> ## Documentation Index
> Fetch the complete documentation index at: https://siderolabs-fe86397c-config-evolution.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Config defines the v1alpha1.Config Talos machine configuration document.

# MachineConfig

```yaml theme={null}
version: v1alpha1
machine: # ...
cluster: # ...
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`version`</td>
      <td>string</td>
      <td>Indicates the schema used to decode the contents.</td>
      <td>`v1alpha1`<br /></td>
    </tr>

    <tr>
      <td>`debug`</td>
      <td>bool</td>
      <td>Enable verbose logging to the console.<br />All system containers logs will flow into serial console.<br /><br />**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.</td>
      <td>`true`<br />`yes`<br />`false`<br />`no`<br /></td>
    </tr>

    <tr>
      <td>`machine`</td>
      <td><a href="#machine">MachineConfig</a></td>
      <td>Provides machine specific configuration options.</td>

      <td />
    </tr>

    <tr>
      <td>`cluster`</td>
      <td><a href="#cluster">ClusterConfig</a></td>
      <td>Provides cluster specific configuration options.</td>

      <td />
    </tr>
  </tbody>
</table>

## machine

MachineConfig represents the machine-specific config values.

```yaml theme={null}
machine:
    type: controlplane
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`type`</td>
      <td>string</td>
      <td>Defines the role of the machine within the cluster.<br /><br />**Control Plane**<br /><br />Control Plane node type designates the node as a control plane member.<br />This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.<br /><br />**Worker**<br /><br />Worker node type designates the node as a worker node.<br />This means it will be an available compute node for scheduling workloads.<br /><br />This node type was previously known as "join"; that value is still supported but deprecated.</td>
      <td>`controlplane`<br />`worker`<br /></td>
    </tr>

    <tr>
      <td>`token`</td>
      <td>string</td>
      <td>The `token` is used by a machine to join the PKI of the cluster.<br />Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.</td>

      <td />
    </tr>

    <tr>
      <td>`ca`</td>
      <td>PEMEncodedCertificateAndKey</td>
      <td>The root certificate authority of the PKI.<br />It is composed of a base64 encoded `crt` and `key`.</td>

      <td />
    </tr>

    <tr>
      <td>`acceptedCAs`</td>
      <td>\[]PEMEncodedCertificate</td>
      <td>The certificates issued by certificate authorities are accepted in addition to issuing 'ca'.<br />It is composed of a base64 encoded \`crt\`\`.</td>

      <td />
    </tr>

    <tr>
      <td>`certSANs`</td>
      <td>\[]string</td>
      <td>Extra certificate subject alternative names for the machine's certificate.<br />By default, all non-loopback interface IPs are automatically added to the certificate's SANs.</td>

      <td />
    </tr>

    <tr>
      <td>`features`</td>
      <td><a href="#features">FeaturesConfig</a></td>
      <td>Features describe individual Talos features that can be switched on or off.</td>

      <td />
    </tr>

    <tr>
      <td>`logging`</td>
      <td><a href="#logging">LoggingConfig</a></td>
      <td>Configures the logging system.</td>

      <td />
    </tr>

    <tr>
      <td>`seccompProfiles`</td>
      <td><a href="#seccompprofiles%5B%5D">MachineSeccompProfile</a></td>
      <td>Configures the seccomp profiles for the machine.</td>

      <td />
    </tr>
  </tbody>
</table>

### features

FeaturesConfig describes individual Talos features that can be switched on or off.

```yaml theme={null}
machine:
    features:
        diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`diskQuotaSupport`</td>
      <td>bool</td>
      <td>Enable XFS project quota support for EPHEMERAL partition and user disks.<br />Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota.</td>

      <td />
    </tr>

    <tr>
      <td>`nodeAddressSortAlgorithm`</td>
      <td>string</td>
      <td>Select the node address sort algorithm.<br />The 'v1' algorithm sorts addresses by the address itself.<br />The 'v2' algorithm prefers more specific prefixes.<br />If unset, defaults to 'v1'.</td>

      <td />
    </tr>
  </tbody>
</table>

### logging

LoggingConfig struct configures Talos logging.

```yaml theme={null}
machine:
    logging:
        # Logging destination.
        destinations:
            - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
              format: json_lines # Logs format.
```

```yaml theme={null}
machine:
    logging:
        # Logging destination.
        destinations:
            - endpoint: udp://127.0.0.1:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
              format: json_lines # Logs format.
              # Extra tags (key-value) pairs to attach to every log message sent.
              extraTags:
                machine: worker-1
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`destinations`</td>
      <td><a href="#destinations%5B%5D">LoggingDestination</a></td>
      <td>Logging destination.</td>

      <td />
    </tr>
  </tbody>
</table>

#### destinations\[]

LoggingDestination struct configures Talos logging destination.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`endpoint`</td>
      <td><a href="#endpoint">Endpoint</a></td>
      <td>Where to send logs. Supported protocols are "tcp" and "udp".</td>

      <td />
    </tr>

    <tr>
      <td>`format`</td>
      <td>string</td>
      <td>Logs format.</td>
      <td>`json_lines`<br /></td>
    </tr>

