mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
IvanHunters
f035da8a0f
Resolve conflicts introduced by main: - Drop the FluxCD tenant addon (API type, deepcopy, values schema, RD) in favour of the GPU type main added; main removed the fluxcd addon wholesale. - Renumber the Phase 2 worker-pool adoption migration 54 -> 56, behind main's redis-operator (54) and fluxcd-removal (55) migrations; targetVersion 55 -> 57. - Accept the branch's removal of the in-chart talos-reconcile Job; it moved to the kubernetes-nodes chart, main only touched its comment. - Regenerate kubernetes values.schema.json / README and the kubernetes-rd ApplicationDefinition schema. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
872 lines
30 KiB
JSON
872 lines
30 KiB
JSON
{
|
|
"title": "Chart Values",
|
|
"type": "object",
|
|
"properties": {
|
|
"storageClass": {
|
|
"description": "Default StorageClass inside the tenant cluster. Remote-accessible LINSTOR classes are auto-propagated to the tenant under the same name.",
|
|
"type": "string",
|
|
"default": "replicated",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "self == oldSelf",
|
|
"message": "storageClass is immutable"
|
|
}
|
|
],
|
|
"x-cozystack-options": {
|
|
"source": "storageclass"
|
|
}
|
|
},
|
|
"version": {
|
|
"description": "Kubernetes major.minor version to deploy",
|
|
"type": "string",
|
|
"default": "v1.35",
|
|
"enum": [
|
|
"v1.35",
|
|
"v1.34",
|
|
"v1.33",
|
|
"v1.32",
|
|
"v1.31"
|
|
]
|
|
},
|
|
"host": {
|
|
"description": "External hostname for Kubernetes cluster. Defaults to `\u003ccluster-name\u003e.\u003ctenant-host\u003e` if empty.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"addons": {
|
|
"description": "Cluster addons configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"certManager",
|
|
"cilium",
|
|
"coredns",
|
|
"gatewayAPI",
|
|
"gpuOperator",
|
|
"hami",
|
|
"ingressNginx",
|
|
"monitoringAgents",
|
|
"ouroboros",
|
|
"velero",
|
|
"verticalPodAutoscaler"
|
|
],
|
|
"properties": {
|
|
"certManager": {
|
|
"description": "Cert-manager addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable cert-manager.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"cilium": {
|
|
"description": "Cilium CNI plugin.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"coredns": {
|
|
"description": "CoreDNS addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"gatewayAPI": {
|
|
"description": "Gateway API addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable Gateway API.",
|
|
"type": "boolean",
|
|
"default": false
|
|
}
|
|
}
|
|
},
|
|
"gpuOperator": {
|
|
"description": "NVIDIA GPU Operator.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable GPU Operator.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"hami": {
|
|
"description": "HAMi GPU virtualization middleware.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable HAMi (requires GPU Operator).",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"ingressNginx": {
|
|
"description": "Ingress-NGINX controller.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"exposeMethod",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable the controller (requires nodes labeled `ingress-nginx`).",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"exposeMethod": {
|
|
"description": "Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.",
|
|
"type": "string",
|
|
"default": "Proxied",
|
|
"enum": [
|
|
"Proxied",
|
|
"LoadBalancer"
|
|
]
|
|
},
|
|
"hosts": {
|
|
"description": "Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"monitoringAgents": {
|
|
"description": "Monitoring agents.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable monitoring agents.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"ouroboros": {
|
|
"description": "Hairpin-NAT fix for ingress-nginx with PROXY-protocol.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable ouroboros. Requires addons.ingressNginx.enabled (chart-render fail otherwise). Only useful when PROXY-protocol is wired on the tenant ingress-nginx via valuesOverride.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides. Operator-key wins over cozystack defaults.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"velero": {
|
|
"description": "Velero backup/restore addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable Velero.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"verticalPodAutoscaler": {
|
|
