLabel. + nodeID: {} + slot: 0 # Key slot number for LUKS2 encryption. + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + + # # Cipher kind to use for the encryption. Depends on the encryption provider. + # cipher: aes-xts-plain64 + + # # Defines the encryption sector size. + # blockSize: 4096 + + # # Additional --perf parameters for the LUKS2 encryption. + # options: + # - no_read_workqueue + # - no_write_workqueue +{{< /highlight >}}
| | +|`features` |FeaturesConfig |Features describe individual Talos features that can be switched on or off.
Show example(s){{< highlight yaml >}} +features: + rbac: true # Enable role-based access control (RBAC). + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system +{{< /highlight >}}
| | +|`udev` |UdevConfig |Configures the udev system.
Show example(s){{< highlight yaml >}} +udev: + # List of udev rules to apply to the udev system + rules: + - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" +{{< /highlight >}}
| | +|`logging` |LoggingConfig |Configures the logging system.
Show example(s){{< highlight yaml >}} +logging: + # Logging destination. + destinations: + - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + format: json_lines # Logs format. +{{< /highlight >}}
| | +|`kernel` |KernelConfig |Configures the kernel.
Show example(s){{< highlight yaml >}} +kernel: + # Kernel modules to load. + modules: + - name: brtfs # Module name. +{{< /highlight >}}
| | +|`seccompProfiles` |[]MachineSeccompProfile |Configures the seccomp profiles for the machine.
Show example(s){{< highlight yaml >}} +seccompProfiles: + - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # The `value` field is used to provide the seccomp profile. + value: + defaultAction: SCMP_ACT_LOG +{{< /highlight >}}
| | +|`nodeLabels` |map[string]string |Configures the node labels for the machine.
Show example(s){{< highlight yaml >}} +nodeLabels: + exampleLabel: exampleLabelValue +{{< /highlight >}}
| | + + + +--- +## MachineSeccompProfile +MachineSeccompProfile defines seccomp profiles for the machine. + +Appears in: + +- MachineConfig.seccompProfiles + + + +{{< highlight yaml >}} +- name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # The `value` field is used to provide the seccomp profile. + value: + defaultAction: SCMP_ACT_LOG +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |The `name` field is used to provide the file name of the seccomp profile. | | +|`value` |Unstructured |The `value` field is used to provide the seccomp profile. | | + + + +--- +## ClusterConfig +ClusterConfig represents the cluster-wide config values. + +Appears in: + +- Config.cluster + + + +{{< highlight yaml >}} +# ControlPlaneConfig represents the control plane configuration options. +controlPlane: + endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + localAPIServerPort: 443 # The port that the API server listens on internally. +clusterName: talos.local +# ClusterNetworkConfig represents kube networking configuration options. +network: + # The CNI used. + cni: + name: flannel # Name of CNI to use. + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`id` |string |Globally unique identifier for this cluster (base64 encoded random 32 bytes). | | +|`secret` |string |
Shared secret of cluster (base64 encoded random 32 bytes).This secret is shared among cluster members but should never be sent over the network.
| | +|`controlPlane` |ControlPlaneConfig |Provides control plane specific configuration options.
Show example(s){{< highlight yaml >}} +controlPlane: + endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + localAPIServerPort: 443 # The port that the API server listens on internally. +{{< /highlight >}}
| | +|`clusterName` |string |Configures the cluster's name. | | +|`network` |ClusterNetworkConfig |Provides cluster specific network configuration options.
Show example(s){{< highlight yaml >}} +network: + # The CNI used. + cni: + name: flannel # Name of CNI to use. + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 +{{< /highlight >}}
| | +|`token` |string |The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
Show example(s){{< highlight yaml >}} +token: wlzjyw.bei2zfylhs2by0wd +{{< /highlight >}}
| | +|`aescbcEncryptionSecret` |string |
A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).Enables encryption with AESCBC.
Show example(s){{< highlight yaml >}} +aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= +{{< /highlight >}}
| | +|`secretboxEncryptionSecret` |string |
A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).Enables encryption with secretbox.
Secretbox has precedence over AESCBC.
Show example(s){{< highlight yaml >}} +secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= +{{< /highlight >}}
| | +|`ca` |PEMEncodedCertificateAndKey |The base64 encoded root certificate authority used by Kubernetes.
Show example(s){{< highlight yaml >}} +ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`aggregatorCA` |PEMEncodedCertificateAndKey |
The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
This CA can be self-signed.
Show example(s){{< highlight yaml >}} +aggregatorCA: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`serviceAccount` |PEMEncodedKey |The base64 encoded private key for service account token generation.
Show example(s){{< highlight yaml >}} +serviceAccount: + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`apiServer` |APIServerConfig |API server specific configuration options.
Show example(s){{< highlight yaml >}} +apiServer: + image: registry.k8s.io/kube-apiserver:v1.28.0 # The container image used in the API server manifest. + # Extra arguments to supply to the API server. + extraArgs: + feature-gates: ServerSideApply=true + http2-max-streams-per-connection: "32" + # Extra certificate subject alternative names for the API server's certificate. + certSANs: + - 1.2.3.4 + - 4.5.6.7 + + # # Configure the API server admission plugins. + # admissionControl: + # - name: PodSecurity # Name is the name of the admission controller. + # # Configuration is an embedded configuration object to be used as the plugin's + # configuration: + # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + # defaults: + # audit: restricted + # audit-version: latest + # enforce: baseline + # enforce-version: latest + # warn: restricted + # warn-version: latest + # exemptions: + # namespaces: + # - kube-system + # runtimeClasses: [] + # usernames: [] + # kind: PodSecurityConfiguration + + # # Configure the API server audit policy. + # auditPolicy: + # apiVersion: audit.k8s.io/v1 + # kind: Policy + # rules: + # - level: Metadata +{{< /highlight >}}
| | +|`controllerManager` |ControllerManagerConfig |Controller manager server specific configuration options.
Show example(s){{< highlight yaml >}} +controllerManager: + image: registry.k8s.io/kube-controller-manager:v1.28.0 # The container image used in the controller manager manifest. + # Extra arguments to supply to the controller manager. + extraArgs: + feature-gates: ServerSideApply=true +{{< /highlight >}}
| | +|`proxy` |ProxyConfig |Kube-proxy server-specific configuration options
Show example(s){{< highlight yaml >}} +proxy: + image: registry.k8s.io/kube-proxy:v1.28.0 # The container image used in the kube-proxy manifest. + mode: ipvs # proxy mode of kube-proxy. + # Extra arguments to supply to kube-proxy. + extraArgs: + proxy-mode: iptables + + # # Disable kube-proxy deployment on cluster bootstrap. + # disabled: false +{{< /highlight >}}
| | +|`scheduler` |SchedulerConfig |Scheduler server specific configuration options.
Show example(s){{< highlight yaml >}} +scheduler: + image: registry.k8s.io/kube-scheduler:v1.28.0 # The container image used in the scheduler manifest. + # Extra arguments to supply to the scheduler. + extraArgs: + feature-gates: AllBeta=true +{{< /highlight >}}
| | +|`discovery` |ClusterDiscoveryConfig |Configures cluster member discovery.
Show example(s){{< highlight yaml >}} +discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: {} + # Service registry is using an external service to push and pull information about cluster members. + service: + endpoint: https://discovery.talos.dev/ # External service endpoint. +{{< /highlight >}}
| | +|`etcd` |EtcdConfig |Etcd specific configuration options.
Show example(s){{< highlight yaml >}} +etcd: + image: gcr.io/etcd-development/etcd:v3.5.9 # The container image used to create the etcd service. + # The `ca` is the root certificate authority of the PKI. + ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # Extra arguments to supply to etcd. + extraArgs: + election-timeout: "5000" + + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 +{{< /highlight >}}
| | +|`coreDNS` |CoreDNS |Core DNS specific configuration options.
Show example(s){{< highlight yaml >}} +coreDNS: + image: registry.k8s.io/coredns/coredns:v1.10.1 # The `image` field is an override to the default coredns image. +{{< /highlight >}}
| | +|`externalCloudProvider` |ExternalCloudProviderConfig |External cloud provider configuration.
Show example(s){{< highlight yaml >}} +externalCloudProvider: + enabled: true # Enable external cloud provider. + # A list of urls that point to additional manifests for an external cloud provider. + manifests: + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml +{{< /highlight >}}
| | +|`extraManifests` |[]string |
A list of urls that point to additional manifests.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} +extraManifests: + - https://www.example.com/manifest1.yaml + - https://www.example.com/manifest2.yaml +{{< /highlight >}}
| | +|`extraManifestHeaders` |map[string]string |A map of key value pairs that will be added while fetching the extraManifests.
Show example(s){{< highlight yaml >}} +extraManifestHeaders: + Token: "1234567" + X-ExtraInfo: info +{{< /highlight >}}
| | +|`inlineManifests` |ClusterInlineManifests |
A list of inline Kubernetes manifests.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} +inlineManifests: + - name: namespace-ci # Name of the manifest. + contents: |- # Manifest contents as a string. + apiVersion: v1 + kind: Namespace + metadata: + name: ci +{{< /highlight >}}
| | +|`adminKubeconfig` |AdminKubeconfigConfig |
Settings for admin kubeconfig generation.Certificate lifetime can be configured.
Show example(s){{< highlight yaml >}} +adminKubeconfig: + certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). +{{< /highlight >}}
| | +|`allowSchedulingOnControlPlanes` |bool |Allows running workload on control-plane nodes.
Show example(s){{< highlight yaml >}} +allowSchedulingOnControlPlanes: true +{{< /highlight >}}
|`true`
`yes`
`false`
`no`
| + + + +--- +## ExtraMount +ExtraMount wraps OCI Mount specification. + +Appears in: + +- KubeletConfig.extraMounts + + + +{{< highlight yaml >}} +- destination: /var/lib/example + type: bind + source: /var/lib/example + options: + - bind + - rshared + - rw +{{< /highlight >}} + + + + +--- +## MachineControlPlaneConfig +MachineControlPlaneConfig machine specific configuration options. + +Appears in: + +- MachineConfig.controlPlane + + + +{{< highlight yaml >}} +# Controller manager machine specific configuration options. +controllerManager: + disabled: false # Disable kube-controller-manager on the node. +# Scheduler machine specific configuration options. +scheduler: + disabled: true # Disable kube-scheduler on the node. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`controllerManager` |MachineControllerManagerConfig |Controller manager machine specific configuration options. | | +|`scheduler` |MachineSchedulerConfig |Scheduler machine specific configuration options. | | + + + +--- +## MachineControllerManagerConfig +MachineControllerManagerConfig represents the machine specific ControllerManager config values. + +Appears in: + +- MachineControlPlaneConfig.controllerManager + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable kube-controller-manager on the node. | | + + + +--- +## MachineSchedulerConfig +MachineSchedulerConfig represents the machine specific Scheduler config values. + +Appears in: + +- MachineControlPlaneConfig.scheduler + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable kube-scheduler on the node. | | + + + +--- +## KubeletConfig +KubeletConfig represents the kubelet config values. + +Appears in: + +- MachineConfig.kubelet + + + +{{< highlight yaml >}} +image: ghcr.io/siderolabs/kubelet:v1.28.0 # The `image` field is an optional reference to an alternative kubelet image. +# The `extraArgs` field is used to provide additional flags to the kubelet. +extraArgs: + feature-gates: ServerSideApply=true + +# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. +# clusterDNS: +# - 10.96.0.10 +# - 169.254.2.53 + +# # The `extraMounts` field is used to add additional mounts to the kubelet container. +# extraMounts: +# - destination: /var/lib/example +# type: bind +# source: /var/lib/example +# options: +# - bind +# - rshared +# - rw + +# # The `extraConfig` field is used to provide kubelet configuration overrides. +# extraConfig: +# serverTLSBootstrap: true + +# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. +# nodeIP: +# # The `validSubnets` field configures the networks to pick kubelet node IP from. +# validSubnets: +# - 10.0.0.0/8 +# - '!10.0.0.3/32' +# - fdc7::/16 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The `image` field is an optional reference to an alternative kubelet image.
Show example(s){{< highlight yaml >}} +image: ghcr.io/siderolabs/kubelet:v1.28.0 +{{< /highlight >}}
| | +|`clusterDNS` |[]string |The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
Show example(s){{< highlight yaml >}} +clusterDNS: + - 10.96.0.10 + - 169.254.2.53 +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |The `extraArgs` field is used to provide additional flags to the kubelet.
Show example(s){{< highlight yaml >}} +extraArgs: + key: value +{{< /highlight >}}
| | +|`extraMounts` |[]ExtraMount |
The `extraMounts` field is used to add additional mounts to the kubelet container.Note that either `bind` or `rbind` are required in the `options`.
Show example(s){{< highlight yaml >}} +extraMounts: + - destination: /var/lib/example + type: bind + source: /var/lib/example + options: + - bind + - rshared + - rw +{{< /highlight >}}
| | +|`extraConfig` |Unstructured |
The `extraConfig` field is used to provide kubelet configuration overrides.
Some fields are not allowed to be overridden: authentication and authorization, cgroups
configuration, ports, etc.
Show example(s){{< highlight yaml >}} +extraConfig: + serverTLSBootstrap: true +{{< /highlight >}}
| | +|`defaultRuntimeSeccompProfileEnabled` |bool |Enable container runtime default Seccomp profile. |`true`
`yes`
`false`
`no`
| +|`registerWithFQDN` |bool |
The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration.This is required in clouds like AWS.
|`true`
`yes`
`false`
`no`
| +|`nodeIP` |KubeletNodeIPConfig |
The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.This is used when a node has multiple addresses to choose from.
Show example(s){{< highlight yaml >}} +nodeIP: + # The `validSubnets` field configures the networks to pick kubelet node IP from. + validSubnets: + - 10.0.0.0/8 + - '!10.0.0.3/32' + - fdc7::/16 +{{< /highlight >}}
| | +|`skipNodeRegistration` |bool |
The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver.This runs kubelet as standalone and only runs static pods.
|`true`
`yes`
`false`
`no`
| +|`disableManifestsDirectory` |bool |
The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.It's recommended to configure static pods with the "pods" key instead.
|`true`
`yes`
`false`
`no`
| + + + +--- +## KubeletNodeIPConfig +KubeletNodeIPConfig represents the kubelet node IP configuration. + +Appears in: + +- KubeletConfig.nodeIP + + + +{{< highlight yaml >}} +# The `validSubnets` field configures the networks to pick kubelet node IP from. +validSubnets: + - 10.0.0.0/8 + - '!10.0.0.3/32' + - fdc7::/16 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`validSubnets` |[]string |
The `validSubnets` field configures the networks to pick kubelet node IP from.For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.
IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.
| | + + + +--- +## NetworkConfig +NetworkConfig represents the machine's networking config values. + +Appears in: + +- MachineConfig.network + + + +{{< highlight yaml >}} +hostname: worker-1 # Used to statically set the hostname for the machine. +# `interfaces` is used to define the network interface configuration. +interfaces: + - interface: enp0s1 # The interface name. + # Assigns static IP addresses to the interface. + addresses: + - 192.168.2.0/24 + # A list of routes associated with the interface. + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. + mtu: 1500 # The interface's MTU. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*. + # deviceSelector: + # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + + # # Bond specific options. + # bond: + # # The interfaces that make up the bond. + # interfaces: + # - enp2s0 + # - enp2s1 + # # Picks a network device using the selector. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + # mode: 802.3ad # A bond option. + # lacpRate: fast # A bond option. + + # # Bridge specific options. + # bridge: + # # The interfaces that make up the bridge. + # interfaces: + # - enxda4042ca9a51 + # - enxae2a6774c259 + # # A bridge option. + # stp: + # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # Indicates if DHCP should be used to configure the interface. + # dhcp: true + + # # DHCP specific options. + # dhcpOptions: + # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # Wireguard specific configuration. + + # # wireguard server example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # listenPort: 51111 # Specifies a device's listening port. + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + # # wireguard peer example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + + # # Virtual (shared) IP address configuration. + + # # layer2 vip example + # vip: + # ip: 172.16.199.55 # Specifies the IP address to be used. +# Used to statically set the nameservers for the machine. +nameservers: + - 9.8.7.6 + - 8.7.6.5 + +# # Allows for extra entries to be added to the `/etc/hosts` file +# extraHostEntries: +# - ip: 192.168.1.100 # The IP of the host. +# # The host alias. +# aliases: +# - example +# - example.domain.tld + +# # Configures KubeSpan feature. +# kubespan: +# enabled: true # Enable the KubeSpan feature. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`hostname` |string |Used to statically set the hostname for the machine. | | +|`interfaces` |[]Device |
`interfaces` is used to define the network interface configuration.By default all network interfaces will attempt a DHCP discovery.
This can be further tuned through this configuration parameter.
Show example(s){{< highlight yaml >}} +interfaces: + - interface: enp0s1 # The interface name. + # Assigns static IP addresses to the interface. + addresses: + - 192.168.2.0/24 + # A list of routes associated with the interface. + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. + mtu: 1500 # The interface's MTU. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*. + # deviceSelector: + # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + + # # Bond specific options. + # bond: + # # The interfaces that make up the bond. + # interfaces: + # - enp2s0 + # - enp2s1 + # # Picks a network device using the selector. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + # mode: 802.3ad # A bond option. + # lacpRate: fast # A bond option. + + # # Bridge specific options. + # bridge: + # # The interfaces that make up the bridge. + # interfaces: + # - enxda4042ca9a51 + # - enxae2a6774c259 + # # A bridge option. + # stp: + # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # Indicates if DHCP should be used to configure the interface. + # dhcp: true + + # # DHCP specific options. + # dhcpOptions: + # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # Wireguard specific configuration. + + # # wireguard server example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # listenPort: 51111 # Specifies a device's listening port. + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + # # wireguard peer example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + + # # Virtual (shared) IP address configuration. + + # # layer2 vip example + # vip: + # ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}}
| | +|`nameservers` |[]string |
Used to statically set the nameservers for the machine.Defaults to `1.1.1.1` and `8.8.8.8`
Show example(s){{< highlight yaml >}} +nameservers: + - 8.8.8.8 + - 1.1.1.1 +{{< /highlight >}}
| | +|`extraHostEntries` |[]ExtraHost |Allows for extra entries to be added to the `/etc/hosts` file
Show example(s){{< highlight yaml >}} +extraHostEntries: + - ip: 192.168.1.100 # The IP of the host. + # The host alias. + aliases: + - example + - example.domain.tld +{{< /highlight >}}
| | +|`kubespan` |NetworkKubeSpan |Configures KubeSpan feature.
Show example(s){{< highlight yaml >}} +kubespan: + enabled: true # Enable the KubeSpan feature. +{{< /highlight >}}
| | +|`disableSearchDomain` |bool |
Disable generating a default search domain in /etc/resolv.confbased on the machine hostname.
Defaults to `false`.
|`true`
`yes`
`false`
`no`
| + + + +--- +## InstallConfig +InstallConfig represents the installation options for preparing a node. + +Appears in: + +- MachineConfig.install + + + +{{< highlight yaml >}} +disk: /dev/sda # The disk used for installations. +# Allows for supplying extra kernel args via the bootloader. +extraKernelArgs: + - console=ttyS1 + - panic=10 +image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. +wipe: false # Indicates if the installation disk should be wiped at installation time. + +# # Look up disk using disk attributes like model, size, serial and others. +# diskSelector: +# size: 4GB # Disk size. +# model: WDC* # Disk model `/sys/block//device/model`. +# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + +# # Allows for supplying additional system extension images to install on top of base Talos image. +# extensions: +# - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disk` |string |The disk used for installations.
Show example(s){{< highlight yaml >}} +disk: /dev/sda +{{< /highlight >}}{{< highlight yaml >}} +disk: /dev/nvme0 +{{< /highlight >}}
| | +|`diskSelector` |InstallDiskSelector |
Look up disk using disk attributes like model, size, serial and others.Always has priority over `disk`.
Show example(s){{< highlight yaml >}} +diskSelector: + size: '>= 1TB' # Disk size. + model: WDC* # Disk model `/sys/block//device/model`. + + # # Disk bus path. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 + # busPath: /pci0000:00/* +{{< /highlight >}}
| | +|`extraKernelArgs` |[]string |Allows for supplying extra kernel args via the bootloader.
Show example(s){{< highlight yaml >}} +extraKernelArgs: + - talos.platform=metal + - reboot=k +{{< /highlight >}}
| | +|`image` |string |
Allows for supplying the image used to perform the installation.Image reference for each Talos release can be found on
[GitHub releases page](https://github.com/siderolabs/talos/releases).
Show example(s){{< highlight yaml >}} +image: ghcr.io/siderolabs/installer:latest +{{< /highlight >}}
| | +|`extensions` |[]InstallExtensionConfig |Allows for supplying additional system extension images to install on top of base Talos image.
Show example(s){{< highlight yaml >}} +extensions: + - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image. +{{< /highlight >}}
| | +|`bootloader` |bool |Indicates if a bootloader should be installed. |`true`
`yes`
`false`
`no`
| +|`wipe` |bool |
Indicates if the installation disk should be wiped at installation time.Defaults to `true`.
|`true`
`yes`
`false`
`no`
| +|`legacyBIOSSupport` |bool |
Indicates if MBR partition should be marked as bootable (active).Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.
| | + + + +--- +## InstallDiskSelector +InstallDiskSelector represents a disk query parameters for the install disk lookup. + +Appears in: + +- InstallConfig.diskSelector + + + +{{< highlight yaml >}} +size: '>= 1TB' # Disk size. +model: WDC* # Disk model `/sys/block//device/model`. + +# # Disk bus path. +# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 +# busPath: /pci0000:00/* +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`size` |InstallDiskSizeMatcher |Disk size.
Show example(s){{< highlight yaml >}} +size: 4GB +{{< /highlight >}}{{< highlight yaml >}} +size: '> 1TB' +{{< /highlight >}}{{< highlight yaml >}} +size: <= 2TB +{{< /highlight >}}
| | +|`name` |string |Disk name `/sys/block//device/name`. | | +|`model` |string |Disk model `/sys/block//device/model`. | | +|`serial` |string |Disk serial number `/sys/block//serial`. | | +|`modalias` |string |Disk modalias `/sys/block//device/modalias`. | | +|`uuid` |string |Disk UUID `/sys/block//uuid`. | | +|`wwid` |string |Disk WWID `/sys/block//wwid`. | | +|`type` |InstallDiskType |Disk Type. |`ssd`
`hdd`
`nvme`
`sd`
| +|`busPath` |string |Disk bus path.
Show example(s){{< highlight yaml >}} +busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 +{{< /highlight >}}{{< highlight yaml >}} +busPath: /pci0000:00/* +{{< /highlight >}}
| | + + + +--- +## InstallExtensionConfig +InstallExtensionConfig represents a configuration for a system extension. + +Appears in: + +- InstallConfig.extensions + + + +{{< highlight yaml >}} +- image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |System extension image. | | + + + +--- +## TimeConfig +TimeConfig represents the options for configuring time on a machine. + +Appears in: + +- MachineConfig.time + + + +{{< highlight yaml >}} +disabled: false # Indicates if the time service is disabled for the machine. +# Specifies time (NTP) servers to use for setting the system time. +servers: + - time.cloudflare.com +bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |
Indicates if the time service is disabled for the machine.Defaults to `false`.
| | +|`servers` |[]string |
Specifies time (NTP) servers to use for setting the system time.Defaults to `pool.ntp.org`
| | +|`bootTimeout` |Duration |
Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.NTP sync will be still running in the background.
Defaults to "infinity" (waiting forever for time sync)
| | + + + +--- +## RegistriesConfig +RegistriesConfig represents the image pull options. + +Appears in: + +- MachineConfig.registries + + + +{{< highlight yaml >}} +# Specifies mirror configuration for each registry host namespace. +mirrors: + docker.io: + # List of endpoints (URLs) for registry mirrors to use. + endpoints: + - https://registry.local +# Specifies TLS & auth configuration for HTTPS image registries. +config: + registry.local: + # The TLS configuration for the registry. + tls: + # Enable mutual TLS authentication with the registry. + clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # The auth configuration for this registry. + auth: + username: username # Optional registry authentication. + password: password # Optional registry authentication. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`mirrors` |map[string]RegistryMirrorConfig |
Specifies mirror configuration for each registry host namespace.This setting allows to configure local pull-through caching registires,
air-gapped installations, etc.

