Custom Resources

apiVersion: deckhouse.io/v1
kind: ClusterConfiguration
podSubnetNodeCIDRPrefix: '24'
podSubnetCIDR: 10.244.0.0/16
serviceSubnetCIDR: 192.168.0.0/16
kubernetesVersion: '1.29'
clusterDomain: k8s.internal
clusterType: Cloud
cloud:
  prefix: k8s-dev
  provider: Yandex
proxy:
  httpProxy: https://user:password@proxy.company.my:8443
  httpsProxy: https://user:password@proxy.company.my:8443
  noProxy:
  - company.my

• apiVersion

  string

  Required value

  Version of the Deckhouse API.

  Allowed values: deckhouse.io/v1, deckhouse.io/v1alpha1

• cloud

  object

  Cloud provider-related settings (if the Cloud clusterType is used).

  • cloud.prefix

    string

    A prefix of the objects to be created in the cloud.

    Is used, for example, to distinguish objects created for different clusters, to configure routing, etc.

    Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

  • cloud.provider

    string

    Required value

    Cloud provider.

    Allowed values: OpenStack, AWS, GCP, Yandex, vSphere, Azure, VCD, Zvirt, Dynamix, Huaweicloud, DVP

• clusterDomain

  string

  Required value

  Cluster domain (used for local routing).

  Please note: the domain must not match the domain used in the DNS name template in the publicDomainTemplate parameter. For example, you cannot set cluster Domain: cluster.local and publicDomainTemplate: %s.cluster.local at the same time.

  If you need to change a parameter in a running cluster, it is recommended to use instructions

  Default: cluster.local

• clusterType

  string

  Required value

  Type of the cluster infrastructure:

  • Static — a cluster on bare metal (physical servers) or virtual machines. In the case of virtual machines, it is assumed that Deckhouse doesn’t have access to the API for managing virtual machines (they are managed by the administrator using the usual cloud infrastructure tools);
  • Cloud — a cluster deployed on the resources of a cloud infrastructure. This type implies that Deckhouse has access to the cloud infrastructure API for managing virtual machines.

  Allowed values: Cloud, Static

• defaultCRI

  string

  The container runtime type that used on cluster nodes (NodeGroups) by default.

  If the value NotManaged is used, then Deckhouse does not manage the container runtime (and doesn’t install it). In this case, it is necessary to use images for NodeGroups on which the container runtime is already installed.

  If ContainerdV2 is set, CgroupsV2 will be used (providing improved security and resource management). To use ContainerdV2 as the container runtime, cluster nodes must meet the following requirements:

  • Support for CgroupsV2.
  • Linux kernel version 5.8 or newer.
  • Systemd version 244 or newer.
  • Support for erofs kernel module.

  Default: Containerd

  Allowed values: Containerd, ContainerdV2, NotManaged

• encryptionAlgorithm

  string

  In Kubernetes version 1.30 and earlier, only the RSA-2048 algorithm is supported.

  Starting from version 1.31, kubeadm use the specified asymmetric encryption algorithm when generating keys and certificates for the following control-plane components:

  • apiserver
  • apiserver-kubelet-client
  • apiserver-etcd-client
  • front-proxy-client
  • etcd-server
  • etcd-peer
  • etcd-healthcheck-client

  Certificates for the components listed above will be reissued using the selected algorithm and key length.

  Warning. When reissuing certificates, the root certificate (CA) is not rotated. The root certificate is created with the selected algorithm only during the initial cluster bootstrap.

  Default: RSA-2048

  Allowed values: RSA-2048, RSA-3072, RSA-4096, ECDSA-P256

• kind

  string

  Required value

  Allowed values: ClusterConfiguration

• kubernetesVersion

  string

  Required value

  Kubernetes version (control plane components of the cluster).

  Changing a parameter in a running cluster will automatically update the cluster’s control plane version.

  If Automatic is specified, then the control plane version is used, which is considered stable at the moment. If the stable version of control plane is less than the maximum version that has ever been installed in the cluster, more than 1 minor version, then the version of the cluster will not be changed. The version may change when the minor version of the Deckhouse release is changed (see a corresponding release message).

  Allowed values: 1.29, 1.30, 1.31, 1.32, 1.33, Automatic

• podSubnetCIDR

  string

  Required value

  Address space of the cluster’s Pods.

