V1 Config Schema - Rafay Product Documentation
AKS Schema ¶
Cluster configuration for AKS clusters
| apiVersion: rafay.io/v1alpha1 |
string | |
| kind: Cluster |
string | |
| name: myclustername |
Cluster name | string |
| project: myproject |
Project for the cluster | string |
| labels: {} |
Cluster labels | object |
| type: aks |
Cluster Type | string |
| blueprint: myblueprint |
Blueprint associated with the cluster. Defaults to default |
string |
| blueprintversion: mybpversion |
Blueprint version associated with the cluster. Defaults to "" |
string |
| cloudprovider: mycloudprovider |
Cloud credentials provider used to create and manage the cluster | string |
| apiVersion: rafay.io/v1alpha1 |
string | |
| kind: aksClusterConfig |
string | |
| name: myclustername |
AKS Cluster name | string |
| subscriptionID: dd18a64f-4dda-4c41-b194-9b5a7952d66d |
Subscription ID for the cluster | string |
| resourceGroupName: myresourcegroup |
Resource group for the cluster | string |
| apiVersion: 2024-01-01 |
string | |
| name: | The name of the extended location. | string |
| type: EdgeZone |
The type of the extended location. | string |
| delegatedResources: | The delegated identity resources assigned to this managed cluster. This can only be set by another Azure Resource Provider, and managed cluster only accept one delegated identity resource. Internal use only. | object |
| type: SystemAssigned |
For more information see use managed identities in AKS. Valid values are SystemAssigned, UserAssigned, None. |
string |
| userAssignedIdentities: | The keys must be ARM resource IDs in the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. |
object |
| location: | The geo-location where the resource lives | string |
| adminGroupObjectIDs: | The list of AAD group object IDs that will have admin role of the cluster. | string[] |
| clientAppID: | (DEPRECATED) The client AAD application ID. Learn more at https://aka.ms/aks/aad-legacy. | string |
| enableAzureRBAC: | Whether to enable Azure RBAC for Kubernetes authorization. | boolean |
| managed: | Whether to enable managed AAD. | boolean |
| serverAppID: | (DEPRECATED) The server AAD application ID. Learn more at https://aka.ms/aks/aad-legacy. | string |
| serverAppSecret: | (DEPRECATED) The server AAD application secret. Learn more at https://aka.ms/aks/aad-legacy. | string |
| tenantID: | The AAD tenant ID to use for authentication. If not specified, will use the tenant of the deployment subscription. | string |
| addonProfiles: | The profile of managed cluster add-on. | object |
| authorizedIPRanges: | IP ranges are specified in CIDR format, e.g. 137.117.106.88/29. This feature is not compatible with clusters that use Public IP Per Node, or clusters that are using a Basic Load Balancer. For more information see API server authorized IP ranges. | string[] |
| disableRunCommand: | Whether to disable run command for the cluster or not. | boolean |
| enablePrivateCluster: | For more details, see Creating a private AKS cluster. | boolean |
| enablePrivateClusterPublicFQDN: | Whether to create additional public FQDN for private cluster or not. | boolean |
| privateDNSZone: | The default is System. For more details see configure private DNS zone. Allowed values are system and none. |
string |
| balance-similar-node-groups: | Valid values are true and false |
string |
| expander: least-waste |
If not specified, the default is random. See expanders for more information. Valid values are least-waste, most-pods, priority, random. |
string |
| max-empty-bulk-delete: | The default is 10. | string |
| max-graceful-termination-sec: | The default is 600. | string |
| max-node-provision-time: | The default is 15m. Values must be an integer followed by an m. No unit of time other than minutes (m) is supported. |
string |
| max-total-unready-percentage: | The default is 45. The maximum is 100 and the minimum is 0. | string |
| new-pod-scale-up-delay: | For scenarios like burst/batch scale where you don't want CA to act before the kubernetes scheduler could schedule all the pods, you can tell CA to ignore unscheduled pods before they're a certain age. The default is 0s. Values must be an integer followed by a unit (s for seconds, m for minutes, h for hours, etc). |
string |
| ok-total-unready-count: | This must be an integer. The default is 3. | string |
| scale-down-delay-after-add: | The default is 10m. Values must be an integer followed by an m. No unit of time other than minutes (m) is supported. |
string |