For example, when pulling an image with the reference `example.com:123/image:v1`,
the `example.com:123` key will be used to lookup the mirror configuration.

Optionally the `*` key can be used to configure a fallback mirror.

Registry name is the first segment of image identifier, with 'docker.io'
being default one.
Show example(s){{< highlight yaml >}} +mirrors: + ghcr.io: + # List of endpoints (URLs) for registry mirrors to use. + endpoints: + - https://registry.insecure + - https://ghcr.io/v2/ +{{< /highlight >}}
| | +|`config` |map[string]RegistryConfig |
Specifies TLS & auth configuration for HTTPS image registries.Mutual TLS can be enabled with 'clientIdentity' option.

The full hostname and port (if not using a default port 443)
should be used as the key.
The fallback key `*` can't be used for TLS configuration.

TLS configuration can be skipped if registry has trusted
server certificate.
Show example(s){{< highlight yaml >}} +config: + registry.insecure: + # The TLS configuration for the registry. + tls: + insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + + # # Enable mutual TLS authentication with the registry. + # clientIdentity: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # The auth configuration for this registry. + # auth: + # username: username # Optional registry authentication. + # password: password # Optional registry authentication. +{{< /highlight >}}
| | + + + +--- +## PodCheckpointer +PodCheckpointer represents the pod-checkpointer config values. + + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The `image` field is an override to the default pod-checkpointer image. | | + + + +--- +## CoreDNS +CoreDNS represents the CoreDNS config values. + +Appears in: + +- ClusterConfig.coreDNS + + + +{{< highlight yaml >}} +image: registry.k8s.io/coredns/coredns:v1.10.1 # The `image` field is an override to the default coredns image. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable coredns deployment on cluster bootstrap. | | +|`image` |string |The `image` field is an override to the default coredns image. | | + + + +--- +## Endpoint +Endpoint represents the endpoint URL parsed out of the machine config. + +Appears in: + +- ControlPlaneConfig.endpoint +- LoggingDestination.endpoint + + + +{{< highlight yaml >}} +https://1.2.3.4:6443 +{{< /highlight >}} + +{{< highlight yaml >}} +https://cluster1.internal:6443 +{{< /highlight >}} + +{{< highlight yaml >}} +udp://127.0.0.1:12345 +{{< /highlight >}} + +{{< highlight yaml >}} +tcp://1.2.3.4:12345 +{{< /highlight >}} + + + + +--- +## ControlPlaneConfig +ControlPlaneConfig represents the control plane configuration options. + +Appears in: + +- ClusterConfig.controlPlane + + + +{{< highlight yaml >}} +endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. +localAPIServerPort: 443 # The port that the API server listens on internally. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |Endpoint |
Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.It is single-valued, and may optionally include a port number.
Show example(s){{< highlight yaml >}} +endpoint: https://1.2.3.4:6443 +{{< /highlight >}}{{< highlight yaml >}} +endpoint: https://cluster1.internal:6443 +{{< /highlight >}}
| | +|`localAPIServerPort` |int |
The port that the API server listens on internally.This may be different than the port portion listed in the endpoint field above.
The default is `6443`.
| | + + + +--- +## APIServerConfig +APIServerConfig represents the kube apiserver configuration options. + +Appears in: + +- ClusterConfig.apiServer + + + +{{< highlight yaml >}} +image: registry.k8s.io/kube-apiserver:v1.28.0 # The container image used in the API server manifest. +# Extra arguments to supply to the API server. +extraArgs: + feature-gates: ServerSideApply=true + http2-max-streams-per-connection: "32" +# Extra certificate subject alternative names for the API server's certificate. +certSANs: + - 1.2.3.4 + - 4.5.6.7 + +# # Configure the API server admission plugins. +# admissionControl: +# - name: PodSecurity # Name is the name of the admission controller. +# # Configuration is an embedded configuration object to be used as the plugin's +# configuration: +# apiVersion: pod-security.admission.config.k8s.io/v1alpha1 +# defaults: +# audit: restricted +# audit-version: latest +# enforce: baseline +# enforce-version: latest +# warn: restricted +# warn-version: latest +# exemptions: +# namespaces: +# - kube-system +# runtimeClasses: [] +# usernames: [] +# kind: PodSecurityConfiguration + +# # Configure the API server audit policy. +# auditPolicy: +# apiVersion: audit.k8s.io/v1 +# kind: Policy +# rules: +# - level: Metadata +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The container image used in the API server manifest.
Show example(s){{< highlight yaml >}} +image: registry.k8s.io/kube-apiserver:v1.28.0 +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |Extra arguments to supply to the API server. | | +|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the API server static pod. | | +|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | +|`certSANs` |[]string |Extra certificate subject alternative names for the API server's certificate. | | +|`disablePodSecurityPolicy` |bool |Disable PodSecurityPolicy in the API server and default manifests. | | +|`admissionControl` |[]AdmissionPluginConfig |Configure the API server admission plugins.
Show example(s){{< highlight yaml >}} +admissionControl: + - name: PodSecurity # Name is the name of the admission controller. + # Configuration is an embedded configuration object to be used as the plugin's + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration +{{< /highlight >}}
| | +|`auditPolicy` |Unstructured |Configure the API server audit policy.
Show example(s){{< highlight yaml >}} +auditPolicy: + apiVersion: audit.k8s.io/v1 + kind: Policy + rules: + - level: Metadata +{{< /highlight >}}
| | +|`resources` |ResourcesConfig |Configure the API server resources. | | + + + +--- +## AdmissionPluginConfig +AdmissionPluginConfig represents the API server admission plugin configuration. + +Appears in: + +- APIServerConfig.admissionControl + + + +{{< highlight yaml >}} +- name: PodSecurity # Name is the name of the admission controller. + # Configuration is an embedded configuration object to be used as the plugin's + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |
Name is the name of the admission controller.It must match the registered admission plugin name.
| | +|`configuration` |Unstructured |
Configuration is an embedded configuration object to be used as the plugin'sconfiguration.
| | + + + +--- +## ControllerManagerConfig +ControllerManagerConfig represents the kube controller manager configuration options. + +Appears in: + +- ClusterConfig.controllerManager + + + +{{< highlight yaml >}} +image: registry.k8s.io/kube-controller-manager:v1.28.0 # The container image used in the controller manager manifest. +# Extra arguments to supply to the controller manager. +extraArgs: + feature-gates: ServerSideApply=true +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The container image used in the controller manager manifest.
Show example(s){{< highlight yaml >}} +image: registry.k8s.io/kube-controller-manager:v1.28.0 +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |Extra arguments to supply to the controller manager. | | +|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the controller manager static pod. | | +|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | +|`resources` |ResourcesConfig |Configure the controller manager resources. | | + + + +--- +## ProxyConfig +ProxyConfig represents the kube proxy configuration options. + +Appears in: + +- ClusterConfig.proxy + + + +{{< highlight yaml >}} +image: registry.k8s.io/kube-proxy:v1.28.0 # The container image used in the kube-proxy manifest. +mode: ipvs # proxy mode of kube-proxy. +# Extra arguments to supply to kube-proxy. +extraArgs: + proxy-mode: iptables + +# # Disable kube-proxy deployment on cluster bootstrap. +# disabled: false +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable kube-proxy deployment on cluster bootstrap.
Show example(s){{< highlight yaml >}} +disabled: false +{{< /highlight >}}
| | +|`image` |string |The container image used in the kube-proxy manifest.
Show example(s){{< highlight yaml >}} +image: registry.k8s.io/kube-proxy:v1.28.0 +{{< /highlight >}}
| | +|`mode` |string |
proxy mode of kube-proxy.The default is 'iptables'.
| | +|`extraArgs` |map[string]string |Extra arguments to supply to kube-proxy. | | + + + +--- +## SchedulerConfig +SchedulerConfig represents the kube scheduler configuration options. + +Appears in: + +- ClusterConfig.scheduler + + + +{{< highlight yaml >}} +image: registry.k8s.io/kube-scheduler:v1.28.0 # The container image used in the scheduler manifest. +# Extra arguments to supply to the scheduler. +extraArgs: + feature-gates: AllBeta=true +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The container image used in the scheduler manifest.
Show example(s){{< highlight yaml >}} +image: registry.k8s.io/kube-scheduler:v1.28.0 +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |Extra arguments to supply to the scheduler. | | +|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the scheduler static pod. | | +|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | +|`resources` |ResourcesConfig |Configure the scheduler resources. | | + + + +--- +## EtcdConfig +EtcdConfig represents the etcd configuration options. + +Appears in: + +- ClusterConfig.etcd + + + +{{< highlight yaml >}} +image: gcr.io/etcd-development/etcd:v3.5.9 # The container image used to create the etcd service. +# The `ca` is the root certificate authority of the PKI. +ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +# Extra arguments to supply to etcd. +extraArgs: + election-timeout: "5000" + +# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. +# advertisedSubnets: +# - 10.0.0.0/8 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`image` |string |The container image used to create the etcd service.
Show example(s){{< highlight yaml >}} +image: gcr.io/etcd-development/etcd:v3.5.9 +{{< /highlight >}}
| | +|`ca` |PEMEncodedCertificateAndKey |
The `ca` is the root certificate authority of the PKI.It is composed of a base64 encoded `crt` and `key`.
Show example(s){{< highlight yaml >}} +ca: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`extraArgs` |map[string]string |
Extra arguments to supply to etcd.Note that the following args are not allowed:

- `name`
- `data-dir`
- `initial-cluster-state`
- `listen-peer-urls`
- `listen-client-urls`
- `cert-file`
- `key-file`
- `trusted-ca-file`
- `peer-client-cert-auth`
- `peer-cert-file`
- `peer-trusted-ca-file`
- `peer-key-file`
| | +|`advertisedSubnets` |[]string |
The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.
Show example(s){{< highlight yaml >}} +advertisedSubnets: + - 10.0.0.0/8 +{{< /highlight >}}
| | +|`listenSubnets` |[]string |
The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections.
If `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to
`advertisedSubnets`.

If neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses.

IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.
| | + + + +--- +## ClusterNetworkConfig +ClusterNetworkConfig represents kube networking configuration options. + +Appears in: + +- ClusterConfig.network + + + +{{< highlight yaml >}} +# The CNI used. +cni: + name: flannel # Name of CNI to use. +dnsDomain: cluster.local # The domain used by Kubernetes DNS. +# The pod subnet CIDR. +podSubnets: + - 10.244.0.0/16 +# The service subnet CIDR. +serviceSubnets: + - 10.96.0.0/12 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`cni` |CNIConfig |
The CNI used.Composed of "name" and "urls".
The "name" key supports the following options: "flannel", "custom", and "none".
"flannel" uses Talos-managed Flannel CNI, and that's the default option.
"custom" uses custom manifests that should be provided in "urls".
"none" indicates that Talos will not manage any CNI installation.
Show example(s){{< highlight yaml >}} +cni: + name: custom # Name of CNI to use. + # URLs containing manifests to apply for the CNI. + urls: + - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml +{{< /highlight >}}
| | +|`dnsDomain` |string |
The domain used by Kubernetes DNS.The default is `cluster.local`
Show example(s){{< highlight yaml >}} +dnsDomain: cluser.local +{{< /highlight >}}
| | +|`podSubnets` |[]string |The pod subnet CIDR.
Show example(s){{< highlight yaml >}} +podSubnets: + - 10.244.0.0/16 +{{< /highlight >}}
| | +|`serviceSubnets` |[]string |The service subnet CIDR.
Show example(s){{< highlight yaml >}} +serviceSubnets: + - 10.96.0.0/12 +{{< /highlight >}}
| | + + + +--- +## CNIConfig +CNIConfig represents the CNI configuration options. + +Appears in: + +- ClusterNetworkConfig.cni + + + +{{< highlight yaml >}} +name: custom # Name of CNI to use. +# URLs containing manifests to apply for the CNI. +urls: + - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Name of CNI to use. |`flannel`
`custom`
`none`
| +|`urls` |[]string |
URLs containing manifests to apply for the CNI.Should be present for "custom", must be empty for "flannel" and "none".
| | + + + +--- +## ExternalCloudProviderConfig +ExternalCloudProviderConfig contains external cloud provider configuration. + +Appears in: + +- ClusterConfig.externalCloudProvider + + + +{{< highlight yaml >}} +enabled: true # Enable external cloud provider. +# A list of urls that point to additional manifests for an external cloud provider. +manifests: + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable external cloud provider. |`true`
`yes`
`false`
`no`
| +|`manifests` |[]string |
A list of urls that point to additional manifests for an external cloud provider.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} +manifests: + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml +{{< /highlight >}}
| | + + + +--- +## AdminKubeconfigConfig +AdminKubeconfigConfig contains admin kubeconfig settings. + +Appears in: + +- ClusterConfig.adminKubeconfig + + + +{{< highlight yaml >}} +certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`certLifetime` |Duration |
Admin kubeconfig certificate lifetime (default is 1 year).Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).
| | + + + +--- +## MachineDisk +MachineDisk represents the options available for partitioning, formatting, and +mounting extra disks. + + +Appears in: + +- MachineConfig.disks + + + +{{< highlight yaml >}} +- device: /dev/sdb # The name of the disk to use. + # A list of partitions to create on the disk. + partitions: + - mountpoint: /var/mnt/extra # Where to mount the partition. + + # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. + + # # Human readable representation. + # size: 100 MB + # # Precise value in bytes. + # size: 1073741824 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`device` |string |The name of the disk to use. | | +|`partitions` |[]DiskPartition |A list of partitions to create on the disk. | | + + + +--- +## DiskPartition +DiskPartition represents the options for a disk partition. + +Appears in: + +- MachineDisk.partitions + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`size` |DiskSize |The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.
Show example(s){{< highlight yaml >}} +size: 100 MB +{{< /highlight >}}{{< highlight yaml >}} +size: 1073741824 +{{< /highlight >}}
| | +|`mountpoint` |string |Where to mount the partition. | | + + + +--- +## EncryptionConfig +EncryptionConfig represents partition encryption settings. + +Appears in: + +- SystemDiskEncryptionConfig.state +- SystemDiskEncryptionConfig.ephemeral + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`provider` |string |Encryption provider to use for the encryption.
Show example(s){{< highlight yaml >}} +provider: luks2 +{{< /highlight >}}
| | +|`keys` |[]EncryptionKey |Defines the encryption keys generation and storage method. | | +|`cipher` |string |Cipher kind to use for the encryption. Depends on the encryption provider.
Show example(s){{< highlight yaml >}} +cipher: aes-xts-plain64 +{{< /highlight >}}
|`aes-xts-plain64`
`xchacha12,aes-adiantum-plain64`
`xchacha20,aes-adiantum-plain64`
| +|`keySize` |uint |Defines the encryption key length. | | +|`blockSize` |uint64 |Defines the encryption sector size.
Show example(s){{< highlight yaml >}} +blockSize: 4096 +{{< /highlight >}}
| | +|`options` |[]string |Additional --perf parameters for the LUKS2 encryption.
Show example(s){{< highlight yaml >}} +options: + - no_read_workqueue + - no_write_workqueue +{{< /highlight >}}
|`no_read_workqueue`
`no_write_workqueue`
`same_cpu_crypt`
| + + + +--- +## EncryptionKey +EncryptionKey represents configuration for disk encryption key. + +Appears in: + +- EncryptionConfig.keys + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`static` |EncryptionKeyStatic |Key which value is stored in the configuration file. | | +|`nodeID` |EncryptionKeyNodeID |Deterministically generated key from the node UUID and PartitionLabel. | | +|`kms` |EncryptionKeyKMS |KMS managed encryption key.
Show example(s){{< highlight yaml >}} +kms: + endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. +{{< /highlight >}}
| | +|`slot` |int |Key slot number for LUKS2 encryption. | | +|`tpm` |EncryptionKeyTPM |Enable TPM based disk encryption. | | + + + +--- +## EncryptionKeyStatic +EncryptionKeyStatic represents throw away key type. + +Appears in: + +- EncryptionKey.static + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`passphrase` |string |Defines the static passphrase value. | | + + + +--- +## EncryptionKeyKMS +EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server. + +Appears in: + +- EncryptionKey.kms + + + +{{< highlight yaml >}} +endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |string |KMS endpoint to Seal/Unseal the key. | | + + + +--- +## EncryptionKeyTPM +EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM. + +Appears in: + +- EncryptionKey.tpm + + + + + + +--- +## EncryptionKeyNodeID +EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. + +Appears in: + +- EncryptionKey.nodeID + + + + + + +--- +## ResourcesConfig +ResourcesConfig represents the pod resources. + +Appears in: + +- APIServerConfig.resources +- ControllerManagerConfig.resources +- SchedulerConfig.resources + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`requests` |Unstructured |Requests configures the reserved cpu/memory resources.
Show example(s){{< highlight yaml >}} +requests: + cpu: 1 + memory: 1Gi +{{< /highlight >}}
| | +|`limits` |Unstructured |Limits configures the maximum cpu/memory resources a container can use.
Show example(s){{< highlight yaml >}} +limits: + cpu: 2 + memory: 2500Mi +{{< /highlight >}}
| | + + + +--- +## MachineFile +MachineFile represents a file to write to disk. + +Appears in: + +- MachineConfig.files + + + +{{< highlight yaml >}} +- content: '...' # The contents of the file. + permissions: 0o666 # The file's permissions in octal. + path: /tmp/file.txt # The path of the file. + op: append # The operation to use +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`content` |string |The contents of the file. | | +|`permissions` |FileMode |The file's permissions in octal. | | +|`path` |string |The path of the file. | | +|`op` |string |The operation to use |`create`
`append`
`overwrite`
| + + + +--- +## ExtraHost +ExtraHost represents a host entry in /etc/hosts. + +Appears in: + +- NetworkConfig.extraHostEntries + + + +{{< highlight yaml >}} +- ip: 192.168.1.100 # The IP of the host. + # The host alias. + aliases: + - example + - example.domain.tld +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`ip` |string |The IP of the host. | | +|`aliases` |[]string |The host alias. | | + + + +--- +## Device +Device represents a network interface. + +Appears in: + +- NetworkConfig.interfaces + + + +{{< highlight yaml >}} +- interface: enp0s1 # The interface name. + # Assigns static IP addresses to the interface. + addresses: + - 192.168.2.0/24 + # A list of routes associated with the interface. + routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + metric: 1024 # The optional metric for the route. + mtu: 1500 # The interface's MTU. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*. + # deviceSelector: + # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelector: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + + # # Bond specific options. + # bond: + # # The interfaces that make up the bond. + # interfaces: + # - enp2s0 + # - enp2s1 + # # Picks a network device using the selector. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. + # mode: 802.3ad # A bond option. + # lacpRate: fast # A bond option. + + # # Bridge specific options. + # bridge: + # # The interfaces that make up the bridge. + # interfaces: + # - enxda4042ca9a51 + # - enxae2a6774c259 + # # A bridge option. + # stp: + # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # Indicates if DHCP should be used to configure the interface. + # dhcp: true + + # # DHCP specific options. + # dhcpOptions: + # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # Wireguard specific configuration. + + # # wireguard server example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # listenPort: 51111 # Specifies a device's listening port. + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + # # wireguard peer example + # wireguard: + # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # Specifies a list of peer configurations to apply to a device. + # peers: + # - publicKey: ABCDEF... # Specifies the public key of this peer. + # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # allowedIPs: + # - 192.168.1.0/24 + + # # Virtual (shared) IP address configuration. + + # # layer2 vip example + # vip: + # ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`interface` |string |
The interface name.Mutually exclusive with `deviceSelector`.
Show example(s){{< highlight yaml >}} +interface: enp0s3 +{{< /highlight >}}
| | +|`deviceSelector` |NetworkDeviceSelector |
Picks a network device using the selector.Mutually exclusive with `interface`.
Supports partial match using wildcard syntax.
Show example(s){{< highlight yaml >}} +deviceSelector: + busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. +{{< /highlight >}}{{< highlight yaml >}} +deviceSelector: + hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + driver: virtio # Kernel driver, supports matching by wildcard. +{{< /highlight >}}
| | +|`addresses` |[]string |
Assigns static IP addresses to the interface.An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).
Show example(s){{< highlight yaml >}} +addresses: + - 10.5.0.0/16 + - 192.168.3.7 +{{< /highlight >}}
| | +|`routes` |[]Route |
A list of routes associated with the interface.If used in combination with DHCP, these routes will be appended to routes returned by DHCP server.
Show example(s){{< highlight yaml >}} +routes: + - network: 0.0.0.0/0 # The route's network (destination). + gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). + - network: 10.2.0.0/16 # The route's network (destination). + gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). +{{< /highlight >}}
| | +|`bond` |Bond |Bond specific options.
Show example(s){{< highlight yaml >}} +bond: + # The interfaces that make up the bond. + interfaces: + - enp2s0 + - enp2s1 + mode: 802.3ad # A bond option. + lacpRate: fast # A bond option. + + # # Picks a network device using the selector. + + # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # deviceSelectors: + # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + # driver: virtio # Kernel driver, supports matching by wildcard. +{{< /highlight >}}
| | +|`bridge` |Bridge |Bridge specific options.
Show example(s){{< highlight yaml >}} +bridge: + # The interfaces that make up the bridge. + interfaces: + - enxda4042ca9a51 + - enxae2a6774c259 + # A bridge option. + stp: + enabled: true # Whether Spanning Tree Protocol (STP) is enabled. +{{< /highlight >}}
| | +|`vlans` |[]Vlan |VLAN specific options. | | +|`mtu` |int |
The interface's MTU.If used in combination with DHCP, this will override any MTU settings returned from DHCP server.
| | +|`dhcp` |bool |
Indicates if DHCP should be used to configure the interface.The following DHCP options are supported:

- `OptionClasslessStaticRoute`
- `OptionDomainNameServer`
- `OptionDNSDomainSearchList`
- `OptionHostName`
Show example(s){{< highlight yaml >}} +dhcp: true +{{< /highlight >}}
| | +|`ignore` |bool |Indicates if the interface should be ignored (skips configuration). | | +|`dummy` |bool |
Indicates if the interface is a dummy interface.`dummy` is used to specify that this interface should be a virtual-only, dummy interface.
| | +|`dhcpOptions` |DHCPOptions |
DHCP specific options.`dhcp` *must* be set to true for these to take effect.
Show example(s){{< highlight yaml >}} +dhcpOptions: + routeMetric: 1024 # The priority of all routes received via DHCP. +{{< /highlight >}}
| | +|`wireguard` |DeviceWireguardConfig |
Wireguard specific configuration.Includes things like private key, listen port, peers.
Show example(s){{< highlight yaml >}} +wireguard: + privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + listenPort: 51111 # Specifies a device's listening port. + # Specifies a list of peer configurations to apply to a device. + peers: + - publicKey: ABCDEF... # Specifies the public key of this peer. + endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + allowedIPs: + - 192.168.1.0/24 +{{< /highlight >}}{{< highlight yaml >}} +wireguard: + privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # Specifies a list of peer configurations to apply to a device. + peers: + - publicKey: ABCDEF... # Specifies the public key of this peer. + endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + allowedIPs: + - 192.168.1.0/24 +{{< /highlight >}}
| | +|`vip` |DeviceVIPConfig |Virtual (shared) IP address configuration.
