SD Immutable Kind Schema

This document explains the full schema for the kind: Immutable for the furyctl.yaml file used by furyctl. This configuration file will be used to provision and deploy bare metal nodes with iPXE boot, storage partitioning, network configuration, and the SIGHUP Distribution modules for immutable Kubernetes infrastructure.

An example configuration file can be created by running the following command:

furyctl create config --kind Immutable --version v1.35.1 --name test-cluster

note

Replace the version with your desired version of the SIGHUP Distribution.

Properties

Property	Type	Required
apiVersion	string	Required
flags	object	Optional
kind	string	Required
metadata	object	Required
spec	object	Required

Description

A SIGHUP Distribution Kubernetes Cluster deployed on bare metal infrastructure with iPXE boot provisioning and immutable OS configuration.

.apiVersion

Constraints

pattern: the string must match the following regular expression:

^kfd\.sighup\.io/v\d+((alpha|beta)\d+)?$

try pattern

.flags

Description

Persistent furyctl command flags, see the documentation for more details: https://docs.sighup.io/furyctl/flags-configuration

.kind

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Immutable"

.metadata

Properties

Property	Type	Required
name	string	Required

.metadata.name

Description

The name of the cluster. It will also be used as a prefix for all the other resources created.

Constraints

maximum length: the maximum number of characters for this string is: 56

minimum length: the minimum number of characters for this string is: 1

.spec

Properties

Property	Type	Required
distribution	object	Required
distributionVersion	string	Required
infrastructure	object	Required
kubernetes	object	Required
plugins	object	Optional
toolsConfiguration	object	Optional

.spec.distribution

Properties

Property	Type	Required
common	object	Optional
customPatches	object	Optional
customResources	object	Optional
modules	object	Required

.spec.distribution.common

Properties

Property	Type	Required
networkPoliciesEnabled	boolean	Optional
nodeSelector	object	Optional
provider	object	Optional
registry	string	Optional
relativeVendorPath	string	Optional
tolerations	array	Optional

Description

Common configuration for all the distribution modules.

.spec.distribution.common.networkPoliciesEnabled

Description

EXPERIMENTAL FEATURE. This field defines whether Network Policies are provided for core modules.

.spec.distribution.common.nodeSelector

Description

The node selector to use to place the pods for all the SD modules. Follows Kubernetes selector format. Example: node.kubernetes.io/role: infra.

.spec.distribution.common.provider

Properties

Property	Type	Required
type	string	Required

.spec.distribution.common.provider.type

Description

The provider type. Don't set. FOR INTERNAL USE ONLY.

.spec.distribution.common.registry

Description

URL of the registry where to pull images from for the Distribution phase. (Default is registry.sighup.io/fury).

NOTE: If plugins are pulling from the default registry, the registry will be replaced for the plugin too.

.spec.distribution.common.relativeVendorPath

Description

The relative path to the vendor directory, does not need to be changed.

.spec.distribution.common.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

An array with the tolerations that will be added to the pods for all the SD modules. Follows Kubernetes tolerations format. Example:

- effect: NoSchedule
  key: node.kubernetes.io/role
  value: infra

.spec.distribution.common.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.common.tolerations.key

Description

The key of the toleration

.spec.distribution.common.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.common.tolerations.value

Description

The value of the toleration

.spec.distribution.customPatches

Properties

Property	Type	Required
configMapGenerator	array	Optional
images	array	Optional
patches	array	Optional
patchesStrategicMerge	array	Optional
secretGenerator	array	Optional

.spec.distribution.customPatches.configMapGenerator

Properties

Property	Type	Required
behavior	string	Optional
envs	array	Optional
files	array	Optional
literals	array	Optional
name	string	Required
namespace	string	Optional
options	object	Optional

.spec.distribution.customPatches.configMapGenerator.behavior

Description

The behavior of the configmap

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"create"
"replace"
"merge"

.spec.distribution.customPatches.configMapGenerator.envs

Description

The envs of the configmap

.spec.distribution.customPatches.configMapGenerator.files

Description

The files of the configmap

.spec.distribution.customPatches.configMapGenerator.literals

Description

The literals of the configmap

.spec.distribution.customPatches.configMapGenerator.name

Description

The name of the configmap

.spec.distribution.customPatches.configMapGenerator.namespace

Description

The namespace of the configmap

.spec.distribution.customPatches.configMapGenerator.options

Properties

Property	Type	Required
annotations	object	Optional
disableNameSuffixHash	boolean	Optional
immutable	boolean	Optional
labels	object	Optional

.spec.distribution.customPatches.configMapGenerator.options.annotations

Description

The annotations of the configmap

.spec.distribution.customPatches.configMapGenerator.options.disableNameSuffixHash

Description

If true, the name suffix hash will be disabled

.spec.distribution.customPatches.configMapGenerator.options.immutable

Description

If true, the configmap will be immutable

.spec.distribution.customPatches.configMapGenerator.options.labels

Description

The labels of the configmap

.spec.distribution.customPatches.images

Description

Each entry should follow the format of Kustomize's images patch

.spec.distribution.customPatches.patches

Properties

Property	Type	Required
options	object	Optional
patch	string	Optional
path	string	Optional
target	object	Optional

.spec.distribution.customPatches.patches.options

Properties

Property	Type	Required
allowKindChange	boolean	Optional
allowNameChange	boolean	Optional

.spec.distribution.customPatches.patches.options.allowKindChange

Description

If true, the kind change will be allowed

.spec.distribution.customPatches.patches.options.allowNameChange

Description

If true, the name change will be allowed

.spec.distribution.customPatches.patches.patch

Description

The patch content

.spec.distribution.customPatches.patches.path

Description

The path of the patch

.spec.distribution.customPatches.patches.target

Properties

Property	Type	Required
annotationSelector	string	Optional
group	string	Optional
kind	string	Optional
labelSelector	string	Optional
name	string	Optional
namespace	string	Optional
version	string	Optional

.spec.distribution.customPatches.patches.target.annotationSelector

Description

The annotation selector of the target

.spec.distribution.customPatches.patches.target.group

Description

The group of the target

.spec.distribution.customPatches.patches.target.kind

Description

The kind of the target

.spec.distribution.customPatches.patches.target.labelSelector

Description

The label selector of the target

.spec.distribution.customPatches.patches.target.name

Description

The name of the target

.spec.distribution.customPatches.patches.target.namespace

Description

The namespace of the target

.spec.distribution.customPatches.patches.target.version

Description

The version of the target

.spec.distribution.customPatches.patchesStrategicMerge

Description

Each entry should be either a relative file path or an inline content resolving to a partial or complete resource definition

.spec.distribution.customPatches.secretGenerator

Properties

Property	Type	Required
behavior	string	Optional
envs	array	Optional
files	array	Optional
literals	array	Optional
name	string	Required
namespace	string	Optional
options	object	Optional
type	string	Optional

.spec.distribution.customPatches.secretGenerator.behavior

Description

The behavior of the secret

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"create"
"replace"
"merge"

.spec.distribution.customPatches.secretGenerator.envs

Description

The envs of the secret

.spec.distribution.customPatches.secretGenerator.files

Description

The files of the secret

.spec.distribution.customPatches.secretGenerator.literals

Description

The literals of the secret

.spec.distribution.customPatches.secretGenerator.name

Description

The name of the secret

.spec.distribution.customPatches.secretGenerator.namespace

Description

The namespace of the secret

.spec.distribution.customPatches.secretGenerator.options

Properties

Property	Type	Required
annotations	object	Optional
disableNameSuffixHash	boolean	Optional
immutable	boolean	Optional
labels	object	Optional

.spec.distribution.customPatches.secretGenerator.options.annotations

Description

The annotations of the secret

.spec.distribution.customPatches.secretGenerator.options.disableNameSuffixHash

Description

If true, the name suffix hash will be disabled

.spec.distribution.customPatches.secretGenerator.options.immutable

Description

If true, the secret will be immutable

.spec.distribution.customPatches.secretGenerator.options.labels

Description

The labels of the secret

.spec.distribution.customPatches.secretGenerator.type

Description

The type of the secret

.spec.distribution.customResources

Description

Add custom resources to the distribution phase. Each entry should point to a resource file, a kustomize base, or a remote resource (e.g. a git repository or URL). customResources should be used when you need the resources to be applyed in the distribution phase together with the rest of the modules; prefer using Plugins instead when possible.

.spec.distribution.modules

Properties

Property	Type	Required
auth	object	Optional
dr	object	Required
ingress	object	Required
logging	object	Required
monitoring	object	Optional
networking	object	Optional
policy	object	Required
tracing	object	Optional

.spec.distribution.modules.auth

Properties

Property	Type	Required
baseDomain	string	Optional
dex	object	Optional
oidcKubernetesAuth	object	Optional
oidcTrustedCA	string	Optional
overrides	object	Optional
pomerium	object	Optional
provider	object	Required

Description

Configuration for the Auth module.

.spec.distribution.modules.auth.baseDomain

Description

The base domain for the ingresses created by the Auth module (Gangplank, Pomerium, Dex). Notice that when the ingress module type is dual, these will use the external ingress class.

.spec.distribution.modules.auth.dex

Properties

Property	Type	Required
additionalStaticClients	array	Optional
connectors	array	Required
expiry	object	Optional
overrides	object	Optional

Description

Configuration for the Dex package.

.spec.distribution.modules.auth.dex.additionalStaticClients

Description

Additional static clients defitions that will be added to the default clients included with the distribution in Dex's configuration. Example:

additionalStaticClients:
  - id: my-custom-client
    name: "A custom additional static client"
    redirectURIs:
      - "https://myapp.tld/redirect"
      - "https://alias.tld/oidc-callback"
    secret: supersecretpassword

Reference: https://dexidp.io/docs/connectors/local/

.spec.distribution.modules.auth.dex.connectors

Description

A list with each item defining a Dex connector. Follows Dex connectors configuration format: https://dexidp.io/docs/connectors/

.spec.distribution.modules.auth.dex.expiry

Properties

Property	Type	Required
idTokens	string	Optional
signingKeys	string	Optional

.spec.distribution.modules.auth.dex.expiry.idTokens

Description

Dex ID tokens expiration time duration (default 24h).

.spec.distribution.modules.auth.dex.expiry.signingKeys

Description

Dex signing key expiration time duration (default 6h).

.spec.distribution.modules.auth.dex.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.auth.dex.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.auth.dex.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.auth.dex.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.auth.dex.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.auth.dex.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.auth.dex.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.auth.oidcKubernetesAuth

Properties

Property	Type	Required
clientID	string	Optional
clientSecret	string	Optional
emailClaim	string	Optional
enabled	boolean	Required
namespace	string	Optional
removeCAFromKubeconfig	boolean	Optional
scopes	array	Optional
sessionSecurityKey	string	Optional
usernameClaim	string	Optional

.spec.distribution.modules.auth.oidcKubernetesAuth.clientID

Description

The client ID that the Kubernetes API will use to authenticate against the OIDC provider (Dex).

.spec.distribution.modules.auth.oidcKubernetesAuth.clientSecret

Description

The client secret that the Kubernetes API will use to authenticate against the OIDC provider (Dex).

.spec.distribution.modules.auth.oidcKubernetesAuth.emailClaim

Description

DEPRECATED. Defaults to email.

.spec.distribution.modules.auth.oidcKubernetesAuth.enabled

Description

If true, components needed for interacting with the Kubernetes API with OIDC authentication (Gangplank, Dex) be deployed and configued.

.spec.distribution.modules.auth.oidcKubernetesAuth.namespace

Description

The namespace to set in the context of the kubeconfig file generated by Gangplank. Defaults to default.

.spec.distribution.modules.auth.oidcKubernetesAuth.removeCAFromKubeconfig

Description

Set to true to remove the CA from the kubeconfig file generated by Gangplank.

.spec.distribution.modules.auth.oidcKubernetesAuth.scopes

Description

Used to specify the scope of the requested Oauth authorization by Gangplank. Defaults to: ["openid", "profile", "email", "offline_access", "groups"]

.spec.distribution.modules.auth.oidcKubernetesAuth.sessionSecurityKey

Description

The Key to use for the sessions in Gangplank. Must be different between different instances of Gangplank.

.spec.distribution.modules.auth.oidcKubernetesAuth.usernameClaim

Description

The JWT claim to use as the username. This is used in Gangplank's UI. This is combined with the clusterName for the user portion of the kubeconfig. Defaults to nickname.

.spec.distribution.modules.auth.oidcTrustedCA

Description

The Certificate Authority certificate file's content to trust for self-signed certificates at the OAuth2 URL. You can use the "{file://<path>}" notation to get the content from a file.

.spec.distribution.modules.auth.overrides

Properties

Property	Type	Required
ingresses	object	Optional
nodeSelector	object	Optional
tolerations	array	Optional

Description

Override the common configuration with a particular configuration for the Auth module.

.spec.distribution.modules.auth.overrides.ingresses

Properties

Property	Type	Required
dex	object	Optional
gangplank	object	Optional

Description

Override the definition of the Auth module ingresses.

.spec.distribution.modules.auth.overrides.ingresses.dex

Properties

Property	Type	Required
host	string	Required
ingressClass	string	Required

.spec.distribution.modules.auth.overrides.ingresses.dex.host

Description

Use this host for the ingress instead of the default one.

.spec.distribution.modules.auth.overrides.ingresses.dex.ingressClass

Description

Use this ingress class for the ingress instead of the default one.

.spec.distribution.modules.auth.overrides.ingresses.gangplank

Properties

Property	Type	Required
host	string	Required
ingressClass	string	Required

.spec.distribution.modules.auth.overrides.ingresses.gangplank.host

Description

Use this host for the ingress instead of the default one.

.spec.distribution.modules.auth.overrides.ingresses.gangplank.ingressClass

Description

Use this ingress class for the ingress instead of the default one.

.spec.distribution.modules.auth.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the Auth module.

.spec.distribution.modules.auth.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the Auth module.

.spec.distribution.modules.auth.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.auth.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.auth.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.auth.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.auth.pomerium

Properties

Property	Type	Required
defaultRoutesPolicy	object	Optional
overrides	object	Optional
policy	string	Optional
routes	array	Optional
secrets	object	Required

Description

Configuration for Pomerium, an identity-aware reverse proxy used for SSO.

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy

Properties

Property	Type	Required
gatekeeperPolicyManager	array	Optional
hubbleUi	array	Optional
ingressForecastle	array	Optional
loggingMinioConsole	array	Optional
loggingOpensearchDashboards	array	Optional
monitoringAlertmanager	array	Optional
monitoringGrafana	array	Optional
monitoringMinioConsole	array	Optional
monitoringPrometheus	array	Optional
tracingMinioConsole	array	Optional
whisker	array	Optional

Description

override default routes for SD components

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.gatekeeperPolicyManager

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.hubbleUi

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.ingressForecastle

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.loggingMinioConsole

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.loggingOpensearchDashboards

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.monitoringAlertmanager

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.monitoringGrafana

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.monitoringMinioConsole

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.monitoringPrometheus

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.tracingMinioConsole

.spec.distribution.modules.auth.pomerium.defaultRoutesPolicy.whisker

.spec.distribution.modules.auth.pomerium.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.auth.pomerium.overrides.nodeSelector

.spec.distribution.modules.auth.pomerium.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Required

.spec.distribution.modules.auth.pomerium.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.auth.pomerium.overrides.tolerations.key

.spec.distribution.modules.auth.pomerium.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.auth.pomerium.overrides.tolerations.value

.spec.distribution.modules.auth.pomerium.policy

Description

DEPRECATED: Use defaultRoutesPolicy and/or routes

.spec.distribution.modules.auth.pomerium.routes

Description

Additional routes configuration for Pomerium. Follows Pomerium's route format: https://www.pomerium.com/docs/reference/routes

.spec.distribution.modules.auth.pomerium.secrets

Properties

Property	Type	Required
COOKIE_SECRET	string	Required
IDP_CLIENT_SECRET	string	Required
SHARED_SECRET	string	Required
SIGNING_KEY	string	Required

Description

Pomerium needs some user-provided secrets to be fully configured. These secrets should be unique between clusters.