| scale-down-delay-after-delete: | The default is the scan-interval. Values must be an integer followed by an m. No unit of time other than minutes (m) is supported. |
string |
| scale-down-delay-after-failure: | The default is 3m. Values must be an integer followed by an m. No unit of time other than minutes (m) is supported. |
string |
| scale-down-unneeded-time: | The default is 10m. Values must be an integer followed by an m. No unit of time other than minutes (m) is supported. |
string |
| scale-down-unready-time: | The default is 20m. Values must be an integer followed by an m. No unit of time other than minutes (m) is supported. |
string |
| scale-down-utilization-threshold: | The default is 0.5. |
string |
| scan-interval: | The default is 10. Values must be an integer number of seconds. |
string |
| skip-nodes-with-local-storage: | The default is true. | string |
| skip-nodes-with-system-pods: | The default is true. | string |
| nodeOSUpgradeChannel: None |
Manner in which the OS on your nodes is updated. The default is NodeImage. Valid values are None, Unmanaged, NodeImage. |
string |
| upgradeChannel: rapid |
For more information see setting the AKS cluster auto-upgrade channel. Valid values are rapid, stable, patch, node-image, none. |
string |
| enabled: | Whether to enable or disable the Azure Managed Prometheus addon for Prometheus monitoring. See aka.ms/AzureManagedPrometheus-aks-enable for details on enabling and disabling. | boolean |
| metricAnnotationsAllowList: | Comma-separated list of Kubernetes annotation keys that will be used in the resource's labels metric (Example: namespaces=[kubernetes.io/team,...],pods=[kubernetes.io/team],...). By default the metric contains only resource name and namespace labels. |
string |
| metricLabelsAllowlist: | Comma-separated list of additional Kubernetes label keys that will be used in the resource's labels metric (Example: namespaces=[k8s-label-1,k8s-label-n,...],pods=[app],...). By default the metric contains only resource name and namespace labels. |
string |
| disableLocalAccounts: | If set to true, getting static credentials will be disabled for this cluster. This must only be used on Managed Clusters that are AAD enabled. For more details see disable local accounts. | boolean |
| diskEncryptionSetID: | This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/diskEncryptionSets/{encryptionSetName} |
string |
| dnsPrefix: | This cannot be updated once the Managed Cluster has been created. | string |
| enablePodSecurityPolicy: | (DEPRECATED) Whether to enable Kubernetes pod security policy (preview). PodSecurityPolicy was deprecated in Kubernetes v1.21, and removed from Kubernetes in v1.25. Learn more at https://aka.ms/k8s/psp and https://aka.ms/aks/psp. | boolean |
| enableRBAC: | Whether to enable Kubernetes Role-Based Access Control. | boolean |
| fqdnSubdomain: | This cannot be updated once the Managed Cluster has been created. | string |
| httpProxy: | The HTTP proxy server endpoint to use. | string |
| httpsProxy: | The HTTPS proxy server endpoint to use. | string |
| noProxy: | The endpoints that should not go through proxy. | string[] |
| trustedCa: | Alternative CA cert to use for connecting to proxy servers. | string |
| identityProfile: | Identities associated with the cluster. | object |
| dnsZoneResourceIds: | Resource IDs of the DNS zones to be associated with the Application Routing add-on. Used only when Application Routing add-on is enabled. Public and private DNS zones can be in different resource groups, but all public DNS zones must be in the same resource group and all private DNS zones must be in the same resource group. | string[] |
| enabled: | Whether to enable the Application Routing add-on. | boolean |
| kubernetesVersion: | Both patch version (e.g. 1.20.13) and (e.g. 1.20) are supported. When is specified, the latest supported GA patch version is chosen automatically. Updating the cluster with the same once it has been created (e.g. 1.14.x -> 1.14) will not trigger an upgrade, even if a newer patch version is available. When you upgrade a supported AKS cluster, Kubernetes minor versions cannot be skipped. All upgrades must be performed sequentially by major version number. For example, upgrades between 1.14.x -> 1.15.x or 1.15.x -> 1.16.x are allowed, however 1.14.x -> 1.16.x is not allowed. See upgrading an AKS cluster for more details. | string |
| adminUsername: | The administrator username to use for Linux VMs. | string |
| - keyData: |
Certificate public key used to authenticate with VMs through SSH. The certificate must be in PEM format with or without headers. | string |
| dnsServiceIP: 10.0.0.10 |