Show example(s){{< highlight yaml >}} +vip: + ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}}
| | + + + +--- +## DHCPOptions +DHCPOptions contains options for configuring the DHCP settings for a given interface. + +Appears in: + +- Device.dhcpOptions +- Vlan.dhcpOptions + + + +{{< highlight yaml >}} +routeMetric: 1024 # The priority of all routes received via DHCP. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`routeMetric` |uint32 |The priority of all routes received via DHCP. | | +|`ipv4` |bool |Enables DHCPv4 protocol for the interface (default is enabled). | | +|`ipv6` |bool |Enables DHCPv6 protocol for the interface (default is disabled). | | +|`duidv6` |string |Set client DUID (hex string). | | + + + +--- +## DeviceWireguardConfig +DeviceWireguardConfig contains settings for configuring Wireguard network interface. + +Appears in: + +- Device.wireguard + + + +{{< highlight yaml >}} +privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). +listenPort: 51111 # Specifies a device's listening port. +# Specifies a list of peer configurations to apply to a device. +peers: + - publicKey: ABCDEF... # Specifies the public key of this peer. + endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + allowedIPs: + - 192.168.1.0/24 +{{< /highlight >}} + +{{< highlight yaml >}} +privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). +# Specifies a list of peer configurations to apply to a device. +peers: + - publicKey: ABCDEF... # Specifies the public key of this peer. + endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + allowedIPs: + - 192.168.1.0/24 +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`privateKey` |string |
Specifies a private key configuration (base64 encoded).Can be generated by `wg genkey`.
| | +|`listenPort` |int |Specifies a device's listening port. | | +|`firewallMark` |int |Specifies a device's firewall mark. | | +|`peers` |[]DeviceWireguardPeer |Specifies a list of peer configurations to apply to a device. | | + + + +--- +## DeviceWireguardPeer +DeviceWireguardPeer a WireGuard device peer configuration. + +Appears in: + +- DeviceWireguardConfig.peers + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`publicKey` |string |
Specifies the public key of this peer.Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`.
| | +|`endpoint` |string |Specifies the endpoint of this peer entry. | | +|`persistentKeepaliveInterval` |Duration |
Specifies the persistent keepalive interval for this peer.Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).
| | +|`allowedIPs` |[]string |AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. | | + + + +--- +## DeviceVIPConfig +DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. + +Appears in: + +- Device.vip +- Vlan.vip + + + +{{< highlight yaml >}} +ip: 172.16.199.55 # Specifies the IP address to be used. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`ip` |string |Specifies the IP address to be used. | | +|`equinixMetal` |VIPEquinixMetalConfig |Specifies the Equinix Metal API settings to assign VIP to the node. | | +|`hcloud` |VIPHCloudConfig |Specifies the Hetzner Cloud API settings to assign VIP to the node. | | + + + +--- +## VIPEquinixMetalConfig +VIPEquinixMetalConfig contains settings for Equinix Metal VIP management. + +Appears in: + +- DeviceVIPConfig.equinixMetal + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`apiToken` |string |Specifies the Equinix Metal API Token. | | + + + +--- +## VIPHCloudConfig +VIPHCloudConfig contains settings for Hetzner Cloud VIP management. + +Appears in: + +- DeviceVIPConfig.hcloud + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`apiToken` |string |Specifies the Hetzner Cloud API Token. | | + + + +--- +## Bond +Bond contains the various options for configuring a bonded interface. + +Appears in: + +- Device.bond + + + +{{< highlight yaml >}} +# The interfaces that make up the bond. +interfaces: + - enp2s0 + - enp2s1 +mode: 802.3ad # A bond option. +lacpRate: fast # A bond option. + +# # Picks a network device using the selector. + +# # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. +# deviceSelectors: +# - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. +# - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. +# driver: virtio # Kernel driver, supports matching by wildcard. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`interfaces` |[]string |The interfaces that make up the bond. | | +|`deviceSelectors` |[]NetworkDeviceSelector |
Picks a network device using the selector.Mutually exclusive with `interfaces`.
Supports partial match using wildcard syntax.
Show example(s){{< highlight yaml >}} +deviceSelectors: + - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + driver: virtio # Kernel driver, supports matching by wildcard. +{{< /highlight >}}
| | +|`arpIPTarget` |[]string |
A bond option.Please see the official kernel documentation.
Not supported at the moment.
| | +|`mode` |string |
A bond option.Please see the official kernel documentation.
| | +|`xmitHashPolicy` |string |
A bond option.Please see the official kernel documentation.
| | +|`lacpRate` |string |
A bond option.Please see the official kernel documentation.
| | +|`adActorSystem` |string |
A bond option.Please see the official kernel documentation.
Not supported at the moment.
| | +|`arpValidate` |string |
A bond option.Please see the official kernel documentation.
| | +|`arpAllTargets` |string |
A bond option.Please see the official kernel documentation.
| | +|`primary` |string |
A bond option.Please see the official kernel documentation.
| | +|`primaryReselect` |string |
A bond option.Please see the official kernel documentation.
| | +|`failOverMac` |string |
A bond option.Please see the official kernel documentation.
| | +|`adSelect` |string |
A bond option.Please see the official kernel documentation.
| | +|`miimon` |uint32 |
A bond option.Please see the official kernel documentation.
| | +|`updelay` |uint32 |
A bond option.Please see the official kernel documentation.
| | +|`downdelay` |uint32 |
A bond option.Please see the official kernel documentation.
| | +|`arpInterval` |uint32 |
A bond option.Please see the official kernel documentation.
| | +|`resendIgmp` |uint32 |
A bond option.Please see the official kernel documentation.
| | +|`minLinks` |uint32 |
A bond option.Please see the official kernel documentation.
| | +|`lpInterval` |uint32 |
A bond option.Please see the official kernel documentation.
| | +|`packetsPerSlave` |uint32 |
A bond option.Please see the official kernel documentation.
| | +|`numPeerNotif` |uint8 |
A bond option.Please see the official kernel documentation.
| | +|`tlbDynamicLb` |uint8 |
A bond option.Please see the official kernel documentation.
| | +|`allSlavesActive` |uint8 |
A bond option.Please see the official kernel documentation.
| | +|`useCarrier` |bool |
A bond option.Please see the official kernel documentation.
| | +|`adActorSysPrio` |uint16 |
A bond option.Please see the official kernel documentation.
| | +|`adUserPortKey` |uint16 |
A bond option.Please see the official kernel documentation.
| | +|`peerNotifyDelay` |uint32 |
A bond option.Please see the official kernel documentation.
| | + + + +--- +## STP +STP contains the various options for configuring the STP properties of a bridge interface. + +Appears in: + +- Bridge.stp + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Whether Spanning Tree Protocol (STP) is enabled. | | + + + +--- +## Bridge +Bridge contains the various options for configuring a bridge interface. + +Appears in: + +- Device.bridge + + + +{{< highlight yaml >}} +# The interfaces that make up the bridge. +interfaces: + - enxda4042ca9a51 + - enxae2a6774c259 +# A bridge option. +stp: + enabled: true # Whether Spanning Tree Protocol (STP) is enabled. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`interfaces` |[]string |The interfaces that make up the bridge. | | +|`stp` |STP |
A bridge option.Please see the official kernel documentation.
| | + + + +--- +## Vlan +Vlan represents vlan settings for a device. + +Appears in: + +- Device.vlans + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`addresses` |[]string |The addresses in CIDR notation or as plain IPs to use. | | +|`routes` |[]Route |A list of routes associated with the VLAN. | | +|`dhcp` |bool |Indicates if DHCP should be used. | | +|`vlanId` |uint16 |The VLAN's ID. | | +|`mtu` |uint32 |The VLAN's MTU. | | +|`vip` |DeviceVIPConfig |The VLAN's virtual IP address configuration. | | +|`dhcpOptions` |DHCPOptions |
DHCP specific options.`dhcp` *must* be set to true for these to take effect.
| | + + + +--- +## Route +Route represents a network route. + +Appears in: + +- Device.routes +- Vlan.routes + + + +{{< highlight yaml >}} +- network: 0.0.0.0/0 # The route's network (destination). + gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). +- network: 10.2.0.0/16 # The route's network (destination). + gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`network` |string |The route's network (destination). | | +|`gateway` |string |The route's gateway (if empty, creates link scope route). | | +|`source` |string |The route's source address (optional). | | +|`metric` |uint32 |The optional metric for the route. | | +|`mtu` |uint32 |The optional MTU for the route. | | + + + +--- +## RegistryMirrorConfig +RegistryMirrorConfig represents mirror configuration for a registry. + +Appears in: + +- RegistriesConfig.mirrors + + + +{{< highlight yaml >}} +ghcr.io: + # List of endpoints (URLs) for registry mirrors to use. + endpoints: + - https://registry.insecure + - https://ghcr.io/v2/ +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoints` |[]string |
List of endpoints (URLs) for registry mirrors to use.Endpoint configures HTTP/HTTPS access mode, host name,
port and path (if path is not set, it defaults to `/v2`).
| | +|`overridePath` |bool |
Use the exact path specified for the endpoint (don't append /v2/).This setting is often required for setting up multiple mirrors
on a single instance of a registry.
| | + + + +--- +## RegistryConfig +RegistryConfig specifies auth & TLS config per registry. + +Appears in: + +- RegistriesConfig.config + + + +{{< highlight yaml >}} +registry.insecure: + # The TLS configuration for the registry. + tls: + insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + + # # Enable mutual TLS authentication with the registry. + # clientIdentity: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # The auth configuration for this registry. + # auth: + # username: username # Optional registry authentication. + # password: password # Optional registry authentication. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`tls` |RegistryTLSConfig |The TLS configuration for the registry.
Show example(s){{< highlight yaml >}} +tls: + # Enable mutual TLS authentication with the registry. + clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}{{< highlight yaml >}} +tls: + insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + + # # Enable mutual TLS authentication with the registry. + # clientIdentity: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`auth` |RegistryAuthConfig |
The auth configuration for this registry.Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.
Show example(s){{< highlight yaml >}} +auth: + username: username # Optional registry authentication. + password: password # Optional registry authentication. +{{< /highlight >}}
| | + + + +--- +## RegistryAuthConfig +RegistryAuthConfig specifies authentication configuration for a registry. + +Appears in: + +- RegistryConfig.auth + + + +{{< highlight yaml >}} +username: username # Optional registry authentication. +password: password # Optional registry authentication. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`username` |string |
Optional registry authentication.The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).
| | +|`password` |string |
Optional registry authentication.The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).
| | +|`auth` |string |
Optional registry authentication.The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).
| | +|`identityToken` |string |
Optional registry authentication.The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).
| | + + + +--- +## RegistryTLSConfig +RegistryTLSConfig specifies TLS config for HTTPS registries. + +Appears in: + +- RegistryConfig.tls + + + +{{< highlight yaml >}} +# Enable mutual TLS authentication with the registry. +clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}} + +{{< highlight yaml >}} +insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + +# # Enable mutual TLS authentication with the registry. +# clientIdentity: +# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t +# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`clientIdentity` |PEMEncodedCertificateAndKey |
Enable mutual TLS authentication with the registry.Client certificate and key should be base64-encoded.
Show example(s){{< highlight yaml >}} +clientIdentity: + crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== +{{< /highlight >}}
| | +|`ca` |Base64Bytes |
CA registry certificate to add the list of trusted certificates.Certificate should be base64-encoded.
| | +|`insecureSkipVerify` |bool |Skip TLS server certificate verification (not recommended). | | + + + +--- +## SystemDiskEncryptionConfig +SystemDiskEncryptionConfig specifies system disk partitions encryption settings. + +Appears in: + +- MachineConfig.systemDiskEncryption + + + +{{< highlight yaml >}} +# Ephemeral partition encryption. +ephemeral: + provider: luks2 # Encryption provider to use for the encryption. + # Defines the encryption keys generation and storage method. + keys: + - # Deterministically generated key from the node UUID and PartitionLabel. + nodeID: {} + slot: 0 # Key slot number for LUKS2 encryption. + + # # KMS managed encryption key. + # kms: + # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. + + # # Cipher kind to use for the encryption. Depends on the encryption provider. + # cipher: aes-xts-plain64 + + # # Defines the encryption sector size. + # blockSize: 4096 + + # # Additional --perf parameters for the LUKS2 encryption. + # options: + # - no_read_workqueue + # - no_write_workqueue +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`state` |EncryptionConfig |State partition encryption. | | +|`ephemeral` |EncryptionConfig |Ephemeral partition encryption. | | + + + +--- +## FeaturesConfig +FeaturesConfig describes individual Talos features that can be switched on or off. + +Appears in: + +- MachineConfig.features + + + +{{< highlight yaml >}} +rbac: true # Enable role-based access control (RBAC). + +# # Configure Talos API access from Kubernetes pods. +# kubernetesTalosAPIAccess: +# enabled: true # Enable Talos API access from Kubernetes pods. +# # The list of Talos API roles which can be granted for access from Kubernetes pods. +# allowedRoles: +# - os:reader +# # The list of Kubernetes namespaces Talos API access is available from. +# allowedKubernetesNamespaces: +# - kube-system +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`rbac` |bool |Enable role-based access control (RBAC). | | +|`stableHostname` |bool |Enable stable default hostname. | | +|`kubernetesTalosAPIAccess` |KubernetesTalosAPIAccessConfig |
Configure Talos API access from Kubernetes pods.
This feature is disabled if the feature config is not specified.
Show example(s){{< highlight yaml >}} +kubernetesTalosAPIAccess: + enabled: true # Enable Talos API access from Kubernetes pods. + # The list of Talos API roles which can be granted for access from Kubernetes pods. + allowedRoles: + - os:reader + # The list of Kubernetes namespaces Talos API access is available from. + allowedKubernetesNamespaces: + - kube-system +{{< /highlight >}}
| | +|`apidCheckExtKeyUsage` |bool |Enable checks for extended key usage of client certificates in apid. | | +|`diskQuotaSupport` |bool |
Enable XFS project quota support for EPHEMERAL partition and user disks.Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota.
| | +|`kubePrism` |KubePrism |
KubePrism - local proxy/load balancer on defined port that will distributerequests to all API servers in the cluster.
| | + + + +--- +## KubePrism +KubePrism describes the configuration for the KubePrism load balancer. + +Appears in: + +- FeaturesConfig.kubePrism + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable KubePrism support - will start local load balacing proxy. | | +|`port` |int |KubePrism port. | | + + + +--- +## KubernetesTalosAPIAccessConfig +KubernetesTalosAPIAccessConfig describes the configuration for the Talos API access from Kubernetes pods. + +Appears in: + +- FeaturesConfig.kubernetesTalosAPIAccess + + + +{{< highlight yaml >}} +enabled: true # Enable Talos API access from Kubernetes pods. +# The list of Talos API roles which can be granted for access from Kubernetes pods. +allowedRoles: + - os:reader +# The list of Kubernetes namespaces Talos API access is available from. +allowedKubernetesNamespaces: + - kube-system +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |Enable Talos API access from Kubernetes pods. | | +|`allowedRoles` |[]string |
The list of Talos API roles which can be granted for access from Kubernetes pods.
Empty list means that no roles can be granted, so access is blocked.
| | +|`allowedKubernetesNamespaces` |[]string |The list of Kubernetes namespaces Talos API access is available from. | | + + + +--- +## VolumeMountConfig +VolumeMountConfig struct describes extra volume mount for the static pods. + +Appears in: + +- APIServerConfig.extraVolumes +- ControllerManagerConfig.extraVolumes +- SchedulerConfig.extraVolumes + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`hostPath` |string |Path on the host.
Show example(s){{< highlight yaml >}} +hostPath: /var/lib/auth +{{< /highlight >}}
| | +|`mountPath` |string |Path in the container.
Show example(s){{< highlight yaml >}} +mountPath: /etc/kubernetes/auth +{{< /highlight >}}
| | +|`readonly` |bool |Mount the volume read only.
Show example(s){{< highlight yaml >}} +readonly: true +{{< /highlight >}}
| | + + + +--- +## ClusterInlineManifest +ClusterInlineManifest struct describes inline bootstrap manifests for the user. + + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |
Name of the manifest.Name should be unique.
Show example(s){{< highlight yaml >}} +name: csi +{{< /highlight >}}
| | +|`contents` |string |Manifest contents as a string.
Show example(s){{< highlight yaml >}} +contents: /etc/kubernetes/auth +{{< /highlight >}}
| | + + + +--- +## NetworkKubeSpan +NetworkKubeSpan struct describes KubeSpan configuration. + +Appears in: + +- NetworkConfig.kubespan + + + +{{< highlight yaml >}} +enabled: true # Enable the KubeSpan feature. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |
Enable the KubeSpan feature.Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.
| | +|`advertiseKubernetesNetworks` |bool |
Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.If disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,
and KubeSpan handles the node-to-node traffic.
If enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.
When enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which
is not always the case with CNIs not relying on Kubernetes for IPAM.
| | +|`allowDownPeerBypass` |bool |
Skip sending traffic via KubeSpan if the peer connection state is not up.This provides configurable choice between connectivity and security: either traffic is always
forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly
to the peer if Wireguard connection can't be established.
| | +|`mtu` |uint32 |
KubeSpan link MTU size.Default value is 1420.
| | +|`filters` |KubeSpanFilters |
KubeSpan advanced filtering of network addresses .
Settings in this section are optional, and settings apply only to the node.
| | + + + +--- +## KubeSpanFilters +KubeSpanFilters struct describes KubeSpan advanced network addresses filtering. + +Appears in: + +- NetworkKubeSpan.filters + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoints` |[]string |
Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.
By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.

Default value: no filtering.
Show example(s){{< highlight yaml >}} +endpoints: + - 0.0.0.0/0 + - '!192.168.0.0/16' + - ::/0 +{{< /highlight >}}
| | + + + +--- +## NetworkDeviceSelector +NetworkDeviceSelector struct describes network device selector. + +Appears in: + +- Device.deviceSelector +- Bond.deviceSelectors + + + +{{< highlight yaml >}} +busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. +{{< /highlight >}} + +{{< highlight yaml >}} +hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. +driver: virtio # Kernel driver, supports matching by wildcard. +{{< /highlight >}} + +{{< highlight yaml >}} +- busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. +- hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. + driver: virtio # Kernel driver, supports matching by wildcard. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`busPath` |string |PCI, USB bus prefix, supports matching by wildcard. | | +|`hardwareAddr` |string |Device hardware address, supports matching by wildcard. | | +|`pciID` |string |PCI ID (vendor ID, product ID), supports matching by wildcard. | | +|`driver` |string |Kernel driver, supports matching by wildcard. | | + + + +--- +## ClusterDiscoveryConfig +ClusterDiscoveryConfig struct configures cluster membership discovery. + +Appears in: + +- ClusterConfig.discovery + + + +{{< highlight yaml >}} +enabled: true # Enable the cluster membership discovery feature. +# Configure registries used for cluster member discovery. +registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: {} + # Service registry is using an external service to push and pull information about cluster members. + service: + endpoint: https://discovery.talos.dev/ # External service endpoint. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`enabled` |bool |
Enable the cluster membership discovery feature.Cluster discovery is based on individual registries which are configured under the registries field.
| | +|`registries` |DiscoveryRegistriesConfig |Configure registries used for cluster member discovery. | | + + + +--- +## DiscoveryRegistriesConfig +DiscoveryRegistriesConfig struct configures cluster membership discovery. + +Appears in: + +- ClusterDiscoveryConfig.registries + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`kubernetes` |RegistryKubernetesConfig |
Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional informationas annotations on the Node resources.
| | +|`service` |RegistryServiceConfig |Service registry is using an external service to push and pull information about cluster members. | | + + + +--- +## RegistryKubernetesConfig +RegistryKubernetesConfig struct configures Kubernetes discovery registry. + +Appears in: + +- DiscoveryRegistriesConfig.kubernetes + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable Kubernetes discovery registry. | | + + + +--- +## RegistryServiceConfig +RegistryServiceConfig struct configures Kubernetes discovery registry. + +Appears in: + +- DiscoveryRegistriesConfig.service + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`disabled` |bool |Disable external service discovery registry. | | +|`endpoint` |string |External service endpoint.
Show example(s){{< highlight yaml >}} +endpoint: https://discovery.talos.dev/ +{{< /highlight >}}
| | + + + +--- +## UdevConfig +UdevConfig describes how the udev system should be configured. + +Appears in: + +- MachineConfig.udev + + + +{{< highlight yaml >}} +# List of udev rules to apply to the udev system +rules: + - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`rules` |[]string |List of udev rules to apply to the udev system | | + + + +--- +## LoggingConfig +LoggingConfig struct configures Talos logging. + +Appears in: + +- MachineConfig.logging + + + +{{< highlight yaml >}} +# Logging destination. +destinations: + - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + format: json_lines # Logs format. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`destinations` |[]LoggingDestination |Logging destination. | | + + + +--- +## LoggingDestination +LoggingDestination struct configures Talos logging destination. + +Appears in: + +- LoggingConfig.destinations + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`endpoint` |Endpoint |Where to send logs. Supported protocols are "tcp" and "udp".