.spec.distribution.modules.auth.pomerium.secrets.COOKIE_SECRET

Description

Cookie Secret is the secret used to encrypt and sign session cookies.

To generate a random key, run the following command: head -c32 /dev/urandom | base64

.spec.distribution.modules.auth.pomerium.secrets.IDP_CLIENT_SECRET

Description

Identity Provider Client Secret is the OAuth 2.0 Secret Identifier. When auth type is SSO, this value will be the secret used to authenticate Pomerium with Dex, use a strong random value.

.spec.distribution.modules.auth.pomerium.secrets.SHARED_SECRET

Description

Shared Secret is the base64-encoded, 256-bit key used to mutually authenticate requests between Pomerium services. It's critical that secret keys are random, and stored safely.

To generate a key, run the following command: head -c32 /dev/urandom | base64

.spec.distribution.modules.auth.pomerium.secrets.SIGNING_KEY

Description

Signing Key is the base64 representation of one or more PEM-encoded private keys used to sign a user's attestation JWT, which can be consumed by upstream applications to pass along identifying user information like username, id, and groups.

To generates an P-256 (ES256) signing key:

openssl ecparam -genkey -name prime256v1 -noout -out ec_private.pem
# careful! this will output your private key in terminal
cat ec_private.pem | base64

.spec.distribution.modules.auth.provider

Properties

Property	Type	Required
basicAuth	object	Optional
type	string	Required

.spec.distribution.modules.auth.provider.basicAuth

Properties

Property	Type	Required
password	string	Required
username	string	Required

Description

Configuration for the HTTP Basic Auth provider.

.spec.distribution.modules.auth.provider.basicAuth.password

Description

The password for logging in with the HTTP basic authentication.

.spec.distribution.modules.auth.provider.basicAuth.username

Description

The username for logging in with the HTTP basic authentication.

.spec.distribution.modules.auth.provider.type

Description

The type of the Auth provider, options are:

• none: will disable authentication in the infrastructural ingresses.
• sso: will protect the infrastructural ingresses with Pomerium and Dex (SSO) and require authentication before accessing them.
• basicAuth: will protect the infrastructural ingresses with HTTP basic auth (username and password) authentication.

Default is none.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"basicAuth"
"sso"

.spec.distribution.modules.dr

Properties

Property	Type	Required
etcdBackup	object	Optional
overrides	object	Optional
type	string	Required
velero	object	Optional

Description

Configuration for the Disaster Recovery module.

.spec.distribution.modules.dr.etcdBackup

Properties

Property	Type	Required
backupPrefix	string	Optional
pvc	object	Optional
s3	object	Optional
type	string	Optional

Description

Configuration for the ETCD backup package.

.spec.distribution.modules.dr.etcdBackup.backupPrefix

Description

A prefix to be prepended to the backup filenames. If unset, the prefix defaults to the cluster's name.

.spec.distribution.modules.dr.etcdBackup.pvc

Properties

Property	Type	Required
accessModes	array	Optional
name	string	Optional
retentionTime	string	Optional
schedule	string	Optional
size	string	Optional
storageClass	string	Optional

Description

Configuration parameters for the pvc type of etcdBackup.

.spec.distribution.modules.dr.etcdBackup.pvc.accessModes

Description

The accessModes that the furyctl-managed PersistentVolumeClaim will use. This has no effect and is ignored if name is set. Default is ["ReadOnlyOnce"]

.spec.distribution.modules.dr.etcdBackup.pvc.name

Description

The PersistentVolumeClaim name where the backups will be saved. If set, size and storageClass will be ignored and etcd-backup will use the PersistentVolumeClaim that matches the name set. Please note that the PersistentVolumeClaim must be created inside the kube-system namespace.

If you leave name unset furyctl will create a PersistentVolumeClaim for you with an arbitrary name.

.spec.distribution.modules.dr.etcdBackup.pvc.retentionTime

Description

The retention time of the backups inside the PersistentVolumeClaim. Follows rclone's min-age format. Example: '30d' for 30 days. Default is 10d (ten days).

.spec.distribution.modules.dr.etcdBackup.pvc.schedule

Description

The cron expression for the etcd-backup-pvc backup schedule. Default is 0 1 * * * (everyday at 01:00).

.spec.distribution.modules.dr.etcdBackup.pvc.size

Description

The size that the furyctl-managed PersistentVolumeClaim will use. This has no effect and is ignored if name is set. Default is 10G.

.spec.distribution.modules.dr.etcdBackup.pvc.storageClass

Description

The storage class that the furyctl-managed PersistentVolumeClaim will use. This has no effect and is ignored if name is set. Default is default.

.spec.distribution.modules.dr.etcdBackup.s3

Properties

Property	Type	Required
accessKeyId	string	Required
bucketName	string	Required
endpoint	string	Required
insecure	boolean	Optional
retentionTime	string	Optional
schedule	string	Optional
secretAccessKey	string	Required

Description

Configuration parameters for the s3 type of etcdBackup.

.spec.distribution.modules.dr.etcdBackup.s3.accessKeyId

Description

The access key ID (username) for the external S3-compatible bucket.

.spec.distribution.modules.dr.etcdBackup.s3.bucketName

Description

The bucket name of the external S3-compatible object storage.

.spec.distribution.modules.dr.etcdBackup.s3.endpoint

Description

External S3-compatible endpoint for etcd-backup-s3's storage.

.spec.distribution.modules.dr.etcdBackup.s3.insecure

Description

If true, will use HTTP as protocol instead of HTTPS.

.spec.distribution.modules.dr.etcdBackup.s3.retentionTime

Description

The retention time of the external S3-compatible object storage. Follows rclone's min-age format. Example: '30d' for 30 days. Default is 10d (ten days).

.spec.distribution.modules.dr.etcdBackup.s3.schedule

Description

The cron expression for the etcd-backup-s3 backup schedule. Default is 0 1 * * * (everyday at 01:00).

.spec.distribution.modules.dr.etcdBackup.s3.secretAccessKey

Description

The secret access key (password) for the external S3-compatible bucket.

.spec.distribution.modules.dr.etcdBackup.type

Description

The type of the etcd backup to enable, options are:

• none: no etcd backup CronJob will be installed and no etcd backup will be performed.
• s3: the etcd-backup-s3 package will be enabled. It will deploy a CronJob which continuously snapshots a healthy etcd node and will save the backups in a configured S3 bucket.
• pvc: the etcd-backup-pvc package will be enabled. It will deploy a CronJob which continuously snapshots a healthy etcd node and will save the backups in a configured PersistentVolumeClaim.
• all: both kinds of backups will be enabled.

Default is none.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"s3"
"pvc"
"none"
"all"

.spec.distribution.modules.dr.overrides

Properties

Property	Type	Required
ingresses	object	Optional
nodeSelector	object	Optional
tolerations	array	Optional

Description

Override the common configuration with a particular configuration for the module.

.spec.distribution.modules.dr.overrides.ingresses

.spec.distribution.modules.dr.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the module.

.spec.distribution.modules.dr.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the module.

.spec.distribution.modules.dr.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.dr.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.dr.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.dr.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.dr.type

Description

The type of the Disaster Recovery, must be none or on-premises. none disables the module and on-premises will install Velero, an optional MinIO deployment and optionally etcd-backup.

Default is none.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"on-premises"

.spec.distribution.modules.dr.velero

Properties

Property	Type	Required
backend	string	Optional
externalEndpoint	object	Optional
gcs	object	Optional
nodeAgent	object	Optional
overrides	object	Optional
schedules	object	Optional
snapshotController	object	Optional

Description

Configuration for the Velero package.

.spec.distribution.modules.dr.velero.backend

Description

The storage backend type for Velero. minio will use an in-cluster MinIO deployment for object storage, externalEndpoint can be used to point to an external S3-compatible object storage instead of deploying an in-cluster MinIO, gcs can be used to point to an external GCS object storage instead of deploying an in-cluster MinIO.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"minio"
"externalEndpoint"
"gcs"

.spec.distribution.modules.dr.velero.externalEndpoint

Properties

Property	Type	Required
accessKeyId	string	Optional
accessMode	string	Optional
bucketName	string	Optional
endpoint	string	Optional
insecure	boolean	Optional
prefixName	string	Optional
secretAccessKey	string	Optional

Description

Configuration for Velero's external storage backend.

.spec.distribution.modules.dr.velero.externalEndpoint.accessKeyId

Description

The access key ID (username) for the external S3-compatible bucket.

.spec.distribution.modules.dr.velero.externalEndpoint.accessMode

Description

How Velero can access the backup storage location.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"ReadWrite"
"ReadOnly"

.spec.distribution.modules.dr.velero.externalEndpoint.bucketName

Description

The bucket name of the external object storage.

.spec.distribution.modules.dr.velero.externalEndpoint.endpoint

Description

External S3-compatible endpoint for Velero's storage.

.spec.distribution.modules.dr.velero.externalEndpoint.insecure

Description

If true, will use HTTP as protocol instead of HTTPS.

.spec.distribution.modules.dr.velero.externalEndpoint.prefixName

Description

The prefix name to use inside the bucket.

.spec.distribution.modules.dr.velero.externalEndpoint.secretAccessKey

Description

The secret access key (password) for the external S3-compatible bucket.

.spec.distribution.modules.dr.velero.gcs

Properties

Property	Type	Required
accessMode	string	Optional
bucketName	string	Optional
clientEmail	string	Optional
prefixName	string	Optional
serviceAccountString	string	Optional

Description

Configuration for Velero's gcs storage backend.

.spec.distribution.modules.dr.velero.gcs.accessMode

Description

How Velero can access the backup storage location.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"ReadWrite"
"ReadOnly"

.spec.distribution.modules.dr.velero.gcs.bucketName

Description

The bucket name of the gcs object storage.

.spec.distribution.modules.dr.velero.gcs.clientEmail

Description

Full gcs client email.

.spec.distribution.modules.dr.velero.gcs.prefixName

Description

The prefix name to use inside the gcs bucket.

.spec.distribution.modules.dr.velero.gcs.serviceAccountString

Description

Service gcs account JSON string.

.spec.distribution.modules.dr.velero.nodeAgent

Properties

Property	Type	Required
prepareQueueLength	integer	Optional

Description

Configuration for Velero's node-agent DaemonSet.

.spec.distribution.modules.dr.velero.nodeAgent.prepareQueueLength

Description

Defines the maximum number of DataUpload/DataDownload/PodVolumeBackup/PodVolumeRestore CRs under preparation statuses but not yet processed by any node. This constrains the number of intermediate objects (PVCs, VolumeSnapshots, etc.) to prevent unnecessary resource usage when cluster parallelism is limited.

.spec.distribution.modules.dr.velero.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.dr.velero.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.dr.velero.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.dr.velero.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.dr.velero.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.dr.velero.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.dr.velero.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.dr.velero.schedules

Properties

Property	Type	Required
definitions	object	Optional
install	boolean	Optional

Description

Configuration for Velero's backup schedules.

.spec.distribution.modules.dr.velero.schedules.definitions

Properties

Property	Type	Required
full	object	Optional
manifests	object	Optional

Description

Configuration for Velero schedules.

.spec.distribution.modules.dr.velero.schedules.definitions.full

Properties

Property	Type	Required
schedule	string	Optional
snapshotMoveData	boolean	Optional
ttl	string	Optional

Description

Configuration for Velero's manifests backup schedule.

.spec.distribution.modules.dr.velero.schedules.definitions.full.schedule

Description

The cron expression for the full backup schedule (default 0 1 * * *).

.spec.distribution.modules.dr.velero.schedules.definitions.full.snapshotMoveData

Description

EXPERIMENTAL (if you do more than one backups, the following backups after the first are not automatically restorable, see https://github.com/vmware-tanzu/velero/issues/7057#issuecomment-2466815898 for the manual restore solution): SnapshotMoveData specifies whether snapshot data should be moved. Velero will create a new volume from the snapshot and upload the content to the storageLocation.

.spec.distribution.modules.dr.velero.schedules.definitions.full.ttl

Description

The Time To Live (TTL) of the backups created by the backup schedules (default 720h0m0s, 30 days). Notice that changing this value will affect only newly created backups, prior backups will keep the old TTL.

.spec.distribution.modules.dr.velero.schedules.definitions.manifests

Properties

Property	Type	Required
schedule	string	Optional
ttl	string	Optional

Description

Configuration for Velero's manifests backup schedule.

.spec.distribution.modules.dr.velero.schedules.definitions.manifests.schedule

Description

The cron expression for the manifests backup schedule (default */15 * * * *).

.spec.distribution.modules.dr.velero.schedules.definitions.manifests.ttl

Description

The Time To Live (TTL) of the backups created by the backup schedules (default 720h0m0s, 30 days). Notice that changing this value will affect only newly created backups, prior backups will keep the old TTL.

.spec.distribution.modules.dr.velero.schedules.install

Description

Whether to install or not the default manifests and full backups schedules. Default is true.

.spec.distribution.modules.dr.velero.snapshotController

Properties

Property	Type	Required
install	boolean	Optional

Description

Configuration for the additional snapshotController component installation.

.spec.distribution.modules.dr.velero.snapshotController.install

Description

Whether to install or not the snapshotController component in the cluster. Before enabling this field, check if your CSI driver does not have snapshotController built-in.

.spec.distribution.modules.ingress

Properties

Property	Type	Required
baseDomain	string	Required
byoic	object	Optional
certManager	object	Optional
forecastle	object	Optional
haproxy	object	Optional
infrastructureIngressController	string	Optional
nginx	object	Optional
overrides	object	Optional

.spec.distribution.modules.ingress.baseDomain

Description

The base domain used for all the SD's infrastructural ingresses. If using the nginx dual type, this value should be the same as the domain associated with the internal ingress class.

.spec.distribution.modules.ingress.byoic

Properties

Property	Type	Required
commonAnnotations	object	Optional
enabled	boolean	Required
ingressClass	string	Optional

Description

Configuration for Bring Your Own Ingress Controller mode. The ingressClass is used for infrastructure ingresses when both controllers are disabled.

.spec.distribution.modules.ingress.byoic.commonAnnotations

Description

Annotations to apply to all infrastructure ingresses when using this BYOIC ingress class. Useful for controller-specific configuration (TLS, auth middlewares, etc.).

.spec.distribution.modules.ingress.byoic.enabled

Description

Enable BYOIC mode.

.spec.distribution.modules.ingress.byoic.ingressClass

Description

The IngressClass to use for infrastructure ingresses (Prometheus, Grafana, etc.) when both nginx and haproxy are disabled.

