Spec holds information passed to the plugin by the transport.

Status is filled in by the plugin and holds the credentials that the transport should use to contact the API.

Server is the address of the kubernetes cluster (https://hostname:port).

TLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.

InsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.

CAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.

ProxyURL is the URL to the proxy to be used for all requests to this cluster.

Config holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.

This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:

clusters:

• name: my-cluster cluster: ... extensions:
  • name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary config

In some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.

Cluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to. Note that Cluster is non-nil only when provideClusterInfo is set to true in the exec provider config (i.e., ExecConfig.ProvideClusterInfo).

Interactive declares whether stdin has been passed to this exec plugin.

ExpirationTimestamp indicates a time when the provided credentials expire.

Token is a bearer token used by the client for request authentication.

PEM-encoded client TLS certificates (including intermediates, if any).

PEM-encoded private key for the above certificate.

Spec holds information passed to the plugin by the transport.

Status is filled in by the plugin and holds the credentials that the transport should use to contact the API.

Server is the address of the kubernetes cluster (https://hostname:port).

TLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.

InsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.

CAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.

ProxyURL is the URL to the proxy to be used for all requests to this cluster.

Config holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.

This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:

clusters:

• name: my-cluster cluster: ... extensions:
  • name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary config

In some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.

Cluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to. Note that Cluster is non-nil only when provideClusterInfo is set to true in the exec provider config (i.e., ExecConfig.ProvideClusterInfo).

Interactive declares whether stdin has been passed to this exec plugin.

ExpirationTimestamp indicates a time when the provided credentials expire.

Token is a bearer token used by the client for request authentication.

PEM-encoded client TLS certificates (including intermediates, if any).

PEM-encoded private key for the above certificate.

limits are the limits to place on event queries received. Limits can be placed on events received server-wide, per namespace, per user, and per source+object. At least one limit is required.

type is the type of limit to which this configuration applies

qps is the number of event queries per second that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The qps determines how many queries are accepted once the burst amount of queries has been exhausted.

burst is the burst number of event queries that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The burst determines the maximum size of the allowance granted for a particular bucket. For example, if the burst is 10 and the qps is 3, then the admission control will accept 10 queries before blocking any queries. Every second, 3 more queries will be allowed. If some of that allowance is not used, then it will roll over to the next second, until the maximum allowance of 10 is reached.

cacheSize is the size of the LRU cache for this type of limit. If a bucket is evicted from the cache, then the allowance for that bucket is reset. If more queries are later received for an evicted bucket, then that bucket will re-enter the cache with a clean slate, giving that bucket a full allowance of burst queries.

The default cache size is 4096.

If limitType is 'server', then cacheSize is ignored.

Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

Spec holds information about the pod being evaluated

Status is filled in by the backend and indicates whether the pod should be allowed.

This can be in the form image:tag or image@SHA:012345679abcdef.

Containers is a list of a subset of the information in each container of the Pod being created.

Annotations is a list of key-value pairs extracted from the Pod's annotations. It only includes keys which match the pattern *.image-policy.k8s.io/*. It is up to each webhook backend to determine how to interpret these annotations, if at all.

Namespace is the namespace the pod is being created in.

Allowed indicates that all images were allowed to be run.

Reason should be empty unless Allowed is false in which case it may contain a short description of what is wrong. Kubernetes may truncate excessively long errors when displaying to the user.

AuditAnnotations will be added to the attributes object of the admission controller request using 'AddAnnotation'. The keys should be prefix-less (i.e., the admission controller will add an appropriate prefix).

AuditLevel at which event was generated

Unique audit ID, generated for each request.

Stage of the request handling when this event instance was generated.

RequestURI is the request URI as sent by the client to a server.

Verb is the kubernetes verb associated with the request. For non-resource requests, this is the lower-cased HTTP method.

Authenticated user information.

Impersonated user information.

Source IPs, from where the request originated and intermediate proxies. The source IPs are listed from (in order):

1. X-Forwarded-For request header IPs
2. X-Real-Ip header, if not present in the X-Forwarded-For list
3. The remote address for the connection, if it doesn't match the last IP in the list up to here (X-Forwarded-For or X-Real-Ip). Note: All but the last IP can be arbitrarily set by the client.

UserAgent records the user agent string reported by the client. Note that the UserAgent is provided by the client, and must not be trusted.

Object reference this request is targeted at. Does not apply for List-type requests, or non-resource requests.

The response status, populated even when the ResponseObject is not a Status type. For successful responses, this will only include the Code and StatusSuccess. For non-status type error responses, this will be auto-populated with the error Message.

API object from the request, in JSON format. The RequestObject is recorded as-is in the request (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or merging. It is an external versioned object type, and may not be a valid object on its own. Omitted for non-resource requests. Only logged at Request Level and higher.

API object returned in the response, in JSON. The ResponseObject is recorded after conversion to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged at Response Level.

Time the request reached the apiserver.

Time the request reached current audit stage.

Annotations is an unstructured key value map stored with an audit event that may be set by plugins invoked in the request serving chain, including authentication, authorization and admission plugins. Note that these annotations are for the audit event, and do not correspond to the metadata.annotations of the submitted object. Keys should uniquely identify the informing component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values should be short. Annotations are included in the Metadata level.

ObjectMeta is included for interoperability with API infrastructure.

Rules specify the audit Level a request should be recorded at. A request may match multiple rules, in which case the FIRST matching rule is used. The default audit level is None, but can be overridden by a catch-all rule at the end of the list. PolicyRules are strictly ordered.

OmitStages is a list of stages for which no events are created. Note that this can also be specified per rule in which case the union of both are omitted.

OmitManagedFields indicates whether to omit the managed fields of the request and response bodies from being written to the API audit log. This is used as a global default - a value of 'true' will omit the managed fileds, otherwise the managed fields will be included in the API audit log. Note that this can also be specified per rule in which case the value specified in a rule will override the global default.

Group is the name of the API group that contains the resources. The empty string represents the core API group.

Resources is a list of resources this rule applies to.

