MachineConfig

version: v1alpha1
machine: # ...
cluster: # ...

Field	Type	Description	Value(s)
`version`	string	Indicates the schema used to decode the contents.	`v1alpha1`
`debug`	bool	Enable verbose logging to the console. All system containers logs will flow into serial console. Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.	`true` `yes` `false` `no`
`machine`	MachineConfig	Provides machine specific configuration options.
`cluster`	ClusterConfig	Provides cluster specific configuration options.

machine

MachineConfig represents the machine-specific config values.

machine:
    type: controlplane

Field	Type	Description	Value(s)
`type`	string	Defines the role of the machine within the cluster. Control Plane Control Plane node type designates the node as a control plane member. This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler. Worker Worker node type designates the node as a worker node. This means it will be an available compute node for scheduling workloads. This node type was previously known as “join”; that value is still supported but deprecated.	`controlplane` `worker`
`token`	string	The `token` is used by a machine to join the PKI of the cluster. Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity.
`ca`	PEMEncodedCertificateAndKey	The root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`.
`acceptedCAs`	[]PEMEncodedCertificate	The certificates issued by certificate authorities are accepted in addition to issuing ‘ca’. It is composed of a base64 encoded `crt“.
`certSANs`	[]string	Extra certificate subject alternative names for the machine’s certificate. By default, all non-loopback interface IPs are automatically added to the certificate’s SANs.
`features`	FeaturesConfig	Features describe individual Talos features that can be switched on or off.
`logging`	LoggingConfig	Configures the logging system.
`seccompProfiles`	MachineSeccompProfile	Configures the seccomp profiles for the machine.

features

FeaturesConfig describes individual Talos features that can be switched on or off.

machine:
    features:
        diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.

Field	Type	Description	Value(s)
`diskQuotaSupport`	bool	Enable XFS project quota support for EPHEMERAL partition and user disks. Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota.
`nodeAddressSortAlgorithm`	string	Select the node address sort algorithm. The ‘v1’ algorithm sorts addresses by the address itself. The ‘v2’ algorithm prefers more specific prefixes. If unset, defaults to ‘v1’.

logging

LoggingConfig struct configures Talos logging.

machine:
    logging:
        # Logging destination.
        destinations:
            - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
              format: json_lines # Logs format.

machine:
    logging:
        # Logging destination.
        destinations:
            - endpoint: udp://127.0.0.1:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
              format: json_lines # Logs format.
              # Extra tags (key-value) pairs to attach to every log message sent.
              extraTags:
                machine: worker-1

Field	Type	Description	Value(s)
`destinations`	LoggingDestination	Logging destination.

destinations[]

LoggingDestination struct configures Talos logging destination.

Field	Type	Description	Value(s)
`endpoint`	Endpoint	Where to send logs. Supported protocols are “tcp” and “udp”.
`format`	string	Logs format.	`json_lines`
`extraTags`	map[string]string	Extra tags (key-value) pairs to attach to every log message sent.

endpoint

Endpoint represents the endpoint URL parsed out of the machine config.

Field	Type	Description	Value(s)

seccompProfiles[]

MachineSeccompProfile defines seccomp profiles for the machine.

machine:
    seccompProfiles:
        - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
          # The `value` field is used to provide the seccomp profile.
          value:
            defaultAction: SCMP_ACT_LOG

Field	Type	Description	Value(s)
`name`	string	The `name` field is used to provide the file name of the seccomp profile.
`value`	Unstructured	The `value` field is used to provide the seccomp profile.

cluster

ClusterConfig represents the cluster-wide config values.

Field	Type	Description
`token`	string	The bootstrap token used to join the cluster.
`etcd`	EtcdConfig	Etcd specific configuration options.
`externalCloudProvider`	ExternalCloudProviderConfig	External cloud provider configuration.
`adminKubeconfig`	AdminKubeconfigConfig	Settings for admin kubeconfig generation. Certificate lifetime can be configured.

etcd

EtcdConfig represents the etcd configuration options.

cluster:
    etcd:
        image: registry.k8s.io/etcd:v3.7.0 # The container image used to create the etcd service.
        # The `ca` is the root certificate authority of the PKI.
        ca:
            crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
            key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
        # Extra arguments to supply to etcd.
        extraArgs:
            election-timeout: "5000"

        # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
        # advertisedSubnets:
        #     - 10.0.0.0/8

Field	Type	Description
`image`	string	The container image used to create the etcd service.
`ca`	PEMEncodedCertificateAndKey	The `ca` is the root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`.
`extraArgs`	Args	Extra arguments to supply to etcd. Note that the following args are not allowed: - `name` - `data-dir` - `initial-cluster-state` - `listen-peer-urls` - `listen-client-urls` - `cert-file` - `key-file` - `trusted-ca-file` - `peer-client-cert-auth` - `peer-cert-file` - `peer-trusted-ca-file` - `peer-key-file`
`advertisedSubnets`	[]string	The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node.
`listenSubnets`	[]string	The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections. If `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to `advertisedSubnets`. If neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node.

externalCloudProvider

ExternalCloudProviderConfig contains external cloud provider configuration.

cluster:
    externalCloudProvider:
        enabled: true # Enable external cloud provider.
        # A list of urls that point to additional manifests for an external cloud provider.
        manifests:
            - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
            - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml

Field	Type	Description	Value(s)
`enabled`	bool	Enable external cloud provider.	`true` `yes` `false` `no`
`manifests`	[]string	A list of urls that point to additional manifests for an external cloud provider. These will get automatically deployed as part of the bootstrap.

adminKubeconfig

AdminKubeconfigConfig contains admin kubeconfig settings.

cluster:
    adminKubeconfig:
        certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).

Field	Type	Description	Value(s)
`certLifetime`	Duration	Admin kubeconfig certificate lifetime (default is 1 year). Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).

Overview

Getting Started

Platform specific installation

Deploying and managing workloads

Networking

Security

Build and extend Talos

Configure your Talos cluster

Advanced guides

Reference

Troubleshooting and support

Learn more

machine

features

logging

destinations[]

endpoint

seccompProfiles[]

cluster

etcd

externalCloudProvider

adminKubeconfig

​machine

​features

​logging

​destinations[]

endpoint

​seccompProfiles[]

​cluster

​etcd

​externalCloudProvider

​adminKubeconfig

machine

features

logging

destinations[]

seccompProfiles[]

cluster

etcd

externalCloudProvider

adminKubeconfig