Custom resources | node-manager

The Deckhouse Kubernetes Platform installs CRDs but does not remove them when a module is disabled. If you no longer need the created CRDs, delete them.

The module lifecycle stage: General Availability

Instance

Scope: Cluster

v1alpha2
v1alpha1

Instance describes the full lifecycle of a server in Deckhouse Kubernetes Platform, aggregating status from the Machine object (infrastructure) and Bashible service on the node (configuration).

spec
object
Specification of the Instance, including references to related resources.
- spec.classReference
  object
  The reference to the InstanceClass object. It is unique for each cloud-provider-* module.
  - spec.classReference.kind
    string
    The object type (e.g., OpenStackInstanceClass). The object type is specified in the documentation of the corresponding cloud-provider- module.
  - spec.classReference.name
    string
    The name of the required InstanceClass object (e.g., finland-medium).
- spec.machineRef
  object
  Reference to instance in the cloud.
  - spec.machineRef.apiVersion
    string
    APIVersion defines the versioned schema of this representation of an reference object.
  - spec.machineRef.kind
    string
    Kind is a string value representing the REST resource referenced object represents.
  - spec.machineRef.name
    string
    Name of referenced object.
  - spec.machineRef.namespace
    string
    Namespace of referenced object.
- spec.nodeRef
  object
  Reference to the kubernetes node object.
  - spec.nodeRef.name
    string
    Node name.
status
object
Most recently observed status of the Instance.
- status.bashibleStatus
  string
  Aggregated status of the bashible configuration process.
  
  Derived from BashibleReady condition.
  
  Allowed values: Error, Unknown, Ready, WaitingApproval
- status.bootstrapStatus
  object
  Information about instance bootstrapping process.
  - status.bootstrapStatus.description
    string
    Description about getting logs.
  - status.bootstrapStatus.logsEndpoint
    string
    http endpoint for getting bootstrap logs.
- status.conditions
  array of objects
  Detailed conditions of the instance (MachineReady, BashibleReady, etc.).
  - status.conditions.lastHeartbeatTime
    string
    Last time the condition heartbeat was updated by its source.
  - status.conditions.lastTransitionTime
    string
    Last time the condition transitioned from one status to another.
  - status.conditions.message
    string
    A human-readable message indicating details about the transition.
  - status.conditions.observedGeneration
    integer
    The generation observed by the controller.
  - status.conditions.reason
    string
    Required value
    The reason for the condition’s last transition.
  - status.conditions.severity
    string
    Severity of the condition (Error, Warning, Info).
  - status.conditions.status
    string
    Required value
    Status of the condition (True, False, Unknown).
  - status.conditions.type
    string
    Required value
    Type of the condition (e.g., MachineReady, BashibleReady).
- status.machineStatus
  string
  Aggregated status of the infrastructure machine.
  
  Derived from MachineReady condition.
  
  Allowed values: Progressing, Error, Ready, Blocked, Rebooting
- status.message
  string
  A human-readable message indicating details about the current status or error.
  
  Displayed in CLI only when using -o wide for d8 k.
- status.phase
  string
  The high-level lifecycle phase of the Instance.
  
  Mapping: Pending -> Provisioning -> Provisioned -> Running -> Terminating.
  
  Allowed values: Pending, Provisioning, Provisioned, Running, Terminating, Unknown

Describes an implementation-independent ephemeral machine resource.

status
object
- status.bootstrapStatus
  object
  Information about instance bootstrapping process.
  - status.bootstrapStatus.description
    string
    Description about getting logs.
  - status.bootstrapStatus.logsEndpoint
    string
    http endpoint for getting bootstrap logs.
- status.classReference
  object
  The reference to the InstanceClass object. It is unique for each cloud-provider-* module.
  - status.classReference.kind
    string
    The object type (e.g., OpenStackInstanceClass). The object type is specified in the documentation of the corresponding cloud-provider- module.
    
    Allowed values: OpenStackInstanceClass, GCPInstanceClass, VsphereInstanceClass, AWSInstanceClass, YandexInstanceClass, AzureInstanceClass, VCDInstanceClass, ZvirtInstanceClass, DynamixInstanceClass, HuaweiCloudInstanceClass, DVPInstanceClass
  - status.classReference.name
    string
    The name of the required InstanceClass object (e.g., finland-medium).
- status.currentStatus
  object
  Current status of the instance object.
  - status.currentStatus.lastUpdateTime
    string
    Last update time of current status.
  - status.currentStatus.phase
    string
    InstancePhase is a label for the condition of a instance at the current time.
- status.lastOperation
  object
  Last operation refers to the status of the last operation performed.
  - status.lastOperation.description
    string
    Description of the current operation.
  - status.lastOperation.lastUpdateTime
    string
    Last update time of current operation.
  - status.lastOperation.state
    string
    State of operation.
  - status.lastOperation.type
    string
    Type of operation.
- status.machineRef
  object
  Reference to instance in the cloud.
  - status.machineRef.apiVersion
    string
    APIVersion defines the versioned schema of this representation of an reference object.
  - status.machineRef.kind
    string
    Kind is a string value representing the REST resource referenced object represents.
  - status.machineRef.name
    string
    Name of referenced object.
  - status.machineRef.namespace
    string
    Namespace of referenced object.
- status.nodeRef
  object
  Reference to the kubernetes node object.
  - status.nodeRef.name
    string
    Node name.

InstanceTypesCatalog

Scope: Cluster
Version: v1alpha1

Contains information about discovered data from cloud.

instanceTypes
array of objects
Required value
List of available instance types.
- instanceTypes.cpu
  integer or string
  Required value
  The number of CPUs for the instance type.
  
  Pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
- instanceTypes.memory
  integer or string
  Required value
  The amount of RAM a instance type has.
  
  Pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
- instanceTypes.name
  string
  Instance type name.
- instanceTypes.rootDisk
  integer or string
  Root disk size.
  
  Pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$

NodeGroup

Short names: ng

Scope: Cluster

v1
v1alpha2
v1alpha1

Describes the runtime parameters of the node group.

Example:

# NodeGroup for cloud nodes in AWS.
apiVersion: deckhouse.io/v1
kind: NodeGroup
metadata:
  name: test
spec:
  nodeType: CloudEphemeral
  cloudInstances:
    zones:
      - eu-west-1a
      - eu-west-1b
    minPerZone: 1
    maxPerZone: 2
    classReference:
      kind: AWSInstanceClass
      name: test
  nodeTemplate:
    labels:
      tier: test
---
# NodeGroup for static nodes on bare metal servers (or VMs).
apiVersion: deckhouse.io/v1
kind: NodeGroup
metadata:
  name: worker
spec:
  nodeType: Static

metadata
object
- metadata.name
  string
  Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
  Maximum length: 42
spec
object
Required value
- spec.chaos
  object
  Chaos monkey settings.
  
  Example:
  chaos: mode: DrainAndDelete period: 24h
  - spec.chaos.mode
    string
    The chaos monkey mode:
    
    DrainAndDelete — drains and deletes a node when triggered;
    
    Disabled — leaves this NodeGroup intact.
    Default: Disabled
    Allowed values: Disabled, DrainAndDelete
  - spec.chaos.period
    string
    The time interval to use for the chaos monkey.
    
    It is specified as a string containing the time unit in hours and minutes: 30m, 1h, 2h30m, 24h.
    
    Default: 6h
    Pattern: ^([0-9]+h([0-9]+m)?|[0-9]+m)$
- spec.cloudInstances
  object
  Parameter for provisioning the cloud-based VMs.
  
  Caution. Can only be used together with nodeType: CloudEphemeral.
  - spec.cloudInstances.classReference
    object
    Required value
    The reference to the InstanceClass object. It is unique for each cloud-provider-* module.
    - spec.cloudInstances.classReference.kind
      string
      The kind of the InstanceClass object (e.g., OpenStackInstanceClass). Supported kinds are defined by the installed cloud provider modules and specified in their documentation.
    - spec.cloudInstances.classReference.name
      string
      The name of the required InstanceClass object (e.g., finland-medium).
  - spec.cloudInstances.maxPerZone
    integer
    Required value
    The maximum number of instances for the group in each zone.
    
    This value is used as the upper bound in cluster-autoscaler.
    
    Allowed values: 0 <= X
  - spec.cloudInstances.maxSurgePerZone
    integer
    The maximum number of instances to rollout simultaneously in the group in each zone.
    
    Default: 1
    Allowed values: 0 <= X
  - spec.cloudInstances.maxUnavailablePerZone
    integer
    The maximum number of unavailable instances (during rollout) in the group in each zone.
    
    Default: 0
    Allowed values: 0 <= X
  - spec.cloudInstances.minPerZone
    integer
    Required value
    The minimum number of instances for the group in each zone.
    
    This value is used in the MachineDeployment object and as a lower bound in cluster-autoscaler.
    
    Allowed values: 0 <= X
  - spec.cloudInstances.priority
    integer
    Priority of the node group.
    
    When scaling a cluster, the autoscaler will first select node groups with a higher priority set. If several node groups have the same priority, the autoscaler randomly selects a group of them. You can control the rate at which nodes are switched to lower-priority groups on demand (for more details, see the FAQ).
    
    Using priorities can be convenient to prefer ordering cheaper nodes (for example, spot instances) over more expensive ones.
  - spec.cloudInstances.quickShutdown
    Deprecated
    boolean
    Lowers CloudEphemeral machine drain timeout to 5 minutes.
  - spec.cloudInstances.standby
    integer or string
    The summary number of overprovisioned nodes for this NodeGroup in all zones.
    
    An overprovisioned node is a cluster node on which resources are reserved that are available at any time for scaling. The presence of such a node allows the cluster autoscaler not to wait for node initialization (which may take several minutes), but to immediately place a load on it.
    
    The value can be an absolute number (for example, 2) or a percentage of desired nodes (for example, 10%). If a percentage is specified, the absolute number is calculated based on the percentage of the maximum number of nodes (the maxPerZone parameter) rounded down, but not less than one.
    
    Pattern: ^[0-9]+%?$
  - spec.cloudInstances.standbyHolder
    object
    Amount of reserved resources.
    
    Used to determine whether to order overprovisioned nodes.
    - spec.cloudInstances.standbyHolder.notHeldResources
      Deprecated
      object
      Deprecated: the parameter is no longer used. Use the overprovisioningRate parameter.
      
      Describes the resources that will not be held (consumed) by the standby holder.
      - spec.cloudInstances.standbyHolder.notHeldResources.cpu
        integer or string
        Describes the amount of CPU that will not be held by standby holder on Nodes from this NodeGroup.
        
        The value can be an absolute number of cpus (for example, 2) as well as a milli representation (for example, 1500m).
        
        Pattern: ^[0-9]+m?$
      - spec.cloudInstances.standbyHolder.notHeldResources.memory
        integer or string
        Describes the amount of memory that will not be held by standby holder on Nodes from this NodeGroup.
        
        The value can be an absolute number of bytes (for example, 128974848) as well as a fixed-point number using one of memory suffixes: G, Gi, M, Mi.
        
        Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$
    - spec.cloudInstances.standbyHolder.overprovisioningRate
      integer
      Percentage of reserved resources calculated from the capacity of a node of a NodeGroup.
      
      Default: 50
      Allowed values: 1 <= X <= 80
  - spec.cloudInstances.zones
    array of strings
    List of availability zones to create instances in.
    
    The default value depends on the cloud provider selected and usually corresponds to all zones of the region being used.
    
    Example:
    zones: - Helsinki - Espoo - Tampere
- spec.cri
  object
  Container runtime parameters.
  - spec.cri.containerd
    object
    Containerd runtime parameters.
    
    If used, cri.type must be set to Containerd.
    - spec.cri.containerd.maxConcurrentDownloads
      integer
      Set the max concurrent downloads for each pull.
      
      Default: 3
  - spec.cri.containerdV2
    object
    ContainerdV2 runtime parameters.
    
    If used, cri.type must be set to ContainerdV2.
    
    When using ContainerdV2, CgroupsV2 will be used (providing improved security and resource management).
    
    To use ContainerdV2 as a container runtime, the nodes in the group must meet the following requirements:
    
    Support for CgroupsV2.
    
    Linux kernel version 5.8 or newer.
    
    Systemd version 244 or newer.
    
    Support for erofs kernel module.
    - spec.cri.containerdV2.maxConcurrentDownloads
      integer
      Set the max concurrent downloads for each pull.
      
      Default: 3
  - spec.cri.docker
    Deprecated
    object
    Docker settings for nodes.
    - spec.cri.docker.manage
      boolean
      Enable Docker maintenance from bashible.
      
      Default: true
    - spec.cri.docker.maxConcurrentDownloads
      integer
      Set the max concurrent downloads for each pull.
      
      Default: 3
  - spec.cri.notManaged
    object
    Settings for not managed CRI for nodes.
    - spec.cri.notManaged.criSocketPath
      string
      Path to CRI socket.
  - spec.cri.type
    string
    Container runtime type.
    