.spec.distribution.modules.ingress.certManager

Properties

Property	Type	Required
clusterIssuer	object	Required
overrides	object	Optional

Description

Configuration for the cert-manager package. Required even if ingress.nginx.type is none, cert-manager is used for managing other certificates in the cluster besides the TLS termination certificates for the ingresses.

.spec.distribution.modules.ingress.certManager.clusterIssuer

Properties

Property	Type	Required
email	string	Required
name	string	Required
solvers	array	Optional
type	string	Optional

Description

Configuration for the cert-manager's ACME clusterIssuer used to request certificates from Let's Encrypt.

.spec.distribution.modules.ingress.certManager.clusterIssuer.email

Description

The email address to use during the certificate issuing process.

.spec.distribution.modules.ingress.certManager.clusterIssuer.name

Description

The name of the clusterIssuer.

.spec.distribution.modules.ingress.certManager.clusterIssuer.solvers

Description

The list of challenge solvers to use instead of the default one for the http01 challenge. Check cert manager's documentation for examples for this field.

.spec.distribution.modules.ingress.certManager.clusterIssuer.type

Description

The type of the clusterIssuer. Only http01 challenge is supported for on-premises clusters. See solvers for arbitrary configurations.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"http01"

.spec.distribution.modules.ingress.certManager.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.ingress.certManager.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.ingress.certManager.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.ingress.certManager.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.ingress.certManager.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.ingress.certManager.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.ingress.certManager.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.ingress.forecastle

Properties

Property	Type	Required
overrides	object	Optional

.spec.distribution.modules.ingress.forecastle.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.ingress.forecastle.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.ingress.forecastle.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.ingress.forecastle.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.ingress.forecastle.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.ingress.forecastle.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.ingress.forecastle.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.ingress.haproxy

Properties

Property	Type	Required
overrides	object	Optional
tls	object	Optional
type	string	Required

Description

Configuration for HAProxy Kubernetes Ingress Controller.

.spec.distribution.modules.ingress.haproxy.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.ingress.haproxy.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.ingress.haproxy.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.ingress.haproxy.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.ingress.haproxy.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.ingress.haproxy.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.ingress.haproxy.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.ingress.haproxy.tls

Properties

Property	Type	Required
provider	string	Required
secret	object	Optional

Description

TLS configuration for the HAProxy Kubernetes Ingress Controller.

.spec.distribution.modules.ingress.haproxy.tls.provider

Description

The provider of the TLS certificates for the ingresses, one of: none, certManager, or secret.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"certManager"
"secret"
"none"

.spec.distribution.modules.ingress.haproxy.tls.secret

Properties

Property	Type	Required
ca	string	Required
cert	string	Required
key	string	Required

Description

Kubernetes TLS secret for the HAProxy ingresses TLS certificate.

.spec.distribution.modules.ingress.haproxy.tls.secret.ca

Description

The Certificate Authority certificate file's content. You can use the "{file://<path>}" notation to get the content from a file.

.spec.distribution.modules.ingress.haproxy.tls.secret.cert

Description

The certificate file's content. You can use the "{file://<path>}" notation to get the content from a file.

.spec.distribution.modules.ingress.haproxy.tls.secret.key

Description

The signing key file's content. You can use the "{file://<path>}" notation to get the content from a file.

.spec.distribution.modules.ingress.haproxy.type

Description

The type of the HAProxy Kubernetes Ingress Controller, options are:

• none: HAProxy ingress controller will not be installed.
• single: a single HAProxy ingress controller with ingress class haproxy will be installed.
• dual: two independent HAProxy ingress controllers will be installed, one for the haproxy-internal ingress class and one for the haproxy-external ingress class.

Default is none.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"single"
"dual"

.spec.distribution.modules.ingress.infrastructureIngressController

Description

Overrides the default ingress controller for SD infrastructure ingresses. Set to nginx or haproxy to select the controller family; the dual/single class mapping (e.g., haproxy-internal/haproxy-external) is applied automatically based on the controller's type setting. Useful during migrations to keep infrastructure ingresses on one controller while testing another. Do not use this field when both nginx.type and haproxy.type are none: in that case rely on byoic.ingressClass to define the ingress class for SD ingresses.

.spec.distribution.modules.ingress.nginx

Properties

Property	Type	Required
overrides	object	Optional
tls	object	Optional
type	string	Required

Description

(DEPRECATED) Configurations for the Ingress NGINX Controller package.

.spec.distribution.modules.ingress.nginx.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.ingress.nginx.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.ingress.nginx.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.ingress.nginx.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.ingress.nginx.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.ingress.nginx.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.ingress.nginx.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.ingress.nginx.tls

Properties

Property	Type	Required
provider	string	Required
secret	object	Optional

Description

TLS configuration for the Ingress NGINX Controller.

.spec.distribution.modules.ingress.nginx.tls.provider

Description

The provider of the TLS certificates for the ingresses, one of: none, certManager, or secret.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"certManager"
"secret"
"none"

.spec.distribution.modules.ingress.nginx.tls.secret

Properties

Property	Type	Required
ca	string	Required
cert	string	Required
key	string	Required

Description

Kubernetes TLS secret for the ingresses TLS certificate.

.spec.distribution.modules.ingress.nginx.tls.secret.ca

Description

The Certificate Authority certificate file's content. You can use the "{file://<path>}" notation to get the content from a file.

.spec.distribution.modules.ingress.nginx.tls.secret.cert

Description

The certificate file's content. You can use the "{file://<path>}" notation to get the content from a file.

.spec.distribution.modules.ingress.nginx.tls.secret.key

Description

The signing key file's content. You can use the "{file://<path>}" notation to get the content from a file.

.spec.distribution.modules.ingress.nginx.type

Description

The type of the Ingress nginx controller, options are:

• none: no ingress controller will be installed and no infrastructural ingresses will be created.
• single: a single ingress controller with ingress class nginx will be installed to manage all the ingress resources, infrastructural ingresses will be created.
• dual: two independent ingress controllers will be installed, one for the internal ingress class intended for private ingresses and one for the external ingress class intended for public ingresses. SD's infrastructural ingresses wil use the internal ingress class when using the dual type.

Default is single.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"single"
"dual"

.spec.distribution.modules.ingress.overrides

Properties

Property	Type	Required
ingresses	object	Optional
nodeSelector	object	Optional
tolerations	array	Optional

Description

Override the common configuration with a particular configuration for the Ingress module.

.spec.distribution.modules.ingress.overrides.ingresses

Properties

Property	Type	Required
forecastle	object	Optional

.spec.distribution.modules.ingress.overrides.ingresses.forecastle

Properties

Property	Type	Required
disableAuth	boolean	Optional
host	string	Optional
ingressClass	string	Optional

.spec.distribution.modules.ingress.overrides.ingresses.forecastle.disableAuth

Description

If true, the ingress will not have authentication even if .spec.modules.auth.provider.type is SSO or Basic Auth.

.spec.distribution.modules.ingress.overrides.ingresses.forecastle.host

Description

Use this host for the ingress instead of the default one.

.spec.distribution.modules.ingress.overrides.ingresses.forecastle.ingressClass

Description

Use this ingress class for the ingress instead of the default one.

.spec.distribution.modules.ingress.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the Ingress module.

.spec.distribution.modules.ingress.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the Ingress module.

.spec.distribution.modules.ingress.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.ingress.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.ingress.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.ingress.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.logging

Properties

Property	Type	Required
customOutputs	object	Optional
loki	object	Optional
minio	object	Optional
opensearch	object	Optional
operator	object	Optional
overrides	object	Optional
type	string	Required

Description

Configuration for the Logging module.

.spec.distribution.modules.logging.customOutputs

Properties

Property	Type	Required
audit	string	Required
errors	string	Required
events	string	Required
infra	string	Required
ingressHaproxy	string	Required
ingressNginx	string	Required
kubernetes	string	Required
systemdCommon	string	Required
systemdEtcd	string	Required

Description

When using the customOutputs logging type, you need to manually specify the spec of the several Output and ClusterOutputs that the Logging Operator expects to forward the logs collected by the pre-defined flows.

.spec.distribution.modules.logging.customOutputs.audit

Description

This value defines where the output from the audit Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.customOutputs.errors

Description

This value defines where the output from the errors Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.customOutputs.events

Description

This value defines where the output from the events Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.customOutputs.infra

Description

This value defines where the output from the infra Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.customOutputs.ingressHaproxy

Description

This value defines where the output from the ingressHaproxy Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.customOutputs.ingressNginx

Description

This value defines where the output from the ingressNginx Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.customOutputs.kubernetes

Description

This value defines where the output from the kubernetes Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.customOutputs.systemdCommon

Description

This value defines where the output from the systemdCommon Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.customOutputs.systemdEtcd

Description

This value defines where the output from the systemdEtcd Flow will be sent. This will be the spec section of the Output object. It must be a string (and not a YAML object) following the OutputSpec definition. Use the nullout output to discard the flow: nullout: {}

.spec.distribution.modules.logging.loki

Properties

Property	Type	Required
backend	string	Optional
externalEndpoint	object	Optional
resources	object	Optional
retentionTime	string	Optional
tsdbStartDate	string	Optional

Description

Configuration for the Loki package.

.spec.distribution.modules.logging.loki.backend

Description

The storage backend type for Loki. minio will use an in-cluster MinIO deployment for object storage, externalEndpoint can be used to point to an external object storage instead of deploying an in-cluster MinIO.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"minio"
"externalEndpoint"

.spec.distribution.modules.logging.loki.externalEndpoint

Properties

Property	Type	Required
accessKeyId	string	Optional
bucketName	string	Optional
endpoint	string	Optional
insecure	boolean	Optional
secretAccessKey	string	Optional

Description

Configuration for Loki's external storage backend.

.spec.distribution.modules.logging.loki.externalEndpoint.accessKeyId

Description

The access key ID (username) for the external S3-compatible bucket.

.spec.distribution.modules.logging.loki.externalEndpoint.bucketName

Description

The bucket name of the external S3-compatible object storage.

.spec.distribution.modules.logging.loki.externalEndpoint.endpoint

Description

External S3-compatible endpoint for Loki's storage.

.spec.distribution.modules.logging.loki.externalEndpoint.insecure

Description

If true, will use HTTP as protocol instead of HTTPS.

.spec.distribution.modules.logging.loki.externalEndpoint.secretAccessKey

Description

The secret access key (password) for the external S3-compatible bucket.

.spec.distribution.modules.logging.loki.resources

Properties

Property	Type	Required
limits	object	Optional
requests	object	Optional

.spec.distribution.modules.logging.loki.resources.limits

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.logging.loki.resources.limits.cpu

Description

The CPU limit for the Pod, in cores or millicores. Examples: 1000m, 2, 1.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.logging.loki.resources.limits.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.logging.loki.resources.requests

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.logging.loki.resources.requests.cpu

Description

The CPU request for the Pod, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.logging.loki.resources.requests.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.logging.loki.retentionTime

Description

Optional retention period for logs stored in Loki (default 720h, 30 days). Setting it to 0s disables retention. Format must match: [0-9]+(s|m|h|d|w|y).

.spec.distribution.modules.logging.loki.tsdbStartDate

Description

Starting from versions 1.28.4, 1.29.5 and 1.30.0 of SIGHUP Distribution, Loki changed the time series database from BoltDB to TSDB and the schema that it uses to store the logs from v11 to v13.

The value of this field will determine the date when Loki will start writing using the new TSDB and the schema v13, always at midnight UTC. The old BoltDB and schema will be kept until all the logs expire for reading purposes.

From versions 1.29.7, 1.30.2 and 1.31.1 of the Distribution, this field will be immutable once set and its value should be a date before upgrading to one of these versions or creating the cluster, Loki does not support writing BoltDB and schema v11 anymore.

Value must be a string in ISO 8601 date format (yyyy-mm-dd). Example: 2024-11-18.

.spec.distribution.modules.logging.minio

Properties

Property	Type	Required
overrides	object	Optional
rootUser	object	Optional
storageSize	string	Optional

Description

Configuration for Logging's MinIO deployment.

.spec.distribution.modules.logging.minio.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.logging.minio.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.logging.minio.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.logging.minio.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.logging.minio.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.logging.minio.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.logging.minio.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.logging.minio.rootUser

Properties

Property	Type	Required
password	string	Optional
username	string	Optional

.spec.distribution.modules.logging.minio.rootUser.password

Description

The password for the default MinIO root user.

.spec.distribution.modules.logging.minio.rootUser.username

Description

The username for the default MinIO root user.

.spec.distribution.modules.logging.minio.storageSize

Description

The PVC size for each MinIO disk, 6 disks total.

.spec.distribution.modules.logging.opensearch

Properties

Property	Type	Required
overrides	object	Optional
resources	object	Optional
storageSize	string	Optional
type	string	Required

.spec.distribution.modules.logging.opensearch.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.logging.opensearch.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.logging.opensearch.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.logging.opensearch.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.logging.opensearch.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.logging.opensearch.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.logging.opensearch.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.logging.opensearch.resources

Properties

Property	Type	Required
limits	object	Optional
requests	object	Optional

.spec.distribution.modules.logging.opensearch.resources.limits

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.logging.opensearch.resources.limits.cpu

Description

The CPU limit for the Pod, in cores or millicores. Examples: 1000m, 2, 1.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.logging.opensearch.resources.limits.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.logging.opensearch.resources.requests

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.logging.opensearch.resources.requests.cpu

Description

The CPU request for the Pod, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.logging.opensearch.resources.requests.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.logging.opensearch.storageSize

Description

The storage size for the OpenSearch volumes. Follows Kubernetes resources storage requests. Default is 150Gi.

.spec.distribution.modules.logging.opensearch.type

Description

The type of OpenSearch deployment. One of: single for a single replica or triple for an HA 3-replicas deployment.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"single"
"triple"

.spec.distribution.modules.logging.operator

Properties

Property	Type	Required
fluentbit	object	Optional
fluentd	object	Optional
overrides	object	Optional

Description

Configuration for the Logging Operator.

.spec.distribution.modules.logging.operator.fluentbit

Properties

Property	Type	Required
resources	object	Optional

Description

Configuration for Fluent Bit that reads the logs from the workload and forwards them to Fluentd.

.spec.distribution.modules.logging.operator.fluentbit.resources

Properties

Property	Type	Required
limits	object	Optional
requests	object	Optional

.spec.distribution.modules.logging.operator.fluentbit.resources.limits

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.logging.operator.fluentbit.resources.limits.cpu

Description

The CPU limit for the Pod, in cores or millicores. Examples: 1000m, 2, 1.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.logging.operator.fluentbit.resources.limits.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.logging.operator.fluentbit.resources.requests

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.logging.operator.fluentbit.resources.requests.cpu

Description

The CPU request for the Pod, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.logging.operator.fluentbit.resources.requests.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.logging.operator.fluentd

Properties

Property	Type	Required
replicas	integer	Optional
resources	object	Optional

Description

Configuration for Fluentd that collects the logs and forwards them to the outputs.

.spec.distribution.modules.logging.operator.fluentd.replicas

Description

The number of Fluentd replicas to run. Default is 2.

.spec.distribution.modules.logging.operator.fluentd.resources

Properties

Property	Type	Required
limits	object	Optional
requests	object	Optional

.spec.distribution.modules.logging.operator.fluentd.resources.limits

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.logging.operator.fluentd.resources.limits.cpu

Description

The CPU limit for the Pod, in cores or millicores. Examples: 1000m, 2, 1.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.logging.operator.fluentd.resources.limits.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.logging.operator.fluentd.resources.requests

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.logging.operator.fluentd.resources.requests.cpu

Description

The CPU request for the Pod, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.logging.operator.fluentd.resources.requests.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.logging.operator.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.logging.operator.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.logging.operator.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.logging.operator.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.logging.operator.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.logging.operator.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.logging.operator.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.logging.overrides

Properties

Property	Type	Required
ingresses	object	Optional
nodeSelector	object	Optional
tolerations	array	Optional

Description

Override the common configuration with a particular configuration for the module.