Show example(s){{< highlight yaml >}} +endpoint: udp://127.0.0.1:12345 +{{< /highlight >}}{{< highlight yaml >}} +endpoint: tcp://1.2.3.4:12345 +{{< /highlight >}}
| | +|`format` |string |Logs format. |`json_lines`
| + + + +--- +## KernelConfig +KernelConfig struct configures Talos Linux kernel. + +Appears in: + +- MachineConfig.kernel + + + +{{< highlight yaml >}} +# Kernel modules to load. +modules: + - name: brtfs # Module name. +{{< /highlight >}} + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`modules` |[]KernelModuleConfig |Kernel modules to load. | | + + + +--- +## KernelModuleConfig +KernelModuleConfig struct configures Linux kernel modules to load. + +Appears in: + +- KernelConfig.modules + + + + +| Field | Type | Description | Value(s) | +|-------|------|-------------|----------| +|`name` |string |Module name. | | +|`parameters` |[]string |Module parameters, changes applied after reboot. | | + + diff --git a/website/content/v1.6/reference/kernel.md b/website/content/v1.6/reference/kernel.md new file mode 100644 index 0000000000..4d453c2877 --- /dev/null +++ b/website/content/v1.6/reference/kernel.md @@ -0,0 +1,242 @@ +--- +title: "Kernel" +description: "Linux kernel reference." +--- + +## Commandline Parameters + +Talos supports a number of kernel commandline parameters. Some are required for +it to operate. Others are optional and useful in certain circumstances. + +Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings). + +**Required** parameters: + +* `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `equinixMetal`, `gcp`, `hcloud`, `metal`, `nocloud`, `openstack`, `oracle`, `scaleway`, `upcloud`, `vmware` or `vultr` +* `slab_nomerge`: required by KSPP +* `pti=on`: required by KSPP + +**Recommended** parameters: + +* `init_on_alloc=1`: advised by KSPP, enabled by default in kernel config +* `init_on_free=1`: advised by KSPP, enabled by default in kernel config + +### Available Talos-specific parameters + +#### `ip` + +Initial configuration of the interface, routes, DNS, NTP servers (multiple `ip=` kernel parameters are accepted). + +Full documentation is available in the [Linux kernel docs](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt). + +`ip=:::::::::` + +Talos will use the configuration supplied via the kernel parameter as the initial network configuration. +This parameter is useful in the environments where DHCP doesn't provide IP addresses or when default DNS and NTP servers should be overridden +before loading machine configuration. +Partial configuration can be applied as well, e.g. `ip=:::::::::` sets only the DNS and NTP servers. + +IPv6 addresses can be specified by enclosing them in the square brackets, e.g. `ip=[2001:db8::a]:[2001:db8::b]:[fe80::1]::controlplane1:eth1::[2001:4860:4860::6464]:[2001:4860:4860::64]:[2001:4860:4806::]`. + +`` can use either an IP address notation (IPv4: `255.255.255.0`, IPv6: `[ffff:ffff:ffff:ffff::0]`), or simply a number of one bits in the netmask (`24`). + +`` can be traditional interface naming scheme `eth0, eth1` or `enx`, example: `enx78e7d1ea46da` + +DHCP can be enabled by setting `` to `dhcp`, example: `ip=:::::eth0.3:dhcp`. +Alternative syntax is `ip=eth0.3:dhcp`. + +#### `bond` + +Bond interface configuration. + +Full documentation is available in the [Dracut kernel docs](https://man7.org/linux/man-pages/man7/dracut.cmdline.7.html). + +`bond=:::` + +Talos will use the `bond=` kernel parameter if supplied to set the initial bond configuration. +This parameter is useful in environments where the switch ports are suspended if the machine doesn't setup a LACP bond. + +If only the bond name is supplied, the bond will be created with `eth0` and `eth1` as slaves and bond mode set as `balance-rr` + +All these below configurations are equivalent: + +* `bond=bond0` +* `bond=bond0:` +* `bond=bond0::` +* `bond=bond0:::` +* `bond=bond0:eth0,eth1` +* `bond=bond0:eth0,eth1:balance-rr` + +An example of a bond configuration with all options specified: + +`bond=bond1:eth3,eth4:mode=802.3ad,xmit_hash_policy=layer2+3:1450` + +This will create a bond interface named `bond1` with `eth3` and `eth4` as slaves and set the bond mode to `802.3ad`, the transmit hash policy to `layer2+3` and bond interface MTU to 1450. + +#### `vlan` + +The interface vlan configuration. + +Full documentation is available in the [Dracut kernel docs](https://man7.org/linux/man-pages/man7/dracut.cmdline.7.html). + +Talos will use the `vlan=` kernel parameter if supplied to set the initial vlan configuration. +This parameter is useful in environments where the switch ports are VLAN tagged with no native VLAN. + +Only one vlan can be configured at this stage. + +An example of a vlan configuration including static ip configuration: + +`vlan=eth0.100:eth0 ip=172.20.0.2::172.20.0.1:255.255.255.0::eth0.100:::::` + +This will create a vlan interface named `eth0.100` with `eth0` as the underlying interface and set the vlan id to 100 with static IP 172.20.0.2/24 and 172.20.0.1 as default gateway. + +#### `net.ifnames=0` + +Disable the predictable network interface names by specifying `net.ifnames=0` on the kernel command line. + +#### `panic` + +The amount of time to wait after a panic before a reboot is issued. + +Talos will always reboot if it encounters an unrecoverable error. +However, when collecting debug information, it may reboot too quickly for +humans to read the logs. +This option allows the user to delay the reboot to give time to collect debug +information from the console screen. + +A value of `0` disables automatic rebooting entirely. + +#### `talos.config` + +The URL at which the machine configuration data may be found (only for `metal` platform, with the kernel parameter `talos.platform=metal`). + +This parameter supports variable substitution inside URL query values for the following case-insensitive placeholders: + +* `${uuid}` the SMBIOS UUID +* `${serial}` the SMBIOS Serial Number +* `${mac}` the MAC address of the first network interface attaining link state `up` +* `${hostname}` the hostname of the machine + +The following example + +`http://example.com/metadata?h=${hostname}&m=${mac}&s=${serial}&u=${uuid}` + +may translate to + +`http://example.com/metadata?h=myTestHostname&m=52%3A2f%3Afd%3Adf%3Afc%3Ac0&s=0OCZJ19N65&u=40dcbd19-3b10-444e-bfff-aaee44a51fda` + +For backwards compatibility we insert the system UUID into the query parameter `uuid` if its value is empty. As in +`http://example.com/metadata?uuid=` => `http://example.com/metadata?uuid=40dcbd19-3b10-444e-bfff-aaee44a51fda` + +##### `metal-iso` + +When the kernel parameter `talos.config=metal-iso` is set, Talos will attempt to load the machine configuration from any block device with a filesystem label of `metal-iso`. +Talos will look for a file named `config.yaml` in the root of the filesystem. + +For example, such ISO filesystem can be created with: + +```sh +mkdir iso/ +cp config.yaml iso/ +mkisofs -joliet -rock -volid 'metal-iso' -output config.iso iso/ +``` + +#### `talos.platform` + +The platform name on which Talos will run. + +Valid options are: + +* `aws` +* `azure` +* `container` +* `digitalocean` +* `equinixMetal` +* `gcp` +* `hcloud` +* `metal` +* `nocloud` +* `openstack` +* `oracle` +* `scaleway` +* `upcloud` +* `vmware` +* `vultr` + +#### `talos.board` + +The board name, if Talos is being used on an ARM64 SBC. + +Supported boards are: + +* `bananapi_m64`: Banana Pi M64 +* `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC +* `rock64`: Pine64 Rock64 +* ... + +#### `talos.hostname` + +The hostname to be used. +The hostname is generally specified in the machine config. +However, in some cases, the DHCP server needs to know the hostname +before the machine configuration has been acquired. + +Unless specifically required, the machine configuration should be used +instead. + +#### `talos.shutdown` + +The type of shutdown to use when Talos is told to shutdown. + +Valid options are: + +* `halt` +* `poweroff` + +#### `talos.network.interface.ignore` + +A network interface which should be ignored and not configured by Talos. + +Before a configuration is applied (early on each boot), Talos attempts to +configure each network interface by DHCP. +If there are many network interfaces on the machine which have link but no +DHCP server, this can add significant boot delays. + +This option may be specified multiple times for multiple network interfaces. + +#### `talos.experimental.wipe` + +Resets the disk before starting up the system. + +Valid options are: + +* `system` resets system disk. +* `system:EPHEMERAL,STATE` resets ephemeral and state partitions. Doing this reverts Talos into maintenance mode. + +#### `talos.unified_cgroup_hierarchy` + +Talos defaults to always using the unified cgroup hierarchy (`cgroupsv2`), but `cgroupsv1` +can be forced with `talos.unified_cgroup_hierarchy=0`. + +> Note: `cgroupsv1` is deprecated and it should be used only for compatibility with workloads which don't support `cgroupsv2` yet. + +#### `talos.dashboard.disabled` + +By default, Talos redirects kernel logs to virtual console `/dev/tty1` and starts the dashboard on `/dev/tty2`, +then switches to the dashboard tty. + +If you set `talos.dashboard.disabled=1`, this behavior will be disabled. +Kernel logs will be sent to the currently active console and the dashboard will not be started. + +It is set to be `1` by default on SBCs. + +#### `talos.environment` + +Each value of the argument sets a default environment variable. +The expected format is `key=value`. + +Example: + +```text +talos.environment=http_proxy=http://proxy.example.com:8080 talos.environment=https_proxy=http://proxy.example.com:8080 +``` diff --git a/website/content/v1.6/schemas/v1alpha1_config.schema.json b/website/content/v1.6/schemas/v1alpha1_config.schema.json new file mode 100644 index 0000000000..88c4d47350 --- /dev/null +++ b/website/content/v1.6/schemas/v1alpha1_config.schema.json @@ -0,0 +1,2823 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://talos.dev/v1.5/schemas/v1alpha1_config.schema.json", + "$ref": "#/$defs/Config", + "$defs": { + "APIServerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the API server manifest.\n", + "markdownDescription": "The container image used in the API server manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the API server manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the API server.\n", + "markdownDescription": "Extra arguments to supply to the API server.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the API server.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the API server static pod.\n", + "markdownDescription": "Extra volumes to mount to the API server static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the API server static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "certSANs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "certSANs", + "description": "Extra certificate subject alternative names for the API server’s certificate.\n", + "markdownDescription": "Extra certificate subject alternative names for the API server's certificate.", + "x-intellij-html-description": "\u003cp\u003eExtra certificate subject alternative names for the API server\u0026rsquo;s certificate.\u003c/p\u003e\n" + }, + "disablePodSecurityPolicy": { + "type": "boolean", + "title": "disablePodSecurityPolicy", + "description": "Disable PodSecurityPolicy in the API server and default manifests.\n", + "markdownDescription": "Disable PodSecurityPolicy in the API server and default manifests.", + "x-intellij-html-description": "\u003cp\u003eDisable PodSecurityPolicy in the API server and default manifests.\u003c/p\u003e\n" + }, + "admissionControl": { + "items": { + "$ref": "#/$defs/AdmissionPluginConfig" + }, + "type": "array", + "title": "admissionControl", + "description": "Configure the API server admission plugins.\n", + "markdownDescription": "Configure the API server admission plugins.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server admission plugins.\u003c/p\u003e\n" + }, + "auditPolicy": { + "type": "object", + "title": "auditPolicy", + "description": "Configure the API server audit policy.\n", + "markdownDescription": "Configure the API server audit policy.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server audit policy.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the API server resources.\n", + "markdownDescription": "Configure the API server resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the API server resources.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "AdminKubeconfigConfig": { + "properties": { + "certLifetime": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "certLifetime", + "description": "Admin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).\n", + "markdownDescription": "Admin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).", + "x-intellij-html-description": "\u003cp\u003eAdmin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format (\u0026lsquo;1h\u0026rsquo; for one hour, \u0026lsquo;10m\u0026rsquo; for ten minutes).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "AdmissionPluginConfig": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Name is the name of the admission controller.\nIt must match the registered admission plugin name.\n", + "markdownDescription": "Name is the name of the admission controller.\nIt must match the registered admission plugin name.", + "x-intellij-html-description": "\u003cp\u003eName is the name of the admission controller.\nIt must match the registered admission plugin name.\u003c/p\u003e\n" + }, + "configuration": { + "type": "object", + "title": "configuration", + "description": "Configuration is an embedded configuration object to be used as the plugin’s\nconfiguration.\n", + "markdownDescription": "Configuration is an embedded configuration object to be used as the plugin's\nconfiguration.", + "x-intellij-html-description": "\u003cp\u003eConfiguration is an embedded configuration object to be used as the plugin\u0026rsquo;s\nconfiguration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Bond": { + "properties": { + "interfaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "interfaces", + "description": "The interfaces that make up the bond.\n", + "markdownDescription": "The interfaces that make up the bond.", + "x-intellij-html-description": "\u003cp\u003eThe interfaces that make up the bond.\u003c/p\u003e\n" + }, + "deviceSelectors": { + "items": { + "$ref": "#/$defs/NetworkDeviceSelector" + }, + "type": "array", + "title": "deviceSelectors", + "description": "Picks a network device using the selector.\nMutually exclusive with interfaces.\nSupports partial match using wildcard syntax.\n", + "markdownDescription": "Picks a network device using the selector.\nMutually exclusive with `interfaces`.\nSupports partial match using wildcard syntax.", + "x-intellij-html-description": "\u003cp\u003ePicks a network device using the selector.\nMutually exclusive with \u003ccode\u003einterfaces\u003c/code\u003e.\nSupports partial match using wildcard syntax.\u003c/p\u003e\n" + }, + "arpIPTarget": { + "items": { + "type": "string" + }, + "type": "array", + "title": "arpIPTarget", + "description": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\u003c/p\u003e\n" + }, + "mode": { + "type": "string", + "title": "mode", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "xmitHashPolicy": { + "type": "string", + "title": "xmitHashPolicy", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "lacpRate": { + "type": "string", + "title": "lacpRate", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adActorSystem": { + "type": "string", + "title": "adActorSystem", + "description": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\u003c/p\u003e\n" + }, + "arpValidate": { + "type": "string", + "title": "arpValidate", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "arpAllTargets": { + "type": "string", + "title": "arpAllTargets", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "primary": { + "type": "string", + "title": "primary", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "primaryReselect": { + "type": "string", + "title": "primaryReselect", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "failOverMac": { + "type": "string", + "title": "failOverMac", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adSelect": { + "type": "string", + "title": "adSelect", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "miimon": { + "type": "integer", + "title": "miimon", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "updelay": { + "type": "integer", + "title": "updelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "downdelay": { + "type": "integer", + "title": "downdelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "arpInterval": { + "type": "integer", + "title": "arpInterval", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "resendIgmp": { + "type": "integer", + "title": "resendIgmp", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "minLinks": { + "type": "integer", + "title": "minLinks", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "lpInterval": { + "type": "integer", + "title": "lpInterval", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "packetsPerSlave": { + "type": "integer", + "title": "packetsPerSlave", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "numPeerNotif": { + "type": "integer", + "title": "numPeerNotif", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "tlbDynamicLb": { + "type": "integer", + "title": "tlbDynamicLb", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "allSlavesActive": { + "type": "integer", + "title": "allSlavesActive", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "useCarrier": { + "type": "boolean", + "title": "useCarrier", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adActorSysPrio": { + "type": "integer", + "title": "adActorSysPrio", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "adUserPortKey": { + "type": "integer", + "title": "adUserPortKey", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + }, + "peerNotifyDelay": { + "type": "integer", + "title": "peerNotifyDelay", + "description": "A bond option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bond option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Bridge": { + "properties": { + "interfaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "interfaces", + "description": "The interfaces that make up the bridge.\n", + "markdownDescription": "The interfaces that make up the bridge.", + "x-intellij-html-description": "\u003cp\u003eThe interfaces that make up the bridge.\u003c/p\u003e\n" + }, + "stp": { + "$ref": "#/$defs/STP", + "title": "stp", + "description": "A bridge option.\nPlease see the official kernel documentation.\n", + "markdownDescription": "A bridge option.\nPlease see the official kernel documentation.", + "x-intellij-html-description": "\u003cp\u003eA bridge option.\nPlease see the official kernel documentation.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "CNIConfig": { + "properties": { + "name": { + "enum": [ + "flannel", + "custom", + "none" + ], + "title": "name", + "description": "Name of CNI to use.\n", + "markdownDescription": "Name of CNI to use.", + "x-intellij-html-description": "\u003cp\u003eName of CNI to use.\u003c/p\u003e\n" + }, + "urls": { + "items": { + "type": "string" + }, + "type": "array", + "title": "urls", + "description": "URLs containing manifests to apply for the CNI.\nShould be present for “custom”, must be empty for “flannel” and “none”.\n", + "markdownDescription": "URLs containing manifests to apply for the CNI.\nShould be present for \"custom\", must be empty for \"flannel\" and \"none\".", + "x-intellij-html-description": "\u003cp\u003eURLs containing manifests to apply for the CNI.\nShould be present for \u0026ldquo;custom\u0026rdquo;, must be empty for \u0026ldquo;flannel\u0026rdquo; and \u0026ldquo;none\u0026rdquo;.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterConfig": { + "properties": { + "id": { + "type": "string", + "title": "id", + "description": "Globally unique identifier for this cluster (base64 encoded random 32 bytes).\n", + "markdownDescription": "Globally unique identifier for this cluster (base64 encoded random 32 bytes).", + "x-intellij-html-description": "\u003cp\u003eGlobally unique identifier for this cluster (base64 encoded random 32 bytes).\u003c/p\u003e\n" + }, + "secret": { + "type": "string", + "title": "secret", + "description": "Shared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.\n", + "markdownDescription": "Shared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.", + "x-intellij-html-description": "\u003cp\u003eShared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.\u003c/p\u003e\n" + }, + "controlPlane": { + "$ref": "#/$defs/ControlPlaneConfig", + "title": "controlPlane", + "description": "Provides control plane specific configuration options.\n", + "markdownDescription": "Provides control plane specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides control plane specific configuration options.\u003c/p\u003e\n" + }, + "clusterName": { + "type": "string", + "title": "clusterName", + "description": "Configures the cluster’s name.\n", + "markdownDescription": "Configures the cluster's name.", + "x-intellij-html-description": "\u003cp\u003eConfigures the cluster\u0026rsquo;s name.\u003c/p\u003e\n" + }, + "network": { + "$ref": "#/$defs/ClusterNetworkConfig", + "title": "network", + "description": "Provides cluster specific network configuration options.\n", + "markdownDescription": "Provides cluster specific network configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides cluster specific network configuration options.\u003c/p\u003e\n" + }, + "token": { + "type": "string", + "title": "token", + "description": "The bootstrap token used to join the cluster.\n", + "markdownDescription": "The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ca href=\"https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/\" target=\"_blank\"\u003ebootstrap token\u003c/a\u003e used to join the cluster.\u003c/p\u003e\n" + }, + "aescbcEncryptionSecret": { + "type": "string", + "title": "aescbcEncryptionSecret", + "description": "A key used for the encryption of secret data at rest.\nEnables encryption with AESCBC.\n", + "markdownDescription": "A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\nEnables encryption with AESCBC.", + "x-intellij-html-description": "\u003cp\u003eA key used for the \u003ca href=\"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\" target=\"_blank\"\u003eencryption of secret data at rest\u003c/a\u003e.\nEnables encryption with AESCBC.\u003c/p\u003e\n" + }, + "secretboxEncryptionSecret": { + "type": "string", + "title": "secretboxEncryptionSecret", + "description": "A key used for the encryption of secret data at rest.\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.\n", + "markdownDescription": "A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.", + "x-intellij-html-description": "\u003cp\u003eA key used for the \u003ca href=\"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\" target=\"_blank\"\u003eencryption of secret data at rest\u003c/a\u003e.\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The base64 encoded root certificate authority used by Kubernetes.\n", + "markdownDescription": "The base64 encoded root certificate authority used by Kubernetes.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded root certificate authority used by Kubernetes.\u003c/p\u003e\n" + }, + "aggregatorCA": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "aggregatorCA", + "description": "The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n\nThis CA can be self-signed.\n", + "markdownDescription": "The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n\nThis CA can be self-signed.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\u003c/p\u003e\n\n\u003cp\u003eThis CA can be self-signed.\u003c/p\u003e\n" + }, + "serviceAccount": { + "properties": { + "key": { + "additionalProperties": false, + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "serviceAccount", + "description": "The base64 encoded private key for service account token generation.\n", + "markdownDescription": "The base64 encoded private key for service account token generation.", + "x-intellij-html-description": "\u003cp\u003eThe base64 encoded private key for service account token generation.\u003c/p\u003e\n" + }, + "apiServer": { + "$ref": "#/$defs/APIServerConfig", + "title": "apiServer", + "description": "API server specific configuration options.\n", + "markdownDescription": "API server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eAPI server specific configuration options.\u003c/p\u003e\n" + }, + "controllerManager": { + "$ref": "#/$defs/ControllerManagerConfig", + "title": "controllerManager", + "description": "Controller manager server specific configuration options.\n", + "markdownDescription": "Controller manager server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eController manager server specific configuration options.\u003c/p\u003e\n" + }, + "proxy": { + "$ref": "#/$defs/ProxyConfig", + "title": "proxy", + "description": "Kube-proxy server-specific configuration options\n", + "markdownDescription": "Kube-proxy server-specific configuration options", + "x-intellij-html-description": "\u003cp\u003eKube-proxy server-specific configuration options\u003c/p\u003e\n" + }, + "scheduler": { + "$ref": "#/$defs/SchedulerConfig", + "title": "scheduler", + "description": "Scheduler server specific configuration options.\n", + "markdownDescription": "Scheduler server specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eScheduler server specific configuration options.\u003c/p\u003e\n" + }, + "discovery": { + "$ref": "#/$defs/ClusterDiscoveryConfig", + "title": "discovery", + "description": "Configures cluster member discovery.\n", + "markdownDescription": "Configures cluster member discovery.", + "x-intellij-html-description": "\u003cp\u003eConfigures cluster member discovery.\u003c/p\u003e\n" + }, + "etcd": { + "$ref": "#/$defs/EtcdConfig", + "title": "etcd", + "description": "Etcd specific configuration options.\n", + "markdownDescription": "Etcd specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eEtcd specific configuration options.\u003c/p\u003e\n" + }, + "coreDNS": { + "$ref": "#/$defs/CoreDNS", + "title": "coreDNS", + "description": "Core DNS specific configuration options.\n", + "markdownDescription": "Core DNS specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eCore DNS specific configuration options.\u003c/p\u003e\n" + }, + "externalCloudProvider": { + "$ref": "#/$defs/ExternalCloudProviderConfig", + "title": "externalCloudProvider", + "description": "External cloud provider configuration.\n", + "markdownDescription": "External cloud provider configuration.", + "x-intellij-html-description": "\u003cp\u003eExternal cloud provider configuration.\u003c/p\u003e\n" + }, + "extraManifests": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraManifests", + "description": "A list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + }, + "extraManifestHeaders": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraManifestHeaders", + "description": "A map of key value pairs that will be added while fetching the extraManifests.\n", + "markdownDescription": "A map of key value pairs that will be added while fetching the extraManifests.", + "x-intellij-html-description": "\u003cp\u003eA map of key value pairs that will be added while fetching the extraManifests.\u003c/p\u003e\n" + }, + "inlineManifests": { + "items": { + "$ref": "#/$defs/ClusterInlineManifest" + }, + "type": "array", + "title": "inlineManifests", + "description": "A list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + }, + "adminKubeconfig": { + "$ref": "#/$defs/AdminKubeconfigConfig", + "title": "adminKubeconfig", + "description": "Settings for admin kubeconfig generation.\nCertificate lifetime can be configured.\n", + "markdownDescription": "Settings for admin kubeconfig generation.\nCertificate lifetime can be configured.", + "x-intellij-html-description": "\u003cp\u003eSettings for admin kubeconfig generation.\nCertificate lifetime can be configured.\u003c/p\u003e\n" + }, + "allowSchedulingOnControlPlanes": { + "type": "boolean", + "title": "allowSchedulingOnControlPlanes", + "description": "Allows running workload on control-plane nodes.\n", + "markdownDescription": "Allows running workload on control-plane nodes.", + "x-intellij-html-description": "\u003cp\u003eAllows running workload on control-plane nodes.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterDiscoveryConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.\n", + "markdownDescription": "Enable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.", + "x-intellij-html-description": "\u003cp\u003eEnable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.\u003c/p\u003e\n" + }, + "registries": { + "$ref": "#/$defs/DiscoveryRegistriesConfig", + "title": "registries", + "description": "Configure registries used for cluster member discovery.\n", + "markdownDescription": "Configure registries used for cluster member discovery.", + "x-intellij-html-description": "\u003cp\u003eConfigure registries used for cluster member discovery.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterInlineManifest": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Name of the manifest.