An IP address assigned to the Kubernetes DNS service. It must be within the Kubernetes service address range specified in serviceCidr. | string |
| ipFamilies: | IP families are used to determine single-stack or dual-stack clusters. For single-stack, the expected value is IPv4. For dual-stack, the expected values are IPv4 and IPv6. | string[] |
| allocatedOutboundPorts: 0 |
The desired number of allocated SNAT ports per VM. Allowed values are in the range of 0 to 64000 (inclusive). The default value is 0 which results in Azure dynamically allocating ports. | integer |
| backendPoolType: NodeIPConfiguration |
The type of the managed inbound Load Balancer BackendPool. Valid values are NodeIPConfiguration, NodeIP. |
string |
| - id: |
The fully qualified Azure resource id. | string |
| enableMultipleStandardLoadBalancers: | Enable multiple standard load balancers per AKS cluster or not. | boolean |
| idleTimeoutInMinutes: 30 |
Desired outbound flow idle timeout in minutes. Allowed values are in the range of 4 to 120 (inclusive). The default value is 30 minutes. | integer |
| count: 1 |
The desired number of IPv4 outbound IPs created/managed by Azure for the cluster load balancer. Allowed values must be in the range of 1 to 100 (inclusive). The default value is 1. | integer |
| countIPv6: 0 |
The desired number of IPv6 outbound IPs created/managed by Azure for the cluster load balancer. Allowed values must be in the range of 1 to 100 (inclusive). The default value is 0 for single-stack and 1 for dual-stack. | integer |
| - id: |
The fully qualified Azure resource id. | string |
| - id: |
The fully qualified Azure resource id. | string |
| loadBalancerSku: standard |
The default is standard. See Azure Load Balancer SKUs for more information about the differences between load balancer SKUs. Valid values are standard, basic. |
string |
| - id: |
The fully qualified Azure resource id. | string |
| idleTimeoutInMinutes: 4 |
Desired outbound flow idle timeout in minutes. Allowed values are in the range of 4 to 120 (inclusive). The default value is 4 minutes. | integer |
| count: 1 |
The desired number of outbound IPs created/managed by Azure. Allowed values must be in the range of 1 to 16 (inclusive). The default value is 1. | integer |
| networkDataplane: azure |
Network dataplane used in the Kubernetes cluster. Valid values are azure, cilium. |
string |
| networkMode: transparent |
This cannot be specified if networkPlugin is anything other than azure. Valid values are transparent, bridge. |
string |
| networkPlugin: azure |
Network plugin used for building the Kubernetes network. Valid values are azure, kubenet, none. |
string |
| networkPluginMode: overlay |
The mode the network plugin should use. | string |
| networkPolicy: calico |
Network policy used for building the Kubernetes network. Valid values are calico, azure, cilium. |
string |
| outboundType: loadBalancer |
This can only be set at cluster creation time and cannot be changed later. For more information see egress outbound type. Valid values are loadBalancer, userDefinedRouting, managedNATGateway, userAssignedNATGateway. |
string |
| podCidr: 10.244.0.0/16 |
A CIDR notation IP range from which to assign pod IPs when kubenet is used. | string |
| podCidrs: | One IPv4 CIDR is expected for single-stack networking. Two CIDRs, one for each IP family (IPv4/IPv6), is expected for dual-stack networking. | string[] |
| serviceCidr: 10.0.0.0/16 |
A CIDR notation IP range from which to assign service cluster IPs. It must not overlap with any Subnet IP ranges. | string |
| serviceCidrs: | One IPv4 CIDR is expected for single-stack networking. Two CIDRs, one for each IP family (IPv4/IPv6), is expected for dual-stack networking. They must not overlap with any Subnet IP ranges. | string[] |
| nodeResourceGroup: | The name of the resource group containing agent pool nodes. | string |
| enabled: | Whether the OIDC issuer is enabled. | boolean |
| allowNetworkPluginKubenet: | Running in Kubenet is disabled by default due to the security related nature of AAD Pod Identity and the risks of IP spoofing. See using Kubenet network plugin with AAD Pod Identity for more information. | boolean |
| enabled: | Whether the pod identity addon is enabled. | boolean |
| - bindingSelector: |
The binding selector to use for the AzureIdentityBinding resource. | string |
| clientId: | The client ID of the user assigned identity. | string |
| objectId: | The object ID of the user assigned identity. | string |
| resourceId: | The resource ID of the user assigned identity. | string |
| - name: |
