apiVersion: v1
kind: Pod
metadata:
annotations:
kubernetes.io/config.hash: 31d2042c537bb89e6a1bed614cd19509
kubernetes.io/config.mirror: 31d2042c537bb89e6a1bed614cd19509
kubernetes.io/config.seen: '2026-09-18T20:53:26.580514920Z'
kubernetes.io/config.source: http
talos.dev/config-file-version: '1111'
talos.dev/config-version: '1'
talos.dev/secrets-version: '1'
creationTimestamp: '2026-09-18T20:54:15Z'
generation: 1
labels:
app.kubernetes.io/component: control-plane
app.kubernetes.io/managed-by: Talos
app.kubernetes.io/name: kube-apiserver
app.kubernetes.io/version: 1.36.4
component: kube-apiserver
k8s-app: kube-apiserver
tier: control-plane
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:metadata:
f:annotations:
.: {}
f:kubernetes.io/config.hash: {}
f:kubernetes.io/config.mirror: {}
f:kubernetes.io/config.seen: {}
f:kubernetes.io/config.source: {}
f:talos.dev/config-file-version: {}
f:talos.dev/config-version: {}
f:talos.dev/secrets-version: {}
f:labels:
.: {}
f:app.kubernetes.io/component: {}
f:app.kubernetes.io/managed-by: {}
f:app.kubernetes.io/name: {}
f:app.kubernetes.io/version: {}
f:component: {}
f:k8s-app: {}
f:tier: {}
f:ownerReferences:
.: {}
k:{"uid":"aa16654e-03a6-4d9f-a0e6-65f52b9d0900"}: {}
f:spec:
f:containers:
k:{"name":"kube-apiserver"}:
.: {}
f:command: {}
f:env:
.: {}
k:{"name":"POD_IP"}:
.: {}
f:name: {}
f:valueFrom:
.: {}
f:fieldRef: {}
f:image: {}
f:imagePullPolicy: {}
f:name: {}
f:resources:
.: {}
f:requests:
.: {}
f:cpu: {}
f:memory: {}
f:securityContext:
.: {}
f:allowPrivilegeEscalation: {}
f:capabilities:
.: {}
f:add: {}
f:drop: {}
f:seccompProfile:
.: {}
f:type: {}
f:terminationMessagePath: {}
f:terminationMessagePolicy: {}
f:volumeMounts:
.: {}
k:{"mountPath":"/system/config/kubernetes/kube-apiserver"}:
.: {}
f:mountPath: {}
f:name: {}
f:readOnly: {}
k:{"mountPath":"/system/secrets/kubernetes/kube-apiserver"}:
.: {}
f:mountPath: {}
f:name: {}
f:readOnly: {}
k:{"mountPath":"/var/log/audit/kube"}:
.: {}
f:mountPath: {}
f:name: {}
f:dnsPolicy: {}
f:enableServiceLinks: {}
f:hostNetwork: {}
f:nodeName: {}
f:priority: {}
f:priorityClassName: {}
f:restartPolicy: {}
f:schedulerName: {}
f:securityContext:
.: {}
f:runAsGroup: {}
f:runAsNonRoot: {}
f:runAsUser: {}
f:terminationGracePeriodSeconds: {}
f:volumes:
.: {}
k:{"name":"audit"}:
.: {}
f:hostPath:
.: {}
f:path: {}
f:type: {}
f:name: {}
k:{"name":"config"}:
.: {}
f:hostPath:
.: {}
f:path: {}
f:type: {}
f:name: {}
k:{"name":"secrets"}:
.: {}
f:hostPath:
.: {}
f:path: {}
f:type: {}
f:name: {}
manager: kubelet
operation: Update
time: '2026-09-18T20:54:15Z'
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:status:
f:allocatedResources:
.: {}
f:cpu: {}
f:memory: {}
f:conditions:
.: {}
k:{"type":"ContainersReady"}:
.: {}
f:lastProbeTime: {}
f:lastTransitionTime: {}
f:status: {}
f:type: {}
k:{"type":"Initialized"}:
.: {}
f:lastProbeTime: {}
f:lastTransitionTime: {}
f:status: {}
f:type: {}
k:{"type":"PodReadyToStartContainers"}:
.: {}
f:lastProbeTime: {}
f:lastTransitionTime: {}
f:status: {}
f:type: {}
k:{"type":"PodScheduled"}:
.: {}