For example: 'pods' matches pods. 'pods/log' matches the log subresource of pods. '' matches all resources and their subresources. 'pods/' matches all subresources of pods. '*/scale' matches all scale subresources.

If wildcard is present, the validation rule will ensure resources do not overlap with each other.

An empty list implies all resources and subresources in this API groups apply.

ResourceNames is a list of resource instance names that the policy matches. Using this field requires Resources to be specified. An empty list implies that every instance of the resource is matched.

APIGroup is the name of the API group that contains the referred object. The empty string represents the core API group.

APIVersion is the version of the API group that contains the referred object.

The Level that requests matching this rule are recorded at.

The users (by authenticated user name) this rule applies to. An empty list implies every user.

The user groups this rule applies to. A user is considered matching if it is a member of any of the UserGroups. An empty list implies every user group.

The verbs that match this rule. An empty list implies every verb.

Resources that this rule matches. An empty list implies all kinds in all API groups.

Namespaces that this rule matches. The empty string "" matches non-namespaced resources. An empty list implies every namespace.

NonResourceURLs is a set of URL paths that should be audited. s are allowed, but only as the full, final step in the path. Examples: "/metrics" - Log requests for apiserver metrics "/healthz" - Log all health checks

OmitStages is a list of stages for which no events are created. Note that this can also be specified policy wide in which case the union of both are omitted. An empty list means no restrictions will apply.

OmitManagedFields indicates whether to omit the managed fields of the request and response bodies from being written to the API audit log.

• a value of 'true' will drop the managed fields from the API audit log
• a value of 'false' indicates that the managed fileds should be included in the API audit log Note that the value, if specified, in this rule will override the global default If a value is not specified then the global default specified in Policy.OmitManagedFields will stand.

Plugins allows specifying a configuration per admission control plugin.

Name is the name of the admission controller. It must match the registered admission plugin name.

Path is the path to a configuration file that contains the plugin's configuration

Configuration is an embedded configuration object to be used as the plugin's configuration. If present, it will be used instead of the path to the configuration file.

Plugins allows specifying a configuration per admission control plugin.

connectionServices contains a list of egress selection client configurations

Endpoint of the collector that's running on the control-plane node. The APIServer uses the egressType ControlPlane when sending data to the collector. The syntax is defined in https://github.com/grpc/grpc/blob/master/doc/naming.md. Defaults to the otlpgrpc default, localhost:4317 The connection is insecure, and does not support TLS.

SamplingRatePerMillion is the number of samples to collect per million spans. Defaults to 0.

Name is the name of the admission controller. It must match the registered admission plugin name.

Path is the path to a configuration file that contains the plugin's configuration

Configuration is an embedded configuration object to be used as the plugin's configuration. If present, it will be used instead of the path to the configuration file.

Protocol is the protocol used to connect from client to the konnectivity server.

Transport defines the transport configurations we use to dial to the konnectivity server. This is required if ProxyProtocol is HTTPConnect or GRPC.

name is the name of the egress selection. Currently supported values are "controlplane", "master", "etcd" and "cluster" The "master" egress selector is deprecated in favor of "controlplane"

connection is the exact information used to configure the egress selection

URL is the location of the konnectivity server to connect to. As an example it might be "https://127.0.0.1:8131"

TLSConfig is the config needed to use TLS when connecting to konnectivity server

caBundle is the file location of the CA to be used to determine trust with the konnectivity server. Must be absent/empty if TCPTransport.URL is prefixed with http:// If absent while TCPTransport.URL is prefixed with https://, default to system trust roots.

clientKey is the file location of the client key to be used in mtls handshakes with the konnectivity server. Must be absent/empty if TCPTransport.URL is prefixed with http:// Must be configured if TCPTransport.URL is prefixed with https://

clientCert is the file location of the client certificate to be used in mtls handshakes with the konnectivity server. Must be absent/empty if TCPTransport.URL is prefixed with http:// Must be configured if TCPTransport.URL is prefixed with https://

TCP is the TCP configuration for communicating with the konnectivity server via TCP ProxyProtocol of GRPC is not supported with TCP transport at the moment Requires at least one of TCP or UDS to be set

UDS is the UDS configuration for communicating with the konnectivity server via UDS Requires at least one of TCP or UDS to be set

UDSName is the name of the unix domain socket to connect to konnectivity server This does not use a unix:// prefix. (Eg: /etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket)

resources is a list containing resources, and their corresponding encryption providers.

keys is a list of keys to be used for creating the AES transformer. Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.

name is the name of the KMS plugin to be used.

cachesize is the maximum number of secrets which are cached in memory. The default value is 1000. Set to a negative value to disable caching.

endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".

timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.

name is the name of the key to be used while storing data to disk.

secret is the actual key, encoded in base64.

aesgcm is the configuration for the AES-GCM transformer.

aescbc is the configuration for the AES-CBC transformer.

secretbox is the configuration for the Secretbox based transformer.

identity is the (empty) configuration for the identity transformer.

kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.

resources is a list of kubernetes resources which have to be encrypted.

providers is a list of transformers to be used for reading and writing the resources to disk. eg: aesgcm, aescbc, secretbox, identity.

keys is a list of keys to be used for creating the Secretbox transformer. Each key has to be 32 bytes long.

featureGates is a map of feature names to bools that enable or disable alpha/experimental features.

bindAddress is the IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces)

healthzBindAddress is the IP address and port for the health check server to serve on, defaulting to 0.0.0.0:10256

metricsBindAddress is the IP address and port for the metrics server to serve on, defaulting to 127.0.0.1:10249 (set to 0.0.0.0 for all interfaces)

bindAddressHardFail, if true, kube-proxy will treat failure to bind to a port as fatal and exit

enableProfiling enables profiling via web interface on /debug/pprof handler. Profiling handlers will be handled by metrics server.

clusterCIDR is the CIDR range of the pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, no off-cluster bridging will be performed.

hostnameOverride, if non-empty, will be used as the identity instead of the actual hostname.

clientConnection specifies the kubeconfig file and client connection settings for the proxy server to use when communicating with the apiserver.

iptables contains iptables-related configuration options.

ipvs contains ipvs-related configuration options.

oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000]

mode specifies which proxy mode to use.

portRange is the range of host ports (beginPort-endPort, inclusive) that may be consumed in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.

udpIdleTimeout is how long an idle UDP connection will be kept open (e.g. '250ms', '2s'). Must be greater than 0. Only applicable for proxyMode=userspace.

conntrack contains conntrack-related configuration options.

configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater than 0.

nodePortAddresses is the --nodeport-addresses value for kube-proxy process. Values must be valid IP blocks. These values are as a parameter to select the interfaces where nodeport works. In case someone would like to expose a service on localhost for local visit and some other interfaces for particular purpose, a list of IP blocks would do that. If set it to "127.0.0.0/8", kube-proxy will only select the loopback interface for NodePort. If set it to a non-zero IP block, kube-proxy will filter that down to just the IPs that applied to the node. An empty string slice is meant to select all network interfaces.

winkernel contains winkernel-related configuration options.