    If not specified, the defaultCRI parameter value of ClusterConfiguration is used.
    
    Note. Docker support is deprecated.
    
    Note. The CSE edition supports containerd v2 only.
    
    Allowed values: Docker, Containerd, ContainerdV2, NotManaged
- spec.disruptions
  object
  Disruptions settings for nodes.
  
  Example:
  disruptions: approvalMode: Automatic automatic: drainBeforeApproval: false windows: - from: '06:00' to: '08:00' days: - Tue - Sun
  - spec.disruptions.approvalMode
    string
    The approval mode for disruptive updates:
    
    Manual — disable automatic disruption approval; the alert will be displayed if disruption is needed. Nodes are not drained automatically in Manual mode. If necessary, manually drain nodes before setting the update.node.deckhouse.io/disruption-approved= annotation. Caution. The master node group update mode must be Manual to avoid issues with draining.
    
    Automatic — automatically approve disruption-involving updates. Nodes could be drained automatically before reboot, as configured by the drainBeforeApproval option.
    
    RollingUpdate — in this mode, a new node with new settings will be created; then, the old node will be deleted. Available only for cloud nodes.
    
    If the RollingUpdate mode is not used, when updating, the node is first drained and then updated (rebooted) and put back into operation (uncordoned). Note that in this case, the cluster must have sufficient resources to accommodate the load while the node being updated is unavailable. In the RollingUpdate mode, the node is replaced by the updated node, i.e., an extra node appears in the cluster for the duration of the update. In cloud infrastructures, the RollingUpdate mode is convenient, for example, if there are no resources in the cluster to temporarily host the load from the node being updated.
    Default: Automatic
    Allowed values: Manual, Automatic, RollingUpdate
  - spec.disruptions.automatic
    object
    Additional parameters for the Automatic mode.
    - spec.disruptions.automatic.drainBeforeApproval
      boolean
      Drain Pods from the nodes before approving disruption.
      
      Caution. This setting ignores (nodes will be approved without draining Pods):
      
      for the nodeGroup master with a single node;
      
      for a single ready node in a nodeGroup picked out for Deckhouse placement.
      
      Default: true
    - spec.disruptions.automatic.windows
      array of objects
      Time windows for node disruptive updates.
      - spec.disruptions.automatic.windows.days
        array of strings
        Days of the week when node could be updated.
        
        Examples:
        days: Mon
        
        days: Wed
        
        Element of the array
        string
        Day of the week.
        
        Allowed values: Mon, Tue, Wed, Thu, Fri, Sat, Sun
      - spec.disruptions.automatic.windows.from
        string
        Required value
        Start time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        from: '13:00'
      - spec.disruptions.automatic.windows.to
        string
        Required value
        End time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        to: '18:30'
  - spec.disruptions.rollingUpdate
    object
    Additional parameters for the RollingUpdate mode.
    - spec.disruptions.rollingUpdate.windows
      array of objects
      Time windows for node disruptive updates.
      - spec.disruptions.rollingUpdate.windows.days
        array of strings
        Days of the week when node could be updated.
        
        Examples:
        days: Mon
        
        days: Wed
        
        Element of the array
        string
        Day of the week.
        
        Allowed values: Mon, Tue, Wed, Thu, Fri, Sat, Sun
      - spec.disruptions.rollingUpdate.windows.from
        string
        Required value
        Start time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        from: '13:00'
      - spec.disruptions.rollingUpdate.windows.to
        string
        Required value
        End time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        to: '18:30'
- spec.fencing
  object
  Enable the fencing-controller for a node group.
  - spec.fencing.mode
    string
    Required value
    Specifies the operating mode of the fencing-controller.
    
    Supported modes:
    
    Watchdog: Uses the watchdog kernel module to automatically reboot nodes that lose connectivity with the cluster. In this mode, the fencing-agent also monitors node availability in the cluster.
    
    When fencing is enabled, the NodeGroupConfiguration script loads the softdog kernel module with the soft_margin parameter set to the value of spec.fencing.watchdog.timeout (60 seconds by default) and soft_panic=1.
    
    How the fencing-agent works:
    
    The agent opens the /dev/watchdog device and sets the node-manager.deckhouse.io/fencing-enabled label on the node, as well as the node-manager.deckhouse.io/fencing-mode label with the value Watchdog.
    
    The fencing-agent joins a gossip cluster (memberlist) with agents from the same node group.
    
    The agent regularly checks quorum (availability of the majority of nodes in the group):
    
    If quorum is lost (quorum=false), the agent performs an additional check of Kubernetes API availability.
    
    If quorum is present or the Kubernetes API is reachable, the agent resets the watchdog timer.
    
    If neither quorum nor access to the Kubernetes API is available, the watchdog is no longer reset, the timer expires, and a kernel panic occurs.
    
    The agent respects maintenance annotations node-manager.deckhouse.io/fencing-disable, update.node.deckhouse.io/approved, and update.node.deckhouse.io/disruption-approved, temporarily disabling the watchdog during planned operations.
    
    When fencing is enabled, automatic node reboot after a kernel panic is disabled at the OS level. This prevents a node from returning in an undefined state before it is properly handled (manually for static nodes, or via the cloud-provider-controller for cloud nodes).
    
    The fencing-controller takes the node type (node.deckhouse.io/type) into account when handling a failed node:
    
    For cloud nodes (CloudEphemeral, CloudPermanent), the controller deletes the Node object, after which the cloud-provider-controller recreates the corresponding virtual machine.
    
    For static nodes (Static, CloudStatic), the controller only evicts workloads while keeping the Node object in the cluster.
    
    For details on how fencing handles different node types, see FAQ.
    Allowed values: Watchdog
  - spec.fencing.watchdog
    object
    - spec.fencing.watchdog.timeout
      string
      Required value
      Watchdog timeout duration. Should be specified in seconds, minutes or hours.
      
      Default: 60s
      Pattern: ^[0-9]+[smh]{1}$
- spec.gpu
  object
  Available in editions: EE
  GPU parameters.
  - spec.gpu.exclusive
    object
    Without GPU sharing.
  - spec.gpu.mig
    object
    MIG sharing strategy parameters.
    - spec.gpu.mig.customConfigs
      array of objects
      Custom MIG partitioning by GPU index.
      
      Used only when partedConfig: custom is set.
      
      Represents an array of devices (a map keyed by index), where each entry refers to a GPU by its index and describes the slices to be created.
      
      Examples:
      customConfigs: profile: 3g.40gb count: 2
      
      customConfigs: profile: 1g.10gb.me count: 1
      - spec.gpu.mig.customConfigs.index
        integer
        Required value
        GPU index on the node.
        
        Allowed values: 0 <= X
      - spec.gpu.mig.customConfigs.slices
        array of objects
        Required value
        List of MIG slices to create.
        
        spec.gpu.mig.customConfigs.slices.count
        integer
        Required value
        Number of slices in the selected profile.
        
        Default: 1
        Allowed values: 1 <= X <= 7
        
        spec.gpu.mig.customConfigs.slices.profile
        string
        Required value
        MIG profile name.
        
        Pattern: ^[0-9]+g\.[0-9]+gb(\.me)?$
        Examples:
        profile: 3g.40gb
        
        profile: 1g.10gb
        
        profile: 1g.10gb.me
    - spec.gpu.mig.partedConfig
      string
      MIG configuration name.
      
      Standard all-* profiles are supported (the same partitioning applied to all GPUs), as well as the custom value, which allows defining partitioning individually for each GPU.
      
      Default: all-1g.5gb
  - spec.gpu.sharing
    string
    GPU sharing strategy:
    
    Exclusive — no sharing (each GPU is fully allocated to a single Pod).
    
    TimeSlicing — time-sliced sharing (multiple Pods can share one GPU concurrently by splitting GPU time).
    
    MIG — use NVIDIA Multi-Instance GPU (MIG) to split each GPU into multiple instances (if supported by hardware).
    Allowed values: TimeSlicing, MIG, Exclusive
  - spec.gpu.timeSlicing
    object
    TimeSlicing sharing strategy parameters.
    - spec.gpu.timeSlicing.partitionCount
      number
      Count of partition per GPU.
      
      Default: 4
      Allowed values: 1 <= X <= 100
- spec.kubelet
  object
  Kubelet settings for nodes.
  - spec.kubelet.containerLogMaxFiles
    integer
    How many rotated log files to store before deleting them.
    
    Default: 4
    Allowed values: 1 <= X <= 20
  - spec.kubelet.containerLogMaxSize
    string
    Maximum log file size before it is rotated.
    
    Default: 50Mi
    Pattern: \d+[Ei|Pi|Ti|Gi|Mi|Ki|E|P|T|G|M|k|m]
  - spec.kubelet.maxPods
    integer
    Set the max count of pods per node for given NodeGroup. When left unspecified, the system automatically determines this limit according to the value of the podSubnetNodeCIDRPrefix ClusterConfiguration parameter:
    
    120 pods for podSubnetNodeCIDRPrefix ≥ 24;
    
    250 pods for podSubnetNodeCIDRPrefix = 23;
    
    500 pods for podSubnetNodeCIDRPrefix = 22;
    
    1000 pods for podSubnetNodeCIDRPrefix ≤ 21.
  - spec.kubelet.memorySwap
    object
    Configuration of swap memory usage for kubelet.
    - spec.kubelet.memorySwap.limitedSwap
      object
      Configuration for the limited swap mode. Required when swapBehavior is set to LimitedSwap.
      - spec.kubelet.memorySwap.limitedSwap.size
        string
        Required value
        Size of the swap file to create, specified in GB (for example, “2G”, “4G”).
        
        Pattern: ^\d+G$
        Example:
        size: 1G
    - spec.kubelet.memorySwap.swapBehavior
      string
      Defines how swap memory is handled on the node:
      
      NoSwap: Swap is disabled. This is the traditional Kubernetes behavior.
      
      LimitedSwap: Kubelet can use swap memory up to the limit specified in limitedSwap.size.
      
      For details on swap memory usage on nodes, refer to Kubernetes documentation.
      
      Allowed values: NoSwap, LimitedSwap
    - spec.kubelet.memorySwap.swappiness
      integer
      Defines the kernel’s tendency to use the swap.
      
      0: Minimal swap usage (only to avoid OOM).
      
      60: Default balanced behavior.
      
      100: Aggressive swap usage.
      
      This value is set via vm.swappiness sysctl parameter.
      
      Default: 60
      Allowed values: 0 <= X <= 100
  - spec.kubelet.resourceReservation
    object
    Management of resource reservation for system daemons on a node.
    
    More info in the Kubernetes documentation.
    - spec.kubelet.resourceReservation.mode
      string
      Defines the system resource reservation mode:
      
      Off — disables resource reservation.
      
      Auto — reserves resources based on the Node capacity.
      
      Static — reserves resources based on the values provided by the user via the static parameter.
      
      Note that currently we do not use a dedicated group cgroup for resource reservation (-system-reserved-cgroup is not used).
      
      Default: Auto
    - spec.kubelet.resourceReservation.static
      object
      Resource reservation parameters for the ‘Static’ mode.
      - spec.kubelet.resourceReservation.static.cpu
        integer or string
        Pattern: \d+[m]
      - spec.kubelet.resourceReservation.static.ephemeralStorage
        integer or string
        Pattern: \d+[Ei|Pi|Ti|Gi|Mi|Ki|E|P|T|G|M|k|m]
      - spec.kubelet.resourceReservation.static.memory
        integer or string
        Pattern: \d+[Ei|Pi|Ti|Gi|Mi|Ki|E|P|T|G|M|k|m]
  - spec.kubelet.rootDir
    string
    Directory path for managing kubelet files (volume mounts,etc).
    
    Default: /var/lib/kubelet
  - spec.kubelet.seccompDefault
    boolean
    Use RuntimeDefault seccomp profile for workloads that don’t specify seccomp profile explicitly.
  - spec.kubelet.topologyManager
    object
    Controls a topology manager.
    
    The topology manager allows the Kubernetes scheduler to take resource topology data into account when scheduling pods.
    
    In a cluster with NUMA nodes, the topology manager can improve application performance by aligning workloads with NUMA nodes that are more resource-efficient.
    
    For more information, see the Kubernetes documentation.
    - spec.kubelet.topologyManager.enabled
      boolean
      Enables Topology Management on a node.
      
      If the topology manager is enabled, strict resource allocation modes are activated for containers in Guaranteed pods. The following parameter values are set in the kubelet configuration:
      
      cpuManagerPolicy: static: The kubelet exclusively assigns whole physical cores to a container with an integer CPU request.
      
      memoryManagerPolicy: Static: The kubelet assigns the container’s memory to a minimum number of NUMA nodes (preferably one).
      
      Default: false
    - spec.kubelet.topologyManager.policy
      string
      Resource/topology alignment policy to use when scheduling a pod.
      
      There are four supported policies:
      
      None — no resource alignment (default).
      