The name of the pod identity. | string |
| - namespace: |
The namespace of the pod identity. | string |
| - name: |
The name of the pod identity exception. | string |
| - namespace: |
The namespace of the pod identity exception. | string |
| - podLabels: |
The pod labels to match. | object |
| - groupId: |
The group ID of the resource. | string |
| - id: |
The ID of the private link resource. | string |
| - name: |
The name of the private link resource. | string |
| - requiredMembers: |
The RequiredMembers of the resource | string[] |
| - type: |
The resource type. | string |
| publicNetworkAccess: Enabled |
Allow or deny public network access for AKS Valid values are Enabled, Disabled. |
string |
| enabled: | Whether to enable Azure Key Vault key management service. The default is false. | boolean |
| keyId: | Identifier of Azure Key Vault key. See key identifier format for more details. When Azure Key Vault key management service is enabled, this field is required and must be a valid key identifier. When Azure Key Vault key management service is disabled, leave the field empty. | string |
| keyVaultNetworkAccess: Public |
Network access of key vault. The possible values are Public and Private. Public means the key vault allows public access from all networks. Private means the key vault disables public access and enables private link. The default value is Public. |
string |
| keyVaultResourceId: | Resource ID of key vault. When keyVaultNetworkAccess is Private, this field is required and must be a valid resource ID. When keyVaultNetworkAccess is Public, leave the field empty. |
string |
| logAnalyticsWorkspaceResourceId: | Resource ID of the Log Analytics workspace to be associated with Microsoft Defender. When Microsoft Defender is enabled, this field is required and must be a valid workspace resource ID. When Microsoft Defender is disabled, leave the field empty. | string |
| enabled: | Whether to enable Defender threat detection | boolean |
| enabled: | Whether to enable Image Cleaner on AKS cluster. | boolean |
| intervalHours: | Image Cleaner scanning interval in hours. | integer |
| enabled: | Whether to enable workload identity. | boolean |
| certChainObjectName: | Certificate chain object name in Azure Key Vault. | string |
| certObjectName: | Intermediate certificate object name in Azure Key Vault. | string |
| keyObjectName: | Intermediate certificate private key object name in Azure Key Vault. | string |
| keyVaultId: | The resource ID of the Key Vault. | string |
| rootCertObjectName: | Root certificate object name in Azure Key Vault. | string |
| - enabled: |
Whether to enable the egress gateway. | boolean |
| - nodeSelector: |
NodeSelector for scheduling the egress gateway. | object |
| - enabled: |
Whether to enable the ingress gateway. | boolean |
| - mode: External |
Mode of an ingress gateway. Valid values are External, Internal. |
string |
| revisions: | The list of revisions of the Istio control plane. When an upgrade is not in progress, this holds one value. When canary upgrade is in progress, this can only hold two consecutive values. For more information, see: https://learn.microsoft.com/en-us/azure/aks/istio-upgrade | string[] |
| mode: Istio |
Mode of the service mesh. Valid values are Istio, Disabled. |
string |
| clientId: | The ID for the service principal. If specified, must be set to [parameters('servicePrincipalClientId')]. This would be set to the cloud credential's client ID during cluster deployment. |
string |
| secret: | The secret password associated with the service principal. If specified, must be set to [parameters('servicePrincipalClientSecret')]. This would be set to the cloud credential's client secret during cluster deployment. |
string |
| enabled: | Whether to enable AzureBlob CSI Driver. The default value is false. | boolean |
| enabled: | Whether to enable AzureDisk CSI Driver. The default value is true. | boolean |
| enabled: | Whether to enable AzureFile CSI Driver. The default value is true. | boolean |
| enabled: | Whether to enable Snapshot Controller. The default value is true. | boolean |
| supportPlan: KubernetesOfficial |
The support plan for the Managed Cluster. If unspecified, the default is KubernetesOfficial. Valid values are KubernetesOfficial, AKSLongTermSupport. |
string |
| forceUpgrade: | Whether to force upgrade the cluster. Note that this option instructs upgrade operation to bypass upgrade protections such as checking for deprecated API usage. Enable this option only with caution. | boolean |
