Config

{{< highlight yaml >}} version: v1alpha1 machine: # ... cluster: # ... {{< /highlight >}}

Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. |true yes false no | |machine |<a href="#Config.machine">MachineConfig</a> |Provides machine specific configuration options. | | |cluster |<a href="#Config.cluster">ClusterConfig</a> |Provides cluster specific configuration options. | |

machine {#Config.machine}

MachineConfig represents the machine-specific config values.

{{< highlight yaml >}} machine: type: controlplane {{< /highlight >}}

Control Plane

Control Plane node type designates the node as a control plane member. This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.

Worker

Worker node type designates the node as a worker node. This means it will be an available compute node for scheduling workloads.

This node type was previously known as "join"; that value is still supported but deprecated. |controlplane worker | |token |string |The token is used by a machine to join the PKI of the cluster. Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. <details><summary>Show example(s)</summary>example token:{{< highlight yaml >}} token: 328hom.uqjzh6jnn2eie9oi {{< /highlight >}}</details> | | |ca |PEMEncodedCertificateAndKey |The root certificate authority of the PKI. It is composed of a base64 encoded crt and key. <details><summary>Show example(s)</summary>machine CA example:{{< highlight yaml >}} ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== {{< /highlight >}}</details> | | |acceptedCAs |[]PEMEncodedCertificate |The certificates issued by certificate authorities are accepted in addition to issuing 'ca'. It is composed of a base64 encoded crt``. | | |certSANs |[]string |Extra certificate subject alternative names for the machine's certificate. By default, all non-loopback interface IPs are automatically added to the certificate's SANs. <details><summary>Show example(s)</summary>Uncomment this to enable SANs.:{{< highlight yaml >}} certSANs: - 10.0.0.10 - 172.16.0.10 - 192.168.0.10 {{< /highlight >}}</details> | | |features |<a href="#Config.machine.features">FeaturesConfig</a> |Features describe individual Talos features that can be switched on or off. <details><summary>Show example(s)</summary>{{< highlight yaml >}} features: diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. {{< /highlight >}}</details> | | |logging |<a href="#Config.machine.logging">LoggingConfig</a> |Configures the logging system. <details><summary>Show example(s)</summary>{{< highlight yaml >}} logging: # Logging destination. destinations: - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. {{< /highlight >}}{{< highlight yaml >}} logging: # Logging destination. destinations: - endpoint: udp://127.0.0.1:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. # Extra tags (key-value) pairs to attach to every log message sent. extraTags: machine: worker-1 {{< /highlight >}}</details> | | |seccompProfiles|<a href="#Config.machine.seccompProfiles.">[]MachineSeccompProfile</a> |Configures the seccomp profiles for the machine. <details><summary>Show example(s)</summary>{{< highlight yaml >}} seccompProfiles: - name: audit.json # Thenamefield is used to provide the file name of the seccomp profile. # Thevalue` field is used to provide the seccomp profile. value: defaultAction: SCMP_ACT_LOG {{< /highlight >}}</details> | |

features {#Config.machine.features}

FeaturesConfig describes individual Talos features that can be switched on or off.

{{< highlight yaml >}} machine: features: diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. {{< /highlight >}}

logging {#Config.machine.logging}

LoggingConfig struct configures Talos logging.

{{< highlight yaml >}} machine: logging: # Logging destination. destinations: - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. {{< /highlight >}}

{{< highlight yaml >}} machine: logging: # Logging destination. destinations: - endpoint: udp://127.0.0.1:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. # Extra tags (key-value) pairs to attach to every log message sent. extraTags: machine: worker-1 {{< /highlight >}}

destinations[] {#Config.machine.logging.destinations.}

LoggingDestination struct configures Talos logging destination.

endpoint {#Config.machine.logging.destinations..endpoint}

Endpoint represents the endpoint URL parsed out of the machine config.

seccompProfiles[] {#Config.machine.seccompProfiles.}

MachineSeccompProfile defines seccomp profiles for the machine.

{{< highlight yaml >}} machine: seccompProfiles: - name: audit.json # The name field is used to provide the file name of the seccomp profile. # The value field is used to provide the seccomp profile. value: defaultAction: SCMP_ACT_LOG {{< /highlight >}}

cluster {#Config.cluster}

ClusterConfig represents the cluster-wide config values.

image: registry.k8s.io/etcd:3.7.1 # The container image used to create the etcd service.
# The `ca` is the root certificate authority of the PKI.
ca:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
# Extra arguments to supply to etcd.
extraArgs:
    election-timeout: "5000"

# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
# advertisedSubnets:
#     - 10.0.0.0/8

{{< /highlight >}}</details> | | |externalCloudProvider |<a href="#Config.cluster.externalCloudProvider">ExternalCloudProviderConfig</a> |External cloud provider configuration. <details><summary>Show example(s)</summary>{{< highlight yaml >}} externalCloudProvider: enabled: true # Enable external cloud provider. # A list of urls that point to additional manifests for an external cloud provider. manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml {{< /highlight >}}</details> | | |adminKubeconfig |<a href="#Config.cluster.adminKubeconfig">AdminKubeconfigConfig</a> |Settings for admin kubeconfig generation. Certificate lifetime can be configured. <details><summary>Show example(s)</summary>{{< highlight yaml >}} adminKubeconfig: certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). {{< /highlight >}}</details> | |

etcd {#Config.cluster.etcd}

EtcdConfig represents the etcd configuration options.

{{< highlight yaml >}} cluster: etcd: image: registry.k8s.io/etcd:3.7.1 # The container image used to create the etcd service. # The ca is the root certificate authority of the PKI. ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== # Extra arguments to supply to etcd. extraArgs: election-timeout: "5000"

    # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
    # advertisedSubnets:
    #     - 10.0.0.0/8

{{< /highlight >}}

crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

{{< /highlight >}}</details> | | |extraArgs |Args |Extra arguments to supply to etcd. Note that the following args are not allowed:

• name
• data-dir
• initial-cluster-state
• listen-peer-urls
• listen-client-urls
• cert-file
• key-file
• trusted-ca-file
• peer-client-cert-auth
• peer-cert-file
• peer-trusted-ca-file
• peer-key-file | | |advertisedSubnets |[]string |The advertisedSubnets field configures the networks to pick etcd advertised IP from.

IPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node. <details><summary>Show example(s)</summary>{{< highlight yaml >}} advertisedSubnets: - 10.0.0.0/8 {{< /highlight >}}</details> | | |listenSubnets |[]string |The listenSubnets field configures the networks for the etcd to listen for peer and client connections.

If listenSubnets is not set, but advertisedSubnets is set, listenSubnets defaults to advertisedSubnets.

If neither advertisedSubnets nor listenSubnets is set, listenSubnets defaults to listen on all addresses.

IPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node. | |

externalCloudProvider {#Config.cluster.externalCloudProvider}

ExternalCloudProviderConfig contains external cloud provider configuration.

{{< highlight yaml >}} cluster: externalCloudProvider: enabled: true # Enable external cloud provider. # A list of urls that point to additional manifests for an external cloud provider. manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml {{< /highlight >}}

- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml

{{< /highlight >}}</details> | |

adminKubeconfig {#Config.cluster.adminKubeconfig}

AdminKubeconfigConfig contains admin kubeconfig settings.

{{< highlight yaml >}} cluster: adminKubeconfig: certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). {{< /highlight >}}