\nName should be unique.\n", + "markdownDescription": "Name of the manifest.\nName should be unique.", + "x-intellij-html-description": "\u003cp\u003eName of the manifest.\nName should be unique.\u003c/p\u003e\n" + }, + "contents": { + "type": "string", + "title": "contents", + "description": "Manifest contents as a string.\n", + "markdownDescription": "Manifest contents as a string.", + "x-intellij-html-description": "\u003cp\u003eManifest contents as a string.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterNetworkConfig": { + "properties": { + "cni": { + "$ref": "#/$defs/CNIConfig", + "title": "cni", + "description": "The CNI used.\nComposed of “name” and “urls”.\nThe “name” key supports the following options: “flannel”, “custom”, and “none”.\n“flannel” uses Talos-managed Flannel CNI, and that’s the default option.\n“custom” uses custom manifests that should be provided in “urls”.\n“none” indicates that Talos will not manage any CNI installation.\n", + "markdownDescription": "The CNI used.\nComposed of \"name\" and \"urls\".\nThe \"name\" key supports the following options: \"flannel\", \"custom\", and \"none\".\n\"flannel\" uses Talos-managed Flannel CNI, and that's the default option.\n\"custom\" uses custom manifests that should be provided in \"urls\".\n\"none\" indicates that Talos will not manage any CNI installation.", + "x-intellij-html-description": "\u003cp\u003eThe CNI used.\nComposed of \u0026ldquo;name\u0026rdquo; and \u0026ldquo;urls\u0026rdquo;.\nThe \u0026ldquo;name\u0026rdquo; key supports the following options: \u0026ldquo;flannel\u0026rdquo;, \u0026ldquo;custom\u0026rdquo;, and \u0026ldquo;none\u0026rdquo;.\n\u0026ldquo;flannel\u0026rdquo; uses Talos-managed Flannel CNI, and that\u0026rsquo;s the default option.\n\u0026ldquo;custom\u0026rdquo; uses custom manifests that should be provided in \u0026ldquo;urls\u0026rdquo;.\n\u0026ldquo;none\u0026rdquo; indicates that Talos will not manage any CNI installation.\u003c/p\u003e\n" + }, + "dnsDomain": { + "type": "string", + "title": "dnsDomain", + "description": "The domain used by Kubernetes DNS.\nThe default is cluster.local\n", + "markdownDescription": "The domain used by Kubernetes DNS.\nThe default is `cluster.local`", + "x-intellij-html-description": "\u003cp\u003eThe domain used by Kubernetes DNS.\nThe default is \u003ccode\u003ecluster.local\u003c/code\u003e\u003c/p\u003e\n" + }, + "podSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "podSubnets", + "description": "The pod subnet CIDR.\n", + "markdownDescription": "The pod subnet CIDR.", + "x-intellij-html-description": "\u003cp\u003eThe pod subnet CIDR.\u003c/p\u003e\n" + }, + "serviceSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "serviceSubnets", + "description": "The service subnet CIDR.\n", + "markdownDescription": "The service subnet CIDR.", + "x-intellij-html-description": "\u003cp\u003eThe service subnet CIDR.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Config": { + "properties": { + "version": { + "enum": [ + "v1alpha1" + ], + "title": "version", + "description": "Indicates the schema used to decode the contents.\n", + "markdownDescription": "Indicates the schema used to decode the contents.", + "x-intellij-html-description": "\u003cp\u003eIndicates the schema used to decode the contents.\u003c/p\u003e\n" + }, + "debug": { + "type": "boolean", + "title": "debug", + "description": "Enable verbose logging to the console.\nAll system containers logs will flow into serial console.\n\nNote: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.\n", + "markdownDescription": "Enable verbose logging to the console.\nAll system containers logs will flow into serial console.\n\n**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.", + "x-intellij-html-description": "\u003cp\u003eEnable verbose logging to the console.\nAll system containers logs will flow into serial console.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.\u003c/p\u003e\n" + }, + "persist": { + "type": "boolean", + "title": "persist", + "description": "description: |\n Indicates whether to pull the machine config upon every boot.\n\nNote: this option is deprecated and it will be removed in Talos 1.6.\n values:\n - true\n - yes\n - false\n - no\n", + "markdownDescription": "description: |\n Indicates whether to pull the machine config upon every boot.\n\n **Note**: this option is deprecated and it will be removed in Talos 1.6.\n values:\n - true\n - yes\n - false\n - no", + "x-intellij-html-description": "\u003cp\u003edescription: |\n Indicates whether to pull the machine config upon every boot.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: this option is deprecated and it will be removed in Talos 1.6.\n values:\n - true\n - yes\n - false\n - no\u003c/p\u003e\n" + }, + "machine": { + "$ref": "#/$defs/MachineConfig", + "title": "machine", + "description": "Provides machine specific configuration options.\n", + "markdownDescription": "Provides machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific configuration options.\u003c/p\u003e\n" + }, + "cluster": { + "$ref": "#/$defs/ClusterConfig", + "title": "cluster", + "description": "Provides cluster specific configuration options.\n", + "markdownDescription": "Provides cluster specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides cluster specific configuration options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneConfig": { + "properties": { + "endpoint": { + "type": "string", + "pattern": "^https://", + "format": "uri", + "title": "endpoint", + "description": "Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.\n", + "markdownDescription": "Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.", + "x-intellij-html-description": "\u003cp\u003eEndpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.\u003c/p\u003e\n" + }, + "localAPIServerPort": { + "type": "integer", + "title": "localAPIServerPort", + "description": "The port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is 6443.\n", + "markdownDescription": "The port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is `6443`.", + "x-intellij-html-description": "\u003cp\u003eThe port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is \u003ccode\u003e6443\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControllerManagerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the controller manager manifest.\n", + "markdownDescription": "The container image used in the controller manager manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the controller manager manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the controller manager.\n", + "markdownDescription": "Extra arguments to supply to the controller manager.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the controller manager.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the controller manager static pod.\n", + "markdownDescription": "Extra volumes to mount to the controller manager static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the controller manager static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the controller manager resources.\n", + "markdownDescription": "Configure the controller manager resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the controller manager resources.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "CoreDNS": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable coredns deployment on cluster bootstrap.\n", + "markdownDescription": "Disable coredns deployment on cluster bootstrap.", + "x-intellij-html-description": "\u003cp\u003eDisable coredns deployment on cluster bootstrap.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "The image field is an override to the default coredns image.\n", + "markdownDescription": "The `image` field is an override to the default coredns image.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an override to the default coredns image.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DHCPOptions": { + "properties": { + "routeMetric": { + "type": "integer", + "title": "routeMetric", + "description": "The priority of all routes received via DHCP.\n", + "markdownDescription": "The priority of all routes received via DHCP.", + "x-intellij-html-description": "\u003cp\u003eThe priority of all routes received via DHCP.\u003c/p\u003e\n" + }, + "ipv4": { + "type": "boolean", + "title": "ipv4", + "description": "Enables DHCPv4 protocol for the interface (default is enabled).\n", + "markdownDescription": "Enables DHCPv4 protocol for the interface (default is enabled).", + "x-intellij-html-description": "\u003cp\u003eEnables DHCPv4 protocol for the interface (default is enabled).\u003c/p\u003e\n" + }, + "ipv6": { + "type": "boolean", + "title": "ipv6", + "description": "Enables DHCPv6 protocol for the interface (default is disabled).\n", + "markdownDescription": "Enables DHCPv6 protocol for the interface (default is disabled).", + "x-intellij-html-description": "\u003cp\u003eEnables DHCPv6 protocol for the interface (default is disabled).\u003c/p\u003e\n" + }, + "duidv6": { + "type": "string", + "title": "duidv6", + "description": "Set client DUID (hex string).\n", + "markdownDescription": "Set client DUID (hex string).", + "x-intellij-html-description": "\u003cp\u003eSet client DUID (hex string).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Device": { + "properties": { + "interface": { + "type": "string", + "title": "interface", + "description": "The interface name.\nMutually exclusive with deviceSelector.\n", + "markdownDescription": "The interface name.\nMutually exclusive with `deviceSelector`.", + "x-intellij-html-description": "\u003cp\u003eThe interface name.\nMutually exclusive with \u003ccode\u003edeviceSelector\u003c/code\u003e.\u003c/p\u003e\n" + }, + "deviceSelector": { + "$ref": "#/$defs/NetworkDeviceSelector", + "title": "deviceSelector", + "description": "Picks a network device using the selector.\nMutually exclusive with interface.\nSupports partial match using wildcard syntax.\n", + "markdownDescription": "Picks a network device using the selector.\nMutually exclusive with `interface`.\nSupports partial match using wildcard syntax.", + "x-intellij-html-description": "\u003cp\u003ePicks a network device using the selector.\nMutually exclusive with \u003ccode\u003einterface\u003c/code\u003e.\nSupports partial match using wildcard syntax.\u003c/p\u003e\n" + }, + "addresses": { + "items": { + "type": "string" + }, + "type": "array", + "title": "addresses", + "description": "Assigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).\n", + "markdownDescription": "Assigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).", + "x-intellij-html-description": "\u003cp\u003eAssigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).\u003c/p\u003e\n" + }, + "routes": { + "items": { + "$ref": "#/$defs/Route" + }, + "type": "array", + "title": "routes", + "description": "A list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.\n", + "markdownDescription": "A list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.", + "x-intellij-html-description": "\u003cp\u003eA list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.\u003c/p\u003e\n" + }, + "bond": { + "$ref": "#/$defs/Bond", + "title": "bond", + "description": "Bond specific options.\n", + "markdownDescription": "Bond specific options.", + "x-intellij-html-description": "\u003cp\u003eBond specific options.\u003c/p\u003e\n" + }, + "bridge": { + "$ref": "#/$defs/Bridge", + "title": "bridge", + "description": "Bridge specific options.\n", + "markdownDescription": "Bridge specific options.", + "x-intellij-html-description": "\u003cp\u003eBridge specific options.\u003c/p\u003e\n" + }, + "vlans": { + "items": { + "$ref": "#/$defs/Vlan" + }, + "type": "array", + "title": "vlans", + "description": "VLAN specific options.\n", + "markdownDescription": "VLAN specific options.", + "x-intellij-html-description": "\u003cp\u003eVLAN specific options.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The interface’s MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.\n", + "markdownDescription": "The interface's MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.", + "x-intellij-html-description": "\u003cp\u003eThe interface\u0026rsquo;s MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.\u003c/p\u003e\n" + }, + "dhcp": { + "type": "boolean", + "title": "dhcp", + "description": "Indicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\n\n\nOptionClasslessStaticRoute\nOptionDomainNameServer\nOptionDNSDomainSearchList\nOptionHostName\n\n", + "markdownDescription": "Indicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\n\n- `OptionClasslessStaticRoute`\n- `OptionDomainNameServer`\n- `OptionDNSDomainSearchList`\n- `OptionHostName`", + "x-intellij-html-description": "\u003cp\u003eIndicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eOptionClasslessStaticRoute\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionDomainNameServer\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionDNSDomainSearchList\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionHostName\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n" + }, + "ignore": { + "type": "boolean", + "title": "ignore", + "description": "Indicates if the interface should be ignored (skips configuration).\n", + "markdownDescription": "Indicates if the interface should be ignored (skips configuration).", + "x-intellij-html-description": "\u003cp\u003eIndicates if the interface should be ignored (skips configuration).\u003c/p\u003e\n" + }, + "dummy": { + "type": "boolean", + "title": "dummy", + "description": "Indicates if the interface is a dummy interface.\ndummy is used to specify that this interface should be a virtual-only, dummy interface.\n", + "markdownDescription": "Indicates if the interface is a dummy interface.\n`dummy` is used to specify that this interface should be a virtual-only, dummy interface.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the interface is a dummy interface.\n\u003ccode\u003edummy\u003c/code\u003e is used to specify that this interface should be a virtual-only, dummy interface.\u003c/p\u003e\n" + }, + "dhcpOptions": { + "$ref": "#/$defs/DHCPOptions", + "title": "dhcpOptions", + "description": "DHCP specific options.\ndhcp must be set to true for these to take effect.\n", + "markdownDescription": "DHCP specific options.\n`dhcp` *must* be set to true for these to take effect.", + "x-intellij-html-description": "\u003cp\u003eDHCP specific options.\n\u003ccode\u003edhcp\u003c/code\u003e \u003cem\u003emust\u003c/em\u003e be set to true for these to take effect.\u003c/p\u003e\n" + }, + "wireguard": { + "$ref": "#/$defs/DeviceWireguardConfig", + "title": "wireguard", + "description": "Wireguard specific configuration.\nIncludes things like private key, listen port, peers.\n", + "markdownDescription": "Wireguard specific configuration.\nIncludes things like private key, listen port, peers.", + "x-intellij-html-description": "\u003cp\u003eWireguard specific configuration.\nIncludes things like private key, listen port, peers.\u003c/p\u003e\n" + }, + "vip": { + "$ref": "#/$defs/DeviceVIPConfig", + "title": "vip", + "description": "Virtual (shared) IP address configuration.\n", + "markdownDescription": "Virtual (shared) IP address configuration.", + "x-intellij-html-description": "\u003cp\u003eVirtual (shared) IP address configuration.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DeviceVIPConfig": { + "properties": { + "ip": { + "type": "string", + "title": "ip", + "description": "Specifies the IP address to be used.\n", + "markdownDescription": "Specifies the IP address to be used.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the IP address to be used.\u003c/p\u003e\n" + }, + "equinixMetal": { + "$ref": "#/$defs/VIPEquinixMetalConfig", + "title": "equinixMetal", + "description": "Specifies the Equinix Metal API settings to assign VIP to the node.\n", + "markdownDescription": "Specifies the Equinix Metal API settings to assign VIP to the node.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Equinix Metal API settings to assign VIP to the node.\u003c/p\u003e\n" + }, + "hcloud": { + "$ref": "#/$defs/VIPHCloudConfig", + "title": "hcloud", + "description": "Specifies the Hetzner Cloud API settings to assign VIP to the node.\n", + "markdownDescription": "Specifies the Hetzner Cloud API settings to assign VIP to the node.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Hetzner Cloud API settings to assign VIP to the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DeviceWireguardConfig": { + "properties": { + "privateKey": { + "type": "string", + "title": "privateKey", + "description": "Specifies a private key configuration (base64 encoded).\nCan be generated by wg genkey.\n", + "markdownDescription": "Specifies a private key configuration (base64 encoded).\nCan be generated by `wg genkey`.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a private key configuration (base64 encoded).\nCan be generated by \u003ccode\u003ewg genkey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "listenPort": { + "type": "integer", + "title": "listenPort", + "description": "Specifies a device’s listening port.\n", + "markdownDescription": "Specifies a device's listening port.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a device\u0026rsquo;s listening port.\u003c/p\u003e\n" + }, + "firewallMark": { + "type": "integer", + "title": "firewallMark", + "description": "Specifies a device’s firewall mark.\n", + "markdownDescription": "Specifies a device's firewall mark.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a device\u0026rsquo;s firewall mark.\u003c/p\u003e\n" + }, + "peers": { + "items": { + "$ref": "#/$defs/DeviceWireguardPeer" + }, + "type": "array", + "title": "peers", + "description": "Specifies a list of peer configurations to apply to a device.\n", + "markdownDescription": "Specifies a list of peer configurations to apply to a device.", + "x-intellij-html-description": "\u003cp\u003eSpecifies a list of peer configurations to apply to a device.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DeviceWireguardPeer": { + "properties": { + "publicKey": { + "type": "string", + "title": "publicKey", + "description": "Specifies the public key of this peer.\nCan be extracted from private key by running wg pubkey \u0026lt; private.key \u0026gt; public.key \u0026amp;\u0026amp; cat public.key.\n", + "markdownDescription": "Specifies the public key of this peer.\nCan be extracted from private key by running `wg pubkey \u003c private.key \u003e public.key \u0026\u0026 cat public.key`.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the public key of this peer.\nCan be extracted from private key by running \u003ccode\u003ewg pubkey \u0026lt; private.key \u0026gt; public.key \u0026amp;\u0026amp; cat public.key\u003c/code\u003e.\u003c/p\u003e\n" + }, + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "Specifies the endpoint of this peer entry.\n", + "markdownDescription": "Specifies the endpoint of this peer entry.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the endpoint of this peer entry.\u003c/p\u003e\n" + }, + "persistentKeepaliveInterval": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "persistentKeepaliveInterval", + "description": "Specifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).\n", + "markdownDescription": "Specifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).", + "x-intellij-html-description": "\u003cp\u003eSpecifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format (\u0026lsquo;1h\u0026rsquo; for one hour, \u0026lsquo;10m\u0026rsquo; for ten minutes).\u003c/p\u003e\n" + }, + "allowedIPs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedIPs", + "description": "AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\n", + "markdownDescription": "AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.", + "x-intellij-html-description": "\u003cp\u003eAllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DiscoveryRegistriesConfig": { + "properties": { + "kubernetes": { + "$ref": "#/$defs/RegistryKubernetesConfig", + "title": "kubernetes", + "description": "Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\n", + "markdownDescription": "Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.", + "x-intellij-html-description": "\u003cp\u003eKubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\u003c/p\u003e\n" + }, + "service": { + "$ref": "#/$defs/RegistryServiceConfig", + "title": "service", + "description": "Service registry is using an external service to push and pull information about cluster members.\n", + "markdownDescription": "Service registry is using an external service to push and pull information about cluster members.", + "x-intellij-html-description": "\u003cp\u003eService registry is using an external service to push and pull information about cluster members.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DiskPartition": { + "properties": { + "size": { + "type": "integer", + "title": "size", + "description": "The size of partition: either bytes or human readable representation. If size: is omitted, the partition is sized to occupy the full disk.\n", + "markdownDescription": "The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.", + "x-intellij-html-description": "\u003cp\u003eThe size of partition: either bytes or human readable representation. If \u003ccode\u003esize:\u003c/code\u003e is omitted, the partition is sized to occupy the full disk.\u003c/p\u003e\n" + }, + "mountpoint": { + "type": "string", + "title": "mountpoint", + "description": "Where to mount the partition.\n", + "markdownDescription": "Where to mount the partition.", + "x-intellij-html-description": "\u003cp\u003eWhere to mount the partition.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionConfig": { + "properties": { + "provider": { + "type": "string", + "title": "provider", + "description": "Encryption provider to use for the encryption.\n", + "markdownDescription": "Encryption provider to use for the encryption.", + "x-intellij-html-description": "\u003cp\u003eEncryption provider to use for the encryption.\u003c/p\u003e\n" + }, + "keys": { + "items": { + "$ref": "#/$defs/EncryptionKey" + }, + "type": "array", + "title": "keys", + "description": "Defines the encryption keys generation and storage method.\n", + "markdownDescription": "Defines the encryption keys generation and storage method.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption keys generation and storage method.\u003c/p\u003e\n" + }, + "cipher": { + "enum": [ + "aes-xts-plain64", + "xchacha12,aes-adiantum-plain64", + "xchacha20,aes-adiantum-plain64" + ], + "title": "cipher", + "description": "Cipher kind to use for the encryption. Depends on the encryption provider.\n", + "markdownDescription": "Cipher kind to use for the encryption. Depends on the encryption provider.", + "x-intellij-html-description": "\u003cp\u003eCipher kind to use for the encryption. Depends on the encryption provider.\u003c/p\u003e\n" + }, + "keySize": { + "type": "integer", + "title": "keySize", + "description": "Defines the encryption key length.\n", + "markdownDescription": "Defines the encryption key length.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption key length.\u003c/p\u003e\n" + }, + "blockSize": { + "type": "integer", + "title": "blockSize", + "description": "Defines the encryption sector size.\n", + "markdownDescription": "Defines the encryption sector size.", + "x-intellij-html-description": "\u003cp\u003eDefines the encryption sector size.\u003c/p\u003e\n" + }, + "options": { + "enum": [ + "no_read_workqueue", + "no_write_workqueue", + "same_cpu_crypt" + ], + "title": "options", + "description": "Additional –perf parameters for the LUKS2 encryption.\n", + "markdownDescription": "Additional --perf parameters for the LUKS2 encryption.", + "x-intellij-html-description": "\u003cp\u003eAdditional \u0026ndash;perf parameters for the LUKS2 encryption.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKey": { + "properties": { + "static": { + "$ref": "#/$defs/EncryptionKeyStatic", + "title": "static", + "description": "Key which value is stored in the configuration file.\n", + "markdownDescription": "Key which value is stored in the configuration file.", + "x-intellij-html-description": "\u003cp\u003eKey which value is stored in the configuration file.\u003c/p\u003e\n" + }, + "nodeID": { + "$ref": "#/$defs/EncryptionKeyNodeID", + "title": "nodeID", + "description": "Deterministically generated key from the node UUID and PartitionLabel.\n", + "markdownDescription": "Deterministically generated key from the node UUID and PartitionLabel.", + "x-intellij-html-description": "\u003cp\u003eDeterministically generated key from the node UUID and PartitionLabel.\u003c/p\u003e\n" + }, + "kms": { + "$ref": "#/$defs/EncryptionKeyKMS", + "title": "kms", + "description": "KMS managed encryption key.\n", + "markdownDescription": "KMS managed encryption key.", + "x-intellij-html-description": "\u003cp\u003eKMS managed encryption key.\u003c/p\u003e\n" + }, + "slot": { + "type": "integer", + "title": "slot", + "description": "Key slot number for LUKS2 encryption.\n", + "markdownDescription": "Key slot number for LUKS2 encryption.", + "x-intellij-html-description": "\u003cp\u003eKey slot number for LUKS2 encryption.\u003c/p\u003e\n" + }, + "tpm": { + "$ref": "#/$defs/EncryptionKeyTPM", + "title": "tpm", + "description": "Enable TPM based disk encryption.\n", + "markdownDescription": "Enable TPM based disk encryption.", + "x-intellij-html-description": "\u003cp\u003eEnable TPM based disk encryption.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKeyKMS": { + "properties": { + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "KMS endpoint to Seal/Unseal the key.\n", + "markdownDescription": "KMS endpoint to Seal/Unseal the key.", + "x-intellij-html-description": "\u003cp\u003eKMS endpoint to Seal/Unseal the key.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKeyNodeID": { + "properties": {}, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKeyStatic": { + "properties": { + "passphrase": { + "type": "string", + "title": "passphrase", + "description": "Defines the static passphrase value.\n", + "markdownDescription": "Defines the static passphrase value.", + "x-intellij-html-description": "\u003cp\u003eDefines the static passphrase value.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EncryptionKeyTPM": { + "properties": {}, + "additionalProperties": false, + "type": "object" + }, + "Endpoint": { + "properties": {}, + "additionalProperties": false, + "type": "object" + }, + "EtcdConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used to create the etcd service.\n", + "markdownDescription": "The container image used to create the etcd service.", + "x-intellij-html-description": "\u003cp\u003eThe container image used to create the etcd service.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The ca is the root certificate authority of the PKI.\nIt is composed of a base64 encoded crt and key.\n", + "markdownDescription": "The `ca` is the root certificate authority of the PKI.\nIt is composed of a base64 encoded `crt` and `key`.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eca\u003c/code\u003e is the root certificate authority of the PKI.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e and \u003ccode\u003ekey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to etcd.\nNote that the following args are not allowed:\n\n\nname\ndata-dir\ninitial-cluster-state\nlisten-peer-urls\nlisten-client-urls\ncert-file\nkey-file\ntrusted-ca-file\npeer-client-cert-auth\npeer-cert-file\npeer-trusted-ca-file\npeer-key-file\n\n", + "markdownDescription": "Extra arguments to supply to etcd.\nNote that the following args are not allowed:\n\n- `name`\n- `data-dir`\n- `initial-cluster-state`\n- `listen-peer-urls`\n- `listen-client-urls`\n- `cert-file`\n- `key-file`\n- `trusted-ca-file`\n- `peer-client-cert-auth`\n- `peer-cert-file`\n- `peer-trusted-ca-file`\n- `peer-key-file`", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to etcd.\nNote that the following args are not allowed:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ename\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003edata-dir\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003einitial-cluster-state\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elisten-peer-urls\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elisten-client-urls\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ecert-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ekey-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etrusted-ca-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-client-cert-auth\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-cert-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-trusted-ca-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-key-file\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n" + }, + "advertisedSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "advertisedSubnets", + "description": "The advertisedSubnets field configures the networks to pick etcd advertised IP from.\n\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\n", + "markdownDescription": "The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.\n\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eadvertisedSubnets\u003c/code\u003e field configures the networks to pick etcd advertised IP from.