version: v1alpha1 # Indicates the schema used to decode the contents. debug: false # Enable verbose logging to the console. persist: true # Indicates whether to pull the machine config upon every boot. # Provides machine specific configuration options. machine: type: controlplane # Defines the role of the machine within the cluster. token: ukp3y7.ojx633zx5whc4kxc # The `token` is used by a machine to join the PKI of the cluster. # The root certificate authority of the PKI. ca: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBMDc5N0NWOEdUSUdYVFg5bmVkcWd6ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qTXdOVEV6TURRMU1USTNXaGNOTXpNd05URXdNRFExTVRJM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQURSRXFBbXI3MFcyNDlHS3JpbVlxSUpTTlhaS2xUNXBURXpPCkpqZEd5K0llbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkRDU01oREN5L1ZqVEwrWQpvZFFhZ2EyVEZzYm1NQVVHQXl0bGNBTkJBTzRnYnZzMzJQQTZBcnRRVHpxb1RUS2QybjJydjM4RlkzQ0dIVDFKCm9xMlE5ajZER1hwMHhaYm9mTnFleWJYeHJBZUx0MjlWRDgxWXRXWUMzYWNoUndrPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJRlZGQnFmcERkMW1seGhYbWFTL3pqYUp6bzV6TzNhcTVJSDRMZkVqSjRNdwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K # Extra certificate subject alternative names for the machine's certificate. certSANs: [] # # Uncomment this to enable SANs. # - 10.0.0.10 # - 172.16.0.10 # - 192.168.0.10 # Used to provide additional options to the kubelet. kubelet: image: ghcr.io/siderolabs/kubelet:v1.27.1 # The `image` field is an optional reference to an alternative kubelet image. # The `extraArgs` field is used to provide additional flags to the kubelet. extraArgs: node-labels: node.kubernetes.io/exclude-from-external-load-balancers=true defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: # - 10.96.0.10 # - 169.254.2.53 # # The `extraMounts` field is used to add additional mounts to the kubelet container. # extraMounts: # - destination: /var/lib/example # type: bind # source: /var/lib/example # options: # - bind # - rshared # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: # serverTLSBootstrap: true # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. # nodeIP: # # The `validSubnets` field configures the networks to pick kubelet node IP from. # validSubnets: # - 10.0.0.0/8 # - '!10.0.0.3/32' # - fdc7::/16 # Provides machine specific network configuration options. network: {} # # `interfaces` is used to define the network interface configuration. # interfaces: # - interface: eth0 # The interface name. # # Assigns static IP addresses to the interface. # addresses: # - 192.168.2.0/24 # # A list of routes associated with the interface. # routes: # - network: 0.0.0.0/0 # The route's network (destination). # gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). # metric: 1024 # The optional metric for the route. # mtu: 1500 # The interface's MTU. # # # # Picks a network device using the selector. # # # select a device with bus prefix 00:*. # # deviceSelector: # # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. # # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. # # deviceSelector: # # hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. # # driver: virtio # Kernel driver, supports matching by wildcard. # # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. # # deviceSelector: # # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. # # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. # # driver: virtio # Kernel driver, supports matching by wildcard. # # # Bond specific options. # # bond: # # # The interfaces that make up the bond. # # interfaces: # # - eth0 # # - eth1 # # # Picks a network device using the selector. # # deviceSelectors: # # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. # # - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. # # driver: virtio # Kernel driver, supports matching by wildcard. # # mode: 802.3ad # A bond option. # # lacpRate: fast # A bond option. # # # Bridge specific options. # # bridge: # # # The interfaces that make up the bridge. # # interfaces: # # - eth0 # # - eth1 # # # A bridge option. # # stp: # # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. # # # Indicates if DHCP should be used to configure the interface. # # dhcp: true # # # DHCP specific options. # # dhcpOptions: # # routeMetric: 1024 # The priority of all routes received via DHCP. # # # Wireguard specific configuration. # # # wireguard server example # # wireguard: # # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # # listenPort: 51111 # Specifies a device's listening port. # # # Specifies a list of peer configurations to apply to a device. # # peers: # # - publicKey: ABCDEF... # Specifies the public key of this peer. # # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # # allowedIPs: # # - 192.168.1.0/24 # # # wireguard peer example # # wireguard: # # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # # # Specifies a list of peer