| until: | Until when the overrides are effective. Note that this only matches the start time of an upgrade, and the effectiveness won't change once an upgrade starts even if the until expires as upgrade proceeds. This field is not set by default. It must be set for the overrides to take effect. |
string |
| adminUsername: | Specifies the name of the administrator account. Restriction: Cannot end in "." Disallowed values: "administrator", "admin", "user", "user1", "test", "user2", "test1", "user3", "admin1", "1", "123", "a", "actuser", "adm", "admin2", "aspnet", "backup", "console", "david", "guest", "john", "owner", "root", "server", "sql", "support", "support_388945a0", "sys", "test2", "test3", "user4", "user5". Minimum-length: 1 character Max-length: 20 characters |
string |
| enableCSIProxy: | For more details on CSI proxy, see the CSI proxy GitHub repo. | boolean |
| dnsServer: | Specifies the DNS server for Windows gMSA. Set it to empty if you have configured the DNS server in the vnet which is used to create the managed cluster. |
string |
| enabled: | Specifies whether to enable Windows gMSA in the managed cluster. | boolean |
| rootDomainName: | Specifies the root domain name for Windows gMSA. Set it to empty if you have configured the DNS server in the vnet which is used to create the managed cluster. |
string |
| licenseType: None |
The license type to use for Windows VMs. See Azure Hybrid User Benefits for more details. Valid values are None, Windows_Server. |
string |
| enabled: | Whether to enable KEDA. | boolean |
| enabled: false |
Whether to enable VPA. Default value is false. | boolean |
| name: Base |
The name of a managed cluster SKU. | string |
| tier: Premium |
If not specified, the default is Free. See AKS Pricing Tier for more details. Valid values are Premium, Standard, Free. |
string |
| tags: | Resource tags. | object |
| type: Microsoft.ContainerService/managedClusters |
string | |
| resourceGroupName: | If not specified, defaults to the resource group of the managed cluster | string |
| acrName: | The name of the Azure Container Registry resource. | string |
| oms_workspace_location: | If not specified, defaults to the resource group of the managed cluster. Valid only if the Log analytics workspace is specified. | string |
| apiVersion: 2024-01-01 |
string | |
| name: | The name of the agent pool. | string |
| availabilityZones: | The list of Availability zones to use for nodes. This can only be specified if the AgentPoolType property is VirtualMachineScaleSets. |
string[] |
| capacityReservationGroupID: | AKS will associate the specified agent pool with the Capacity Reservation Group. | string |
| count: | Number of agents (VMs) to host docker containers. Allowed values must be in the range of 0 to 1000 (inclusive) for user pools and in the range of 1 to 1000 (inclusive) for system pools. The default value is 1. | integer |
| sourceResourceId: | This is the ARM ID of the source object to be used to create the target object. | string |
| enableAutoScaling: | Whether to enable auto-scaler | boolean |
| enableEncryptionAtHost: | This is only supported on certain VM sizes and in certain Azure regions. For more information, see: https://docs.microsoft.com/azure/aks/enable-host-encryption | boolean |
| enableFIPS: | See Add a FIPS-enabled node pool for more details. | boolean |
| enableNodePublicIP: | Some scenarios may require nodes in a node pool to receive their own dedicated public IP addresses. A common scenario is for gaming workloads, where a console needs to make a direct connection to a cloud virtual machine to minimize hops. For more information see assigning a public IP per node. The default is false. | boolean |
| enableUltraSSD: | Whether to enable UltraSSD | boolean |
| gpuInstanceProfile: MIG1g |
GPUInstanceProfile to be used to specify GPU MIG instance profile for supported GPU VM SKU. Valid values are MIG1g, MIG2g, MIG3g, MIG4g, MIG7g. |
string |
| hostGroupID: | This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/hostGroups/{hostGroupName}. For more information see Azure dedicated hosts. | string |
| allowedUnsafeSysctls: | Allowed list of unsafe sysctls or unsafe sysctl patterns (ending in *). |
string[] |
| containerLogMaxFiles: | The maximum number of container log files that can be present for a container. The number must be ≥ 2. | integer |
| containerLogMaxSizeMB: | The maximum size (e.g. 10Mi) of container log file before it is rotated. | integer |
| cpuCfsQuota: | The default is true. | boolean |
| cpuCfsQuotaPeriod: | The default is 100ms. Valid values are a sequence of decimal numbers with an optional fraction and a unit suffix. For example: 300ms, 2h45m. Supported units are ns, us, ms, s, m, and h. |