f:lastProbeTime: {}
f:lastTransitionTime: {}
f:status: {}
f:type: {}
k:{"type":"Ready"}:
.: {}
f:lastProbeTime: {}
f:lastTransitionTime: {}
f:status: {}
f:type: {}
f:containerStatuses: {}
f:hostIP: {}
f:hostIPs: {}
f:phase: {}
f:podIP: {}
f:podIPs:
.: {}
k:{"ip":"172.29.21.217"}:
.: {}
f:ip: {}
f:resources:
.: {}
f:requests:
.: {}
f:cpu: {}
f:memory: {}
f:startTime: {}
manager: kubelet
operation: Update
subresource: status
time: '2026-09-18T20:54:15Z'
name: kube-apiserver-csfarm-controlplane-02
namespace: kube-system
ownerReferences:
- apiVersion: v1
controller: true
kind: Node
name: csfarm-controlplane-02
uid: aa16654e-03a6-4d9f-a0e6-65f52b9d0900
resourceVersion: '571'
uid: 34a381a9-7372-4f15-a9d6-d9f55446f204
spec:
containers:
- command:
- /usr/local/bin/kube-apiserver
- --admission-control-config-file=/system/config/kubernetes/kube-apiserver/admission-control-config.yaml
- --advertise-address=$(POD_IP)
- --allow-privileged=true
- --anonymous-auth=false
- --api-audiences=https://172.29.21.200:6443
- --audit-log-maxage=30
- --audit-log-maxbackup=10
- --audit-log-maxsize=100
- --audit-log-path=/var/log/audit/kube/kube-apiserver.log
- --audit-policy-file=/system/config/kubernetes/kube-apiserver/auditpolicy.yaml
- --authorization-config=/system/config/kubernetes/kube-apiserver/authorization-config.yaml
- --bind-address=0.0.0.0
- --client-ca-file=/system/secrets/kubernetes/kube-apiserver/ca.crt
- --enable-admission-plugins=NodeRestriction
- --enable-bootstrap-token-auth=true
- --encryption-provider-config=/system/secrets/kubernetes/kube-apiserver/encryptionconfig.yaml
- --etcd-cafile=/system/secrets/kubernetes/kube-apiserver/etcd-client-ca.crt
- --etcd-certfile=/system/secrets/kubernetes/kube-apiserver/etcd-client.crt
- --etcd-keyfile=/system/secrets/kubernetes/kube-apiserver/etcd-client.key
- --etcd-servers=https://127.0.0.1:2379
- --kubelet-client-certificate=/system/secrets/kubernetes/kube-apiserver/apiserver-kubelet-client.crt
- --kubelet-client-key=/system/secrets/kubernetes/kube-apiserver/apiserver-kubelet-client.key
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --profiling=false
- --proxy-client-cert-file=/system/secrets/kubernetes/kube-apiserver/front-proxy-client.crt
- --proxy-client-key-file=/system/secrets/kubernetes/kube-apiserver/front-proxy-client.key
- --requestheader-allowed-names=front-proxy-client
- --requestheader-client-ca-file=/system/secrets/kubernetes/kube-apiserver/aggregator-ca.crt
- --requestheader-extra-headers-prefix=X-Remote-Extra-
- --requestheader-group-headers=X-Remote-Group
- --requestheader-username-headers=X-Remote-User
- --secure-port=6443
- --service-account-issuer=https://172.29.21.200:6443
- --service-account-key-file=/system/secrets/kubernetes/kube-apiserver/service-account.pub
- --service-account-signing-key-file=/system/secrets/kubernetes/kube-apiserver/service-account.key
- --service-cluster-ip-range=10.96.0.0/12
- --tls-cert-file=/system/secrets/kubernetes/kube-apiserver/apiserver.crt
- --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
- --tls-min-version=VersionTLS12