    <tr>
      <td>`extraTags`</td>
      <td>map\[string]string</td>
      <td>Extra tags (key-value) pairs to attach to every log message sent.</td>

      <td />
    </tr>
  </tbody>
</table>

##### endpoint

Endpoint represents the endpoint URL parsed out of the machine config.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody />
</table>

### seccompProfiles\[]

MachineSeccompProfile defines seccomp profiles for the machine.

```yaml theme={null}
machine:
    seccompProfiles:
        - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
          # The `value` field is used to provide the seccomp profile.
          value:
            defaultAction: SCMP_ACT_LOG
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`name`</td>
      <td>string</td>
      <td>The `name` field is used to provide the file name of the seccomp profile.</td>

      <td />
    </tr>

    <tr>
      <td>`value`</td>
      <td>Unstructured</td>
      <td>The `value` field is used to provide the seccomp profile.</td>

      <td />
    </tr>
  </tbody>
</table>

## cluster

ClusterConfig represents the cluster-wide config values.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`token`</td>
      <td>string</td>
      <td>The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.</td>

      <td />
    </tr>

    <tr>
      <td>`etcd`</td>
      <td><a href="#etcd">EtcdConfig</a></td>
      <td>Etcd specific configuration options.</td>

      <td />
    </tr>

    <tr>
      <td>`externalCloudProvider`</td>
      <td><a href="#externalcloudprovider">ExternalCloudProviderConfig</a></td>
      <td>External cloud provider configuration.</td>

      <td />
    </tr>

    <tr>
      <td>`adminKubeconfig`</td>
      <td><a href="#adminkubeconfig">AdminKubeconfigConfig</a></td>
      <td>Settings for admin kubeconfig generation.<br />Certificate lifetime can be configured.</td>

      <td />
    </tr>
  </tbody>
</table>

### etcd

EtcdConfig represents the etcd configuration options.

```yaml theme={null}
cluster:
    etcd:
        image: registry.k8s.io/etcd:v3.7.0 # The container image used to create the etcd service.
        # The `ca` is the root certificate authority of the PKI.
        ca:
            crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
            key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
        # Extra arguments to supply to etcd.
        extraArgs:
            election-timeout: "5000"

        # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
        # advertisedSubnets:
        #     - 10.0.0.0/8
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`image`</td>
      <td>string</td>
      <td>The container image used to create the etcd service.</td>

      <td />
    </tr>

    <tr>
      <td>`ca`</td>
      <td>PEMEncodedCertificateAndKey</td>
      <td>The `ca` is the root certificate authority of the PKI.<br />It is composed of a base64 encoded `crt` and `key`.</td>

      <td />
    </tr>

    <tr>
      <td>`extraArgs`</td>
      <td>Args</td>
      <td>Extra arguments to supply to etcd.<br />Note that the following args are not allowed:<br /><br />- `name`<br />- `data-dir`<br />- `initial-cluster-state`<br />- `listen-peer-urls`<br />- `listen-client-urls`<br />- `cert-file`<br />- `key-file`<br />- `trusted-ca-file`<br />- `peer-client-cert-auth`<br />- `peer-cert-file`<br />- `peer-trusted-ca-file`<br />- `peer-key-file`</td>

      <td />
    </tr>

    <tr>
      <td>`advertisedSubnets`</td>
      <td>\[]string</td>
      <td>The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.<br /><br />IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.<br />Negative subnet matches should be specified last to filter out IPs picked by positive matches.<br />If not specified, advertised IP is selected as the first routable address of the node.</td>

      <td />
    </tr>

    <tr>
      <td>`listenSubnets`</td>
      <td>\[]string</td>
      <td>The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections.<br /><br />If `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to<br />`advertisedSubnets`.<br /><br />If neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses.<br /><br />IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.<br />Negative subnet matches should be specified last to filter out IPs picked by positive matches.<br />If not specified, advertised IP is selected as the first routable address of the node.</td>

      <td />
    </tr>
  </tbody>
</table>

### externalCloudProvider

ExternalCloudProviderConfig contains external cloud provider configuration.

```yaml theme={null}
cluster:
    externalCloudProvider:
        enabled: true # Enable external cloud provider.
        # A list of urls that point to additional manifests for an external cloud provider.
        manifests:
            - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
            - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`enabled`</td>
      <td>bool</td>
      <td>Enable external cloud provider.</td>
      <td>`true`<br />`yes`<br />`false`<br />`no`<br /></td>
    </tr>

    <tr>
      <td>`manifests`</td>
      <td>\[]string</td>
      <td>A list of urls that point to additional manifests for an external cloud provider.<br />These will get automatically deployed as part of the bootstrap.</td>

      <td />
    </tr>
  </tbody>
</table>

### adminKubeconfig

AdminKubeconfigConfig contains admin kubeconfig settings.

```yaml theme={null}
cluster:
    adminKubeconfig:
        certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`certLifetime`</td>
      <td>Duration</td>
      <td>Admin kubeconfig certificate lifetime (default is 1 year).<br />Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).</td>

      <td />
    </tr>
  </tbody>
</table>