ShowHiddenMetricsForVersion is the version for which you want to show hidden metrics.

DetectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR

DetectLocal contains optional configuration settings related to DetectLocalMode.

BridgeInterface is a string argument which represents a single bridge interface name. Kube-proxy considers traffic as local if originating from this given bridge. This argument should be set if DetectLocalMode is set to LocalModeBridgeInterface.

InterfaceNamePrefix is a string argument which represents a single interface prefix name. Kube-proxy considers traffic as local if originating from one or more interfaces which match the given prefix. This argument should be set if DetectLocalMode is set to LocalModeInterfaceNamePrefix.

maxPerCore is the maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore min).

min is the minimum value of connect-tracking records to allocate, regardless of conntrackMaxPerCore (set maxPerCore=0 to leave the limit as-is).

tcpEstablishedTimeout is how long an idle TCP connection will be kept open (e.g. '2s'). Must be greater than 0 to set.

tcpCloseWaitTimeout is how long an idle conntrack entry in CLOSE_WAIT state will remain in the conntrack table. (e.g. '60s'). Must be greater than 0 to set.

masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using the pure iptables proxy mode. Values must be within the range [0, 31].

masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode.

syncPeriod is the period that iptables rules are refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0.

minSyncPeriod is the minimum period that iptables rules are refreshed (e.g. '5s', '1m', '2h22m').

syncPeriod is the period that ipvs rules are refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0.

minSyncPeriod is the minimum period that ipvs rules are refreshed (e.g. '5s', '1m', '2h22m').

ipvs scheduler

excludeCIDRs is a list of CIDR's which the ipvs proxier should not touch when cleaning up ipvs services.

strict ARP configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface

tcpTimeout is the timeout value used for idle IPVS TCP sessions. The default value is 0, which preserves the current timeout value on the system.

tcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN. The default value is 0, which preserves the current timeout value on the system.

udpTimeout is the timeout value used for IPVS UDP packets. The default value is 0, which preserves the current timeout value on the system.

networkName is the name of the network kube-proxy will use to create endpoints and policies

sourceVip is the IP address of the source VIP endoint used for NAT when loadbalancing

enableDSR tells kube-proxy whether HNS policies should be created with DSR

RootHnsEndpointName is the name of hnsendpoint that is attached to l2bridge for root network namespace

ForwardHealthCheckVip forwards service VIP for health check port on Windows

kubeconfig is the path to a KubeConfig file.

acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular client.

contentType is the content type used when sending data to the server from this client.

qps controls the number of queries per second allowed for this connection.

burst allows extra queries to accumulate when a client is exceeding its rate.

enableProfiling enables profiling via web interface host:port/debug/pprof/

enableContentionProfiling enables lock contention profiling, if enableProfiling is true.

[Experimental] JSON contains options for logging format "json".

[Experimental] SplitStream redirects error messages to stderr while info messages go to stdout, with buffering. The default is to write both to stdout, without buffering.

[Experimental] InfoBufferSize sets the size of the info stream when using split streams. The default is zero, which disables buffering.

leaderElect enables a leader election client to gain leadership before executing the main loop. Enable this when running replicated components for high availability.

leaseDuration is the duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled.

renewDeadline is the interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled.

retryPeriod is the duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled.

resourceLock indicates the resource object type that will be used to lock during leader election cycles.

resourceName indicates the name of resource object that will be used to lock during leader election cycles.

resourceName indicates the namespace of resource object that will be used to lock during leader election cycles.

Format Flag specifies the structure of log messages. default value of format is text

Maximum number of nanoseconds (i.e. 1s = 1000000000) between log flushes. Ignored if the selected logging backend writes log messages without buffering.

Verbosity is the threshold that determines which log messages are logged. Default is zero which logs only the most important messages. Higher values enable additional messages. Error messages are always logged.

VModule overrides the verbosity threshold for individual files. Only supported for "text" log format.

[Experimental] Options holds additional parameters that are specific to the different logging formats. Only the options for the selected format get used, but all of them get validated.

kubeconfig is the path to a KubeConfig file.

acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular client.

contentType is the content type used when sending data to the server from this client.

qps controls the number of queries per second allowed for this connection.

burst allows extra queries to accumulate when a client is exceeding its rate.

enableProfiling enables profiling via web interface host:port/debug/pprof/

enableContentionProfiling enables lock contention profiling, if enableProfiling is true.

[Experimental] JSON contains options for logging format "json".

[Experimental] SplitStream redirects error messages to stderr while info messages go to stdout, with buffering. The default is to write both to stdout, without buffering.

[Experimental] InfoBufferSize sets the size of the info stream when using split streams. The default is zero, which disables buffering.

leaderElect enables a leader election client to gain leadership before executing the main loop. Enable this when running replicated components for high availability.

leaseDuration is the duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled.

renewDeadline is the interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled.

retryPeriod is the duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled.

resourceLock indicates the resource object type that will be used to lock during leader election cycles.

resourceName indicates the name of resource object that will be used to lock during leader election cycles.

resourceName indicates the namespace of resource object that will be used to lock during leader election cycles.

Format Flag specifies the structure of log messages. default value of format is text

Maximum number of nanoseconds (i.e. 1s = 1000000000) between log flushes. Ignored if the selected logging backend writes log messages without buffering.

