MkeConfig#
MkeConfig is the primary configuration resource for an MKE 4 cluster. The mke4.yaml configuration file that you pass to mkectl apply is an MkeConfig object, and the operator reconciles the cluster to match its spec.
MkeConfig
Kind
Kind
mke.mirantis.com
Group
Group
v1alpha1
Version
Version
apiVersion: mke.mirantis.com/v1alpha1
kind: MkeConfig
MkeConfig is the Schema for the mkeconfigs API
Scope: Namespaced · Source: mke.mirantis.com_mkeconfigs.yaml
spec object
spec is the desired state of the MKE cluster.airgap object
airgap configures MKE installation in an airgapped environment.bastion object
bastion is the bastion host used to reach the cluster nodes.address string required
address is the host address: an IP address or an RFC 1123 hostname.keyPath string required
keyPath is the path to the SSH private key file.port integer required
port is the SSH port.user string required
user is the SSH user name.enabled boolean required
enabled marks the cluster as installed in an airgapped environment. Defaults to false.apiServer object required
apiServer configures the Kubernetes API server.alwaysPullImages boolean
alwaysPullImages enables the AlwaysPullImages admission controller.audit object
audit configures audit logging for the API server.customPolicyYaml string
customPolicyYaml is a custom audit policy in YAML. When set, level is ignored.enabled boolean required
enabled enables audit logging for the API server. Defaults to false.level string
level is the audit log level. Defaults to Metadata.maxAge integer
maxAge is the number of days to retain rotated audit log files, by the timestamp in their name. Defaults to 30.maxBackup integer
maxBackup is the number of rotated audit log files to retain. 0 means unlimited. Defaults to 10.maxSize integer
maxSize is the size in megabytes at which the audit log file is rotated. Defaults to 10.policyFile string
policyFile is the path to the audit policy file. Defaults to /etc/audit_policy.yaml.webhookConfigPath string
webhookConfigPath is the path to the audit webhook backend configuration file.encryptionProvider string
encryptionProvider is the path to a custom EncryptionConfig file for the API server. Defaults to encryption.cfg in the k0s data directory.eventRateLimit object
eventRateLimit configures the EventRateLimit admission controller.enabled boolean required
enabled enables the EventRateLimit admission controller. Defaults to false.limits []object
limits lists the rate limits. At least one is required when enabled.limit string required
limit is the limit type: Namespace, User, SourceAndObject or Server.limitBurst integer required
limitBurst is the maximum burst of events allowed for this limit type. For example, with limitBurst: 10 and limitQPS: 3, 10 events are accepted at once, then 3 more per second; unused allowance carries over up to 10.limitCacheSize integer
limitCacheSize is the size of the LRU cache of rate-limit buckets. An evicted bucket starts over with a full burst allowance. Defaults to 4096.limitQPS integer required
limitQPS is the number of events per second allowed for this limit type once the burst is exhausted.externalAddress string required
externalAddress is the address clients use to reach the cluster, as host or host:port. Must be lowercase.
A port in this value is the MKE Gateway HTTPS node port (spec.gatewayMKEIngress.nodePorts.https, 33001 by default).extraArgs map[string]string
extraArgs sets extra arguments passed to kube-apiserver.port integer
port is the port kube-apiserver listens on. Defaults to 6443.profilingEnabled boolean
profilingEnabled enables profiling on the API server at /debug/pprof/.requestTimeout string
requestTimeout is how long a request may stay open before the API server times it out. Defaults to 1m0s.sans []string
sans lists extra Subject Alternative Names for the API server serving certificate. Entries may be IP addresses or DNS names.tlsCipherSuites []string
tlsCipherSuites lists the TLS cipher suites enabled for the API server.ucpauthz object
ucpauthz configures the mke4-ucpauthz ValidatingAdmissionPolicy.disabled boolean
disabled disables the policy.exemptNamespaces []string
exemptNamespaces lists additional namespaces exempt from the policy.exemptUsers []string
exemptUsers lists additional service accounts exempt from the policy.noDefaultUserExemptions boolean
noDefaultUserExemptions removes the default user exemptions, which are the service accounts of the MKE-managed Calico components.valuesYaml string
valuesYaml sets raw Helm values for the policy chart, in YAML. When set, it overrides all other fields here.authentication object required
authentication configures MKE authentication.audience []string
audience lists the audiences for the aud claim of Dex-issued ID tokens and access tokens.authenticatedUsers object
authenticatedUsers sets the permissions granted to every authenticated user (the system:authenticated group).grants object
grants sets the permissions granted to every authenticated user.nodeAccess boolean
nodeAccess grants cluster-wide read access to nodes by binding the mke-viewer-role cluster role. Defaults to false.prometheusAccess boolean
prometheusAccess grants access to the Prometheus service proxy in the mke namespace by binding the mke-prometheus-access role. Defaults to false.clients []object
clients lists predefined OIDC clients.id string
id is the OIDC client id.name string
name is the display name shown to users at login.public boolean
public marks the client as public (for example CLI or mobile apps), disabling client secret checks.redirectURIs []string
redirectURIs lists the allowed redirect URIs. They must match the application's callback URLs exactly.secret string
secret is the client secret. Not required for public clients.credentialsSecretName string
credentialsSecretName is the name of a pre-created Secret of type mke.mirantis.com/auth-credentials holding the authentication secrets under the keys ldapBindPassword, oidcClientSecret and oidcClientId. When set, the operator reads credentials from it and does not modify spec. Cannot be combined with the deprecated inline fields ldap.bindPW, oidc.clientSecret and oidc.clientID. CA data (ldap.caData, saml.caData and oidc.rootCAs) stays in spec; the Secret's CA keys are read only as a fallback for clusters upgraded from MKE 4.2.0.expiry object
expiry sets token and key expiration. Durations are a number with a unit (s, m, h), for example 10m. The example shows the defaults.deviceRequests string
deviceRequests is the time frame in which users can authorize a device to receive an access or ID token.idTokens string
idTokens is the ID token lifetime. Short lifetimes such as 10m are recommended. Defaults to 1h.refreshTokens object
refreshTokens sets the refresh token expiration. When unset, defaults to validIfNotUsedFor: 4h and absoluteLifetime: 12h; when set, only the fields given apply.absoluteLifetime string
absoluteLifetime is the absolute lifetime of a refresh token. After it, users must authenticate again.reuseInterval string
reuseInterval is the period during which the refresh endpoint returns the same refresh token, provided the request carries the previous one.validIfNotUsedFor string
validIfNotUsedFor invalidates refresh tokens unused for this long.signingKeys string
signingKeys is the signing key rotation period. Public keys stay available for validation until the ID tokens signed with them expire.ldap object required
ldap configures Lightweight Directory Access Protocol (ldap) authentication.bindDN string
bindDN is the Distinguished Name of the service account used with bindPW to search for users and groups. Not required for anonymous access.
Example: bindDN: "uid=serviceaccount,cn=users,dc=example,dc=com"bindPW string
bindPW is the password of the service account identified by bindDN. Not required for anonymous access. Prefer the ldapBindPassword key of the Secret referenced by credentialsSecretName; this inline field is deprecated and will be removed.ca string
ca is the path to the trusted root ca certificate file inside the Dex Pod. The file must be mounted manually. Alternative to caData.caData string
caData is the trusted root CA certificate, PEM-encoded. Alternative to ca.enabled boolean required
enabled enables LDAP authentication. Defaults to false.groupSearch object
groupSearch finds the groups of a user entry.baseDN string
baseDN is the base DN of the group search. The query is (&(<filter>)(<userMatchers[].groupAttr>=<user attribute>)).