  Caution! Normally, you won’t be able to change the parameter in a running cluster. To avoid this limitation use specific flag.

• podSubnetNodeCIDRPrefix

  string

  The prefix of Pod network on a node.

  Caution! Normally, you won’t be able to change the parameter in a running cluster. To avoid this limitation use specific flag.

  Default: 24

• proxy

  object

  Available in editions: BE, SE, SE+, EE

  Global proxy setup (mainly for working in air-gapped environments).

  The parameters described in this section will be translated into the environment variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY for all cluster nodes and Deckhouse components. This will result in HTTP(S) requests (curl, git, registry, etc.) to all resources not listed in the noProxy parameter being made through a proxy. Note that the podSubnetCIDR and serviceSubnetCIDR subnets, as well as the clusterDomain domain are added to noProxy automatically.

  Caution! To avoid using proxies in requests between pods and services located in the cluster node network, make sure you list all the host subnets in the noProxy parameter.

  • proxy.httpProxy

    string

    Available in editions: BE, SE, SE+, EE

    Proxy URL for HTTP requests.

    If necessary, specify the proxy server’s username, password, and port.

    Pattern: ^https?://([!*'();&=+$,/?%#\[\]0-9a-zA-Z\.\-\_]+(\:[!*'();:@&=+$,/?%#\[\]0-9a-zA-Z\.\-\_]+)?@)?[0-9a-zA-Z\.\-]+(\:[0-9]{1,5})?$

    Examples:

    httpProxy: http://proxy.company.my
    

    httpProxy: https://user:password@proxy.company.my:8443
    

    httpProxy: https://DOMAIN%5Cuser:password@proxy.company.my:8443
    

    httpProxy: https://user%40domain.local:password@proxy.company.my:8443
    

  • proxy.httpsProxy

    string

    Available in editions: BE, SE, SE+, EE

    Proxy URL for HTTPS requests.

    If necessary, specify the proxy server’s username, password, and port.

    Pattern: ^https?://([!*'();&=+$,/?%#\[\]0-9a-zA-Z\.\-\_]+(\:[!*'();:@&=+$,/?%#\[\]0-9a-zA-Z\.\-\_]+)?@)?[0-9a-zA-Z\.\-]+(\:[0-9]{1,5})?$

    Examples:

    httpsProxy: http://proxy.company.my
    

    httpsProxy: https://user:password@proxy.company.my:8443
    

    httpsProxy: https://DOMAIN%5Cuser:password@proxy.company.my:8443
    

    httpsProxy: https://user%40domain.local:password@proxy.company.my:8443
    

  • proxy.noProxy

    array of strings

    Available in editions: BE, SE, SE+, EE

    List of no proxy IP and domain entries.

    For wildcard domains, use a domain name with a dot prefix, e.g., “.example.com”.

    Caution. If the cluster is supposed to have pods interacting with services located in the cluster node network, then specify the list of subnets that are used on the nodes.

    • Element of the array

      string

      Pattern: ^[a-z0-9\-\./]+$

• serviceSubnetCIDR

  string

  Required value

  Address space of the cluster’s services.

  Caution! Normally, you won’t be able to change the parameter in a running cluster. To avoid this limitation use specific flag.

apiVersion: deckhouse.io/v1
kind: InitConfiguration
deckhouse:
  imagesRepo: nexus.company.my/deckhouse/ee
  registryDockerCfg: eyJhdXRocyI6IHsgIm5leHVzLmNvbXBhbnkubXkiOiB7InVzZXJuYW1lIjoibmV4dXMtdXNlciIsInBhc3N3b3JkIjoibmV4dXMtcEBzc3cwcmQiLCJhdXRoIjoiYm1WNGRYTXRkWE5sY2pwdVpYaDFjeTF3UUhOemR6QnlaQW89In19fQo=
  registryScheme: HTTPS
  registryCA: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----

• apiVersion

  string

  Required value

  Version of the Deckhouse API.

  Allowed values: deckhouse.io/v1, deckhouse.io/v1alpha1

• deckhouse

  object

  Required value

  Initial parameters required to install Deckhouse.

  • deckhouse.devBranch

    Deprecated

    string

    The parameter is used for development needs. Will be replaced with the CLI-tools.

  • deckhouse.imagesRepo

    string

    Address of a container registry with Deckhouse images.

