kubernetes:
  cluster_name: cluster.local
  # support: flannel, calico
  kube_network_plugin: calico
  # the image repository of kubernetes.
  image_repository: |
    {{ .k8s_registry }}
  # memory size for each kube_worker node.(unit kB)
  # should be greater than or equal to minimal_node_memory_mb.
  minimal_node_memory_mb: 10
  # the maximum number of pods that can be run on each node.
  max_pods: 110
  audit: false
  networking:
    dns_domain: cluster.local
    # it supports two value like value1,value2.
    # the first value is ipv4_cidr, the last value is ipv6_cidr.
    pod_cidr: 10.233.64.0/18
    service_cidr: 10.233.0.0/18
    dns_image: |
      {{ .k8s_registry }}/coredns/coredns:1.8.6
    dns_cache_image: |
      {{ .dockerio_registry }}/kubesphere/k8s-dns-node-cache:1.22.20
    dns_service_ip: |
      {{ .kubernetes.networking.service_cidr | ipInCIDR 2 }}
  # Specify a stable IP address or DNS name for the control plane.
#  control_plane_endpoint: lb.kubesphere.local
  apiserver:
    port: 6443
    certSANs: []
    extra_args:
      bind-address: 0.0.0.0
      feature-gates: ExpandCSIVolumes=true,CSIStorageCapacity=true,RotateKubeletServerCertificate=true
  controller_manager:
    # Set the Pod CIDR size of a node.
    kube_network_node_prefix: 24
    extra_args:
      feature-gates: ExpandCSIVolumes=true,CSIStorageCapacity=true,RotateKubeletServerCertificate=true
  scheduler:
    extra_args:
      feature-gates: ExpandCSIVolumes=true,CSIStorageCapacity=true,RotateKubeletServerCertificate=true
  kube_proxy:
    enabled: true
    # support ipvs and iptables
    mode: "ipvs"
    config:
      iptables:
        masqueradeAll: false
        masqueradeBit: 14
        minSyncPeriod: 0s
        syncPeriod: 30s
  kubelet:
    max_pod: 110
    pod_pids_limit: 10000
#    feature_gates:
    container_log_max_size: 5Mi
    container_log_max_files: 3
#    extra_args:
  coredns:
    dns_etc_hosts: []
    # the config for zones
    zone_configs:
        # DNS zones to match. default use port of 53. the format like this.
        # .: all dns zone.
        # example.com: match *.example.com use dns server with port 53
        # example.com:54: match *.example.com use dns server with port 54
      - zones: [".:53"]
        additional_configs:
          - errors
          - ready
          - prometheus :9153
          - loop
          - reload
          - loadbalance
        cache: 30
        kubernetes:
          zones:
            - "{{ .kubernetes.networking.dns_domain }}"
        # rewrite performs internal message rewriting.
#        rewrite:
#            #  specify multiple rules and an incoming query matches multiple rules.
#            # continue: if the rewrite rule is not matched, the next rule will be matched.
#            # stop: if the rewrite rule is not matched, the next rule will not be matched.
#          - rule: continue
#            # support: type, name, class, edns0, ttl, cname
#            # type: the type field of the request will be rewritten. FROM/TO must be a DNS record type (A, MX, etc.).
#            # name: the query name in the request is rewritten; by default this is a full match of the name
#            # class: the class of the message will be rewritten.
#            # edns0: an EDNS0 option can be appended to the request as described below in the EDNS0 Options section.
#            # ttl: the TTL value in the response is rewritten.
#            # cname: the CNAME target if the response has a CNAME record
#            field: name
#            # this optional element can be specified for a name or ttl field.
#            # exact: the name must be exactly the same as the value.
#            # prefix: the name must start with the value.
#            # suffix: the name must end with the value.
#            # substring: the name must contain the value.
#            # regex: the name must match the value.
#            type: exact
#            value: "example.com example2.com"
#            # for field name further options are possible controlling the response rewrites.
#            # answer auto: the names in the response is rewritten in a best effort manner.
#            # answer name FROM TO: the query name in the response is rewritten matching the from regex pattern.
#            # answer value FROM TO: the names in the response is rewritten matching the from regex pattern.
#            options: ""
        forward:
            # the base domain to match for the request to be forwarded.
          - from: "."
            # the destination endpoints to forward to. The TO syntax allows you to specify a protocol
            to: ["/etc/resolv.conf"]
            # a space-separated list of domains to exclude from forwarding.
            except: []
            # use TCP even when the request comes in over UDP.
            force_tcp: false
            # try first using UDP even when the request comes in over TCP.
            # If response is truncated (TC flag set in response) then do another attempt over TCP.
            prefer_udp: false
            # the number of subsequent failed health checks that are needed before considering an upstream to be down
            # If 0, the upstream will never be marked as down (nor health checked).
#            max_fails: 2
            # expire (cached) connections after this time,
#            expire: 10s
            # define the TLS properties for TLS connection.
#            tls:
#              # the path to the certificate file.
#              cert_file: ""
#              # the path to the key file.
#              key_file: ""
#              # the path to the CA certificate file.
#              ca_file: ""
#            # allows you to set a server name in the TLS configuration
#            tls_servername: ""
            # specifies the policy to use for selecting upstream servers. The default is random.
            # random: a policy that implements random upstream selection.
            # round_robin: a policy that selects hosts based on round robin ordering.
            # sequential: a policy that selects hosts based on sequential ordering.
#            policy: "random"
            # configure the behaviour of health checking of the upstream servers
            # format: DURATION [no_rec] [domain FQDN]
            # <duration>: use a different duration for health checking, the default duration is 0.5s.
            # no_rec:optional argument that sets the RecursionDesired-flag of the dns-query used in health checking to false. The flag is default true.
            # domain FQDN: set the domain name used for health checks to FQDN. If not configured, the domain name used for health checks is .
#            health_check: ""
            # limit the number of concurrent queries to MAX.
            max_concurrent: 1000
  kube_vip:
    enabled: false
    address: | 
      {{ .kubernetes.control_plane_endpoint }}
    # support:BGP, ARP
    mode: BGP
    image: |
      {{ .dockerio_registry }}/plndr/kube-vip:v0.7.2
  haproxy:
    enabled: false
    health_port: 8081
    image: |
      {{ .dockerio_registry }}/library/haproxy:2.9.6-alpine
  etcd:
    # It is possible to deploy etcd with three methods.
    # external: Deploy etcd cluster with external etcd cluster.
    # internal: Deploy etcd cluster by static pod.
    deployment_type: external
    image: |
      {{ .k8s_registry }}/etcd:3.5.0
  custom_label: {}