.spec.distribution.modules.logging.overrides.ingresses

.spec.distribution.modules.logging.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the module.

.spec.distribution.modules.logging.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the module.

.spec.distribution.modules.logging.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.logging.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.logging.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.logging.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.logging.type

Description

Selects the logging stack. Options are:

• none: will disable the centralized logging.
• opensearch: will deploy and configure the Logging Operator and an OpenSearch cluster (can be single or triple for HA) where the logs will be stored.
• loki: will use a distributed Grafana Loki instead of OpenSearch for storage.
• customOuputs: the Logging Operator will be deployed and installed but without in-cluster storage, you will have to create the needed Outputs and ClusterOutputs to ship the logs to your desired storage.

Default is opensearch.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"opensearch"
"loki"
"customOutputs"

.spec.distribution.modules.monitoring

Properties

Property	Type	Required
alertmanager	object	Optional
blackboxExporter	object	Optional
grafana	object	Optional
kubeStateMetrics	object	Optional
mimir	object	Optional
minio	object	Optional
overrides	object	Optional
prometheus	object	Optional
prometheusAdapter	object	Optional
prometheusAgent	object	Optional
type	string	Required
x509Exporter	object	Optional

Description

Configuration for the Monitoring module.

.spec.distribution.modules.monitoring.alertmanager

Properties

Property	Type	Required
deadManSwitchWebhookUrl	string	Optional
installDefaultRules	boolean	Optional
slackWebhookUrl	string	Optional

.spec.distribution.modules.monitoring.alertmanager.deadManSwitchWebhookUrl

Description

The webhook URL to send dead man's switch monitoring, for example to use with healthchecks.io.

.spec.distribution.modules.monitoring.alertmanager.installDefaultRules

Description

Set to false to avoid installing the Prometheus rules (alerts) included with the distribution.

.spec.distribution.modules.monitoring.alertmanager.slackWebhookUrl

Description

The Slack webhook URL where to send the infrastructural and workload alerts to.

.spec.distribution.modules.monitoring.blackboxExporter

Properties

Property	Type	Required
overrides	object	Optional

.spec.distribution.modules.monitoring.blackboxExporter.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.monitoring.blackboxExporter.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.monitoring.blackboxExporter.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.monitoring.blackboxExporter.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.monitoring.blackboxExporter.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.monitoring.blackboxExporter.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.monitoring.blackboxExporter.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.monitoring.grafana

Properties

Property	Type	Required
basicAuthIngress	boolean	Optional
overrides	object	Optional
usersRoleAttributePath	string	Optional

.spec.distribution.modules.monitoring.grafana.basicAuthIngress

Description

Setting this to true will deploy an additional grafana-basic-auth ingress protected with Grafana's basic auth instead of SSO. It's intended use is as a temporary ingress for when there are problems with the SSO login flow.

Notice that by default anonymous access is enabled.

.spec.distribution.modules.monitoring.grafana.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.monitoring.grafana.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.monitoring.grafana.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.monitoring.grafana.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.monitoring.grafana.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.monitoring.grafana.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.monitoring.grafana.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.monitoring.grafana.usersRoleAttributePath

Description

JMESPath expression to retrieve the user's role. Example:

usersRoleAttributePath: "contains(groups[*], 'beta') && 'Admin' || contains(groups[*], 'gamma') && 'Editor' || contains(groups[*], 'delta') && 'Viewer'

More details in Grafana's documentation.

.spec.distribution.modules.monitoring.kubeStateMetrics

Properties

Property	Type	Required
overrides	object	Optional

.spec.distribution.modules.monitoring.kubeStateMetrics.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.monitoring.kubeStateMetrics.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.monitoring.kubeStateMetrics.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.monitoring.kubeStateMetrics.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.monitoring.kubeStateMetrics.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.monitoring.kubeStateMetrics.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.monitoring.kubeStateMetrics.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.monitoring.mimir

Properties

Property	Type	Required
backend	string	Optional
externalEndpoint	object	Optional
overrides	object	Optional
retentionTime	string	Optional

Description

Configuration for the Mimir package.

.spec.distribution.modules.monitoring.mimir.backend

Description

The storage backend type for Mimir. minio will use an in-cluster MinIO deployment for object storage, externalEndpoint can be used to point to an external S3-compatible object storage instead of deploying an in-cluster MinIO.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"minio"
"externalEndpoint"

.spec.distribution.modules.monitoring.mimir.externalEndpoint

Properties

Property	Type	Required
accessKeyId	string	Optional
bucketName	string	Optional
endpoint	string	Optional
insecure	boolean	Optional
secretAccessKey	string	Optional

Description

Configuration for Mimir's external storage backend.

.spec.distribution.modules.monitoring.mimir.externalEndpoint.accessKeyId

Description

The access key ID (username) for the external S3-compatible bucket.

.spec.distribution.modules.monitoring.mimir.externalEndpoint.bucketName

Description

The bucket name of the external S3-compatible object storage.

.spec.distribution.modules.monitoring.mimir.externalEndpoint.endpoint

Description

The external S3-compatible endpoint for Mimir's storage.

.spec.distribution.modules.monitoring.mimir.externalEndpoint.insecure

Description

If true, will use HTTP as protocol instead of HTTPS.

.spec.distribution.modules.monitoring.mimir.externalEndpoint.secretAccessKey

Description

The secret access key (password) for the external S3-compatible bucket.

.spec.distribution.modules.monitoring.mimir.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.monitoring.mimir.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.monitoring.mimir.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.monitoring.mimir.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.monitoring.mimir.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.monitoring.mimir.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.monitoring.mimir.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.monitoring.mimir.retentionTime

Description

The retention time for the logs stored in Mimir. Default is 30d. Value must match the regular expression [0-9]+(ns|us|µs|ms|s|m|h|d|w|y) where y = 365 days.

.spec.distribution.modules.monitoring.minio

Properties

Property	Type	Required
overrides	object	Optional
rootUser	object	Optional
storageSize	string	Optional

Description

Configuration for Monitoring's MinIO deployment.

.spec.distribution.modules.monitoring.minio.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.monitoring.minio.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.monitoring.minio.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.monitoring.minio.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.monitoring.minio.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.monitoring.minio.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.monitoring.minio.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.monitoring.minio.rootUser

Properties

Property	Type	Required
password	string	Optional
username	string	Optional

.spec.distribution.modules.monitoring.minio.rootUser.password

Description

The password for the default MinIO root user.

.spec.distribution.modules.monitoring.minio.rootUser.username

Description

The username for the default MinIO root user.

.spec.distribution.modules.monitoring.minio.storageSize

Description

The PVC size for each MinIO disk, 6 disks total.

.spec.distribution.modules.monitoring.overrides

Properties

Property	Type	Required
ingresses	object	Optional
nodeSelector	object	Optional
tolerations	array	Optional

Description

Override the common configuration with a particular configuration for the module.

.spec.distribution.modules.monitoring.overrides.ingresses

.spec.distribution.modules.monitoring.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the module.

.spec.distribution.modules.monitoring.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the module.

.spec.distribution.modules.monitoring.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.monitoring.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.monitoring.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.monitoring.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.monitoring.prometheus

Properties

Property	Type	Required
remoteWrite	array	Optional
resources	object	Optional
retentionSize	string	Optional
retentionTime	string	Optional
storageSize	string	Optional

.spec.distribution.modules.monitoring.prometheus.remoteWrite

Description

Set this option to ship the collected metrics to a remote Prometheus receiver.

remoteWrite is an array of objects that allows configuring the remoteWrite options for Prometheus. The objects in the array follow the same schema as in the prometheus operator.

.spec.distribution.modules.monitoring.prometheus.resources

Properties

Property	Type	Required
limits	object	Optional
requests	object	Optional

.spec.distribution.modules.monitoring.prometheus.resources.limits

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.monitoring.prometheus.resources.limits.cpu

Description

The CPU limit for the Pod, in cores or millicores. Examples: 1000m, 2, 1.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.monitoring.prometheus.resources.limits.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.monitoring.prometheus.resources.requests

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.monitoring.prometheus.resources.requests.cpu

Description

The CPU request for the Pod, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.monitoring.prometheus.resources.requests.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.monitoring.prometheus.retentionSize

Description

The retention size for the k8s Prometheus instance.

.spec.distribution.modules.monitoring.prometheus.retentionTime

Description

The retention time for the k8s Prometheus instance.

.spec.distribution.modules.monitoring.prometheus.storageSize

Description

The storage size for the k8s Prometheus instance.

.spec.distribution.modules.monitoring.prometheusAdapter

Properties

Property	Type	Required
installEnhancedHPAMetrics	boolean	Optional
resources	object	Optional

.spec.distribution.modules.monitoring.prometheusAdapter.installEnhancedHPAMetrics

Description

Configures whether to enable advanced HPA metric collection in the Prometheus Adapter. When set to true, the Prometheus Adapter component will query Prometheus instances directly to retrieve additional metrics related to the Horizontal Pod Autoscaler (HPA). These metrics provide deeper visibility into HPA behaviour and performance. Caution: Enabling this feature results in a significant increase in RAM consumption of the Prometheus Adapter, as it requires managing an additional dataset. Default value: true.

.spec.distribution.modules.monitoring.prometheusAdapter.resources

Properties

Property	Type	Required
limits	object	Optional
requests	object	Optional

.spec.distribution.modules.monitoring.prometheusAdapter.resources.limits

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.monitoring.prometheusAdapter.resources.limits.cpu

Description

The CPU limit for the Pod, in cores or millicores. Examples: 1000m, 2, 1.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.monitoring.prometheusAdapter.resources.limits.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.monitoring.prometheusAdapter.resources.requests

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.monitoring.prometheusAdapter.resources.requests.cpu

Description

The CPU request for the Pod, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.monitoring.prometheusAdapter.resources.requests.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.monitoring.prometheusAgent

Properties

Property	Type	Required
remoteWrite	array	Optional
resources	object	Optional

.spec.distribution.modules.monitoring.prometheusAgent.remoteWrite

Description

Set this option to ship the collected metrics to a remote Prometheus receiver.

remoteWrite is an array of objects that allows configuring the remoteWrite options for Prometheus. The objects in the array follow the same schema as in the prometheus operator.

.spec.distribution.modules.monitoring.prometheusAgent.resources

Properties

Property	Type	Required
limits	object	Optional
requests	object	Optional

.spec.distribution.modules.monitoring.prometheusAgent.resources.limits

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.monitoring.prometheusAgent.resources.limits.cpu

Description

The CPU limit for the Pod, in cores or millicores. Examples: 1000m, 2, 1.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.monitoring.prometheusAgent.resources.limits.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.monitoring.prometheusAgent.resources.requests

Properties

Property	Type	Required
cpu	string	Optional
memory	string	Optional

.spec.distribution.modules.monitoring.prometheusAgent.resources.requests.cpu

Description

The CPU request for the Pod, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.distribution.modules.monitoring.prometheusAgent.resources.requests.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.distribution.modules.monitoring.type

Description

The type of the monitoring, must be none, prometheus, prometheusAgent or mimir.

• none: will disable the whole monitoring stack.
• prometheus: will install Prometheus Operator and a preconfigured Prometheus instance, Alertmanager, a set of alert rules, exporters needed to monitor all the components of the cluster, Grafana and a series of dashboards to view the collected metrics, and more.
• prometheusAgent: will install Prometheus operator, an instance of Prometheus in Agent mode (no alerting, no queries, no storage), and all the exporters needed to get metrics for the status of the cluster and the workloads. Useful when having a centralized (remote) Prometheus where to ship the metrics and not storing them locally in the cluster.
• mimir: will install the same as the prometheus option, plus Grafana Mimir that allows for longer retention of metrics and the usage of Object Storage.

Default is prometheus.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"prometheus"
"prometheusAgent"
"mimir"

.spec.distribution.modules.monitoring.x509Exporter

Properties

Property	Type	Required
overrides	object	Optional

.spec.distribution.modules.monitoring.x509Exporter.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.monitoring.x509Exporter.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.monitoring.x509Exporter.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.monitoring.x509Exporter.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.monitoring.x509Exporter.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.monitoring.x509Exporter.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.monitoring.x509Exporter.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.networking

Properties

Property	Type	Required
cilium	object	Optional
overrides	object	Optional
tigeraOperator	object	Optional
type	string	Required

Description

Configuration for the Networking module.

.spec.distribution.modules.networking.cilium

Properties

Property	Type	Required
maskSize	string	Optional
overrides	object	Optional
podCidr	string	Optional

.spec.distribution.modules.networking.cilium.maskSize

Description

The mask size to use for the Pods network on each node.

.spec.distribution.modules.networking.cilium.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.networking.cilium.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.networking.cilium.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.networking.cilium.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.networking.cilium.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.networking.cilium.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.networking.cilium.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.networking.cilium.podCidr

Description

Allows specifing a CIDR for the Pods network different from .spec.kubernetes.podCidr. If not set the default is to use .spec.kubernetes.podCidr.

Constraints

pattern: the string must match the following regular expression:

^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.){3}(25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\/(3[0-2]|[1-2][0-9]|[0-9])$

try pattern

.spec.distribution.modules.networking.overrides

Properties

Property	Type	Required
ingresses	object	Optional
nodeSelector	object	Optional
tolerations	array	Optional

Description

Override the common configuration with a particular configuration for the module.

.spec.distribution.modules.networking.overrides.ingresses

.spec.distribution.modules.networking.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the module.

.spec.distribution.modules.networking.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the module.

.spec.distribution.modules.networking.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.networking.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.networking.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.networking.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.networking.tigeraOperator

Properties

Property	Type	Required
blockSize	integer	Optional
overrides	object	Optional
podCidr	string	Optional

.spec.distribution.modules.networking.tigeraOperator.blockSize

Description

BlockSize specifies the CIDR prefix length to use when allocating per-node IP blocks from the main IP pool CIDR. WARNING: The value for this field cannot be changed once set. Default is 26.

.spec.distribution.modules.networking.tigeraOperator.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.networking.tigeraOperator.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.networking.tigeraOperator.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.networking.tigeraOperator.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.networking.tigeraOperator.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.networking.tigeraOperator.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.networking.tigeraOperator.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.networking.tigeraOperator.podCidr

Description

Allows specifing a CIDR for the Pods network different from .spec.kubernetes.podCidr. If not set the default is to use .spec.kubernetes.podCidr. WARNING: The value for this field cannot be changed once set.

Constraints

pattern: the string must match the following regular expression:

^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.){3}(25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\/(3[0-2]|[1-2][0-9]|[0-9])$

try pattern

.spec.distribution.modules.networking.type

Description

The type of CNI plugin to use, either calico (Tigera Operator) or cilium. Default is calico.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"calico"
"cilium"

.spec.distribution.modules.policy

Properties

Property	Type	Required
gatekeeper	object	Optional
kyverno	object	Optional
overrides	object	Optional
type	string	Required

Description

Configuration for the Policy module.