      BestEffort — a preferred NUMA node is defined for each container. If there are no preferred nodes for the pod available, it will be scheduled to a node without taking topology manager data into account, while the already running pod will keep running.
      
      Restricted — a preferred NUMA node is defined for each pod container. If there are no preferred nodes available, a new pod will not be scheduled to a node while an already running pod will be stopped.
      
      SingleNumaNode — a preferred NUMA node is defined for each pod container. If there is no NUMA node available that suits all pod containers, a new pod will not be scheduled while an already running pod will be stopped.
      
      More information can be found in the Kubernetes documentation.
      
      Default: None
      Allowed values: None, BestEffort, Restricted, SingleNumaNode
    - spec.kubelet.topologyManager.scope
      string
      Defines granularity with which resources are aligned:
      
      Container. The preferred resources are computed for a container. The computation does not take into account that multiple containers may belong to the same pod.
      
      Pod. The preferred resources are computed for the pod. All containers in the pod are treated as a whole in the computation.
      
      Default: Container
      Allowed values: Container, Pod
- spec.nodeDrainTimeoutSecond
  integer
  Maximum duration (in seconds) for which the controller attempts to reschedule pods to a new machine during node draining.
  
  The range is the one the module’s own settings have always enforced. A value outside it used to be accepted here and then rejected when the module read it, which stopped node-manager reconciling anything at all.
  
  Allowed values: 30 <= X <= 7200
- spec.nodeTemplate
  object
  Specification of some of the fields that will be maintained in all nodes of the group.
  
  Example:
  nodeTemplate: labels: environment: production app: warp-drive-ai annotations: ai.fleet.com/discombobulate: 'true' taints: - effect: NoExecute key: ship-class value: frigate
  - spec.nodeTemplate.annotations
    object
    Similar to the standard metadata.annotations field.
    
    Example:
    annotations: ai.fleet.com/discombobulate: 'true'
  - spec.nodeTemplate.labels
    object
    Similar to the standard metadata.labels field.
    
    Example:
    labels: environment: production app: warp-drive-ai
  - spec.nodeTemplate.taints
    array of objects
    Similar to the .spec.taints field of the Node object.
    
    Available fields: effect, key, and values.
    
    Example:
    taints: - effect: NoExecute key: ship-class value: frigate
    - spec.nodeTemplate.taints.effect
      string
      Allowed values: NoSchedule, PreferNoSchedule, NoExecute
    - spec.nodeTemplate.taints.key
      string
    - spec.nodeTemplate.taints.value
      string
- spec.nodeType
  string
  Required value
  The type of nodes this group provides:
  - CloudEphemeral — nodes for this group will be automatically created (and deleted) in the cloud of the specified cloud provider;
  - CloudPermanent — nodes from ProviderClusterConfiguration will be created via dhctl;
  - CloudStatic — a static node (created manually or using any external tools) hosted in the cloud integrated with one of the cloud providers. This node has the CSI running, and it is managed by the cloud-controller-manager: the Node object automatically gets the information about the zone and region based on the cloud data; if a node gets deleted from the cloud, its corresponding Node object will be deleted in Kubernetes;
  - Static — a static node hosted on a bare metal or virtual machine. The cloud-controller-manager does not manage the node even if one of the cloud providers is enabled.
  Allowed values: CloudEphemeral, CloudPermanent, CloudStatic, Static
- spec.operatingSystem
  object
  Operating System settings for nodes.
  - spec.operatingSystem.manageKernel
    Deprecated
    boolean
    This parameter has no effect. Earlier, it enabled kernel maintenance on behalf of bashible.
    
    Default: true
- spec.staticInstances
  object
  Parameter for provisioning static machines to the cluster.
  - spec.staticInstances.count
    integer
    Target number of StaticInstance resources (matching the labelSelector) that DKP bootstraps and adds into the cluster.
    
    In a NodeGroup with Static or CloudStatic nodes, this parameter sets the expected number of nodes. DKP uses this value for state control and automation purposes.
    
    Warning. Set this parameter explicitly. The default value is 0, which means DKP won’t bootstrap any StaticInstance resource or add any node to the group unless this value is modified. To add static nodes, specify the required number here (greater than 0).
    
    Default: 0
    Allowed values: 0 <= X
  - spec.staticInstances.labelSelector
    object
    A label selector is a label query over a set of staticInstances resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
    - spec.staticInstances.labelSelector.matchExpressions
      array of objects
      A list of label selector requirements. The requirements are ANDed.
      
      A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
      - spec.staticInstances.labelSelector.matchExpressions.key
        string
        key is the label key that the selector applies to.
      - spec.staticInstances.labelSelector.matchExpressions.operator
        string
        operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
      - spec.staticInstances.labelSelector.matchExpressions.values
        array of strings
        values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
        
        Element of the array
        string
        Pattern: [a-z0-9]([-a-z0-9]*[a-z0-9])?
        Length: 1..63
    - spec.staticInstances.labelSelector.matchLabels
      object
      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
- spec.systemType
  string
  How the node is managed.
  
  Possible values:
  - Mutable — the classic node configured on the fly by bashible. This is what an unset field means.
  - Immutable — an agent on the node brings it to the state described in a NodeConfig object. bashible is not used.
  Once the field names a value, that value can no longer be changed or removed. A NodeGroup that names none can still record one — but not Immutable while it holds nodes bashible has already configured, since those nodes cannot be handed over to the on-node agent.
  Allowed values: Mutable, Immutable
- spec.update
  object
  - spec.update.maxConcurrent
    integer or string
    Maximum number of concurrently updating nodes.
    
    Can be set as absolute count or as a percent of total nodes.
    
    Default: 1
    Pattern: ^[1-9][0-9]*%?$
status
object
- status.conditionSummary
  object
  - status.conditionSummary.ready
    string
    Status of the condition summary.
    
    Allowed values: True, False
  - status.conditionSummary.statusMessage
    string
    Status message about group handling.
- status.conditions
  array of objects
  - status.conditions.lastTransitionTime
    string
    Last time the condition transit from one status to another.
  - status.conditions.message
    string
    Human readable message indicating details about last transition.
  - status.conditions.status
    string
    Required value
    Status of the condition, one of True, False.
  - status.conditions.type
    string
    Required value
    Type of node group condition.
- status.deckhouse
  object
  - status.deckhouse.observed
    object
    Contains last timestamp when the resource change was noted by the operator and its checksum.
    - status.deckhouse.observed.checkSum
      string
      The checksum of the last observed resource.
    - status.deckhouse.observed.lastTimestamp
      string
      Last timestamp when a change of the resource was noted by the operator.
  - status.deckhouse.processed
    object
    Contains last timestamp when the resource was applied in the cluster by the operator and its checksum.
    - status.deckhouse.processed.checkSum
      string
      The checksum of the last applied resource.
    - status.deckhouse.processed.lastTimestamp
      string
      Last timestamp when the resource was applied in the cluster.
  - status.deckhouse.synced
    string
    True if last observed version of the resource was successfully applied in the cluster.
- status.desired
  integer
  Number of desired machines in the group.
- status.engine
  string
  Machinery used to manage nodes in this group.
  
  The field value indicates which component manages the nodes:
  - None — nodes in the group are not managed by Machine Controller Manager or CAPI.
  - MCM — nodes in the group are managed by Machine Controller Manager.
  - CAPI — nodes in the group are managed by Cluster API.
  Allowed values: None, MCM, CAPI
- status.error
  string
  Error message about possible problems with the group handling.
- status.instances
  integer
  Number of instances (in any state) in the group.
- status.kubernetesVersion
  string
  The current version of kubernetes on the nodes, or the version to which the nodes will be upgraded.
- status.lastMachineFailures
  array of objects
  - status.lastMachineFailures.lastOperation
    object
    - status.lastMachineFailures.lastOperation.description
      string
      Last operation’s description.
    - status.lastMachineFailures.lastOperation.lastUpdateTime
      string
      Timestamp of last status update for operation.
    - status.lastMachineFailures.lastOperation.state
      string
      Machine’s operation state.
    - status.lastMachineFailures.lastOperation.type
      string
      Type of operation.
  - status.lastMachineFailures.name
    string
    Machine’s name.
  - status.lastMachineFailures.ownerRef
    string
    Machine owner’s name.
  - status.lastMachineFailures.providerID
    string
    Machine’s ProviderID.
- status.max
  integer
  Maximum amount of instances in the group.
- status.min
  integer
  Minimal amount of instances in the group.
- status.nodes
  integer
  Number of Kubernetes nodes (in any state) in the group.
- status.ready
  integer
  Number of ready Kubernetes nodes in the group.
- status.standby
  integer
  Number of overprovisioned instances in the group.
- status.upToDate
  integer
  Number of up-to-date nodes in the group.

Describes the runtime parameters of the node group.

metadata
object
- metadata.name
  string
  Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
  Maximum length: 42
spec
object
Required value
- spec.chaos
  object
  Chaos monkey settings.
  
  Example:
  chaos: mode: DrainAndDelete period: 24h
  - spec.chaos.mode
    string
    The chaos monkey mode:
    
    DrainAndDelete — drains and deletes a node when triggered;
    
    Disabled — leaves this NodeGroup intact.
    Default: Disabled
    Allowed values: Disabled, DrainAndDelete
  - spec.chaos.period
    string
    The time interval to use for the chaos monkey (can be specified in the Go format).
    
    Default: 6h
    Pattern: ^[0-9]+[mh]{1}$
- spec.cloudInstances
  object
  Parameter for provisioning the cloud-based VMs.
  
  Caution. Can only be used together with nodeType: CloudEphemeral.
  - spec.cloudInstances.classReference
    object
    Required value
    The reference to the InstanceClass object. It is unique for each cloud-provider-* module.
    - spec.cloudInstances.classReference.kind
      string
      The kind of the InstanceClass object (e.g., OpenStackInstanceClass). Supported kinds are defined by the installed cloud provider modules and specified in their documentation.
    - spec.cloudInstances.classReference.name
      string
      The name of the required InstanceClass object (e.g., finland-medium).
  - spec.cloudInstances.maxPerZone
    integer
    Required value
    The maximum number of instances for the group in each zone.
    
    This value is used as the upper bound in cluster-autoscaler.
    
    Allowed values: 0 <= X
  - spec.cloudInstances.maxSurgePerZone
    integer
    The maximum number of instances to rollout simultaneously in the group in each zone.
    
    Default: 1
    Allowed values: 0 <= X
  - spec.cloudInstances.maxUnavailablePerZone
    integer
    The maximum number of unavailable instances (during rollout) in the group in each zone.
    
    Default: 0
    Allowed values: 0 <= X
  - spec.cloudInstances.minPerZone
    integer
    Required value
    The minimum number of instances for the group in each zone.
    
    This value is used in the MachineDeployment object and as a lower bound in cluster-autoscaler.
    
    Allowed values: 0 <= X
  - spec.cloudInstances.standby
    integer or string
    The summary number of overprovisioned nodes for this NodeGroup in all zones.
    
    An overprovisioned node is a cluster node on which resources are reserved that are available at any time for scaling. The presence of such a node allows the cluster autoscaler not to wait for node initialization (which may take several minutes), but to immediately place a load on it.
    
    The value can be an absolute number (for example, 2) or a percentage of desired nodes (for example, 10%). If a percentage is specified, the absolute number is calculated based on the percentage of the maximum number of nodes (the maxPerZone parameter) rounded down, but not less than one.
    
    Pattern: ^[0-9]+%?$
  - spec.cloudInstances.standbyHolder
    object
    Amount of reserved resources.
    
    Used to determine whether to order overprovisioned nodes.
    - spec.cloudInstances.standbyHolder.notHeldResources
      object
      Describes the resources that will not be held (consumed) by the standby holder.
      - spec.cloudInstances.standbyHolder.notHeldResources.cpu
        integer or string
        Describes the amount of CPU that will not be held by standby holder on Nodes from this NodeGroup.
        
        The value can be an absolute number of cpus (for example, 2) as well as a milli representation (for example, 1500m).
        
        Pattern: ^[0-9]+m?$
      - spec.cloudInstances.standbyHolder.notHeldResources.memory
        integer or string
        Describes the amount of memory that will not be held by standby holder on Nodes from this NodeGroup.
        
        The value can be an absolute number of bytes (for example, 128974848) as well as a fixed-point number using one of memory suffixes: G, Gi, M, Mi.
        
        Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$
  - spec.cloudInstances.zones
    array of strings
    List of availability zones to create instances in.
    
    The default value depends on the cloud provider selected and usually corresponds to all zones of the region being used.
    
    Example:
    zones: - Helsinki - Espoo - Tampere
- spec.cri
  object
  Container runtime parameters.
  - spec.cri.containerd
    object
    Containerd runtime parameters.
    
    If used, cri.type must be set to Containerd.
    - spec.cri.containerd.maxConcurrentDownloads
      integer
      Set the max concurrent downloads for each pull.
      