"description": "Vertical Pod Autoscaler.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"controlPlane": {
|
|
"description": "Kubernetes control-plane configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"apiServer",
|
|
"controllerManager",
|
|
"konnectivity",
|
|
"replicas",
|
|
"scheduler"
|
|
],
|
|
"properties": {
|
|
"apiServer": {
|
|
"description": "API Server configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"extraArgs": {
|
|
"description": "Extra command-line flags appended to the tenant kube-apiserver, passed through to KamajiControlPlane `spec.apiServer.extraArgs`. For OIDC use `spec.oidc.mode` — this passthrough is the escape hatch for other apiserver flags (`--requestheader-uid-headers=X-Remote-Uid`, feature gates, etc). Do NOT add legacy `--oidc-*` flags here when `spec.oidc.mode` is not `None`; the chart injects `--authentication-config` and the apiserver refuses to boot with both. Empty by default (no change to current behavior).",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"extraVolumeMounts": {
|
|
"description": "Extra volume mounts added to the tenant kube-apiserver container, passed through to KamajiControlPlane `spec.apiServer.extraVolumeMounts`. Each `name` must reference a volume declared in `extraVolumes`; the chart-managed talos secret volumes cannot be mounted. Each item is a core/v1 VolumeMount. Empty by default.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
},
|
|
"extraVolumes": {
|
|
"description": "Extra volumes added to the control-plane Deployment, passed through to KamajiControlPlane `spec.deployment.extraVolumes`. Use to mount a ConfigMap or Secret holding an AuthenticationConfiguration file referenced by `extraArgs`. Each item is a core/v1 Volume, but because the control-plane pod runs on the management cluster only `configMap` and `secret` sources are allowed (host-reaching sources like `hostPath`/`csi` and token-projection via `projected` are rejected); each volume must have a unique, non-empty name and exactly one source. The names `talos-ca` and `talos-tls-cert` are reserved by the chart. Empty by default.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
},
|
|
"resources": {
|
|
"description": "CPU and memory resources for API Server.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "c1.medium",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"controllerManager": {
|
|
"description": "Controller Manager configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Controller Manager.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"konnectivity": {
|
|
"description": "Konnectivity configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"server"
|
|
],
|
|
"properties": {
|
|
"server": {
|
|
"description": "Konnectivity Server configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Konnectivity.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"replicas": {
|
|
"description": "Number of control-plane replicas.",
|
|
"type": "integer",
|
|
"default": 2
|
|
},
|
|
"scheduler": {
|
|
"description": "Scheduler configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Scheduler.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"images": {
|
|
"description": "Optional image overrides for air-gapped or rate-limited registries.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"kubectl": {
|
|
"description": "Image used by the bootstrap-token tenant Job (kubectl). Empty falls back to images/kubectl.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"talosCsrSigner": {
|
|
"description": "Image used by the talos-csr-signer sidecar in the Kamaji control plane. Empty falls back to images/talos-csr-signer.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"waitForKubeconfig": {
|
|
"description": "Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
}
|
|
}
|
|
},
|
|
"talos": {
|
|
"description": "Talos worker image configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"imageFactoryURL",
|
|
"installerRepository",
|
|
"registryMirrors",
|
|
"schematicID",
|
|
"version"
|
|
],
|
|
"properties": {
|
|
"imageFactoryURL": {
|
|
"description": "Base URL of the Talos Image Factory that serves the worker OS disk image (the `openstack-amd64.raw.xz` raw artifact streamed in by CDI over HTTP). Defaults to the public factory. Point at a self-hosted Image Factory, a caching mirror, or an internal HTTP file server for air-gapped, rate-limited, or flaky-egress environments. No trailing slash.",