Example: baseDN: "cn=groups,dc=freeipa,dc=example,dc=com"filter string
filter is the filter for the group search.
Example: filter: "(objectClass=group)"nameAttr string
nameAttr is the attribute holding the group name.
Example: nameAttr: "cn"userMatchers []object
userMatchers lists attribute pairs that match a user to a group: the group attribute must equal the user attribute.
Example: userMatchers: [{userAttr: "dn", groupAttr: "member"}]groupAttr string
groupAttr is the group attribute listing the members.
Example: groupAttr: "member"userAttr string
userAttr is the user attribute compared with the group attribute. Usually the same as userSearch.idAttr.
Example: userAttr: "uid"host string
host is the LDAP server, as host or host:port. Without a port, 389 is used with insecureNoSSL or startTLS, 636 otherwise.insecureNoSSL boolean
insecureNoSSL connects without TLS. Required when the LDAP server does not use TLS (port 389).insecureSkipVerify boolean
insecureSkipVerify disables verification of the server TLS certificate. For testing only.noSimplePagination boolean
noSimplePagination omits the Simple Paged Results control from LDAP user and group synchronization searches, for directory servers that reject or mishandle the control. Defaults to false, which paginates searches.startTLS boolean
startTLS connects over ldap:// and upgrades the connection with startTLS. Otherwise ldaps:// is used.userSearch object
userSearch maps the entered username and password to an LDAP user entry.baseDN string
baseDN is the base DN of the user search. The query is (&(<filter>)(<username>=<entered username>)).
Example: baseDN: "cn=users,dc=example,dc=com"emailAttr string
emailAttr is the attribute mapped to the user email.
Example: emailAttr: "mail"filter string
filter is an optional filter for the user search.
Example: filter: "(objectClass=person)"idAttr string
idAttr is the attribute uniquely identifying the user. Usually the same as groupSearch.userMatchers[].userAttr.
Example: idAttr: "DN" or idAttr: "uid"nameAttr string
nameAttr is the attribute mapped to the user display name.
Example: nameAttr: "name"preferredUsernameAttr string
preferredUsernameAttr is the attribute mapped to the preferred username. When set, it replaces the username value.
Example: preferredUsernameAttr: "uid"username string
username is the attribute compared with the entered username, as (<attr>=<username>).
Example: username: "uid"usernamePrompt string
usernamePrompt is the label of the username field on the login form. Defaults to Username.localUsers boolean
localUsers enables local users in Dex. Defaults to true.oauth2 object
oauth2 customizes the OAuth 2.0 flow.alwaysShowLoginScreen boolean
alwaysShowLoginScreen always shows the login screen. By default, when a single authentication method is enabled, users are redirected straight to it.passwordConnector string
passwordConnector is the connector ID used for password grants.responseTypes []string
responseTypes lists the allowed OAuth 2.0 response types, which select the authorization flow.
- code: Authorization Code Flow
- id_token: Implicit Flow
- id_token token: Implicit Flow
- code id_token: Hybrid Flow
- code token: Hybrid Flow
- code id_token token: Hybrid Flow
See the Authorization Examples in OpenID Connect Core 1.0.skipApprovalScreen boolean
skipApprovalScreen skips the consent screen that asks users to approve sharing their data with the client application.oidc object required
oidc configures OpenID Connect (oidc) authentication.clientID string
clientID is the OIDC client ID. Prefer the oidcClientId key of the Secret referenced by credentialsSecretName; this inline field is deprecated and will be removed.clientSecret string
clientSecret is the OIDC client secret. Prefer the oidcClientSecret key of the Secret referenced by credentialsSecretName; this inline field is deprecated and will be removed.enabled boolean required
enabled enables OIDC authentication. Defaults to false.insecureSkipVerify boolean
insecureSkipVerify disables TLS certificate verification of the OIDC provider. For testing only.issuer string
issuer is the provider issuer URL, also used for discovery. Must match the issuer in the provider's discovery document.rootCAs []string
rootCAs lists PEM-encoded root CA certificates used to verify the TLS connection to the OIDC provider. Use it when the IdP has a private or self-signed certificate.usernameClaim string
usernameClaim is the claim used as the username. Defaults to name.preLogonMessage string
preLogonMessage is a plain-text message shown on the login page before credentials are entered, for example a regulatory notice. Empty shows no banner.proxy object
proxy configures a single shared HTTP(S) proxy for outbound authentication traffic: Dex OIDC requests and operator retrieval of saml.ssoMetadataURL. It does not apply to LDAP, browser redirects or SAML form posts. Disabled by default.enabled boolean required
enabled routes authentication traffic through the proxy.noProxy []string
noProxy lists additional hosts, domains or CIDRs excluded from proxying. Entries are merged with the in-cluster exclusions MKE generates (localhost, Kubernetes service names, .svc, .cluster.local); they never replace the generated ones.url string
url is the proxy url: an absolute http:// or https:// url with a host, for example http://proxy.example.com:3128. Credentials embedded in the url are rejected. For an authenticating proxy, supply the credentials as the proxyUsername and proxyPassword keys of the auth-credentials Secret (the one referenced by credentialsSecretName, or the operator-managed authentication-credentials Secret otherwise). Required when enabled.replicaCount integer
replicaCount is the number of Dex Pod replicas. Defaults to the number of control plane nodes.resources object
resources sets the Dex Pod resource requests and limits. Entries are merged over the defaults, which are the example values.limits map[string]int|string
limits sets the maximum amount of compute resources allowed.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/requests map[string]int|string
requests sets the minimum amount of compute resources required.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/saml object required
saml configures Security Assertion Markup Language (saml) authentication.ca string
ca is the path to the ca certificate file inside the Dex Pod. The file must be mounted manually. Alternative to caData.caData string
caData is the CA certificate, as base64-encoded PEM. Alternative to ca.emailAttr string
emailAttr is the email attribute in the returned assertions, mapped to ID token claims.enabled boolean required
enabled enables SAML authentication. Defaults to false.entityIssuer string
entityIssuer is the issuer value Dex sends in the AuthnRequest. It also replaces the redirect URI as the expected audience in AudienceRestriction checks.groupsAttr string
groupsAttr is the groups attribute in the returned assertions, mapped to ID token claims.groupsDelim string
groupsDelim is the delimiter for groups returned as a single attribute value. By default each group is a separate attribute with the same name.insecureSkipSignatureValidation boolean
insecureSkipSignatureValidation skips SAML response signature validation. For testing only.nameIDPolicyFormat string
nameIDPolicyFormat is the requested NameID format. The NameID is mapped to the user ID.
The last component of the URI is enough. For example, emailAddress resolves to:urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddressurn:oasis:names:tc:SAML:2.0:nameid-format:persistentssoIssuer string
ssoIssuer is the issuer value expected in the SAML response.ssoMetadataURL string
ssoMetadataURL is the IdP metadata URL. When set, MKE fetches ssoURL, caData and the attribute names from it, so the other SAML fields become optional; fields set explicitly are kept. Once applied, the URL is cleared from the cluster configuration.ssoURL string
ssoURL is the IdP single sign-on URL.usernameAttr string
usernameAttr is the username attribute in the returned assertions, mapped to ID token claims.topologySpreadConstraints []object
topologySpreadConstraints sets the Pod topology spread constraints of the Dex addon.