      Default: 3
  - spec.cri.docker
    object
    Docker settings for nodes.
    
    Note. the Docker is deprecated.
    - spec.cri.docker.manage
      boolean
      Enable Docker maintenance from bashible.
      
      Default: true
    - spec.cri.docker.maxConcurrentDownloads
      integer
      Set the max concurrent downloads for each pull.
      
      Default: 3
  - spec.cri.notManaged
    object
    Settings for not managed CRI for nodes.
    - spec.cri.notManaged.criSocketPath
      string
      Path to CRI socket.
  - spec.cri.type
    string
    Container runtime type.
    
    Value defaultCRI from the initial cluster configration (cluster-configuration.yaml parameter from the d8-cluster-configuration secret in the kube-system namespace) is used if not specified.
    
    Note. Docker support is deprecated.
    
    Allowed values: Docker, Containerd, NotManaged
- spec.disruptions
  object
  Disruptions settings for nodes.
  
  Example:
  disruptions: approvalMode: Automatic automatic: drainBeforeApproval: false windows: - from: '06:00' to: '08:00' days: - Tue - Sun
  - spec.disruptions.approvalMode
    string
    The approval mode for disruptive updates:
    
    Manual — disable automatic disruption approval; the alert will be displayed if disruption is needed. Caution. The master node group update mode must be Manual to avoid issues with draining.
    
    Automatic — automatically approve disruption-involving updates.
    
    RollingUpdate — in this mode, a new node with new settings will be created; then, the old node will be deleted. Available only for cloud nodes.
    
    If the RollingUpdate mode is not used, when updating, the node is first drained and then updated (rebooted) and put back into operation (uncordoned). Note that in this case, the cluster must have sufficient resources to accommodate the load while the node being updated is unavailable. In the RollingUpdate mode, the node is replaced by the updated node, i.e., an extra node appears in the cluster for the duration of the update. In cloud infrastructures, the RollingUpdate mode is convenient, for example, if there are no resources in the cluster to temporarily host the load from the node being updated.
    Default: Automatic
    Allowed values: Manual, Automatic, RollingUpdate
  - spec.disruptions.automatic
    object
    Additional parameters for the Automatic mode.
    - spec.disruptions.automatic.drainBeforeApproval
      boolean
      Drain Pods from the nodes before approving disruption.
      
      Caution. This setting ignores (nodes will be approved without draining Pods):
      
      for the nodeGroup master with a single node;
      
      for a single ready node in a nodeGroup picked out for Deckhouse placement.
      
      Default: true
    - spec.disruptions.automatic.windows
      array of objects
      Time windows for node disruptive updates.
      - spec.disruptions.automatic.windows.days
        array of strings
        Days of the week when node could be updated.
        
        Examples:
        days: Mon
        
        days: Wed
        
        Element of the array
        string
        Day of the week.
        
        Allowed values: Mon, Tue, Wed, Thu, Fri, Sat, Sun
      - spec.disruptions.automatic.windows.from
        string
        Required value
        Start time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        from: '13:00'
      - spec.disruptions.automatic.windows.to
        string
        Required value
        End time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        to: '18:30'
  - spec.disruptions.rollingUpdate
    object
    Additional parameters for the RollingUpdate mode.
    - spec.disruptions.rollingUpdate.windows
      array of objects
      Time windows for node disruptive updates.
      - spec.disruptions.rollingUpdate.windows.days
        array of strings
        Days of the week when node could be updated.
        
        Examples:
        days: Mon
        
        days: Wed
        
        Element of the array
        string
        Day of the week.
        
        Allowed values: Mon, Tue, Wed, Thu, Fri, Sat, Sun
      - spec.disruptions.rollingUpdate.windows.from
        string
        Required value
        Start time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        from: '13:00'
      - spec.disruptions.rollingUpdate.windows.to
        string
        Required value
        End time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        to: '18:30'
- spec.kubelet
  object
  Kubelet settings for nodes.
  - spec.kubelet.containerLogMaxFiles
    integer
    How many rotated log files to store before deleting them.
    
    Warning. This parameter does nothing if CRI type is Docker.
    
    Default: 4
    Allowed values: 1 <= X <= 20
  - spec.kubelet.containerLogMaxSize
    string
    Maximum log file size before it is rotated.
    
    Warning. This parameter does nothing if CRI type is Docker.
    
    Default: 50Mi
    Pattern: \d+[Ei|Pi|Ti|Gi|Mi|Ki|E|P|T|G|M|k|m]
  - spec.kubelet.maxPods
    integer
    Set the max count of pods per node for given NodeGroup. When left unspecified, the system automatically determines this limit according to the value of the podSubnetNodeCIDRPrefix ClusterConfiguration parameter:
    
    120 pods for podSubnetNodeCIDRPrefix ≥ 24;
    
    250 pods for podSubnetNodeCIDRPrefix = 23;
    
    500 pods for podSubnetNodeCIDRPrefix = 22;
    
    1000 pods for podSubnetNodeCIDRPrefix ≤ 21.
  - spec.kubelet.rootDir
    string
    Directory path for managing kubelet files (volume mounts,etc).
    
    Default: /var/lib/kubelet
  - spec.kubelet.seccompDefault
    boolean
    Use RuntimeDefault seccomp profile for workloads that don’t specify seccomp profile explicitly.
- spec.nodeTemplate
  object
  Specification of some of the fields that will be maintained in all nodes of the group.
  
  Example:
  nodeTemplate: labels: environment: production app: warp-drive-ai annotations: ai.fleet.com/discombobulate: 'true' taints: - effect: NoExecute key: ship-class value: frigate
  - spec.nodeTemplate.annotations
    object
    Similar to the standard metadata.annotations field.
    
    Example:
    annotations: ai.fleet.com/discombobulate: 'true'
  - spec.nodeTemplate.labels
    object
    Similar to the standard metadata.labels field.
    
    Example:
    labels: environment: production app: warp-drive-ai
  - spec.nodeTemplate.taints
    array of objects
    Similar to the .spec.taints field of the Node object.
    
    Available fields: effect, key, and values.
    
    Example:
    taints: - effect: NoExecute key: ship-class value: frigate
    - spec.nodeTemplate.taints.effect
      string
      Allowed values: NoSchedule, PreferNoSchedule, NoExecute
    - spec.nodeTemplate.taints.key
      string
    - spec.nodeTemplate.taints.value
      string
- spec.nodeType
  string
  Required value
  The type of nodes this group provides.
  - Cloud — nodes for this group will be automatically created (and deleted) in the cloud of the specified cloud provider;
  - Static — a static node hosted on a bare metal or virtual machine. The cloud-controller-manager does not manage the node even of one of the cloud providers is enabled;
  - Hybrid — a static node (created manually or using any external tools) hosted in the cloud integrated with one of the cloud provider. This node has the CSI running, and it is managed by the cloud-controller-manager: the Node object automatically gets the information about the zone and region based on the cloud data; if a node gets deleted from the cloud, its corresponding Node object will be deleted in Kubernetes.
  Allowed values: Cloud, Static, Hybrid
- spec.operatingSystem
  object
  Operating System settings for nodes.
  - spec.operatingSystem.manageKernel
    boolean
    Enable kernel maintenance from bashible.
    
    Default: true
- spec.systemType
  string
  How the node is managed.
  
  Possible values:
  - Mutable — the classic node configured on the fly by bashible. This is what an unset field means.
  - Immutable — an agent on the node brings it to the state described in a NodeConfig object. bashible is not used.
  Once the field names a value, that value can no longer be changed or removed. A NodeGroup that names none can still record one — but not Immutable while it holds nodes bashible has already configured, since those nodes cannot be handed over to the on-node agent.
  Allowed values: Mutable, Immutable
status
object
- status.conditionSummary
  object
  - status.conditionSummary.ready
    string
    Status of the condition summary.
    
    Allowed values: True, False
  - status.conditionSummary.statusMessage
    string
    Status message about group handling.
- status.desired
  integer
  Number of desired machines in the group.
- status.engine
  string
  Machinery used to manage nodes in this group.
  
  The field value indicates which component manages the nodes:
  - None — nodes in the group are not managed by MCM or CAPI.
  - MCM — nodes in the group are managed by machine-controller-manager.
  - CAPI — nodes in the group are managed by Cluster API.
  Allowed values: None, MCM, CAPI
- status.error
  string
  Error message about possible problems with the group handling.
- status.instances
  integer
  Number of instances (in any state) in the group.
- status.kubernetesVersion
  string
  The current version of kubernetes on the nodes, or the version to which the nodes will be upgraded.
- status.lastMachineFailures
  array of objects
  - status.lastMachineFailures.lastOperation
    object
    - status.lastMachineFailures.lastOperation.description
      string
      Last operation’s description.
    - status.lastMachineFailures.lastOperation.lastUpdateTime
      string
      Timestamp of last status update for operation.
    - status.lastMachineFailures.lastOperation.state
      string
      Machine’s operation state.
    - status.lastMachineFailures.lastOperation.type
      string
      Type of operation.
  - status.lastMachineFailures.name
    string
    Machine’s name.
  - status.lastMachineFailures.ownerRef
    string
    Machine owner’s name.
  - status.lastMachineFailures.providerID
    string
    Machine’s ProviderID.
- status.max
  integer
  Maximum amount of instances in the group.
- status.min
  integer
  Minimal amount of instances in the group.
- status.nodes
  integer
  Number of Kubernetes nodes (in any state) in the group.
- status.ready
  integer
  Number of ready Kubernetes nodes in the group.
- status.standby
  integer
  Number of overprovisioned instances in the group.
- status.upToDate
  integer
  Number of up-to-date nodes in the group.

Defines the runtime parameters of a node group.

metadata
object
- metadata.name
  string
  Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
  Maximum length: 42
spec
object
Required value
- spec.chaos
  object
  Chaos monkey settings.
  
  Example:
  chaos: mode: DrainAndDelete period: 24h
  - spec.chaos.mode
    string
    The chaos monkey mode:
    
    DrainAndDelete — drains and deletes a node when triggered;
    
    Disabled — leaves this NodeGroup intact.
    Default: Disabled
    Allowed values: Disabled, DrainAndDelete
  - spec.chaos.period
    string
    The time interval to use for the chaos monkey (can be specified in the Go format).
    
    Default: 6h
    Pattern: ^[0-9]+[mh]{1}$
- spec.cloudInstances
  object
  Parameter for provisioning the cloud-based VMs.
  
  Caution. Can only be used together with nodeType: CloudEphemeral.
  - spec.cloudInstances.classReference
    object
    Required value
    The reference to the InstanceClass object. It is unique for each cloud-provider-* module.
    - spec.cloudInstances.classReference.kind
      string
      The kind of the InstanceClass object (e.g., OpenStackInstanceClass). Supported kinds are defined by the installed cloud provider modules and specified in their documentation.
    - spec.cloudInstances.classReference.name
      string
      The name of the required InstanceClass object (e.g., finland-medium).
  - spec.cloudInstances.maxPerZone
    integer
    Required value
    The maximum number of instances for the group in each zone.
    
    This value is used as the upper bound in cluster-autoscaler.
    
    With a value of 0, you need to set capacity for some InstanceClass. Get more details in the description of the necessary InstanceClass.
    
    Allowed values: 0 <= X
  - spec.cloudInstances.maxSurgePerZone
    integer
    The maximum number of instances to rollout simultaneously in the group in each zone.
    
    Default: 1
    Allowed values: 0 <= X
  - spec.cloudInstances.maxUnavailablePerZone
    integer
    The maximum number of unavailable instances (during rollout) in the group in each zone.
    
    Default: 0
    Allowed values: 0 <= X
  - spec.cloudInstances.minPerZone
    integer
    Required value
    The minimum number of instances for the group in each zone.
    
    This value is used in the MachineDeployment object and as a lower bound in cluster-autoscaler.
    
    Allowed values: 0 <= X
  - spec.cloudInstances.standby
    integer or string
    The summary number of overprovisioned nodes for this NodeGroup all zones.
    
    An overprovisioned node is a cluster node on which resources are reserved that are available at any time for scaling. The presence of such a node allows the cluster autoscaler not to wait for node initialization (which may take several minutes), but to immediately place a load on it.
    
    The value can be an absolute number (for example, 2) or a percentage of desired nodes (for example, 10%). If a percentage is specified, the absolute number is calculated based on the percentage of the maximum number of nodes (the maxPerZone parameter) rounded down, but not less than one.
    
    Pattern: ^[0-9]+%?$
  - spec.cloudInstances.standbyHolder
    object
    Amount of reserved resources.
    
    Used to determine whether to order overprovisioned nodes.
    - spec.cloudInstances.standbyHolder.notHeldResources
      object
      Describes the resources that will not be held (consumed) by the standby holder.
      - spec.cloudInstances.standbyHolder.notHeldResources.cpu
        integer or string
        Describes the amount of CPU that will not be held by standby holder on Nodes from this NodeGroup.
        
