{{< highlight yaml >}} apiVersion: v1alpha1 kind: VolumeConfig name: EPHEMERAL # Name of the volume.

The provisioning describes how the volume is provisioned.

provisioning: # The disk selector expression. diskSelector: match: disk.transport == "nvme" # The Common Expression Language (CEL) expression to match the disk. maxSize: 50GiB # The maximum size of the volume, if not specified the volume can grow to the size of the

# # The minimum size of the volume.
# minSize: 2.5GiB

# The encryption describes how the volume is encrypted.

encryption:

provider: luks2 # Encryption provider to use for the encryption.

# Defines the encryption keys generation and storage method.

keys:

- slot: 0 # Key slot number for LUKS2 encryption.

# Key which value is stored in the configuration file.

static:

passphrase: exampleKey # Defines the static passphrase value.

# # KMS managed encryption key.

# kms:

# endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

- slot: 1 # Key slot number for LUKS2 encryption.

# KMS managed encryption key.

kms:

endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key.

cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider.

blockSize: 4096 # Defines the encryption sector size.

# Additional --perf parameters for the LUKS2 encryption.

options:

- no_read_workqueue

- no_write_workqueue

{{< /highlight >}}

Note: this only takes effect at the time the volume is formatted. | | |encryption |<a href="#VolumeConfig.encryption">EncryptionSpec</a> |The encryption describes how the volume is encrypted. | | |mount |<a href="#VolumeConfig.mount">MountSpec</a> |The mount describes additional mount options. | | |trim |<a href="#VolumeConfig.trim">TrimConfig</a> |The trim describes the per-volume filesystem trim (fstrim) configuration. | | |scrub |<a href="#VolumeConfig.scrub">ScrubConfig</a> |The scrub describes the per-volume filesystem scrub configuration. | |

provisioning {#VolumeConfig.provisioning}

ProvisioningSpec describes how the volume is provisioned.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB. <details><summary>Show example(s)</summary>{{< highlight yaml >}} minSize: 2.5GiB {{< /highlight >}}</details> | | |maxSize |Size |The maximum size of the volume, if not specified the volume can grow to the size of the disk.

Size is specified in bytes or in percents. It can be expressed in human readable format, e.g. 100MB. <details><summary>Show example(s)</summary>{{< highlight yaml >}} maxSize: 50GiB {{< /highlight >}}{{< highlight yaml >}} maxSize: 80% {{< /highlight >}}</details> | |

diskSelector {#VolumeConfig.provisioning.diskSelector}

DiskSelector selects a disk for the volume.

filesystem {#VolumeConfig.filesystem}

SystemVolumeFilesystemSpec describes how the system volume is formatted.

The filesystem type is fixed for system volumes, and project quota support is configured via machine features, so only the filesystem-specific tunables are exposed here.

xfs {#VolumeConfig.filesystem.xfs}

XFSSpec configures XFS-specific filesystem options.

On non-rotational devices mkfs.xfs sizes the allocation group count to the number of CPUs, which on machines with many cores and a modest disk yields hundreds of tiny allocation groups. Talos bounds the allocation group size from below to keep the geometry sane; this option overrides that bound.

Set to zero to use the mkfs.xfs defaults unchanged.

Note: this only affects volumes at the time they are formatted.

Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB. <details><summary>Show example(s)</summary>{{< highlight yaml >}} minAllocationGroupSize: 128GiB {{< /highlight >}}</details> | |

encryption {#VolumeConfig.encryption}

EncryptionSpec represents volume encryption settings.

{{< highlight yaml >}} encryption: provider: luks2 # Encryption provider to use for the encryption. # Defines the encryption keys generation and storage method. keys: - slot: 0 # Key slot number for LUKS2 encryption. # Key which value is stored in the configuration file. static: passphrase: exampleKey # Defines the static passphrase value.

      # # KMS managed encryption key.
      # kms:
      #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
    - slot: 1 # Key slot number for LUKS2 encryption.
      # KMS managed encryption key.
      kms:
        endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key.
cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider.
blockSize: 4096 # Defines the encryption sector size.

# # Additional --perf parameters for the LUKS2 encryption.
# options:
#     - no_read_workqueue
#     - no_write_workqueue

{{< /highlight >}}

- no_read_workqueue
- no_write_workqueue

{{< /highlight >}}</details> | | |allowDiscards |bool |Allow TRIM/discard requests to be passed through to the underlying device when the encrypted volume is opened. Defaults to false. | |

keys[] {#VolumeConfig.encryption.keys.}

EncryptionKey represents configuration for disk encryption key.

static {#VolumeConfig.encryption.keys..static}

EncryptionKeyStatic represents throw away key type.

nodeID {#VolumeConfig.encryption.keys..nodeID}

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

kms {#VolumeConfig.encryption.keys..kms}

EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server.

{{< highlight yaml >}} encryption: keys: - kms: endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. {{< /highlight >}}

tpm {#VolumeConfig.encryption.keys..tpm}

EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM.

options {#VolumeConfig.encryption.keys..tpm.options}

EncryptionKeyTPMOptions represents the options for TPM-based key protection.

mount {#VolumeConfig.mount}

MountSpec describes how the volume is mounted.

For dedicated ETCD and LOG volumes, this also enables noexec.

Defaults to true for better security. Supported for EPHEMERAL and dedicated ETCD, CRI, KUBELET and LOG volumes. | | |disableAccessTime |bool |If true, disable file access time updates.

Supported only for EPHEMERAL volume. | |

trim {#VolumeConfig.trim}

TrimConfig describes per-volume filesystem trim (fstrim) configuration.

It overrides the global FilesystemTrimConfig for the volume.

If not set, trimming is enabled when the global FilesystemTrimConfig is present. | | |interval |Duration |The interval at which the volume is trimmed, overriding the global trim interval. | |

scrub {#VolumeConfig.scrub}

ScrubConfig describes per-volume filesystem scrub configuration.

It overrides the global FilesystemScrubConfig for the volume.

If not set, scrubbing is enabled by default when scrub section is present. | | |interval |Duration |The interval at which the volume is scrubbed, overriding the global scrub interval. | |