# TalosCluster

This page is generated from the CRD schema in `config/crd/bases` (`make docs-reference`). Do not edit it.

TalosCluster is the Schema for the talosclusters API

| | |
|---|---|
| Group | `ichor.maesh.dev` |
| Kind | `TalosCluster` (list kind `TalosClusterList`) |
| Resource | `talosclusters` |
| Short names | `tcl` |
| Scope | Namespaced |

## v1alpha1

Version v1alpha1: has a `status` subresource.

### spec

| Field | Type | Required | Description |
|---|---|---|---|
| `spec` | `object` | yes | spec defines the desired state of TalosCluster |
| `spec.authentication` | `object` | no | authentication declares who the kube-apiserver trusts to sign users in with a JWT: Ichor's own issuer and up to three external OIDC providers. It is rendered into Talos's KubeAuthenticationConfig document, so it needs versionContract v1.14 or later, and changing it needs the update verb on talosclusters/authentication. Unset (the default) renders the Talos default: no JWT authenticator, anonymous access to the health endpoints only. |
| `spec.authentication.external` | `[]object` | no | external lists the external OIDC providers the kube-apiserver also trusts. Keep it equal to ichorUI.oidc.*: that is what the UI signs in against, this is what the kube-apiserver accepts. |
| `spec.authentication.external[].audiences` | `[]string` | yes | audiences are the accepted aud values (the OIDC client IDs). |
| `spec.authentication.external[].certificateAuthority` | `string` | no | certificateAuthority is a PEM bundle (public certificates only) that verifies the provider's TLS certificate. Empty uses the control plane's system roots. |
| `spec.authentication.external[].groupsClaim` | `string` | no | groupsClaim is the token claim that lists the user's groups. Default: `"groups"`. |
| `spec.authentication.external[].groupsPrefix` | `string` | no | groupsPrefix is put in front of every group, with the same restrictions as usernamePrefix. Default: `"oidc:"`. |
| `spec.authentication.external[].issuerURL` | `string` | yes | issuerURL is the provider's issuer, an https URL without query or fragment. |
| `spec.authentication.external[].usernameClaim` | `string` | no | usernameClaim is the token claim that names the user. Default: `"email"`. |
| `spec.authentication.external[].usernamePrefix` | `string` | no | usernamePrefix is put in front of every username. It cannot be empty or start with "ichor:", so an external user can never be mistaken for an Ichor user. Default: `"oidc:"`. |
| `spec.authentication.ichor` | `object` | no | ichor turns on Ichor's own OIDC issuer (ichor-ui) as a kube-apiserver authenticator. Users appear as ichor:\<name>, groups as ichor:\<role>. |
| `spec.authentication.ichor.enabled` | `boolean` | no | enabled renders Ichor's issuer into the kube-apiserver. It needs the trust ConfigMap ichor-oidc-trust (the controller publishes it); without it the render fails and says so. Default: `false`. |
| `spec.authentication.ichor.url` | `string` | yes | url is the external https URL of ichor-ui. It is the issuer (the iss claim of every token). |
| `spec.certSANs` | `[]string` | no | certSANs are extra subject alternative names (hostnames, IPs) for the Talos API certificate of every node and for the kube-apiserver serving certificate: machine.certSANs and KubeAPIServerConfig.certExtraSANs, which Talos's generator writes together from one list. The cluster endpoint host is not added for you here; list it if the nodes should serve it. Unset adds none. |
| `spec.cni` | `object` | no | cni configures which CNI preset this cluster bootstraps and how kube-proxy is split between Talos and the CNI (docs/design/architecture.md, "CNI"). |
| `spec.cni.cilium` | `object` | no | cilium holds the user layer of Cilium's Helm values. |
| `spec.cni.cilium.values` | `object (free-form)` | no | values is the user layer of Cilium's Helm values. Effective values are Ichor's defaults, then these deep-merged on top, then the Ichor-owned keys (ipam.mode, securityContext.capabilities.ciliumAgent, securityContext.capabilities.cleanCiliumState, cgroup.autoMount.enabled, cgroup.hostRoot, k8sServiceHost, k8sServicePort, kubeProxyReplacement, tunnelProtocol); a value for an owned key is a validation error. The merged values must stay under 64 KiB. |
| `spec.cni.custom` **(deprecated)** | `object` | no | custom is deprecated, unused; kept so the CRD never drops a field. It declared the chart/manifest source and Talos-side settings for a user-supplied CNI. |
| `spec.cni.custom.documents` **(deprecated)** | `[]object` | no | documents are the Talos-side config documents this CNI needs, applied as a cluster-layer patch -- e.g. disabling kube-proxy when kubeProxy is "replaced". |
| `spec.cni.custom.documents[].config` **(deprecated)** | `object` | no | config is a Talos v1alpha1 Config document; populated when kind is "Config". |
| `spec.cni.custom.documents[].config.cluster` **(deprecated)** | `object` | no | Provides cluster specific configuration options. |
| `spec.cni.custom.documents[].config.cluster.acceptedCAs` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: Use `KubeAPIServerCAConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.acceptedCAs[].crt` **(deprecated)** | `string (byte)` | yes |  |
| `spec.cni.custom.documents[].config.cluster.adminKubeconfig` **(deprecated)** | `object` | no | Settings for admin kubeconfig generation. Certificate lifetime can be configured. |
| `spec.cni.custom.documents[].config.cluster.adminKubeconfig.certLifetime` **(deprecated)** | `string` | no | Admin kubeconfig certificate lifetime (default is 1 year). Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). |
| `spec.cni.custom.documents[].config.cluster.allowSchedulingOnControlPlanes` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: use `KubeNodeConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.allowSchedulingOnMasters` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: use `KubeNodeConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.apiServer` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeAPIServerConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.apiServer.admissionControl` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: Use `KubeAdmissionControlConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.apiServer.admissionControl[].name` **(deprecated)** | `string` | yes | Name is the name of the admission controller. It must match the registered admission plugin name. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeAuditPolicyConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.apiVersion` **(deprecated)** | `string` | no | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.kind` **(deprecated)** | `string` | no | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.metadata` **(deprecated)** | `object` | no | ObjectMeta is included for interoperability with API infrastructure. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.omitManagedFields` **(deprecated)** | `boolean` | no | OmitManagedFields indicates whether to omit the managed fields of the request and response bodies from being written to the API audit log. This is used as a global default - a value of 'true' will omit the managed fileds, otherwise the managed fields will be included in the API audit log. Note that this can also be specified per rule in which case the value specified in a rule will override the global default. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.omitStages` **(deprecated)** | `[]string` | no | OmitStages is a list of stages for which no events are created. Note that this can also be specified per rule in which case the union of both are omitted. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules` **(deprecated)** | `[]object` | yes | Rules specify the audit Level a request should be recorded at. A request may match multiple rules, in which case the FIRST matching rule is used. The default audit level is None, but can be overridden by a catch-all rule at the end of the list. PolicyRules are strictly ordered. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].level` **(deprecated)** | `string` | yes | The Level that requests matching this rule are recorded at. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].namespaces` **(deprecated)** | `[]string` | no | Namespaces that this rule matches. The empty string "" matches non-namespaced resources. An empty list implies every namespace. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].nonResourceURLs` **(deprecated)** | `[]string` | no | NonResourceURLs is a set of URL paths that should be audited. `*`s are allowed, but only as the full, final step in the path. Examples: - `/metrics` - Log requests for apiserver metrics - `/healthz*` - Log all health checks |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].omitManagedFields` **(deprecated)** | `boolean` | no | OmitManagedFields indicates whether to omit the managed fields of the request and response bodies from being written to the API audit log. - a value of 'true' will drop the managed fields from the API audit log - a value of 'false' indicates that the managed fileds should be included in the API audit log Note that the value, if specified, in this rule will override the global default If a value is not specified then the global default specified in Policy.OmitManagedFields will stand. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].omitStages` **(deprecated)** | `[]string` | no | OmitStages is a list of stages for which no events are created. Note that this can also be specified policy wide in which case the union of both are omitted. An empty list means no restrictions will apply. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].resources` **(deprecated)** | `[]object` | no | Resources that this rule matches. An empty list implies all kinds in all API groups. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].resources[].group` **(deprecated)** | `string` | no | Group is the name of the API group that contains the resources. The empty string represents the core API group. `*` matches all groups |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].resources[].resourceNames` **(deprecated)** | `[]string` | no | ResourceNames is a list of resource instance names that the policy matches. Using this field requires Resources to be specified. An empty list implies that every instance of the resource is matched. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].resources[].resources` **(deprecated)** | `[]string` | no | Resources is a list of resources this rule applies to. For example: - `pods` matches pods. - `pods/log` matches the log subresource of pods. - `*` matches all resources and their subresources. - `pods/*` matches all subresources of pods. - `*/scale` matches all scale subresources. If wildcard is present, the validation rule will ensure resources do not overlap with each other. An empty list implies all resources and subresources in this API groups apply. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].userGroups` **(deprecated)** | `[]string` | no | The user groups this rule applies to. A user is considered matching if it is a member of any of the UserGroups. An empty list implies every user group. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].users` **(deprecated)** | `[]string` | no | The users (by authenticated user name) this rule applies to. An empty list implies every user. |
| `spec.cni.custom.documents[].config.cluster.apiServer.auditPolicy.rules[].verbs` **(deprecated)** | `[]string` | no | The verbs that match this rule. An empty list implies every verb. |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: Use `KubeAuthorizerConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].name` **(deprecated)** | `string` | yes | Name is used to describe the authorizer. |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].type` **(deprecated)** | `string` | yes | Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook` **(deprecated)** | `object` | no | webhook is the configuration for the webhook authorizer. |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.authorizedTTL` **(deprecated)** | `string` | yes | The duration to cache 'authorized' responses from the webhook authorizer. Same as setting `--authorization-webhook-cache-authorized-ttl` flag Default: 5m0s |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.cacheAuthorizedRequests` **(deprecated)** | `boolean` | no | CacheAuthorizedRequests specifies whether authorized requests should be cached. If set to true, the TTL for cached decisions can be configured via the AuthorizedTTL field. Default: true |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.cacheUnauthorizedRequests` **(deprecated)** | `boolean` | no | CacheUnauthorizedRequests specifies whether unauthorized requests should be cached. If set to true, the TTL for cached decisions can be configured via the UnauthorizedTTL field. Default: true |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.connectionInfo` **(deprecated)** | `object` | yes | ConnectionInfo defines how we talk to the webhook |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.connectionInfo.kubeConfigFile` **(deprecated)** | `string` | yes | Path to KubeConfigFile for connection info Required, if connectionInfo.Type is KubeConfig |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.connectionInfo.type` **(deprecated)** | `string` | yes | Controls how the webhook should communicate with the server. Valid values: - KubeConfigFile: use the file specified in kubeConfigFile to locate the server. - InClusterConfig: use the in-cluster configuration to call the SubjectAccessReview API hosted by kube-apiserver. This mode is not allowed for kube-apiserver. |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.failurePolicy` **(deprecated)** | `string` | yes | Controls the authorization decision when a webhook request fails to complete or returns a malformed response or errors evaluating matchConditions. Valid values: - NoOpinion: continue to subsequent authorizers to see if one of them allows the request - Deny: reject the request without consulting subsequent authorizers Required, with no default. |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.matchConditionSubjectAccessReviewVersion` **(deprecated)** | `string` | yes | MatchConditionSubjectAccessReviewVersion specifies the SubjectAccessReview version the CEL expressions are evaluated against Valid values: v1 Required, no default value |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.matchConditions` **(deprecated)** | `[]object` | yes | matchConditions is a list of conditions that must be met for a request to be sent to this webhook. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed. The exact matching logic is (in order): 1. If at least one matchCondition evaluates to FALSE, then the webhook is skipped. 2. If ALL matchConditions evaluate to TRUE, then the webhook is called. 3. If at least one matchCondition evaluates to an error (but none are FALSE): - If failurePolicy=Deny, then the webhook rejects the request - If failurePolicy=NoOpinion, then the error is ignored and the webhook is skipped |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.matchConditions[].expression` **(deprecated)** | `string` | yes | expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the SubjectAccessReview in v1 version. If version specified by subjectAccessReviewVersion in the request variable is v1beta1, the contents would be converted to the v1 version before evaluating the CEL expression. - 'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default' - 'nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'. - 'user' is the user to test for. e.g. request.user == 'alice' - 'groups' is the groups to test for. e.g. ('group1' in request.groups) - 'extra' corresponds to the user.Info.GetExtra() method from the authenticator. - 'uid' is the information about the requesting user. e.g. request.uid == '1' Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.subjectAccessReviewVersion` **(deprecated)** | `string` | yes | The API version of the authorization.k8s.io SubjectAccessReview to send to and expect from the webhook. Same as setting `--authorization-webhook-version` flag Valid values: v1beta1, v1 Required, no default value |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.timeout` **(deprecated)** | `string` | yes | Timeout for the webhook request Maximum allowed value is 30s. Required, no default value. |