        The value can be an absolute number of cpus (for example, 2) as well as a milli representation (for example, 1500m).
        
        Pattern: ^[0-9]+m?$
      - spec.cloudInstances.standbyHolder.notHeldResources.memory
        integer or string
        Describes the amount of memory that will not be held by standby holder on Nodes from this NodeGroup.
        
        The value can be an absolute number of bytes (for example, 128974848) as well as a fixed-point number using one of memory suffixes: G, Gi, M, Mi.
        
        Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$
  - spec.cloudInstances.zones
    array of strings
    List of availability zones to create instances in.
    
    The default value depends on the cloud provider selected and usually corresponds to all zones of the region being used.
    
    Example:
    zones: - Helsinki - Espoo - Tampere
- spec.cri
  object
  Container runtime parameters.
  - spec.cri.containerd
    object
    Containerd runtime parameters.
    
    If used, cri.type must be set to Containerd.
    - spec.cri.containerd.maxConcurrentDownloads
      integer
      Set the max concurrent downloads for each pull.
      
      Default: 3
  - spec.cri.type
    string
    Container runtime type.
    
    If not specified, the defaultCRI parameter value of ClusterConfiguration is used.
    
    Note. Docker support is deprecated.
    
    Allowed values: Docker, Containerd, NotManaged
- spec.disruptions
  object
  Disruptions settings for nodes.
  
  Example:
  disruptions: approvalMode: Automatic automatic: drainBeforeApproval: false windows: - from: '06:00' to: '08:00' days: - Tue - Sun
  - spec.disruptions.approvalMode
    string
    The approval mode for disruptive updates:
    
    Manual — disable automatic disruption approval; the alert will be displayed if disruption is needed. Caution. The master node group update mode must be Manual to avoid issues with draining.
    
    Automatic — automatically approve disruption-involving updates.
    
    RollingUpdate — in this mode, a new node with new settings will be created; then, the old node will be deleted. Available only for cloud nodes.
    
    If the RollingUpdate mode is not used, when updating, the node is first drained and then updated (rebooted) and put back into operation (uncordoned). Note that in this case, the cluster must have sufficient resources to accommodate the load while the node being updated is unavailable. In the RollingUpdate mode, the node is replaced by the updated node, i.e., an extra node appears in the cluster for the duration of the update. In cloud infrastructures, the RollingUpdate mode is convenient, for example, if there are no resources in the cluster to temporarily host the load from the node being updated.
    Default: Automatic
    Allowed values: Manual, Automatic, RollingUpdate
  - spec.disruptions.automatic
    object
    Additional parameters for the Automatic mode.
    - spec.disruptions.automatic.drainBeforeApproval
      boolean
      Drain Pods from the nodes before approving disruption.
      
      Caution. This setting ignores (nodes will be approved without draining Pods):
      
      for the nodeGroup master with a single node;
      
      for a single ready node in a nodeGroup picked out for Deckhouse placement.
      
      Default: true
    - spec.disruptions.automatic.windows
      array of objects
      Time windows for node disruptive updates.
      - spec.disruptions.automatic.windows.days
        array of strings
        Days of the week when node could be updated.
        
        Examples:
        days: Mon
        
        days: Wed
        
        Element of the array
        string
        Day of the week.
        
        Allowed values: Mon, Tue, Wed, Thu, Fri, Sat, Sun
      - spec.disruptions.automatic.windows.from
        string
        Required value
        Start time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        from: '13:00'
      - spec.disruptions.automatic.windows.to
        string
        Required value
        End time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        to: '18:30'
  - spec.disruptions.rollingUpdate
    object
    Additional parameters for the RollingUpdate mode.
    - spec.disruptions.rollingUpdate.windows
      array of objects
      Time windows for node disruptive updates.
      - spec.disruptions.rollingUpdate.windows.days
        array of strings
        Days of the week when node could be updated.
        
        Examples:
        days: Mon
        
        days: Wed
        
        Element of the array
        string
        Day of the week.
        
        Allowed values: Mon, Tue, Wed, Thu, Fri, Sat, Sun
      - spec.disruptions.rollingUpdate.windows.from
        string
        Required value
        Start time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        from: '13:00'
      - spec.disruptions.rollingUpdate.windows.to
        string
        Required value
        End time of disruptive update window (UTC timezone).
        
        Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
        Example:
        to: '18:30'
- spec.docker
  object
  Docker settings for nodes.
  
  If used, cri.type must be set to Docker.
  
  Note. the Docker is deprecated.
  - spec.docker.manage
    boolean
    Enable Docker maintenance from bashible.
    
    Default: true
  - spec.docker.maxConcurrentDownloads
    integer
    Set the max concurrent downloads for each pull.
    
    Default: 3
- spec.kubelet
  object
  Kubelet settings for nodes.
  - spec.kubelet.containerLogMaxFiles
    integer
    How many rotated log files to store before deleting them.
    
    Warning. This parameter does nothing if CRI type is Docker.
    
    Default: 4
    Allowed values: 1 <= X <= 20
  - spec.kubelet.containerLogMaxSize
    string
    Maximum log file size before it is rotated.
    
    Warning. This parameter does nothing if CRI type is Docker.
    
    Default: 50Mi
    Pattern: \d+[Ei|Pi|Ti|Gi|Mi|Ki|E|P|T|G|M|k|m]
  - spec.kubelet.maxPods
    integer
    Set the max count of pods per node for given NodeGroup. When left unspecified, the system automatically determines this limit according to the value of the podSubnetNodeCIDRPrefix ClusterConfiguration parameter:
    
    120 pods for podSubnetNodeCIDRPrefix ≥ 24;
    
    250 pods for podSubnetNodeCIDRPrefix = 23;
    
    500 pods for podSubnetNodeCIDRPrefix = 22;
    
    1000 pods for podSubnetNodeCIDRPrefix ≤ 21.
  - spec.kubelet.rootDir
    string
    Directory path for managing kubelet files (volume mounts,etc).
    
    Default: /var/lib/kubelet
  - spec.kubelet.seccompDefault
    boolean
    Use RuntimeDefault seccomp profile for workloads that don’t specify seccomp profile explicitly.
- spec.kubernetesVersion
  string
  The desired minor version of Kubernetes.
  
  By default, it corresponds to the version selected for the cluster globally (see installation documentation) or to the current version of the control plane (if the global version is not defined).
  
  Allowed values: 1.32, 1.33, 1.34, 1.35, 1.36
  Example:
  kubernetesVersion: '1.33'
- spec.nodeTemplate
  object
  Specification of some of the fields that will be maintained in all nodes of the group.
  
  Example:
  nodeTemplate: labels: environment: production app: warp-drive-ai annotations: ai.fleet.com/discombobulate: 'true' taints: - effect: NoExecute key: ship-class value: frigate
  - spec.nodeTemplate.annotations
    object
    Similar to the standard metadata.annotations field.
    
    Example:
    annotations: ai.fleet.com/discombobulate: 'true'
  - spec.nodeTemplate.labels
    object
    Similar to the standard metadata.labels field.
    
    Example:
    labels: environment: production app: warp-drive-ai
  - spec.nodeTemplate.taints
    array of objects
    Similar to the .spec.taints field of the Node object.
    
    Available fields: effect, key, and values.
    
    Example:
    taints: - effect: NoExecute key: ship-class value: frigate
    - spec.nodeTemplate.taints.effect
      string
      Allowed values: NoSchedule, PreferNoSchedule, NoExecute
    - spec.nodeTemplate.taints.key
      string
    - spec.nodeTemplate.taints.value
      string
- spec.nodeType
  string
  Required value
  The type of nodes this group provides.
  - Cloud — nodes for this group will be automatically created (and deleted) in the cloud of the specified cloud provider;
  - Static — a static node hosted on a bare metal or virtual machine. The cloud-controller-manager does not manage the node even of one of the cloud providers is enabled;
  - Hybrid — a static node (created manually or using any external tools) hosted in the cloud integrated with one of the cloud provider. This node has the CSI running, and it is managed by the cloud-controller-manager: the Node object automatically gets the information about the zone and region based on the cloud data; if a node gets deleted from the cloud, its corresponding Node object will be deleted in Kubernetes.
  Allowed values: Cloud, Static, Hybrid
- spec.operatingSystem
  Deprecated
  object
  Operating System settings for nodes.
  - spec.operatingSystem.manageKernel
    Deprecated
    boolean
    Enable kernel maintenance from bashible.
    
    Default: true
- spec.static
  object
  Static node parameters
  - spec.static.internalNetworkCIDRs
    array of strings
    Subnet CIDR
- spec.systemType
  string
  How the node is managed.
  
  Possible values:
  - Mutable — the classic node configured on the fly by bashible. This is what an unset field means.
  - Immutable — an agent on the node brings it to the state described in a NodeConfig object. bashible is not used.
  Once the field names a value, that value can no longer be changed or removed. A NodeGroup that names none can still record one — but not Immutable while it holds nodes bashible has already configured, since those nodes cannot be handed over to the on-node agent.
  Allowed values: Mutable, Immutable
status
object
- status.conditionSummary
  object
  - status.conditionSummary.ready
    string
    Status of the condition summary.
    
    Allowed values: True, False
  - status.conditionSummary.statusMessage
    string
    Status message about group handling.
- status.desired
  integer
  Number of desired machines in the group.
- status.engine
  string
  Machinery used to manage nodes in this group.
  
  The field value indicates which component manages the nodes:
  - None — nodes in the group are not managed by Machine Controller Manager or CAPI.
  - MCM — nodes in the group are managed by Machine Controller Manager.
  - CAPI — nodes in the group are managed by Cluster API.
  Allowed values: None, MCM, CAPI
- status.error
  string
  Error message about possible problems with the group handling.
- status.instances
  integer
  Number of instances (in any state) in the group.
- status.kubernetesVersion
  string
  The current version of kubernetes on the nodes, or the version to which the nodes will be upgraded.
- status.lastMachineFailures
  array of objects
  - status.lastMachineFailures.lastOperation
    object
    - status.lastMachineFailures.lastOperation.description
      string
      Last operation’s description.
    - status.lastMachineFailures.lastOperation.lastUpdateTime
      string
      Timestamp of last status update for operation.
    - status.lastMachineFailures.lastOperation.state
      string
      Machine’s operation state.
    - status.lastMachineFailures.lastOperation.type
      string
      Type of operation.
  - status.lastMachineFailures.name
    string
    Machine’s name.
  - status.lastMachineFailures.ownerRef
    string
    Machine owner’s name.
  - status.lastMachineFailures.providerID
    string
    Machine’s ProviderID.
- status.max
  integer
  Maximum amount of instances in the group.
- status.min
  integer
  Minimal amount of instances in the group.
- status.nodes
  integer
  Number of Kubernetes nodes (in any state) in the group.
- status.ready
  integer
  Number of ready Kubernetes nodes in the group.
- status.standby
  integer
  Number of overprovisioned instances in the group.
- status.upToDate
  integer
  Number of up-to-date nodes in the group.

NodeConfig

Short names: nc

Scope: Cluster
Version: v1alpha1

NodeConfig is the desired state of a Deckhouse Engine node, stored at /config/nodeconfig.yaml and as a cluster CRD (crds/nodeconfig.yaml, generated). Keep identical with nodelet’s internal/config/types.go and dhctl’s spec-only mirrors.

spec
object
Required value
NodeSpec is the desired state of the node.
- spec.apiServerEndpoints
  array of strings
  APIServerEndpoints is the list of API server URLs the node connects to (via the node-local API proxy).
  - Element of the array
    string
    Pattern: ^(https?://)?(\[[0-9A-Fa-f:]+\]|[A-Za-z0-9]([-A-Za-z0-9]*[A-Za-z0-9])?([.][A-Za-z0-9]([-A-Za-z0-9]*[A-Za-z0-9])?)*):(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3})/?$
- spec.containerRuntime
  object
  ContainerRuntime holds containerd configuration.
  - spec.containerRuntime.maxConcurrentDownloads
    integer
    MaxConcurrentDownloads limits parallel image layer downloads. Zero is containerd’s “no limit”, and a NodeGroup takes any integer (crds/node_group.yaml:1638): a value it accepts must be accepted here. The default is bashible’s (candi/bashible/common-steps/all/032_configure_containerd.sh.tpl).
    
    Default: 8
    Allowed values: 0 <= X
  - spec.containerRuntime.sandboxImage
    string
    SandboxImage is the pause image used for pod sandboxes.
    
    Default: registry.k8s.io/pause:3.10
    Pattern: ^[^[:space:]]+$
- spec.extensions
  array of objects
  Extensions are the signed verity sysext images to merge onto the root.
  
  Extension is a signed verity sysext built from a release channel, fetched from the registry-packages-proxy by digest. Optional repository selects the proxy’s per-registry config; optional additionalPath is its “path” parameter.
  - spec.extensions.additionalPath
    string
    AdditionalPath is forwarded to the proxy as the “path” query parameter.
  - spec.extensions.digest
    string
    Required value
    Digest is the sha256 digest of the sysext image.
    