Verbosity is the threshold that determines which log messages are logged. Default is zero which logs only the most important messages. Higher values enable additional messages. Error messages are always logged.

VModule overrides the verbosity threshold for individual files. Only supported for "text" log format.

[Experimental] Options holds additional parameters that are specific to the different logging formats. Only the options for the selected format get used, but all of them get validated.

MinCandidateNodesPercentage is the minimum number of candidates to shortlist when dry running preemption as a percentage of number of nodes. Must be in the range [0, 100]. Defaults to 10% of the cluster size if unspecified.

MinCandidateNodesAbsolute is the absolute minimum number of candidates to shortlist. The likely number of candidates enumerated for dry running preemption is given by the formula: numCandidates = max(numNodes * minCandidateNodesPercentage, minCandidateNodesAbsolute) We say "likely" because there are other factors such as PDB violations that play a role in the number of candidates shortlisted. Must be at least 0 nodes. Defaults to 100 nodes if unspecified.

HardPodAffinityWeight is the scoring weight for existing pods with a matching hard affinity to the incoming pod.

Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16

LeaderElection defines the configuration of leader election client.

ClientConnection specifies the kubeconfig file and client connection settings for the proxy server to use when communicating with the apiserver.

Note: Both HealthzBindAddress and MetricsBindAddress fields are deprecated. Only empty address or port 0 is allowed. Anything else will fail validation. HealthzBindAddress is the IP address and port for the health check server to serve on.

MetricsBindAddress is the IP address and port for the metrics server to serve on.

DebuggingConfiguration holds configuration for Debugging related features TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration

PercentageOfNodesToScore is the percentage of all nodes that once found feasible for running a pod, the scheduler stops its search for more feasible nodes in the cluster. This helps improve scheduler's performance. Scheduler always tries to find at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. Example: if the cluster size is 500 nodes and the value of this flag is 30, then scheduler stops finding further feasible nodes once it finds 150 feasible ones. When the value is 0, default percentage (5%--50% based on the size of the cluster) of the nodes will be scored.

PodInitialBackoffSeconds is the initial backoff for unschedulable pods. If specified, it must be greater than 0. If this value is null, the default value (1s) will be used.

PodMaxBackoffSeconds is the max backoff for unschedulable pods. If specified, it must be greater than podInitialBackoffSeconds. If this value is null, the default value (10s) will be used.

Profiles are scheduling profiles that kube-scheduler supports. Pods can choose to be scheduled under a particular profile by setting its associated scheduler name. Pods that don't specify any scheduler name are scheduled with the "default-scheduler" profile, if present here.

Extenders are the list of scheduler extenders, each holding the values of how to communicate with the extender. These extenders are shared by all scheduler profiles.

AddedAffinity is applied to all Pods additionally to the NodeAffinity specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes match). When AddedAffinity is used, some Pods with affinity requirements that match a specific Node (such as Daemonset Pods) might remain unschedulable.

Resources to be managed, the default is "cpu" and "memory" if not specified.

IgnoredResources is the list of resources that NodeResources fit filter should ignore. This doesn't apply to scoring.

IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. e.g. if group is ["example.com"], it will ignore all resource names that begin with "example.com", such as "example.com/aaa" and "example.com/bbb". A resource group name can't contain '/'. This doesn't apply to scoring.

ScoringStrategy selects the node resource scoring strategy. The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.

DefaultConstraints defines topology spread constraints to be applied to Pods that don't define any in pod.spec.topologySpreadConstraints. .defaultConstraints[*].labelSelectors must be empty, as they are deduced from the Pod's membership to Services, ReplicationControllers, ReplicaSets or StatefulSets. When not empty, .defaultingType must be "List".

DefaultingType determines how .defaultConstraints are deduced. Can be one of "System" or "List".

• "System": Use kubernetes defined constraints that spread Pods among Nodes and Zones.
• "List": Use constraints defined in .defaultConstraints.

Defaults to "System".

BindTimeoutSeconds is the timeout in seconds in volume binding operation. Value must be non-negative integer. The value zero indicates no waiting. If this value is nil, the default value (600) will be used.

Shape specifies the points defining the score function shape, which is used to score nodes based on the utilization of statically provisioned PVs. The utilization is calculated by dividing the total requested storage of the pod by the total capacity of feasible PVs on each node. Each point contains utilization (ranges from 0 to 100) and its associated score (ranges from 0 to 10). You can turn the priority by specifying different scores for different utilization numbers. The default shape points are:

1. 0 for 0 utilization
2. 10 for 100 utilization All points must be sorted in increasing order by utilization.

URLPrefix at which the extender is available

Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.

Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.

Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.

The numeric multiplier for the node scores that the prioritize call generates. The weight should be a positive integer

Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender can implement this function.

EnableHTTPS specifies whether https should be used to communicate with the extender

TLSConfig specifies the transport layer security config

HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize timeout is ignored, k8s/other extenders priorities are used to select the node.

NodeCacheCapable specifies that the extender is capable of caching node information, so the scheduler should only send minimal information about the eligible nodes assuming that the extender already cached full details of all nodes in the cluster

ManagedResources is a list of extended resources that are managed by this extender.

• A pod will be sent to the extender on the Filter, Prioritize and Bind (if the extender is the binder) phases iff the pod requests at least one of the extended resources in this list. If empty or unspecified, all pods will be sent to this extender.
• If IgnoredByScheduler is set to true for a resource, kube-scheduler will skip checking the resource in predicates.

Ignorable specifies if the extender is ignorable, i.e. scheduling should not fail when the extender returns an error or is not reachable.

Name is the extended resource name.

IgnoredByScheduler indicates whether kube-scheduler should ignore this resource when applying predicates.

Server should be accessed without verifying the TLS certificate. For testing only.

ServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.

