mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
Myasnikov Daniilandmattia-eleuteri
db4db4a6e8
Add optional nodeGroups[name].maxUnhealthy and nodeGroups[name].nodeStartupTimeout
fields that override the cluster-wide nodeHealthCheck defaults per worker node
group. When unset, a group inherits nodeHealthCheck.{maxUnhealthy,nodeStartupTimeout},
so existing values are unaffected. The MachineHealthCheck render resolves the
per-group value first, reuses the existing int-or-string validation, and names
the offending group in the fail() message when an override is invalid.
Delivers the per-group granularity of the standalone maxUnhealthy proposal on
top of the cluster-wide nodeHealthCheck from the Talos worker bootstrap PR.
Co-authored-by: mattia-eleuteri <mattia@hidora.io>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
1062 lines
39 KiB
JSON
1062 lines
39 KiB
JSON
{
|
|
"title": "Chart Values",
|
|
"type": "object",
|
|
"properties": {
|
|
"storageClass": {
|
|
"description": "Default StorageClass inside the tenant cluster. Remote-accessible LINSTOR classes are auto-propagated to the tenant under the same name.",
|
|
"type": "string",
|
|
"default": "replicated",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "self == oldSelf",
|
|
"message": "storageClass is immutable"
|
|
}
|
|
],
|
|
"x-cozystack-options": {
|
|
"source": "storageclass"
|
|
}
|
|
},
|
|
"nodeGroups": {
|
|
"description": "Worker nodes configuration map. When left empty, a default node group `md0` is emitted with `minReplicas: 0` and `roles: [ingress-nginx]` — the MachineDeployment renders but provisions no workers until an unschedulable Pod triggers the cluster-autoscaler (or an operator scales the group manually). Enabling `addons.ingressNginx.enabled: true` on a CR with default `nodeGroups: {}` therefore requires either supplying a nodeGroup with `roles: [ingress-nginx]` and `minReplicas \u003e= 1`, or waiting for the autoscaler to bring up the default md0 in response to the ingress-nginx controller Pods becoming Pending. Provide your own groups to take full control — they are not merged with the default, so you may name and omit groups freely.",
|
|
"type": "object",
|
|
"default": {},
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"required": [
|
|
"diskSize",
|
|
"instanceType",
|
|
"maxReplicas",
|
|
"minReplicas"
|
|
],
|
|
"properties": {
|
|
"diskSize": {
|
|
"description": "System disk size for the worker VM. Carries the Talos OS image (factory.talos.dev raw artifact streamed in by CDI), kubelet state, containerd image cache, and any local-path PVCs. Pre-Talos installs used a separate disk-kubelet PVC for kubelet/containerd state; on Talos this is consolidated onto the single system disk imaged from the factory artifact.",
|
|
"default": "20Gi",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"gpus": {
|
|
"description": "List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": [
|
|
"name"
|
|
],
|
|
"properties": {
|
|
"name": {
|
|
"description": "Name of GPU, such as \"nvidia.com/AD102GL_L40S\".",
|
|
"type": "string",
|
|
"x-cozystack-options": {
|
|
"source": "gpu"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"instanceType": {
|
|
"description": "Virtual machine instance type.",
|
|
"type": "string",
|
|
"default": "u1.medium",
|
|
"x-cozystack-options": {
|
|
"source": "instancetype"
|
|
}
|
|
},
|
|
"kubelet": {
|
|
"description": "Kubelet resource reservations for this node group.",
|
|
"type": "object",
|
|
"properties": {
|
|
"evictionHardMemory": {
|
|
"description": "Hard eviction threshold for memory (absolute like 200Mi or percentage like 7%).",
|
|
"type": "string",
|
|
"default": "7%"
|
|
},
|
|
"evictionSoftMemory": {
|
|
"description": "Soft eviction threshold for memory (absolute like 1Gi or percentage like 10%).",
|
|
"type": "string",
|
|
"default": "10%"
|
|
},
|
|
"kubeReservedCpu": {
|
|
"description": "CPU reserved for kubelet and container runtime. Auto-computed from instanceType if empty.",
|
|
"type": "string"
|
|
},
|
|
"kubeReservedMemory": {
|
|
"description": "Memory reserved for kubelet and container runtime. Auto-computed from instanceType if empty.",
|
|
"type": "string"
|
|
},
|
|
"systemReservedCpu": {
|
|
"description": "CPU reserved for host OS. Auto-computed from instanceType if empty.",
|
|
"type": "string"
|
|
},
|
|
"systemReservedMemory": {
|
|
"description": "Memory reserved for host OS. Auto-computed from instanceType if empty.",
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"maxReplicas": {
|
|
"description": "Maximum number of replicas.",
|
|
"type": "integer",
|
|
"default": 10
|
|
},
|
|
"maxUnhealthy": {
|
|
"description": "Per-group override for `nodeHealthCheck.maxUnhealthy`. When unset, the cluster-wide `nodeHealthCheck.maxUnhealthy` applies. Accepts a bare integer (\"0\", \"1\", ...) or an integer percentage (\"0%\", \"50%\").",
|
|
"type": "string"
|
|
},
|
|
"minReplicas": {
|
|
"description": "Minimum number of replicas.",
|
|
"type": "integer",
|
|
"default": 0
|