string |
| cpuManagerPolicy: | The default is none. See Kubernetes CPU management policies for more information. Allowed values are none and static. |
string |
| failSwapOn: | If set to true it will make the Kubelet fail to start if swap is enabled on the node. | boolean |
| imageGcHighThreshold: | To disable image garbage collection, set to 100. The default is 85% | integer |
| imageGcLowThreshold: | This cannot be set higher than imageGcHighThreshold. The default is 80% | integer |
| podMaxPids: | The maximum number of processes per pod. | integer |
| topologyManagerPolicy: | For more information see Kubernetes Topology Manager. The default is none. Allowed values are none, best-effort, restricted, and single-numa-node. |
string |
| kubeletDiskType: OS |
Determines the placement of emptyDir volumes, container runtime data root, and Kubelet ephemeral storage. Valid values are OS, Temporary. |
string |
| swapFileSizeMB: | The size in MB of a swap file that will be created on each node. | integer |
| fsAioMaxNr: | Sysctl setting fs.aio-max-nr. | integer |
| fsFileMax: | Sysctl setting fs.file-max. | integer |
| fsInotifyMaxUserWatches: | Sysctl setting fs.inotify.max_user_watches. | integer |
| fsNrOpen: | Sysctl setting fs.nr_open. | integer |
| kernelThreadsMax: | Sysctl setting kernel.threads-max. | integer |
| netCoreNetdevMaxBacklog: | Sysctl setting net.core.netdev_max_backlog. | integer |
| netCoreOptmemMax: | Sysctl setting net.core.optmem_max. | integer |
| netCoreRmemDefault: | Sysctl setting net.core.rmem_default. | integer |
| netCoreRmemMax: | Sysctl setting net.core.rmem_max. | integer |
| netCoreSomaxconn: | Sysctl setting net.core.somaxconn. | integer |
| netCoreWmemDefault: | Sysctl setting net.core.wmem_default. | integer |
| netCoreWmemMax: | Sysctl setting net.core.wmem_max. | integer |
| netIpv4IpLocalPortRange: | Sysctl setting net.ipv4.ip_local_port_range. | string |
| netIpv4NeighDefaultGcThresh1: | Sysctl setting net.ipv4.neigh.default.gc_thresh1. | integer |
| netIpv4NeighDefaultGcThresh2: | Sysctl setting net.ipv4.neigh.default.gc_thresh2. | integer |
| netIpv4NeighDefaultGcThresh3: | Sysctl setting net.ipv4.neigh.default.gc_thresh3. | integer |
| netIpv4TcpFinTimeout: | Sysctl setting net.ipv4.tcp_fin_timeout. | integer |
| netIpv4TcpKeepaliveProbes: | Sysctl setting net.ipv4.tcp_keepalive_probes. | integer |
| netIpv4TcpKeepaliveTime: | Sysctl setting net.ipv4.tcp_keepalive_time. | integer |
| netIpv4TcpMaxSynBacklog: | Sysctl setting net.ipv4.tcp_max_syn_backlog. | integer |
| netIpv4TcpMaxTwBuckets: | Sysctl setting net.ipv4.tcp_max_tw_buckets. | integer |
| netIpv4TcpTwReuse: | Sysctl setting net.ipv4.tcp_tw_reuse. | boolean |
| netIpv4TcpkeepaliveIntvl: | Sysctl setting net.ipv4.tcp_keepalive_intvl. | integer |
| netNetfilterNfConntrackBuckets: | Sysctl setting net.netfilter.nf_conntrack_buckets. | integer |
| netNetfilterNfConntrackMax: | Sysctl setting net.netfilter.nf_conntrack_max. | integer |
| vmMaxMapCount: | Sysctl setting vm.max_map_count. | integer |
| vmSwappiness: | Sysctl setting vm.swappiness. | integer |
| vmVfsCachePressure: | Sysctl setting vm.vfs_cache_pressure. | integer |
| transparentHugePageDefrag: | Valid values are always, defer, defer+madvise, madvise and never. The default is madvise. For more information see Transparent Hugepages. |
string |
| transparentHugePageEnabled: | Valid values are always, madvise, and never. The default is always. For more information see Transparent Hugepages. |
string |
| maxCount: | The maximum number of nodes for auto-scaling | integer |
| maxPods: | The maximum number of pods that can run on a node. | integer |
| minCount: | The minimum number of nodes for auto-scaling | integer |
| mode: System |
A cluster must have at least one System Agent Pool at all times. For additional information on agent pool restrictions and best practices, see: https://docs.microsoft.com/azure/aks/use-system-pools Valid values are System, User. |
string |
| - portEnd: |
The maximum port that is included in the range. It should be ranged from 1 to 65535, and be greater than or equal to portStart. | integer |
| - portStart: |
The minimum port that is included in the range. It should be ranged from 1 to 65535, and be less than or equal to portEnd. | integer |
| - protocol: TCP |
The network protocol of the port. Valid values are TCP, UDP. |
string |
| applicationSecurityGroups: | The IDs of the application security groups which agent pool will associate when created. | string[] |
