mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 18:47:04 +09:00
Aleksei Sviridkin
3ae1e10c92
State in the README that in-guest registry pulls are routable again via talos.registryMirrors, which knob covers which artifact (the mirror routes registry pulls; the worker OS disk image arrives as a raw HTTP artifact under talos.imageFactoryURL and no registry mirror touches it), and the limits: skipFallback is needed for air-gap, machine.registries.config is not passed through, and existing nodes keep their boot-time config until replaced. Trim the field doc comment. The regenerated schema, README tables and cozyrds openAPISchema follow from those sources. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
1074 lines
41 KiB
JSON
1074 lines
41 KiB
JSON
{
|
|
"title": "Chart Values",
|
|
"type": "object",
|
|
"properties": {
|
|
"storageClass": {
|
|
"description": "Default StorageClass inside the tenant cluster. Remote-accessible LINSTOR classes are auto-propagated to the tenant under the same name.",
|
|
"type": "string",
|
|
"default": "replicated",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "self == oldSelf",
|
|
"message": "storageClass is immutable"
|
|
}
|
|
],
|
|
"x-cozystack-options": {
|
|
"source": "storageclass"
|
|
}
|
|
},
|
|
"nodeGroups": {
|
|
"description": "Worker nodes configuration map. When left empty, a default node group `md0` is emitted with `minReplicas: 0` and `roles: [ingress-nginx]` — the MachineDeployment renders but provisions no workers until an unschedulable Pod triggers the cluster-autoscaler (or an operator scales the group manually). Enabling `addons.ingressNginx.enabled: true` on a CR with default `nodeGroups: {}` therefore requires either supplying a nodeGroup with `roles: [ingress-nginx]` and `minReplicas \u003e= 1`, or waiting for the autoscaler to bring up the default md0 in response to the ingress-nginx controller Pods becoming Pending. Provide your own groups to take full control — they are not merged with the default, so you may name and omit groups freely.",
|
|
"type": "object",
|
|
"default": {},
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"required": [
|
|
"diskSize",
|
|
"instanceType",
|
|
"maxReplicas",
|
|
"minReplicas"
|
|
],
|
|
"properties": {
|
|
"diskSize": {
|
|
"description": "System disk size for the worker VM. Carries the Talos OS image (factory.talos.dev raw artifact streamed in by CDI), kubelet state, containerd image cache, and any local-path PVCs. Pre-Talos installs used a separate disk-kubelet PVC for kubelet/containerd state; on Talos this is consolidated onto the single system disk imaged from the factory artifact.",
|
|
"default": "20Gi",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"gpus": {
|
|
"description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": [
|
|
"name"
|
|
],
|
|
"properties": {
|
|
"name": {
|
|
"description": "Name of GPU, such as \"nvidia.com/AD102GL_L40S\".",
|
|
"type": "string",
|
|
"x-cozystack-options": {
|
|
"source": "gpu"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"instanceType": {
|
|
"description": "Virtual machine instance type.",
|
|
"type": "string",
|
|
"default": "u1.medium",
|
|
"x-cozystack-options": {
|
|
"source": "instancetype"
|
|
}
|
|
},
|
|
"kubelet": {
|
|
"description": "Kubelet resource reservations for this node group.",
|
|
"type": "object",
|
|
"properties": {
|
|
"evictionHardMemory": {
|
|
"description": "Hard eviction threshold for memory (absolute like 200Mi or percentage like 7%).",
|
|
"type": "string",
|
|
"default": "7%"
|
|
},
|
|
"evictionSoftMemory": {
|
|
"description": "Soft eviction threshold for memory (absolute like 1Gi or percentage like 10%).",
|
|
"type": "string",
|
|
"default": "10%"
|
|
},
|
|
"kubeReservedCpu": {
|
|
"description": "CPU reserved for kubelet and container runtime. Auto-computed from instanceType if empty.",
|
|
"type": "string"
|
|
},
|
|
"kubeReservedMemory": {
|
|
"description": "Memory reserved for kubelet and container runtime. Auto-computed from instanceType if empty.",
|
|
"type": "string"
|
|
},
|
|
"systemReservedCpu": {
|
|
"description": "CPU reserved for host OS. Auto-computed from instanceType if empty.",
|
|
"type": "string"
|
|
},
|
|
"systemReservedMemory": {
|
|
"description": "Memory reserved for host OS. Auto-computed from instanceType if empty.",
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"logSerialConsole": {
|
|
"description": "Stream each worker VM's guest serial console into a `guest-console-log` container beside virt-launcher, readable with `kubectl logs`. The only view of a worker that stalls during boot before Talos apid answers, when neither a Node nor a certificate request exists to diagnose from. Two costs the field name does not show. Changing the value rolls the node group, because it is part of the worker VM template whose name is a hash of its content -- including the stuck VM whose console was wanted, so it buys visibility into the next boot rather than the current one. And it overrides the platform's cluster-wide `disableSerialConsoleLog`, set because that container has been seen holding virt-launcher in `PodInitializing` (kubevirt/kubevirt#15989), which would take the node group down rather than explain it -- so check that virt-launcher Pods reach Running after enabling it.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"maxReplicas": {