| `spec.cni.custom.documents[].config.cluster.apiServer.authorizationConfig[].webhook.unauthorizedTTL` **(deprecated)** | `string` | yes | The duration to cache 'unauthorized' responses from the webhook authorizer. Same as setting `--authorization-webhook-cache-unauthorized-ttl` flag Default: 30s |
| `spec.cni.custom.documents[].config.cluster.apiServer.certSANs` **(deprecated)** | `[]string` | no | Extra certificate subject alternative names for the API server's certificate. |
| `spec.cni.custom.documents[].config.cluster.apiServer.disablePodSecurityPolicy` **(deprecated)** | `boolean` | no | docgen:nodoc |
| `spec.cni.custom.documents[].config.cluster.apiServer.env` **(deprecated)** | `map[string]string` | no | The `env` field allows for the addition of environment variables for the control plane component. |
| `spec.cni.custom.documents[].config.cluster.apiServer.extraArgs` **(deprecated)** | `map[string][]string` | no | Extra arguments to supply to the API server. |
| `spec.cni.custom.documents[].config.cluster.apiServer.extraVolumes` **(deprecated)** | `[]object` | no | Extra volumes to mount to the API server static pod. |
| `spec.cni.custom.documents[].config.cluster.apiServer.extraVolumes[].hostPath` **(deprecated)** | `string` | yes | Path on the host. |
| `spec.cni.custom.documents[].config.cluster.apiServer.extraVolumes[].mountPath` **(deprecated)** | `string` | yes | Path in the container. |
| `spec.cni.custom.documents[].config.cluster.apiServer.extraVolumes[].readonly` **(deprecated)** | `boolean` | no | Mount the volume read only. |
| `spec.cni.custom.documents[].config.cluster.apiServer.image` **(deprecated)** | `string` | no | The container image used in the API server manifest. |
| `spec.cni.custom.documents[].config.cluster.apiServer.resources` **(deprecated)** | `object` | no | Configure the API server resources. |
| `spec.cni.custom.documents[].config.cluster.apiServer.resources.limits` **(deprecated)** | `map[string]integer or string` | no | Limits configures the maximum cpu/memory resources a container can use. |
| `spec.cni.custom.documents[].config.cluster.apiServer.resources.requests` **(deprecated)** | `map[string]integer or string` | no | Requests configures the reserved cpu/memory resources. |
| `spec.cni.custom.documents[].config.cluster.clusterName` **(deprecated)** | `string` | no | docgen:nodoc Deprecated: Use `KubeClusterConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.controlPlane` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeClusterConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.controlPlane.endpoint` **(deprecated)** | `string` | yes | Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. It is single-valued, and may optionally include a port number. |
| `spec.cni.custom.documents[].config.cluster.controlPlane.localAPIServerPort` **(deprecated)** | `integer` | no | docgen:nodoc Deprecated: Use `KubeAPIServerConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.controllerManager` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeControllerManagerConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.env` **(deprecated)** | `map[string]string` | no | The `env` field allows for the addition of environment variables for the control plane component. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.extraArgs` **(deprecated)** | `map[string][]string` | no | Extra arguments to supply to the controller manager. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.extraVolumes` **(deprecated)** | `[]object` | no | Extra volumes to mount to the controller manager static pod. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.extraVolumes[].hostPath` **(deprecated)** | `string` | yes | Path on the host. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.extraVolumes[].mountPath` **(deprecated)** | `string` | yes | Path in the container. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.extraVolumes[].readonly` **(deprecated)** | `boolean` | no | Mount the volume read only. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.image` **(deprecated)** | `string` | no | The container image used in the controller manager manifest. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.resources` **(deprecated)** | `object` | no | Configure the controller manager resources. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.resources.limits` **(deprecated)** | `map[string]integer or string` | no | Limits configures the maximum cpu/memory resources a container can use. |
| `spec.cni.custom.documents[].config.cluster.controllerManager.resources.requests` **(deprecated)** | `map[string]integer or string` | no | Requests configures the reserved cpu/memory resources. |
| `spec.cni.custom.documents[].config.cluster.coreDNS` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeCoreDNSConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.coreDNS.disabled` **(deprecated)** | `boolean` | no | Disable coredns deployment on cluster bootstrap. |
| `spec.cni.custom.documents[].config.cluster.coreDNS.image` **(deprecated)** | `string` | no | The `image` field is an override to the default coredns image. |
| `spec.cni.custom.documents[].config.cluster.discovery` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use 'DiscoveryServiceConfig' instead |
| `spec.cni.custom.documents[].config.cluster.discovery.enabled` **(deprecated)** | `boolean` | no | Enable the cluster membership discovery feature. Cluster discovery is based on individual registries which are configured under the registries field. |
| `spec.cni.custom.documents[].config.cluster.discovery.registries` **(deprecated)** | `object` | yes | Configure registries used for cluster member discovery. |
| `spec.cni.custom.documents[].config.cluster.discovery.registries.kubernetes` **(deprecated)** | `object` | yes | Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information as annotations on the Node resources. This feature is deprecated as it is not compatible with Kubernetes 1.32+. See https://github.com/siderolabs/talos/issues/9980 for more information. |
| `spec.cni.custom.documents[].config.cluster.discovery.registries.kubernetes.disabled` **(deprecated)** | `boolean` | no | Disable Kubernetes discovery registry. |
| `spec.cni.custom.documents[].config.cluster.discovery.registries.service` **(deprecated)** | `object` | yes | Service registry is using an external service to push and pull information about cluster members. |
| `spec.cni.custom.documents[].config.cluster.discovery.registries.service.disabled` **(deprecated)** | `boolean` | no | Disable external service discovery registry. |
| `spec.cni.custom.documents[].config.cluster.discovery.registries.service.endpoint` **(deprecated)** | `string` | no | External service endpoint. |
| `spec.cni.custom.documents[].config.cluster.etcd` **(deprecated)** | `object` | no | Etcd specific configuration options. |
| `spec.cni.custom.documents[].config.cluster.etcd.advertisedSubnets` **(deprecated)** | `[]string` | no | The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node. |
| `spec.cni.custom.documents[].config.cluster.etcd.extraArgs` **(deprecated)** | `map[string][]string` | no | Extra arguments to supply to etcd. Note that the following args are not allowed: - `name` - `data-dir` - `initial-cluster-state` - `listen-peer-urls` - `listen-client-urls` - `cert-file` - `key-file` - `trusted-ca-file` - `peer-client-cert-auth` - `peer-cert-file` - `peer-trusted-ca-file` - `peer-key-file` |
| `spec.cni.custom.documents[].config.cluster.etcd.image` **(deprecated)** | `string` | no | The container image used to create the etcd service. |
| `spec.cni.custom.documents[].config.cluster.etcd.listenSubnets` **(deprecated)** | `[]string` | no | The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections. If `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to `advertisedSubnets`. If neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node. |
| `spec.cni.custom.documents[].config.cluster.etcd.subnet` **(deprecated)** | `string` | no | docgen:nodoc Deprecated: use EtcdAdvertistedSubnets |
| `spec.cni.custom.documents[].config.cluster.externalCloudProvider` **(deprecated)** | `object` | no | External cloud provider configuration. |
| `spec.cni.custom.documents[].config.cluster.externalCloudProvider.enabled` **(deprecated)** | `boolean` | no | Enable external cloud provider. |
| `spec.cni.custom.documents[].config.cluster.externalCloudProvider.manifests` **(deprecated)** | `[]string` | no | A list of urls that point to additional manifests for an external cloud provider. These will get automatically deployed as part of the bootstrap. |
| `spec.cni.custom.documents[].config.cluster.extraManifestHeaders` **(deprecated)** | `map[string]string` | no | docgen:nodoc Deprecated: Use `KubeExternalManifestConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.extraManifests` **(deprecated)** | `[]string` | no | docgen:nodoc Deprecated: Use `KubeExternalManifestConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.id` **(deprecated)** | `string` | no | docgen:nodoc Deprecated: Use 'DiscoveryIdentityConfig' document instead. |
| `spec.cni.custom.documents[].config.cluster.inlineManifests` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: Use `KubeInlineManifestConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.inlineManifests[].contents` **(deprecated)** | `string` | yes | Manifest contents as a string. |
| `spec.cni.custom.documents[].config.cluster.inlineManifests[].name` **(deprecated)** | `string` | yes | Name of the manifest. Name should be unique. |
| `spec.cni.custom.documents[].config.cluster.network` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeNetworkConfig` and `KubeFlannelCNIConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.network.cni` **(deprecated)** | `object` | no | The CNI used. Composed of "name" and "urls". The "name" key supports the following options: "flannel", "custom", and "none". "flannel" uses Talos-managed Flannel CNI, and that's the default option. "custom" uses custom manifests that should be provided in "urls". "none" indicates that Talos will not manage any CNI installation. |
| `spec.cni.custom.documents[].config.cluster.network.cni.flannel` **(deprecated)** | `object` | no | FlannelCNIConfig represents the Flannel CNI configuration options. docgen:nodoc |
| `spec.cni.custom.documents[].config.cluster.network.cni.flannel.extraArgs` **(deprecated)** | `[]string` | no | Extra arguments for 'flanneld'. |
| `spec.cni.custom.documents[].config.cluster.network.cni.flannel.kubeNetworkPoliciesEnabled` **(deprecated)** | `boolean` | no | Deploys kube-network-policies along with Flannel. This enables Kubernetes Network Policies support in the cluster. |
| `spec.cni.custom.documents[].config.cluster.network.cni.name` **(deprecated)** | `string` | no | Name of CNI to use. |
| `spec.cni.custom.documents[].config.cluster.network.cni.urls` **(deprecated)** | `[]string` | no | URLs containing manifests to apply for the CNI. Should be present for "custom", must be empty for "flannel" and "none". |
| `spec.cni.custom.documents[].config.cluster.network.dnsDomain` **(deprecated)** | `string` | yes | The domain used by Kubernetes DNS. The default is `cluster.local` |
| `spec.cni.custom.documents[].config.cluster.network.podSubnets` **(deprecated)** | `[]string` | yes | The pod subnet CIDR. |
| `spec.cni.custom.documents[].config.cluster.network.serviceSubnets` **(deprecated)** | `[]string` | yes | The service subnet CIDR. |
| `spec.cni.custom.documents[].config.cluster.proxy` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: use `KubeProxyConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.proxy.disabled` **(deprecated)** | `boolean` | no | Disable kube-proxy deployment on cluster bootstrap. |
| `spec.cni.custom.documents[].config.cluster.proxy.extraArgs` **(deprecated)** | `map[string][]string` | no | Extra arguments to supply to kube-proxy. |
| `spec.cni.custom.documents[].config.cluster.proxy.image` **(deprecated)** | `string` | no | The container image used in the kube-proxy manifest. |
| `spec.cni.custom.documents[].config.cluster.proxy.mode` **(deprecated)** | `string` | no | proxy mode of kube-proxy. The default is 'iptables'. |
| `spec.cni.custom.documents[].config.cluster.scheduler` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeSchedulerConfig` instead. |
| `spec.cni.custom.documents[].config.cluster.scheduler.env` **(deprecated)** | `map[string]string` | no | The `env` field allows for the addition of environment variables for the control plane component. |
| `spec.cni.custom.documents[].config.cluster.scheduler.extraArgs` **(deprecated)** | `map[string][]string` | no | Extra arguments to supply to the scheduler. |
| `spec.cni.custom.documents[].config.cluster.scheduler.extraVolumes` **(deprecated)** | `[]object` | no | Extra volumes to mount to the scheduler static pod. |
| `spec.cni.custom.documents[].config.cluster.scheduler.extraVolumes[].hostPath` **(deprecated)** | `string` | yes | Path on the host. |
| `spec.cni.custom.documents[].config.cluster.scheduler.extraVolumes[].mountPath` **(deprecated)** | `string` | yes | Path in the container. |
| `spec.cni.custom.documents[].config.cluster.scheduler.extraVolumes[].readonly` **(deprecated)** | `boolean` | no | Mount the volume read only. |
| `spec.cni.custom.documents[].config.cluster.scheduler.image` **(deprecated)** | `string` | no | The container image used in the scheduler manifest. |
| `spec.cni.custom.documents[].config.cluster.scheduler.resources` **(deprecated)** | `object` | no | Configure the scheduler resources. |
| `spec.cni.custom.documents[].config.cluster.scheduler.resources.limits` **(deprecated)** | `map[string]integer or string` | no | Limits configures the maximum cpu/memory resources a container can use. |
| `spec.cni.custom.documents[].config.cluster.scheduler.resources.requests` **(deprecated)** | `map[string]integer or string` | no | Requests configures the reserved cpu/memory resources. |
| `spec.cni.custom.documents[].config.debug` **(deprecated)** | `boolean` | no | Enable verbose logging to the console. All system containers logs will flow into serial console. **Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. |
| `spec.cni.custom.documents[].config.machine` **(deprecated)** | `object` | no | Provides machine specific configuration options. |
| `spec.cni.custom.documents[].config.machine.acceptedCAs` **(deprecated)** | `[]object` | no | The certificates issued by certificate authorities are accepted in addition to issuing 'ca'. It is composed of a base64 encoded `crt``. |
| `spec.cni.custom.documents[].config.machine.acceptedCAs[].crt` **(deprecated)** | `string (byte)` | yes |  |
| `spec.cni.custom.documents[].config.machine.certSANs` **(deprecated)** | `[]string` | no | Extra certificate subject alternative names for the machine's certificate. By default, all non-loopback interface IPs are automatically added to the certificate's SANs. |
| `spec.cni.custom.documents[].config.machine.controlPlane` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeControllerManagerConfig`/`KubeSchedulerConfig` instead. |
| `spec.cni.custom.documents[].config.machine.controlPlane.controllerManager` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeControllerManagerConfig` instead. |
| `spec.cni.custom.documents[].config.machine.controlPlane.controllerManager.disabled` **(deprecated)** | `boolean` | no | Disable kube-controller-manager on the node. |
| `spec.cni.custom.documents[].config.machine.controlPlane.scheduler` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeSchedulerConfig` instead. |
| `spec.cni.custom.documents[].config.machine.controlPlane.scheduler.disabled` **(deprecated)** | `boolean` | no | Disable kube-scheduler on the node. |
| `spec.cni.custom.documents[].config.machine.disks` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: Use 'UserVolumeConfig' instead. |
| `spec.cni.custom.documents[].config.machine.disks[].device` **(deprecated)** | `string` | no | The name of the disk to use. |