configurations to apply to a device. # # peers: # # - publicKey: ABCDEF... # Specifies the public key of this peer. # # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. # # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # # allowedIPs: # # - 192.168.1.0/24 # # # Virtual (shared) IP address configuration. # # # layer2 vip example # # vip: # # ip: 172.16.199.55 # Specifies the IP address to be used. # # Used to statically set the nameservers for the machine. # nameservers: # - 8.8.8.8 # - 1.1.1.1 # # Allows for extra entries to be added to the `/etc/hosts` file # extraHostEntries: # - ip: 192.168.1.100 # The IP of the host. # # The host alias. # aliases: # - example # - example.domain.tld # # Configures KubeSpan feature. # kubespan: # enabled: true # Enable the KubeSpan feature. # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. image: ghcr.io/siderolabs/installer:v1.4.4 # Allows for supplying the image used to perform the installation. bootloader: true # Indicates if a bootloader should be installed. wipe: false # Indicates if the installation disk should be wiped at installation time. # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. # # Allows for supplying extra kernel args via the bootloader. # extraKernelArgs: # - talos.platform=metal # - reboot=k # # Allows for supplying additional system extension images to install on top of base Talos image. # extensions: # - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image. # Features describe individual Talos features that can be switched on or off. features: rbac: true # Enable role-based access control (RBAC). stableHostname: true # Enable stable default hostname. apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid. # # Configure Talos API access from Kubernetes pods. # kubernetesTalosAPIAccess: # enabled: true # Enable Talos API access from Kubernetes pods. # # The list of Talos API roles which can be granted for access from Kubernetes pods. # allowedRoles: # - os:reader # # The list of Kubernetes namespaces Talos API access is available from. # allowedKubernetesNamespaces: # - kube-system # # Provides machine specific control plane configuration options. # # ControlPlane definition example. # controlPlane: # # Controller manager machine specific configuration options. # controllerManager: # disabled: false # Disable kube-controller-manager on the node. # # Scheduler machine specific configuration options. # scheduler: # disabled: true # Disable kube-scheduler on the node. # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. # # nginx static pod. # pods: # - apiVersion: v1 # kind: pod # metadata: # name: nginx # spec: # containers: # - image: nginx # name: nginx # # Used to partition, format and mount additional disks. # # MachineDisks list example. # disks: # - device: /dev/sdb # The name of the disk to use. # # A list of partitions to create on the disk. # partitions: # - mountpoint: /var/mnt/extra # Where to mount the partition. # # # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. # # # Human readable representation. # # size: 100 MB # # # Precise value in bytes. # # size: 1073741824 # # Allows the addition of user specified files. # # MachineFiles usage example. # files: # - content: '...' # The contents of the file. # permissions: 0o666 # The file's permissions in octal. # path: /tmp/file.txt # The path of the file. # op: append # The operation to use # # The `env` field allows for the addition of environment variables. # # Environment variables definition examples. # env: # GRPC_GO_LOG_SEVERITY_LEVEL: info # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" # https_proxy: http://SERVER:PORT/ # env: # GRPC_GO_LOG_SEVERITY_LEVEL: error # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ # env: # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ # # Used to configure the machine's time settings. # # Example configuration for cloudflare ntp server. # time: # disabled: false # Indicates if the time service is disabled for the machine. # # Specifies time (NTP) servers to use for setting the system time. # servers: # - time.cloudflare.com # bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. # # Used to configure the machine's sysctls. # # MachineSysctls usage example. # sysctls: # kernel.domainname: talos.dev # net.ipv4.ip_forward: "0" # # Used to configure the machine's sysfs. # # MachineSysfs usage example. # sysfs: # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance # # Used to configure the machine's container image registry mirrors. # registries: # # Specifies mirror configuration for each registry host namespace. # mirrors: # ghcr.io: # # List of endpoints (URLs) for registry mirrors to use. # endpoints: # - https://registry.insecure # - https://ghcr.io/v2/ # # Specifies TLS & auth configuration for HTTPS image registries. # config: # registry.insecure: # # The TLS configuration for the registry. # tls: # insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). # # # # Enable mutual TLS authentication with the registry. # # clientIdentity: # # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t # # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== # # # # The auth configuration for this registry. # # auth: # # username: username # Optional registry authentication. # # password: password # Optional registry authentication. # # Machine system disk encryption configuration. # systemDiskEncryption: # # Ephemeral partition encryption. # ephemeral: # provider: luks2 # Encryption provider to use for the encryption. # # Defines the encryption keys generation and storage method. # keys: # - # Deterministically generated key from the node UUID and PartitionLabel. # nodeID: {} # slot: 0 # Key slot number for LUKS2 encryption. # # # # Cipher kind to use for the encryption. Depends on the encryption provider. # # cipher: aes-xts-plain64 # # # Defines the encryption sector size. # # blockSize: 4096 # # # Additional --perf parameters for the LUKS2 encryption. # # options: # # - no_read_workqueue # # - no_write_workqueue # # Configures the udev system. # udev: # # List of udev rules to apply to the udev system # rules: # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" # # Configures the logging system. # logging: # # Logging destination. # destinations: # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". # format: json_lines # Logs format. # # Configures the kernel. # kernel: # # Kernel modules to load. # modules: # - name: brtfs # Module name. # # Configures the seccomp profiles for the machine. # seccompProfiles: # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. # # The `value` field is used to provide the seccomp profile. # value: # defaultAction: SCMP_ACT_LOG # # Configures the node labels for the machine. # # node labels example. # nodeLabels: # exampleLabel: exampleLabelValue # Provides cluster specific configuration options. cluster: id: AomznMVjQrZCD-Bm1a6DORI8GLZOVYwikdQEr0qI31g= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). secret: O/0Q2iNvQ8HYaET+D/4/tw4KJaFIIWo5UYn98vbHGUE= # Shared secret of cluster (base64 encoded random 32 bytes). # Provides control plane specific configuration options. controlPlane: endpoint: https://24.199.76.219:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. clusterName: distrust # Configures the cluster's name. # Provides cluster specific network configuration options. network: # The CNI used. cni: name: none # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 token: pye8s4.xbsov4gw0wvrshzm # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. secretboxEncryptionSecret: yW/XHbD87zaf+5JFwT5/YqadB26ZGU9gBrlDEREiFYA= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). # The base64 encoded root certificate authority used by Kubernetes. ca: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQUpxcC9saTRpVW5mMmtUWEF6ZkRBb1F3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlNekExTVRNd05EVXhNamRhRncwek16QTFNVEF3TkRVeApNamRhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVQ2QjMxRDR4bU44Q1hMVWQ5SWkvc3JBSnBobkpQWXMxd2Q4SXU0QTBxTHVxL0VxbXVjZHQ5L0dzODAKMmZyUTFPd3V4WDdXNytBWld6YzNOK01FdytkZW8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGQmlUeDBOSHlTaG5pMHY4S1NOMmMwOUF1SlN3TUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUNOMHhDK2MKOFdNL1JHM0ZBQW9Md3BWaThPRmZjaFZoSTJXdFE4QmlTd1QxQWlFQXRvclZLajZPeDJsQUEzSUhtU3hsRjhGYgpoZ2pBVm9jWWlVdk9EKzN2OFpBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUk4cGJ3ZXR6YkRlNU1LeTk5NHJTT3ZSTmJnSzFlQnZYaFBLd2pXY1RuNkVvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK2dkOVErTVpqZkFseTFIZlNJdjdLd0NhWVp5VDJMTmNIZkNMdUFOS2k3cXZ4S3BybkhiZgpmeHJQTk5uNjBOVHNMc1YrMXUvZ0dWczNOemZqQk1QblhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. aggregatorCA: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFhZ0F3SUJBZ0lSQUxnTUx4citpZFNCeVEvczdvREVKUTR3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU16QTFNVE13TkRVeE1qZGFGdzB6TXpBMU1UQXdORFV4TWpkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVE1R2JZT2oxV0VvTUdlNVEwYmlyaTljdndxVGhqZ1ZreHhiNmpGdW8xNk0wbFR5cWE3ClIvOW1DQ2hqdlZqRmgwYVl0QUpkZ2ZZM1B5Z1FmSHM1MzBRVW8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGS1VtTVZWanhNWWNJQU1vV2xINTJTdlVXdUxhTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDCklCMkwvTmdscHNPa0s0ak9WSXNkR3dSaEJocG9EMWh0TGQxSkFXcHNsNXJmQWlFQW9VNU4yeEd4c1JsT2tTOU4KTEFUbUtKajVUQS96UHhDcnUvUTIvVFNITDkwPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUdiZUVPRURJQ2lIM292dTNTQWdqNHd6SHhqK0oxWWl2SHd0MzFPc0lCQUtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFT1JtMkRvOVZoS0RCbnVVTkc0cTR2WEw4S2s0WTRGWk1jVytveGJxTmVqTkpVOHFtdTBmLwpaZ2dvWTcxWXhZZEdtTFFDWFlIMk56OG9FSHg3T2Q5RUZBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= # The base64 encoded private key for service account token generation. serviceAccount: key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUNSNmJBV1hlUWVYUTBYRTlnT1RzdTZ3REh1aHNHMDFGUnExQmZydzRNR05vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXRmaVlqUitFQUlka2R3dVhMMXA5OTl3VjNQa3Q5bDl5SUhPKzFSR0ZEY1ZNU2RvV01XMgp3YTNhZVovMS81eS9jdFFHVmxlVzJXcUs2RnNFQnZNeGp3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= # API server specific configuration options. apiServer: image: registry.k8s.io/kube-apiserver:v1.27.1 # The container image used in the API server manifest. # Extra certificate subject alternative names for the API server's certificate. certSANs: - 24.199.76.219 disablePodSecurityPolicy: true # Disable PodSecurityPolicy in the API server and default manifests. # Configure the API server admission plugins. admissionControl: - name: PodSecurity # Name is the name of the admission controller. # Configuration is an embedded configuration object to be used as the plugin's configuration: apiVersion: pod-security.admission.config.k8s.io/v1alpha1 defaults: audit: restricted audit-version: latest enforce: baseline enforce-version: latest warn: restricted warn-version: latest exemptions: namespaces: - kube-system runtimeClasses: [] usernames: [] kind: PodSecurityConfiguration # Configure the API server audit policy. auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata # Controller manager server specific configuration options. controllerManager: image: registry.k8s.io/kube-controller-manager:v1.27.1 # The container image used in the controller manager manifest. # Kube-proxy server-specific configuration options proxy: image: registry.k8s.io/kube-proxy:v1.27.1 # The container image used in the kube-proxy manifest. # # Disable kube-proxy deployment on cluster bootstrap. # disabled: false # Scheduler server specific configuration options. scheduler: image: registry.k8s.io/kube-scheduler:v1.27.1 # The container image used in the scheduler manifest. # Configures cluster member discovery. discovery: enabled: true # Enable the cluster membership discovery feature. # Configure registries used for cluster member discovery. registries: # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: disabled: true # Disable Kubernetes discovery registry. # Service registry is using an external service to push and pull information about cluster members. service: {} # # External service endpoint. # endpoint: https://discovery.talos.dev/ # Etcd specific configuration options. etcd: # The `ca` is the root certificate authority of the PKI. ca: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmakNDQVNTZ0F3SUJBZ0lSQU8yVUZxZFIyVXpuTnBEQ2duUGs0dG93Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TXpBMU1UTXdORFV4TWpkYUZ3MHpNekExTVRBd05EVXhNamRhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFUSS9XV3dPZXg1ClYyYi9OZk9XNFNHVU9vYVRvM0lXMk9hcUdmQk5zNGx0alNmZW1SMjZCMDc3VmVuMmVuRU5qUUo0VjRJbnIybmwKeGxQNnBqaXBWU3ZLbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRk8wSVNLM3h1OURmClVRVTF6ZDBXZG02WWdEWVdNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUUNsemh5MmFHL0lQR1pnV0JkbnE3NnQKTVJGMXVTWE53ZmRQYnpiajljaEJSQUlnT3VyZHFEcHg5OStzRnZ5QTFRM2ZhVXJaUERNdHh1b0ZuOXROVDQ0Two3OUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5TNDJhd3gyazdnYk5JN3Rmam84MnFqTXc5N2ZobW5GY2oySFJMYnY1TXBvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFeVAxbHNEbnNlVmRtL3pYemx1RWhsRHFHazZOeUZ0am1xaG53VGJPSmJZMG4zcGtkdWdkTworMVhwOW5weERZMENlRmVDSjY5cDVjWlQrcVk0cVZVcnlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= # # The container image used to create the etcd service. # image: gcr.io/etcd-development/etcd:v3.5.8 # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. # advertisedSubnets: # - 10.0.0.0/8 # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). # # Decryption secret example (do not use in production!). # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= # # Core DNS specific configuration options. # coreDNS: # image: docker.io/coredns/coredns:1.10.1 # The `image` field is an override to the default coredns image. # # External cloud provider configuration. # externalCloudProvider: # enabled: true # Enable external cloud provider. # # A list of urls that point to additional manifests for an external cloud provider. # manifests: # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml # # A list of urls that point to additional manifests. # extraManifests: # - https://www.example.com/manifest1.yaml # - https://www.example.com/manifest2.yaml # # A map of key value pairs that will be added while fetching the extraManifests. # extraManifestHeaders: # Token: "1234567" # X-ExtraInfo: info # # A list of inline Kubernetes manifests. # inlineManifests: # - name: namespace-ci # Name of the manifest. # contents: |- # Manifest contents as a string. # apiVersion: v1 # kind: Namespace # metadata: # name: ci # # Settings for admin kubeconfig generation. # adminKubeconfig: # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).