.spec.distribution.modules.policy.gatekeeper

Properties

Property	Type	Required
additionalExcludedNamespaces	array	Optional
enforcementAction	string	Required
installDefaultPolicies	boolean	Required
overrides	object	Optional

Description

Configuration for the Gatekeeper package.

.spec.distribution.modules.policy.gatekeeper.additionalExcludedNamespaces

Description

This parameter adds namespaces to Gatekeeper's exemption list, so it will not enforce the constraints on them.

.spec.distribution.modules.policy.gatekeeper.enforcementAction

Description

The default enforcement action to use for the included constraints. deny will block the admission when violations to the policies are found, warn will show a message to the user but will admit the violating requests and dryrun won't give any feedback to the user but it will log the violations.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"deny"
"dryrun"
"warn"

.spec.distribution.modules.policy.gatekeeper.installDefaultPolicies

Description

Set to false to avoid installing the default Gatekeeper policies (constraints templates and constraints) included with the distribution.

.spec.distribution.modules.policy.gatekeeper.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.policy.gatekeeper.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.policy.gatekeeper.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.policy.gatekeeper.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.policy.gatekeeper.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.policy.gatekeeper.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.policy.gatekeeper.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.policy.kyverno

Properties

Property	Type	Required
additionalExcludedNamespaces	array	Optional
installDefaultPolicies	boolean	Required
overrides	object	Optional
validationFailureAction	string	Required

Description

Configuration for the Kyverno package.

.spec.distribution.modules.policy.kyverno.additionalExcludedNamespaces

Description

This parameter adds namespaces to Kyverno's exemption list, so it will not enforce the policies on them.

.spec.distribution.modules.policy.kyverno.installDefaultPolicies

Description

Set to false to avoid installing the default Kyverno policies included with distribution.

.spec.distribution.modules.policy.kyverno.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.policy.kyverno.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.policy.kyverno.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.policy.kyverno.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.policy.kyverno.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.policy.kyverno.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.policy.kyverno.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.policy.kyverno.validationFailureAction

Description

The validation failure action to use for the included policies, Enforce will block when a request does not comply with the policies and Audit will not block but log when a request does not comply with the policies.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Audit"
"Enforce"

.spec.distribution.modules.policy.overrides

Properties

Property	Type	Required
ingresses	object	Optional
nodeSelector	object	Optional
tolerations	array	Optional

Description

Override the common configuration with a particular configuration for the module.

.spec.distribution.modules.policy.overrides.ingresses

.spec.distribution.modules.policy.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the module.

.spec.distribution.modules.policy.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the module.

.spec.distribution.modules.policy.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.policy.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.policy.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.policy.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.policy.type

Description

The type of policy enforcement to use, either none, gatekeeper or kyverno.

Default is none.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"gatekeeper"
"kyverno"

.spec.distribution.modules.tracing

Properties

Property	Type	Required
minio	object	Optional
overrides	object	Optional
tempo	object	Optional
type	string	Required

Description

Configuration for the Tracing module.

.spec.distribution.modules.tracing.minio

Properties

Property	Type	Required
overrides	object	Optional
rootUser	object	Optional
storageSize	string	Optional

Description

Configuration for Tracing's MinIO deployment.

.spec.distribution.modules.tracing.minio.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.tracing.minio.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.tracing.minio.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.tracing.minio.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.tracing.minio.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.tracing.minio.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.tracing.minio.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.tracing.minio.rootUser

Properties

Property	Type	Required
password	string	Optional
username	string	Optional

.spec.distribution.modules.tracing.minio.rootUser.password

Description

The password for the default MinIO root user.

.spec.distribution.modules.tracing.minio.rootUser.username

Description

The username for the default MinIO root user.

.spec.distribution.modules.tracing.minio.storageSize

Description

The PVC size for each MinIO disk, 6 disks total.

.spec.distribution.modules.tracing.overrides

Properties

Property	Type	Required
ingresses	object	Optional
nodeSelector	object	Optional
tolerations	array	Optional

Description

Override the common configuration with a particular configuration for the module.

.spec.distribution.modules.tracing.overrides.ingresses

.spec.distribution.modules.tracing.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the module.

.spec.distribution.modules.tracing.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the module.

.spec.distribution.modules.tracing.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.tracing.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.tracing.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.tracing.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.tracing.tempo

Properties

Property	Type	Required
backend	string	Optional
externalEndpoint	object	Optional
overrides	object	Optional
retentionTime	string	Optional

Description

Configuration for the Tempo package.

.spec.distribution.modules.tracing.tempo.backend

Description

The storage backend type for Tempo. minio will use an in-cluster MinIO deployment for object storage, externalEndpoint can be used to point to an external S3-compatible object storage instead of deploying an in-cluster MinIO.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"minio"
"externalEndpoint"

.spec.distribution.modules.tracing.tempo.externalEndpoint

Properties

Property	Type	Required
accessKeyId	string	Optional
bucketName	string	Optional
endpoint	string	Optional
insecure	boolean	Optional
secretAccessKey	string	Optional

Description

Configuration for Tempo's external storage backend.

.spec.distribution.modules.tracing.tempo.externalEndpoint.accessKeyId

Description

The access key ID (username) for the external S3-compatible bucket.

.spec.distribution.modules.tracing.tempo.externalEndpoint.bucketName

Description

The bucket name of the external S3-compatible object storage.

.spec.distribution.modules.tracing.tempo.externalEndpoint.endpoint

Description

The external S3-compatible endpoint for Tempo's storage.

.spec.distribution.modules.tracing.tempo.externalEndpoint.insecure

Description

If true, will use HTTP as protocol instead of HTTPS.

.spec.distribution.modules.tracing.tempo.externalEndpoint.secretAccessKey

Description

The secret access key (password) for the external S3-compatible bucket.

.spec.distribution.modules.tracing.tempo.overrides

Properties

Property	Type	Required
nodeSelector	object	Optional
tolerations	array	Optional

.spec.distribution.modules.tracing.tempo.overrides.nodeSelector

Description

Set to override the node selector used to place the pods of the package.

.spec.distribution.modules.tracing.tempo.overrides.tolerations

Properties

Property	Type	Required
effect	string	Required
key	string	Required
operator	string	Optional
value	string	Optional

Description

Set to override the tolerations that will be added to the pods of the package.

.spec.distribution.modules.tracing.tempo.overrides.tolerations.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.distribution.modules.tracing.tempo.overrides.tolerations.key

Description

The key of the toleration

.spec.distribution.modules.tracing.tempo.overrides.tolerations.operator

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Exists"
"Equal"

.spec.distribution.modules.tracing.tempo.overrides.tolerations.value

Description

The value of the toleration

.spec.distribution.modules.tracing.tempo.retentionTime

Description

The retention time for the traces stored in Tempo.

.spec.distribution.modules.tracing.type

Description

The type of tracing to use, either none or tempo. none will disable the Tracing module and tempo will install a Grafana Tempo deployment.

Default is tempo.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"tempo"

.spec.distributionVersion

Description

Defines which SD version will be installed and, in consequence, the Kubernetes version used to create the cluster. It supports git tags and branches. Example: v1.32.1.

Constraints

minimum length: the minimum number of characters for this string is: 1

.spec.infrastructure

Properties

Property	Type	Required
ipxeServer	object	Optional
loadBalancers	object	Optional
nodes	array	Required
proxy	object	Optional
ssh	object	Required

Description

Defines the bare metal infrastructure configuration, including nodes, network boot, storage, and networking.

.spec.infrastructure.ipxeServer

Properties

Property	Type	Required
bindAddress	string	Optional
bindPort	integer	Optional
postInstallCommands	array	Optional
preInstallCommands	array	Optional
url	string	Required

Description

iPXE server configuration for network boot provisioning. Ref: https://www.flatcar.org/docs/latest/setup/customization/

.spec.infrastructure.ipxeServer.bindAddress

Description

The address where the iPXE server will listen for incoming requests. Default is the address from the URL

.spec.infrastructure.ipxeServer.bindPort

Description

The port where the iPXE server will listen for incoming requests. Default is the port from the URL or 80 if not specified.

.spec.infrastructure.ipxeServer.postInstallCommands

Description

List of commands to execute after installing Flatcar to disk and before rebooting the node

.spec.infrastructure.ipxeServer.preInstallCommands

Description

List of commands to execute before installing Flatcar to disk

.spec.infrastructure.ipxeServer.url

Description

The URL of the iPXE boot server. Example: https://ipxe.internal.example.com:8080

Constraints

pattern: the string must match the following regular expression:

^(http|https)\:\/\/.+$

try pattern

.spec.infrastructure.loadBalancers

Properties

Property	Type	Required
containerd	object	Optional
haproxy	object	Optional
keepalived	object	Optional
members	array	Optional

Description

Load balancer configuration. Uses HAProxy for load balancing and keepalived for VIP failover between LB nodes. Having members defined will enable the load balancers.

.spec.infrastructure.loadBalancers.containerd

Properties

Property	Type	Required
debugLevel	string	Optional
deviceOwnershipFromSecurityContext	boolean	Optional
grpcMaxRecvMessageSize	integer	Optional
grpcMaxSendMessageSize	integer	Optional
maxContainerLogLineSize	integer	Optional
metricsAddress	string	Optional
metricsGrpcHistogram	boolean	Optional
oomScore	integer	Optional
registryConfigs	array	Optional
selfmanagedRepositories	boolean	Optional
stateDir	string	Optional
storageDir	string	Optional
systemdDir	string	Optional

Description

Advanced configuration for containerd

.spec.infrastructure.loadBalancers.containerd.debugLevel

Description

The Containerd debug level used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.deviceOwnershipFromSecurityContext

Description

Set to true to apply device ownership from the container runtime's security context instead of the host's defaults, used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.grpcMaxRecvMessageSize

Description

The Containerd gRPC maximum receive message size in bytes used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.grpcMaxSendMessageSize

Description

The Containerd gRPC maximum send message size in bytes used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.maxContainerLogLineSize

Description

The maximum container log line size in bytes used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.metricsAddress

Description

The Containerd metrics address used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.metricsGrpcHistogram

Description

Enable Containerd metrics gRPC histogram in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.oomScore

Description

The Containerd OOM score adjustment used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.registryConfigs

Properties

Property	Type	Required
insecureSkipVerify	boolean	Optional
mirrorEndpoint	array	Optional
password	string	Optional
registry	string	Optional
username	string	Optional

Description

Allows specifying custom configuration for a registry at containerd level. You can set authentication details and mirrors for a registry. This feature can be used for example to authenticate to a private registry at containerd (container runtime) level, i.e. globally instead of using imagePullSecrets. It also can be used to use a mirror for a registry or to enable insecure connections to trusted registries that have self-signed certificates.

.spec.infrastructure.loadBalancers.containerd.registryConfigs.insecureSkipVerify

Description

Set to true to skip TLS verification (e.g. when using self-signed certificates).

.spec.infrastructure.loadBalancers.containerd.registryConfigs.mirrorEndpoint

Description

Array of URLs with the mirrors to use for the registry. Example: ["http://mymirror.tld:8080"]

.spec.infrastructure.loadBalancers.containerd.registryConfigs.password

Description

The password containerd will use to authenticate against the registry.

.spec.infrastructure.loadBalancers.containerd.registryConfigs.registry

Description

Registry address on which you would like to configure authentication or mirror(s). Example: myregistry.tld:5000

.spec.infrastructure.loadBalancers.containerd.registryConfigs.username

Description

The username containerd will use to authenticate against the registry.

.spec.infrastructure.loadBalancers.containerd.selfmanagedRepositories

Description

Set to true if you manage the NVIDIA container toolkit's repositories externally and wish to skip their automatic configuration with furyctl. Default is false (furyctl manages repositories automatically). Notice that containerd itself is installed from binaries and does not use a repository. See .spec.kubernetes.advanced.airGap for other download options for containerd.

.spec.infrastructure.loadBalancers.containerd.stateDir

Description

The Containerd state directory used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.storageDir

Description

The Containerd storage directory used in the config.toml file.

.spec.infrastructure.loadBalancers.containerd.systemdDir

Description

The Containerd systemd service directory used in the config.toml file.

.spec.infrastructure.loadBalancers.haproxy

Properties

Property	Type	Required
configuration	string	Optional
image	string	Optional
tag	string	Optional

Description

HAProxy container configuration for load balancing.

.spec.infrastructure.loadBalancers.haproxy.configuration

Description

Custom HAProxy configuration content. If not provided, a default configuration will be generated for load balancing Kubernetes control plane.

.spec.infrastructure.loadBalancers.haproxy.image

Description

Container image for HAProxy. Example: docker.io/library/haproxy

.spec.infrastructure.loadBalancers.haproxy.tag

Description

Container tag for HAProxy. Example: 2.8-alpine

.spec.infrastructure.loadBalancers.keepalived

Properties

Property	Type	Required
enabled	boolean	Required
interface	string	Optional
ip	string	Optional
passphrase	string	Optional
virtualRouterId	string	Optional

Description

This section allows to configure a floating Virtual IP between the nodes via Keepalived. This can be used to provide high availability between 2 or more nodes.

.spec.infrastructure.loadBalancers.keepalived.enabled

Description

Set to install keepalived with a floating virtual IP shared between the load balancer hosts for a deployment in High Availability.

.spec.infrastructure.loadBalancers.keepalived.interface

Description

Name of the network interface where to bind the Keepalived virtual IP.

.spec.infrastructure.loadBalancers.keepalived.ip

Description

The Virtual floating IP for Keepalived

.spec.infrastructure.loadBalancers.keepalived.passphrase

Description

Password for accessing vrrpd. Make it unique between Keepalived clusters.

Constraints

maximum length: the maximum number of characters for this string is: 8

.spec.infrastructure.loadBalancers.keepalived.virtualRouterId

Description

The virtual router ID of Keepalived, an arbitrary unique number from 1 to 255 used to differentiate multiple instances of vrrpd running on the same network interface and address family and multicast/unicast (and hence same socket).

.spec.infrastructure.loadBalancers.members

Properties

Property	Type	Required
hostname	string	Required
ip	string	Optional

Description

A member node reference with optional IP override.

Constraints

minimum number of items: the minimum number of items for this array is: 1

.spec.infrastructure.loadBalancers.members.hostname

Description

Hostname that must match an infrastructure node. Example: ctrl01.k8s.example.com

Constraints

minimum length: the minimum number of characters for this string is: 1

.spec.infrastructure.loadBalancers.members.ip

Description

Optional IP address. If not specified, it is inferred from the node's network configuration. NOTE: this field is currently ignored, left for future usage.

Constraints

pattern: the string must match the following regular expression:

^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.){3}(25[0-5]|(2[0-4]|1\d|[1-9]|)\d)$

try pattern

.spec.infrastructure.nodes

Properties

Property	Type	Required
arch	string	Optional
hostname	string	Required
kernelArguments	object	Optional
kernelParameters	array	Optional
macAddress	string	Required
network	object	Required
passwd	object	Optional
storage	object	Required
systemd	object	Optional

Description

Definition of a bare metal node with storage, network, and hardware configuration.