| `spec.cni.custom.documents[].config.machine.disks[].partitions` **(deprecated)** | `[]object` | no | A list of partitions to create on the disk. |
| `spec.cni.custom.documents[].config.machine.disks[].partitions[].mountpoint` **(deprecated)** | `string` | no | Where to mount the partition. |
| `spec.cni.custom.documents[].config.machine.disks[].partitions[].size` **(deprecated)** | `string` | no | The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. |
| `spec.cni.custom.documents[].config.machine.env` **(deprecated)** | `map[string]string` | no | docgen:nodoc Deprecated: Use 'EnvironmentConfig' instead. |
| `spec.cni.custom.documents[].config.machine.features` **(deprecated)** | `object` | no | Features describe individual Talos features that can be switched on or off. |
| `spec.cni.custom.documents[].config.machine.features.apidCheckExtKeyUsage` **(deprecated)** | `boolean` | no | docgen:nodoc |
| `spec.cni.custom.documents[].config.machine.features.diskQuotaSupport` **(deprecated)** | `boolean` | no | Enable XFS project quota support for EPHEMERAL partition and user disks. Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota. |
| `spec.cni.custom.documents[].config.machine.features.hostDNS` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use ResolverConfig document instead. |
| `spec.cni.custom.documents[].config.machine.features.hostDNS.enabled` **(deprecated)** | `boolean` | no | Enable host DNS caching resolver. |
| `spec.cni.custom.documents[].config.machine.features.hostDNS.forwardKubeDNSToHost` **(deprecated)** | `boolean` | no | Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. When enabled, CoreDNS pods use host DNS server as the upstream DNS (instead of using configured upstream DNS resolvers directly). |
| `spec.cni.custom.documents[].config.machine.features.hostDNS.resolveMemberNames` **(deprecated)** | `boolean` | no | Resolve member hostnames using the host DNS resolver. When enabled, cluster member hostnames and node names are resolved using the host DNS resolver. This requires service discovery to be enabled. |
| `spec.cni.custom.documents[].config.machine.features.imageCache` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use ImageCacheConfig document instead. |
| `spec.cni.custom.documents[].config.machine.features.imageCache.localEnabled` **(deprecated)** | `boolean` | no | Enable local image cache. |
| `spec.cni.custom.documents[].config.machine.features.kubePrism` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use KubePrismConfig document instead. |
| `spec.cni.custom.documents[].config.machine.features.kubePrism.enabled` **(deprecated)** | `boolean` | no | Enable KubePrism support - will start local load balancing proxy. |
| `spec.cni.custom.documents[].config.machine.features.kubePrism.port` **(deprecated)** | `integer` | no | KubePrism port. |
| `spec.cni.custom.documents[].config.machine.features.kubernetesTalosAPIAccess` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: use KubeTalosAPIAccessConfig instead. |
| `spec.cni.custom.documents[].config.machine.features.kubernetesTalosAPIAccess.allowedKubernetesNamespaces` **(deprecated)** | `[]string` | no | The list of Kubernetes namespaces Talos API access is available from. |
| `spec.cni.custom.documents[].config.machine.features.kubernetesTalosAPIAccess.allowedRoles` **(deprecated)** | `[]string` | no | The list of Talos API roles which can be granted for access from Kubernetes pods. Empty list means that no roles can be granted, so access is blocked. |
| `spec.cni.custom.documents[].config.machine.features.kubernetesTalosAPIAccess.enabled` **(deprecated)** | `boolean` | no | Enable Talos API access from Kubernetes pods. |
| `spec.cni.custom.documents[].config.machine.features.nodeAddressSortAlgorithm` **(deprecated)** | `string` | no | Select the node address sort algorithm. The 'v1' algorithm sorts addresses by the address itself. The 'v2' algorithm prefers more specific prefixes. If unset, defaults to 'v1'. |
| `spec.cni.custom.documents[].config.machine.features.rbac` **(deprecated)** | `boolean` | no | docgen:nodoc |
| `spec.cni.custom.documents[].config.machine.features.stableHostname` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: use HostConfig instead. |
| `spec.cni.custom.documents[].config.machine.files` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: Use dedicated configuration documents such as EtcFileConfig and CRICustomizationConfig instead. |
| `spec.cni.custom.documents[].config.machine.files[].content` **(deprecated)** | `string` | yes | The contents of the file. |
| `spec.cni.custom.documents[].config.machine.files[].op` **(deprecated)** | `string` | yes | The operation to use |
| `spec.cni.custom.documents[].config.machine.files[].path` **(deprecated)** | `string` | yes | The path of the file. |
| `spec.cni.custom.documents[].config.machine.files[].permissions` **(deprecated)** | `string` | yes | The file's permissions in octal. |
| `spec.cni.custom.documents[].config.machine.install` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use the 'UnattendedInstall' multi-document config instead. |
| `spec.cni.custom.documents[].config.machine.install.bootloader` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: It never worked. |
| `spec.cni.custom.documents[].config.machine.install.disk` **(deprecated)** | `string` | no | The disk used for installations. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector` **(deprecated)** | `object` | no | Look up disk using disk attributes like model, size, serial and others. Always has priority over `disk`. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.busPath` **(deprecated)** | `string` | no | Disk bus path. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.modalias` **(deprecated)** | `string` | no | Disk modalias `/sys/block/\<dev>/device/modalias`. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.model` **(deprecated)** | `string` | no | Disk model `/sys/block/\<dev>/device/model`. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.name` **(deprecated)** | `string` | no | Disk name `/sys/block/\<dev>/device/name`. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.serial` **(deprecated)** | `string` | no | Disk serial number `/sys/block/\<dev>/serial`. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.size` **(deprecated)** | `string` | no | Disk size. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.type` **(deprecated)** | `string` | no | Disk Type. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.uuid` **(deprecated)** | `string` | no | Disk UUID `/sys/block/\<dev>/uuid`. |
| `spec.cni.custom.documents[].config.machine.install.diskSelector.wwid` **(deprecated)** | `string` | no | Disk WWID `/sys/block/\<dev>/wwid`. |
| `spec.cni.custom.documents[].config.machine.install.extensions` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: Use custom `InstallImage` instead. |
| `spec.cni.custom.documents[].config.machine.install.extensions[].image` **(deprecated)** | `string` | yes | System extension image. |
| `spec.cni.custom.documents[].config.machine.install.extraKernelArgs` **(deprecated)** | `[]string` | no | docgen:nodoc Deprecated: Use Image Factory/imager instead to build a proper installer. |
| `spec.cni.custom.documents[].config.machine.install.grubUseUKICmdline` **(deprecated)** | `boolean` | no | Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. This changes the way cmdline is managed with GRUB bootloader to be more consistent with UKI/systemd-boot. |
| `spec.cni.custom.documents[].config.machine.install.image` **(deprecated)** | `string` | no | Allows for supplying the image used to perform the installation. Image reference for each Talos release can be found on [GitHub releases page](https://github.com/siderolabs/talos/releases). |
| `spec.cni.custom.documents[].config.machine.install.legacyBIOSSupport` **(deprecated)** | `boolean` | no | Indicates if MBR partition should be marked as bootable (active). Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme. |
| `spec.cni.custom.documents[].config.machine.install.wipe` **(deprecated)** | `boolean` | yes | Indicates if the installation disk should be wiped at installation time. Defaults to `true`. |
| `spec.cni.custom.documents[].config.machine.kernel` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use 'KernelModuleConfig' instead. |
| `spec.cni.custom.documents[].config.machine.kernel.modules` **(deprecated)** | `[]object` | no | Kernel modules to load. |
| `spec.cni.custom.documents[].config.machine.kernel.modules[].name` **(deprecated)** | `string` | yes | Module name. |
| `spec.cni.custom.documents[].config.machine.kernel.modules[].parameters` **(deprecated)** | `[]string` | no | Module parameters, changes applied after reboot. |
| `spec.cni.custom.documents[].config.machine.kubelet` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeletConfig` instead. |
| `spec.cni.custom.documents[].config.machine.kubelet.clusterDNS` **(deprecated)** | `[]string` | no | docgen:nodoc Deprecated: use `KubeletConfig` instead. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig` **(deprecated)** | `object` | no | The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.apiVersion` **(deprecated)** | `string` | no | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.kind` **(deprecated)** | `string` | no | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers` **(deprecated)** | `[]object` | yes | providers is a list of credential provider plugins that will be enabled by the kubelet. Multiple providers may match against a single image, in which case credentials from all providers will be returned to the kubelet. If multiple providers are called for a single image, the results are combined. If providers return overlapping auth keys, the value from the provider earlier in this list is attempted first. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].apiVersion` **(deprecated)** | `string` | yes | Required input version of the exec CredentialProviderRequest. The returned CredentialProviderResponse MUST use the same encoding version as the input. Current supported values are: - credentialprovider.kubelet.k8s.io/v1 |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].args` **(deprecated)** | `[]string` | no | Arguments to pass to the command when executing it. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].defaultCacheDuration` **(deprecated)** | `string` | yes | defaultCacheDuration is the default duration the plugin will cache credentials in-memory if a cache duration is not provided in the plugin response. This field is required. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].env` **(deprecated)** | `[]object` | no | Env defines additional environment variables to expose to the process. These are unioned with the host's environment, as well as variables client-go uses to pass argument to the plugin. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].env[].name` **(deprecated)** | `string` | yes |  |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].env[].value` **(deprecated)** | `string` | yes |  |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].matchImages` **(deprecated)** | `[]string` | yes | matchImages is a required list of strings used to match against images in order to determine if this provider should be invoked. If one of the strings matches the requested image from the kubelet, the plugin will be invoked and given a chance to provide credentials. Images are expected to contain the registry domain and URL path. Each entry in matchImages is a pattern which can optionally contain a port and a path. Globs can be used in the domain, but not in the port or the path. Globs are supported as subdomains like '*.k8s.io' or 'k8s.*.io', and top-level-domains such as 'k8s.*'. Matching partial subdomains like 'app*.k8s.io' is also supported. Each glob can only match a single subdomain segment, so *.io does not match *.k8s.io. A match exists between an image and a matchImage when all of the below are true: - Both contain the same number of domain parts and each part matches. - The URL path of an imageMatch must be a prefix of the target image URL path. - If the imageMatch contains a port, then the port must match in the image as well. Example values of matchImages: - 123456789.dkr.ecr.us-east-1.amazonaws.com - *.azurecr.io - gcr.io - *.*.registry.io - registry.io:8080/path |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].name` **(deprecated)** | `string` | yes | name is the required name of the credential provider. It must match the name of the provider executable as seen by the kubelet. The executable must be in the kubelet's bin directory (set by the --image-credential-provider-bin-dir flag). Required to be unique across all providers. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].tokenAttributes` **(deprecated)** | `object` | no | tokenAttributes is the configuration for the service account token that will be passed to the plugin. The credential provider opts in to using service account tokens for image pull by setting this field. When this field is set, kubelet will generate a service account token bound to the pod for which the image is being pulled and pass to the plugin as part of CredentialProviderRequest along with other attributes required by the plugin. The service account metadata and token attributes will be used as a dimension to cache the credentials in kubelet. The cache key is generated by combining the service account metadata (namespace, name, UID, and annotations key+value for the keys defined in serviceAccountTokenAttribute.requiredServiceAccountAnnotationKeys and serviceAccountTokenAttribute.optionalServiceAccountAnnotationKeys). The pod metadata (namespace, name, UID) that are in the service account token are not used as a dimension to cache the credentials in kubelet. This means workloads that are using the same service account could end up using the same credentials for image pull. For plugins that don't want this behavior, or plugins that operate in pass-through mode; i.e., they return the service account token as-is, they can set the credentialProviderResponse.cacheDuration to 0. This will disable the caching of credentials in kubelet and the plugin will be invoked for every image pull. This does result in token generation overhead for every image pull, but it is the only way to ensure that the credentials are not shared across pods (even if they are using the same service account). |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].tokenAttributes.cacheType` **(deprecated)** | `string` | yes | cacheType indicates the type of cache key use for caching the credentials returned by the plugin when the service account token is used. The most conservative option is to set this to "Token", which means the kubelet will cache returned credentials on a per-token basis. This should be set if the returned credential's lifetime is limited to the service account token's lifetime. If the plugin's credential retrieval logic depends only on the service account and not on pod-specific claims, then the plugin can set this to "ServiceAccount". In this case, the kubelet will cache returned credentials on a per-serviceaccount basis. Use this when the returned credential is valid for all pods using the same service account. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].tokenAttributes.optionalServiceAccountAnnotationKeys` **(deprecated)** | `[]string` | no | optionalServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are optional to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. The plugin is responsible for validating the existence of annotations and their values. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials. Keys in this list must be unique. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].tokenAttributes.requireServiceAccount` **(deprecated)** | `boolean` | yes | requireServiceAccount indicates whether the plugin requires the pod to have a service account. If set to true, kubelet will only invoke the plugin if the pod has a service account. If set to false, kubelet will invoke the plugin even if the pod does not have a service account and will not include a token in the CredentialProviderRequest in that scenario. This is useful for plugins that are used to pull images for pods without service accounts (e.g., static pods). |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].tokenAttributes.requiredServiceAccountAnnotationKeys` **(deprecated)** | `[]string` | no | requiredServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are required to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. If any of the keys defined in this list are not present in the service account, kubelet will not invoke the plugin and will return an error. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials or allow workloads to opt in to using service account tokens for image pull. If non-empty, requireServiceAccount must be set to true. Keys in this list must be unique. This list needs to be mutually exclusive with optionalServiceAccountAnnotationKeys. |