See: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/labelSelector object
labelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both matchLabelKeys and LabelSelector. matchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.
This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).maxSkew integer (int32) required
maxSkew describes the degree to which pods may be unevenly distributed. When whenUnsatisfiable=DoNotSchedule, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, maxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1.
| zone1 | zone2 | zone3 |
| P P | P P | P |
- if maxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate maxSkew(1).
- if maxSkew is 2, incoming pod can be scheduled onto any zone. When whenUnsatisfiable=ScheduleAnyway, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed.minDomains integer (int32)
minDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if minDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
For example, in a 3-zone cluster, MaxSkew is set to 2, minDomains is set to 5 and pods with the same labelSelector spread as 2/2/2:
| zone1 | zone2 | zone3 |
| P P | P P | P P |
The number of domains is less than 5(minDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.nodeAffinityPolicy string
nodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are:
- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
If this value is nil, the behavior is equivalent to the Honor policy.nodeTaintsPolicy string
nodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are:
- Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included.
- Ignore: node taints are ignored. All nodes are included.
If this value is nil, the behavior is equivalent to the Ignore policy.topologyKey string required
topologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If topologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if topologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field.whenUnsatisfiable string required
whenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint.
- DoNotSchedule (default) tells the scheduler not to schedule it.
- ScheduleAnyway tells the scheduler to schedule the pod in any location,
but giving higher precedence to topologies that would help reduce the
skew.
A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1:
| zone1 | zone2 | zone3 |
| P P P | P | P |
If whenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.backup object
backup configures cluster backups: scheduled backups, notification delay and history retention.historyRetain integer (int32)
historyRetain is how many MkeBackup history records to keep. Records are written by every backup — scheduled, manual and pre-upgrade — so this lives on spec.backup rather than under the schedule: history exists even with scheduled backups disabled, and must be bounded there too.
Deliberately separate from spec.backup.schedule.retain, which bounds the ARCHIVES. Those are hundreds of MB on node disks; a record is about a kilobyte, so history can reach much further back. Tying them together would cap the visible history at the archive count and delete the last successful record after a run of failures — exactly the signal the backup notification needs. There is no keep-all value: unbounded history grows etcd without limit.notificationDelay integer (int32)
notificationDelay is the number of days without a fresh successful backup after which operators should be notified; -1 disables the notification. Mirrors MKE 3's backup notification_delay.
It sits on spec.backup rather than under spec.backup.schedule deliberately. The notification applies whether or not scheduled backups are enabled — MKE 3 warned on the absence of ANY backup, including a manual one — so nesting it under the schedule would make it unreachable for the very clusters that need it: spec.backup.schedule is a nil pointer until a schedule is configured, so an operator could not raise the delay, or disable the warning with -1, without first enabling a scheduled backup they do not want.
A pointer for the same reason Retain is one: omitempty drops a serialized 0, and API defaulting would then turn an explicit "warn immediately" into 7. Note the default only materializes when spec.backup itself is present, since that is a pointer too — consumers should fall back to DefaultBackupNotificationDelay when spec.backup is absent.
NOTE: this is the setting only. The notification behaviour is BOP-1293, and the durable last-successful-backup signal it needs is BOP-6336.schedule object
schedule configures automatic, recurring cluster backups. See BOP-5047.configSnapshotFallback string
configSnapshotFallback decides what a scheduled backup does when the operator's config snapshot is not current:
- None (default): refuse the tick and record why. No archive is produced.
- LastKnownGood: bundle the last fully reconciled snapshot and mark the
record degraded via the ConfigSnapshotCurrent condition.
Only these two. A scheduled run has no client machine to take a local config from, and the live unapplied spec is a pre-upgrade-only choice tied to a rollback artifact - neither is expressible here, which is why this enum is narrower than the CLI's --config-snapshot-fallback.
LastKnownGood keeps producing archives while the operator is wedged, at the cost of each one carrying an increasingly old configuration. That trade is the operator's to make, so it is opt-in: the default refuses rather than quietly bundling something nobody authorised.cronExpression string
cronExpression is the backup schedule. Supports a standard 5-field crontab, a 6-field spec with seconds, or a descriptor (e.g. "@daily", "@every 24h").enabled boolean
enabled turns scheduled backups on.encryption object
encryption encrypts each scheduled backup with a passphrase read from a Secret. Absent means scheduled backups are not encrypted.
A Secret rather than an inline value because scheduled backups are non-interactive — nobody can type a passphrase at 02:00 — and because the passphrase must not sit in the cluster config. The service reads the Secret at backup time; it is never written to a node's disk or to logs.passphraseSecretRef object required
passphraseSecretRef names the Secret in the mke namespace holding the passphrase. The passphrase must be at least 12 characters, matching MKE 3.name string required
name of the Secret, in the mke namespace.includeLogs boolean
includeLogs writes a sidecar log file (<archive>.log) next to each backup archive, capturing that backup run's operation log for audit and troubleshooting. Mirrors MKE 3's backup include_logs. Retention prunes the sidecar log together with its archive.path string
path is the directory on each controller node where backup archives are written. Defaults to /var/lib/mke/backups when empty.replication string
replication controls where each scheduled backup is placed:
- AllControllers (default): every controller takes its own local backup.
- LeaderOnly: only the etcd-leader controller takes the backup.retain integer (int32)
retain is the number of scheduled backups to keep per node. It is a pointer so an omitted value is distinguishable from an explicit 0: when omitted (nil) it defaults to 30 (matching MKE 3's backups_limit default) so scheduled backups — stored locally on every controller by default — cannot grow unbounded and fill controller disks; an explicit 0 keeps all backups (opt-in unlimited) and is preserved rather than being re-defaulted to 30. A non-pointer int32 would collapse these: omitempty drops a serialized 0, and API defaulting would then turn the intended keep-all into 30 (this also broke MKE 3 migration when backups_limit <= 0, which converts to 0). Retention is keyed by the scheduled run ID so the retained set is coherent across nodes even though each node prunes locally.certificates object
certificates configures custom TLS certificates for customer-facing services.ca string
ca is the user-provided TLS ca certificate for customer-facing services. Required when enabled is true.cert string
cert is the user-provided TLS certificate for customer-facing services. Write-only: the value is stored in a TLS Secret in the cluster and then cleared from this field.domainName string required
domainName is the fully qualified domain name used to reach the cluster with the custom certificate. An IP address is accepted if it is visible to the API server. Must differ from spec.apiServer.externalAddress.enabled boolean required
enabled enables the custom TLS certificate for customer-facing services.key string
key is the user-provided TLS key for customer-facing services. Write-only: the value is stored in a TLS Secret in the cluster and then cleared from this field.cloudProvider object
cloudProvider configures the cloud provider integration. Cannot be enabled together with metallb.enabled boolean required
enabled enables the cloud provider integration. Defaults to false.provider string
provider is the cloud provider name: aws or external.componentScheduling object
componentScheduling configures scheduling of MKE components. By default, component scheduling is enabled for the MKE operator, Dex, Envoy Gateway, Prometheus and the k0rdent Enterprise KCM controller-manager.enabled boolean
enabled applies topology spread constraints to MKE components. Defaults to true.topologySpreadConstraints []object
topologySpreadConstraints sets the Pod topology spread constraints applied to MKE components. The example shows the defaults.
See: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/labelSelector object
labelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both matchLabelKeys and LabelSelector. matchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.