Constraints

minimum number of items: the minimum number of items for this array is: 1

.spec.infrastructure.nodes.arch

Description

CPU architecture for the node. Determines which Flatcar artifacts and sysext packages are downloaded. Supports mixed-architecture clusters where different nodes can run different architectures. Kubernetes automatically labels nodes with kubernetes.io/arch. Examples: x86-64 (Intel/AMD amd64), arm64 (ARM aarch64). See examples/immutable-mixed-arch-example.yaml for mixed-architecture cluster configuration.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"x86-64"
"arm64"

.spec.infrastructure.nodes.hostname

Description

Fully qualified domain name for the node. Example: node01.k8s.example.com

Constraints

minimum length: the minimum number of characters for this string is: 1

pattern: the string must match the following regular expression:

^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$

try pattern

.spec.infrastructure.nodes.kernelArguments

Properties

Property	Type	Required
shouldExist	array	Optional
shouldNotExist	array	Optional

Description

Kernel arguments for this node, mirroring Butane's kernel_arguments (both lists optional). They are written to the bootloader and applied by Ignition on the node's first boot.

.spec.infrastructure.nodes.kernelArguments.shouldExist

Description

Kernel arguments to add, rendered to Butane should_exist. Example: console=ttyS0,115200n8

.spec.infrastructure.nodes.kernelArguments.shouldNotExist

Description

Kernel arguments to remove, rendered to Butane should_not_exist. Example: mitigations=auto

.spec.infrastructure.nodes.kernelParameters

Properties

Property	Type	Required
name	string	Required
value	string	Required

Description

Node-specific kernel parameters that override global settings.

.spec.infrastructure.nodes.kernelParameters.name

Description

The kernel parameter name (sysctl format). Example: net.ipv4.ip_forward, net.bridge.bridge-nf-call-iptables

Constraints

maximum length: the maximum number of characters for this string is: 256

minimum length: the minimum number of characters for this string is: 1

pattern: the string must match the following regular expression:

^[a-z][a-z0-9_-]*([.][a-z][a-z0-9_-]*)+$

try pattern

.spec.infrastructure.nodes.kernelParameters.value

Description

The kernel parameter value. Example: "1"

Constraints

minimum length: the minimum number of characters for this string is: 1

.spec.infrastructure.nodes.macAddress

Description

MAC address in format XX:XX:XX:XX:XX:XX

Constraints

pattern: the string must match the following regular expression:

^([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$

try pattern

.spec.infrastructure.nodes.network

Properties

Property	Type	Required
ethernets	object	Optional

Description

Advanced network configuration with ethernets using networkd format.

.spec.infrastructure.nodes.network.ethernets

Description

Ethernet interface configurations, keyed by interface name (e.g., eth0, ens3, eno49).

.spec.infrastructure.nodes.passwd

Properties

Property	Type	Required
groups	array	Optional
users	array	Optional

Description

Describes the desired additions to the passwd database. See https://www.flatcar.org/docs/latest/provisioning/config-transpiler/configuration/

.spec.infrastructure.nodes.passwd.groups

Properties

Property	Type	Required
gid	integer	Optional
name	string	Required
password_hash	string	Optional
should_exist	boolean	Optional
system	boolean	Optional

Description

Represents a group to be created in the system.

.spec.infrastructure.nodes.passwd.groups.gid

Description

The group ID of the new group.

.spec.infrastructure.nodes.passwd.groups.name

Description

The name of the group.

.spec.infrastructure.nodes.passwd.groups.password_hash

Description

The hashed password of the new group.

.spec.infrastructure.nodes.passwd.groups.should_exist

Description

Whether or not the group with the specified name should exist. If omitted, it defaults to true. If false, then Ignition will delete the specified group.

.spec.infrastructure.nodes.passwd.groups.system

Description

Whether or not the group should be a system group. This only has an effect if the group doesn't exist yet.

.spec.infrastructure.nodes.passwd.users

Properties

Property	Type	Required
gecos	string	Optional
groups	array	Optional
home_dir	string	Optional
name	string	Required
no_create_home	boolean	Optional
no_log_init	boolean	Optional
no_user_group	boolean	Optional
password_hash	string	Optional
primary_group	string	Optional
shell	string	Optional
should_exist	boolean	Optional
ssh_authorized_keys	array	Optional
system	boolean	Optional
uid	integer	Optional

Description

Represents a user account to be created in the system.

.spec.infrastructure.nodes.passwd.users.gecos

Description

The GECOS field of the account.

.spec.infrastructure.nodes.passwd.users.groups

Description

The list of supplementary groups of the account.

.spec.infrastructure.nodes.passwd.users.home_dir

Description

The home directory of the account.

.spec.infrastructure.nodes.passwd.users.name

Description

The username for the account.

.spec.infrastructure.nodes.passwd.users.no_create_home

Description

Whether or not to create the user's home directory. This only has an effect if the account doesn't exist yet.

.spec.infrastructure.nodes.passwd.users.no_log_init

Description

Whether or not to add the user to the lastlog and faillog databases. This only has an effect if the account doesn't exist yet.

.spec.infrastructure.nodes.passwd.users.no_user_group

Description

Whether or not to create a group with the same name as the user. This only has an effect if the account doesn't exist yet.

.spec.infrastructure.nodes.passwd.users.password_hash

Description

The hashed password for the account.

.spec.infrastructure.nodes.passwd.users.primary_group

Description

The name of the primary group of the account.

.spec.infrastructure.nodes.passwd.users.shell

Description

The login shell of the new account.

.spec.infrastructure.nodes.passwd.users.should_exist

Description

Whether or not the user with the specified name should exist. If omitted, it defaults to true. If false, then Ignition will delete the specified user.

.spec.infrastructure.nodes.passwd.users.ssh_authorized_keys

Description

A list of SSH keys to be added as an SSH key fragment at .ssh/authorized_keys.d/ignition in the user's home directory. All SSH keys must be unique.

.spec.infrastructure.nodes.passwd.users.system

Description

Whether or not this account should be a system account. This only has an effect if the account doesn't exist yet.

.spec.infrastructure.nodes.passwd.users.uid

Description

The user ID of the account.

.spec.infrastructure.nodes.storage

Properties

Property	Type	Required
directories	array	Optional
disks	array	Optional
files	array	Optional
filesystems	array	Optional
installDisk	string	Required
links	array	Optional

Description

Storage configuration for the node, including the install disk and the Butane storage sections.

.spec.infrastructure.nodes.storage.directories

Properties

Property	Type	Required
group	object	Optional
mode	integer	Optional
overwrite	boolean	Optional
path	string	Required
user	object	Optional

Description

Represents a directory to be created on the filesystem. See Butane Flatcar v1.1.0 spec.

.spec.infrastructure.nodes.storage.directories.group

Properties

Property	Type	Required
id	integer	Optional
name	string	Optional

Description

The group of the directory.

.spec.infrastructure.nodes.storage.directories.group.id

Description

The group ID of the owner.

.spec.infrastructure.nodes.storage.directories.group.name

Description

The group name of the owner.

.spec.infrastructure.nodes.storage.directories.mode

Description

The directory's permission mode (decimal). Note that the mode must be properly specified as a decimal value (i.e. 0o755 -> 493). Example: 493 means 0755.

.spec.infrastructure.nodes.storage.directories.overwrite

Description

Whether to delete preexisting nodes at the path. If overwrite is false and a directory already exists at the path, Ignition will only set its permissions. Defaults to false.

.spec.infrastructure.nodes.storage.directories.path

Description

The absolute path to the directory.

.spec.infrastructure.nodes.storage.directories.user

Properties

Property	Type	Required
id	integer	Optional
name	string	Optional

Description

The user of the directory.

.spec.infrastructure.nodes.storage.directories.user.id

Description

The user ID of the owner.

.spec.infrastructure.nodes.storage.directories.user.name

Description

The username of the owner.

.spec.infrastructure.nodes.storage.disks

Properties

Property	Type	Required
device	string	Required
partitions	array	Optional
wipe_table	boolean	Optional

Description

Represents a disk to be partitioned.

.spec.infrastructure.nodes.storage.disks.device

Description

The absolute path to the device. Devices are typically referenced by the /dev/disk/by-* symlinks. Example: /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive1

.spec.infrastructure.nodes.storage.disks.partitions

Properties

Property	Type	Required
guid	string	Optional
label	string	Optional
number	integer	Optional
resize	boolean	Optional
should_exist	boolean	Optional
size_mib	integer	Optional
start_mib	integer	Optional
type_guid	string	Optional
wipe_partition_entry	boolean	Optional

Description

Represents a partition to be created on the disk.

.spec.infrastructure.nodes.storage.disks.partitions.guid

Description

The GPT unique partition GUID.

Constraints

pattern: the string must match the following regular expression:

^(|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$

try pattern

.spec.infrastructure.nodes.storage.disks.partitions.label

Description

The PARTLABEL for the partition, used to reference it from a filesystem as /dev/disk/by-partlabel/LABEL. Cannot contain a colon. Example: data

Constraints

maximum length: the maximum number of characters for this string is: 36

pattern: the string must match the following regular expression:

^[^:]*$

try pattern

.spec.infrastructure.nodes.storage.disks.partitions.number

Description

The partition number, which will change the partition table entry at that location. If not specified, the next available partition number will be used.

.spec.infrastructure.nodes.storage.disks.partitions.resize

Description

Whether or not the existing partition should be resized. Defaults to false. If true, Ignition will resize an existing partition if it matches the config in all respects except the partition size.

.spec.infrastructure.nodes.storage.disks.partitions.should_exist

Description

Whether or not the partition with the specified number should exist. Defaults to true. If false, Ignition will either delete the specified partition or fail, depending on wipe_partition_entry.

.spec.infrastructure.nodes.storage.disks.partitions.size_mib

Description

The size of the partition with a unit of mebibytes. If zero, the partition will be made as large as possible.

.spec.infrastructure.nodes.storage.disks.partitions.start_mib

Description

The start of the partition with a unit of mebibytes. If zero, the partition will be positioned at the start of the largest block available.

.spec.infrastructure.nodes.storage.disks.partitions.type_guid

Description

The GPT partition type GUID. If omitted, the default will be 0FC63DAF-8483-4772-8E79-3D69D8477DE4 (Linux filesystem data).

Constraints

pattern: the string must match the following regular expression:

^(|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$

try pattern

.spec.infrastructure.nodes.storage.disks.partitions.wipe_partition_entry

Description

If true, Ignition will clobber an existing partition if it does not match the config. If false, Ignition will fail instead. Defaults to false.

.spec.infrastructure.nodes.storage.disks.wipe_table

Description

Whether or not the partition tables shall be wiped. When true, the partition tables are erased before any further manipulation. Otherwise, the existing entries are left intact. Defaults to false.

.spec.infrastructure.nodes.storage.files

Properties

Property	Type	Required
append	array	Optional
contents	object	Optional
group	object	Optional
mode	integer	Optional
overwrite	boolean	Optional
path	string	Required
user	object	Optional

Description

Represents a file to be created on the filesystem.

.spec.infrastructure.nodes.storage.files.append

Properties

Property	Type	Required
compression	string	Optional
http_headers	array	Optional
inline	string	Optional
local	string	Optional
source	string	Optional
verification	object	Optional

Description

List of contents to be appended to the file. Follows the same structure as contents.

.spec.infrastructure.nodes.storage.files.append.compression

Description

The type of compression used on the contents (null or gzip).

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"gzip"

.spec.infrastructure.nodes.storage.files.append.http_headers

Properties

Property	Type	Required
name	string	Required
value	string	Required

Description

A list of HTTP headers to be added to the request. Available for http and https source schemes only.

.spec.infrastructure.nodes.storage.files.append.http_headers.name

Description

The header name.

.spec.infrastructure.nodes.storage.files.append.http_headers.value

Description

The header contents.

.spec.infrastructure.nodes.storage.files.append.inline

Description

The contents to append. Mutually exclusive with source and local.

.spec.infrastructure.nodes.storage.files.append.local

Description

A local path to the contents to append, relative to the directory specified by the --files-dir command-line argument. Mutually exclusive with source and inline.

.spec.infrastructure.nodes.storage.files.append.source

Description

The URL of the contents to append. Supported schemes are http, https, tftp, s3, gs, and data. Mutually exclusive with inline and local.

.spec.infrastructure.nodes.storage.files.append.verification

Properties

Property	Type	Required
hash	string	Optional

Description

Options related to the verification of the appended contents.

.spec.infrastructure.nodes.storage.files.append.verification.hash

Description

The hash of the content, in the form <type>-<value> where type is either sha512 or sha256.

.spec.infrastructure.nodes.storage.files.contents

Properties

Property	Type	Required
compression	string	Optional
http_headers	array	Optional
inline	string	Optional
local	string	Optional
source	string	Optional
verification	object	Optional

Description

Options related to the contents of the file.

.spec.infrastructure.nodes.storage.files.contents.compression

Description

The type of compression used on the contents (null or gzip). Compression cannot be used with S3.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"gzip"

.spec.infrastructure.nodes.storage.files.contents.http_headers

Properties

Property	Type	Required
name	string	Required
value	string	Required

Description

A list of HTTP headers to be added to the request. Available for http and https source schemes only.

.spec.infrastructure.nodes.storage.files.contents.http_headers.name

Description

The header name.

.spec.infrastructure.nodes.storage.files.contents.http_headers.value

Description

The header contents.

.spec.infrastructure.nodes.storage.files.contents.inline

Description

The contents of the file. Mutually exclusive with source and local.

.spec.infrastructure.nodes.storage.files.contents.local

Description

A local path to the contents of the file, relative to the directory specified by the --files-dir command-line argument. Mutually exclusive with source and inline.

.spec.infrastructure.nodes.storage.files.contents.source

Description

The URL of the file contents. Supported schemes are http, https, tftp, s3, gs, and data. When using http, it is advisable to use the verification option. Mutually exclusive with inline and local.

.spec.infrastructure.nodes.storage.files.contents.verification

Properties

Property	Type	Required
hash	string	Optional

Description

Options related to the verification of the file contents.

.spec.infrastructure.nodes.storage.files.contents.verification.hash

Description

The hash of the content, in the form <type>-<value> where type is either sha512 or sha256. Example: sha256-abcd1234...

.spec.infrastructure.nodes.storage.files.group

Properties

Property	Type	Required
id	integer	Optional
name	string	Optional

Description

Specifies the file's group.

.spec.infrastructure.nodes.storage.files.group.id

Description

The group ID of the group.

.spec.infrastructure.nodes.storage.files.group.name

Description

The group name of the group.

.spec.infrastructure.nodes.storage.files.mode

Description

The file's permission mode (in octal, e.g. 0644). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if overwrite is false and a file already exists.

.spec.infrastructure.nodes.storage.files.overwrite

Description

Whether to delete preexisting nodes at the path. Contents must be specified if overwrite is true. Defaults to false.

.spec.infrastructure.nodes.storage.files.path

Description

The absolute path to the file.

.spec.infrastructure.nodes.storage.files.user

Properties

Property	Type	Required
id	integer	Optional
name	string	Optional

Description

Specifies the file's owner.

.spec.infrastructure.nodes.storage.files.user.id

Description

The user ID of the owner.

.spec.infrastructure.nodes.storage.files.user.name

Description

The user name of the owner.

.spec.infrastructure.nodes.storage.filesystems

Properties

Property	Type	Required
device	string	Required
format	string	Optional
label	string	Optional
mount_options	array	Optional
options	array	Optional
path	string	Optional
uuid	string	Optional
wipe_filesystem	boolean	Optional
with_mount_unit	boolean	Optional

Description

Represents a filesystem to be created on a device.