| `spec.cni.custom.documents[].config.machine.kubelet.credentialProviderConfig.providers[].tokenAttributes.serviceAccountTokenAudience` **(deprecated)** | `string` | yes | serviceAccountTokenAudience is the intended audience for the projected service account token. |
| `spec.cni.custom.documents[].config.machine.kubelet.defaultRuntimeSeccompProfileEnabled` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: use `KubeletConfig` instead. |
| `spec.cni.custom.documents[].config.machine.kubelet.disableManifestsDirectory` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: locked to true in multi-doc config. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraArgs` **(deprecated)** | `map[string][]string` | no | docgen:nodoc Deprecated: use `KubeletConfig` instead. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: removed in multi-doc config. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].destination` **(deprecated)** | `string` | yes | Destination is the absolute path where the mount will be placed in the container. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].gidMappings` **(deprecated)** | `[]object` | no | UID/GID mappings used for changing file owners w/o calling chown, fs should support it. Every mount point could have its own mapping. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].gidMappings[].containerID` **(deprecated)** | `integer` | yes | ContainerID is the starting UID/GID in the container. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].gidMappings[].hostID` **(deprecated)** | `integer` | yes | HostID is the starting UID/GID on the host to be mapped to 'ContainerID'. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].gidMappings[].size` **(deprecated)** | `integer` | yes | Size is the number of IDs to be mapped. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].options` **(deprecated)** | `[]string` | no | Options are fstab style mount options. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].source` **(deprecated)** | `string` | no | Source specifies the source path of the mount. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].type` **(deprecated)** | `string` | no | Type specifies the mount kind. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].uidMappings` **(deprecated)** | `[]object` | no | UID/GID mappings used for changing file owners w/o calling chown, fs should support it. Every mount point could have its own mapping. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].uidMappings[].containerID` **(deprecated)** | `integer` | yes | ContainerID is the starting UID/GID in the container. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].uidMappings[].hostID` **(deprecated)** | `integer` | yes | HostID is the starting UID/GID on the host to be mapped to 'ContainerID'. |
| `spec.cni.custom.documents[].config.machine.kubelet.extraMounts[].uidMappings[].size` **(deprecated)** | `integer` | yes | Size is the number of IDs to be mapped. |
| `spec.cni.custom.documents[].config.machine.kubelet.image` **(deprecated)** | `string` | no | docgen:nodoc Deprecated: use `KubeletConfig` instead. |
| `spec.cni.custom.documents[].config.machine.kubelet.nodeIP` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: use `KubeNodeConfig` instead. |
| `spec.cni.custom.documents[].config.machine.kubelet.nodeIP.validSubnets` **(deprecated)** | `[]string` | no | The `validSubnets` field configures the networks to pick kubelet node IP from. For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both. |
| `spec.cni.custom.documents[].config.machine.kubelet.registerWithFQDN` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: use `KubeNodeConfig` instead. |
| `spec.cni.custom.documents[].config.machine.kubelet.skipNodeRegistration` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: use `KubeNodeConfig` instead. |
| `spec.cni.custom.documents[].config.machine.logging` **(deprecated)** | `object` | no | Configures the logging system. |
| `spec.cni.custom.documents[].config.machine.logging.destinations` **(deprecated)** | `[]object` | yes | Logging destination. |
| `spec.cni.custom.documents[].config.machine.logging.destinations[].endpoint` **(deprecated)** | `string` | yes | Where to send logs. Supported protocols are "tcp" and "udp". |
| `spec.cni.custom.documents[].config.machine.logging.destinations[].extraTags` **(deprecated)** | `map[string]string` | no | Extra tags (key-value) pairs to attach to every log message sent. |
| `spec.cni.custom.documents[].config.machine.logging.destinations[].format` **(deprecated)** | `string` | yes | Logs format. |
| `spec.cni.custom.documents[].config.machine.network` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: All fields within NetworkConfig are deprecated. Use multi-document network config types instead: HostnameConfig, NetworkDeviceConfig, ResolverConfig, StaticHostConfig, KubeSpanConfig. |
| `spec.cni.custom.documents[].config.machine.network.disableSearchDomain` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: Use `ResolverConfig` instead. |
| `spec.cni.custom.documents[].config.machine.network.extraHostEntries` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: Use `StaticHostConfig` instead. |
| `spec.cni.custom.documents[].config.machine.network.extraHostEntries[].aliases` **(deprecated)** | `[]string` | yes | The host alias. |
| `spec.cni.custom.documents[].config.machine.network.extraHostEntries[].ip` **(deprecated)** | `string` | yes | The IP of the host. |
| `spec.cni.custom.documents[].config.machine.network.hostname` **(deprecated)** | `string` | no | docgen:nodoc Deprecated: use `HostnameConfig` instead. |
| `spec.cni.custom.documents[].config.machine.network.interfaces` **(deprecated)** | `[]object` | no | docgen:nodoc Deprecated: use multi-doc network config. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].addresses` **(deprecated)** | `[]string` | no | Assigns static IP addresses to the interface. An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond` **(deprecated)** | `object` | no | Bond specific options. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.adActorSysPrio` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.adActorSystem` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. Not supported at the moment. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.adSelect` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.adUserPortKey` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.allSlavesActive` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.arpAllTargets` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.arpIPTarget` **(deprecated)** | `[]string` | no | A bond option. Please see the official kernel documentation. Not supported at the moment. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.arpInterval` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.arpValidate` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.deviceSelectors` **(deprecated)** | `[]object` | no | Picks a network device using the selector. Mutually exclusive with `interfaces`. Supports partial match using wildcard syntax. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.deviceSelectors[].busPath` **(deprecated)** | `string` | no | PCI, USB bus prefix, supports matching by wildcard. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.deviceSelectors[].driver` **(deprecated)** | `string` | no | Kernel driver, supports matching by wildcard. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.deviceSelectors[].hardwareAddr` **(deprecated)** | `string` | no | Device hardware (MAC) address, supports matching by wildcard. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.deviceSelectors[].pciID` **(deprecated)** | `string` | no | PCI ID (vendor ID, product ID), supports matching by wildcard. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.deviceSelectors[].permanentAddr` **(deprecated)** | `string` | no | Device permanent hardware address, supports matching by wildcard. The permanent address doesn't change when the link is enslaved to a bond, so it's recommended to use this field for bond members. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.deviceSelectors[].physical` **(deprecated)** | `boolean` | no | Select only physical devices. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.downdelay` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.failOverMac` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.interfaces` **(deprecated)** | `[]string` | yes | The interfaces that make up the bond. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.lacpRate` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.lpInterval` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.miimon` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.minLinks` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.mode` **(deprecated)** | `string` | yes | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.numPeerNotif` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.packetsPerSlave` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.peerNotifyDelay` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.primary` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.primaryReselect` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.resendIgmp` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.tlbDynamicLb` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.updelay` **(deprecated)** | `integer` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.useCarrier` **(deprecated)** | `boolean` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bond.xmitHashPolicy` **(deprecated)** | `string` | no | A bond option. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bridge` **(deprecated)** | `object` | no | Bridge specific options. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bridge.interfaces` **(deprecated)** | `[]string` | yes | The interfaces that make up the bridge. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bridge.stp` **(deprecated)** | `object` | no | Enable STP on this bridge. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bridge.stp.enabled` **(deprecated)** | `boolean` | no | Whether Spanning Tree Protocol (STP) is enabled. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bridge.vlan` **(deprecated)** | `object` | no | Enable VLAN-awareness on this bridge. Please see the official kernel documentation. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bridge.vlan.vlanFiltering` **(deprecated)** | `boolean` | no | Whether VLAN filtering is enabled. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bridgePort` **(deprecated)** | `object` | no | Configure this device as a bridge port. This can be used to dynamically assign network interfaces to a bridge. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].bridgePort.master` **(deprecated)** | `string` | no | The name of the bridge master interface |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].cidr` **(deprecated)** | `string` | no | docgen:nodoc |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].deviceSelector` **(deprecated)** | `object` | no | Picks a network device using the selector. Mutually exclusive with `interface`. Supports partial match using wildcard syntax. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].deviceSelector.busPath` **(deprecated)** | `string` | no | PCI, USB bus prefix, supports matching by wildcard. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].deviceSelector.driver` **(deprecated)** | `string` | no | Kernel driver, supports matching by wildcard. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].deviceSelector.hardwareAddr` **(deprecated)** | `string` | no | Device hardware (MAC) address, supports matching by wildcard. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].deviceSelector.pciID` **(deprecated)** | `string` | no | PCI ID (vendor ID, product ID), supports matching by wildcard. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].deviceSelector.permanentAddr` **(deprecated)** | `string` | no | Device permanent hardware address, supports matching by wildcard. The permanent address doesn't change when the link is enslaved to a bond, so it's recommended to use this field for bond members. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].deviceSelector.physical` **(deprecated)** | `boolean` | no | Select only physical devices. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].dhcp` **(deprecated)** | `boolean` | no | Indicates if DHCP should be used to configure the interface. The following DHCP options are supported: - `OptionClasslessStaticRoute` - `OptionDomainNameServer` - `OptionDNSDomainSearchList` - `OptionHostName` |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].dhcpOptions` **(deprecated)** | `object` | no | DHCP specific options. `dhcp` *must* be set to true for these to take effect. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].dhcpOptions.duidv6` **(deprecated)** | `string` | no | Set client DUID (hex string). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].dhcpOptions.ipv4` **(deprecated)** | `boolean` | no | Enables DHCPv4 protocol for the interface (default is enabled). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].dhcpOptions.ipv6` **(deprecated)** | `boolean` | no | Enables DHCPv6 protocol for the interface (default is disabled). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].dhcpOptions.routeMetric` **(deprecated)** | `integer` | yes | The priority of all routes received via DHCP. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].dummy` **(deprecated)** | `boolean` | no | Indicates if the interface is a dummy interface. `dummy` is used to specify that this interface should be a virtual-only, dummy interface. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].ignore` **(deprecated)** | `boolean` | no | Indicates if the interface should be ignored (skips configuration). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].interface` **(deprecated)** | `string` | no | The interface name. Mutually exclusive with `deviceSelector`. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].mtu` **(deprecated)** | `integer` | no | The interface's MTU. If used in combination with DHCP, this will override any MTU settings returned from DHCP server. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].routes` **(deprecated)** | `[]object` | no | A list of routes associated with the interface. If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].routes[].gateway` **(deprecated)** | `string` | yes | The route's gateway (if empty, creates link scope route). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].routes[].metric` **(deprecated)** | `integer` | no | The optional metric for the route. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].routes[].mtu` **(deprecated)** | `integer` | no | The optional MTU for the route. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].routes[].network` **(deprecated)** | `string` | yes | The route's network (destination). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].routes[].source` **(deprecated)** | `string` | no | The route's source address (optional). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vip` **(deprecated)** | `object` | no | Virtual (shared) IP address configuration. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vip.equinixMetal` **(deprecated)** | `object` | no | Specifies the Equinix Metal API settings to assign VIP to the node. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vip.hcloud` **(deprecated)** | `object` | no | Specifies the Hetzner Cloud API settings to assign VIP to the node. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vip.ip` **(deprecated)** | `string` | no | Specifies the IP address to be used. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans` **(deprecated)** | `[]object` | no | VLAN specific options. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].addresses` **(deprecated)** | `[]string` | no | The addresses in CIDR notation or as plain IPs to use. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].cidr` **(deprecated)** | `string` | no | docgen:nodoc |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].dhcp` **(deprecated)** | `boolean` | no | Indicates if DHCP should be used. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].dhcpOptions` **(deprecated)** | `object` | no | DHCP specific options. `dhcp` *must* be set to true for these to take effect. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].dhcpOptions.duidv6` **(deprecated)** | `string` | no | Set client DUID (hex string). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].dhcpOptions.ipv4` **(deprecated)** | `boolean` | no | Enables DHCPv4 protocol for the interface (default is enabled). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].dhcpOptions.ipv6` **(deprecated)** | `boolean` | no | Enables DHCPv6 protocol for the interface (default is disabled). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].dhcpOptions.routeMetric` **(deprecated)** | `integer` | yes | The priority of all routes received via DHCP. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].mtu` **(deprecated)** | `integer` | no | The VLAN's MTU. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].routes` **(deprecated)** | `[]object` | yes | A list of routes associated with the VLAN. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].routes[].gateway` **(deprecated)** | `string` | yes | The route's gateway (if empty, creates link scope route). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].routes[].metric` **(deprecated)** | `integer` | no | The optional metric for the route. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].routes[].mtu` **(deprecated)** | `integer` | no | The optional MTU for the route. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].routes[].network` **(deprecated)** | `string` | yes | The route's network (destination). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].routes[].source` **(deprecated)** | `string` | no | The route's source address (optional). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].vip` **(deprecated)** | `object` | no | The VLAN's virtual IP address configuration. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].vip.equinixMetal` **(deprecated)** | `object` | no | Specifies the Equinix Metal API settings to assign VIP to the node. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].vip.hcloud` **(deprecated)** | `object` | no | Specifies the Hetzner Cloud API settings to assign VIP to the node. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].vip.ip` **(deprecated)** | `string` | no | Specifies the IP address to be used. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].vlans[].vlanId` **(deprecated)** | `integer` | yes | The VLAN's ID. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].wireguard` **(deprecated)** | `object` | no | Wireguard specific configuration. Includes things like private key, listen port, peers. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].wireguard.firewallMark` **(deprecated)** | `integer` | no | Specifies a device's firewall mark. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].wireguard.listenPort` **(deprecated)** | `integer` | no | Specifies a device's listening port. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].wireguard.peers` **(deprecated)** | `[]object` | no | Specifies a list of peer configurations to apply to a device. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].wireguard.peers[].allowedIPs` **(deprecated)** | `[]string` | no | AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].wireguard.peers[].endpoint` **(deprecated)** | `string` | no | Specifies the endpoint of this peer entry. |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].wireguard.peers[].persistentKeepaliveInterval` **(deprecated)** | `string` | no | Specifies the persistent keepalive interval for this peer. Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). |
| `spec.cni.custom.documents[].config.machine.network.interfaces[].wireguard.peers[].publicKey` **(deprecated)** | `string` | no | Specifies the public key of this peer. Can be extracted from private key by running `wg pubkey \< private.key > public.key && cat public.key`. |
| `spec.cni.custom.documents[].config.machine.network.kubespan` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `KubeSpanConfig` document instead. |
| `spec.cni.custom.documents[].config.machine.network.kubespan.advertiseKubernetesNetworks` **(deprecated)** | `boolean` | no | Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node. If disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel, and KubeSpan handles the node-to-node traffic. If enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly. When enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which is not always the case with CNIs not relying on Kubernetes for IPAM. |
| `spec.cni.custom.documents[].config.machine.network.kubespan.allowDownPeerBypass` **(deprecated)** | `boolean` | no | Skip sending traffic via KubeSpan if the peer connection state is not up. This provides configurable choice between connectivity and security: either traffic is always forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly to the peer if Wireguard connection can't be established. |
| `spec.cni.custom.documents[].config.machine.network.kubespan.enabled` **(deprecated)** | `boolean` | no | Enable the KubeSpan feature. Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled. |
| `spec.cni.custom.documents[].config.machine.network.kubespan.filters` **(deprecated)** | `object` | no | KubeSpan advanced filtering of network addresses . Settings in this section are optional, and settings apply only to the node. |
| `spec.cni.custom.documents[].config.machine.network.kubespan.filters.endpoints` **(deprecated)** | `[]string` | no | Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections. By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works. Default value: no filtering. |
| `spec.cni.custom.documents[].config.machine.network.kubespan.filters.excludeAdvertisedNetworks` **(deprecated)** | `[]string` | no | Filter networks (e.g., host addresses, pod CIDRs if enabled) which will be advertised over KubeSpan. By default, all networks are advertised. Use this filter to exclude some networks from being advertised. Note: excluded networks will not be reachable over KubeSpan, so make sure these networks are still reachable via some other route (e.g., direct connection). Default value: no filtering. |
| `spec.cni.custom.documents[].config.machine.network.kubespan.harvestExtraEndpoints` **(deprecated)** | `boolean` | no | KubeSpan can collect and publish extra endpoints for each member of the cluster based on Wireguard endpoint information for each peer. This feature is disabled by default, don't enable it with high number of peers (>50) in the KubeSpan network (performance issues). |
| `spec.cni.custom.documents[].config.machine.network.kubespan.mtu` **(deprecated)** | `integer` | no | KubeSpan link MTU size. Default value is 1420. |
| `spec.cni.custom.documents[].config.machine.network.nameservers` **(deprecated)** | `[]string` | no | docgen:nodoc Deprecated: Use `ResolverConfig` instead. |
| `spec.cni.custom.documents[].config.machine.network.searchDomains` **(deprecated)** | `[]string` | no | docgen:nodoc Deprecated: Use `ResolverConfig` instead. |
| `spec.cni.custom.documents[].config.machine.nodeAnnotations` **(deprecated)** | `map[string]string` | no | docgen:nodoc Deprecated: use `KubeNodeConfig` instead. |
| `spec.cni.custom.documents[].config.machine.nodeLabels` **(deprecated)** | `map[string]string` | no | docgen:nodoc Deprecated: use `KubeNodeConfig` instead. |
| `spec.cni.custom.documents[].config.machine.nodeTaints` **(deprecated)** | `map[string]string` | no | docgen:nodoc Deprecated: use `KubeNodeConfig` instead. |
| `spec.cni.custom.documents[].config.machine.registries` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `Registry*Config` instead. |
| `spec.cni.custom.documents[].config.machine.registries.config` **(deprecated)** | `map[string]object` | no | Specifies TLS & auth configuration for HTTPS image registries. Mutual TLS can be enabled with 'clientIdentity' option. The full hostname and port (if not using a default port 443) should be used as the key. The fallback key `*` can't be used for TLS configuration. TLS configuration can be skipped if registry has trusted server certificate. |
| `spec.cni.custom.documents[].config.machine.registries.config.<key>.auth` **(deprecated)** | `object` | no | The auth configuration for this registry. Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot. |
| `spec.cni.custom.documents[].config.machine.registries.config.<key>.auth.username` **(deprecated)** | `string` | no | Optional registry authentication. The meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication). |
| `spec.cni.custom.documents[].config.machine.registries.config.<key>.tls` **(deprecated)** | `object` | no | The TLS configuration for the registry. |
| `spec.cni.custom.documents[].config.machine.registries.config.<key>.tls.ca` **(deprecated)** | `string (byte)` | no | CA registry certificate to add the list of trusted certificates. Certificate should be base64-encoded. |
| `spec.cni.custom.documents[].config.machine.registries.config.<key>.tls.clientIdentity` **(deprecated)** | `object` | no | Enable mutual TLS authentication with the registry. Client certificate and key should be base64-encoded. |
| `spec.cni.custom.documents[].config.machine.registries.config.<key>.tls.clientIdentity.crt` **(deprecated)** | `string (byte)` | yes |  |
| `spec.cni.custom.documents[].config.machine.registries.config.<key>.tls.clientIdentity.key` **(deprecated)** | `string (byte)` | yes |  |
| `spec.cni.custom.documents[].config.machine.registries.config.<key>.tls.insecureSkipVerify` **(deprecated)** | `boolean` | no | Skip TLS server certificate verification (not recommended). |
| `spec.cni.custom.documents[].config.machine.registries.mirrors` **(deprecated)** | `map[string]object` | no | Specifies mirror configuration for each registry host namespace. This setting allows to configure local pull-through caching registires, air-gapped installations, etc. For example, when pulling an image with the reference `example.com:123/image:v1`, the `example.com:123` key will be used to lookup the mirror configuration. Optionally the `*` key can be used to configure a fallback mirror. Registry name is the first segment of image identifier, with 'docker.io' being default one. |
| `spec.cni.custom.documents[].config.machine.registries.mirrors.<key>.endpoints` **(deprecated)** | `[]string` | yes | List of endpoints (URLs) for registry mirrors to use. Endpoint configures HTTP/HTTPS access mode, host name, port and path (if path is not set, it defaults to `/v2`). |
| `spec.cni.custom.documents[].config.machine.registries.mirrors.<key>.overridePath` **(deprecated)** | `boolean` | no | Use the exact path specified for the endpoint (don't append /v2/). This setting is often required for setting up multiple mirrors on a single instance of a registry. |
| `spec.cni.custom.documents[].config.machine.registries.mirrors.<key>.skipFallback` **(deprecated)** | `boolean` | no | Skip fallback to the upstream endpoint, for example the mirror configuration for `docker.io` will not fallback to `registry-1.docker.io`. |
| `spec.cni.custom.documents[].config.machine.seccompProfiles` **(deprecated)** | `[]object` | no | Configures the seccomp profiles for the machine. |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].name` **(deprecated)** | `string` | yes | The `name` field is used to provide the file name of the seccomp profile. |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value` **(deprecated)** | `object` | yes | The `value` field is used to provide the seccomp profile. |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.architectures` **(deprecated)** | `[]string` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.defaultAction` **(deprecated)** | `string` | yes | LinuxSeccompAction taken upon Seccomp rule match |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.defaultErrnoRet` **(deprecated)** | `integer` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.flags` **(deprecated)** | `[]string` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.listenerMetadata` **(deprecated)** | `string` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.listenerPath` **(deprecated)** | `string` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls` **(deprecated)** | `[]object` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls[].action` **(deprecated)** | `string` | yes | LinuxSeccompAction taken upon Seccomp rule match |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls[].args` **(deprecated)** | `[]object` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls[].args[].index` **(deprecated)** | `integer` | yes |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls[].args[].op` **(deprecated)** | `string` | yes | LinuxSeccompOperator used to match syscall arguments in Seccomp |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls[].args[].value` **(deprecated)** | `integer` | yes |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls[].args[].valueTwo` **(deprecated)** | `integer` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls[].errnoRet` **(deprecated)** | `integer` | no |  |
| `spec.cni.custom.documents[].config.machine.seccompProfiles[].value.syscalls[].names` **(deprecated)** | `[]string` | yes |  |
| `spec.cni.custom.documents[].config.machine.sysctls` **(deprecated)** | `map[string]string` | no | docgen:nodoc Deprecated: Use 'SysctlConfig' instead. |