Server requires TLS client certificate authentication

Server requires TLS client certificate authentication

Trusted root certificates for server

CertData holds PEM-encoded bytes (typically read from a client certificate file). CertData takes precedence over CertFile

KeyData holds PEM-encoded bytes (typically read from a client certificate key file). KeyData takes precedence over KeyFile

CAData holds PEM-encoded bytes (typically read from a root certificates bundle). CAData takes precedence over CAFile

SchedulerName is the name of the scheduler associated to this profile. If SchedulerName matches with the pod's "spec.schedulerName", then the pod is scheduled with this profile.

Plugins specify the set of plugins that should be enabled or disabled. Enabled plugins are the ones that should be enabled in addition to the default plugins. Disabled plugins are any of the default plugins that should be disabled. When no enabled or disabled plugin is specified for an extension point, default plugins for that extension point will be used if there is any. If a QueueSort plugin is specified, the same QueueSort Plugin and PluginConfig must be specified for all profiles.

PluginConfig is an optional set of custom plugin arguments for each plugin. Omitting config args for a plugin is equivalent to using the default config for that plugin.

Name defines the name of plugin

Weight defines the weight of plugin, only used for Score plugins.

Name defines the name of plugin being configured

Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.

Enabled specifies plugins that should be enabled in addition to default plugins. If the default plugin is also configured in the scheduler config file, the weight of plugin will be overridden accordingly. These are called after default plugins and in the same order specified here.

Disabled specifies default plugins that should be disabled. When all default plugins need to be disabled, an array containing only one "*" should be provided.

QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.

PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.

Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.

PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod.

PreScore is a list of plugins that are invoked before scoring.

Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.

Reserve is a list of plugins invoked when reserving/unreserving resources after a node is assigned to run the pod.

Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.

PreBind is a list of plugins that should be invoked before a pod is bound.

Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.

PostBind is a list of plugins that should be invoked after a pod is successfully bound.

MultiPoint is a simplified config section to enable plugins for all valid extension points.

Shape is a list of points defining the scoring function shape.

Name of the resource.

Weight of the resource.

Type selects which strategy to run.

Resources to consider when scoring. The default resource set includes "cpu" and "memory" with an equal weight. Allowed weights go from 1 to 100. Weight defaults to 1 if not specified or explicitly set to 0.

Arguments specific to RequestedToCapacityRatio strategy.

Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.

Score assigned to given utilization (y axis). Valid values are 0 to 10.

kubeconfig is the path to a KubeConfig file.

acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular client.

contentType is the content type used when sending data to the server from this client.

qps controls the number of queries per second allowed for this connection.

burst allows extra queries to accumulate when a client is exceeding its rate.

enableProfiling enables profiling via web interface host:port/debug/pprof/

enableContentionProfiling enables lock contention profiling, if enableProfiling is true.

[Experimental] JSON contains options for logging format "json".

[Experimental] SplitStream redirects error messages to stderr while info messages go to stdout, with buffering. The default is to write both to stdout, without buffering.

[Experimental] InfoBufferSize sets the size of the info stream when using split streams. The default is zero, which disables buffering.

leaderElect enables a leader election client to gain leadership before executing the main loop. Enable this when running replicated components for high availability.

leaseDuration is the duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled.

renewDeadline is the interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled.

retryPeriod is the duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled.

resourceLock indicates the resource object type that will be used to lock during leader election cycles.

resourceName indicates the name of resource object that will be used to lock during leader election cycles.

resourceName indicates the namespace of resource object that will be used to lock during leader election cycles.

Format Flag specifies the structure of log messages. default value of format is text

Maximum number of nanoseconds (i.e. 1s = 1000000000) between log flushes. Ignored if the selected logging backend writes log messages without buffering.

Verbosity is the threshold that determines which log messages are logged. Default is zero which logs only the most important messages. Higher values enable additional messages. Error messages are always logged.

VModule overrides the verbosity threshold for individual files. Only supported for "text" log format.

[Experimental] Options holds additional parameters that are specific to the different logging formats. Only the options for the selected format get used, but all of them get validated.

MinCandidateNodesPercentage is the minimum number of candidates to shortlist when dry running preemption as a percentage of number of nodes. Must be in the range [0, 100]. Defaults to 10% of the cluster size if unspecified.

MinCandidateNodesAbsolute is the absolute minimum number of candidates to shortlist. The likely number of candidates enumerated for dry running preemption is given by the formula: numCandidates = max(numNodes * minCandidateNodesPercentage, minCandidateNodesAbsolute) We say "likely" because there are other factors such as PDB violations that play a role in the number of candidates shortlisted. Must be at least 0 nodes. Defaults to 100 nodes if unspecified.

HardPodAffinityWeight is the scoring weight for existing pods with a matching hard affinity to the incoming pod.

Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16

LeaderElection defines the configuration of leader election client.

ClientConnection specifies the kubeconfig file and client connection settings for the proxy server to use when communicating with the apiserver.

DebuggingConfiguration holds configuration for Debugging related features TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration

PercentageOfNodesToScore is the percentage of all nodes that once found feasible for running a pod, the scheduler stops its search for more feasible nodes in the cluster. This helps improve scheduler's performance. Scheduler always tries to find at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. Example: if the cluster size is 500 nodes and the value of this flag is 30, then scheduler stops finding further feasible nodes once it finds 150 feasible ones. When the value is 0, default percentage (5%--50% based on the size of the cluster) of the nodes will be scored.

PodInitialBackoffSeconds is the initial backoff for unschedulable pods. If specified, it must be greater than 0. If this value is null, the default value (1s) will be used.

PodMaxBackoffSeconds is the max backoff for unschedulable pods. If specified, it must be greater than podInitialBackoffSeconds. If this value is null, the default value (10s) will be used.

Profiles are scheduling profiles that kube-scheduler supports. Pods can choose to be scheduled under a particular profile by setting its associated scheduler name. Pods that don't specify any scheduler name are scheduled with the "default-scheduler" profile, if present here.

Extenders are the list of scheduler extenders, each holding the values of how to communicate with the extender. These extenders are shared by all scheduler profiles.

AddedAffinity is applied to all Pods additionally to the NodeAffinity specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes match). When AddedAffinity is used, some Pods with affinity requirements that match a specific Node (such as Daemonset Pods) might remain unschedulable.

Resources to be managed, the default is "cpu" and "memory" if not specified.