\u003c/p\u003e\n\n\u003cp\u003eIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\u003c/p\u003e\n" + }, + "listenSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "listenSubnets", + "description": "The listenSubnets field configures the networks for the etcd to listen for peer and client connections.\n\nIf listenSubnets is not set, but advertisedSubnets is set, listenSubnets defaults to\nadvertisedSubnets.\n\nIf neither advertisedSubnets nor listenSubnets is set, listenSubnets defaults to listen on all addresses.\n\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\n", + "markdownDescription": "The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections.\n\nIf `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to\n`advertisedSubnets`.\n\nIf neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses.\n\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003elistenSubnets\u003c/code\u003e field configures the networks for the etcd to listen for peer and client connections.\u003c/p\u003e\n\n\u003cp\u003eIf \u003ccode\u003elistenSubnets\u003c/code\u003e is not set, but \u003ccode\u003eadvertisedSubnets\u003c/code\u003e is set, \u003ccode\u003elistenSubnets\u003c/code\u003e defaults to\n\u003ccode\u003eadvertisedSubnets\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003eIf neither \u003ccode\u003eadvertisedSubnets\u003c/code\u003e nor \u003ccode\u003elistenSubnets\u003c/code\u003e is set, \u003ccode\u003elistenSubnets\u003c/code\u003e defaults to listen on all addresses.\u003c/p\u003e\n\n\u003cp\u003eIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalCloudProviderConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable external cloud provider.\n", + "markdownDescription": "Enable external cloud provider.", + "x-intellij-html-description": "\u003cp\u003eEnable external cloud provider.\u003c/p\u003e\n" + }, + "manifests": { + "items": { + "type": "string" + }, + "type": "array", + "title": "manifests", + "description": "A list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.\n", + "markdownDescription": "A list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.", + "x-intellij-html-description": "\u003cp\u003eA list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExtraHost": { + "properties": { + "ip": { + "type": "string", + "title": "ip", + "description": "The IP of the host.\n", + "markdownDescription": "The IP of the host.", + "x-intellij-html-description": "\u003cp\u003eThe IP of the host.\u003c/p\u003e\n" + }, + "aliases": { + "items": { + "type": "string" + }, + "type": "array", + "title": "aliases", + "description": "The host alias.\n", + "markdownDescription": "The host alias.", + "x-intellij-html-description": "\u003cp\u003eThe host alias.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExtraMount": { + "properties": {}, + "additionalProperties": false, + "type": "object" + }, + "FeaturesConfig": { + "properties": { + "rbac": { + "type": "boolean", + "title": "rbac", + "description": "Enable role-based access control (RBAC).\n", + "markdownDescription": "Enable role-based access control (RBAC).", + "x-intellij-html-description": "\u003cp\u003eEnable role-based access control (RBAC).\u003c/p\u003e\n" + }, + "stableHostname": { + "type": "boolean", + "title": "stableHostname", + "description": "Enable stable default hostname.\n", + "markdownDescription": "Enable stable default hostname.", + "x-intellij-html-description": "\u003cp\u003eEnable stable default hostname.\u003c/p\u003e\n" + }, + "kubernetesTalosAPIAccess": { + "$ref": "#/$defs/KubernetesTalosAPIAccessConfig", + "title": "kubernetesTalosAPIAccess", + "description": "Configure Talos API access from Kubernetes pods.\n\nThis feature is disabled if the feature config is not specified.\n", + "markdownDescription": "Configure Talos API access from Kubernetes pods.\n\nThis feature is disabled if the feature config is not specified.", + "x-intellij-html-description": "\u003cp\u003eConfigure Talos API access from Kubernetes pods.\u003c/p\u003e\n\n\u003cp\u003eThis feature is disabled if the feature config is not specified.\u003c/p\u003e\n" + }, + "apidCheckExtKeyUsage": { + "type": "boolean", + "title": "apidCheckExtKeyUsage", + "description": "Enable checks for extended key usage of client certificates in apid.\n", + "markdownDescription": "Enable checks for extended key usage of client certificates in apid.", + "x-intellij-html-description": "\u003cp\u003eEnable checks for extended key usage of client certificates in apid.\u003c/p\u003e\n" + }, + "diskQuotaSupport": { + "type": "boolean", + "title": "diskQuotaSupport", + "description": "Enable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.\n", + "markdownDescription": "Enable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.", + "x-intellij-html-description": "\u003cp\u003eEnable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.\u003c/p\u003e\n" + }, + "kubePrism": { + "$ref": "#/$defs/KubePrism", + "title": "kubePrism", + "description": "KubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.\n", + "markdownDescription": "KubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.", + "x-intellij-html-description": "\u003cp\u003eKubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "InstallConfig": { + "properties": { + "disk": { + "type": "string", + "title": "disk", + "description": "The disk used for installations.\n", + "markdownDescription": "The disk used for installations.", + "x-intellij-html-description": "\u003cp\u003eThe disk used for installations.\u003c/p\u003e\n" + }, + "diskSelector": { + "$ref": "#/$defs/InstallDiskSelector", + "title": "diskSelector", + "description": "Look up disk using disk attributes like model, size, serial and others.\nAlways has priority over disk.\n", + "markdownDescription": "Look up disk using disk attributes like model, size, serial and others.\nAlways has priority over `disk`.", + "x-intellij-html-description": "\u003cp\u003eLook up disk using disk attributes like model, size, serial and others.\nAlways has priority over \u003ccode\u003edisk\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraKernelArgs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "extraKernelArgs", + "description": "Allows for supplying extra kernel args via the bootloader.\n", + "markdownDescription": "Allows for supplying extra kernel args via the bootloader.", + "x-intellij-html-description": "\u003cp\u003eAllows for supplying extra kernel args via the bootloader.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "Allows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\nGitHub releases page.\n", + "markdownDescription": "Allows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\n[GitHub releases page](https://github.com/siderolabs/talos/releases).", + "x-intellij-html-description": "\u003cp\u003eAllows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\n\u003ca href=\"https://github.com/siderolabs/talos/releases\" target=\"_blank\"\u003eGitHub releases page\u003c/a\u003e.\u003c/p\u003e\n" + }, + "extensions": { + "items": { + "$ref": "#/$defs/InstallExtensionConfig" + }, + "type": "array", + "title": "extensions", + "description": "Allows for supplying additional system extension images to install on top of base Talos image.\n", + "markdownDescription": "Allows for supplying additional system extension images to install on top of base Talos image.", + "x-intellij-html-description": "\u003cp\u003eAllows for supplying additional system extension images to install on top of base Talos image.\u003c/p\u003e\n" + }, + "bootloader": { + "type": "boolean", + "title": "bootloader", + "description": "Indicates if a bootloader should be installed.\n", + "markdownDescription": "Indicates if a bootloader should be installed.", + "x-intellij-html-description": "\u003cp\u003eIndicates if a bootloader should be installed.\u003c/p\u003e\n" + }, + "wipe": { + "type": "boolean", + "title": "wipe", + "description": "Indicates if the installation disk should be wiped at installation time.\nDefaults to true.\n", + "markdownDescription": "Indicates if the installation disk should be wiped at installation time.\nDefaults to `true`.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the installation disk should be wiped at installation time.\nDefaults to \u003ccode\u003etrue\u003c/code\u003e.\u003c/p\u003e\n" + }, + "legacyBIOSSupport": { + "type": "boolean", + "title": "legacyBIOSSupport", + "description": "Indicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn’t support GPT partitioning scheme.\n", + "markdownDescription": "Indicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.", + "x-intellij-html-description": "\u003cp\u003eIndicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn\u0026rsquo;t support GPT partitioning scheme.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "InstallDiskSelector": { + "properties": { + "size": { + "type": "string", + "title": "size", + "description": "Disk size.\n", + "markdownDescription": "Disk size.", + "x-intellij-html-description": "\u003cp\u003eDisk size.\u003c/p\u003e\n" + }, + "name": { + "type": "string", + "title": "name", + "description": "Disk name /sys/block/\u0026lt;dev\u0026gt;/device/name.\n", + "markdownDescription": "Disk name `/sys/block/\u003cdev\u003e/device/name`.", + "x-intellij-html-description": "\u003cp\u003eDisk name \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/name\u003c/code\u003e.\u003c/p\u003e\n" + }, + "model": { + "type": "string", + "title": "model", + "description": "Disk model /sys/block/\u0026lt;dev\u0026gt;/device/model.\n", + "markdownDescription": "Disk model `/sys/block/\u003cdev\u003e/device/model`.", + "x-intellij-html-description": "\u003cp\u003eDisk model \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/model\u003c/code\u003e.\u003c/p\u003e\n" + }, + "serial": { + "type": "string", + "title": "serial", + "description": "Disk serial number /sys/block/\u0026lt;dev\u0026gt;/serial.\n", + "markdownDescription": "Disk serial number `/sys/block/\u003cdev\u003e/serial`.", + "x-intellij-html-description": "\u003cp\u003eDisk serial number \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/serial\u003c/code\u003e.\u003c/p\u003e\n" + }, + "modalias": { + "type": "string", + "title": "modalias", + "description": "Disk modalias /sys/block/\u0026lt;dev\u0026gt;/device/modalias.\n", + "markdownDescription": "Disk modalias `/sys/block/\u003cdev\u003e/device/modalias`.", + "x-intellij-html-description": "\u003cp\u003eDisk modalias \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/modalias\u003c/code\u003e.\u003c/p\u003e\n" + }, + "uuid": { + "type": "string", + "title": "uuid", + "description": "Disk UUID /sys/block/\u0026lt;dev\u0026gt;/uuid.\n", + "markdownDescription": "Disk UUID `/sys/block/\u003cdev\u003e/uuid`.", + "x-intellij-html-description": "\u003cp\u003eDisk UUID \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/uuid\u003c/code\u003e.\u003c/p\u003e\n" + }, + "wwid": { + "type": "string", + "title": "wwid", + "description": "Disk WWID /sys/block/\u0026lt;dev\u0026gt;/wwid.\n", + "markdownDescription": "Disk WWID `/sys/block/\u003cdev\u003e/wwid`.", + "x-intellij-html-description": "\u003cp\u003eDisk WWID \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/wwid\u003c/code\u003e.\u003c/p\u003e\n" + }, + "type": { + "enum": [ + "ssd", + "hdd", + "nvme", + "sd" + ], + "title": "type", + "description": "Disk Type.\n", + "markdownDescription": "Disk Type.", + "x-intellij-html-description": "\u003cp\u003eDisk Type.\u003c/p\u003e\n" + }, + "busPath": { + "type": "string", + "title": "busPath", + "description": "Disk bus path.\n", + "markdownDescription": "Disk bus path.", + "x-intellij-html-description": "\u003cp\u003eDisk bus path.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "InstallExtensionConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "System extension image.\n", + "markdownDescription": "System extension image.", + "x-intellij-html-description": "\u003cp\u003eSystem extension image.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KernelConfig": { + "properties": { + "modules": { + "items": { + "$ref": "#/$defs/KernelModuleConfig" + }, + "type": "array", + "title": "modules", + "description": "Kernel modules to load.\n", + "markdownDescription": "Kernel modules to load.", + "x-intellij-html-description": "\u003cp\u003eKernel modules to load.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KernelModuleConfig": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "Module name.\n", + "markdownDescription": "Module name.", + "x-intellij-html-description": "\u003cp\u003eModule name.\u003c/p\u003e\n" + }, + "parameters": { + "items": { + "type": "string" + }, + "type": "array", + "title": "parameters", + "description": "Module parameters, changes applied after reboot.\n", + "markdownDescription": "Module parameters, changes applied after reboot.", + "x-intellij-html-description": "\u003cp\u003eModule parameters, changes applied after reboot.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubePrism": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable KubePrism support - will start local load balacing proxy.\n", + "markdownDescription": "Enable KubePrism support - will start local load balacing proxy.", + "x-intellij-html-description": "\u003cp\u003eEnable KubePrism support - will start local load balacing proxy.\u003c/p\u003e\n" + }, + "port": { + "type": "integer", + "title": "port", + "description": "KubePrism port.\n", + "markdownDescription": "KubePrism port.", + "x-intellij-html-description": "\u003cp\u003eKubePrism port.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeSpanFilters": { + "properties": { + "endpoints": { + "items": { + "type": "string" + }, + "type": "array", + "title": "endpoints", + "description": "Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\n\nBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\n\nDefault value: no filtering.\n", + "markdownDescription": "Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\n\nBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\n\nDefault value: no filtering.", + "x-intellij-html-description": "\u003cp\u003eFilter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\u003c/p\u003e\n\n\u003cp\u003eBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\u003c/p\u003e\n\n\u003cp\u003eDefault value: no filtering.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeletConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The image field is an optional reference to an alternative kubelet image.\n", + "markdownDescription": "The `image` field is an optional reference to an alternative kubelet image.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an optional reference to an alternative kubelet image.\u003c/p\u003e\n" + }, + "clusterDNS": { + "items": { + "type": "string" + }, + "type": "array", + "title": "clusterDNS", + "description": "The ClusterDNS field is an optional reference to an alternative kubelet clusterDNS ip list.\n", + "markdownDescription": "The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eClusterDNS\u003c/code\u003e field is an optional reference to an alternative kubelet clusterDNS ip list.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "The extraArgs field is used to provide additional flags to the kubelet.\n", + "markdownDescription": "The `extraArgs` field is used to provide additional flags to the kubelet.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraArgs\u003c/code\u003e field is used to provide additional flags to the kubelet.\u003c/p\u003e\n" + }, + "extraMounts": { + "items": { + "$ref": "#/$defs/ExtraMount" + }, + "type": "array", + "title": "extraMounts", + "description": "The extraMounts field is used to add additional mounts to the kubelet container.\nNote that either bind or rbind are required in the options.\n", + "markdownDescription": "The `extraMounts` field is used to add additional mounts to the kubelet container.\nNote that either `bind` or `rbind` are required in the `options`.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraMounts\u003c/code\u003e field is used to add additional mounts to the kubelet container.\nNote that either \u003ccode\u003ebind\u003c/code\u003e or \u003ccode\u003erbind\u003c/code\u003e are required in the \u003ccode\u003eoptions\u003c/code\u003e.\u003c/p\u003e\n" + }, + "extraConfig": { + "type": "object", + "title": "extraConfig", + "description": "The extraConfig field is used to provide kubelet configuration overrides.\n\nSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.\n", + "markdownDescription": "The `extraConfig` field is used to provide kubelet configuration overrides.\n\nSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraConfig\u003c/code\u003e field is used to provide kubelet configuration overrides.\u003c/p\u003e\n\n\u003cp\u003eSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.\u003c/p\u003e\n" + }, + "defaultRuntimeSeccompProfileEnabled": { + "type": "boolean", + "title": "defaultRuntimeSeccompProfileEnabled", + "description": "Enable container runtime default Seccomp profile.\n", + "markdownDescription": "Enable container runtime default Seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eEnable container runtime default Seccomp profile.\u003c/p\u003e\n" + }, + "registerWithFQDN": { + "type": "boolean", + "title": "registerWithFQDN", + "description": "The registerWithFQDN field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.\n", + "markdownDescription": "The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eregisterWithFQDN\u003c/code\u003e field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.\u003c/p\u003e\n" + }, + "nodeIP": { + "$ref": "#/$defs/KubeletNodeIPConfig", + "title": "nodeIP", + "description": "The nodeIP field is used to configure --node-ip flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.\n", + "markdownDescription": "The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003enodeIP\u003c/code\u003e field is used to configure \u003ccode\u003e--node-ip\u003c/code\u003e flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.\u003c/p\u003e\n" + }, + "skipNodeRegistration": { + "type": "boolean", + "title": "skipNodeRegistration", + "description": "The skipNodeRegistration is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.\n", + "markdownDescription": "The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eskipNodeRegistration\u003c/code\u003e is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.\u003c/p\u003e\n" + }, + "disableManifestsDirectory": { + "type": "boolean", + "title": "disableManifestsDirectory", + "description": "The disableManifestsDirectory field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt’s recommended to configure static pods with the “pods” key instead.\n", + "markdownDescription": "The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt's recommended to configure static pods with the \"pods\" key instead.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003edisableManifestsDirectory\u003c/code\u003e field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt\u0026rsquo;s recommended to configure static pods with the \u0026ldquo;pods\u0026rdquo; key instead.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeletNodeIPConfig": { + "properties": { + "validSubnets": { + "items": { + "type": "string" + }, + "type": "array", + "title": "validSubnets", + "description": "The validSubnets field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.\n", + "markdownDescription": "The `validSubnets` field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003evalidSubnets\u003c/code\u003e field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubernetesTalosAPIAccessConfig": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable Talos API access from Kubernetes pods.\n", + "markdownDescription": "Enable Talos API access from Kubernetes pods.", + "x-intellij-html-description": "\u003cp\u003eEnable Talos API access from Kubernetes pods.\u003c/p\u003e\n" + }, + "allowedRoles": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedRoles", + "description": "The list of Talos API roles which can be granted for access from Kubernetes pods.\n\nEmpty list means that no roles can be granted, so access is blocked.\n", + "markdownDescription": "The list of Talos API roles which can be granted for access from Kubernetes pods.\n\nEmpty list means that no roles can be granted, so access is blocked.", + "x-intellij-html-description": "\u003cp\u003eThe list of Talos API roles which can be granted for access from Kubernetes pods.\u003c/p\u003e\n\n\u003cp\u003eEmpty list means that no roles can be granted, so access is blocked.\u003c/p\u003e\n" + }, + "allowedKubernetesNamespaces": { + "items": { + "type": "string" + }, + "type": "array", + "title": "allowedKubernetesNamespaces", + "description": "The list of Kubernetes namespaces Talos API access is available from.\n", + "markdownDescription": "The list of Kubernetes namespaces Talos API access is available from.", + "x-intellij-html-description": "\u003cp\u003eThe list of Kubernetes namespaces Talos API access is available from.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "LoggingConfig": { + "properties": { + "destinations": { + "items": { + "$ref": "#/$defs/LoggingDestination" + }, + "type": "array", + "title": "destinations", + "description": "Logging destination.\n", + "markdownDescription": "Logging destination.", + "x-intellij-html-description": "\u003cp\u003eLogging destination.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "LoggingDestination": { + "properties": { + "endpoint": { + "$ref": "#/$defs/Endpoint", + "title": "endpoint", + "description": "Where to send logs. Supported protocols are “tcp” and “udp”.\n", + "markdownDescription": "Where to send logs. Supported protocols are \"tcp\" and \"udp\".", + "x-intellij-html-description": "\u003cp\u003eWhere to send logs. Supported protocols are \u0026ldquo;tcp\u0026rdquo; and \u0026ldquo;udp\u0026rdquo;.\u003c/p\u003e\n" + }, + "format": { + "enum": [ + "json_lines" + ], + "title": "format", + "description": "Logs format.\n", + "markdownDescription": "Logs format.", + "x-intellij-html-description": "\u003cp\u003eLogs format.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineConfig": { + "properties": { + "type": { + "enum": [ + "controlplane", + "worker" + ], + "title": "type", + "description": "Defines the role of the machine within the cluster.\n\nControl Plane\n\nControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\n\nWorker\n\nWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\n\nThis node type was previously known as “join”; that value is still supported but deprecated.\n", + "markdownDescription": "Defines the role of the machine within the cluster.\n\n**Control Plane**\n\nControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\n\n**Worker**\n\nWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\n\nThis node type was previously known as \"join\"; that value is still supported but deprecated.", + "x-intellij-html-description": "\u003cp\u003eDefines the role of the machine within the cluster.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eControl Plane\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWorker\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\u003c/p\u003e\n\n\u003cp\u003eThis node type was previously known as \u0026ldquo;join\u0026rdquo;; that value is still supported but deprecated.\u003c/p\u003e\n" + }, + "token": { + "type": "string", + "title": "token", + "description": "The token is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity.\n", + "markdownDescription": "The `token` is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003etoken\u003c/code\u003e is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its\u0026rsquo; identity.\u003c/p\u003e\n" + }, + "ca": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "ca", + "description": "The root certificate authority of the PKI.\nIt is composed of a base64 encoded crt and key.\n", + "markdownDescription": "The root certificate authority of the PKI.\nIt is composed of a base64 encoded `crt` and `key`.", + "x-intellij-html-description": "\u003cp\u003eThe root certificate authority of the PKI.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e and \u003ccode\u003ekey\u003c/code\u003e.\u003c/p\u003e\n" + }, + "certSANs": { + "items": { + "type": "string" + }, + "type": "array", + "title": "certSANs", + "description": "Extra certificate subject alternative names for the machine’s certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate’s SANs.\n", + "markdownDescription": "Extra certificate subject alternative names for the machine's certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate's SANs.", + "x-intellij-html-description": "\u003cp\u003eExtra certificate subject alternative names for the machine\u0026rsquo;s certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate\u0026rsquo;s SANs.\u003c/p\u003e\n" + }, + "controlPlane": { + "$ref": "#/$defs/MachineControlPlaneConfig", + "title": "controlPlane", + "description": "Provides machine specific control plane configuration options.\n", + "markdownDescription": "Provides machine specific control plane configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific control plane configuration options.\u003c/p\u003e\n" + }, + "kubelet": { + "$ref": "#/$defs/KubeletConfig", + "title": "kubelet", + "description": "Used to provide additional options to the kubelet.\n", + "markdownDescription": "Used to provide additional options to the kubelet.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide additional options to the kubelet.\u003c/p\u003e\n" + }, + "pods": { + "items": { + "type": "object" + }, + "type": "array", + "title": "pods", + "description": "Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\nStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn’t validate the pod definition.\nUpdates to this field can be applied without a reboot.\n\nSee https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.\n", + "markdownDescription": "Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\nStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn't validate the pod definition.\nUpdates to this field can be applied without a reboot.\n\nSee https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\u003c/p\u003e\n\n\u003cp\u003eStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn\u0026rsquo;t validate the pod definition.\nUpdates to this field can be applied without a reboot.\u003c/p\u003e\n\n\u003cp\u003eSee \u003ca href=\"https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/\" target=\"_blank\"\u003ehttps://kubernetes.io/docs/tasks/configure-pod-container/static-pod/\u003c/a\u003e.\u003c/p\u003e\n" + }, + "network": { + "$ref": "#/$defs/NetworkConfig", + "title": "network", + "description": "Provides machine specific network configuration options.\n", + "markdownDescription": "Provides machine specific network configuration options.", + "x-intellij-html-description": "\u003cp\u003eProvides machine specific network configuration options.\u003c/p\u003e\n" + }, + "disks": { + "items": { + "$ref": "#/$defs/MachineDisk" + }, + "type": "array", + "title": "disks", + "description": "Used to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of /var, mounts are only valid if they are under /var.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf size: is omitted, the partition is sized to occupy the full disk.\n", + "markdownDescription": "Used to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf `size:` is omitted, the partition is sized to occupy the full disk.", + "x-intellij-html-description": "\u003cp\u003eUsed to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of \u003ccode\u003e/var\u003c/code\u003e, mounts are only valid if they are under \u003ccode\u003e/var\u003c/code\u003e.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf \u003ccode\u003esize:\u003c/code\u003e is omitted, the partition is sized to occupy the full disk.\u003c/p\u003e\n" + }, + "install": { + "$ref": "#/$defs/InstallConfig", + "title": "install", + "description": "Used to provide instructions for installations.\n\nNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.\n", + "markdownDescription": "Used to provide instructions for installations.\n\nNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.", + "x-intellij-html-description": "\u003cp\u003eUsed to provide instructions for installations.\u003c/p\u003e\n\n\u003cp\u003eNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.\u003c/p\u003e\n" + }, + "files": { + "items": { + "$ref": "#/$defs/MachineFile" + }, + "type": "array", + "title": "files", + "description": "Allows the addition of user specified files.\nThe value of op can be create, overwrite, or append.\nIn the case of create, path must not exist.\nIn the case of overwrite, and append, path must be a valid file.\nIf an op value of append is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.\n", + "markdownDescription": "Allows the addition of user specified files.\nThe value of `op` can be `create`, `overwrite`, or `append`.\nIn the case of `create`, `path` must not exist.\nIn the case of `overwrite`, and `append`, `path` must be a valid file.\nIf an `op` value of `append` is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.", + "x-intellij-html-description": "\u003cp\u003eAllows the addition of user specified files.