| - ipTagType: |
The IP tag type. Example: RoutingPreference. | string |
| - tag: |
The value of the IP tag associated with the public IP. Example: Internet. | string |
| nodeLabels: | The node labels to be persisted across all nodes in agent pool. | object |
| nodePublicIPPrefixID: | This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/publicIPPrefixes/{publicIPPrefixName} | string |
| nodeTaints: | The taints added to new nodes during node pool create and scale. For example, key=value:NoSchedule. | string[] |
| orchestratorVersion: | Both patch version (e.g. 1.20.13) and (e.g. 1.20) are supported. When is specified, the latest supported GA patch version is chosen automatically. Updating the cluster with the same once it has been created (e.g. 1.14.x -> 1.14) will not trigger an upgrade, even if a newer patch version is available. As a best practice, you should upgrade all node pools in an AKS cluster to the same Kubernetes version. The node pool version must have the same major version as the control plane. The node pool minor version must be within two minor versions of the control plane version. The node pool version cannot be greater than the control plane version. For more information see upgrading a node pool. | string |
| osDiskSizeGB: | OS Disk Size in GB to be used to specify the disk size for every machine in the master/agent pool. If you specify 0, it will apply the default osDisk size according to the vmSize specified. | integer |
| osDiskType: Managed |
The default is Ephemeral if the VM supports it and has a cache disk larger than the requested OSDiskSizeGB. Otherwise, defaults to Managed. May not be changed after creation. For more information see Ephemeral OS. |
string |
| osSKU: Ubuntu |
Specifies the OS SKU used by the agent pool. The default is Ubuntu if OSType is Linux. The default is Windows2019 when Kubernetes <= 1.24 or Windows2022 when Kubernetes >= 1.25 if OSType is Windows. Valid values are Ubuntu, AzureLinux, CBLMariner, Windows2019, Windows2022. |
string |
| osType: Linux |
The operating system type. The default is Linux. Valid values are Linux, Windows. |
string |
| podSubnetID: | If omitted, pod IPs are statically assigned on the node subnet (see vnetSubnetID for more details). This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkName}/subnets/{subnetName} | string |
| code: Running |
Tells whether the cluster is Running or Stopped | string |
| proximityPlacementGroupID: | The ID for Proximity Placement Group. | string |
| scaleDownMode: Delete |
This also effects the cluster autoscaler behavior. If not specified, it defaults to Delete. Valid values are Delete, Deallocate. |
string |
| scaleSetEvictionPolicy: Delete |
This cannot be specified unless the scaleSetPriority is Spot. If not specified, the default is Delete. Valid values are Delete, Deallocate. |
string |
| scaleSetPriority: Spot |
The Virtual Machine Scale Set priority. If not specified, the default is Regular. Valid values are Spot, Regular. |
string |
| spotMaxPrice: -1 |
Possible values are any decimal value greater than zero or -1 which indicates the willingness to pay any on-demand price. For more details on spot pricing, see spot VMs pricing | number |
| tags: | The tags to be persisted on the agent pool virtual machine scale set. | object |
| type: VirtualMachineScaleSets |
The type of Agent Pool. Valid values are VirtualMachineScaleSets, AvailabilitySet. |
string |
| drainTimeoutInMinutes: | The amount of time (in minutes) to wait on eviction of pods and graceful termination per node. This eviction wait time honors waiting on pod disruption budgets. If this time is exceeded, the upgrade fails. If not specified, the default is 30 minutes. | integer |
| maxSurge: | This can either be set to an integer (e.g. 5) or a percentage (e.g. 50%). If a percentage is specified, it is the percentage of the total agent pool size at the time of the upgrade. For percentages, fractional nodes are rounded up. If not specified, the default is 1. For more information, including best practices, see: https://docs.microsoft.com/azure/aks/upgrade-cluster#customize-node-surge-upgrade |
string |
| nodeSoakDurationInMinutes: | The amount of time (in minutes) to wait after draining a node and before reimaging it and moving on to next node. If not specified, the default is 0 minutes. | integer |
| vmSize: | VM size availability varies by region. If a node contains insufficient compute resources (memory, cpu, etc) pods might fail to run correctly. For more details on restricted VM sizes, see: https://docs.microsoft.com/azure/aks/quotas-skus-regions | string |