This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).maxSkew integer (int32) required
maxSkew describes the degree to which pods may be unevenly distributed. When whenUnsatisfiable=DoNotSchedule, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, maxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1.
| zone1 | zone2 | zone3 |
| P P | P P | P |
- if maxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate maxSkew(1).
- if maxSkew is 2, incoming pod can be scheduled onto any zone. When whenUnsatisfiable=ScheduleAnyway, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed.minDomains integer (int32)
minDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if minDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
For example, in a 3-zone cluster, MaxSkew is set to 2, minDomains is set to 5 and pods with the same labelSelector spread as 2/2/2:
| zone1 | zone2 | zone3 |
| P P | P P | P P |
The number of domains is less than 5(minDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.nodeAffinityPolicy string
nodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are:
- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
If this value is nil, the behavior is equivalent to the Honor policy.nodeTaintsPolicy string
nodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are:
- Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included.
- Ignore: node taints are ignored. All nodes are included.
If this value is nil, the behavior is equivalent to the Ignore policy.topologyKey string required
topologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If topologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if topologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field.whenUnsatisfiable string required
whenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint.
- DoNotSchedule (default) tells the scheduler not to schedule it.
- ScheduleAnyway tells the scheduler to schedule the pod in any location,
but giving higher precedence to topologies that would help reduce the
skew.
A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1:
| zone1 | zone2 | zone3 |
| P P P | P | P |
If whenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.controllerManager object
controllerManager configures kube-controller-manager.extraArgs map[string]string
extraArgs sets extra arguments passed to kube-controller-manager. They take precedence over the other fields here, such as profilingEnabled and terminatedPodGCThreshold.profilingEnabled boolean
profilingEnabled enables profiling on kube-controller-manager (sets the profiling argument).terminatedPodGCThreshold integer
terminatedPodGCThreshold is the number of terminated Pods kept before garbage collection starts (sets the terminated-pod-gc-threshold argument). Defaults to 12500.devicePlugins object
devicePlugins configures MKE device plugins.nvidiaGPU object
nvidiaGPU configures the NVIDIA GPU Operator, which installs and manages the NVIDIA components needed to run GPU workloads: drivers, the Kubernetes device plugin, the NVIDIA container runtime, node labelling and DCGM monitoring.
See: https://docs.mirantis.com/mke4k/latest/configuration/nvidia-gpu/enabled boolean required
enabled enables the NVIDIA GPU Operator. Defaults to false.mig object
mig configures Multi-Instance GPU (mig). mig partitions Ampere and later GPUs, such as the A100, into isolated GPU instances. Only the single strategy is supported.enabled boolean
enabled enables the MIG manager.dns object
dns configures CoreDNS.lameduck object
lameduck configures the CoreDNS lameduck option, which delays shutdown by a fixed duration.duration string
duration is how long shutdown is delayed. Defaults to 7s.enabled boolean
enabled sets the lameduck option on the CoreDNS health plugin.driftDetection object
driftDetection configures drift detection of MKE services. By default, drift detection and correction is enabled for all MKE services.driftExclusions []object
driftExclusions lists resource fields ignored by drift detection.paths []string required
paths is a slice of JSON6902 paths to exclude from configuration drift evaluation.target object
target points to the resources that the paths refers to.annotationSelector string
annotationSelector is a string that follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api It matches with the resource annotations.group string
group is the API group to select resources from. Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdkind string
kind of the API Group to select resources from. Together with Group and Version it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdlabelSelector string
labelSelector is a string that follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api It matches with the resource labels.name string
name to match resources with.namespace string
namespace to select resources from.version string
version of the API Group to select resources from. Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mddriftIgnore []object
driftIgnore lists resources ignored by drift detection.annotationSelector string
annotationSelector is a string that follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api It matches with the resource annotations.group string
group is the API group to select resources from. Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdkind string
kind of the API Group to select resources from. Together with Group and Version it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdlabelSelector string
labelSelector is a string that follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api It matches with the resource labels.name string
name to match resources with.namespace string
namespace to select resources from.version string
version of the API Group to select resources from. Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdenvoyGateway object required
envoyGateway configures Envoy Gateway, the Kubernetes Gateway API controller.disabled boolean
disabled disables the MKE Envoy Gateway addon. Use it when a compatible Envoy Gateway deployment already exists, for example after an upgrade from MKE 3.keepIngressNginxAddon boolean
keepIngressNginxAddon keeps the ingress-nginx addon installed. Intended for clusters upgraded from MKE 3 or from MKE 4 releases before 4.1.3; fresh installs do not install ingress-nginx.nodeSelector map[string]string
nodeSelector sets the node labels the controller Pods must match. Merged with the default selectors:
- kubernetes.io/os: linux
- node-role.kubernetes.io/control-plane: "true"replicaCount integer
replicaCount is the number of Envoy Gateway controller replicas. Defaults to the number of control plane nodes.resources object
resources sets the resource requests and limits of the controller Pods.limits map[string]string
limits sets the resource limits.requests map[string]string
requests sets the resource requests.tolerations []object
tolerations sets the tolerations of the controller Pods. The example shows the defaults.effect string required
effect is the taint effect to match: NoSchedule, PreferNoSchedule or NoExecute. Empty matches all taint effects.key string required
key is the taint key the toleration applies to. Empty matches all taint keys; operator must then be Exists.operator string required
operator is the relationship between the key and the value: Equal or Exists. Exists matches any value of the key. Defaults to Equal.value string required
value is the taint value the toleration matches. Must be empty when operator is Exists.etcd object
etcd configures etcd.maintenanceService object
maintenanceService configures the etcd maintenance service.cleanupEnabled boolean required
cleanupEnabled enables scheduled cleanup of Kubernetes Events from etcd.cronExpression string required
cronExpression is the cron schedule for cleanup and, if enabled, defragmentation. Runs must be at least 72 hours apart.defragEnabled boolean
defragEnabled enables scheduled defragmentation, run right after cleanup.defragPauseSeconds integer required
defragPauseSeconds is the pause in seconds between defragmenting consecutive etcd members.defragTimeoutSeconds integer required
defragTimeoutSeconds is the timeout in seconds for each defragmentation command.grpcPort integer
grpcPort is the port of the maintenance service internal gRPC API. Defaults to 5557.httpPort integer
httpPort is the port of the maintenance service HTTP API. Defaults to
18088.minTTLToKeepSeconds integer
minTTLToKeepSeconds is the minimum remaining TTL, in seconds, an Event must have to survive cleanup.storageQuota string
storageQuota is the maximum etcd storage size, as a quantity in bytes, kibibytes, mebibytes, gibibytes or tebibytes, for example 8GiB. Units are case-insensitive; the b suffix is optional.tlsCipherSuites []string
tlsCipherSuites lists the TLS cipher suites enabled for the etcd API server.fips object
fips configures fips mode.enabled boolean required
enabled enables FIPS mode. Cannot be changed after creation.gatewayMKEIngress object required
gatewayMKEIngress configures the Gateway that serves MKE's own endpoints, such as authentication.envoyProxy object
envoyProxy configures the Envoy proxy shared by the HTTP and HTTPS management Gateways.affinity object
affinity sets the affinity rules of the Envoy proxy Pods.nodeAffinity object
Describes node affinity scheduling rules for the pod.