|
},
|
|
"nodeStartupTimeout": {
|
|
"description": "Per-group override for `nodeHealthCheck.nodeStartupTimeout`. When unset, the cluster-wide `nodeHealthCheck.nodeStartupTimeout` applies.",
|
|
"type": "string"
|
|
},
|
|
"resources": {
|
|
"description": "Explicit CPU and memory for each worker node, as an alternative to `instanceType` sizing. Optional: when omitted, the node is sized by `instanceType`. When both `cpu` and `memory` are set, they take precedence and `instanceType` is ignored for that node group (the instancetype is omitted from the VM, since KubeVirt cannot override an instancetype's CPU/memory). Set both `cpu` and `memory` together or neither; setting only one is rejected at render time.",
|
|
"type": "object",
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"roles": {
|
|
"description": "List of node roles.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"storageClass": {
|
|
"description": "StorageClass for worker node persistent disks. When empty, falls back to the application-level storageClass. Worker VMs live-migrate, so their disks need ReadWriteMany — the RWX access mode is supplied by the chosen StorageClass's CDI StorageProfile, not set on the DataVolume here — and linstor-csi rejects RWX volumes that are not on a DRBD-backed StorageClass, so the fallback targets the replicated/DRBD application storageClass rather than a possibly non-DRBD cluster default. NOTE: deliberately not marked immutable — the field is optional and undefaulted, so a strict `self == oldSelf` rule would block any future attempt to set it on an existing node group.",
|
|
"type": "string",
|
|
"x-cozystack-options": {
|
|
"source": "storageclass"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"version": {
|
|
"description": "Kubernetes major.minor version to deploy",
|
|
"type": "string",
|
|
"default": "v1.35",
|
|
"enum": [
|
|
"v1.35",
|
|
"v1.34",
|
|
"v1.33",
|
|
"v1.32",
|
|
"v1.31"
|
|
]
|
|
},
|
|
"host": {
|
|
"description": "External hostname for Kubernetes cluster. Defaults to `\u003ccluster-name\u003e.\u003ctenant-host\u003e` if empty.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"addons": {
|
|
"description": "Cluster addons configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"certManager",
|
|
"cilium",
|
|
"coredns",
|
|
"fluxcd",
|
|
"gatewayAPI",
|
|
"gpuOperator",
|
|
"hami",
|
|
"ingressNginx",
|
|
"monitoringAgents",
|
|
"ouroboros",
|
|
"velero",
|
|
"verticalPodAutoscaler"
|
|
],
|
|
"properties": {
|
|
"certManager": {
|
|
"description": "Cert-manager addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable cert-manager.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"cilium": {
|
|
"description": "Cilium CNI plugin.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"coredns": {
|
|
"description": "CoreDNS addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"fluxcd": {
|
|
"description": "FluxCD GitOps operator.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable FluxCD.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"gatewayAPI": {
|
|
"description": "Gateway API addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable Gateway API.",
|
|
"type": "boolean",
|
|
"default": false
|
|
}
|
|
}
|
|
},
|
|
"gpuOperator": {
|
|
"description": "NVIDIA GPU Operator.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable GPU Operator.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"hami": {
|
|
"description": "HAMi GPU virtualization middleware.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable HAMi (requires GPU Operator).",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"ingressNginx": {
|
|
"description": "Ingress-NGINX controller.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"exposeMethod",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable the controller (requires nodes labeled `ingress-nginx`).",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"exposeMethod": {
|
|
"description": "Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.",
|
|
"type": "string",
|
|
"default": "Proxied",
|
|
"enum": [
|
|
"Proxied",
|
|
"LoadBalancer"
|
|
]
|
|
},
|
|
"hosts": {
|
|
"description": "Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"monitoringAgents": {
|
|
"description": "Monitoring agents.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable monitoring agents.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"ouroboros": {
|
|
"description": "Hairpin-NAT fix for ingress-nginx with PROXY-protocol.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable ouroboros. Requires addons.ingressNginx.enabled (chart-render fail otherwise). Only useful when PROXY-protocol is wired on the tenant ingress-nginx via valuesOverride.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides. Operator-key wins over cozystack defaults.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"velero": {
|
|
"description": "Velero backup/restore addon.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"enabled",