    Pattern: ^sha256:[a-f0-9]{64}$
  - spec.extensions.name
    string
    Required value
    Name is the extension name (also the sysext image basename).
    
    Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
    Length: 1..63
  - spec.extensions.repository
    string
    Repository optionally selects the proxy’s per-registry client config.
  - spec.extensions.requestedBy
    string
    RequestedBy records who requested the extension (e.g. “node-manager”).
- spec.internalNetworkCIDRs
  array of strings
  InternalNetworkCIDRs are the subnets the cluster’s own traffic runs on. The node picks the interface holding an address inside one of them and registers with that address; a node with one NIC needs none of this. The pattern is StaticClusterConfiguration’s own (candi/openapi/static_cluster_configuration.yaml): IPv4 only.
  - Element of the array
    string
    Pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$
- spec.kernel
  object
  Kernel holds sysctl settings and kernel modules to load.
  - spec.kernel.modules
    array of objects
    - spec.kernel.modules.name
      string
      Required value
    - spec.kernel.modules.params
      array of strings
  - spec.kernel.sysctl
    object
- spec.kubelet
  object
  Kubelet holds kubelet configuration parameters.
  - spec.kubelet.bootstrapToken
    string
    BootstrapToken is the bootstrap token used by kubelet to obtain its client certificate on first boot.
  - spec.kubelet.caCert
    string
    CACert is the base64-encoded cluster CA certificate used in the bootstrap-kubelet.conf to verify the API server.
  - spec.kubelet.clusterDNS
    array of strings
    ClusterDNS is the list of DNS server IP addresses for the cluster.
    - Element of the array
      string
      Maximum length: 45
  - spec.kubelet.clusterDomain
    string
    ClusterDomain is the DNS domain for this cluster (e.g. “cluster.local”).
    
    Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
    Maximum length: 253
  - spec.kubelet.containerLogMaxFiles
    integer
    ContainerLogMaxFiles is the number of rotated log files to retain.
    
    Default: 4
    Allowed values: 1 <= X <= 1000
  - spec.kubelet.containerLogMaxSize
    string
    ContainerLogMaxSize is the maximum log file size before rotation (e.g. “50Mi”).
    
    Default: 50Mi
  - spec.kubelet.externalCloudProvider
    boolean
    ExternalCloudProvider enables –cloud-provider=external so the cloud-controller-manager manages the node (zone, region, providerID).
  - spec.kubelet.kubernetesVersion
    string
    KubernetesVersion is the cluster’s minor version, e.g. “1.34”. It decides which feature gates kubelet is started with (bashible turns DRA gates on by version); without it DRA workloads cannot run on immutable nodes.
    
    Pattern: ^[0-9]+\.[0-9]+$
    Maximum length: 16
  - spec.kubelet.maxPods
    integer
    MaxPods is the maximum number of pods per node.
    
    Default: 120
    Allowed values: 1 <= X <= 1000
  - spec.kubelet.nodeLabels
    object
    NodeLabels are labels added to the node object when kubelet registers. A NodeGroup caps neither their number nor their shape (crds/node_group.yaml:1915), so neither does this.
  - spec.kubelet.registerWithTaints
    array of objects
    RegisterWithTaints is a list of taints to add to the node object when kubelet registers itself. Only takes effect on initial registration.
    
    Taint represents a Kubernetes taint applied to a node during registration. Key, value and effect take what a NodeGroup takes (crds/node_group.yaml:1944): bare strings and an optional effect, so a taint copied from one still fits.
    - spec.kubelet.registerWithTaints.effect
      string
      Allowed values: NoSchedule, PreferNoSchedule, NoExecute
    - spec.kubelet.registerWithTaints.key
      string
      Required value
    - spec.kubelet.registerWithTaints.value
      string
  - spec.kubelet.resourceReservation
    object
    ResourceReservation controls how much CPU, memory and disk are held back from pods for the system itself (kubeReserved).
    - spec.kubelet.resourceReservation.mode
      string
      Mode is the reservation policy.
      
      Possible values:
      
      Auto — compute the reservation from the node’s capacity.
      
      Off — reserve nothing.
      
      Default: Auto
      Allowed values: Auto, Off
  - spec.kubelet.serverTLSBootstrap
    boolean
    ServerTLSBootstrap makes kubelet request a serving certificate from the cluster instead of signing its own. Default true. The zero master sets it to false: nothing approves serving CSRs until Deckhouse is installed.
- spec.network
  object
  Network holds hostname, DNS, NTP, interfaces and routes.
  - spec.network.dns
    object
    DNS resolver configuration.
    - spec.network.dns.search
      array of strings
    - spec.network.dns.servers
      array of strings
  - spec.network.hostname
    string
  - spec.network.interfaces
    array of objects
    - spec.network.interfaces.addresses
      array of strings
      Addresses are static CIDR addresses (used when DHCP is false).
    - spec.network.interfaces.cluster
      boolean
      Cluster names this NIC the one the cluster’s traffic runs on, for a machine whose addressing spec.internalNetworkCIDRs cannot tell apart.
    - spec.network.interfaces.dhcp
      boolean
      Required value
      DHCP enables DHCPv4 on the interface.
    - spec.network.interfaces.gateway
      string
    - spec.network.interfaces.name
      string
      Required value
  - spec.network.ntp
    object
    NTP time-sync configuration.
    - spec.network.ntp.servers
      array of strings
  - spec.network.routes
    array of objects
    - spec.network.routes.gateway
      string
    - spec.network.routes.name
      string
    - spec.network.routes.networks
      array of strings
- spec.nodeName
  string
  Required value
  NodeName is the Kubernetes node name this config applies to.
  
  Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
  Length: 1..253
- spec.osImage
  object
  Required value
  OSImage is the image the cluster believes this node should run. Required: a rootfs update is decided by comparing it with what the node recorded at install, and a config that names no image is one no update can start from.
  - spec.osImage.additionalPath
    string
    AdditionalPath is the proxy’s “path” parameter. Empty is right for Deckhouse: every image of a release sits in the repository spec.registry.path already names.
  - spec.osImage.digest
    string
    Required value
    Digest pins the exact image, as for an extension. The node records it at install and compares it on every pass, so a tag would say nothing.
    
    Pattern: ^sha256:[a-f0-9]{64}$
  - spec.osImage.repository
    string
    Repository is the registry host the image is fetched from, handed to the registry-packages-proxy as its “repository” parameter. Empty leaves the parameter out, so the proxy uses its own default registry.
- spec.registry
  object
  Registry is the container registry the node talks to directly, without the registry-packages-proxy. A node bootstrapping a control plane has no proxy yet but must pull images and sysexts; workers leave this empty.
  - spec.registry.address
    string
    Required value
    Address is the registry host, optionally with a port, e.g. “registry.deckhouse.io” or “registry.example.com:5000”.
    
    Pattern: ^\S+$
  - spec.registry.auth
    string
    Auth is the base64-encoded “user:password” pair, as it appears in the “auth” field of a docker config.
    
    Pattern: ^[A-Za-z0-9+/]+={0,2}$
  - spec.registry.ca
    string
    CA is a PEM certificate bundle to verify the registry with, for registries signed by a private CA. The image carries the Mozilla bundle and nothing else, so without this a self-signed registry is unreachable.
  - spec.registry.path
    string
    Path is the repository path within the registry, e.g. “/deckhouse/ce”.
  - spec.registry.scheme
    string
    Scheme is HTTPS (default) or HTTP.
    
    Default: HTTPS
    Allowed values: HTTPS, HTTP
- spec.registryPackagesProxyAccessTokenB64
  string
  RegistryPackagesProxyAccessTokenB64 is a base64-encoded token used to authenticate against the registry packages proxy. Deliberately not marked sensitive: nodelet must read it, and the token is identical on every node.
  
  Pattern: ^(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)?$
- spec.statusToken
  string
  StatusToken is the bearer presented to the node’s :50000 status port. Whoever writes the document mints it (dhctl, or the NodeConfigTemplate render for a hand-installed machine); the cluster carries it over untouched, having no way to tell the node a new one. Deliberately not marked sensitive: the apiserver would answer “" and the carry-over would write that back, destroying the token.
- spec.storage
  object
  Storage selects the target disk for the OS install. The partition layout is fixed (boot/config/data), so only the whole-disk device is needed.
  - spec.storage.device
    string
    Device is the whole-disk block device to install onto, e.g. “/dev/sda”, “/dev/nvme0n1”, or a stable “/dev/disk/by-id/…” path. Ignored when diskSelector is set.
    
    Pattern: ^/dev/[A-Za-z0-9._/-]+$
  - spec.storage.diskSelector
    object
    DiskSelector picks the target disk by attributes instead of a fixed path. It takes priority over device (matching Talos semantics). All specified conditions must match; the first disk that matches is used.
    - spec.storage.diskSelector.busPath
      string
      BusPath matches the hardware bus path (glob).
    - spec.storage.diskSelector.model
      string
      Model matches the device model (glob), e.g. “Samsung*”.
    - spec.storage.diskSelector.name
      string
      Name matches the kernel device name (glob), e.g. “nvme0n1”.
    - spec.storage.diskSelector.rotational
      boolean
      Rotational matches spinning (true) vs solid-state (false) disks.
    - spec.storage.diskSelector.serial
      string
      Serial matches the disk serial number (glob).
    - spec.storage.diskSelector.size
      string
      Size matches the disk capacity, optionally with a comparison operator, e.g. “>=100Gi”, “>1Ti”, “512Gi”.
    - spec.storage.diskSelector.type
      string
      Type matches the disk kind.
      
      Allowed values: SSD, HDD, NVMe, SD
    - spec.storage.diskSelector.wwid
      string
      WWID matches the World Wide Identifier (glob).
  - spec.storage.mounts
    array of objects
    Mounts are additional filesystems the node makes available, at /mnt/ or wherever bindTo names. Nothing here is partitioned: only existing partitions and blank whole disks are formatted (when empty) and mounted.
    
    Mount is one additional filesystem, at /mnt/ unless bindTo says otherwise. Exactly one of device or partitionSelector names the partition; an empty one is formatted (label = name), an existing filesystem mounted as is.
    - spec.storage.mounts.bindTo
      string
      BindTo mounts the filesystem at this path instead of /mnt/, for a directory something else knows by name (/var/lib/etcd). The directory must be empty: mounting over files hides them, and hidden etcd data is lost data.
      
      Pattern: ^/[A-Za-z0-9._/-]+$
    - spec.storage.mounts.device
      string
      Device is the partition to use, e.g. “/dev/sdb1” or a stable “/dev/disk/by-id/…-part1” path.
      
      Pattern: ^/dev/[A-Za-z0-9._/-]+$
    - spec.storage.mounts.filesystem
      string
      Filesystem is what to create when the partition is empty. It says what to create and is not a matching condition.
      
      Default: ext4
      Allowed values: ext4
    - spec.storage.mounts.mode
      string
      Mode is the mode of the filesystem root after mounting, as an octal string, e.g. “0700”. Left alone when unset. A freshly made ext4 has its root at 0755, which is a mode etcd refuses to start on.
      
      Pattern: ^0[0-7]{3}$
    - spec.storage.mounts.name
      string
      Required value
      Name identifies the mount, and is both the mount point (/mnt/) and the filesystem label written when this node formats the partition. Capped at 16 characters because that is the size of the ext4 volume label field.
      
      Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
      Length: 1..16
    - spec.storage.mounts.partitionSelector
      object
      PartitionSelector picks the partition by attributes instead of a fixed path.
      - spec.storage.mounts.partitionSelector.blank
        boolean
        Blank makes whole disks selectable, and only ones that carry nothing: no partition table, no filesystem — a cloud disk never touched. Without it a selector sees partitions only; a whole disk is where somebody’s layout lives.
      - spec.storage.mounts.partitionSelector.fsType
        string
        FSType matches the type of the filesystem already present (glob).
      - spec.storage.mounts.partitionSelector.label
        string
        Label matches the filesystem label (glob).
      - spec.storage.mounts.partitionSelector.name
        string
        Name matches the kernel device name (glob), e.g. “sdb1” or “nvme0n1p*”.
      - spec.storage.mounts.partitionSelector.partLabel
        string
        PartLabel matches the GPT partition name (glob).
      - spec.storage.mounts.partitionSelector.partUUID
        string
        PartUUID matches the GPT partition UUID exactly, ignoring case.
      - spec.storage.mounts.partitionSelector.size
        string
        Size matches the size, optionally with a comparison operator, e.g. “>=100Gi”, “>1Ti”, “512Gi”. Without an operator the comparison is “>=”; “=” allows 1%, since a disk rarely reports an exact round size.
      - spec.storage.mounts.partitionSelector.uuid
        string
        UUID matches the filesystem UUID exactly, ignoring case.
  - spec.storage.wipe
    boolean
    Wipe controls whether an already-provisioned disk is wiped and re-partitioned. Default false: only an unprovisioned (or non-matching) disk is set up, so an existing layout stays and a reboot never destroys data.
- spec.updatePolicy
  object
  UpdatePolicy controls how and when the node is updated.
  - spec.updatePolicy.mode
    string
    Mode is the update mode.
    
