Audience: Operators · Developers
Working YAML examples for Beskar7. Pair these with the installation guide and the first-flow walk-through.
| File | Scope | Description | Apply |
|---|---|---|---|
minimal-test.yaml |
Minimal | One PhysicalHost + one Beskar7Machine, no hardware requirements. Verifies BMC enrolment (the host reaches Available); the Beskar7Machine waits for an owning CAPI Machine and never claims the host. |
kubectl apply -f minimal-test.yaml |
minimal-test-cluster.yaml |
Single-host | One PhysicalHost + Beskar7Cluster + Beskar7Machine, with no CAPI objects: the host enrols, nothing is claimed. A spec check before kairos-k3s-node.yaml. |
kubectl apply -f minimal-test-cluster.yaml |
simple-cluster.yaml |
Full cluster | Three PhysicalHosts, one control-plane node, two worker nodes, hardware requirements, full CAPI integration. Note: this file omits the KubeadmControlPlane — provisioning blocks at "Waiting for control plane" until you add one. For a fixture proven end-to-end, see kairos-k3s-node.yaml. |
kubectl apply -f simple-cluster.yaml |
kairos-k3s-node.yaml |
Single-node | Proven end-to-end on the project's emulated lab (contract v4.2). Namespace + BMC credentials Secret + Kairos #cloud-config bootstrap Secret + PhysicalHost + Beskar7Cluster + CAPI Cluster + standalone Machine + Beskar7Machine. Drives the full provisioning loop: claim → PXE → inspection → Deploying → whole-disk write → /provisioned callback → Ready k3s node with ProviderID set. Replace every <...> placeholder before applying. |
kubectl apply -f kairos-k3s-node.yaml |
clusterclass.yaml |
ClusterClass | The Beskar7ClusterTemplate a ClusterClass points at, the machine templates its control-plane and worker classes use, and a topology Cluster that consumes the class. The control-plane/bootstrap halves use Kubeadm as the portable illustration — substitute your own providers. See Beskar7ClusterTemplate. |
kubectl apply -f clusterclass.yaml |
host-pools.yaml |
Host selection | Two labelled PhysicalHosts plus a control-plane and a worker Beskar7MachineTemplate, each with a hostSelector, so the two pools claim disjoint inventory instead of the first Available host. Merge with a full cluster fixture. |
kubectl apply -f host-pools.yaml |
target-image-digest-url.yaml |
Image digest | A Beskar7MachineTemplate that names the image digest by targetImageDigestURL (a sha256sum-style checksum file the controller reads once per machine, before it claims a host) instead of pasting targetImageDigest. Read the trust trade-off in the file and in Beskar7Machine first. |
kubectl apply -f target-image-digest-url.yaml |
kairos-providerid-stage.yaml |
Image-side stage | Verified end-to-end (Kairos v4.1.2 + k3s v1.34.8). Bake into the target image's COS_OEM as /oem/10_beskar7_providerid.yaml. Reads the per-host value beskar7 injects at /oem/beskar7/provider-id and writes the kubelet --provider-id, so ONE image and ONE Beskar7MachineTemplate serve every replica of a pool. Must be yip format (a #cloud-config file's stages: block is silently ignored) and must run before the distro first starts (Node.spec.providerID is immutable after registration). |
bake into the image, not kubectl apply |
kairos-k0s-providerid-stage.yaml |
Image-side stage (k0s) | Verified end-to-end (Kairos v4.1.2 + k0s v1.34.8+k0s.0). The k0s counterpart of the stage above, at the same path in COS_OEM. k0s has no working kubelet-flag route (the Kairos k0s provider drops --kubelet-extra-args), so this stage patches Node.spec.providerID from /oem/beskar7/provider-id right after the node registers. |
bake into the image, not kubectl apply |
kairos-k0s-start-gate.yaml |
Image-side stage (k0s) | Required for k0s; verified with the stage above. Bake into COS_OEM as /oem/05_beskar7_k0s_gate.yaml. Keeps k0scontroller/k0sworker from starting on the recovery-partition install boot (where a joiner otherwise becomes a voting etcd member and is then rebooted, killing quorum) or before the bootstrap provider has written its arguments. Opens on /etc/k0s/.capi-args-ready, written by cluster-api-provider-kairos ≥ 3698d55 — with an older provider k0s never starts. |
bake into the image, not kubectl apply |
complete-cluster.yaml |
(Deprecated) | Previously contained a KubeadmControlPlane stack that cannot produce a working Kairos node. Now contains a redirect comment to kairos-k3s-node.yaml. |
— |
security/ |
Security profile | Network policies and pod security configurations for hardened deployments. | kubectl apply -f security/ |
- Installation guide — prerequisites and install steps.
- Quick start — enrol a host with
minimal-test.yaml, then provision it withkairos-k3s-node.yaml. - Building a target image — building a raw Kairos image and baking the image-side stages into
COS_OEM. - Troubleshooting — common failures and diagnostics.
- PhysicalHost, Beskar7Machine, Beskar7Cluster — per-CRD field reference.