\nThe value of \u003ccode\u003eop\u003c/code\u003e can be \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003eoverwrite\u003c/code\u003e, or \u003ccode\u003eappend\u003c/code\u003e.\nIn the case of \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e must not exist.\nIn the case of \u003ccode\u003eoverwrite\u003c/code\u003e, and \u003ccode\u003eappend\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e must be a valid file.\nIf an \u003ccode\u003eop\u003c/code\u003e value of \u003ccode\u003eappend\u003c/code\u003e is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.\u003c/p\u003e\n" + }, + "time": { + "$ref": "#/$defs/TimeConfig", + "title": "time", + "description": "Used to configure the machine’s time settings.\n", + "markdownDescription": "Used to configure the machine's time settings.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s time settings.\u003c/p\u003e\n" + }, + "sysctls": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "sysctls", + "description": "Used to configure the machine’s sysctls.\n", + "markdownDescription": "Used to configure the machine's sysctls.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s sysctls.\u003c/p\u003e\n" + }, + "sysfs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "sysfs", + "description": "Used to configure the machine’s sysfs.\n", + "markdownDescription": "Used to configure the machine's sysfs.", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s sysfs.\u003c/p\u003e\n" + }, + "registries": { + "$ref": "#/$defs/RegistriesConfig", + "title": "registries", + "description": "Used to configure the machine’s container image registry mirrors.\n\nAutomatically generates matching CRI configuration for registry mirrors.\n\nThe mirrors section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\n\nThe config section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in .docker/config.json.\n\nSee also matching configuration for CRI containerd plugin.\n", + "markdownDescription": "Used to configure the machine's container image registry mirrors.\n\nAutomatically generates matching CRI configuration for registry mirrors.\n\nThe `mirrors` section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\n\nThe `config` section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).\n\nSee also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md).", + "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s container image registry mirrors.\u003c/p\u003e\n\n\u003cp\u003eAutomatically generates matching CRI configuration for registry mirrors.\u003c/p\u003e\n\n\u003cp\u003eThe \u003ccode\u003emirrors\u003c/code\u003e section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\u003c/p\u003e\n\n\u003cp\u003eThe \u003ccode\u003econfig\u003c/code\u003e section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eSee also matching configuration for \u003ca href=\"https://github.com/containerd/cri/blob/master/docs/registry.md\" target=\"_blank\"\u003eCRI containerd plugin\u003c/a\u003e.\u003c/p\u003e\n" + }, + "systemDiskEncryption": { + "$ref": "#/$defs/SystemDiskEncryptionConfig", + "title": "systemDiskEncryption", + "description": "Machine system disk encryption configuration.\nDefines each system partition encryption parameters.\n", + "markdownDescription": "Machine system disk encryption configuration.\nDefines each system partition encryption parameters.", + "x-intellij-html-description": "\u003cp\u003eMachine system disk encryption configuration.\nDefines each system partition encryption parameters.\u003c/p\u003e\n" + }, + "features": { + "$ref": "#/$defs/FeaturesConfig", + "title": "features", + "description": "Features describe individual Talos features that can be switched on or off.\n", + "markdownDescription": "Features describe individual Talos features that can be switched on or off.", + "x-intellij-html-description": "\u003cp\u003eFeatures describe individual Talos features that can be switched on or off.\u003c/p\u003e\n" + }, + "udev": { + "$ref": "#/$defs/UdevConfig", + "title": "udev", + "description": "Configures the udev system.\n", + "markdownDescription": "Configures the udev system.", + "x-intellij-html-description": "\u003cp\u003eConfigures the udev system.\u003c/p\u003e\n" + }, + "logging": { + "$ref": "#/$defs/LoggingConfig", + "title": "logging", + "description": "Configures the logging system.\n", + "markdownDescription": "Configures the logging system.", + "x-intellij-html-description": "\u003cp\u003eConfigures the logging system.\u003c/p\u003e\n" + }, + "kernel": { + "$ref": "#/$defs/KernelConfig", + "title": "kernel", + "description": "Configures the kernel.\n", + "markdownDescription": "Configures the kernel.", + "x-intellij-html-description": "\u003cp\u003eConfigures the kernel.\u003c/p\u003e\n" + }, + "seccompProfiles": { + "items": { + "$ref": "#/$defs/MachineSeccompProfile" + }, + "type": "array", + "title": "seccompProfiles", + "description": "Configures the seccomp profiles for the machine.\n", + "markdownDescription": "Configures the seccomp profiles for the machine.", + "x-intellij-html-description": "\u003cp\u003eConfigures the seccomp profiles for the machine.\u003c/p\u003e\n" + }, + "nodeLabels": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "nodeLabels", + "description": "Configures the node labels for the machine.\n", + "markdownDescription": "Configures the node labels for the machine.", + "x-intellij-html-description": "\u003cp\u003eConfigures the node labels for the machine.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineControlPlaneConfig": { + "properties": { + "controllerManager": { + "$ref": "#/$defs/MachineControllerManagerConfig", + "title": "controllerManager", + "description": "Controller manager machine specific configuration options.\n", + "markdownDescription": "Controller manager machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eController manager machine specific configuration options.\u003c/p\u003e\n" + }, + "scheduler": { + "$ref": "#/$defs/MachineSchedulerConfig", + "title": "scheduler", + "description": "Scheduler machine specific configuration options.\n", + "markdownDescription": "Scheduler machine specific configuration options.", + "x-intellij-html-description": "\u003cp\u003eScheduler machine specific configuration options.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineControllerManagerConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-controller-manager on the node.\n", + "markdownDescription": "Disable kube-controller-manager on the node.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-controller-manager on the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineDisk": { + "properties": { + "device": { + "type": "string", + "title": "device", + "description": "The name of the disk to use.\n", + "markdownDescription": "The name of the disk to use.", + "x-intellij-html-description": "\u003cp\u003eThe name of the disk to use.\u003c/p\u003e\n" + }, + "partitions": { + "items": { + "$ref": "#/$defs/DiskPartition" + }, + "type": "array", + "title": "partitions", + "description": "A list of partitions to create on the disk.\n", + "markdownDescription": "A list of partitions to create on the disk.", + "x-intellij-html-description": "\u003cp\u003eA list of partitions to create on the disk.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineFile": { + "properties": { + "content": { + "type": "string", + "title": "content", + "description": "The contents of the file.\n", + "markdownDescription": "The contents of the file.", + "x-intellij-html-description": "\u003cp\u003eThe contents of the file.\u003c/p\u003e\n" + }, + "permissions": { + "type": "integer", + "title": "permissions", + "description": "The file’s permissions in octal.\n", + "markdownDescription": "The file's permissions in octal.", + "x-intellij-html-description": "\u003cp\u003eThe file\u0026rsquo;s permissions in octal.\u003c/p\u003e\n" + }, + "path": { + "type": "string", + "title": "path", + "description": "The path of the file.\n", + "markdownDescription": "The path of the file.", + "x-intellij-html-description": "\u003cp\u003eThe path of the file.\u003c/p\u003e\n" + }, + "op": { + "enum": [ + "create", + "append", + "overwrite" + ], + "title": "op", + "description": "The operation to use\n", + "markdownDescription": "The operation to use", + "x-intellij-html-description": "\u003cp\u003eThe operation to use\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineSchedulerConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-scheduler on the node.\n", + "markdownDescription": "Disable kube-scheduler on the node.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-scheduler on the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "MachineSeccompProfile": { + "properties": { + "name": { + "type": "string", + "title": "name", + "description": "The name field is used to provide the file name of the seccomp profile.\n", + "markdownDescription": "The `name` field is used to provide the file name of the seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003ename\u003c/code\u003e field is used to provide the file name of the seccomp profile.\u003c/p\u003e\n" + }, + "value": { + "type": "object", + "title": "value", + "description": "The value field is used to provide the seccomp profile.\n", + "markdownDescription": "The `value` field is used to provide the seccomp profile.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003evalue\u003c/code\u003e field is used to provide the seccomp profile.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkConfig": { + "properties": { + "hostname": { + "type": "string", + "title": "hostname", + "description": "Used to statically set the hostname for the machine.\n", + "markdownDescription": "Used to statically set the hostname for the machine.", + "x-intellij-html-description": "\u003cp\u003eUsed to statically set the hostname for the machine.\u003c/p\u003e\n" + }, + "interfaces": { + "items": { + "$ref": "#/$defs/Device" + }, + "type": "array", + "title": "interfaces", + "description": "interfaces is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.\n", + "markdownDescription": "`interfaces` is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.", + "x-intellij-html-description": "\u003cp\u003e\u003ccode\u003einterfaces\u003c/code\u003e is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.\u003c/p\u003e\n" + }, + "nameservers": { + "items": { + "type": "string" + }, + "type": "array", + "title": "nameservers", + "description": "Used to statically set the nameservers for the machine.\nDefaults to 1.1.1.1 and 8.8.8.8\n", + "markdownDescription": "Used to statically set the nameservers for the machine.\nDefaults to `1.1.1.1` and `8.8.8.8`", + "x-intellij-html-description": "\u003cp\u003eUsed to statically set the nameservers for the machine.\nDefaults to \u003ccode\u003e1.1.1.1\u003c/code\u003e and \u003ccode\u003e8.8.8.8\u003c/code\u003e\u003c/p\u003e\n" + }, + "extraHostEntries": { + "items": { + "$ref": "#/$defs/ExtraHost" + }, + "type": "array", + "title": "extraHostEntries", + "description": "Allows for extra entries to be added to the /etc/hosts file\n", + "markdownDescription": "Allows for extra entries to be added to the `/etc/hosts` file", + "x-intellij-html-description": "\u003cp\u003eAllows for extra entries to be added to the \u003ccode\u003e/etc/hosts\u003c/code\u003e file\u003c/p\u003e\n" + }, + "kubespan": { + "$ref": "#/$defs/NetworkKubeSpan", + "title": "kubespan", + "description": "Configures KubeSpan feature.\n", + "markdownDescription": "Configures KubeSpan feature.", + "x-intellij-html-description": "\u003cp\u003eConfigures KubeSpan feature.\u003c/p\u003e\n" + }, + "disableSearchDomain": { + "type": "boolean", + "title": "disableSearchDomain", + "description": "Disable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to false.\n", + "markdownDescription": "Disable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to `false`.", + "x-intellij-html-description": "\u003cp\u003eDisable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkDeviceSelector": { + "properties": { + "busPath": { + "type": "string", + "title": "busPath", + "description": "PCI, USB bus prefix, supports matching by wildcard.\n", + "markdownDescription": "PCI, USB bus prefix, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003ePCI, USB bus prefix, supports matching by wildcard.\u003c/p\u003e\n" + }, + "hardwareAddr": { + "type": "string", + "title": "hardwareAddr", + "description": "Device hardware address, supports matching by wildcard.\n", + "markdownDescription": "Device hardware address, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003eDevice hardware address, supports matching by wildcard.\u003c/p\u003e\n" + }, + "pciID": { + "type": "string", + "title": "pciID", + "description": "PCI ID (vendor ID, product ID), supports matching by wildcard.\n", + "markdownDescription": "PCI ID (vendor ID, product ID), supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003ePCI ID (vendor ID, product ID), supports matching by wildcard.\u003c/p\u003e\n" + }, + "driver": { + "type": "string", + "title": "driver", + "description": "Kernel driver, supports matching by wildcard.\n", + "markdownDescription": "Kernel driver, supports matching by wildcard.", + "x-intellij-html-description": "\u003cp\u003eKernel driver, supports matching by wildcard.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkKubeSpan": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Enable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.\n", + "markdownDescription": "Enable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.", + "x-intellij-html-description": "\u003cp\u003eEnable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.\u003c/p\u003e\n" + }, + "advertiseKubernetesNetworks": { + "type": "boolean", + "title": "advertiseKubernetesNetworks", + "description": "Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.\n", + "markdownDescription": "Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.", + "x-intellij-html-description": "\u003cp\u003eControl whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.\u003c/p\u003e\n" + }, + "allowDownPeerBypass": { + "type": "boolean", + "title": "allowDownPeerBypass", + "description": "Skip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can’t be established.\n", + "markdownDescription": "Skip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can't be established.", + "x-intellij-html-description": "\u003cp\u003eSkip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can\u0026rsquo;t be established.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "KubeSpan link MTU size.\nDefault value is 1420.\n", + "markdownDescription": "KubeSpan link MTU size.\nDefault value is 1420.", + "x-intellij-html-description": "\u003cp\u003eKubeSpan link MTU size.\nDefault value is 1420.\u003c/p\u003e\n" + }, + "filters": { + "$ref": "#/$defs/KubeSpanFilters", + "title": "filters", + "description": "KubeSpan advanced filtering of network addresses .\n\nSettings in this section are optional, and settings apply only to the node.\n", + "markdownDescription": "KubeSpan advanced filtering of network addresses .\n\nSettings in this section are optional, and settings apply only to the node.", + "x-intellij-html-description": "\u003cp\u003eKubeSpan advanced filtering of network addresses .\u003c/p\u003e\n\n\u003cp\u003eSettings in this section are optional, and settings apply only to the node.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "PodCheckpointer": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The image field is an override to the default pod-checkpointer image.\n", + "markdownDescription": "The `image` field is an override to the default pod-checkpointer image.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an override to the default pod-checkpointer image.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ProxyConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable kube-proxy deployment on cluster bootstrap.\n", + "markdownDescription": "Disable kube-proxy deployment on cluster bootstrap.", + "x-intellij-html-description": "\u003cp\u003eDisable kube-proxy deployment on cluster bootstrap.\u003c/p\u003e\n" + }, + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the kube-proxy manifest.\n", + "markdownDescription": "The container image used in the kube-proxy manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the kube-proxy manifest.\u003c/p\u003e\n" + }, + "mode": { + "type": "string", + "title": "mode", + "description": "proxy mode of kube-proxy.\nThe default is ‘iptables’.\n", + "markdownDescription": "proxy mode of kube-proxy.\nThe default is 'iptables'.", + "x-intellij-html-description": "\u003cp\u003eproxy mode of kube-proxy.\nThe default is \u0026lsquo;iptables\u0026rsquo;.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to kube-proxy.\n", + "markdownDescription": "Extra arguments to supply to kube-proxy.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to kube-proxy.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistriesConfig": { + "properties": { + "mirrors": { + "patternProperties": { + ".*": { + "$ref": "#/$defs/RegistryMirrorConfig" + } + }, + "type": "object", + "title": "mirrors", + "description": "Specifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\n\nFor example, when pulling an image with the reference example.com:123/image:v1,\nthe example.com:123 key will be used to lookup the mirror configuration.\n\nOptionally the * key can be used to configure a fallback mirror.\n\nRegistry name is the first segment of image identifier, with ‘docker.io’\nbeing default one.\n", + "markdownDescription": "Specifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\n\nFor example, when pulling an image with the reference `example.com:123/image:v1`,\nthe `example.com:123` key will be used to lookup the mirror configuration.\n\nOptionally the `*` key can be used to configure a fallback mirror.\n\nRegistry name is the first segment of image identifier, with 'docker.io'\nbeing default one.", + "x-intellij-html-description": "\u003cp\u003eSpecifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\u003c/p\u003e\n\n\u003cp\u003eFor example, when pulling an image with the reference \u003ccode\u003eexample.com:123/image:v1\u003c/code\u003e,\nthe \u003ccode\u003eexample.com:123\u003c/code\u003e key will be used to lookup the mirror configuration.\u003c/p\u003e\n\n\u003cp\u003eOptionally the \u003ccode\u003e*\u003c/code\u003e key can be used to configure a fallback mirror.\u003c/p\u003e\n\n\u003cp\u003eRegistry name is the first segment of image identifier, with \u0026lsquo;docker.io\u0026rsquo;\nbeing default one.\u003c/p\u003e\n" + }, + "config": { + "patternProperties": { + ".*": { + "$ref": "#/$defs/RegistryConfig" + } + }, + "type": "object", + "title": "config", + "description": "Specifies TLS \u0026amp; auth configuration for HTTPS image registries.\nMutual TLS can be enabled with ‘clientIdentity’ option.\n\nThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key * can’t be used for TLS configuration.\n\nTLS configuration can be skipped if registry has trusted\nserver certificate.\n", + "markdownDescription": "Specifies TLS \u0026 auth configuration for HTTPS image registries.\nMutual TLS can be enabled with 'clientIdentity' option.\n\nThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key `*` can't be used for TLS configuration.\n\nTLS configuration can be skipped if registry has trusted\nserver certificate.", + "x-intellij-html-description": "\u003cp\u003eSpecifies TLS \u0026amp; auth configuration for HTTPS image registries.\nMutual TLS can be enabled with \u0026lsquo;clientIdentity\u0026rsquo; option.\u003c/p\u003e\n\n\u003cp\u003eThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key \u003ccode\u003e*\u003c/code\u003e can\u0026rsquo;t be used for TLS configuration.\u003c/p\u003e\n\n\u003cp\u003eTLS configuration can be skipped if registry has trusted\nserver certificate.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryAuthConfig": { + "properties": { + "username": { + "type": "string", + "title": "username", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "password": { + "type": "string", + "title": "password", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "auth": { + "type": "string", + "title": "auth", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + }, + "identityToken": { + "type": "string", + "title": "identityToken", + "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n", + "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).", + "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryConfig": { + "properties": { + "tls": { + "$ref": "#/$defs/RegistryTLSConfig", + "title": "tls", + "description": "The TLS configuration for the registry.\n", + "markdownDescription": "The TLS configuration for the registry.", + "x-intellij-html-description": "\u003cp\u003eThe TLS configuration for the registry.\u003c/p\u003e\n" + }, + "auth": { + "$ref": "#/$defs/RegistryAuthConfig", + "title": "auth", + "description": "The auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.\n", + "markdownDescription": "The auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.", + "x-intellij-html-description": "\u003cp\u003eThe auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryKubernetesConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable Kubernetes discovery registry.\n", + "markdownDescription": "Disable Kubernetes discovery registry.", + "x-intellij-html-description": "\u003cp\u003eDisable Kubernetes discovery registry.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryMirrorConfig": { + "properties": { + "endpoints": { + "items": { + "type": "string" + }, + "type": "array", + "title": "endpoints", + "description": "List of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to /v2).\n", + "markdownDescription": "List of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to `/v2`).", + "x-intellij-html-description": "\u003cp\u003eList of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to \u003ccode\u003e/v2\u003c/code\u003e).\u003c/p\u003e\n" + }, + "overridePath": { + "type": "boolean", + "title": "overridePath", + "description": "Use the exact path specified for the endpoint (don’t append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.\n", + "markdownDescription": "Use the exact path specified for the endpoint (don't append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.", + "x-intellij-html-description": "\u003cp\u003eUse the exact path specified for the endpoint (don\u0026rsquo;t append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryServiceConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Disable external service discovery registry.\n", + "markdownDescription": "Disable external service discovery registry.", + "x-intellij-html-description": "\u003cp\u003eDisable external service discovery registry.\u003c/p\u003e\n" + }, + "endpoint": { + "type": "string", + "title": "endpoint", + "description": "External service endpoint.\n", + "markdownDescription": "External service endpoint.", + "x-intellij-html-description": "\u003cp\u003eExternal service endpoint.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RegistryTLSConfig": { + "properties": { + "clientIdentity": { + "properties": { + "crt": { + "type": "string" + }, + "key": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "clientIdentity", + "description": "Enable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.\n", + "markdownDescription": "Enable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.", + "x-intellij-html-description": "\u003cp\u003eEnable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.\u003c/p\u003e\n" + }, + "ca": { + "type": "string", + "title": "ca", + "description": "CA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.\n", + "markdownDescription": "CA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.", + "x-intellij-html-description": "\u003cp\u003eCA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.\u003c/p\u003e\n" + }, + "insecureSkipVerify": { + "type": "boolean", + "title": "insecureSkipVerify", + "description": "Skip TLS server certificate verification (not recommended).\n", + "markdownDescription": "Skip TLS server certificate verification (not recommended).", + "x-intellij-html-description": "\u003cp\u003eSkip TLS server certificate verification (not recommended).\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ResourcesConfig": { + "properties": { + "requests": { + "$ref": "#/$defs/Unstructured", + "title": "requests", + "description": "Requests configures the reserved cpu/memory resources.\n", + "markdownDescription": "Requests configures the reserved cpu/memory resources.", + "x-intellij-html-description": "\u003cp\u003eRequests configures the reserved cpu/memory resources.\u003c/p\u003e\n" + }, + "limits": { + "$ref": "#/$defs/Unstructured", + "title": "limits", + "description": "Limits configures the maximum cpu/memory resources a container can use.\n", + "markdownDescription": "Limits configures the maximum cpu/memory resources a container can use.", + "x-intellij-html-description": "\u003cp\u003eLimits configures the maximum cpu/memory resources a container can use.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Route": { + "properties": { + "network": { + "type": "string", + "title": "network", + "description": "The route’s network (destination).\n", + "markdownDescription": "The route's network (destination).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s network (destination).\u003c/p\u003e\n" + }, + "gateway": { + "type": "string", + "title": "gateway", + "description": "The route’s gateway (if empty, creates link scope route).\n", + "markdownDescription": "The route's gateway (if empty, creates link scope route).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s gateway (if empty, creates link scope route).\u003c/p\u003e\n" + }, + "source": { + "type": "string", + "title": "source", + "description": "The route’s source address (optional).\n", + "markdownDescription": "The route's source address (optional).", + "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s source address (optional).\u003c/p\u003e\n" + }, + "metric": { + "type": "integer", + "title": "metric", + "description": "The optional metric for the route.\n", + "markdownDescription": "The optional metric for the route.", + "x-intellij-html-description": "\u003cp\u003eThe optional metric for the route.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The optional MTU for the route.\n", + "markdownDescription": "The optional MTU for the route.", + "x-intellij-html-description": "\u003cp\u003eThe optional MTU for the route.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "STP": { + "properties": { + "enabled": { + "type": "boolean", + "title": "enabled", + "description": "Whether Spanning Tree Protocol (STP) is enabled.\n", + "markdownDescription": "Whether Spanning Tree Protocol (STP) is enabled.", + "x-intellij-html-description": "\u003cp\u003eWhether Spanning Tree Protocol (STP) is enabled.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "SchedulerConfig": { + "properties": { + "image": { + "type": "string", + "title": "image", + "description": "The container image used in the scheduler manifest.\n", + "markdownDescription": "The container image used in the scheduler manifest.", + "x-intellij-html-description": "\u003cp\u003eThe container image used in the scheduler manifest.\u003c/p\u003e\n" + }, + "extraArgs": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "extraArgs", + "description": "Extra arguments to supply to the scheduler.\n", + "markdownDescription": "Extra arguments to supply to the scheduler.", + "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the scheduler.\u003c/p\u003e\n" + }, + "extraVolumes": { + "items": { + "$ref": "#/$defs/VolumeMountConfig" + }, + "type": "array", + "title": "extraVolumes", + "description": "Extra volumes to mount to the scheduler static pod.\n", + "markdownDescription": "Extra volumes to mount to the scheduler static pod.", + "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the scheduler static pod.\u003c/p\u003e\n" + }, + "env": { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object", + "title": "env", + "description": "The env field allows for the addition of environment variables for the control plane component.\n", + "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.", + "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n" + }, + "resources": { + "type": "object", + "title": "resources", + "description": "Configure the scheduler resources.\n", + "markdownDescription": "Configure the scheduler resources.", + "x-intellij-html-description": "\u003cp\u003eConfigure the scheduler resources.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "SystemDiskEncryptionConfig": { + "properties": { + "state": { + "$ref": "#/$defs/EncryptionConfig", + "title": "state", + "description": "State partition encryption.\n", + "markdownDescription": "State partition encryption.", + "x-intellij-html-description": "\u003cp\u003eState partition encryption.\u003c/p\u003e\n" + }, + "ephemeral": { + "$ref": "#/$defs/EncryptionConfig", + "title": "ephemeral", + "description": "Ephemeral partition encryption.\n", + "markdownDescription": "Ephemeral partition encryption.", + "x-intellij-html-description": "\u003cp\u003eEphemeral partition encryption.