| `spec.cni.custom.documents[].config.machine.sysfs` **(deprecated)** | `map[string]string` | no | docgen:nodoc Deprecated: Use 'SysfsConfig' instead. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use `VolumeConfig` instead. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral` **(deprecated)** | `object` | no | Ephemeral partition encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.blockSize` **(deprecated)** | `integer` | no | Defines the encryption sector size. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.cipher` **(deprecated)** | `string` | no | Cipher kind to use for the encryption. Depends on the encryption provider. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.keySize` **(deprecated)** | `integer` | no | Defines the encryption key length. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.keys` **(deprecated)** | `[]object` | yes | Defines the encryption keys generation and storage method. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.keys[].kms` **(deprecated)** | `object` | no | KMS managed encryption key. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.keys[].kms.endpoint` **(deprecated)** | `string` | yes | KMS endpoint to Seal/Unseal the key. The endpoint should be specified as a URL with an explicit scheme, e.g. `https://kms.example.com:4443`. With the `https://` scheme, the connection to the KMS server is established over TLS, and the server certificate is verified against the trusted root CAs. WARNING: if the scheme is omitted (e.g. `kms.example.com:4443`) or set to `grpc://`, the connection to the KMS server is established without TLS, and the disk encryption key material is transmitted in plaintext. Use plaintext endpoints only on fully trusted networks. Note: when encrypting the `STATE` volume, custom trusted root CAs from the machine configuration might not be available when unlocking the volume (as the machine configuration is stored on `STATE`), so the KMS server certificate should be signed by a CA trusted by default. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.keys[].nodeID` **(deprecated)** | `object` | no | Deterministically generated key from the node UUID and PartitionLabel. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.keys[].slot` **(deprecated)** | `integer` | yes | Key slot number for LUKS2 encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.keys[].tpm` **(deprecated)** | `object` | no | Enable TPM based disk encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.keys[].tpm.checkSecurebootStatusOnEnroll` **(deprecated)** | `boolean` | no | Check that Secureboot is enabled in the EFI firmware. If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.options` **(deprecated)** | `[]string` | no | Additional --perf parameters for the LUKS2 encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.ephemeral.provider` **(deprecated)** | `string` | yes | Encryption provider to use for the encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state` **(deprecated)** | `object` | no | State partition encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.blockSize` **(deprecated)** | `integer` | no | Defines the encryption sector size. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.cipher` **(deprecated)** | `string` | no | Cipher kind to use for the encryption. Depends on the encryption provider. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.keySize` **(deprecated)** | `integer` | no | Defines the encryption key length. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.keys` **(deprecated)** | `[]object` | yes | Defines the encryption keys generation and storage method. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.keys[].kms` **(deprecated)** | `object` | no | KMS managed encryption key. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.keys[].kms.endpoint` **(deprecated)** | `string` | yes | KMS endpoint to Seal/Unseal the key. The endpoint should be specified as a URL with an explicit scheme, e.g. `https://kms.example.com:4443`. With the `https://` scheme, the connection to the KMS server is established over TLS, and the server certificate is verified against the trusted root CAs. WARNING: if the scheme is omitted (e.g. `kms.example.com:4443`) or set to `grpc://`, the connection to the KMS server is established without TLS, and the disk encryption key material is transmitted in plaintext. Use plaintext endpoints only on fully trusted networks. Note: when encrypting the `STATE` volume, custom trusted root CAs from the machine configuration might not be available when unlocking the volume (as the machine configuration is stored on `STATE`), so the KMS server certificate should be signed by a CA trusted by default. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.keys[].nodeID` **(deprecated)** | `object` | no | Deterministically generated key from the node UUID and PartitionLabel. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.keys[].slot` **(deprecated)** | `integer` | yes | Key slot number for LUKS2 encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.keys[].tpm` **(deprecated)** | `object` | no | Enable TPM based disk encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.keys[].tpm.checkSecurebootStatusOnEnroll` **(deprecated)** | `boolean` | no | Check that Secureboot is enabled in the EFI firmware. If Secureboot is not enabled, the enrollment of the key will fail. As the TPM key is anyways bound to the value of PCR 7, changing Secureboot status or configuration after the initial enrollment will make the key unusable. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.options` **(deprecated)** | `[]string` | no | Additional --perf parameters for the LUKS2 encryption. |
| `spec.cni.custom.documents[].config.machine.systemDiskEncryption.state.provider` **(deprecated)** | `string` | yes | Encryption provider to use for the encryption. |
| `spec.cni.custom.documents[].config.machine.time` **(deprecated)** | `object` | no | docgen:nodoc Deprecated: Use 'TimeSyncConfig' instead. |
| `spec.cni.custom.documents[].config.machine.time.bootTimeout` **(deprecated)** | `string` | no | Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. NTP sync will be still running in the background. Defaults to "infinity" (waiting forever for time sync) |
| `spec.cni.custom.documents[].config.machine.time.disabled` **(deprecated)** | `boolean` | no | Indicates if the time service is disabled for the machine. Defaults to `false`. |
| `spec.cni.custom.documents[].config.machine.time.servers` **(deprecated)** | `[]string` | no | Specifies time (NTP) servers to use for setting the system time. Defaults to `time.cloudflare.com`. Talos can also sync to the PTP time source (e.g provided by the hypervisor), provide the path to the PTP device as "/dev/ptp0" or "/dev/ptp_kvm". |
| `spec.cni.custom.documents[].config.machine.type` **(deprecated)** | `string` | no | Defines the role of the machine within the cluster. **Control Plane** Control Plane node type designates the node as a control plane member. This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler. **Worker** Worker node type designates the node as a worker node. This means it will be an available compute node for scheduling workloads. This node type was previously known as "join"; that value is still supported but deprecated. |
| `spec.cni.custom.documents[].config.machine.udev` **(deprecated)** | `object` | no | Configures the udev system. |
| `spec.cni.custom.documents[].config.machine.udev.rules` **(deprecated)** | `[]string` | no | List of udev rules to apply to the udev system |
| `spec.cni.custom.documents[].config.persist` **(deprecated)** | `boolean` | no | docgen:nodoc Deprecated: Not supported anymore. |
| `spec.cni.custom.documents[].config.version` **(deprecated)** | `string` | yes | Indicates the schema used to decode the contents. |
| `spec.cni.custom.documents[].kernelModuleConfig` **(deprecated)** | `object` | no | kernelModuleConfig is a Talos KernelModuleConfig document; populated when kind is "KernelModuleConfig". |
| `spec.cni.custom.documents[].kernelModuleConfig.name` **(deprecated)** | `string` | yes | Module name. |
| `spec.cni.custom.documents[].kernelModuleConfig.parameters` **(deprecated)** | `[]string` | no | Module parameters, changes applied after reboot. |
| `spec.cni.custom.documents[].kind` **(deprecated)** | `string` | yes | kind selects which of the fields below is populated. Allowed values: `SysctlConfig`, `KernelModuleConfig`, `Config`, `VolumeConfig`, `UserVolumeConfig`, `RawVolumeConfig`. |
| `spec.cni.custom.documents[].rawVolumeConfig` **(deprecated)** | `object` | no | rawVolumeConfig is a Talos RawVolumeConfig document (an unformatted partition for a CSI provisioner); populated when kind is "RawVolumeConfig". |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption` **(deprecated)** | `object` | no | The encryption describes how the volume is encrypted. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.allowDiscards` **(deprecated)** | `boolean` | no | Allow TRIM/discard requests to be passed through to the underlying device when the encrypted volume is opened. Defaults to false. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.blockSize` **(deprecated)** | `integer` | no | Defines the encryption sector size. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.cipher` **(deprecated)** | `string` | no | Cipher to use for the encryption. Depends on the encryption provider. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keySize` **(deprecated)** | `integer` | no | Defines the encryption key length. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys` **(deprecated)** | `[]object` | yes | Defines the encryption keys generation and storage method. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].kms` **(deprecated)** | `object` | no | EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].kms.endpoint` **(deprecated)** | `string` | yes |  |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].lockToState` **(deprecated)** | `boolean` | no |  |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].nodeID` **(deprecated)** | `object` | no | EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].slot` **(deprecated)** | `integer` | yes |  |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].tpm` **(deprecated)** | `object` | no | EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].tpm.checkSecurebootStatusOnEnroll` **(deprecated)** | `boolean` | no |  |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].tpm.options` **(deprecated)** | `object` | no | EncryptionKeyTPMOptions represents the options for TPM-based key protection. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.keys[].tpm.options.pcrs` **(deprecated)** | `[]integer` | no | List of PCRs to bind the key to. If not set, defaults to PCR 7, can be disabled by passing an empty list. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.options` **(deprecated)** | `[]string` | no | Additional --perf parameters for the LUKS2 encryption. |
| `spec.cni.custom.documents[].rawVolumeConfig.encryption.provider` **(deprecated)** | `string` | yes | Encryption provider to use for the encryption. |
| `spec.cni.custom.documents[].rawVolumeConfig.name` **(deprecated)** | `string` | yes | Name of the volume. Name might be between 1 and 34 characters long and can only contain: lowercase and uppercase ASCII letters, digits, and hyphens. |
| `spec.cni.custom.documents[].rawVolumeConfig.provisioning` **(deprecated)** | `object` | no | The provisioning describes how the volume is provisioned. |
| `spec.cni.custom.documents[].rawVolumeConfig.provisioning.diskSelector` **(deprecated)** | `object` | no | The disk selector expression. |
| `spec.cni.custom.documents[].rawVolumeConfig.provisioning.diskSelector.match` **(deprecated)** | `string` | no | The Common Expression Language (CEL) expression to match the disk. |
| `spec.cni.custom.documents[].rawVolumeConfig.provisioning.grow` **(deprecated)** | `boolean` | no | Should the volume grow to the size of the disk (if possible). |
| `spec.cni.custom.documents[].rawVolumeConfig.provisioning.maxSize` **(deprecated)** | `string` | no | The maximum size of the volume, if not specified the volume can grow to the size of the disk. Size is specified in bytes or in percents. It can be expressed in human readable format, e.g. 100MB. |
| `spec.cni.custom.documents[].rawVolumeConfig.provisioning.minSize` **(deprecated)** | `string` | no | The minimum size of the volume. Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB. |
| `spec.cni.custom.documents[].sysctlConfig` **(deprecated)** | `object` | no | sysctlConfig is a Talos SysctlConfig document; populated when kind is "SysctlConfig". |
| `spec.cni.custom.documents[].sysctlConfig.params` **(deprecated)** | `map[string]string` | yes | Used to configure the machine's sysctls (kernel parameters under `/proc/sys`). Values from this document are merged with the deprecated v1alpha1 machine.sysctls values (if set), with this document taking precedence on key conflicts. |
| `spec.cni.custom.documents[].userVolumeConfig` **(deprecated)** | `object` | no | userVolumeConfig is a Talos UserVolumeConfig document; populated when kind is "UserVolumeConfig". |
| `spec.cni.custom.documents[].userVolumeConfig.encryption` **(deprecated)** | `object` | no | The encryption describes how the volume is encrypted. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.allowDiscards` **(deprecated)** | `boolean` | no | Allow TRIM/discard requests to be passed through to the underlying device when the encrypted volume is opened. Defaults to false. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.blockSize` **(deprecated)** | `integer` | no | Defines the encryption sector size. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.cipher` **(deprecated)** | `string` | no | Cipher to use for the encryption. Depends on the encryption provider. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keySize` **(deprecated)** | `integer` | no | Defines the encryption key length. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys` **(deprecated)** | `[]object` | yes | Defines the encryption keys generation and storage method. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].kms` **(deprecated)** | `object` | no | EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].kms.endpoint` **(deprecated)** | `string` | yes |  |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].lockToState` **(deprecated)** | `boolean` | no |  |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].nodeID` **(deprecated)** | `object` | no | EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].slot` **(deprecated)** | `integer` | yes |  |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].tpm` **(deprecated)** | `object` | no | EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].tpm.checkSecurebootStatusOnEnroll` **(deprecated)** | `boolean` | no |  |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].tpm.options` **(deprecated)** | `object` | no | EncryptionKeyTPMOptions represents the options for TPM-based key protection. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.keys[].tpm.options.pcrs` **(deprecated)** | `[]integer` | no | List of PCRs to bind the key to. If not set, defaults to PCR 7, can be disabled by passing an empty list. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.options` **(deprecated)** | `[]string` | no | Additional --perf parameters for the LUKS2 encryption. |
| `spec.cni.custom.documents[].userVolumeConfig.encryption.provider` **(deprecated)** | `string` | yes | Encryption provider to use for the encryption. |
| `spec.cni.custom.documents[].userVolumeConfig.filesystem` **(deprecated)** | `object` | no | The filesystem describes how the volume is formatted. |
| `spec.cni.custom.documents[].userVolumeConfig.filesystem.projectQuotaSupport` **(deprecated)** | `boolean` | no | Enables project quota support, valid only for 'xfs' filesystem. Note: changing this value might require a full remount of the filesystem. |
| `spec.cni.custom.documents[].userVolumeConfig.filesystem.type` **(deprecated)** | `string` | no | Filesystem type. Default is `xfs`. |
| `spec.cni.custom.documents[].userVolumeConfig.filesystem.xfs` **(deprecated)** | `object` | no | XFS-specific filesystem options, valid only for 'xfs' filesystem. |
| `spec.cni.custom.documents[].userVolumeConfig.filesystem.xfs.minAllocationGroupSize` **(deprecated)** | `string` | no | The minimum size of an XFS allocation group. On non-rotational devices `mkfs.xfs` sizes the allocation group count to the number of CPUs, which on machines with many cores and a modest disk yields hundreds of tiny allocation groups. Talos bounds the allocation group size from below to keep the geometry sane; this option overrides that bound. Set to zero to use the `mkfs.xfs` defaults unchanged. Note: this only affects volumes at the time they are formatted. Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB. |
| `spec.cni.custom.documents[].userVolumeConfig.mount` **(deprecated)** | `object` | no | The mount describes additional mount options. |
| `spec.cni.custom.documents[].userVolumeConfig.mount.disableAccessTime` **(deprecated)** | `boolean` | no | If true, disable file access time updates. |
| `spec.cni.custom.documents[].userVolumeConfig.mount.secure` **(deprecated)** | `boolean` | no | Enable secure mount options (nosuid, nodev, noexec). Defaults to true for better security. |
| `spec.cni.custom.documents[].userVolumeConfig.name` **(deprecated)** | `string` | yes | Name of the volume. Name might be between 1 and 34 characters long and can only contain: lowercase and uppercase ASCII letters, digits, and hyphens. |
| `spec.cni.custom.documents[].userVolumeConfig.provisioning` **(deprecated)** | `object` | no | The provisioning describes how the volume is provisioned. |
| `spec.cni.custom.documents[].userVolumeConfig.provisioning.diskSelector` **(deprecated)** | `object` | no | The disk selector expression. |
| `spec.cni.custom.documents[].userVolumeConfig.provisioning.diskSelector.match` **(deprecated)** | `string` | no | The Common Expression Language (CEL) expression to match the disk. |