    Allowed values: Automatic, Manual
  - spec.updatePolicy.window
    object
    Window is the maintenance window for updates.
    - spec.updatePolicy.window.days
      array of strings
      Days are the weekdays the window applies to.
      - Element of the array
        string
        Allowed values: Mon, Tue, Wed, Thu, Fri, Sat, Sun
    - spec.updatePolicy.window.from
      string
      From is the window start time, “H:MM” or “HH:MM” (24h). The pattern is the NodeGroup one (crds/node_group.yaml:432), which takes a one-digit hour.
      
      Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
    - spec.updatePolicy.window.to
      string
      To is the window end time, same format as From.
      
      Pattern: ^(?:\d|[01]\d|2[0-3]):[0-5]\d$
status
object
Status is reported by the on-node agent after each reconcile pass.
- status.appliedGeneration
  integer
  AppliedGeneration is the spec generation the node is actually running; it lags ObservedGeneration while a disruptive config is held for approval. “This node has converged” means AppliedGeneration == metadata.generation.
- status.conditions
  array of objects
  Conditions are the node-level reconcile outcomes (ConfigurationApplied, DisruptionRequired) plus the gate subsystems (APIEndpointsReachable, SysctlApplied); per-extension and per-unit outcomes live in Extensions and Units.
  
  Condition contains details for one aspect of the current state of this API Resource.
  - status.conditions.lastTransitionTime
    string
    Required value
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
  - status.conditions.message
    string
    Required value
    message is a human readable message indicating details about the transition. This may be an empty string.
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    integer
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    
    Allowed values: 0 <= X
  - status.conditions.reason
    string
    Required value
    reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    
    Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
    Length: 1..1024
  - status.conditions.status
    string
    Required value
    status of the condition, one of True, False, Unknown.
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    string
    Required value
    type of condition in CamelCase or in foo.example.com/CamelCase.
    
    Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
    Maximum length: 316
- status.extensions
  array of objects
  Extensions is the outcome of each configured system extension, one entry per extension. Republished on every pass, empty when the pass checked nothing — never “the previous outcome still holds”.
  
  ExtensionStatus is the reconcile outcome of one system extension.
  - status.extensions.digest
    string
    Digest is the image digest the node installed for it.
  - status.extensions.message
    string
    Message carries the cause when State is Failed.
  - status.extensions.name
    string
    Required value
    Name is the extension name, matching spec.extensions[].name.
  - status.extensions.state
    string
    Required value
    State is Ready when the extension is installed and merged, Pending while it is being fetched or waiting for the update window, or Failed with the cause in Message.
    
    Allowed values: Ready, Pending, Failed
- status.lastReconcileTime
  string
  LastReconcileTime is when the node last finished a reconcile pass — the only thing in the status that ages, so it is what tells a dead agent from a healthy one. Republished coarsely: judge staleness in tens of minutes.
- status.maintenanceToken
  string
  MaintenanceToken is the bearer token an operator presents to the node’s :50000 config-push port once the node has lost the API. Root-equivalent, so the apiserver keeps it out of every answer without the sensitive subresource, which nodes are not granted.
- status.network
  object
  Network is what the node resolved for itself: the interface it took its cluster address from, and that address. Written by the node alone.
  - status.network.address
    string
    Address is the address kubelet registered the node with.
  - status.network.clusterInterface
    string
    ClusterInterface is the NIC the address was taken from.
- status.observedGeneration
  integer
  ObservedGeneration is the latest spec generation the node has processed: it reaches the newest generation as soon as the node has looked at it, even while it is still held for approval (see AppliedGeneration).
- status.osImage
  object
  OSImage is how far the node has got with spec.osImage. Mirrors config.OSImageStatus in the nodelet repository (internal/config/types.go): a field missing here is pruned and the node’s whole status apply fails.
  - status.osImage.attemptsLeft
    integer
    AttemptsLeft is how many boots the trial image has left to prove itself before the initramfs rolls back.
  - status.osImage.digest
    string
    Digest is the image the node is running, as recorded on its config partition. Empty on a node installed before that record existed.
  - status.osImage.failedDigest
    string
    FailedDigest is an image this node booted and rolled back from. It is never tried again: a digest names immutable content, so a fixed image is a different digest.
  - status.osImage.slot
    string
    Slot is the A/B slot that image lives in (“a” or “b”).
  - status.osImage.trialDigest
    string
    TrialDigest is the image staged for the next boot, or on trial in this one. Set only while an update is in flight, which is exactly when Digest still names the old image.
- status.phase
  string
  Phase summarises the node. Ready: running the published config, healthy. Pending: healthy but not yet running the published config (held for approval). Degraded: a subsystem failed, config rejected, or rolled back.
  
  Allowed values: Ready, Pending, Degraded
- status.units
  array of objects
  Units is the outcome of each managed systemd unit (containerd, kubelet and every unit an extension ships), one entry per unit. Republished on every pass like Extensions, and empty when the pass checked nothing.
  
  UnitStatus is the reconcile outcome of one managed systemd unit.
  - status.units.message
    string
    Message carries the cause when State is Failed.
  - status.units.name
    string
    Required value
    Name is the systemd unit name (e.g. containerd.service).
  - status.units.state
    string
    Required value
    State is Active when the unit is running, Pending when it is queued to be started later this pass, or Failed with the cause in Message.
    
    Allowed values: Active, Pending, Failed

NodeExtensionRequest

Short names: ner

Scope: Cluster
Version: v1alpha1

Asks for a system extension (a sysext image, optionally with kernel modules) to be merged onto the nodes it selects.

The image is addressed the way the registry-packages-proxy addresses any package: a name, a digest, and an optional repository and path. node-controller forwards these straight into the NodeConfig extension the on-node agent pulls; it resolves no module or ModuleSource.

apiVersion
string
kind
string
metadata
object
spec
object
Required value
- spec.kernelModules
  array of objects
  The modules to load once the extension is merged.
  - spec.kernelModules.name
    string
    Required value
    The kernel module name.
    
    Pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]*$
  - spec.kernelModules.params
    array of strings
    The module parameters, passed as key=value strings.
- spec.nodeGroupSelector
  object
  Narrows the extension to nodes of the named NodeGroups.
  - spec.nodeGroupSelector.matchNames
    array of strings
    The set of NodeGroup names the extension applies to.
- spec.nodeSelector
  object
  Narrows the extension to nodes carrying the given labels.
  - spec.nodeSelector.matchLabels
    object
    The set of node labels a node must carry to be selected.
- spec.sysext
  object
  Required value
  Locates the system-extension image to merge, the way the registry-packages-proxy locates any package.
  - spec.sysext.digest
    string
    Required value
    The sysext image manifest digest.
    
    Pattern: ^sha256:[a-f0-9]{64}$
  - spec.sysext.name
    string
    Required value
    The sysext name: it is matched against the image’s extension-release and installed on the node as <name>.raw. Copied verbatim into the NodeConfig extension name, so it must be a DNS-label-like token.
    
    Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
    Length: 1..63
  - spec.sysext.path
    string
    The image’s path within the repository (the proxy’s --rpp-path). Left empty, the repository root is used.
  - spec.sysext.repository
    string
    The key the registry-packages-proxy resolves credentials by (its --rpp-repository), for example a ModuleSource’s spec.registry.repo. Left empty, the image is pulled from the cluster’s main registry.
status
object
- status.appliedNodes
  integer
  How many of the selected nodes report the sysext installed and merged. Reported by the nodes themselves: a request can resolve here and still be refused by every node it reaches.
  
  Allowed values: 0 <= X
- status.conditions
  array of objects
  The latest details of the request’s progress.
  - status.conditions.lastTransitionTime
    string
    Required value
  - status.conditions.message
    string
    Required value
    Maximum length: 32768
  - status.conditions.observedGeneration
    integer
    Allowed values: 0 <= X
  - status.conditions.reason
    string
    Required value
    Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
    Length: 1..1024
  - status.conditions.status
    string
    Required value
    Allowed values: True, False, Unknown
  - status.conditions.type
    string
    Required value
    Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
    Maximum length: 316
- status.failedNodes
  integer
  How many of the selected nodes report the sysext refused.
  
  Allowed values: 0 <= X
- status.failureMessage
  string
  What the nodes say about the refusal, taken from one of them.
- status.matchedNodeGroups
  array of strings
  The NodeGroups the selectors currently match.
- status.observedGeneration
  integer
  The generation of the spec this status reflects.
  
  Allowed values: 0 <= X
- status.phase
  string
  Ready when the sysext resolves to an image the selected nodes can pull, Degraded when it cannot (the Ready condition carries the reason).
  
  Allowed values: Ready, Degraded

NodeGroupConfiguration

Short names: ngc

Scope: Cluster
Version: v1alpha1

Executes bash scripts on nodes.

NodeOperation

Short names: nop

Scope: Cluster
Version: v1alpha1

Describes an operation on a node that interrupts its work (a disruptive operation): a reboot, an eviction of its workload, or the permission a node needs before applying a configuration that cannot be applied without interrupting the node.

An operation is a record of intent, not a switch: it is created once, carried through its phases by node-manager and the on-node agent, and kept afterwards as the history of what was done to the node and why. Editing the spec of an existing operation is rejected — create a new one if needed.

Operations are how disruptive work is coordinated for the nodes of a NodeGroup with systemType: Immutable. The same resource is available to an operator who needs to reboot or drain such a node by hand.

Every operation carries the label node-manager.deckhouse.io/node with the value of .spec.nodeName. node-manager stamps it on operations that reach it without one. It is how operations on the same node find each other, which is what keeps two of them from disagreeing about the state the node was in before either started.

apiVersion
string
kind
string
metadata
object
spec
object
Required value
- spec.configGeneration
  integer
  The revision of the node’s NodeConfig this permission covers (.metadata.generation of the NodeConfig object).
  
  The permission is deliberately narrow: it authorises the interruption of the node’s work that one particular configuration needs, so the next published configuration asks for permission again. Only meaningful for ApproveDisruption.
  
  Allowed values: 1 <= X
- spec.drain
  object
  How to evict the workload before the node is interrupted.
  
  The eviction is carried out by a Drain operation of its own, created for and owned by this one. It can be watched like any other operation and is removed together with its parent.
  - spec.drain.skip
    boolean
    Interrupt the node without evicting its workload first.
    
    The workload is then cut off by the interruption instead of being moved, so this is for nodes whose pods must not be evicted (a single-node group, a node running the only replica of something that cannot be moved).
    
    Default: false
- spec.nodeName
  string
  Required value
  The name of the node the operation applies to.
  
  Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
  Length: 1..253
- spec.type
  string
  Required value
  The operation to perform on the node.
  
  Possible values:
  - Reboot — reboot the node.
  - Drain — evict the workload from the node and keep it unschedulable. The operation is complete once the workload has been removed from the node. The node stays out of the scheduler until an operator returns it.
  - ApproveDisruption — allow the node to apply a configuration whose application interrupts it (restarting kubelet or the container runtime, rebuilding the system extensions layer, changing the system image).
  An ApproveDisruption operation is normally created by node-manager in answer to a node that asked for it. The other two are meant for an operator.
  Allowed values: Reboot, Drain, ApproveDisruption
status
object
- status.conditions
  array of objects
  The latest details of the operation’s progress.
  - status.conditions.lastTransitionTime
    string
    Required value
  - status.conditions.message
    string
    Required value
    Maximum length: 32768
  - status.conditions.observedGeneration
    integer
    Allowed values: 0 <= X
  - status.conditions.reason
    string
    Required value
    Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
    Length: 1..1024
  - status.conditions.status
    string
    Required value
    Allowed values: True, False, Unknown
  - status.conditions.type
    string
    Required value
    Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
    Maximum length: 316
- status.drainDeadline
  string
  When the eviction this operation asked for runs out of the time it was given.
  
  It is pinned at the moment the eviction is requested, from the NodeGroup’s nodeDrainTimeoutSecond as it stood then, because that is the bound the draining controller itself started running to. Deriving it again later would let a change to the NodeGroup cut short a drain that is still running.
- status.finishedAt
  string
  When the operation reached a terminal phase. A finished operation is kept as the record of what was done to the node and is collected once it is a day old.
- status.nodeWasUnschedulable
  boolean
  Whether the node was already out of the scheduler when the operation reached it.
  
  Releasing the node at the end of the operation restores this value instead of making the node schedulable, so an operation does not quietly undo a cordon an operator put there by hand.
- status.phase
  string
  The current phase of the operation:
  - Pending — the operation is queued and node-manager has not started it yet;
  - InProgress — the node has been prepared (drained, unless the drain was skipped) and is carrying the operation out;
  - Completed — the operation finished successfully;
  - Failed — the operation failed. See conditions and the events for the reason.
  Allowed values: Pending, InProgress, Completed, Failed
- status.startedAt
  string
  When the node was handed the operation. The wait for the node is measured from here.