IgnoredResources is the list of resources that NodeResources fit filter should ignore. This doesn't apply to scoring.

IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. e.g. if group is ["example.com"], it will ignore all resource names that begin with "example.com", such as "example.com/aaa" and "example.com/bbb". A resource group name can't contain '/'. This doesn't apply to scoring.

ScoringStrategy selects the node resource scoring strategy. The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.

DefaultConstraints defines topology spread constraints to be applied to Pods that don't define any in pod.spec.topologySpreadConstraints. .defaultConstraints[*].labelSelectors must be empty, as they are deduced from the Pod's membership to Services, ReplicationControllers, ReplicaSets or StatefulSets. When not empty, .defaultingType must be "List".

DefaultingType determines how .defaultConstraints are deduced. Can be one of "System" or "List".

• "System": Use kubernetes defined constraints that spread Pods among Nodes and Zones.
• "List": Use constraints defined in .defaultConstraints.

Defaults to "System".

BindTimeoutSeconds is the timeout in seconds in volume binding operation. Value must be non-negative integer. The value zero indicates no waiting. If this value is nil, the default value (600) will be used.

Shape specifies the points defining the score function shape, which is used to score nodes based on the utilization of statically provisioned PVs. The utilization is calculated by dividing the total requested storage of the pod by the total capacity of feasible PVs on each node. Each point contains utilization (ranges from 0 to 100) and its associated score (ranges from 0 to 10). You can turn the priority by specifying different scores for different utilization numbers. The default shape points are:

1. 0 for 0 utilization
2. 10 for 100 utilization All points must be sorted in increasing order by utilization.

URLPrefix at which the extender is available

Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.

Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.

Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.

The numeric multiplier for the node scores that the prioritize call generates. The weight should be a positive integer

Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender can implement this function.

EnableHTTPS specifies whether https should be used to communicate with the extender

TLSConfig specifies the transport layer security config

HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize timeout is ignored, k8s/other extenders priorities are used to select the node.

NodeCacheCapable specifies that the extender is capable of caching node information, so the scheduler should only send minimal information about the eligible nodes assuming that the extender already cached full details of all nodes in the cluster

ManagedResources is a list of extended resources that are managed by this extender.

• A pod will be sent to the extender on the Filter, Prioritize and Bind (if the extender is the binder) phases iff the pod requests at least one of the extended resources in this list. If empty or unspecified, all pods will be sent to this extender.
• If IgnoredByScheduler is set to true for a resource, kube-scheduler will skip checking the resource in predicates.

Ignorable specifies if the extender is ignorable, i.e. scheduling should not fail when the extender returns an error or is not reachable.

Name is the extended resource name.

IgnoredByScheduler indicates whether kube-scheduler should ignore this resource when applying predicates.

Server should be accessed without verifying the TLS certificate. For testing only.

ServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.

Server requires TLS client certificate authentication

Server requires TLS client certificate authentication

Trusted root certificates for server

CertData holds PEM-encoded bytes (typically read from a client certificate file). CertData takes precedence over CertFile

KeyData holds PEM-encoded bytes (typically read from a client certificate key file). KeyData takes precedence over KeyFile

CAData holds PEM-encoded bytes (typically read from a root certificates bundle). CAData takes precedence over CAFile

SchedulerName is the name of the scheduler associated to this profile. If SchedulerName matches with the pod's "spec.schedulerName", then the pod is scheduled with this profile.

Plugins specify the set of plugins that should be enabled or disabled. Enabled plugins are the ones that should be enabled in addition to the default plugins. Disabled plugins are any of the default plugins that should be disabled. When no enabled or disabled plugin is specified for an extension point, default plugins for that extension point will be used if there is any. If a QueueSort plugin is specified, the same QueueSort Plugin and PluginConfig must be specified for all profiles.

PluginConfig is an optional set of custom plugin arguments for each plugin. Omitting config args for a plugin is equivalent to using the default config for that plugin.

Name defines the name of plugin

Weight defines the weight of plugin, only used for Score plugins.

Name defines the name of plugin being configured

Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.

Enabled specifies plugins that should be enabled in addition to default plugins. If the default plugin is also configured in the scheduler config file, the weight of plugin will be overridden accordingly. These are called after default plugins and in the same order specified here.

Disabled specifies default plugins that should be disabled. When all default plugins need to be disabled, an array containing only one "*" should be provided.

QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.

PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.

Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.

PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod.

PreScore is a list of plugins that are invoked before scoring.

Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.

Reserve is a list of plugins invoked when reserving/unreserving resources after a node is assigned to run the pod.

Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.

PreBind is a list of plugins that should be invoked before a pod is bound.

Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.

PostBind is a list of plugins that should be invoked after a pod is successfully bound.

MultiPoint is a simplified config section to enable plugins for all valid extension points. Plugins enabled through MultiPoint will automatically register for every individual extension point the plugin has implemented. Disabling a plugin through MultiPoint disables that behavior. The same is true for disabling "*" through MultiPoint (no default plugins will be automatically registered). Plugins can still be disabled through their individual extension points.

In terms of precedence, plugin config follows this basic hierarchy

1. Specific extension points
2. Explicitly configured MultiPoint plugins
3. The set of default plugins, as MultiPoint plugins This implies that a higher precedence plugin will run first and overwrite any settings within MultiPoint. Explicitly user-configured plugins also take a higher precedence over default plugins. Within this hierarchy, an Enabled setting takes precedence over Disabled. For example, if a plugin is set in both multiPoint.Enabled and multiPoint.Disabled, the plugin will be enabled. Similarly, including multiPoint.Disabled = '*' and multiPoint.Enabled = pluginA will still register that specific plugin through MultiPoint. This follows the same behavior as all other extension point configurations.

Shape is a list of points defining the scoring function shape.

Name of the resource.

Weight of the resource.

Type selects which strategy to run.

Resources to consider when scoring. The default resource set includes "cpu" and "memory" with an equal weight. Allowed weights go from 1 to 100. Weight defaults to 1 if not specified or explicitly set to 0.

Arguments specific to RequestedToCapacityRatio strategy.

Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.

Score assigned to given utilization (y axis). Valid values are 0 to 10.

etcd holds configuration for etcd.

networking holds configuration for the networking topology of the cluster.

kubernetesVersion is the target version of the control plane.

controlPlaneEndpoint sets a stable IP address or DNS name for the control plane; it can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. In case the controlPlaneEndpoint is not specified, the advertiseAddress + bindPort are used; in case the controlPlaneEndpoint is specified but without a TCP port, the bindPort is used. Possible usages are:

• In a cluster with more than one control plane instances, this field should be assigned the address of the external load balancer in front of the control plane instances.
• In environments with enforced node recycling, the controlPlaneEndpoint could be used for assigning a stable DNS to the control plane.

apiServer contains extra settings for the API server.

controllerManager contains extra settings for the controller manager.

scheduler contains extra settings for the scheduler.

dns defines the options for the DNS add-on installed in the cluster.

certificatesDir specifies where to store or look for all required certificates.

imageRepository sets the container registry to pull images from. If empty, k8s.gcr.io will be used by default; in case of kubernetes version is a CI build (kubernetes version starts with ci/) gcr.io/k8s-staging-ci-images is used as a default for control plane components and for kube-proxy, while k8s.gcr.io will be used for all the other images.

useHyperKubeImage controls if hyperkube should be used for Kubernetes components instead of their respective separate images. DEPRECATED: As hyperkube is itself deprecated, this fields is too. It will be removed in future kubeadm config versions, kubeadm will print multiple warnings when this set to true, and at some point it may become ignored.

featureGates contains the feature gates enabled by the user.

The cluster name.

apiEndpoints currently available in the cluster, one for each control plane/API server instance. The key of the map is the IP of the host's default interface.

bootstrapTokens is respected at kubeadm init time and describes a set of bootstrap tokens to create. This information IS NOT uploaded to the kubeadm cluster ConfigMap, partly because of its sensitive nature.

nodeRegistration holds fields that relate to registering the new control-plane node to the cluster.

localAPIEndpoint represents the endpoint of the API server instance that's deployed on this control plane node. In HA setups, this differs from ClusterConfiguration.controlPlaneEndpoint in the sense that ControlPlaneEndpoint is the global endpoint for the cluster, which then load-balances the requests to each individual API server. This configuration object lets you customize what IP/DNS name and port the local API server advertises it's accessible on. By default, kubeadm tries to auto-detect the IP of the default interface and use that, but in case that process fails you may set the desired value here.

certificateKey sets the key with which certificates and keys are encrypted prior to being uploaded in a secret in the cluster during the uploadcerts init phase.

nodeRegistration holds fields that relate to registering the new control-plane node to the cluster

caCertPath is the path to the SSL certificate authority used to secure comunications between a node and the control-plane. Defaults to "/etc/kubernetes/pki/ca.crt".

discovery specifies the options for the kubelet to use during the TLS bootstrap process.

controlPlane defines the additional control plane instance to be deployed on the joining node. If nil, no additional control plane instance will be deployed.

advertiseAddress sets the IP address for the API server to advertise.

bindPort sets the secure port for the API Server to bind to. Defaults to 6443.

certSANs sets extra Subject Alternative Names (SANs) for the API Server signing certificate.

timeoutForControlPlane controls the timeout that we wait for the API server to appear.

token is used for establishing bidirectional trust between nodes and control-planes. Used for joining nodes in the cluster.

description sets a human-friendly message why this token exists and what it's used for, so other administrators can know its purpose.

ttl defines the time to live for this token. Defaults to '24h'. expires and ttl are mutually exclusive.

expires specifies the timestamp when this token expires. Defaults to being set dynamically at runtime based on the ttl. expires and ttl are mutually exclusive.

usages describes the ways in which this token can be used. Can by default be used for establishing bidirectional trust, but that can be changed here.

groups specifies the extra groups that this token will authenticate as when/if used for authentication.

token is a token used to validate cluster information fetched from the control-plane.

apiServerEndpoint is an IP or domain name to the API server from which information will be fetched.

caCertHashes specifies a set of public key pins to verify when token-based discovery is used. The root CA found during discovery must match one of these values. Specifying an empty set disables root CA pinning, which can be unsafe. Each hash is specified as ":", where the only currently supported type is "sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key Info (SPKI) object in DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL.

unsafeSkipCAVerification allows token-based discovery without CA verification via caCertHashes. This can weaken the security of kubeadm since other nodes can impersonate the control-plane.

extraArgs is an extra set of flags to pass to a control plane component. A key in this map is the flag name as it appears on the command line except without leading dash(es).

extraVolumes is an extra set of host volumes mounted to the control plane component.

type defines the DNS add-on to be used.

ImageMeta allows to customize the image used for the DNS component

bootstrapToken is used to set the options for bootstrap token based discovery. bootstrapToken and file are mutually exclusive.

file is used to specify a file or URL to a kubeconfig file from which to load cluster information. bootstrapToken and file are mutually exclusive.

tlsBootstrapToken is a token used for TLS bootstrapping. If bootstrapToken is set, this field is defaulted to .bootstrapToken.token, but can be overridden. If file is set, this field must be set in case the KubeConfigFile does not contain any other authentication information.

timeout modifies the discovery timeout.

local provides configuration knobs for configuring the local etcd instance. local and external are mutually exclusive.

external describes how to connect to an external etcd cluster. local and external are mutually exclusive.

endpoints of etcd members.

caFile is an SSL Certificate Authority (CA) file used to secure etcd communication. Required if using a TLS connection.

certFile is an SSL certification file used to secure etcd communication. Required if using a TLS connection.

keyFile is an SSL key file used to secure etcd communication. Required if using a TLS connection.

kubeConfigPath is used to specify the actual file path or URL to the kubeconfig file from which to load cluster information.

name of the volume inside the Pod template.

hostPath is the path in the host that will be mounted inside the Pod.

mountPathis the path inside the Pod where hostPath volume will be mounted.

readOnly controls write access to the volume.

pathType is the type of the HostPath.

imageRepository sets the container registry to pull images from. If not set, the imageRepository defined in ClusterConfiguration will be used.

imageTag allows for specifying a tag for the image. In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.

localAPIEndpoint represents the endpoint of the API server instance to be deployed on this node.

certificateKey is the key that is used for decryption of certificates after they are downloaded from the secret upon joining a new control plane node. The corresponding encryption key is in the InitConfiguration.