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
preference object required
A node selector term, associated with the corresponding weight.
matchExpressions []object
A list of node selector requirements by node's labels.
key string required
The label
key that the selector applies to.operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string
values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.matchFields []object
A list of node selector requirements by node's fields.
key string required
The label
key that the selector applies to.operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string
values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.weight integer (int32) required
weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.requiredDuringSchedulingIgnoredDuringExecution object
If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
nodeSelectorTerms []object required
Required. A list of node selector terms. The terms are ORed.
matchExpressions []object
A list of node selector requirements by node's labels.
key string required
The label
key that the selector applies to.operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string
values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.matchFields []object
A list of node selector requirements by node's fields.
key string required
The label
key that the selector applies to.operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string
values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.podAffinity object
Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
podAffinityTerm object required
Required. A pod affinity term, associated with the corresponding weight.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.mismatchLabelKeys []string
mismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key
topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.weight integer (int32) required
weight associated with matching the corresponding podAffinityTerm, in the range 1-100.requiredDuringSchedulingIgnoredDuringExecution []object
If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.mismatchLabelKeys []string
mismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key
topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.podAntiAffinity object
Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
podAffinityTerm object required
Required. A pod affinity term, associated with the corresponding weight.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.mismatchLabelKeys []string
mismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key
topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.weight integer (int32) required
weight associated with matching the corresponding podAffinityTerm, in the range 1-100.requiredDuringSchedulingIgnoredDuringExecution []object
If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.mismatchLabelKeys []string
mismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key
topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.defaultLoggingLevel string
defaultLoggingLevel is the default log level of the Envoy proxy Pods: trace, debug, info, warning, error, critical or off.nodeSelector map[string]string
nodeSelector sets the node labels the Envoy proxy Pods must match. Merged with the default selectors:
- kubernetes.io/os: linux
- node-role.kubernetes.io/control-plane: "true"podDisruptionBudget object
podDisruptionBudget configures the podDisruptionBudget of the Envoy proxy Pods.replicas integer
replicas is the number of Envoy proxy replicas.resources object
resources sets the resource requests and limits of the Envoy proxy Pods.limits map[string]string
limits sets the resource limits.requests map[string]string
requests sets the resource requests.tolerations []object
tolerations sets the tolerations of the Envoy proxy Pods.effect string required
effect is the taint effect to match: NoSchedule, PreferNoSchedule or NoExecute. Empty matches all taint effects.key string required
key is the taint key the toleration applies to. Empty matches all taint keys; operator must then be Exists.operator string required
operator is the relationship between the key and the value: Equal or Exists. Exists matches any value of the key. Defaults to Equal.value string required
value is the taint value the toleration matches. Must be empty when operator is Exists.gatewayClassName string
gatewayClassName is the name of the GatewayClass to use. Its controller must be Envoy Gateway.nodePorts object
nodePorts sets the node ports of the MKE Gateway listeners. They must be unique and within the cluster node port range. Only http and https are used. Default to 33000 and 33001 on the management cluster and 30000 and 30001 on child clusters.http integer
http is the node port of the external
http listener.https integer
https is the node port of the external
https listener.tcp map[string]integer
tcp maps tcp listener ports to node ports. Allocated from the node port range when empty. Ignored without tcpServices.udp map[string]integer
udp maps udp listener ports to node ports. Allocated from the node port range when empty. Ignored without udpServices.ingressController object required
ingressController configures the NGINX ingress controller.affinity object
affinity sets the affinity rules of the ingress controller Pods.nodeAffinity object required
nodeAffinity sets the node affinity scheduling rules of the Pod.preferredDuringSchedulingIgnoredDuringExecution []object
preferredDuringSchedulingIgnoredDuringExecution lists weighted node affinity preferences. The scheduler prefers the node with the greatest sum of matching weights, but may pick a node that matches none.preference object required
preference is the node selector term associated with weight.matchExpressions []object
matchExpressions lists node selector requirements by node labels.key string required
key is the label key the selector applies to.operator string required
operator is the relationship between the key and the values: In, NotIn, Exists, DoesNotExist, Gt or Lt.values []string
values lists the values. Must be non-empty for In and NotIn, empty for Exists and DoesNotExist, and a single integer for Gt and Lt.matchFields []object
matchFields lists node selector requirements by node fields.key string required
key is the label key the selector applies to.operator string required
operator is the relationship between the key and the values: In, NotIn, Exists, DoesNotExist, Gt or Lt.values []string
values lists the values. Must be non-empty for In and NotIn, empty for Exists and DoesNotExist, and a single integer for Gt and Lt.weight integer (int32) required
weight is the weight of a node matching preference, in the range 1-100.requiredDuringSchedulingIgnoredDuringExecution object
requiredDuringSchedulingIgnoredDuringExecution sets the node affinity requirements that must be met at scheduling time. Requirements that stop being met while the Pod runs do not evict it.nodeSelectorTerms []object required
nodeSelectorTerms lists the node selector terms. A node matches when any term matches.matchExpressions []object
matchExpressions lists node selector requirements by node labels.key string required
key is the label key the selector applies to.operator string required
operator is the relationship between the key and the values: In, NotIn, Exists, DoesNotExist, Gt or Lt.values []string
values lists the values. Must be non-empty for In and NotIn, empty for Exists and DoesNotExist, and a single integer for Gt and Lt.matchFields []object
matchFields lists node selector requirements by node fields.key string required
key is the label key the selector applies to.operator string required
operator is the relationship between the key and the values: In, NotIn, Exists, DoesNotExist, Gt or Lt.values []string
values lists the values. Must be non-empty for In and NotIn, empty for Exists and DoesNotExist, and a single integer for Gt and Lt.configMap map[string]string
configMap sets NGINX ingress controller configMap options. See the ingress-nginx documentation for the full list.disableHTTP boolean
disableHTTP disables the HTTP listener on the ingress controller Services.enableLoadBalancer boolean
enableLoadBalancer sets the ingress controller Service type to LoadBalancer.enabled boolean required
enabled is ignored by the operator. The ingress-nginx addon is installed only when envoyGateway.keepIngressNginxAddon is true.externalIPs []string
externalIPs lists the external IPs of the ingress controller Service.extraArgs object
extraArgs sets additional command-line arguments of the ingress controller.defaultSslCertificate string
defaultSslCertificate is the Secret with the certificate of the default (catch-all) HTTPS server, as namespace/name. For child clusters, create the Secret on the management cluster; it is synced to the child. Ignored when spec.certificates is enabled. Defaults to the MKE-generated mke/mke-ingress.tls.enableSslPassthrough boolean required
enableSslPassthrough enables SSL passthrough. Defaults to false.httpPort integer
httpPort is the container port for HTTP traffic. Defaults to
80.httpsPort integer
httpsPort is the container port for HTTPS traffic. Defaults to
443.nodePorts object
nodePorts sets the node ports of the external listeners. They must be unique and within the cluster node port range.http integer
http is the node port of the external
http listener.https integer
https is the node port of the external
https listener.tcp map[string]integer
tcp maps tcp listener ports to node ports. Allocated from the node port range when empty. Ignored without tcpServices.udp map[string]integer
udp maps udp listener ports to node ports. Allocated from the node port range when empty. Ignored without udpServices.ports object
preserveClientIP boolean
preserveClientIP preserves the source IP of inbound traffic.replicaCount integer
replicaCount is the number of ingress controller replicas. Defaults to 2.tcpServices map[string]string
tcpServices maps TCP ports to expose to namespace/service:port.