.spec.infrastructure.nodes.storage.filesystems.device

Description

The absolute path to the device. Devices are typically referenced by the /dev/disk/by-* symlinks. Example: /dev/disk/by-partlabel/data

.spec.infrastructure.nodes.storage.filesystems.format

Description

The filesystem format.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"ext4"
"btrfs"
"xfs"
"swap"
"vfat"
"none"

.spec.infrastructure.nodes.storage.filesystems.label

Description

The label of the filesystem. Requires format to be set. Example: DATA

.spec.infrastructure.nodes.storage.filesystems.mount_options

Description

Any special options to be passed to the mount command.

.spec.infrastructure.nodes.storage.filesystems.options

Description

Any additional options to be passed to the format-specific mkfs utility.

.spec.infrastructure.nodes.storage.filesystems.path

Description

The mount-point of the filesystem in the real root. Required unless the format is swap. Example: /var/lib/containerd

.spec.infrastructure.nodes.storage.filesystems.uuid

Description

The UUID of the filesystem.

.spec.infrastructure.nodes.storage.filesystems.wipe_filesystem

Description

Whether or not to wipe the device before filesystem creation. Defaults to false.

.spec.infrastructure.nodes.storage.filesystems.with_mount_unit

Description

Whether to additionally generate a generic mount unit for this filesystem, or a swap unit for this swap area. Defaults to false.

.spec.infrastructure.nodes.storage.installDisk

Description

Unix device path. Example: /dev/sda, /dev/nvme0n1

Constraints

pattern: the string must match the following regular expression:

^/dev/[a-zA-Z0-9/]+$

try pattern

.spec.infrastructure.nodes.storage.links

Properties

Property	Type	Required
group	object	Optional
hard	boolean	Optional
overwrite	boolean	Optional
path	string	Required
target	string	Required
user	object	Optional

Description

Represents a symbolic or hard link to be created.

.spec.infrastructure.nodes.storage.links.group

Properties

Property	Type	Required
id	integer	Optional
name	string	Optional

Description

Specifies the group for a symbolic link. Ignored for hard links.

.spec.infrastructure.nodes.storage.links.group.id

Description

The group ID of the group.

.spec.infrastructure.nodes.storage.links.group.name

Description

The group name of the group.

.spec.infrastructure.nodes.storage.links.hard

Description

A symbolic link is created if this is false, a hard one if this is true.

.spec.infrastructure.nodes.storage.links.overwrite

Description

Whether to delete preexisting nodes at the path. If overwrite is false and a matching link exists at the path, Ignition will only set the owner and group. Defaults to false.

.spec.infrastructure.nodes.storage.links.path

Description

The absolute path to the link.

.spec.infrastructure.nodes.storage.links.target

Description

The target path of the link.

.spec.infrastructure.nodes.storage.links.user

Properties

Property	Type	Required
id	integer	Optional
name	string	Optional

Description

Specifies the owner for a symbolic link. Ignored for hard links.

.spec.infrastructure.nodes.storage.links.user.id

Description

The user ID of the owner.

.spec.infrastructure.nodes.storage.links.user.name

Description

The user name of the owner.

.spec.infrastructure.nodes.systemd

Properties

Property	Type	Required
units	array	Optional

Description

Describes the desired state of the systemd units.

.spec.infrastructure.nodes.systemd.units

Description

the list of systemd units. Every unit must have a unique name.

.spec.infrastructure.proxy

Properties

Property	Type	Required
http	string	Optional
https	string	Optional
noProxy	string	Optional

Description

HTTP/HTTPS proxy configuration for the infrastructure nodes.

.spec.infrastructure.proxy.http

Description

The HTTP proxy URL. Example: http://proxy.example.com:3128

Constraints

pattern: the string must match the following regular expression:

^(http|https)\:\/\/.+$

try pattern

.spec.infrastructure.proxy.https

Description

The HTTPS proxy URL. Example: https://proxy.example.com:3128

Constraints

pattern: the string must match the following regular expression:

^(http|https)\:\/\/.+$

try pattern

.spec.infrastructure.proxy.noProxy

Description

Comma-separated list of hosts that should not use the HTTP(S) proxy. Example: localhost,127.0.0.1,10.0.0.0/8,.example.com

.spec.infrastructure.ssh

Properties

Property	Type	Required
privateKeyPath	string	Optional
publicKeyPath	string	Optional
username	string	Required

Description

SSH credentials for node access.

.spec.infrastructure.ssh.privateKeyPath

Description

Path to the SSH private key. Example: ~/.ssh/id_ed25519_production

.spec.infrastructure.ssh.publicKeyPath

Description

Path to the SSH public key. If not specified, defaults to privateKeyPath + '.pub' (or keyPath + '.pub' if using deprecated keyPath). Example: ~/.ssh/id_ed25519_production.pub

.spec.infrastructure.ssh.username

Description

SSH username. Example: core

Constraints

minimum length: the minimum number of characters for this string is: 1

.spec.kubernetes

Properties

Property	Type	Required
advanced	object	Optional
controlPlane	object	Required
etcd	object	Optional
networking	object	Required
nodeGroups	array	Optional
pkiPath	string	Optional
version	string	Optional

Description

Kubernetes cluster configuration including control plane, etcd, and worker nodes.

.spec.kubernetes.advanced

Properties

Property	Type	Required
apiServer	object	Optional
cloud	object	Optional
containerd	object	Optional
controllerManager	object	Optional
encryption	object	Optional
eventRateLimits	array	Optional
kubeProxy	object	Optional
kubeletConfiguration	object	Optional
oidc	object	Optional
registry	string	Optional
users	object	Optional

Description

Advanced Kubernetes cluster configuration.

.spec.kubernetes.advanced.apiServer

Properties

Property	Type	Required
certSANs	array	Optional

Description

API server configuration for certificate Subject Alternative Names.

.spec.kubernetes.advanced.apiServer.certSANs

Description

SAN entry (hostname or IP address). Examples: k8s-api.example.com, 192.168.100.100

.spec.kubernetes.advanced.cloud

Properties

Property	Type	Required
config	string	Optional
provider	string	Optional

Description

Cloud provider integration. Ref: https://kubernetes.io/docs/concepts/architecture/cloud-controller/

.spec.kubernetes.advanced.cloud.config

Description

Sets cloud config for the Kubelet

.spec.kubernetes.advanced.cloud.provider

Description

Sets the cloud provider for the Kubelet

.spec.kubernetes.advanced.containerd

Properties

Property	Type	Required
debugLevel	string	Optional
deviceOwnershipFromSecurityContext	boolean	Optional
grpcMaxRecvMessageSize	integer	Optional
grpcMaxSendMessageSize	integer	Optional
maxContainerLogLineSize	integer	Optional
metricsAddress	string	Optional
metricsGrpcHistogram	boolean	Optional
oomScore	integer	Optional
registryConfigs	array	Optional
selfmanagedRepositories	boolean	Optional
stateDir	string	Optional
storageDir	string	Optional
systemdDir	string	Optional

Description

Advanced configuration for containerd

.spec.kubernetes.advanced.containerd.debugLevel

Description

The Containerd debug level used in the config.toml file.

.spec.kubernetes.advanced.containerd.deviceOwnershipFromSecurityContext

Description

Set to true to apply device ownership from the container runtime's security context instead of the host's defaults, used in the config.toml file.

.spec.kubernetes.advanced.containerd.grpcMaxRecvMessageSize

Description

The Containerd gRPC maximum receive message size in bytes used in the config.toml file.

.spec.kubernetes.advanced.containerd.grpcMaxSendMessageSize

Description

The Containerd gRPC maximum send message size in bytes used in the config.toml file.

.spec.kubernetes.advanced.containerd.maxContainerLogLineSize

Description

The maximum container log line size in bytes used in the config.toml file.

.spec.kubernetes.advanced.containerd.metricsAddress

Description

The Containerd metrics address used in the config.toml file.

.spec.kubernetes.advanced.containerd.metricsGrpcHistogram

Description

Enable Containerd metrics gRPC histogram in the config.toml file.

.spec.kubernetes.advanced.containerd.oomScore

Description

The Containerd OOM score adjustment used in the config.toml file.

.spec.kubernetes.advanced.containerd.registryConfigs

Properties

Property	Type	Required
insecureSkipVerify	boolean	Optional
mirrorEndpoint	array	Optional
password	string	Optional
registry	string	Optional
username	string	Optional

Description

Allows specifying custom configuration for a registry at containerd level. You can set authentication details and mirrors for a registry. This feature can be used for example to authenticate to a private registry at containerd (container runtime) level, i.e. globally instead of using imagePullSecrets. It also can be used to use a mirror for a registry or to enable insecure connections to trusted registries that have self-signed certificates.

.spec.kubernetes.advanced.containerd.registryConfigs.insecureSkipVerify

Description

Set to true to skip TLS verification (e.g. when using self-signed certificates).

.spec.kubernetes.advanced.containerd.registryConfigs.mirrorEndpoint

Description

Array of URLs with the mirrors to use for the registry. Example: ["http://mymirror.tld:8080"]

.spec.kubernetes.advanced.containerd.registryConfigs.password

Description

The password containerd will use to authenticate against the registry.

.spec.kubernetes.advanced.containerd.registryConfigs.registry

Description

Registry address on which you would like to configure authentication or mirror(s). Example: myregistry.tld:5000

.spec.kubernetes.advanced.containerd.registryConfigs.username

Description

The username containerd will use to authenticate against the registry.

.spec.kubernetes.advanced.containerd.selfmanagedRepositories

Description

Set to true if you manage the NVIDIA container toolkit's repositories externally and wish to skip their automatic configuration with furyctl. Default is false (furyctl manages repositories automatically). Notice that containerd itself is installed from binaries and does not use a repository. See .spec.kubernetes.advanced.airGap for other download options for containerd.

.spec.kubernetes.advanced.containerd.stateDir

Description

The Containerd state directory used in the config.toml file.

.spec.kubernetes.advanced.containerd.storageDir

Description

The Containerd storage directory used in the config.toml file.

.spec.kubernetes.advanced.containerd.systemdDir

Description

The Containerd systemd service directory used in the config.toml file.

.spec.kubernetes.advanced.controllerManager

Properties

Property	Type	Required
gcThreshold	integer	Optional

Description

Advanced configuration for the controller-manager.

.spec.kubernetes.advanced.controllerManager.gcThreshold

Description

Maximum number of terminated Pods retained by the controller-manager before automatic deletion.

.spec.kubernetes.advanced.encryption

Properties

Property	Type	Required
configuration	string	Optional
tlsCipherSuites	array	Optional
tlsCipherSuitesKubelet	array	Optional

.spec.kubernetes.advanced.encryption.configuration

Description

etcd's encryption at rest configuration. Must be a string with the EncryptionConfiguration object in YAML. Example:

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
    - secrets
    providers:
    - aescbc:
        keys:
        - name: mykey
          secret: base64_encoded_secret

.spec.kubernetes.advanced.encryption.tlsCipherSuites

Description

The TLS cipher suites to use for etcd and kubeadm static pods. Example:

tlsCipherSuites:
  - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
  - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
  - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
  - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
  - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
  - "TLS_AES_128_GCM_SHA256"
  - "TLS_AES_256_GCM_SHA384"
  - "TLS_CHACHA20_POLY1305_SHA256"

.

.spec.kubernetes.advanced.encryption.tlsCipherSuitesKubelet

Description

The TLS cipher suites to use for the kubelet. Example:

tlsCipherSuitesKubelet:
  - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
  - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
 - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
  - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
  - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"

. NOTE: to customize the TLS cipher suites of the kubelet, set only this field - do not configure them under the KubeletConfiguration.

.spec.kubernetes.advanced.eventRateLimits

Properties

Property	Type	Required
burst	integer	Required
cacheSize	integer	Optional
qps	integer	Required
type	string	Required

Description

Configures the limits of the API Server's EventRateLimit plugin. Each item represents a bucket (Server, Namespace, User, etc).

.spec.kubernetes.advanced.eventRateLimits.burst

Description

Maximum allowed burst for this bucket type.

.spec.kubernetes.advanced.eventRateLimits.cacheSize

Description

Maximum number of cached objects for this bucket. Only for certain types like Namespace or User.

.spec.kubernetes.advanced.eventRateLimits.qps

Description

Maximum allowed queries per second (QPS) for this bucket type.

.spec.kubernetes.advanced.eventRateLimits.type

Description

Type of limit to apply (Server, Namespace, User, SourceAndObject).

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"Server"
"Namespace"
"User"
"SourceAndObject"

.spec.kubernetes.advanced.kubeProxy

Properties

Property	Type	Required
additionalProperties	object	Optional
type	string	Optional

Description

Configuration for the kube-proxy component.

.spec.kubernetes.advanced.kubeProxy.additionalProperties

.spec.kubernetes.advanced.kubeProxy.type

Description

The operating mode for kube-proxy. none skips kube-proxy installation and configures the CNI accordingly (Cilium in kube-proxy-replacement mode, Calico in eBPF mode). nftables (default) installs kube-proxy in nftables mode.

NOTE: Changing the type after the cluster has been created is not currently supported.

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"none"
"nftables"

.spec.kubernetes.advanced.kubeletConfiguration

Properties

Property	Type	Required
maxPods	integer	Optional
systemReserved	object	Optional

Description

Kubelet configuration parameters. This open field allows users to specify any parameter supported by the KubeletConfiguration object. Examples of uses include controlling the maximum number of pods per node (maxPods), the maximum number of PIDs per pod (podPidsLimit), managing container logging (containerLogMaxSize), or Topology Manager options (topologyManagerPolicyOptions). All values must follow the official Kubelet specification: https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/.

NOTE: Content will not be validated by furyctl. To customize the TLS cipher suites of the Kubelet, set only the Spec.Kubernetes.Advanced.Encryption.tlsCipherSuitesKubelet field - do not configure them under this field.

.spec.kubernetes.advanced.kubeletConfiguration.maxPods

Description

Maximum number of pods per node. Example: 200

.spec.kubernetes.advanced.kubeletConfiguration.systemReserved

Properties

Property	Type	Required
cpu	string	Optional
ephemeral-storage	string	Optional
memory	string	Optional
pid	string	Optional

Description

Resources reserved for system daemons that are not managed by Kubernetes (e.g. the OS, sshd, container runtime). Values are Kubernetes resource quantities. Example:

systemReserved:
  cpu: "500m"
  memory: "1Gi"
  ephemeral-storage: "2Gi"
  pid: "1000"

. Ref: https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#system-reserved

.spec.kubernetes.advanced.kubeletConfiguration.systemReserved.cpu

Description

CPU reserved for system daemons, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.kubernetes.advanced.kubeletConfiguration.systemReserved.ephemeral-storage

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.kubernetes.advanced.kubeletConfiguration.systemReserved.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.kubernetes.advanced.kubeletConfiguration.systemReserved.pid

Description

Process IDs reserved for system daemons. Example: 1000

Constraints

pattern: the string must match the following regular expression:

^[0-9]+$

try pattern

.spec.kubernetes.advanced.oidc

Properties

Property	Type	Required
ca_file	string	Optional
client_id	string	Optional
group_prefix	string	Optional
groups_claim	string	Optional
issuer_url	string	Optional
username_claim	string	Optional
username_prefix	string	Optional

Description

OIDC configuration for the Kubernetes API server.

.spec.kubernetes.advanced.oidc.ca_file

Description

The path to the certificate for the CA that signed the identity provider's web certificate. Defaults to the host's root CAs. This should be a path available to the API Server.