ImageMeta allows to customize the container used for etcd.

dataDir is the directory etcd will place its data. Defaults to "/var/lib/etcd".

extraArgs are extra arguments provided to the etcd binary when run inside a static pod. A key in this map is the flag name as it appears on the command line except without leading dash(es).

serverCertSANs sets extra Subject Alternative Names (SANs) for the etcd server signing certificate.

peerCertSANs sets extra Subject Alternative Names (SANs) for the etcd peer signing certificate.

serviceSubnet is the subnet used by kubernetes Services. Defaults to "10.96.0.0/12".

podSubnet is the subnet used by Pods.

dnsDomain is the DNS domain used by kubernetes Services. Defaults to "cluster.local".

name is the .Metadata.Name field of the Node API object that will be created in this kubeadm init or kubeadm join operation. This field is also used in the CommonName field of the kubelet's client certificate to the API server. Defaults to the hostname of the node if not provided.

criSocket is used to retrieve container runtime information. This information will be annotated to the Node API object, for later re-use.

taints specifies the taints the Node API object should be registered with. If this field is unset, i.e. nil, in the kubeadm init process it will be defaulted with a control-plane taint for control-plane nodes. If you don't want to taint your control-plane node, set this field to an empty list, i.e. taints: [], in the YAML file. This field is solely used for Node registration.

kubeletExtraArgs passes through extra arguments to the kubelet. The arguments here are passed to the kubelet command line via the environment file kubeadm writes at runtime for the kubelet to source. This overrides the generic base-level configuration in the 'kubelet-config-1.X' ConfigMap. Flags have higher priority when parsing. These values are local and specific to the node kubeadm is executing on. A key in this map is the flag name as it appears on the command line except without leading dash(es).

ignorePreflightErrors provides a list of pre-flight errors to be ignored when the current node is registered.

etcd holds the configuration for etcd.

networking holds configuration for the networking topology of the cluster.

kubernetesVersion is the target version of the control plane.

controlPlaneEndpoint sets a stable IP address or DNS name for the control plane. It can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. In case the controlPlaneEndpoint is not specified, the advertiseAddress + bindPort are used; in case the controlPlaneEndpoint is specified but without a TCP port, the bindPort is used. Possible usages are:

• In a cluster with more than one control plane instances, this field should be assigned the address of the external load balancer in front of the control plane instances.
• In environments with enforced node recycling, the controlPlaneEndpoint could be used for assigning a stable DNS to the control plane.

apiServer contains extra settings for the API server.

controllerManager contains extra settings for the controller manager.

scheduler contains extra settings for the scheduler.

dns defines the options for the DNS add-on installed in the cluster.

certificatesDir specifies where to store or look for all required certificates.

imageRepository sets the container registry to pull images from. If empty, k8s.gcr.io will be used by default. In case of kubernetes version is a CI build (kubernetes version starts with ci/) gcr.io/k8s-staging-ci-images will be used as a default for control plane components and for kube-proxy, while k8s.gcr.io will be used for all the other images.

featureGates contains the feature gates enabled by the user.

The cluster name.

bootstrapTokens is respected at kubeadm init time and describes a set of Bootstrap Tokens to create. This information IS NOT uploaded to the kubeadm cluster configmap, partly because of its sensitive nature

nodeRegistration holds fields that relate to registering the new control-plane node to the cluster.

localAPIEndpoint represents the endpoint of the API server instance that's deployed on this control plane node. In HA setups, this differs from ClusterConfiguration.controlPlaneEndpoint in the sense that controlPlaneEndpoint is the global endpoint for the cluster, which then load-balances the requests to each individual API server. This configuration object lets you customize what IP/DNS name and port the local API server advertises it's accessible on. By default, kubeadm tries to auto-detect the IP of the default interface and use that, but in case that process fails you may set the desired value here.

certificateKey sets the key with which certificates and keys are encrypted prior to being uploaded in a Secret in the cluster during the uploadcerts init phase.

skipPhases is a list of phases to skip during command execution. The list of phases can be obtained with the kubeadm init --help command. The flag "--skip-phases" takes precedence over this field.

patches contains options related to applying patches to components deployed by kubeadm during kubeadm init.

nodeRegistration holds fields that relate to registering the new control-plane node to the cluster.

caCertPath is the path to the SSL certificate authority used to secure comunications between a node and the control-plane. Defaults to "/etc/kubernetes/pki/ca.crt".

discovery specifies the options for the kubelet to use during the TLS bootstrap process.

controlPlane defines the additional control plane instance to be deployed on the joining node. If nil, no additional control plane instance will be deployed.

skipPhases is a list of phases to skip during command execution. The list of phases can be obtained with the kubeadm join --help command. The flag --skip-phases takes precedence over this field.

patches contains options related to applying patches to components deployed by kubeadm during kubeadm join.

advertiseAddress sets the IP address for the API server to advertise.

bindPort sets the secure port for the API Server to bind to. Defaults to 6443.

certSANs sets extra Subject Alternative Names (SANs) for the API Server signing certificate.

timeoutForControlPlane controls the timeout that we wait for API server to appear.

token is a token used to validate cluster information fetched from the control-plane.

apiServerEndpoint is an IP or domain name to the API server from which information will be fetched.

caCertHashes specifies a set of public key pins to verify when token-based discovery is used. The root CA found during discovery must match one of these values. Specifying an empty set disables root CA pinning, which can be unsafe. Each hash is specified as ":", where the only currently supported type is "sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key Info (SPKI) object in DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL.

unsafeSkipCAVerification allows token-based discovery without CA verification via caCertHashes. This can weaken the security of kubeadm since other nodes can impersonate the control-plane.

extraArgs is an extra set of flags to pass to the control plane component. A key in this map is the flag name as it appears on the command line except without leading dash(es).