Example: "8080": "default/example-tcp-svc:9000" exposes port 9000 of that Service on port 8080.tolerations []object
tolerations sets the tolerations of the ingress controller Pods.effect string required
effect is the taint effect to match: NoSchedule, PreferNoSchedule or NoExecute. Empty matches all taint effects.key string required
key is the taint key the toleration applies to. Empty matches all taint keys; operator must then be Exists.operator string required
operator is the relationship between the key and the value: Equal or Exists. Exists matches any value of the key. Defaults to Equal.value string required
value is the taint value the toleration matches. Must be empty when operator is Exists.udpServices map[string]string
udpServices maps UDP ports to expose to namespace/service:port.
Example: "53": "kube-system/kube-dns:53" exposes port 53 of that Service on port 53.k0rdent object
k0rdent configures the k0rdent / kcm controller deployment.resources object
resources sets the resource requests and limits of the kcm controller-manager Pod. Unset entries fall back to the defaults, which are higher than the upstream chart defaults to avoid OOM at scale. The example shows the defaults.limits map[string]int|string
limits sets the maximum amount of compute resources allowed.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/requests map[string]int|string
requests sets the minimum amount of compute resources required.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/k8sProviderSpecs object
k8sProviderSpecs configures Kubernetes provider settings, such as the k0s data directory.dataDir string
dataDir is the directory where k0s stores its state and configuration. Defaults to /var/lib/k0s.kubelet object
kubelet configures the kubelet.customProfiles []object
customProfiles lists named kubelet configuration profiles.name string required
name is the unique profile name. The names mke-default-manager and mke-default-worker are reserved.values object (any) required
values is the kubelet configuration overriding the k0s defaults. The following fields cannot be overridden:
- clusterDNS
- clusterDomain
- apiVersion
- kind
- staticPodURL
See: https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/eventRecordQPS integer
eventRecordQPS is the maximum number of events created per second. Must be non-negative; 0 means no limit. Defaults to 50.extraArgs map[string]string
extraArgs sets extra command-line flags passed to every kubelet.kubeletRootDir string
kubeletRootDir is the kubelet root directory. Defaults to /var/lib/kubelet.managerKubeReserved map[string]string
managerKubeReserved sets the resources reserved for Kubernetes system components on manager nodes, as resource name to quantity pairs, for example cpu: 200m. Supported resources are cpu, memory and ephemeral-storage (root file system). The example shows the defaults.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/maxParallelImagePulls integer
maxParallelImagePulls is the maximum number of images the kubelet pulls in parallel. Must be positive. Values above 1 require serializeImagePulls: false. Defaults to 1.maxPods integer
maxPods is the maximum number of Pods per node. Must be non-negative. Defaults to 110.podPidsLimit integer
podPidsLimit is the maximum number of PIDs in any Pod. -1 means no limit. Defaults to -1.podsPerCore integer required
podsPerCore is the maximum number of Pods per CPU core. Cannot exceed maxPods. Must be non-negative; 0 means no limit. Defaults to 0.protectKernelDefaults boolean required
protectKernelDefaults makes the kubelet fail when kernel flags differ from its expectations instead of changing them. Defaults to false.seccompDefault boolean required
seccompDefault uses RuntimeDefault as the default seccomp profile for all workloads. Defaults to false.serializeImagePulls boolean
serializeImagePulls pulls images one at a time. Set it to false to allow parallel pulls, bounded by maxParallelImagePulls. Parallel pulls are not recommended on nodes with an AuFS storage backend. Defaults to true.tlsCipherSuites []string
tlsCipherSuites lists the TLS cipher suites enabled for the kubelet.workerKubeReserved map[string]string
workerKubeReserved sets the resources reserved for Kubernetes system components on worker nodes, as resource name to quantity pairs, for example cpu: 200m. Supported resources are cpu, memory and ephemeral-storage (root file system). The example shows the defaults.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/license object
license is the Mirantis license of the MKE cluster.token string
token is the license as a JWT (RFC 7519): the base64-encoded <JOSE_HEADER>.<PAYLOAD>.<SIGNATURE>. It is signed by the Mirantis license generation tool and validated with the Mirantis public key.metallb object
metallb configures the metallb load balancer. Allowed only with kube-proxy in iptables mode and without a cloud provider.enabled boolean required
enabled enables the MetalLB load balancer.monitoring object required
monitoring configures MKE monitoring.enableCAdvisor boolean required
enableCAdvisor enables cAdvisor container-level metrics. Defaults to false.prometheus object
prometheus configures prometheus.nodeSelector map[string]string
nodeSelector sets the node labels the Prometheus Pod must match.
See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/resources object
resources sets the Prometheus Pod resource requests and limits.limits map[string]int|string
limits sets the maximum amount of compute resources allowed.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/requests map[string]int|string
requests sets the minimum amount of compute resources required.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/retention string
retention is how long metrics are kept in the Prometheus TSDB, as a Prometheus duration such as 24h or 7d.retentionSize string
retentionSize is the maximum on-disk storage Prometheus may use for TSDB blocks, as a byte size such as 50GB or 100MiB.scrapeInterval string
scrapeInterval is how often Prometheus scrapes targets, as a Prometheus duration such as 30s or 1m.network object required
network configures the cluster network.controlPlaneLoadBalancing object
controlPlaneLoadBalancing configures the control plane load balancer for HA clusters without an external load balancer.enabled boolean required
enabled enables the k0s control plane load balancer, which uses keepalived VRRP to serve the virtual IPs. Defaults to false.virtualIPs []string
virtualIPs lists the virtual IPs assigned to the control plane load balancer. Entries must be valid CIDRs because k0s forwards them into the keepalived VRRP configuration.
When virtualRouterID is unset, MKE derives the cluster's VRRP identity from the virtual IP matching spec.apiServer.externalAddress, falling back to the first entry here, so reordering this list or changing externalAddress silently re-keys that identity. Each controller only picks up a new identity on restart, so a rolling restart briefly splits the cluster into two VRRP domains over the same virtual IP. Pin virtualRouterID to change the virtual IPs without triggering that.virtualRouterID integer (int32)
virtualRouterID is the VRRP virtual router ID keepalived uses for the virtual IPs. Every control plane node of a cluster shares it, and clusters that share an L2 segment must not: two clusters on the same virtual router merge into one VRRP domain and only one of them claims its virtual IP.
When unset, MKE derives it from the last address byte of the virtual IP that is spec.apiServer.externalAddress, falling back to the first entry in virtualIPs; a last byte of 0 derives 255, since 0 is not a valid VRRP router ID.kubeProxy object
kubeProxy configures kube-proxy. The example shows the defaults.disabled boolean
No Description Provided.
extraArgs map[string]string
Map of key-values (strings) for any extra arguments to pass down to kube-proxy process Any behavior triggered by these parameters is outside k0s support.
iptables object
KubeProxyIPTablesConfiguration contains iptables-related kube-proxy configuration @see https://github.com/kubernetes/kube-proxy/blob/v0.35.4/config/v1alpha1/types.go#L27-L48
localhostNodePorts boolean
No Description Provided.
masqueradeAll boolean
No Description Provided.
masqueradeBit integer (int32)
No Description Provided.
minSyncPeriod string
No Description Provided.
syncPeriod string
No Description Provided.
ipvs object
KubeProxyIPVSConfiguration contains ipvs-related kube-proxy configuration @see https://github.com/kubernetes/kube-proxy/blob/v0.35.4/config/v1alpha1/types.go#L52-L78
excludeCIDRs []string
No Description Provided.
minSyncPeriod string
No Description Provided.
scheduler string
No Description Provided.
strictARP boolean
No Description Provided.
syncPeriod string
No Description Provided.