.spec.kubernetes.advanced.oidc.client_id

Description

The client ID the API server will use to authenticate to the OIDC provider.

.spec.kubernetes.advanced.oidc.group_prefix

Description

Prefix prepended to group claims to prevent clashes with existing names (such as system: groups).

.spec.kubernetes.advanced.oidc.groups_claim

Description

JWT claim to use as the user's group.

.spec.kubernetes.advanced.oidc.issuer_url

Description

The issuer URL of the OIDC provider.

.spec.kubernetes.advanced.oidc.username_claim

Description

JWT claim to use as the user name. The default value is sub, which is expected to be a unique identifier of the end user.

.spec.kubernetes.advanced.oidc.username_prefix

Description

Prefix prepended to username claims to prevent clashes with existing names (such as system: users).

.spec.kubernetes.advanced.registry

Description

URL of the registry where to pull images from for the Kubernetes phase. (Default is registry.sighup.io/fury/on-premises).

.spec.kubernetes.advanced.users

Properties

Property	Type	Required
names	array	Optional
org	string	Optional

.spec.kubernetes.advanced.users.names

Description

List of user names to create and get a kubeconfig file. Users will not have any permissions by default, RBAC setup for the new users is needed.

.spec.kubernetes.advanced.users.org

Description

The organization the users belong to.

.spec.kubernetes.controlPlane

Properties

Property	Type	Required
address	string	Required
annotations	object	Optional
keepalived	object	Optional
kubeletConfiguration	object	Optional
labels	object	Optional
members	array	Required
taints	array	Optional

Description

Control plane configuration.

.spec.kubernetes.controlPlane.address

Description

The address for the Kubernetes control plane with port. Example: k8s-api.example.com:6443

Constraints

pattern: the string must match the following regular expression:

^[a-zA-Z0-9.-]+:[0-9]+$

try pattern

.spec.kubernetes.controlPlane.annotations

Description

Optional additional Kubernetes annotations that will be added to the control-plane nodes. Follows Kubernetes annotations format. Existing annotations with the same key will be overwritten.

.spec.kubernetes.controlPlane.keepalived

Properties

Property	Type	Required
enabled	boolean	Required
interface	string	Optional
ip	string	Optional
passphrase	string	Optional
virtualRouterId	string	Optional

Description

This section allows to configure a floating Virtual IP between the nodes via Keepalived. This can be used to provide high availability between 2 or more nodes.

.spec.kubernetes.controlPlane.keepalived.enabled

Description

Set to install keepalived with a floating virtual IP shared between the load balancer hosts for a deployment in High Availability.

.spec.kubernetes.controlPlane.keepalived.interface

Description

Name of the network interface where to bind the Keepalived virtual IP.

.spec.kubernetes.controlPlane.keepalived.ip

Description

The Virtual floating IP for Keepalived

.spec.kubernetes.controlPlane.keepalived.passphrase

Description

Password for accessing vrrpd. Make it unique between Keepalived clusters.

Constraints

maximum length: the maximum number of characters for this string is: 8

.spec.kubernetes.controlPlane.keepalived.virtualRouterId

Description

The virtual router ID of Keepalived, an arbitrary unique number from 1 to 255 used to differentiate multiple instances of vrrpd running on the same network interface and address family and multicast/unicast (and hence same socket).

.spec.kubernetes.controlPlane.kubeletConfiguration

Properties

Property	Type	Required
maxPods	integer	Optional
systemReserved	object	Optional

Description

Kubelet configuration parameters. This open field allows users to specify any parameter supported by the KubeletConfiguration object. Examples of uses include controlling the maximum number of pods per node (maxPods), the maximum number of PIDs per pod (podPidsLimit), managing container logging (containerLogMaxSize), or Topology Manager options (topologyManagerPolicyOptions). All values must follow the official Kubelet specification: https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/.

NOTE: Content will not be validated by furyctl. To customize the TLS cipher suites of the Kubelet, set only the Spec.Kubernetes.Advanced.Encryption.tlsCipherSuitesKubelet field - do not configure them under this field.

.spec.kubernetes.controlPlane.kubeletConfiguration.maxPods

Description

Maximum number of pods per node. Example: 200

.spec.kubernetes.controlPlane.kubeletConfiguration.systemReserved

Properties

Property	Type	Required
cpu	string	Optional
ephemeral-storage	string	Optional
memory	string	Optional
pid	string	Optional

Description

Resources reserved for system daemons that are not managed by Kubernetes (e.g. the OS, sshd, container runtime). Values are Kubernetes resource quantities. Example:

systemReserved:
  cpu: "500m"
  memory: "1Gi"
  ephemeral-storage: "2Gi"
  pid: "1000"

. Ref: https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#system-reserved

.spec.kubernetes.controlPlane.kubeletConfiguration.systemReserved.cpu

Description

CPU reserved for system daemons, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.kubernetes.controlPlane.kubeletConfiguration.systemReserved.ephemeral-storage

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.kubernetes.controlPlane.kubeletConfiguration.systemReserved.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.kubernetes.controlPlane.kubeletConfiguration.systemReserved.pid

Description

Process IDs reserved for system daemons. Example: 1000

Constraints

pattern: the string must match the following regular expression:

^[0-9]+$

try pattern

.spec.kubernetes.controlPlane.labels

Description

Optional additional Kubernetes labels that will be added to the control-plane nodes. Follows Kubernetes labels format.

Note: Existing labels with the same key will be overwritten and the label setting the control-plane role cannot be deleted.

.spec.kubernetes.controlPlane.members

Properties

Property	Type	Required
hostname	string	Required
ip	string	Optional

Description

A member node reference with optional IP override.

Constraints

minimum number of items: the minimum number of items for this array is: 1

.spec.kubernetes.controlPlane.members.hostname

Description

Hostname that must match an infrastructure node. Example: ctrl01.k8s.example.com

Constraints

minimum length: the minimum number of characters for this string is: 1

.spec.kubernetes.controlPlane.members.ip

Description

Optional IP address. If not specified, it is inferred from the node's network configuration. NOTE: this field is currently ignored, left for future usage.

Constraints

pattern: the string must match the following regular expression:

^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.){3}(25[0-5]|(2[0-4]|1\d|[1-9]|)\d)$

try pattern

.spec.kubernetes.controlPlane.taints

Properties

Property	Type	Required
effect	string	Required
key	string	Required
value	string	Required

Description

Kubernetes taints for the control-plane nodes, follows Kubernetes taints format. Default is node-role.kubernetes.io/control-plane:NoSchedule.

Example:

- effect: NoSchedule
  key: node.kubernetes.io/role
  value: control-plane

NOTE: Setting an empty list will remove the default control-plane taint.

NOTE2: Takes effect only at cluster creation time.

.spec.kubernetes.controlPlane.taints.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.kubernetes.controlPlane.taints.key

.spec.kubernetes.controlPlane.taints.value

.spec.kubernetes.etcd

Properties

Property	Type	Required
members	array	Required

Description

etcd cluster configuration. Ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/

.spec.kubernetes.etcd.members

Properties

Property	Type	Required
hostname	string	Required
ip	string	Optional

Description

A member node reference with optional IP override.

Constraints

minimum number of items: the minimum number of items for this array is: 1

.spec.kubernetes.etcd.members.hostname

Description

Hostname that must match an infrastructure node. Example: ctrl01.k8s.example.com

Constraints

minimum length: the minimum number of characters for this string is: 1

.spec.kubernetes.etcd.members.ip

Description

Optional IP address. If not specified, it is inferred from the node's network configuration. NOTE: this field is currently ignored, left for future usage.

Constraints

pattern: the string must match the following regular expression:

^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.){3}(25[0-5]|(2[0-4]|1\d|[1-9]|)\d)$

try pattern

.spec.kubernetes.networking

Properties

Property	Type	Required
podCIDR	string	Required
serviceCIDR	string	Required

Description

Kubernetes network configuration. Ref: https://kubernetes.io/docs/concepts/cluster-administration/networking/

.spec.kubernetes.networking.podCIDR

Description

Pod network CIDR. Example: 10.244.0.0/16

Constraints

pattern: the string must match the following regular expression:

^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.){3}(25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\/(3[0-2]|[1-2][0-9]|[0-9])$

try pattern

.spec.kubernetes.networking.serviceCIDR

Description

Service network CIDR. Example: 10.96.0.0/12

Constraints

pattern: the string must match the following regular expression:

^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.){3}(25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\/(3[0-2]|[1-2][0-9]|[0-9])$

try pattern

.spec.kubernetes.nodeGroups

Properties

Property	Type	Required
annotations	object	Optional
kubeletConfiguration	object	Optional
labels	object	Optional
name	string	Required
nodes	array	Required
taints	array	Optional

Description

A group of worker nodes with common labels, taints, and annotations. Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

.spec.kubernetes.nodeGroups.annotations

Description

Kubernetes annotations to apply to nodes in this group.

.spec.kubernetes.nodeGroups.kubeletConfiguration

Properties

Property	Type	Required
maxPods	integer	Optional
systemReserved	object	Optional

Description

Kubelet configuration parameters. This open field allows users to specify any parameter supported by the KubeletConfiguration object. Examples of uses include controlling the maximum number of pods per node (maxPods), the maximum number of PIDs per pod (podPidsLimit), managing container logging (containerLogMaxSize), or Topology Manager options (topologyManagerPolicyOptions). All values must follow the official Kubelet specification: https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/.

NOTE: Content will not be validated by furyctl. To customize the TLS cipher suites of the Kubelet, set only the Spec.Kubernetes.Advanced.Encryption.tlsCipherSuitesKubelet field - do not configure them under this field.

.spec.kubernetes.nodeGroups.kubeletConfiguration.maxPods

Description

Maximum number of pods per node. Example: 200

.spec.kubernetes.nodeGroups.kubeletConfiguration.systemReserved

Properties

Property	Type	Required
cpu	string	Optional
ephemeral-storage	string	Optional
memory	string	Optional
pid	string	Optional

Description

Resources reserved for system daemons that are not managed by Kubernetes (e.g. the OS, sshd, container runtime). Values are Kubernetes resource quantities. Example:

systemReserved:
  cpu: "500m"
  memory: "1Gi"
  ephemeral-storage: "2Gi"
  pid: "1000"

. Ref: https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#system-reserved

.spec.kubernetes.nodeGroups.kubeletConfiguration.systemReserved.cpu

Description

CPU reserved for system daemons, in cores or millicores. Examples: 500m, 1, 0.5

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(m|)$

try pattern

.spec.kubernetes.nodeGroups.kubeletConfiguration.systemReserved.ephemeral-storage

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.kubernetes.nodeGroups.kubeletConfiguration.systemReserved.memory

Description

Kubernetes resource quantity format. Examples: 50Gi, 100Mi, 1Ti

Constraints

pattern: the string must match the following regular expression:

^[0-9]+(\.[0-9]+)?(Ei?|Pi?|Ti?|Gi?|Mi?|Ki?|[EPTGMk])$

try pattern

.spec.kubernetes.nodeGroups.kubeletConfiguration.systemReserved.pid

Description

Process IDs reserved for system daemons. Example: 1000

Constraints

pattern: the string must match the following regular expression:

^[0-9]+$

try pattern

.spec.kubernetes.nodeGroups.labels

Description

Kubernetes labels to apply to nodes in this group.

.spec.kubernetes.nodeGroups.name

Description

Node group name identifier. Example: infra_workers

Constraints

minimum length: the minimum number of characters for this string is: 1

.spec.kubernetes.nodeGroups.nodes

Properties

Property	Type	Required
hostname	string	Required
ip	string	Optional

Description

A member node reference with optional IP override.

Constraints

minimum number of items: the minimum number of items for this array is: 1

.spec.kubernetes.nodeGroups.nodes.hostname

Description

Hostname that must match an infrastructure node. Example: ctrl01.k8s.example.com

Constraints

minimum length: the minimum number of characters for this string is: 1

.spec.kubernetes.nodeGroups.nodes.ip

Description

Optional IP address. If not specified, it is inferred from the node's network configuration. NOTE: this field is currently ignored, left for future usage.

Constraints

pattern: the string must match the following regular expression:

^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.){3}(25[0-5]|(2[0-4]|1\d|[1-9]|)\d)$

try pattern

.spec.kubernetes.nodeGroups.taints

Properties

Property	Type	Required
effect	string	Required
key	string	Required
value	string	Required

Description

Kubernetes taints to apply to nodes in this group.

.spec.kubernetes.nodeGroups.taints.effect

Constraints

enum: the value of this property must be equal to one of the following string values:

Value
"NoSchedule"
"PreferNoSchedule"
"NoExecute"

.spec.kubernetes.nodeGroups.taints.key

.spec.kubernetes.nodeGroups.taints.value

.spec.kubernetes.pkiPath

Description

Path to the PKI directory where to find the certificates and keys for Kubernetes Control Plane and etcd. Must have the master and etcd folders inside.

.spec.kubernetes.version

Description

Kubernetes version for sysext packages. Determines versions of containerd, kubernetes, and other components from installer defaults. Example: 1.33.4

Constraints

pattern: the string must match the following regular expression:

^\d+\.\d+\.\d+$

try pattern

.spec.plugins

Properties

Property	Type	Required
helm	object	Optional
kustomize	array	Optional

.spec.plugins.helm

Properties

Property	Type	Required
releases	array	Optional
repositories	array	Optional

.spec.plugins.helm.releases

Properties

Property	Type	Required
chart	string	Required
disableValidationOnInstall	boolean	Optional
name	string	Required
namespace	string	Required
set	array	Optional
values	array	Optional
version	string	Optional

.spec.plugins.helm.releases.chart

Description

The chart of the release

.spec.plugins.helm.releases.disableValidationOnInstall

Description

Disable running helm diff validation when installing the plugin, it will still be done when upgrading.

.spec.plugins.helm.releases.name

Description

The name of the release

.spec.plugins.helm.releases.namespace

Description

The namespace of the release

.spec.plugins.helm.releases.set

Properties

Property	Type	Required
name	string	Required
value	string	Required

.spec.plugins.helm.releases.set.name

Description

The name of the set

.spec.plugins.helm.releases.set.value

Description

The value of the set

.spec.plugins.helm.releases.values

Description

The values of the release

.spec.plugins.helm.releases.version

Description

The version of the release

.spec.plugins.helm.repositories

Properties

Property	Type	Required
name	string	Required
url	string	Required

.spec.plugins.helm.repositories.name

Description

The name of the repository

.spec.plugins.helm.repositories.url

Description

The url of the repository

.spec.plugins.kustomize

Properties

Property	Type	Required
folder	string	Required
name	string	Required

.spec.plugins.kustomize.folder

Description

The folder of the kustomize plugin

.spec.plugins.kustomize.name

Description

The name of the kustomize plugin. A lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', 'local-storage')

Constraints

pattern: the string must match the following regular expression:

^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

try pattern

.spec.toolsConfiguration

Properties

Property	Type	Required
ansible	object	Optional

Description

Configuration for tools used by furyctl.

.spec.toolsConfiguration.ansible

Properties

Property	Type	Required
config	string	Optional
pythonInterpreter	string	Optional

Description

Ansible configuration.

.spec.toolsConfiguration.ansible.config

Description

Additional content to append to the generated ansible.cfg file.

.spec.toolsConfiguration.ansible.pythonInterpreter

Description

Path to the Python interpreter to be used by Ansible on the remote nodes. Example: /usr/bin/python3