NodeUser

Scope: Cluster

v1
v1alpha1

Defines the linux users to create on all nodes.

The user’s home directory is created in the /home/deckhouse/ directory.

spec
object
Required value
- spec.extraGroups
  array of strings
  Node user additional system groups.
  
  Examples:
  extraGroups: - docker
  extraGroups: - docker - ftp
- spec.isSudoer
  boolean
  Persistence of node user in sudo group.
  
  Default: false
  Example:
  isSudoer: true
- spec.nodeGroups
  array of strings
  List of NodeGroups to apply the user for.
  
  Default: ["*"]
  Examples:
  nodeGroups: - master - worker
  nodeGroups: - worker
  nodeGroups: - "*"
- spec.passwordHash
  string
  Hashed user password.
  
  The format corresponds to the password hashes in /etc/shadow. You can get it using the following command: openssl passwd -6.
  
  Example:
  passwordHash: "$2a$10$F9ey7zW.sVliT224RFxpWeMsgzO.D9YRG54a8T36/K2MCiT41nzmC"
- spec.sshPublicKey
  Deprecated
  string
  Node user SSH public key.
  
  Either sshPublicKey or sshPublicKeys must be specified.
  
  Example:
  sshPublicKey: ssh-rsa AAABBB
- spec.sshPublicKeys
  array of strings
  Node user SSH public keys.
  
  Either sshPublicKey or sshPublicKeys must be specified.
  
  Example:
  sshPublicKeys: - ssh-rsa AAABBB - cert-authority,principals="name" ssh-rsa BBBCCC
- spec.uid
  number
  Required value
  Node user ID.
  
  We recommend using the values >= 1100 to avoid conflicts with manually created users.
  
  This parameter does not change during the entire resource life.
  
  Allowed values: 1001 <= X
  
  Example:
  uid: 1100
status
object
User creation status information
- status.errors
  object
  List of user creation errors on each node

Deprecated resource. Support for the resource might be removed in a later release.

Defines the linux users to create on all nodes.

The user’s home directory is created in the /home/deckhouse/ directory.

spec
object
Required value
- spec.extraGroups
  array of strings
  Node user additional system groups.
  
  Examples:
  extraGroups: - docker
  extraGroups: - docker - ftp
- spec.isSudoer
  boolean
  Persistence of node user in sudo group.
  
  Default: false
  Example:
  isSudoer: true
- spec.nodeGroups
  array of strings
  List of NodeGroups to apply the user for.
  
  Default: ["*"]
  Examples:
  nodeGroups: - master - worker
  nodeGroups: - worker
  nodeGroups: - "*"
- spec.passwordHash
  string
  Hashed user password.
  
  The format corresponds to the password hashes in /etc/shadow. You can get it using the following command: openssl passwd -6.
  
  Example:
  passwordHash: "$2a$10$F9ey7zW.sVliT224RFxpWeMsgzO.D9YRG54a8T36/K2MCiT41nzmC"
- spec.sshPublicKey
  Deprecated
  string
  Node user SSH public key.
  
  Either sshPublicKey or sshPublicKeys must be specified.
  
  Example:
  sshPublicKey: ssh-rsa AAABBB
- spec.sshPublicKeys
  array of strings
  Node user SSH public keys.
  
  Either sshPublicKey or sshPublicKeys must be specified.
  
  Example:
  sshPublicKeys: - ssh-rsa AAABBB - cert-authority,principals="name" ssh-rsa BBBCCC
- spec.uid
  number
  Required value
  Node user ID.
  
  We recommend using the values >= 1100 to avoid conflicts with manually created users.
  
  This parameter does not change during the entire resource life.
  
  Allowed values: 1001 <= X
  
  Example:
  uid: 1100

SSHCredentials

Scope: Cluster

v1alpha2
v1alpha1

Contains credentials required by Cluster API Provider Static (CAPS) to connect over SSH. CAPS connects to the server (virtual machine) defined in the StaticInstance custom resource to manage its state.

A reference to this resource is specified in the credentialsRef parameter of the StaticInstance resource.

apiVersion
string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec
object
SSHCredentialsSpec defines the desired state of SSHCredentials.
- spec.privateSSHKey
  string
  Private SSH key in PEM format encoded as base64 string.
  
  If the user does not have permission to view sensitive SSHCredentials data, the API returns instead of the actual value.
- spec.sshExtraArgs
  string
  A list of additional arguments to pass to the openssh command.
  
  Examples:
  sshExtraArgs: "-vvv"
  sshExtraArgs: "-c chacha20-poly1305@openssh.com"
  sshExtraArgs: "-c aes256-gcm@openssh.com"
  sshExtraArgs: "-m umac-64-etm@openssh.com"
  sshExtraArgs: "-m hmac-sha2-512-etm@openssh.com"
- spec.sshPort
  integer
  A port to connect to the host via SSH.
  
  Default: 22
  Allowed values: 1 <= X <= 65535
- spec.sudoPasswordEncoded
  string
  Base64 encoded sudo password for the user.
  
  If the user does not have permission to view sensitive SSHCredentials data, the API returns instead of the actual value.
- spec.user
  string
  Required value
  A username to connect to the host via SSH.

A reference to this resource is specified in the credentialsRef parameter of the StaticInstance resource.

apiVersion
string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec
object
SSHCredentialsSpec defines the desired state of SSHCredentials.
- spec.privateSSHKey
  string
  Private SSH key in PEM format encoded as base64 string.
  
  If the user does not have permission to view sensitive SSHCredentials data, the API returns instead of the actual value.
- spec.sshExtraArgs
  string
  A list of additional arguments to pass to the openssh command.
  
  Examples:
  sshExtraArgs: "-vvv"
  sshExtraArgs: "-c chacha20-poly1305@openssh.com"
  sshExtraArgs: "-c aes256-gcm@openssh.com"
  sshExtraArgs: "-m umac-64-etm@openssh.com"
  sshExtraArgs: "-m hmac-sha2-512-etm@openssh.com"
- spec.sshPort
  integer
  A port to connect to the host via SSH.
  
  Default: 22
  Allowed values: 1 <= X <= 65535
- spec.sudoPassword
  string
  A sudo password for the user.
  
  If the user does not have permission to view sensitive SSHCredentials data, the API returns instead of the actual value.
- spec.user
  string
  Required value
  A username to connect to the host via SSH.

StaticInstance

Scope: Cluster

v1alpha2
v1alpha1

StaticInstance describes a machine for the Cluster API Provider Static.

apiVersion
string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec
object
StaticInstanceSpec defines the desired state of StaticInstance.
- spec.address
  string
  Required value
  The IP address of the host.
  
  Pattern: ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$
- spec.credentialsRef
  object
  Required value
  The reference to the SSHCredentials object.
  - spec.credentialsRef.apiVersion
    string
    API version of the referent.
  - spec.credentialsRef.fieldPath
    string
    If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: “spec.containers{name}” (where “name” refers to the name of the container that triggered the event) or if no container name is specified “spec.containers[2]” (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.
  - spec.credentialsRef.kind
    string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  - spec.credentialsRef.name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  - spec.credentialsRef.namespace
    string
    Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
  - spec.credentialsRef.resourceVersion
    string
    Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
  - spec.credentialsRef.uid
    string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
status
object
StaticInstanceStatus defines the observed state of StaticInstance.
- status.conditions
  array of objects
  Conditions defines current service state of the StaticInstance.
  
  Condition contains details for one aspect of the current state of this API Resource.
  - status.conditions.lastTransitionTime
    string
    Required value
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
  - status.conditions.message
    string
    Required value
    message is a human readable message indicating details about the transition. This may be an empty string.
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    integer
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    
    Allowed values: 0 <= X
  - status.conditions.reason
    string
    Required value
    reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    
    Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
    Length: 1..1024
  - status.conditions.status
    string
    Required value
    status of the condition, one of True, False, Unknown.
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    string
    Required value
    type of condition in CamelCase or in foo.example.com/CamelCase.
    
    Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
    Maximum length: 316
- status.currentStatus
  object
  - status.currentStatus.lastUpdateTime
    string
  - status.currentStatus.phase
    string
    Allowed values: Error, Pending, Bootstrapping, Running, Cleaning
- status.machineRef
  object
  The reference to the StaticMachine object.
  - status.machineRef.apiVersion
    string
    API version of the referent.
  - status.machineRef.fieldPath
    string
    If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: “spec.containers{name}” (where “name” refers to the name of the container that triggered the event) or if no container name is specified “spec.containers[2]” (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.
  - status.machineRef.kind
    string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  - status.machineRef.name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  - status.machineRef.namespace
    string
    Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
  - status.machineRef.resourceVersion
    string
    Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
  - status.machineRef.uid
    string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
- status.nodeRef
  object
  The reference to the Node object.
  - status.nodeRef.apiVersion
    string
    API version of the referent.
  - status.nodeRef.fieldPath
    string
    If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: “spec.containers{name}” (where “name” refers to the name of the container that triggered the event) or if no container name is specified “spec.containers[2]” (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.
  - status.nodeRef.kind
    string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  - status.nodeRef.name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  - status.nodeRef.namespace
    string
    Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
  - status.nodeRef.resourceVersion
    string
    Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
  - status.nodeRef.uid
    string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids

StaticInstance describes a machine for the Cluster API Provider Static.

apiVersion
string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec
object
StaticInstanceSpec defines the desired state of StaticInstance.
- spec.address
  string
  Required value
  The IP address of the host.
  
  Pattern: ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$
- spec.credentialsRef
  object
  Required value
  The reference to the SSHCredentials object.
  - spec.credentialsRef.apiVersion
    string
    API version of the referent.
  - spec.credentialsRef.fieldPath
    string
    If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: “spec.containers{name}” (where “name” refers to the name of the container that triggered the event) or if no container name is specified “spec.containers[2]” (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.
  - spec.credentialsRef.kind
    string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  - spec.credentialsRef.name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  - spec.credentialsRef.namespace
    string
    Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
  - spec.credentialsRef.resourceVersion
    string
    Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
  - spec.credentialsRef.uid
    string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
status
object
StaticInstanceStatus defines the observed state of StaticInstance.
- status.conditions
  array of objects
  Conditions defines current service state of the StaticInstance.
  
  Condition contains details for one aspect of the current state of this API Resource.
  - status.conditions.lastTransitionTime
    string
    Required value
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
  - status.conditions.message
    string
    Required value
    message is a human readable message indicating details about the transition. This may be an empty string.
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    integer
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    
    Allowed values: 0 <= X
  - status.conditions.reason
    string
    Required value
    reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    
    Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
    Length: 1..1024
  - status.conditions.status
    string
    Required value
    status of the condition, one of True, False, Unknown.
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    string
    Required value
    type of condition in CamelCase or in foo.example.com/CamelCase.
    
    Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
    Maximum length: 316
- status.currentStatus
  object
  - status.currentStatus.lastUpdateTime
    string
  - status.currentStatus.phase
    string
    Allowed values: Error, Pending, Bootstrapping, Running, Cleaning
- status.machineRef
  object
  The reference to the StaticMachine object.
  - status.machineRef.apiVersion
    string
    API version of the referent.
  - status.machineRef.fieldPath
    string
    If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: “spec.containers{name}” (where “name” refers to the name of the container that triggered the event) or if no container name is specified “spec.containers[2]” (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.
  - status.machineRef.kind
    string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  - status.machineRef.name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  - status.machineRef.namespace
    string
    Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
  - status.machineRef.resourceVersion
    string
    Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
  - status.machineRef.uid
    string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
- status.nodeRef
  object
  The reference to the Node object.
  - status.nodeRef.apiVersion
    string
    API version of the referent.
  - status.nodeRef.fieldPath
    string
    If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: “spec.containers{name}” (where “name” refers to the name of the container that triggered the event) or if no container name is specified “spec.containers[2]” (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.
  - status.nodeRef.kind
    string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  - status.nodeRef.name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  - status.nodeRef.namespace
    string
    Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
  - status.nodeRef.resourceVersion
    string
    Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
  - status.nodeRef.uid
    string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids

Managing nodes: custom resources

Instance

InstanceTypesCatalog

NodeGroup

NodeConfig

NodeExtensionRequest

NodeGroupConfiguration

NodeOperation

NodeUser

SSHCredentials

StaticInstance

An error has occurred

Tell us what you didn’t like.

Managing nodes: custom resources

Instance

InstanceTypesCatalog

NodeGroup

NodeConfig

NodeExtensionRequest

NodeGroupConfiguration

NodeOperation

NodeUser

SSHCredentials

StaticInstance

An error has occurred

Tell us what you didn’t like.

Request trial access

Thank you

Error

Request callback

Thank you

Something went wrong

Book your sessions

Thank you

Error

Request demo

Thank you

Error

Get the PCI SSC Compliance Report

Thank you

Error