| `spec.cni.custom.documents[].userVolumeConfig.provisioning.grow` **(deprecated)** | `boolean` | no | Should the volume grow to the size of the disk (if possible). |
| `spec.cni.custom.documents[].userVolumeConfig.provisioning.maxSize` **(deprecated)** | `string` | no | The maximum size of the volume, if not specified the volume can grow to the size of the disk. Size is specified in bytes or in percents. It can be expressed in human readable format, e.g. 100MB. |
| `spec.cni.custom.documents[].userVolumeConfig.provisioning.minSize` **(deprecated)** | `string` | no | The minimum size of the volume. Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB. |
| `spec.cni.custom.documents[].userVolumeConfig.scrub` **(deprecated)** | `object` | no | The scrub describes the per-volume filesystem scrub configuration. |
| `spec.cni.custom.documents[].userVolumeConfig.scrub.enabled` **(deprecated)** | `boolean` | no | Enable or disable scrubbing for this volume. If not set, scrubbing is enabled by default when scrub section is present. |
| `spec.cni.custom.documents[].userVolumeConfig.scrub.interval` **(deprecated)** | `string` | no | The interval at which the volume is scrubbed, overriding the global scrub interval. |
| `spec.cni.custom.documents[].userVolumeConfig.trim` **(deprecated)** | `object` | no | The trim describes the per-volume filesystem trim (fstrim) configuration. |
| `spec.cni.custom.documents[].userVolumeConfig.trim.enabled` **(deprecated)** | `boolean` | no | Enable or disable trimming for this volume. If not set, trimming is enabled when the global FilesystemTrimConfig is present. |
| `spec.cni.custom.documents[].userVolumeConfig.trim.interval` **(deprecated)** | `string` | no | The interval at which the volume is trimmed, overriding the global trim interval. |
| `spec.cni.custom.documents[].userVolumeConfig.volumeType` **(deprecated)** | `string` | no | Volume type. |
| `spec.cni.custom.documents[].volumeConfig` **(deprecated)** | `object` | no | volumeConfig is a Talos VolumeConfig document (a system volume, e.g. STATE or EPHEMERAL, placed on its own disk); populated when kind is "VolumeConfig". |
| `spec.cni.custom.documents[].volumeConfig.encryption` **(deprecated)** | `object` | no | The encryption describes how the volume is encrypted. |
| `spec.cni.custom.documents[].volumeConfig.encryption.allowDiscards` **(deprecated)** | `boolean` | no | Allow TRIM/discard requests to be passed through to the underlying device when the encrypted volume is opened. Defaults to false. |
| `spec.cni.custom.documents[].volumeConfig.encryption.blockSize` **(deprecated)** | `integer` | no | Defines the encryption sector size. |
| `spec.cni.custom.documents[].volumeConfig.encryption.cipher` **(deprecated)** | `string` | no | Cipher to use for the encryption. Depends on the encryption provider. |
| `spec.cni.custom.documents[].volumeConfig.encryption.keySize` **(deprecated)** | `integer` | no | Defines the encryption key length. |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys` **(deprecated)** | `[]object` | yes | Defines the encryption keys generation and storage method. |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].kms` **(deprecated)** | `object` | no | EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server. |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].kms.endpoint` **(deprecated)** | `string` | yes |  |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].lockToState` **(deprecated)** | `boolean` | no |  |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].nodeID` **(deprecated)** | `object` | no | EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].slot` **(deprecated)** | `integer` | yes |  |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].tpm` **(deprecated)** | `object` | no | EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM. |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].tpm.checkSecurebootStatusOnEnroll` **(deprecated)** | `boolean` | no |  |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].tpm.options` **(deprecated)** | `object` | no | EncryptionKeyTPMOptions represents the options for TPM-based key protection. |
| `spec.cni.custom.documents[].volumeConfig.encryption.keys[].tpm.options.pcrs` **(deprecated)** | `[]integer` | no | List of PCRs to bind the key to. If not set, defaults to PCR 7, can be disabled by passing an empty list. |
| `spec.cni.custom.documents[].volumeConfig.encryption.options` **(deprecated)** | `[]string` | no | Additional --perf parameters for the LUKS2 encryption. |
| `spec.cni.custom.documents[].volumeConfig.encryption.provider` **(deprecated)** | `string` | yes | Encryption provider to use for the encryption. |
| `spec.cni.custom.documents[].volumeConfig.filesystem` **(deprecated)** | `object` | no | The filesystem describes how the volume is formatted. Note: this only takes effect at the time the volume is formatted. |
| `spec.cni.custom.documents[].volumeConfig.filesystem.xfs` **(deprecated)** | `object` | no | XFS-specific filesystem options. |
| `spec.cni.custom.documents[].volumeConfig.filesystem.xfs.minAllocationGroupSize` **(deprecated)** | `string` | no | The minimum size of an XFS allocation group. On non-rotational devices `mkfs.xfs` sizes the allocation group count to the number of CPUs, which on machines with many cores and a modest disk yields hundreds of tiny allocation groups. Talos bounds the allocation group size from below to keep the geometry sane; this option overrides that bound. Set to zero to use the `mkfs.xfs` defaults unchanged. Note: this only affects volumes at the time they are formatted. Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB. |
| `spec.cni.custom.documents[].volumeConfig.mount` **(deprecated)** | `object` | no | The mount describes additional mount options. |
| `spec.cni.custom.documents[].volumeConfig.mount.disableAccessTime` **(deprecated)** | `boolean` | no | If true, disable file access time updates. Supported only for EPHEMERAL volume. |
| `spec.cni.custom.documents[].volumeConfig.mount.secure` **(deprecated)** | `boolean` | no | Enable secure mount options (nosuid, nodev). For dedicated ETCD and LOG volumes, this also enables noexec. Defaults to true for better security. Supported for EPHEMERAL and dedicated ETCD, CRI, KUBELET and LOG volumes. |
| `spec.cni.custom.documents[].volumeConfig.name` **(deprecated)** | `string` | yes | Name of the volume. |
| `spec.cni.custom.documents[].volumeConfig.provisioning` **(deprecated)** | `object` | no | The provisioning describes how the volume is provisioned. |
| `spec.cni.custom.documents[].volumeConfig.provisioning.diskSelector` **(deprecated)** | `object` | no | The disk selector expression. |
| `spec.cni.custom.documents[].volumeConfig.provisioning.diskSelector.match` **(deprecated)** | `string` | no | The Common Expression Language (CEL) expression to match the disk. |
| `spec.cni.custom.documents[].volumeConfig.provisioning.grow` **(deprecated)** | `boolean` | no | Should the volume grow to the size of the disk (if possible). |
| `spec.cni.custom.documents[].volumeConfig.provisioning.maxSize` **(deprecated)** | `string` | no | The maximum size of the volume, if not specified the volume can grow to the size of the disk. Size is specified in bytes or in percents. It can be expressed in human readable format, e.g. 100MB. |
| `spec.cni.custom.documents[].volumeConfig.provisioning.minSize` **(deprecated)** | `string` | no | The minimum size of the volume. Size is specified in bytes, but can be expressed in human readable format, e.g. 100MB. |
| `spec.cni.custom.documents[].volumeConfig.scrub` **(deprecated)** | `object` | no | The scrub describes the per-volume filesystem scrub configuration. |
| `spec.cni.custom.documents[].volumeConfig.scrub.enabled` **(deprecated)** | `boolean` | no | Enable or disable scrubbing for this volume. If not set, scrubbing is enabled by default when scrub section is present. |
| `spec.cni.custom.documents[].volumeConfig.scrub.interval` **(deprecated)** | `string` | no | The interval at which the volume is scrubbed, overriding the global scrub interval. |
| `spec.cni.custom.documents[].volumeConfig.trim` **(deprecated)** | `object` | no | The trim describes the per-volume filesystem trim (fstrim) configuration. |
| `spec.cni.custom.documents[].volumeConfig.trim.enabled` **(deprecated)** | `boolean` | no | Enable or disable trimming for this volume. If not set, trimming is enabled when the global FilesystemTrimConfig is present. |
| `spec.cni.custom.documents[].volumeConfig.trim.interval` **(deprecated)** | `string` | no | The interval at which the volume is trimmed, overriding the global trim interval. |
| `spec.cni.custom.source` **(deprecated)** | `object` | yes | source points Argo CD at the chart or manifests for this CNI. |
| `spec.cni.custom.source.chart` **(deprecated)** | `string` | no | chart is a Helm chart name within repoURL; set instead of path. |
| `spec.cni.custom.source.path` **(deprecated)** | `string` | no | path is a directory within repoURL holding plain manifests; set instead of chart. |
| `spec.cni.custom.source.repoURL` **(deprecated)** | `string` | yes | repoURL is the Git or Helm repository Argo CD syncs from. |
| `spec.cni.custom.source.targetRevision` **(deprecated)** | `string` | yes | targetRevision is the Git ref or chart version Argo CD syncs. |
| `spec.cni.kubeProxy` | `string` | no | kubeProxy is enabled (Talos's own default) or replaced by the CNI. Replacing it splits the setting across two owners -- Talos (cluster.proxy.disabled, written by Ichor) and the CNI (written by Argo CD) -- so a consistency check reads the CNI's live configuration and reports a mismatch as a health failure. Allowed values: `enabled`, `replaced`. Default: `"enabled"`. |
| `spec.cni.preset` **(deprecated)** | `string` | no | preset selects the CNI this cluster bootstraps. Cilium is the only CNI Ichor installs; unmanaged leaves the CNI of an adopted cluster exactly as it is, and the webhook accepts it on create only for an object carrying the adoption annotation. The values flannel and custom are deprecated, unused and kept so the CRD never drops a value. Allowed values: `flannel`, `cilium`, `custom`, `unmanaged`. Default: `"cilium"`. |
| `spec.cni.tunnel` | `string` | no | tunnel is Cilium's tunnel protocol. It only applies to the cilium preset; empty means Cilium's default (vxlan). Immutable once set. Allowed values: `vxlan`, `geneve`. |
| `spec.cni.unmanaged` | `object` | no | unmanaged configures the unmanaged preset. Only valid when preset is unmanaged; when omitted there, talosCNI is default. |
| `spec.cni.unmanaged.talosCNI` | `string` | no | talosCNI is default (the machine config has no CNI selection, so Talos runs its own flannel or whatever cluster.network.cni selects by default; render emits nothing about the CNI) or none (render emits cluster.network.cni.name: none). Allowed values: `default`, `none`. Default: `"default"`. |
| `spec.controlPlane` | `object` | yes | controlPlane configures the control-plane topology. |
| `spec.controlPlane.count` | `integer` | yes | count is the number of control-plane nodes; 2 and 4 are rejected because they don't improve etcd availability over 1 or 3. Allowed values: `1`, `3`, `5`. |
| `spec.controlPlane.schedulable` | `string` | yes | schedulable controls whether control planes accept workloads; required with no default because nothing on the object can resolve an auto value before any machine exists. Allowed values: `true`, `false`. |
| `spec.controlPlaneMetrics` | `object` | no | controlPlaneMetrics exposes the control-plane metrics Talos binds locally and restricts scraping to a CIDR. Unset (the default) leaves the Talos defaults alone. |
| `spec.controlPlaneMetrics.allowedCIDRs` | `[]string` | no | allowedCIDRs are the only sources that may reach the metrics ports (TCP 10257, 10259 and 2381) on control-plane nodes. Every other port keeps Talos's default firewall action (accept). A prefix length of 0 is rejected: that would be no restriction at all. |
| `spec.controlPlaneMetrics.enabled` | `boolean` | no | enabled binds the metrics endpoints on all addresses and adds ingress firewall rules that drop connections to those ports from any source outside allowedCIDRs. Default: `false`. |
| `spec.discovery` | `object` | no | discovery lists maintenance-mode candidates for the controller to probe directly. Empty (the default) disables discovery: the controller opens no connection at all. |
| `spec.discovery.addresses` | `[]string` | no | addresses are specific IPv4 candidates to probe, each on Talos's fixed maintenance API port. |
| `spec.discovery.cidrs` | `[]string` | no | cidrs are IPv4 address ranges to probe, one maintenance-mode connection attempt per address in range. Each must be /24 or smaller (at most 256 addresses). |
| `spec.driftPolicy` | `string` | no | driftPolicy controls what the reconciler does when a node's live configuration no longer matches what Ichor last rendered for it, and nothing on Ichor's side (this TalosCluster, a TalosConfigPatch, or the TalosMachine) has changed since Ichor last confirmed the two matched: warnOnly leaves the node as it is and reports the drift through a condition; autoCorrect re-applies, but only when every changed field is reboot-free (pkg/fieldmeta) -- a reboot-requiring or install-time-only drift is always just reported, regardless of this setting. Defaults to warnOnly: unlike controlPlane.schedulable, the two values here are not wrong half the time each -- silently changing a node is the one that can surprise, so it is never the default. The CRD carries no default: the defaulting webhook fills warnOnly, or the installation's spec.defaults.driftPolicy, at create; an empty value is warnOnly. Allowed values: `warnOnly`, `autoCorrect`. |
| `spec.endpoint` | `object` | yes | endpoint is the cluster's control-plane endpoint. |
| `spec.endpoint.address` | `string` | yes | address is the endpoint's address: an IP for vip/node, or a hostname for loadBalancer/dns. |
| `spec.endpoint.type` | `string` | yes | type is the kind of address the endpoint resolves through. Allowed values: `vip`, `loadBalancer`, `dns`, `node`. |
| `spec.kubernetesVersion` | `string` | yes | kubernetesVersion is the Kubernetes release this cluster runs. |
| `spec.network` | `object` | no | network sets the pod and service subnets. Unset keeps Talos's defaults. It cannot change once set. |
| `spec.network.podSubnets` | `[]string` | no | podSubnets are the pod CIDRs, at most one per IP family. |
| `spec.network.serviceSubnets` | `[]string` | no | serviceSubnets are the service CIDRs, at most one per IP family. |
| `spec.registries` | `[]object` | no | registries declares this cluster's private registry mirrors and where their pull credentials live, pushed to every node through the system layer (docs/design/architecture.md "Monitoring and registry mirrors"). Empty (the default) configures no mirrors at all -- mirrors stay entirely optional. listType=map on host (rather than a CEL uniqueness rule, same as status.conditions below) is what the structural schema itself rejects a duplicate host under -- a CEL self.exists_one rule over this list was tried first and rejected by envtest's apiserver: with MaxItems=32 its estimated cost exceeds the per-field budget by 32x (quadratic in list length), and still contributed enough to blow the whole-schema budget by 3.3x alongside this CRD's existing CEL rules. |
| `spec.registries[].authSecretRef` | `object` | no | authSecretRef names a Secret, read in the controller's own namespace (the same reasoning as secretsRef below: RBAC cannot scope a Secret read to "wherever this TalosCluster happens to live" below cluster-wide), holding this registry's password-shaped credentials. Unset means an anonymous mirror -- a public registry needing no credentials at all, not an error. Set but unresolvable (Secret missing, or present but carrying none of its three recognized keys) is: pkg/render.ResolveRegistryAuth fails the render rather than silently producing a mirror with no auth, since that would look identical to a working one until the first pull fails on the node. A corev1.LocalObjectReference, not a SecretKeySelector: machinery's RegistryAuthConfig carries three mutually-exclusive credential shapes (password, auth, identityToken, matching docker config.json's own auth forms) that one registry's credentials pick at most one of, so one reference to a Secret with those three well-known keys covers it -- same shape secretsRef already uses for bundleSecretKey, rather than three separate single-key selectors for a value that is, in practice, one secret. |