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"description": "Enable Velero.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
},
|
|
"verticalPodAutoscaler": {
|
|
"description": "Vertical Pod Autoscaler.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"valuesOverride"
|
|
],
|
|
"properties": {
|
|
"valuesOverride": {
|
|
"description": "Custom Helm values overrides.",
|
|
"type": "object",
|
|
"default": {},
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"controlPlane": {
|
|
"description": "Kubernetes control-plane configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"apiServer",
|
|
"controllerManager",
|
|
"konnectivity",
|
|
"replicas",
|
|
"scheduler"
|
|
],
|
|
"properties": {
|
|
"apiServer": {
|
|
"description": "API Server configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"extraArgs": {
|
|
"description": "Extra command-line flags appended to the tenant kube-apiserver, passed through to KamajiControlPlane `spec.apiServer.extraArgs`. For OIDC use `spec.oidc.mode` — this passthrough is the escape hatch for other apiserver flags (`--requestheader-uid-headers=X-Remote-Uid`, feature gates, etc). Do NOT add legacy `--oidc-*` flags here when `spec.oidc.mode` is not `None`; the chart injects `--authentication-config` and the apiserver refuses to boot with both. Empty by default (no change to current behavior).",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"extraVolumeMounts": {
|
|
"description": "Extra volume mounts added to the tenant kube-apiserver container, passed through to KamajiControlPlane `spec.apiServer.extraVolumeMounts`. Each `name` must reference a volume declared in `extraVolumes`; the chart-managed talos secret volumes cannot be mounted. Each item is a core/v1 VolumeMount. Empty by default.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
},
|
|
"extraVolumes": {
|
|
"description": "Extra volumes added to the control-plane Deployment, passed through to KamajiControlPlane `spec.deployment.extraVolumes`. Use to mount a ConfigMap or Secret holding an AuthenticationConfiguration file referenced by `extraArgs`. Each item is a core/v1 Volume, but because the control-plane pod runs on the management cluster only `configMap` and `secret` sources are allowed (host-reaching sources like `hostPath`/`csi` and token-projection via `projected` are rejected); each volume must have a unique, non-empty name and exactly one source. The names `talos-ca` and `talos-tls-cert` are reserved by the chart. Empty by default.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"x-kubernetes-preserve-unknown-fields": true
|
|
}
|
|
},
|
|
"resources": {
|
|
"description": "CPU and memory resources for API Server.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "c1.medium",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"controllerManager": {
|
|
"description": "Controller Manager configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Controller Manager.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"konnectivity": {
|
|
"description": "Konnectivity configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"server"
|
|
],
|
|
"properties": {
|
|
"server": {
|
|
"description": "Konnectivity Server configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Konnectivity.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"replicas": {
|
|
"description": "Number of control-plane replicas.",
|
|
"type": "integer",
|
|
"default": 2
|
|
},
|
|
"scheduler": {
|
|
"description": "Scheduler configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"resources",
|
|
"resourcesPreset"
|
|
],
|
|
"properties": {
|
|
"resources": {
|
|
"description": "CPU and memory resources for Scheduler.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Preset if `resources` omitted.",
|
|
"type": "string",
|
|
"default": "t1.micro",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"images": {
|
|
"description": "Optional image overrides for air-gapped or rate-limited registries.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"kubectl": {
|
|
"description": "Image used by the bootstrap-token tenant Job (kubectl). Empty falls back to images/kubectl.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"talosCsrSigner": {
|
|
"description": "Image used by the talos-csr-signer sidecar in the Kamaji control plane. Empty falls back to images/talos-csr-signer.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"waitForKubeconfig": {
|
|
"description": "Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.",
|
|
"type": "string",
|
|
"default": ""
|
|
}
|
|
}
|
|
},
|
|
"talos": {
|
|
"description": "Talos worker image configuration.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"imageFactoryURL",
|
|
"installerRepository",
|
|
"schematicID",
|
|
"version"
|
|
],
|
|
"properties": {
|
|
"imageFactoryURL": {
|
|
"description": "Base URL of the Talos Image Factory that serves the worker OS disk image (the `openstack-amd64.raw.xz` raw artifact streamed in by CDI over HTTP). Defaults to the public factory. Point at a self-hosted Image Factory, a caching mirror, or an internal HTTP file server for air-gapped, rate-limited, or flaky-egress environments. No trailing slash.",