|
|
"type": "string",
|
|
"default": "https://factory.talos.dev"
|
|
},
|
|
"installerRepository": {
|
|
"description": "OCI repository prefix for the Talos installer image used by the in-guest `talos-reconcile` upgrade Job. Resolved as `\u003cinstallerRepository\u003e/\u003cschematicID\u003e:\u003cversion\u003e`. Defaults to the public factory's installer path. Override for air-gapped or mirrored registries. No trailing slash.",
|
|
"type": "string",
|
|
"default": "factory.talos.dev/installer"
|
|
},
|
|
"registryMirrors": {
|
|
"description": "Talos `machine.registries.mirrors` passthrough for worker nodes: a map of upstream registry host to `{ endpoints: [ ... ] }`. Empty by default, so workers pull container images (the Talos `kubelet` image included) directly from the upstream registry. Point a host such as `ghcr.io` at an in-cluster pull-through mirror for air-gapped, rate-limited, or flaky-egress environments so a worker's boot does not depend on live public egress. Talos still falls back to the upstream registry unless a host also sets `skipFallback: true`, so a mirror alone does not enforce air-gap.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
},
|
|
"schematicID": {
|
|
"description": "Talos image-factory schematic ID. Defaults to the cozystack-tested vanilla schematic. Operators using custom schematics (system extensions, kernel args) override here.",
|
|
"type": "string",
|
|
"default": "ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515"
|
|
},
|
|
"version": {
|
|
"description": "Talos release used for worker OS image and installer. Must satisfy the chart's Talos\u003c-\u003eKubernetes support matrix against the chosen `version`.",
|
|
"type": "string",
|
|
"default": "v1.13.6"
|
|
}
|
|
}
|
|
},
|
|
"oidc": {
|
|
"description": "OIDC authentication and per-user RBAC for the tenant kube-apiserver. See docs/oidc-tenant.md for the operator guide.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"mode"
|
|
],
|
|
"properties": {
|
|
"customConfig": {
|
|
"description": "Tenant-supplied AuthenticationConfiguration; consumed only when `mode: CustomConfig`.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"config": {
|
|
"description": "Inline AuthenticationConfiguration YAML (`apiserver.config.k8s.io/v1beta1`). The chart writes the value verbatim into a Secret mounted at `/etc/kubernetes/authentication-config/config.yaml` on the kube-apiserver. Mutually exclusive with `secretRef.name`.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"secretRef": {
|
|
"description": "Reference to an existing Secret in the tenant namespace carrying the `AuthenticationConfiguration`.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"name": {
|
|
"description": "Name of an existing Secret in the tenant (release) namespace whose `config.yaml` key holds an `apiserver.config.k8s.io/v1beta1` `AuthenticationConfiguration`. Mutually exclusive with `customConfig.config`.",
|
|
"type": "string",
|
|
"default": ""
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mode": {
|
|
"description": "Identity mode. `None`: no OIDC, only the static admin kubeconfig works. `System`: trust the platform `cozy` realm via a per-cluster public client with audience binding; zero-config default. `CustomConfig`: trust a tenant-supplied issuer directly (BYO); `cozy` is not in the path.",
|
|
"type": "string",
|
|
"default": "None",
|
|
"enum": [
|
|
"None",
|
|
"System",
|
|
"CustomConfig"
|
|
]
|
|
},
|
|
"users": {
|
|
"description": "Users granted access to the tenant cluster; each entry produces one ClusterRoleBinding inside the tenant cluster. Works for both `System` and `CustomConfig` modes.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"required": [
|
|
"email",
|
|
"role"
|
|
],
|
|
"properties": {
|
|
"email": {
|
|
"description": "Email address matched against the `email` claim from the issuer. Used verbatim as the `User:` subject in the ClusterRoleBinding inside the tenant cluster. The `email` claim is a built-in OIDC scope requested explicitly by the chart-generated `kubectl oidc-login` kubeconfig; every conformant OIDC provider (cozy realm included) emits it.",
|
|
"type": "string"
|
|
},
|
|
"role": {
|
|
"description": "Role to bind: `admin` maps to `ClusterRole/cluster-admin`, `view` maps to `ClusterRole/view`.",
|
|
"type": "string",
|
|
"enum": [
|
|
"admin",
|
|
"view"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|