|
|
"description": "Maximum number of replicas.",
|
|
"type": "integer",
|
|
"default": 10
|
|
},
|
|
"maxUnhealthy": {
|
|
"description": "Per-group override for `nodeHealthCheck.maxUnhealthy`. When unset, the cluster-wide `nodeHealthCheck.maxUnhealthy` applies. Accepts a bare integer (\"0\", \"1\", ...) or an integer percentage (\"0%\", \"50%\").",
|
|
"type": "string"
|
|
},
|
|
"minReplicas": {
|
|
"description": "Minimum number of replicas.",
|
|
"type": "integer",
|
|
"default": 0
|
|
},
|
|
"nodeStartupTimeout": {
|
|
"description": "Per-group override for `nodeHealthCheck.nodeStartupTimeout`. When unset, the cluster-wide `nodeHealthCheck.nodeStartupTimeout` applies.",
|
|
"type": "string"
|
|
},
|
|
"resources": {
|
|
"description": "Explicit CPU and memory for each worker node, as an alternative to `instanceType` sizing. Optional: when omitted, the node is sized by `instanceType`. When both `cpu` and `memory` are set, they take precedence and `instanceType` is ignored for that node group (the instancetype is omitted from the VM, since KubeVirt cannot override an instancetype's CPU/memory). Set both `cpu` and `memory` together or neither; setting only one is rejected at render time.",
|
|
"type": "object",
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"roles": {
|
|
"description": "List of node roles.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"storageClass": {
|
|
"description": "StorageClass for worker node persistent disks. When empty, falls back to the application-level storageClass. Worker VMs live-migrate, so their disks need ReadWriteMany — the RWX access mode is supplied by the chosen StorageClass's CDI StorageProfile, not set on the DataVolume here — and linstor-csi rejects RWX volumes that are not on a DRBD-backed StorageClass, so the fallback targets the replicated/DRBD application storageClass rather than a possibly non-DRBD cluster default. NOTE: deliberately not marked immutable — the field is optional and undefaulted, so a strict `self == oldSelf` rule would block any future attempt to set it on an existing node group.",
|
|
"type": "string",
|
|
"x-cozystack-options": {
|
|
"source": "storageclass"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"version": {
|
|
"description": "Kubernetes major.minor version to deploy",
|
|
"type": "string",
|
|
"default": "v1.35",
|
|
"enum": [
|
|
"v1.35",
|
|
"v1.34",
|
|
"v1.33",
|
|
"v1.32",
|
|
"v1.31"
|
|
]
|
|
},
|
|
"host": {
|
|
"description": "External hostname for Kubernetes cluster. Defaults to `\u003ccluster-name\u003e.\u003ctenant-host\u003e` if empty.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"addons": {
|
|
"description": "Cluster addons configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"certManager",
|
|
"cilium",
|
|
"coredns",
|
|
"fluxcd",
|
|
"gatewayAPI",
|
|
"gpuOperator",
|
|
"hami",
|
|
"ingressNginx",
|
|
"monitoringAgents",
|
|
"ouroboros",
|
|
"velero",
|
|
"verticalPodAutoscaler"
|
|
],
|
|
"properties": {
|
|
"certManager": {
|
|
"description": "Cert-manager addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable cert-manager.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"cilium": {
|
|
"description": "Cilium CNI plugin.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"coredns": {
|
|
"description": "CoreDNS addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"fluxcd": {
|
|
"description": "FluxCD GitOps operator.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable FluxCD.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"gatewayAPI": {
|
|
"description": "Gateway API addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable Gateway API.",
|
|
"type": "boolean",
|
|
"default": false
|
|
}
|
|
}
|
|
},
|
|
"gpuOperator": {
|
|
"description": "NVIDIA GPU Operator.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable GPU Operator.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"hami": {
|
|
"description": "HAMi GPU virtualization middleware.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable HAMi (requires GPU Operator).",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"ingressNginx": {
|
|
"description": "Ingress-NGINX controller.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"exposeMethod",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable the controller (requires nodes labeled `ingress-nginx`).",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"exposeMethod": {
|
|
"description": "Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.",
|
|
"type": "string",
|
|
"default": "Proxied",
|
|
"enum": [
|
|
"Proxied",
|
|
"LoadBalancer"
|
|
]
|
|
},
|
|
"hosts": {
|
|
"description": "Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"monitoringAgents": {
|
|
"description": "Monitoring agents.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable monitoring agents.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"ouroboros": {
|
|
