kubernetes:
  # Name of the cluster to be installed
  cluster_name: kubekey

  # Kubernetes version to deploy
  kube_version: v1.33.1
  # helm binary
  helm_version: v3.18.5

  # Image repository for built-in Kubernetes images
  image_repository: >- 
    {{ .image_registry.dockerio_registry }}/kubesphere

  # Kubernetes network configuration
  # kube-apiserver pod parameters
  apiserver:
    port: 6443
    certSANs: []
    extra_args:
      # Example: feature-gates: ExpandCSIVolumes=true,CSIStorageCapacity=true,RotateKubeletServerCertificate=true

  # kube-controller-manager pod parameters
  controller_manager:
    extra_args:
      cluster-signing-duration: 87600h
      # Example: feature-gates: ExpandCSIVolumes=true,CSIStorageCapacity=true,RotateKubeletServerCertificate=true

  # kube-scheduler pod parameters
  scheduler:
    extra_args:
      # Example: feature-gates: ExpandCSIVolumes=true,CSIStorageCapacity=true,RotateKubeletServerCertificate=true

  # kube-proxy pod parameters
  kube_proxy:
    enabled: true
    # Supported proxy modes: ipvs, iptables
    mode: "ipvs"
    config:
      iptables:
        masqueradeAll: false
        masqueradeBit: 14
        minSyncPeriod: 0s
        syncPeriod: 30s

  # kubelet service parameters
  kubelet:
    max_pod: 110
    pod_pids_limit: 10000
#    feature_gates:
    container_log_max_size: 5Mi
    container_log_max_files: 3
#    extra_args:

  # Specify a stable IP address or DNS name for the control plane endpoint.
  # For high availability, it is recommended to set control_plane_endpoint to a DNS name.
  # Configuration guidance:
  # 1. If a DNS name is available:
  #    - Set control_plane_endpoint to that DNS name and ensure it resolves to all control plane node IPs.
  # 2. If no DNS name is available:
  #    - You can set a DNS name now and add the resolution later.
  #    - Add the resolution to each node's local DNS file, for example:
  #      {{ vip }} {{ control_plane_endpoint }}
  #    - If you have a VIP (Virtual IP):
  #        Deploy kube-vip on control plane nodes to map the VIP to the actual node IPs.
  #    - If you do not have a VIP:
  #        Deploy HAProxy on worker nodes, use a fixed IP (such as 127.0.0.2) as the VIP, and forward to all control plane node IPs.
  #
  # For non-HA scenarios (manual configuration only, not automatically installed):
  # You can set the VIP to the IP of a single control plane node.
  control_plane_endpoint:
    host: lb.kubesphere.local
    port: "{{ .kubernetes.apiserver.port }}"
    # Supported types: local, kube_vip, haproxy
    # When type is local, configure as follows:
    #   - On control-plane nodes: 127.0.0.1 {{ .kubernetes.control_plane_endpoint.host }}
    #   - On worker nodes: {{ .init_kubernetes_node }} {{ .kubernetes.control_plane_endpoint.host }}
    type: local
    kube_vip:
      # The IP address of the node's network interface (e.g., "eth0").
      address: ""
      # Supported modes: ARP, BGP
      mode: ARP
      image: 
        registry: >-
          {{ .dockerio_registry }}
        repository: plndr/kube-vip
        tag: v0.7.2
    haproxy:
      # The IP address on the node's "lo" (loopback) interface.
      address: 127.0.0.1
      health_port: 8081
      image: 
        registry: >-
          {{ .dockerio_registry }}
        repository: library/haproxy
        tag: 2.9.6-alpine

  # Whether to automatically renew Kubernetes certificates
  certs:
    # There are three ways to provide the Kubernetes CA (Certificate Authority) files:
    # 1. kubeadm: Leave ca_cert and ca_key empty, and kubeadm will generate them automatically. These certificates are valid for 10 years and will not change.
    # 2. kubekey: Set ca_cert to {{ .binary_dir }}/pki/ca.cert and ca_key to {{ .binary_dir }}/pki/ca.key.
    #    These certificates are generated by kubekey, valid for 10 years, and can be updated via `cert.ca_date`.
    # 3. Custom: Manually specify the absolute paths for ca_cert and ca_key to use your own CA files.
    #
    # To use custom CA files, fill in the absolute paths below.
    # If left empty, the default behavior (kubeadm or kubekey) will be used.
    ca_cert: ""
    ca_key: ""
    # The following fields are for the Kubernetes front-proxy CA certificate and key.
    # To use custom front-proxy CA files, fill in the absolute paths below.
    # If left empty, the default behavior will be used.
    front_proxy_cert: ""
    front_proxy_key: ""
    # Automatically renew service certificates (Note: CA certificates cannot be renewed automatically)
    renew: false