- --tls-private-key-file=/system/secrets/kubernetes/kube-apiserver/apiserver.key
env:
- name: POD_IP
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: status.podIP
image: registry.k8s.io/kube-apiserver:v1.36.4
imagePullPolicy: IfNotPresent
name: kube-apiserver
resources:
requests:
cpu: 200m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
seccompProfile:
type: RuntimeDefault
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /system/secrets/kubernetes/kube-apiserver
name: secrets
readOnly: true
- mountPath: /system/config/kubernetes/kube-apiserver
name: config
readOnly: true
- mountPath: /var/log/audit/kube
name: audit
dnsPolicy: ClusterFirst
enableServiceLinks: true
hostNetwork: true
nodeName: csfarm-controlplane-02
preemptionPolicy: PreemptLowerPriority
priority: 2000000000
priorityClassName: system-cluster-critical
restartPolicy: Always
schedulerName: default-scheduler
securityContext:
runAsGroup: 65534
runAsNonRoot: true
runAsUser: 65534
terminationGracePeriodSeconds: 30
tolerations:
- effect: NoExecute
key: node.kubernetes.io/not-ready
operator: Exists
tolerationSeconds: 300
- effect: NoExecute
key: node.kubernetes.io/unreachable
operator: Exists
tolerationSeconds: 300
volumes:
- hostPath:
path: /system/secrets/kubernetes/kube-apiserver
type: ''
name: secrets
- hostPath:
path: /system/config/kubernetes/kube-apiserver
type: ''
name: config
- hostPath:
path: /var/log/audit/kube
type: ''
name: audit
status:
allocatedResources:
cpu: 200m
memory: 512Mi
conditions:
- lastProbeTime: null
lastTransitionTime: '2026-09-18T20:53:27Z'
status: 'True'
type: PodReadyToStartContainers
- lastProbeTime: null
lastTransitionTime: '2026-09-18T20:53:26Z'
status: 'True'
type: Initialized
- lastProbeTime: null
lastTransitionTime: '2026-09-18T20:53:32Z'
status: 'True'
type: Ready
- lastProbeTime: null
lastTransitionTime: '2026-09-18T20:53:32Z'
status: 'True'
type: ContainersReady
- lastProbeTime: null
lastTransitionTime: '2026-09-18T20:53:26Z'
status: 'True'
type: PodScheduled
containerStatuses:
- allocatedResources:
cpu: 200m
memory: 512Mi
containerID: containerd://71d13c5ad3b2b9a8dd31c237e634542a7a29540dae7d28f2f75ab1b10325de55
image: registry.k8s.io/kube-apiserver:v1.36.4
imageID: registry.k8s.io/kube-apiserver@sha256:cfcdb01653308b975d589b528bfafe54011dfae925d85059177d95963a622748
lastState: {}
name: kube-apiserver
ready: true
resources:
requests:
cpu: 200m
memory: 512Mi
restartCount: 0
started: true
state:
running:
startedAt: '2026-09-18T20:53:32Z'
user:
linux:
gid: 65534
supplementalGroups:
- 65534
uid: 65534
volumeMounts:
- mountPath: /system/secrets/kubernetes/kube-apiserver
name: secrets
readOnly: true
recursiveReadOnly: Disabled
- mountPath: /system/config/kubernetes/kube-apiserver
name: config
readOnly: true
recursiveReadOnly: Disabled
- mountPath: /var/log/audit/kube
name: audit
hostIP: 172.29.21.217
hostIPs:
- ip: 172.29.21.217
phase: Running
podIP: 172.29.21.217
podIPs:
- ip: 172.29.21.217
qosClass: Burstable
resources:
requests:
cpu: 200m
memory: 512Mi
startTime: '2026-09-18T20:53:26Z'