| vnetSubnetID: | If this is not specified, a VNET and subnet will be generated and used. If no podSubnetID is specified, this applies to nodes and pods, otherwise it applies to just nodes. This is of the form: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkName}/subnets/{subnetName} | string |
| workloadRuntime: OCIContainer |
Determines the type of workload a node can run. Valid values are OCIContainer, WasmWasi. |
string |
| type: Microsoft.ContainerService/managedClusters/agentPools |
string | |
| apiVersion: 2024-01-01 |
string | |
| name: | The name of the maintenance configuration. | string |
| durationHours: 24 |
Length of maintenance window range from 4 to 24 hours. | integer |
| - end: |
The end date of the date span. | string |
| - start: |
The start date of the date span. | string |
| dayOfMonth: | The date of the month. | integer |
| intervalMonths: | Specifies the number of months between each set of occurrences. | integer |
| intervalDays: | Specifies the number of days between each set of occurrences. | integer |
| dayOfWeek: Sunday |
Specifies on which day of the week the maintenance occurs. Valid values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday. |
string |
| intervalMonths: | Specifies the number of months between each set of occurrences. | integer |
| weekIndex: First |
Specifies on which week of the month the dayOfWeek applies. Valid values are First, Second, Third, Fourth, Last. |
string |
| dayOfWeek: Sunday |
Specifies on which day of the week the maintenance occurs. Valid values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday. |
string |
| intervalWeeks: | Specifies the number of weeks between each set of occurrences. | integer |
| startDate: | The date the maintenance window activates. If the current date is before this date, the maintenance window is inactive and will not be used for upgrades. If not specified, the maintenance window will be active right away. | string |
| startTime: | The start time of the maintenance window. Accepted values are from 00:00 to 23:59. utcOffset applies to this field. For example: 02:00 with utcOffset: +02:00 means UTC time 00:00. |
string |
| utcOffset: | The UTC offset in format +/-HH:mm. For example, +05:30 for IST and -07:00 for PST. If not specified, the default is +00:00. |
string |
| - end: |
The end of a time span | string |
| - start: |
The start of a time span | string |
| - day: Sunday |
The day of the week. Valid values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday. |
string |
| - hourSlots: |
Each integer hour represents a time range beginning at 0m after the hour ending at the next hour (non-inclusive). 0 corresponds to 00:00 UTC, 23 corresponds to 23:00 UTC. Specifying [0, 1] means the 00:00 - 02:00 UTC time range. | integer[] |
| type: Microsoft.ContainerService/managedClusters/maintenanceConfigurations |
string | |
| createIdentity: | Specifies whether to create a new Azure Managed Identity for the cluster. If true, a dedicated identity is created for the cluster to authenticate with Azure services. If false, an existing managed identity can be used, which may be shared across clusters or other resources. Users are responsible for managing the shared identity's lifecycle and permissions | boolean |
| name: | The unique name of the workload identity. | string |
| resourceGroup: | The Azure resource group that contains the workload identity. | string |
| location: | The Azure region where the workload identity is created. | string |
| clientId: | The client ID of the Azure AD application associated with the workload identity. Required when users bring their own identity for authentication and access to Azure resources | string |
| principalId: | The principal ID of the Azure AD application associated with the workload identity. Required when users bring their own identity for authentication and access to Azure resources | string |
| tags: | Tags associated with the workload identity. | object |
| name: | The name of the role assignment. | string |
| scope: | The Azure resource scope where the role assignment applies. | string |
| createAccount: | Indicates whether to create a new Kubernetes service account for the workload identity. | boolean |
| name: | The name of the Kubernetes service account. | string |
| namespace: | The Kubernetes namespace where the service account resides. | string |
| labels: | Labels associated with the Kubernetes service account | object |
| annotations: | Annotations associated with the Kubernetes service account | object |
Back to top