Config
Config custom resource schema.
The Config CRD holds the cluster-wide defaults for direct device Pods: pull policy and pull
Secrets, default resources, node selectors by image, and the controller-only registry metadata
trust and mirror policies. A NodeProfile referenced by a Node overrides only the fields it sets;
everything else comes from the Config. One Config named clabernetes lives in the namespace
where c9s is installed. See Global configuration for
how it is created and edited.
Config
SPEC
ConfigSpec is the spec for a Config resource.
-
Deployment holds generic direct device workload defaults.
-
ContainerStopSignals, when true, has the direct-pod renderer map an image's OCI stop signal to the Kubernetes lifecycle.stopSignal field; this requires the cluster (apiserver and kubelets) to enable the ContainerStopSignals feature gate. When false, images that declare a stop signal fail planning rather than silently dropping the signal.
default: false -
NodeSelectorsByImage is a mapping of image glob pattern as key and node selectors (value) to apply to direct device workloads. The longest matching pattern wins; conflicts between images in one grouped/component workload fail preflight. A config example: { "internal.io/nokia_sros*": {"node-flavour": "baremetal"}, "ghcr.io/nokia/srlinux*": {"node-flavour": "amd64"}, "default": {"node-flavour": "cheap"}, }.
-
ResourcesDefault is merged onto each logical Node's primary application container. Imported plans remain the source of kind-owned component requirements.
-
Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
This field depends on the DynamicResourceAllocation feature gate.
This field is immutable. It can only be set for containers.
-
ResourceClaim references one entry in PodSpec.ResourceClaims.
-
Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
-
Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.
-
-
-
Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-
Schema for additional map entries.
-
-
-
-
ImagePull holds direct Pod pull defaults and controller-only OCI metadata trust policy.
-
Policy is the default Kubernetes pull policy for application containers whose flattened Node definition does not explicitly declare one.
default: "IfNotPresent"enum: "IfNotPresent", "Always", "Never" -
PullSecrets lists same-namespace Docker-config Secrets placed on direct device Pods. Every listed Secret name must exist in each workload namespace that inherits this Config default.
-
RegistryMetadataMirrors contains exact, controller-only registry mirrors for OCI metadata resolution, for clusters whose registry access flows through a CRI pull-through mirror the controller cannot see. It does not configure kubelets, and trust for a mirror connection comes from the RegistryMetadataTrust entry matching the mirror endpoint host.
-
RegistryMetadataMirrorEntry redirects the c9s controller's OCI metadata requests for one exact source registry to a mirror endpoint, mirroring a CRI pull-through configuration (containerd hosts.toml). Only the controller's HTTP hop is rewritten: image references, resolved digest identities, and Pod image strings keep the original registry, so kubelets keep using their own runtime mirror configuration. There is no origin fallback.
-
Endpoint is the mirror URL: an https or http scheme, a host, and an optional path prefix. An endpoint path requires overridePath. The endpoint scheme selects the connection transport; add a RegistryMetadataTrust entry for the endpoint host when it needs a private CA.
-
OverridePath treats the endpoint path as the mirror's registry API root for this source registry, replacing the standard /v2 prefix on rewritten request paths (containerd hosts.toml override_path semantics, for example a Harbor proxy project at /v2/).
-
Registry is the exact source registry host, optionally including a port. URL schemes and paths are not accepted. Docker Hub aliases (docker.io, index.docker.io, registry-1.docker.io) select one shared entry.
-
-
-
RegistryMetadataTrust contains exact, controller-only trust exceptions for OCI metadata resolution. It does not configure kubelets: administrators must configure the corresponding registry mirror, CA, or HTTP endpoint independently in every eligible node runtime.
-
RegistryMetadataTrustEntry is one exact registry transport policy used only by the c9s controller while resolving OCI manifests and configuration blobs. Kubelet registry mirrors, credentials, and transport trust remain cluster-runtime configuration.
-
CABundle is a PEM-encoded CA bundle that extends the controller's system trust roots for this registry.
-
PlainHTTP explicitly allows unencrypted HTTP metadata access to this registry. It does not disable TLS verification and cannot be combined with CABundle.
-
Registry is the exact registry host, optionally including a port. URL schemes and paths are not accepted.
-
-
-
-
Metadata holds "global" metadata -- that is, metadata that is applied to all objects created by the clabernetes controller.
-
Rollout limits initial device workload startup across all namespaces in this installation.
-
BatchSize admits at most this many new primary Pod groups before waiting for all admitted sandboxes to be ready. It applies to standalone Nodes and Topology output. Zero or omission disables this global limit. Existing workloads are not restarted.
format: int32range: >= 0 -
MaxConcurrentPerHost limits primary workloads booting on each Kubernetes host. A slot is released when the primary container passes its startup probe, without waiting for links or BGP. Zero disables this limit. Config and Topology limits both apply. Enabling the gate affects newly created workloads only.
format: int32range: >= 0
-
STATUS
ConfigStatus is the status for a Config resource.