|
|
"type": "string",
|
|
"default": "https://factory.talos.dev"
|
|
},
|
|
"installerRepository": {
|
|
"description": "OCI repository prefix for the Talos installer image used by the in-guest `talos-reconcile` upgrade Job. Resolved as `\u003cinstallerRepository\u003e/\u003cschematicID\u003e:\u003cversion\u003e`. Defaults to the public factory's installer path. Override for air-gapped or mirrored registries. No trailing slash.",
|
|
"type": "string",
|
|
"default": "factory.talos.dev/installer"
|
|
},
|
|
"schematicID": {
|
|
"description": "Talos image-factory schematic ID. Defaults to the cozystack-tested vanilla schematic. Operators using custom schematics (system extensions, kernel args) override here.",
|
|
"type": "string",
|
|
"default": "ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515"
|
|
},
|
|
"version": {
|
|
"description": "Talos release used for worker OS image and installer. Must satisfy the chart's Talos\u003c-\u003eKubernetes support matrix against the chosen `version`.",
|
|
"type": "string",
|
|
"default": "v1.13.6"
|
|
}
|
|
}
|
|
},
|
|
"nodeHealthCheck": {
|
|
"description": "MachineHealthCheck tuning for worker node groups.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"maxUnhealthy",
|
|
"nodeStartupTimeout"
|
|
],
|
|
"properties": {
|
|
"maxUnhealthy": {
|
|
"description": "Maximum number of unhealthy nodes tolerated per node group before remediation is paused. The MHC admission webhook accepts either a bare integer (\"0\", \"1\", ...) or a percentage (\"0%\", \"50%\"); bare numeric strings are rejected, so the safer default is to express the value as a percentage. Default \"50%\" leaves headroom for transient unhealthy nodes during the kubeadm-to-Talos rollover and slow first boots from factory.talos.dev. Drop to \"0%\" once the fleet is stable on Talos workers.",
|
|
"type": "string",
|
|
"default": "50%"
|
|
},
|
|
"nodeStartupTimeout": {
|
|
"description": "Maximum time a Machine is allowed to spend reaching the Ready condition before it is remediated. Raise for slow first boots (Talos image fetch from factory.talos.dev or a busy storage class on the kubevirt-csi PVC populator).",
|
|
"type": "string",
|
|
"default": "10m"
|
|
}
|
|
}
|
|
},
|
|
"oidc": {
|
|
"description": "OIDC authentication and per-user RBAC for the tenant kube-apiserver. See docs/oidc-tenant.md for the operator guide.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"mode"
|
|
],
|
|
"properties": {
|
|
"customConfig": {
|
|
"description": "Tenant-supplied AuthenticationConfiguration; consumed only when `mode: CustomConfig`.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"config": {
|
|
"description": "Inline AuthenticationConfiguration YAML (`apiserver.config.k8s.io/v1beta1`). The chart writes the value verbatim into a Secret mounted at `/etc/kubernetes/authentication-config/config.yaml` on the kube-apiserver. Mutually exclusive with `secretRef.name`.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"secretRef": {
|
|
"description": "Reference to an existing Secret in the tenant namespace carrying the `AuthenticationConfiguration`.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"name": {
|
|
"description": "Name of an existing Secret in the tenant (release) namespace whose `config.yaml` key holds an `apiserver.config.k8s.io/v1beta1` `AuthenticationConfiguration`. Mutually exclusive with `customConfig.config`.",
|
|
"type": "string",
|
|
"default": ""
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mode": {
|
|
"description": "Identity mode. `None`: no OIDC, only the static admin kubeconfig works. `System`: trust the platform `cozy` realm via a per-cluster public client with audience binding; zero-config default. `CustomConfig`: trust a tenant-supplied issuer directly (BYO); `cozy` is not in the path.",
|
|
"type": "string",
|
|
"default": "None",
|
|
"enum": [
|
|
"None",
|
|
"System",
|
|
"CustomConfig"
|
|
]
|
|
},
|
|
"users": {
|
|
"description": "Users granted access to the tenant cluster; each entry produces one ClusterRoleBinding inside the tenant cluster. Works for both `System` and `CustomConfig` modes.",
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"required": [
|
|
"email",
|
|
"role"
|
|
],
|
|
"properties": {
|
|
"email": {
|
|
"description": "Email address matched against the `email` claim from the issuer. Used verbatim as the `User:` subject in the ClusterRoleBinding inside the tenant cluster. The `email` claim is a built-in OIDC scope requested explicitly by the chart-generated `kubectl oidc-login` kubeconfig; every conformant OIDC provider (cozy realm included) emits it.",
|
|
"type": "string"
|
|
},
|
|
"role": {
|
|
"description": "Role to bind: `admin` maps to `ClusterRole/cluster-admin`, `view` maps to `ClusterRole/view`.",
|
|
"type": "string",
|
|
"enum": [
|
|
"admin",
|
|
"view"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|