"description": "Hairpin-NAT fix for ingress-nginx with PROXY-protocol.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable ouroboros. Requires addons.ingressNginx.enabled (chart-render fail otherwise). Only useful when PROXY-protocol is wired on the tenant ingress-nginx via valuesOverride.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides. Operator-key wins over cozystack defaults.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"velero": {
|
|
"description": "Velero backup/restore addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable Velero.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"verticalPodAutoscaler": {
|
|
"description": "Vertical Pod Autoscaler.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"controlPlane": {
|
|
"description": "Kubernetes control-plane configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"apiServer",
|
|
"controllerManager",
|
|
"konnectivity",
|
|
"replicas",
|
|
"scheduler"
|
|
],
|
|
"properties": {
|
|
"apiServer": {
|
|
"description": "API Server configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"extraArgs": {
|
|
"description": "Extra command-line flags appended to the tenant kube-apiserver, passed through to KamajiControlPlane `spec.apiServer.extraArgs`. For OIDC use `spec.oidc.mode` — this passthrough is the escape hatch for other apiserver flags (`--requestheader-uid-headers=X-Remote-Uid`, feature gates, etc). Do NOT add legacy `--oidc-*` flags here when `spec.oidc.mode` is not `None`; the chart injects `--authentication-config` and the apiserver refuses to boot with both. Empty by default (no change to current behavior).",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"extraVolumeMounts": {
|
|
"description": "Extra volume mounts added to the tenant kube-apiserver container, passed through to KamajiControlPlane `spec.apiServer.extraVolumeMounts`. Each `name` must reference a volume declared in `extraVolumes`; the chart-managed talos secret volumes cannot be mounted. Each item is a core/v1 VolumeMount. Empty by default.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
},
|
|
"extraVolumes": {
|
|
"description": "Extra volumes added to the control-plane Deployment, passed through to KamajiControlPlane `spec.deployment.extraVolumes`. Use to mount a ConfigMap or Secret holding an AuthenticationConfiguration file referenced by `extraArgs`. Each item is a core/v1 Volume, but because the control-plane pod runs on the management cluster only `configMap` and `secret` sources are allowed (host-reaching sources like `hostPath`/`csi` and token-projection via `projected` are rejected); each volume must have a unique, non-empty name and exactly one source. The names `talos-ca` and `talos-tls-cert` are reserved by the chart. Empty by default.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
},
|
|
"resources": {
|
|
"description": "CPU and memory resources for API Server.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "c1.medium",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"controllerManager": {
|
|
"description": "Controller Manager configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Controller Manager.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"konnectivity": {
|
|
"description": "Konnectivity configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"server"
|
|
],
|
|
"properties": {
|
|
"server": {
|
|
"description": "Konnectivity Server configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Konnectivity.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"replicas": {
|
|
"description": "Number of control-plane replicas.",
|
|
"type": "integer",
|
|
"default": 2
|
|
},
|
|
"scheduler": {
|
|
"description": "Scheduler configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Scheduler.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"images": {
|
|
"description": "Optional image overrides for air-gapped or rate-limited registries.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"kubectl": {
|
|
"description": "Image used by the bootstrap-token tenant Job (kubectl). Empty falls back to images/kubectl.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"talosCsrSigner": {
|
|
"description": "Image used by the talos-csr-signer sidecar in the Kamaji control plane. Empty falls back to images/talos-csr-signer.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"waitForKubeconfig": {
|
|
"description": "Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
}
|
|
}
|
|
},
|
|
"talos": {
|
|
"description": "Talos worker image configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"imageFactoryURL",
|
|
"installerRepository",
|
|
"registryMirrors",
|
|
"schematicID",
|
|
"version"
|
|
],
|
|
"properties": {
|
|
"imageFactoryURL": {
|
|
"description": "Base URL of the Talos Image Factory that serves the worker OS disk image (the `openstack-amd64.raw.xz` raw artifact streamed in by CDI over HTTP). Defaults to the public factory. Point at a self-hosted Image Factory, a caching mirror, or an internal HTTP file server for air-gapped, rate-limited, or flaky-egress environments. No trailing slash.",
|
|
"type": "string",
|
|
"default": "https://factory.talos.dev"
|
|
},
|
|
"installerRepository": {
|
|
"description": "OCI repository prefix for the Talos installer image used by the in-guest `talos-reconcile` upgrade Job. Resolved as `\u003cinstallerRepository\u003e/\u003cschematicID\u003e:\u003cversion\u003e`. Defaults to the public factory's installer path. Override for air-gapped or mirrored registries. No trailing slash.",