tcpFinTimeout string
No Description Provided.
tcpTimeout string
No Description Provided.
udpTimeout string
No Description Provided.
metricsBindAddress string
No Description Provided.
mode string
mode defines the kube-proxy mode. Supported values are "iptables", "ipvs", "userspace" and "nft" Defaults to "iptables"nftables object
KubeProxyNFTablesConfiguration contains nftables-related kube-proxy configuration @see https://github.com/kubernetes/kube-proxy/blob/v0.35.4/config/v1alpha1/types.go#L82-L97
masqueradeAll boolean
No Description Provided.
masqueradeBit integer (int32)
No Description Provided.
minSyncPeriod string
No Description Provided.
syncPeriod string
No Description Provided.
nodePortAddresses []string
No Description Provided.
rawArgs []string
Slice of strings with raw arguments to pass to the kube-proxy process These arguments will be appended to the
ExtraArgs and aren't validated at all. ExtraArgs are recommended over rawArgs. If possible use ExtraArgs to set arguments.multus object
multus configures multus CNI.enabled boolean required
enabled installs Multus CNI alongside the main CNI provider. Defaults to false.nodePortRange string
nodePortRange is the range of ports available to NodePort Services on each node. Defaults to 32768-35535.providers []object
providers lists the CNI provider configurations. At most one may be enabled, and the enabled provider cannot be changed on a deployed cluster. A cluster can be installed with no CNI provider enabled. Defaults to Calico.
See: https://docs.mirantis.com/mke4k/latest/configuration/container-network-interface/unmanaged-cni-providers/enabled boolean required
enabled enables the CNI provider.extraConfig map[string]string
extraConfig sets additional configuration parameters of the CNI provider.
See: https://docs.mirantis.com/mke4k/latest/configuration/container-network-interface/configure-cni-providers/provider string required
provider is the CNI provider name. Defaults to calico.serviceCIDR string
serviceCIDR is the IPv4 range of Service IP addresses. Defaults to 10.96.0.0/16.nodeLocalDNS object
nodeLocalDNS configures nodeLocalDNS.enabled boolean required
enabled enables nodelocaldns. Defaults to false.nodeLocalConfigPersist boolean
nodeLocalConfigPersist creates the nodelocaldns ConfigMap with defaults and leaves it for users to edit. When false, the operator keeps overwriting it. Defaults to false.resources object
resources sets the resource requests of the nodelocaldns Pods.requests object
requests sets the resource requests.cpu string
cpu is the cpu request, for example 100m.memory string
memory is the memory request, for example 128Mi.operator object
operator configures the MKE operator (controller manager) deployment.resources object
resources sets the resource requests and limits of the MKE operator Pod. Unset entries fall back to the defaults, which are the example values.limits map[string]int|string
limits sets the maximum amount of compute resources allowed.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/requests map[string]int|string
requests sets the minimum amount of compute resources required.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/policyController object
policyController configures MKE policy controllers.opaGatekeeper object required
opaGatekeeper configures the OPA Gatekeeper policy controller.enabled boolean required
enabled enables OPA Gatekeeper. Defaults to false.exemptNamespaces []string
exemptNamespaces lists namespaces exempt from the Gatekeeper admission webhook, in addition to the MKE system namespaces.registries object
registries configures the image and chart registries.chartRegistry object
chartRegistry is the registry of the MKE system Helm charts. The URL must start with oci://. Defaults to oci://ghcr.io/mirantiscontainers.caData string
caData is the PEM-encoded certificate of the CA that issued the registry TLS certificate. Required when the CA is not publicly trusted.credentialsSecretName string
credentialsSecretName is the name of a Secret in the mke namespace holding pull credentials for this registry. The Secret must be of type kubernetes.io/dockerconfigjson. When empty, the registry is accessed anonymously.url string
url is the registry address, with an optional port, followed by the project path holding the MKE artifacts. A trailing / is removed.imageRegistry object
imageRegistry is the registry of the MKE system images. Defaults to ghcr.io/mirantiscontainers.caData string
caData is the PEM-encoded certificate of the CA that issued the registry TLS certificate. Required when the CA is not publicly trusted.credentialsSecretName string
credentialsSecretName is the name of a Secret in the mke namespace holding pull credentials for this registry. The Secret must be of type kubernetes.io/dockerconfigjson. When empty, the registry is accessed anonymously.url string
url is the registry address, with an optional port, followed by the project path holding the MKE artifacts. A trailing / is removed.scheduler object
scheduler configures kube-scheduler.bindToAll boolean
bindToAll binds kube-scheduler to all interfaces (sets the bind-address argument).extraArgs map[string]string
extraArgs sets extra arguments passed to kube-scheduler. They take precedence over the other fields here, such as profilingEnabled and bindToAll.profilingEnabled boolean
profilingEnabled enables profiling on kube-scheduler (sets the profiling argument).secretsStoreCSIDriver object required
secretsStoreCSIDriver configures the Secrets Store CSI driver.automountServiceAccountToken boolean
automountServiceAccountToken automounts a service account token in the driver Pods. Defaults to true.enabled boolean
enabled enables the Secrets Store CSI driver. Defaults to false.linux object
linux configures the driver on linux nodes.additionalProvidersDirs []string
additionalProvidersDirs lists additional provider socket directories.
See: https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/823enabled boolean
enabled deploys the driver on nodes of this OS. Defaults to true for linux and false for windows.metricsAddr string
metricsAddr is the metrics endpoint address, for example :8095.nodeSelector map[string]string
nodeSelector sets the node labels the driver Pods must match.
See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/priorityClassName string
priorityClassName is the priority class of the driver Pods.providersDir string
providersDir is the root directory of the provider sockets.maxCallRecvMsgSize integer (int64) required
maxCallRecvMsgSize is the maximum size in bytes of gRPC responses from provider plugins. Defaults to 4194304.syncSecret boolean
syncSecret installs the RBAC needed to sync mounted content into Kubernetes Secrets. Defaults to false.tokenRequests []object
tokenRequests lists the service account tokens the driver requests on behalf of the Pods it mounts volumes for.
See: https://kubernetes-csi.github.io/docs/token-requests.htmlaudience string required
audience is the token audience.expirationSeconds integer (int64)
expirationSeconds is the token lifetime in seconds.windows object
windows configures the driver on windows nodes.additionalProvidersDirs []string
additionalProvidersDirs lists additional provider socket directories.
See: https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/823enabled boolean
enabled deploys the driver on nodes of this OS. Defaults to true for linux and false for windows.metricsAddr string
metricsAddr is the metrics endpoint address, for example :8095.nodeSelector map[string]string
nodeSelector sets the node labels the driver Pods must match.