| `spec.registries[].authSecretRef.name` | `string` | no | Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`. |
| `spec.registries[].endpoints` | `[]string` | yes | endpoints are the mirror endpoint URLs for host (RegistryMirrorConfig.endpoints) -- not secret, so they stay a plain typed field here rather than behind a reference. Checked here, not left to machinery: pkg/machinery/config/types/v1alpha1's own ValidateAtRuntime has no validator at all for RegistryMirrorConfig/RegistryConfig, so an endpoint shaped wrong would otherwise reach a node's machine config unexamined, exactly the gap spec.discovery's own CEL above already closes for its addresses. |
| `spec.registries[].host` | `string` | yes | host is the registry host (and port, if not the default) this entry's mirror and credentials apply to, matching RegistriesConfig's own map key: the first segment of an image reference, "docker.io" being the default one, or "*" for a fallback mirror. TLS config (RegistryConfig.tls) uses the same key but never the "*" fallback; this field carries both mirror and auth, so "*" is only meaningful when authSecretRef is unset. |
| `spec.registries[].overridePath` | `boolean` | no | overridePath makes the nodes use every endpoint's path as given, without adding the /v2/ suffix (RegistryMirrorConfig.endpoints[].overridePath). It applies to all of this entry's endpoints; Talos allows it per endpoint, and a mix cannot be recorded here. |
| `spec.registries[].skipFallback` | `boolean` | no | skipFallback stops nodes falling back to host itself when none of the endpoints has the image (RegistryMirrorConfig.skipFallback). Default false, Talos's own default. |
| `spec.registries[].username` | `string` | no | username is this registry's non-secret auth username (RegistryAuthConfig.username). Optional: some private registries authenticate on password/token alone. |
| `spec.schematic` | `object` | no | schematic is the Image Factory schematic used for this cluster's installer image. |
| `spec.schematic.id` | `string` | yes | id is the Image Factory schematic ID. |
| `spec.secretsRef` | `object` | yes | secretsRef names the Secret holding the Talos, Kubernetes and etcd CA bundle. The Secret lives in the controller's own namespace (not necessarily this TalosCluster's), because Kubernetes RBAC cannot restrict Secret reads to "wherever the referencing TalosCluster happens to live" at anything narrower than cluster-wide. |
| `spec.secretsRef.name` | `string` | no | Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`. |
| `spec.security` | `object` | no | security holds opt-in hardening of this cluster: an ingress firewall, Cilium WireGuard encryption, Pod Security levels, an audit policy preset and disk encryption. Unset (the default) changes nothing. |
| `spec.security.audit` | `object` | no | audit selects a kube-apiserver audit policy preset. Restarts the kube-apiserver on every control plane, no node reboot. Needs versionContract v1.14 or later. |
| `spec.security.audit.policy` | `string` | yes | policy is the preset. metadata records who did what, without bodies, for every request (Talos's own default). rbacChanges is metadata plus the full request and response of changes to roles and bindings. writes is metadata plus the request body of every change. Secrets, configmaps, service account tokens and token reviews are never logged above metadata in any preset. Allowed values: `metadata`, `rbacChanges`, `writes`. |
| `spec.security.diskEncryption` | `object` | no | diskEncryption encrypts the STATE and EPHEMERAL volumes with LUKS2. Talos encrypts a volume only when it creates it, so on a cluster that already has machines it needs the wipe-and-rejoin path (see docs/guides/hardening.md) and the confirm annotation. |
| `spec.security.diskEncryption.kmsEndpoint` | `string` | no | kmsEndpoint is the KMS server, as a URL with a scheme (https://kms.example.com:4443). A scheme other than https is refused. |
| `spec.security.diskEncryption.requireSecureBoot` | `boolean` | no | requireSecureBoot makes enrolling a TPM key fail unless SecureBoot is enabled in the firmware. Without SecureBoot a TPM key gives no boot-chain protection. |
| `spec.security.diskEncryption.type` | `string` | yes | type is where the key comes from. tpm seals it in the machine's TPM 2.0 (bound to PCR 7); nodeID derives it from the node UUID, which protects only against a removed disk; kms has a KMS server seal and unseal it. Allowed values: `tpm`, `nodeID`, `kms`. |
| `spec.security.firewall` | `object` | no | firewall turns on Talos's ingress firewall in block mode with the rules a Talos cluster needs, plus the sources you list. No reboot. |
| `spec.security.firewall.allow` | `[]object` | no | allow opens further host ports, for services running with host networking (an ingress controller on 80 and 443, a node exporter). Everything not listed is blocked. |
| `spec.security.firewall.allow[].cidrs` | `[]string` | yes | cidrs are the sources allowed to reach the ports. |
| `spec.security.firewall.allow[].name` | `string` | yes | name identifies the rule; it becomes ichor-fw-allow-\<name> in the machine config. |
| `spec.security.firewall.allow[].ports` | `[]string` | yes | ports are single ports ("443") or inclusive ranges ("8000-8100"). |
| `spec.security.firewall.allow[].protocol` | `string` | yes | protocol is tcp or udp. Allowed values: `tcp`, `udp`. |
| `spec.security.firewall.apiServerCIDRs` | `[]string` | no | apiServerCIDRs are further sources allowed to reach the Kubernetes API (6443), for users and load balancers. |
| `spec.security.firewall.controlPlaneCIDRs` | `[]string` | no | controlPlaneCIDRs are the addresses of the control planes only; etcd and the control planes' own reach to apid and the kubelet are limited to them. Unset means nodeCIDRs. |
| `spec.security.firewall.controllerCIDRs` | `[]string` | no | controllerCIDRs are the addresses Ichor's controller connects from. They are always allowed to reach apid and the Kubernetes API. The admission webhook refuses a value that does not contain the address the controller reaches the cluster endpoint from. |
| `spec.security.firewall.enabled` | `boolean` | no | enabled turns the firewall on. Default: `false`. |
| `spec.security.firewall.kubeSpan` | `boolean` | no | kubeSpan allows KubeSpan's WireGuard port (UDP 51820) from anywhere; set it when the cluster uses KubeSpan. |
| `spec.security.firewall.nodeCIDRs` | `[]string` | no | nodeCIDRs are the addresses of all the cluster's machines, control planes and workers. |
| `spec.security.firewall.talosAPICIDRs` | `[]string` | no | talosAPICIDRs are further sources allowed to reach apid (50000), for operators using talosctl. |
| `spec.security.kernelLockdown` | `string` | no | kernelLockdown is the kernel lockdown level the nodes are expected to run with. Ichor checks it and reports a node below it; it does not render it, because the kernel command line is embedded in the UKI (build it into the boot asset with an Image Factory schematic whose extraKernelArgs has lockdown=confidentiality, and set spec.schematic). SecureBoot images run at integrity by themselves in Talos v1.14. Allowed values: `integrity`, `confidentiality`. |
| `spec.security.kubeletServingCertificates` | `object` | no | kubeletServingCertificates makes every kubelet serve a certificate signed by the Kubernetes CA instead of a self-signed one. Ichor's controller approves the kubelets' serving-certificate requests itself, for the machines it manages and nothing else. A kubelet restart on every node, no node reboot. |
| `spec.security.kubeletServingCertificates.enabled` | `boolean` | no | enabled turns serverTLSBootstrap on and the controller's approval of the requests on. Default: `false`. |
| `spec.security.kubeletServingCertificates.verifyFromAPIServer` | `boolean` | no | verifyFromAPIServer also makes the kube-apiserver check the kubelets' certificates against the Kubernetes CA (--kubelet-certificate-authority). Ichor renders it only once every machine has been issued a serving certificate (condition KubeletServingCertificates), and keeps it once rendered. It restarts the kube-apiserver on every control plane. Until then the apiserver does not verify the kubelets, as before. |
| `spec.security.podSecurity` | `object` | no | podSecurity sets the Pod Security admission levels of the kube-apiserver. Restarts the kube-apiserver on every control plane, no node reboot. Needs versionContract v1.14 or later. |
| `spec.security.podSecurity.audit` | `string` | no | audit is the level above which violations are recorded in the audit log. Allowed values: `privileged`, `baseline`, `restricted`. |
| `spec.security.podSecurity.enforce` | `string` | no | enforce is the level a pod must meet to be admitted. Allowed values: `privileged`, `baseline`, `restricted`. |
| `spec.security.podSecurity.exemptNamespaces` | `[]string` | no | exemptNamespaces are added to the exempt namespaces (kube-system stays exempt). |
| `spec.security.podSecurity.warn` | `string` | no | warn is the level above which violations produce a warning to the client. Allowed values: `privileged`, `baseline`, `restricted`. |
| `spec.security.secureBoot` | `object` | no | secureBoot asks for UEFI SecureBoot with Talos's UKI images. It picks the installer image variant and reports each node's actual state; it never changes an installed node, because Talos cannot convert a GRUB install and the firmware keys are not Talos's. |
| `spec.security.secureBoot.mode` | `string` | yes | mode is Off (the default: the stock installer, nothing reported), Preferred (Ichor uses the SecureBoot installer where it chooses one and reports nodes without SecureBoot) or Required (as Preferred, a TPM disk key must check SecureBoot, enabling it needs the confirm annotation while any approved machine lacks SecureBoot, and a machine in maintenance mode without SecureBoot is not given its first configuration). A node that already runs SecureBoot is upgraded with the SecureBoot installer whatever the mode. Allowed values: `Off`, `Preferred`, `Required`. |
| `spec.security.wireGuard` | `object` | no | wireGuard turns on Cilium's transparent WireGuard encryption of pod traffic between nodes. A rolling restart of the Cilium agents, no node reboot. |
| `spec.security.wireGuard.enabled` | `boolean` | no | enabled sets encryption.enabled=true and encryption.type=wireguard in the managed Cilium values. It wins over any encryption.* the user values set. When the firewall is on, UDP 51871 is opened between nodes. Default: `false`. |
| `spec.security.wireGuard.nodeEncryption` | `boolean` | no | nodeEncryption also encrypts node-to-node traffic that is not pod traffic (encryption.nodeEncryption). |
| `spec.talosVersion` | `string` | yes | talosVersion is the Talos release this cluster renders configuration for. |
| `spec.versionContract` | `string` | yes | versionContract is required rather than defaulted, so that a machinery bump cannot silently change what gets applied (principle 4). |

### status

| Field | Type | Required | Description |
|---|---|---|---|
| `status` | `object` | no | status defines the observed state of TalosCluster |
| `status.certificates` | `[]object` | no | certificates lists when each cluster certificate authority in the secrets bundle expires, so an approaching expiry is visible before it locks anyone out. Read from the bundle, never from a node. |
| `status.certificates[].name` | `string` | yes | name is which authority: talos, kubernetes, kubernetes-aggregator or etcd. |
| `status.certificates[].notAfter` | `string (date-time)` | yes | notAfter is the certificate's last instant of validity. |
| `status.cni` | `object` | no | cni is the observed CNI state that is not a spec ingredient. |
| `status.cni.appliedValuesHash` | `string` | no | appliedValuesHash is the hash of the effective Cilium values the last successful Helm Job applied. The controller starts a new Job when the hash of spec.cni.cilium.values (merged with Ichor's defaults) differs from it. Written by the controller only. |
| `status.cni.availableChartVersion` | `string` | no | availableChartVersion is the Cilium chart version the running Ichor ships when it differs from the installed release; empty when up to date. It backs the CiliumUpgradeAvailable condition. |
| `status.cni.detected` | `string` | no | detected is the CNI the cluster is observed to run, read-only display and the network-policy gate. Written by the controller only. Allowed values: `cilium`, `flannel`, `calico`, `other`, `none`. |
| `status.cni.detectedVersion` | `string` | no | detectedVersion is the image tag of the detected CNI's DaemonSet where one exposes it. |
| `status.cni.imageOverride` | `object` | no | imageOverride is the Cilium patch an earlier Ichor recorded as the images the release runs over the embedded chart. Ichor sets no new one (amendment 2026-11-04 (3)). A recorded patch newer than the embedded chart keeps being rendered, so an Ichor upgrade never steps Cilium back, and the CiliumUpgradeAvailable condition says so; the controller clears it once the embedded chart reaches the patch. |
| `status.cni.imageOverride.images` | `map[string]string` | yes | images maps each image key to the reference the Job runs: "agent", "operator" and "hubble-relay" are repository:tag@sha256:digest, verified against the Cilium release signature. |
| `status.cni.imageOverride.version` | `string` | yes | version is the patch, with a leading v (v1.20.5). |
| `status.cni.jobFailures` | `integer` | no | jobFailures is how many Cilium Helm Jobs failed in a row for the values whose hash is jobFailuresHash, counted when the controller removes a failed Job to try again. Each failure doubles the wait before the next attempt (a minute, up to 30 minutes), so a Job that keeps failing does not hold the cluster operation lock in a near-continuous loop. Other values (another hash) start again at once, and a successful Job clears it. Written by the controller only. |
| `status.cni.jobFailuresHash` | `string` | no | jobFailuresHash is the effective-values hash jobFailures counts for. |
| `status.cni.kubeProxy` | `string` | no | kubeProxy is the mode the Talos side (cluster.proxy.disabled) is rendered for. Unset until a kube-proxy switch first runs, which means "render whatever the patches say"; once set, pkg/render appends it as the last patch, so it wins over any patch. Only the TalosOperation of kind cni writes it, and only after the new side is verified. Allowed values: `enabled`, `replaced`. |
| `status.cni.takenOverInlineManifest` | `string` | no | takenOverInlineManifest is the name of the cluster.inlineManifests entry of the adopted machines that held the Cilium DaemonSet Ichor took over, which pkg/render stops rendering once CNIHandover is True. The controller copies it from the TalosClusterCNIInlineManifestAnnotation when the hand-over completes; empty when the adopted Cilium was not in an inline manifest. |
| `status.conditions` | `[]object` | no | conditions represent the current state of the TalosCluster resource, kstatus-compatible. |
| `status.conditions[].lastTransitionTime` | `string (date-time)` | yes | lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. |
| `status.conditions[].message` | `string` | yes | message is a human readable message indicating details about the transition. This may be an empty string. |
| `status.conditions[].observedGeneration` | `integer` | no | observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. |
| `status.conditions[].reason` | `string` | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
| `status.conditions[].status` | `string` | yes | status of the condition, one of True, False, Unknown. Allowed values: `True`, `False`, `Unknown`. |
| `status.conditions[].type` | `string` | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
| `status.observedGeneration` | `integer` | no | observedGeneration is the most recent generation the controller has reconciled. |