|
|
"type": "string",
|
|
"default": "factory.talos.dev/installer"
|
|
},
|
|
"registryMirrors": {
|
|
"description": "Talos `machine.registries.mirrors` passthrough for worker nodes: a map of upstream registry host to `{ endpoints: [ ... ] }`. Empty by default, so workers pull container images (the Talos `kubelet` image included) directly from the upstream registry. Point a host such as `ghcr.io` at an in-cluster pull-through mirror for air-gapped, rate-limited, or flaky-egress environments so a worker's boot does not depend on live public egress. Talos still falls back to the upstream registry unless a host also sets `skipFallback: true`, so a mirror alone does not enforce air-gap.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
},
|
|
"schematicID": {
|
|
"description": "Talos image-factory schematic ID. Defaults to the cozystack-tested vanilla schematic. Operators using custom schematics (system extensions, kernel args) override here.",
|
|
"type": "string",
|
|
"default": "ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515"
|
|
},
|
|
"version": {
|
|
"description": "Talos release used for worker OS image and installer. Must satisfy the chart's Talos\u003c-\u003eKubernetes support matrix against the chosen `version`.",
|
|
"type": "string",
|
|
"default": "v1.13.6"
|
|
}
|
|
}
|
|
},
|
|
"nodeHealthCheck": {
|
|
"description": "MachineHealthCheck tuning for worker node groups.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"maxUnhealthy",
|
|
"nodeStartupTimeout"
|
|
],
|
|
"properties": {
|
|
"maxUnhealthy": {
|
|
"description": "Maximum number of unhealthy nodes tolerated per node group before remediation is paused. The MHC admission webhook accepts either a bare integer (\"0\", \"1\", ...) or a percentage (\"0%\", \"50%\"); bare numeric strings are rejected, so the safer default is to express the value as a percentage. Default \"50%\" leaves headroom for transient unhealthy nodes during the kubeadm-to-Talos rollover and slow first boots from factory.talos.dev. Drop to \"0%\" once the fleet is stable on Talos workers.",
|
|
"type": "string",
|
|
"default": "50%"
|
|
},
|
|
"nodeStartupTimeout": {
|
|
"description": "Maximum time a Machine is allowed to spend reaching the Ready condition before it is remediated. Raise for slow first boots (Talos image fetch from factory.talos.dev or a busy storage class on the kubevirt-csi PVC populator).",
|
|
"type": "string",
|
|
"default": "10m"
|
|
}
|
|
}
|
|
},
|
|
"oidc": {
|
|
"description": "OIDC authentication and per-user RBAC for the tenant kube-apiserver. See docs/oidc-tenant.md for the operator guide.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"mode"
|
|
],
|
|
"properties": {
|
|
"customConfig": {
|
|
"description": "Tenant-supplied AuthenticationConfiguration; consumed only when `mode: CustomConfig`.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"config": {
|
|
"description": "Inline AuthenticationConfiguration YAML (`apiserver.config.k8s.io/v1beta1`). The chart writes the value verbatim into a Secret mounted at `/etc/kubernetes/authentication-config/config.yaml` on the kube-apiserver. Mutually exclusive with `secretRef.name`.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"secretRef": {
|
|
"description": "Reference to an existing Secret in the tenant namespace carrying the `AuthenticationConfiguration`.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"name": {
|
|
"description": "Name of an existing Secret in the tenant (release) namespace whose `config.yaml` key holds an `apiserver.config.k8s.io/v1beta1` `AuthenticationConfiguration`. Mutually exclusive with `customConfig.config`.",
|
|
"type": "string",
|
|
"default": ""
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mode": {
|
|
"description": "Identity mode. `None`: no OIDC, only the static admin kubeconfig works. `System`: trust the platform `cozy` realm via a per-cluster public client with audience binding; zero-config default. `CustomConfig`: trust a tenant-supplied issuer directly (BYO); `cozy` is not in the path.",
|
|
"type": "string",
|
|
"default": "None",
|
|
"enum": [
|
|
"None",
|
|
"System",
|
|
"CustomConfig"
|
|
]
|
|
},
|
|
"users": {
|
|
"description": "Users granted access to the tenant cluster; each entry produces one ClusterRoleBinding inside the tenant cluster. Works for both `System` and `CustomConfig` modes.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"required": [
|
|
"email",
|
|
"role"
|
|
],
|
|
"properties": {
|
|
"email": {
|
|
"description": "Email address matched against the `email` claim from the issuer. Used verbatim as the `User:` subject in the ClusterRoleBinding inside the tenant cluster. The `email` claim is a built-in OIDC scope requested explicitly by the chart-generated `kubectl oidc-login` kubeconfig; every conformant OIDC provider (cozy realm included) emits it.",
|
|
"type": "string"
|
|
},
|
|
"role": {
|
|
"description": "Role to bind: `admin` maps to `ClusterRole/cluster-admin`, `view` maps to `ClusterRole/view`.",
|
|
"type": "string",
|
|
"enum": [
|
|
"admin",
|
|
"view"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|