See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/priorityClassName string
priorityClassName is the priority class of the driver Pods.providersDir string
providersDir is the root directory of the provider sockets.services []object
services lists additional services to install on the cluster. Names of the default MKE services are reserved, including disabled ones.dependsOn []object
dependsOn specifies a list of other services that this service depends on.name string required
name is the release name on target cluster.namespace string
namespace is the release namespace on target cluster.disable boolean
disable can be set to disable handling of this service.helmAction string
HelmChartAction specifies action on an helm chart
helmOptions object
helmOptions are the options to be passed to the provider for helm installation or updatesatomic boolean
if set, the installation process deletes the installation/upgrades on failure. The --wait flag will be set automatically if --atomic is used
dependencyUpdate boolean
update dependencies if they are missing before installing the chart
description string
description is the description of an helm operationdisableHooks boolean
prevent hooks from running during install/upgrade/uninstall
disableOpenAPIValidation boolean
if set, the installation process will not validate rendered templates against the Kubernetes OpenAPI Schema
enableClientCache boolean
enableClientCache is a flag to enable Helm client cache. If it is not specified, it will be set to false.installOptions object
installOptions are options specific to helm installcreateNamespace boolean
Create the release namespace if not present. Defaults to true
disableHooks boolean
prevent hooks from running during install. If set to true, overrides
disableHooks in HelmOptions. Use this one when you want to selective disable hooks on install Default to falsereplace boolean
Replaces if set indicates to
replace an older release with this onelabels map[string]string
labels that would be added to release metadata.skipCRDs boolean
skipCRDs controls whether CRDs should be installed during install/upgrade operation. By default, CRDs are installed if not already present.skipSchemaValidation boolean
skipSchemaValidation determines if JSON schema validation is disabled.timeout string
time to wait for any individual Kubernetes operation (like Jobs for hooks) (default 5m0s)
uninstallOptions object
uninstallOptions are options specific to helm uninstalldeletionPropagation string
deletionPropagationdisableHooks boolean
prevent hooks from running during install. If set to true, overrides
disableHooks in HelmOptions. Use this one when you want to selective disable hooks on uninstall Default to falsekeepHistory boolean
When uninstall a chart with this flag, Helm removes the resources associated with the chart, but it keeps the release information. This allows to see details about the uninstalled release using the helm history command.
upgradeOptions object
upgradeOptions are options specific to helm upgradecleanupOnFail boolean
cleanupOnFail will, if true, cause the upgrade to delete newly-created resources on a failed update.disableHooks boolean
prevent hooks from running during install. If set to true, overrides
disableHooks in HelmOptions. Use this one when you want to selective disable hooks on upgrade Default to falseforce boolean
force will, if set to true, ignore certain warnings and perform the upgrade anyway. This should be used with caution.maxHistory integer
maxHistory limits the maximum number of revisions saved per release Default to 2recreate boolean
recreate will (if true) recreate pods after a rollback.resetThenReuseValues boolean
resetThenReuseValues will reset the values to the chart's built-ins then merge with user's last supplied values.resetValues boolean
resetValues will reset the values to the chart's built-ins rather than merging with existing.reuseValues boolean
reuseValues copies values from the current release to a new release if the new release does not have any values. If the request already has values, or if there are no values in the current release, this does nothing. This is skipped if the ResetValues flag is set, in which case the request values are not altered.subNotes boolean
subNotes determines whether sub-notes are rendered in the chart.upgradeCRDs boolean
upgradeCRDs upgrade CRDs from the Helm Chart's crds directory By default, CRDs are not applied during Helm upgrade action by Helm https://helm.sh/docs/chart_best_practices/custom_resource_definitions/wait boolean
if set, will
wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state before marking the release as successful. It will wait for as long as --timeoutwaitForJobs boolean
if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. It will wait for as long as --timeout
name string required
name is the chart release.namespace string
namespace is the namespace the release will be installed in. It will default to "default" if not provided.template string required
template is a reference to a template object located in the same namespace.templateChain string
templateChain defines the ServiceTemplateChain object that will be used to deploy the service along with desired ServiceTemplate version.values string
values is the helm values to be passed to the chart used by the template. The string type is used in order to allow for templating.valuesFrom []object
valuesFrom can reference a ConfigMap or Secret containing helm values.kind string required
kind is the kind of the source.name string required
name is the name of the source.version string
version is the version of the service template.tls object
tls configures cluster-wide tls settings of the control plane components.useStrongCiphers boolean
useStrongCiphers restricts the TLS cipher suites used by the API server, kubelet and etcd to the strong set defined by control 4.2.12 (kubelet) of the CIS Kubernetes Benchmark v1.7.0. That set is also a subset of the suites control 1.2.31 permits for the API server. CIS defines no cipher-suite control for etcd, so applying the same set there is Mirantis policy rather than a benchmark requirement. It is the MKE 4 equivalent of the MKE 3 use_strong_tls_ciphers hardening option. Defaults to false.
A non-empty per-component tlsCipherSuites list takes precedence: it is used as-is and, when useStrongCiphers is true, every entry must belong to the strong set. An empty list (tlsCipherSuites: []) is treated as unset and does not override the strong set, so a component with no non-empty list gets the strong set when useStrongCiphers is true. Under FIPS mode (spec.fips.enabled), the non-FIPS ChaCha20 suites are excluded from the strong set.tracking object required
tracking configures MKE telemetry.clusterLabel string
clusterLabel is a label included in the telemetry data sent to Mirantis.enabled boolean
enabled sends telemetry to Mirantis. Cannot be disabled on unlicensed clusters. Defaults to true.ui object
ui configures the MKE Dashboard (ui) deployment.resources object
resources sets the resource requests and limits of the MKE Dashboard Pod. Entries are merged over the defaults, which are the example values.limits map[string]int|string
limits sets the maximum amount of compute resources allowed.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/requests map[string]int|string
requests sets the minimum amount of compute resources required.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/version string required
version is the MKE cluster version. Defaults to the version of the mkectl binary that applies the config.windows object
windows configures Windows-specific cluster settings.gmsa object
gmsa configures the Kubernetes Windows gmsa admission webhook addon.enabled boolean required
enabled enables the Kubernetes Windows gMSA admission webhook. Defaults to false.status object
status is the most recently observed status of the MkeConfig.addons []object
addons contains the status of all supported MKE addons.failureMessage string
failureMessage contains additional details when an addon fails.name string required
name is the canonical addon name from the MKE addon catalog.state string required
state is the current lifecycle state of the addon.authCaConfigMap object
authCaConfigMap reports which CA bundles the operator resolved into the authentication-ca ConfigMap. Dex and dex-http-server mount a CA file only for the connectors reported present here, including a CA taken from the fallback Secret when the caData field in spec is empty.ldapPresent boolean
ldapPresent reports whether an LDAP CA was resolved into the ConfigMap.oidcPresent boolean
oidcPresent reports whether an OIDC CA was resolved into the ConfigMap.samlPresent boolean
samlPresent reports whether a SAML CA was resolved into the ConfigMap.authCredentials object
authCredentials reports the resolved authentication credentials source.secretName string required
secretName is the effective Secret the operator resolved credentials from.source string required
source is how the Secret was resolved: SecretRef when it comes from spec.authentication.credentialsSecretName, Adopted when the operator adopted an existing well-known Secret.clusterID string
clusterID is the ID of the cluster that was created by this MKE config.conditions []object
conditions lists the current state conditions of the MkeConfig.lastTransitionTime string (date-time) required
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.message string required
message is a human readable message indicating details about the transition. This may be an empty string.observedGeneration integer (int64)
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.reason string required
reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.status string required
status of the condition, one of True, False, Unknown.type string required
type of condition in CamelCase or in foo.example.com/CamelCase.licenseStatus object
licenseStatus is the loaded license details.expiration string (date-time)
expiration is when the license expires.licenseType string
licenseType is the license type. unlicensed and expired are reported when no valid license is loaded.maxEngines integer
maxEngines is the maximum number of engines the license allows.scanningEnabled boolean
scanningEnabled is the advanced claim of the license.subject string
subject is the license subject.tier string
tier is the license tier.observedGeneration integer (int64)
observedGeneration is the generation of this config resource most recently reconciled into its ClusterDeployment and reflected in Addons.