    Specify it if Deckhouse Enterprise Edition edition or third-party registry (e.g. proxy server in a closed environment) is used.

    The address matches the edition of Deckhouse used. The public container registry address for Deckhouse Enterprise Edition is registry.deckhouse.io/deckhouse/ee.

    Default: registry.deckhouse.io/deckhouse/ce

    Pattern: ^[0-9a-zA-Z\.\-]+(\:[0-9]{1,5})?(\/[0-9a-zA-Z\.\-\_\/]+)?$

  • deckhouse.registryCA

    string

    Root CA certificate to validate the container registry’s HTTPS certificate (if self-signed certificates are used).

  • deckhouse.registryDockerCfg

    string

    A Base64-encoded string from the Docker client configuration file (in Linux it is usually $HOME/.docker/config.json), for accessing a third-party container registry.

    For example, to access the container registry registry.company.my under the user user with the password P@ssw0rd it will be eyJhdXRocyI6eyJyZWdpc3RyeS5jb21wYW55Lm15Ijp7ImF1dGgiOiJkWE5sY2pwUVFITnpkekJ5WkFvPSJ9fX0K (string {"auths":{"registry.company.my":{"auth":"dXNlcjpQQHNzdzByZAo="}}} in Base64).

    Default: eyJhdXRocyI6IHsgInJlZ2lzdHJ5LmRlY2tob3VzZS5pbyI6IHt9fX0=

  • deckhouse.registryScheme

    string

    Registry access scheme (HTTP or HTTPS).

    Default: HTTPS

    Allowed values: HTTP, HTTPS

• kind

  string

  Required value

  Allowed values: InitConfiguration

Example:

apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: module-1
spec:
  enabled: true
  settings: {}
  version: 1

Example:

apiVersion: deckhouse.io/v1alpha1
kind: ModuleSource
metadata:
  name: example
spec:
  registry:
    repo: registry.example.io/modules-source
    dockerCfg: "<base64 encoded credentials>"

apiVersion: deckhouse.io/v1
kind: StaticClusterConfiguration
internalNetworkCIDRs:
- 10.244.0.0/16
- 10.50.0.0/16

• apiVersion

  string

  Required value

  Version of the Deckhouse API.

  Allowed values: deckhouse.io/v1, deckhouse.io/v1alpha1

• internalNetworkCIDRs

  array of strings

  List of internal cluster networks.

  Internal cluster networks connect Kubernetes components (kube-apiserver, kubelet, etc.).

  The parameter is mandatory in the following cases:

  • Cluster nodes have more than one network interface
  • The cluster is deployed inside a Deckhouse Virtualization Platform

  When changing the value, subnets in the new list must include IP addresses of currently joined nodes.

  Example:

  internalNetworkCIDRs:
  - 192.168.42.0/24
  - 172.16.16.0/24
  

  • Element of the array

    string

    Pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$

• kind

  string

  Required value

  Allowed values: StaticClusterConfiguration

apiVersion: dhctl.deckhouse.io/v1
kind: SSHConfig
sshUser: user
sshPort: 22
sshExtraArgs: "-vvv"
sshAgentPrivateKeys:
- key: "<ssh-private-key>"

• apiVersion

  string

  Version of the Deckhouse API.

  Allowed values: dhctl.deckhouse.io/v1

• kind

  string

  Allowed values: SSHConfig

• legacyMode

  boolean

  Switch to legacy SSH mode

• sshAgentPrivateKeys

  array of objects
  • sshAgentPrivateKeys.key

    string

    Required value

    Private SSH key.

  • sshAgentPrivateKeys.passphrase

    string

    Password for SSH key.

• sshBastionHost

  string

  SSH bastion host.

• sshBastionPassword

  string

  A password for the bastion user.

• sshBastionPort

  integer

  Port of SSH bastion.

• sshBastionUser

  string

  Username for bastion.

• sshExtraArgs

  string

  Additional arguments for SSH connection.

• sshPort

  integer

  SSH port.

• sshUser

  string

  SSH username.

• sudoPassword

  string

  A sudo password for the user.

apiVersion: dhctl.deckhouse.io/v1
kind: SSHHost
host: 172.16.0.0

• apiVersion

  string

  Required value

  Version of the Deckhouse API.

  Allowed values: dhctl.deckhouse.io/v1

• host

  string

  Required value

  Host.

• kind

  string

  Required value

  Allowed values: SSHHost