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "TimeConfig": { + "properties": { + "disabled": { + "type": "boolean", + "title": "disabled", + "description": "Indicates if the time service is disabled for the machine.\nDefaults to false.\n", + "markdownDescription": "Indicates if the time service is disabled for the machine.\nDefaults to `false`.", + "x-intellij-html-description": "\u003cp\u003eIndicates if the time service is disabled for the machine.\nDefaults to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n" + }, + "servers": { + "items": { + "type": "string" + }, + "type": "array", + "title": "servers", + "description": "Specifies time (NTP) servers to use for setting the system time.\nDefaults to pool.ntp.org\n", + "markdownDescription": "Specifies time (NTP) servers to use for setting the system time.\nDefaults to `pool.ntp.org`", + "x-intellij-html-description": "\u003cp\u003eSpecifies time (NTP) servers to use for setting the system time.\nDefaults to \u003ccode\u003epool.ntp.org\u003c/code\u003e\u003c/p\u003e\n" + }, + "bootTimeout": { + "type": "string", + "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$", + "title": "bootTimeout", + "description": "Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to “infinity” (waiting forever for time sync)\n", + "markdownDescription": "Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to \"infinity\" (waiting forever for time sync)", + "x-intellij-html-description": "\u003cp\u003eSpecifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to \u0026ldquo;infinity\u0026rdquo; (waiting forever for time sync)\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "UdevConfig": { + "properties": { + "rules": { + "items": { + "type": "string" + }, + "type": "array", + "title": "rules", + "description": "List of udev rules to apply to the udev system\n", + "markdownDescription": "List of udev rules to apply to the udev system", + "x-intellij-html-description": "\u003cp\u003eList of udev rules to apply to the udev system\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "VIPEquinixMetalConfig": { + "properties": { + "apiToken": { + "type": "string", + "title": "apiToken", + "description": "Specifies the Equinix Metal API Token.\n", + "markdownDescription": "Specifies the Equinix Metal API Token.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Equinix Metal API Token.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "VIPHCloudConfig": { + "properties": { + "apiToken": { + "type": "string", + "title": "apiToken", + "description": "Specifies the Hetzner Cloud API Token.\n", + "markdownDescription": "Specifies the Hetzner Cloud API Token.", + "x-intellij-html-description": "\u003cp\u003eSpecifies the Hetzner Cloud API Token.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Vlan": { + "properties": { + "addresses": { + "items": { + "type": "string" + }, + "type": "array", + "title": "addresses", + "description": "The addresses in CIDR notation or as plain IPs to use.\n", + "markdownDescription": "The addresses in CIDR notation or as plain IPs to use.", + "x-intellij-html-description": "\u003cp\u003eThe addresses in CIDR notation or as plain IPs to use.\u003c/p\u003e\n" + }, + "routes": { + "items": { + "$ref": "#/$defs/Route" + }, + "type": "array", + "title": "routes", + "description": "A list of routes associated with the VLAN.\n", + "markdownDescription": "A list of routes associated with the VLAN.", + "x-intellij-html-description": "\u003cp\u003eA list of routes associated with the VLAN.\u003c/p\u003e\n" + }, + "dhcp": { + "type": "boolean", + "title": "dhcp", + "description": "Indicates if DHCP should be used.\n", + "markdownDescription": "Indicates if DHCP should be used.", + "x-intellij-html-description": "\u003cp\u003eIndicates if DHCP should be used.\u003c/p\u003e\n" + }, + "vlanId": { + "type": "integer", + "title": "vlanId", + "description": "The VLAN’s ID.\n", + "markdownDescription": "The VLAN's ID.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s ID.\u003c/p\u003e\n" + }, + "mtu": { + "type": "integer", + "title": "mtu", + "description": "The VLAN’s MTU.\n", + "markdownDescription": "The VLAN's MTU.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s MTU.\u003c/p\u003e\n" + }, + "vip": { + "$ref": "#/$defs/DeviceVIPConfig", + "title": "vip", + "description": "The VLAN’s virtual IP address configuration.\n", + "markdownDescription": "The VLAN's virtual IP address configuration.", + "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s virtual IP address configuration.\u003c/p\u003e\n" + }, + "dhcpOptions": { + "$ref": "#/$defs/DHCPOptions", + "title": "dhcpOptions", + "description": "DHCP specific options.\ndhcp must be set to true for these to take effect.\n", + "markdownDescription": "DHCP specific options.\n`dhcp` *must* be set to true for these to take effect.", + "x-intellij-html-description": "\u003cp\u003eDHCP specific options.\n\u003ccode\u003edhcp\u003c/code\u003e \u003cem\u003emust\u003c/em\u003e be set to true for these to take effect.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + }, + "VolumeMountConfig": { + "properties": { + "hostPath": { + "type": "string", + "title": "hostPath", + "description": "Path on the host.\n", + "markdownDescription": "Path on the host.", + "x-intellij-html-description": "\u003cp\u003ePath on the host.\u003c/p\u003e\n" + }, + "mountPath": { + "type": "string", + "title": "mountPath", + "description": "Path in the container.\n", + "markdownDescription": "Path in the container.", + "x-intellij-html-description": "\u003cp\u003ePath in the container.\u003c/p\u003e\n" + }, + "readonly": { + "type": "boolean", + "title": "readonly", + "description": "Mount the volume read only.\n", + "markdownDescription": "Mount the volume read only.", + "x-intellij-html-description": "\u003cp\u003eMount the volume read only.\u003c/p\u003e\n" + } + }, + "additionalProperties": false, + "type": "object" + } + } +} \ No newline at end of file diff --git a/website/content/v1.6/talos-guides/_index.md b/website/content/v1.6/talos-guides/_index.md new file mode 100644 index 0000000000..1596f85666 --- /dev/null +++ b/website/content/v1.6/talos-guides/_index.md @@ -0,0 +1,5 @@ +--- +title: Talos Linux Guides +weight: 20 +description: "Documentation on how to manage Talos Linux" +--- diff --git a/website/content/v1.6/talos-guides/configuration/_index.md b/website/content/v1.6/talos-guides/configuration/_index.md new file mode 100644 index 0000000000..a3ced180ef --- /dev/null +++ b/website/content/v1.6/talos-guides/configuration/_index.md @@ -0,0 +1,5 @@ +--- +title: "Configuration" +weight: 20 +description: "Guides on how to configure Talos Linux machines" +--- diff --git a/website/content/v1.6/talos-guides/configuration/certificate-authorities.md b/website/content/v1.6/talos-guides/configuration/certificate-authorities.md new file mode 100644 index 0000000000..7af72aa464 --- /dev/null +++ b/website/content/v1.6/talos-guides/configuration/certificate-authorities.md @@ -0,0 +1,23 @@ +--- +title: "Custom Certificate Authorities" +description: "How to supply custom certificate authorities" +aliases: + - ../../guides/configuring-certificate-authorities +--- + +## Appending the Certificate Authority + +Put into each machine the PEM encoded certificate: + +```yaml +machine: + ... + files: + - content: | + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + permissions: 0644 + path: /etc/ssl/certs/ca-certificates + op: append +``` diff --git a/website/content/v1.6/talos-guides/configuration/containerd.md b/website/content/v1.6/talos-guides/configuration/containerd.md new file mode 100644 index 0000000000..cf4fbf747c --- /dev/null +++ b/website/content/v1.6/talos-guides/configuration/containerd.md @@ -0,0 +1,65 @@ +--- +title: "Containerd" +description: "Customize Containerd Settings" +aliases: + - ../../guides/configuring-containerd +--- + +The base containerd configuration expects to merge in any additional configs present in `/etc/cri/conf.d/20-customization.part`. + +## Examples + +### Exposing Metrics + +Patch the machine config by adding the following: + +```yaml +machine: + files: + - content: | + [metrics] + address = "0.0.0.0:11234" + path: /etc/cri/conf.d/20-customization.part + op: create +``` + +Once the server reboots, metrics are now available: + +```bash +$ curl ${IP}:11234/v1/metrics +# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive +# TYPE container_blkio_io_service_bytes_recursive_bytes gauge +container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 +container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 +... +... +``` + +### Pause Image + +This change is often required for air-gapped environments, as `containerd` CRI plugin has a reference to the `pause` image which is used +to create pods, and it can't be controlled with Kubernetes pod definitions. + +```yaml +machine: + files: + - content: | + [plugins] + [plugins."io.containerd.grpc.v1.cri"] + sandbox_image = "registry.k8s.io/pause:3.8" + path: /etc/cri/conf.d/20-customization.part + op: create +``` + +Now the `pause` image is set to `registry.k8s.io/pause:3.8`: + +```bash +$ talosctl containers --kubernetes +NODE NAMESPACE ID IMAGE PID STATUS +172.20.0.5 k8s.io kube-system/kube-flannel-6hfck registry.k8s.io/pause:3.8 1773 SANDBOX_READY +172.20.0.5 k8s.io └─ kube-system/kube-flannel-6hfck:install-cni:bc39fec3cbac ghcr.io/siderolabs/install-cni:v1.3.0-alpha.0-2-gb155fa0 0 CONTAINER_EXITED +172.20.0.5 k8s.io └─ kube-system/kube-flannel-6hfck:install-config:5c3989353b98 ghcr.io/siderolabs/flannel:v0.20.1 0 CONTAINER_EXITED +172.20.0.5 k8s.io └─ kube-system/kube-flannel-6hfck:kube-flannel:116c67b50da8 ghcr.io/siderolabs/flannel:v0.20.1 2092 CONTAINER_RUNNING +172.20.0.5 k8s.io kube-system/kube-proxy-xp7jq registry.k8s.io/pause:3.8 1780 SANDBOX_READY +172.20.0.5 k8s.io └─ kube-system/kube-proxy-xp7jq:kube-proxy:84fc77c59e17 registry.k8s.io/kube-proxy:v1.26.0-alpha.3 1843 CONTAINER_RUNNING +``` diff --git a/website/content/v1.6/talos-guides/configuration/disk-encryption.md b/website/content/v1.6/talos-guides/configuration/disk-encryption.md new file mode 100644 index 0000000000..38530db881 --- /dev/null +++ b/website/content/v1.6/talos-guides/configuration/disk-encryption.md @@ -0,0 +1,188 @@ +--- +title: "Disk Encryption" +description: "Guide on using system disk encryption" +aliases: + - ../../guides/disk-encryption +--- + +It is possible to enable encryption for system disks at the OS level. +Currently, only [STATE]({{< relref "../../learn-more/architecture/#file-system-partitions" >}}) and [EPHEMERAL]({{< relref "../../learn-more/architecture/#file-system-partitions" >}}) partitions can be encrypted. +STATE contains the most sensitive node data: secrets and certs. +The EPHEMERAL partition may contain sensitive workload data. +Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. +The operating system will run additional setup steps when encryption is enabled. + +If the disk encryption is enabled for the STATE partition, the system will: + +- Save STATE encryption config as JSON in the META partition. +- Before mounting the STATE partition, load encryption configs either from the machine config or from the META partition. + Note that the machine config is always preferred over the META one. +- Before mounting the STATE partition, format and encrypt it. + This occurs only if the STATE partition is empty and has no filesystem. + +If the disk encryption is enabled for the EPHEMERAL partition, the system will: + +- Get the encryption config from the machine config. +- Before mounting the EPHEMERAL partition, encrypt and format it. + +This occurs only if the EPHEMERAL partition is empty and has no filesystem. + +> Note: Talos Linux disk encryption is designed to guard against data being leaked or recovered from a drive that has been removed from a Talos Linux node. +It uses the hardware characteristics of the machine in order to decrypt the data, so drives that have been removed, or recycled from a cloud environment or attached to a different virtual machine, will maintain their protection and encryption. +It is not designed to protect against attacks where physical access to the machine, including the drive, is available. + +## Configuration + +Disk encryption is disabled by default. +To enable disk encryption you should modify the machine configuration with the following options: + +```yaml +machine: + ... + systemDiskEncryption: + ephemeral: + provider: luks2 + keys: + - nodeID: {} + slot: 0 + state: + provider: luks2 + keys: + - nodeID: {} + slot: 0 +``` + +### Encryption Keys + +> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. +> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. + +LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. +Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. +So if you update the keys list, keep at least one key that is not changed to be used for key management. + +When you define a key you should specify the key kind and the `slot`: + +```yaml +machine: + ... + state: + keys: + - nodeID: {} # key kind + slot: 1 + + ephemeral: + keys: + - static: + passphrase: supersecret + slot: 0 +``` + +Take a note that key order does not play any role on which key slot is used. +Every key must always have a slot defined. + +### Encryption Key Kinds + +Talos supports two kinds of keys: + +- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). +- `static` which you define right in the configuration. + +> Note: Use static keys only if your STATE partition is encrypted and only for the EPHEMERAL partition. +> For the STATE partition it will be stored in the META partition, which is not encrypted. + +### Key Rotation + +In order to completely rotate keys, it is necessary to do `talosctl apply-config` a couple of times, since there is a need to always maintain a single working key while changing the other keys around it. + +So, for example, first add a new key: + +```yaml +machine: + ... + ephemeral: + keys: + - static: + passphrase: oldkey + slot: 0 + - static: + passphrase: newkey + slot: 1 + ... +``` + +Run: + +```bash +talosctl apply-config -n -f config.yaml +``` + +Then remove the old key: + +```yaml +machine: + ... + ephemeral: + keys: + - static: + passphrase: newkey + slot: 1 + ... +``` + +Run: + +```bash +talosctl apply-config -n -f config.yaml +``` + +## Going from Unencrypted to Encrypted and Vice Versa + +### Ephemeral Partition + +There is no in-place encryption support for the partitions right now, so to avoid losing data only empty partitions can be encrypted. + +As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. + +- `apply-config` should be called with `--mode=staged`. +- Partition should be wiped after `apply-config`, but before the reboot. + +Edit your machine config and add the encryption configuration: + +```bash +vim config.yaml +``` + +Apply the configuration with `--mode=staged`: + +```bash +talosctl apply-config -f config.yaml -n --mode=staged +``` + +Wipe the partition you're going to encrypt: + +```bash +talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true +``` + +That's it! +After you run the last command, the partition will be wiped and the node will reboot. +During the next boot the system will encrypt the partition. + +### State Partition + +Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. + +The flow should be to first wipe the STATE partition: + +```bash +talosctl reset --system-labels-to-wipe STATE -n --reboot=true +``` + +Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: + +```bash +talosctl apply-config --insecure -n -f config.yaml +``` + +After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v1.6/talos-guides/configuration/editing-machine-configuration.md b/website/content/v1.6/talos-guides/configuration/editing-machine-configuration.md new file mode 100644 index 0000000000..f68b2f7a07 --- /dev/null +++ b/website/content/v1.6/talos-guides/configuration/editing-machine-configuration.md @@ -0,0 +1,159 @@ +--- +title: "Editing Machine Configuration" +description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." +aliases: + - ../../guides/editing-machine-configuration +--- + +Talos node state is fully defined by [machine configuration]({{< relref "../../reference/configuration" >}}). +Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. + +> Note: Be sure that config is persisted so that configuration updates are not overwritten on reboots. +> Configuration persistence was enabled by default since Talos 0.5 (`persist: true` in machine configuration). + +There are three `talosctl` commands which facilitate machine configuration updates: + +* `talosctl apply-config` to apply configuration from the file +* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back +* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch + +Each of these commands can operate in one of four modes: + +* apply change in automatic mode(default): reboot if the change can't be applied without a reboot, otherwise apply the change immediately +* apply change with a reboot (`--mode=reboot`): update configuration, reboot Talos node to apply configuration change +* apply change immediately (`--mode=no-reboot` flag): change is applied immediately without a reboot, fails if the change contains any fields that can not be updated without a reboot +* apply change on next reboot (`--mode=staged`): change is staged to be applied after a reboot, but node is not rebooted +* apply change in the interactive mode (`--mode=interactive`; only for `talosctl apply-config`): launches TUI based interactive installer + +> Note: applying change on next reboot (`--mode=staged`) doesn't modify current node configuration, so next call to +> `talosctl edit machineconfig --mode=staged` will not see changes + +Additionally, there is also `talosctl get machineconfig`, which retrieves the current node configuration API resource and contains the machine configuration in the `.spec` field. +It can be used to modify the configuration locally before being applied to the node. + +The list of config changes allowed to be applied immediately in Talos {{< release >}}: + +* `.debug` +* `.cluster` +* `.machine.time` +* `.machine.certCANs` +* `.machine.install` (configuration is only applied during install/upgrade) +* `.machine.network` +* `.machine.nodeLabels` +* `.machine.sysfs` +* `.machine.sysctls` +* `.machine.logging` +* `.machine.controlplane` +* `.machine.kubelet` +* `.machine.pods` +* `.machine.kernel` +* `.machine.registries` (CRI containerd plugin will not pick up the registry authentication settings without a reboot) +* `.machine.features.kubernetesTalosAPIAccess` + +### `talosctl apply-config` + +This command is traditionally used to submit initial machine configuration generated by `talosctl gen config` to the node. + +It can also be used to apply configuration to running nodes. +The initial YAML for this is typically obtained using `talosctl get machineconfig -o yaml | yq eval .spec >machs.yaml`. +(We must use [`yq`](https://github.com/mikefarah/yq) because for historical reasons, `get` returns the configuration as a full resource, while `apply-config` only accepts the raw machine config directly.) + +Example: + +```bash +talosctl -n apply-config -f config.yaml +``` + +Command `apply-config` can also be invoked as `apply machineconfig`: + +```bash +talosctl -n apply machineconfig -f config.yaml +``` + +Applying machine configuration immediately (without a reboot): + +```bash +talosctl -n IP apply machineconfig -f config.yaml --mode=no-reboot +``` + +Starting the interactive installer: + +```bash +talosctl -n IP apply machineconfig --mode=interactive +``` + +> Note: when a Talos node is running in the maintenance mode it's necessary to provide `--insecure (-i)` flag to connect to the API and apply the config. + +### `taloctl edit machineconfig` + +Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. +If config hasn't been changed in the editor (or if updated config is empty), update is not applied. + +> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. +> If environment variables are missing, `vi` editor is used by default. + +Example: + +```bash +talosctl -n edit machineconfig +``` + +Configuration can be edited for multiple nodes if multiple IP addresses are specified: + +```bash +talosctl -n ,,... edit machineconfig +``` + +Applying machine configuration change immediately (without a reboot): + +```bash +talosctl -n edit machineconfig --mode=no-reboot +``` + +### `talosctl patch machineconfig` + +Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies a set of [JSON patches](http://jsonpatch.com/) to the configuration and writes the result back to the node. + +Example, updating kubelet version (in auto mode): + +```bash +$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/siderolabs/kubelet:v{{< k8s_release >}}"}]' +patched mc at the node +``` + +Updating kube-apiserver version in immediate mode (without a reboot): + +```bash +$ talosctl -n patch machineconfig --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "registry.k8s.io/kube-apiserver:v{{< k8s_release >}}"}]' +patched mc at the node +``` + +A patch might be applied to multiple nodes when multiple IPs are specified: + +```bash +talosctl -n ,,... patch machineconfig -p '[{...}]' +``` + +Patches can also be sourced from files using `@file` syntax: + +```bash +talosctl -n patch machineconfig -p @kubelet-patch.json -p @manifest-patch.json +``` + +It might be easier to store patches in YAML format vs. the default JSON format. +Talos can detect file format automatically: + +```yaml +# kubelet-patch.yaml +- op: replace + path: /machine/kubelet/image + value: ghcr.io/siderolabs/kubelet:v{{< k8s_release >}} +``` + +```bash +talosctl -n patch machineconfig -p @kubelet-patch.yaml +``` + +### Recovering from Node Boot Failures + +If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. diff --git a/website/content/v1.6/talos-guides/configuration/logging.md b/website/content/v1.6/talos-guides/configuration/logging.md new file mode 100644 index 0000000000..53a271b29c --- /dev/null +++ b/website/content/v1.6/talos-guides/configuration/logging.md @@ -0,0 +1,404 @@ +--- +title: "Logging" +description: "Dealing with Talos Linux logs." +aliases: + - ../../guiides/logging +--- + +## Viewing logs + +Kernel messages can be retrieved with `talosctl dmesg` command: + +```sh +$ talosctl -n 172.20.1.2 dmesg + +172.20.1.2: kern: info: [2021-11-10T10:09:37.662764956Z]: Command line: init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on ima_template=ima-ng ima_appraise=fix ima_hash=sha512 console=ttyS0 reboot=k panic=1 talos.shutdown=halt talos.platform=metal talos.config=http://172.20.1.1:40101/config.yaml +[...] +``` + +Service logs can be retrieved with `talosctl logs` command: + +```sh +$ talosctl -n 172.20.1.2 services + +NODE SERVICE STATE HEALTH LAST CHANGE LAST EVENT +172.20.1.2 apid Running OK 19m27s ago Health check successful +172.20.1.2 containerd Running OK 19m29s ago Health check successful +172.20.1.2 cri Running OK 19m27s ago Health check successful +172.20.1.2 etcd Running OK 19m22s ago Health check successful +172.20.1.2 kubelet Running OK 19m20s ago Health check successful +172.20.1.2 machined Running ? 19m30s ago Service started as goroutine +172.20.1.2 trustd Running OK 19m27s ago Health check successful +172.20.1.2 udevd Running OK 19m28s ago Health check successful + +$ talosctl -n 172.20.1.2 logs machined + +172.20.1.2: [talos] task setupLogger (1/1): done, 106.109µs +172.20.1.2: [talos] phase logger (1/7): done, 564.476µs +[...] +``` + +Container logs for Kubernetes pods can be retrieved with `talosctl logs -k` command: + +```sh +$ talosctl -n 172.20.1.2 containers -k +NODE NAMESPACE ID IMAGE PID STATUS +172.20.1.2 k8s.io kube-system/kube-flannel-dk6d5 registry.k8s.io/pause:3.6 1329 SANDBOX_READY +172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:install-cni:f1d4cf68feb9 ghcr.io/siderolabs/install-cni:v0.7.0-alpha.0-1-g2bb2efc 0 CONTAINER_EXITED +172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:install-config:bc39fec3cbac quay.io/coreos/flannel:v0.13.0 0 CONTAINER_EXITED +172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:kube-flannel:5c3989353b98 quay.io/coreos/flannel:v0.13.0 1610 CONTAINER_RUNNING +172.20.1.2 k8s.io kube-system/kube-proxy-gfkqj registry.k8s.io/pause:3.5 1311 SANDBOX_READY +172.20.1.2 k8s.io └─ kube-system/kube-proxy-gfkqj:kube-proxy:ad5e8ddc7e7f registry.k8s.io/kube-proxy:v{{< k8s_release >}} 1379 CONTAINER_RUNNING + +$ talosctl -n 172.20.1.2 logs -k kube-system/kube-proxy-gfkqj:kube-proxy:ad5e8ddc7e7f +172.20.1.2: 2021-11-30T19:13:20.567825192Z stderr F I1130 19:13:20.567737 1 server_others.go:138] "Detected node IP" address="172.20.0.3" +172.20.1.2: 2021-11-30T19:13:20.599684397Z stderr F I1130 19:13:20.599613 1 server_others.go:206] "Using iptables Proxier" +[...] +``` + +## Sending logs + +### Service logs + +You can enable logs sendings in machine configuration: + +```yaml +machine: + logging: + destinations: + - endpoint: "udp://127.0.0.1:12345/" + format: "json_lines" + - endpoint: "tcp://host:5044/" + format: "json_lines" +``` + +Several destinations can be specified. +Supported protocols are UDP and TCP. +The only currently supported format is `json_lines`: + +```json +{ + "msg": "[talos] apply config request: immediate true, on reboot false", + "talos-level": "info", + "talos-service": "machined", + "talos-time": "2021-11-10T10:48:49.294858021Z" +} +``` + +Messages are newline-separated when sent over TCP. +Over UDP messages are sent with one message per packet. +`msg`, `talos-level`, `talos-service`, and `talos-time` fields are always present; there may be additional fields. + +### Kernel logs + +Kernel log delivery can be enabled with the `talos.logging.kernel` kernel command line argument, which can be specified +in the `.machine.installer.extraKernelArgs`: + +```yaml +machine: + install: + extraKernelArgs: + - talos.logging.kernel=tcp://host:5044/ +``` + +Kernel log destination is specified in the same way as service log endpoint. +The only supported format is `json_lines`. + +Sample message: + +```json +{ + "clock":6252819, // time relative to the kernel boot time + "facility":"user", + "msg":"[talos] task startAllServices (1/1): waiting for 6 services\n", + "priority":"warning", + "seq":711, + "talos-level":"warn", // Talos-translated `priority` into common logging level + "talos-time":"2021-11-26T16:53:21.3258698Z" // Talos-translated `clock` using current time +} +``` + +> `extraKernelArgs` in the machine configuration are only applied on Talos upgrades, not just by applying the config. +> (Upgrading to the same version is fine). + +### Filebeat example + +To forward logs to other Log collection services, one way to do this is sending +them to a [Filebeat](https://www.elastic.co/beats/filebeat) running in the +cluster itself (in the host network), which takes care of forwarding it to +other endpoints (and the necessary transformations). + +If [Elastic Cloud on Kubernetes](https://www.elastic.co/elastic-cloud-kubernetes) +is being used, the following Beat (custom resource) configuration might be +helpful: + +```yaml +apiVersion: beat.k8s.elastic.co/v1beta1 +kind: Beat +metadata: + name: talos +spec: + type: filebeat + version: 7.15.1 + elasticsearchRef: + name: talos + config: + filebeat.inputs: + - type: "udp" + host: "127.0.0.1:12345" + processors: + - decode_json_fields: + fields: ["message"] + target: "" + - timestamp: + field: "talos-time" + layouts: + - "2006-01-02T15:04:05.999999999Z07:00" + - drop_fields: + fields: ["message", "talos-time"] + - rename: + fields: + - from: "msg" + to: "message" + + daemonSet: + updateStrategy: + rollingUpdate: + maxUnavailable: 100% + podTemplate: + spec: + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true + securityContext: + runAsUser: 0 + containers: + - name: filebeat + ports: + - protocol: UDP + containerPort: 12345 + hostPort: 12345 +``` + +The input configuration ensures that messages and timestamps are extracted properly. +Refer to the Filebeat documentation on how to forward logs to other outputs. + +Also note the `hostNetwork: true` in the `daemonSet` configuration. + +This ensures filebeat uses the host network, and listens on `127.0.0.1:12345` +(UDP) on every machine, which can then be specified as a logging endpoint in +the machine configuration. + +### Fluent-bit example + +First, we'll create a value file for the `fluentd-bit` Helm chart. + +```yaml +# fluentd-bit.yaml + +podAnnotations: + fluentbit.io/exclude: 'true' + +extraPorts: + - port: 12345 + containerPort: 12345 + protocol: TCP + name: talos + +config: + service: | + [SERVICE] + Flush 5 + Daemon Off + Log_Level warn + Parsers_File custom_parsers.conf + + inputs: | + [INPUT] + Name tcp + Listen 0.0.0.0 + Port 12345 + Format json + Tag talos.* + + [INPUT] + Name tail + Alias kubernetes + Path /var/log/containers/*.log + Parser containerd + Tag kubernetes.* + + [INPUT] + Name tail + Alias audit + Path /var/log/audit/kube/*.log + Parser audit + Tag audit.* + + filters: | + [FILTER] + Name kubernetes + Alias kubernetes + Match kubernetes.* + Kube_Tag_Prefix kubernetes.var.log.containers. + Use_Kubelet Off + Merge_Log On + Merge_Log_Trim On + Keep_Log Off + K8S-Logging.Parser Off + K8S-Logging.Exclude On + Annotations Off + Labels On + + [FILTER] + Name modify + Match kubernetes.* + Add source kubernetes + Remove logtag + + customParsers: | + [PARSER] + Name audit + Format json + Time_Key requestReceivedTimestamp + Time_Format %Y-%m-%dT%H:%M:%S.%L%z + + [PARSER] + Name containerd + Format regex + Regex ^(?