{"id":35804333,"url":"https://github.com/kommodity-io/kommodity","last_synced_at":"2026-05-28T11:00:58.234Z","repository":{"id":291645288,"uuid":"978290450","full_name":"kommodity-io/kommodity","owner":"kommodity-io","description":"A single binary to power the sovereign backbone of your digital infrastructure.","archived":false,"fork":false,"pushed_at":"2026-05-27T15:20:36.000Z","size":6346,"stargazers_count":18,"open_issues_count":9,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-05-27T16:27:59.874Z","etag":null,"topics":["api","baremetal","kubectl","kubernetes-controller","sovereign-cloud","talos-linux"],"latest_commit_sha":null,"homepage":"https://kommodity.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kommodity-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-05-05T18:57:46.000Z","updated_at":"2026-05-27T14:59:26.000Z","dependencies_parsed_at":"2026-03-26T17:03:54.278Z","dependency_job_id":null,"html_url":"https://github.com/kommodity-io/kommodity","commit_stats":null,"previous_names":["kommodity-io/kommodity"],"tags_count":190,"template":false,"template_full_name":null,"purl":"pkg:github/kommodity-io/kommodity","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kommodity-io%2Fkommodity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kommodity-io%2Fkommodity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kommodity-io%2Fkommodity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kommodity-io%2Fkommodity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kommodity-io","download_url":"https://codeload.github.com/kommodity-io/kommodity/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kommodity-io%2Fkommodity/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33605379,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-28T02:00:06.440Z","response_time":99,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api","baremetal","kubectl","kubernetes-controller","sovereign-cloud","talos-linux"],"created_at":"2026-01-07T12:14:43.238Z","updated_at":"2026-05-28T11:00:58.220Z","avatar_url":"https://github.com/kommodity-io.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Kommodity — A single binary to power the sovereign backbone of your digital infrastructure.](public/banner-light.svg#gh-light-mode-only)\n![Kommodity — A single binary to power the sovereign backbone of your digital infrastructure.](public/banner-dark.svg#gh-dark-mode-only)\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://goreportcard.com/report/github.com/kommodity-io/kommodity\"\u003e\u003cimg alt=\"Go Report Card\" src=\"https://img.shields.io/badge/go%20report-A+-brightgreen?style=flat-square\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://pkg.go.dev/github.com/kommodity-io/kommodity\"\u003e\u003cimg alt=\"Go Reference\" src=\"https://img.shields.io/badge/godoc-reference-blue?style=flat-square\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/kommodity-io/kommodity/actions\"\u003e\u003cimg alt=\"CI\" src=\"https://img.shields.io/github/actions/workflow/status/kommodity-io/kommodity/release.yml?branch=main\u0026label=ci\u0026style=flat-square\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/kommodity-io/kommodity/releases\"\u003e\u003cimg alt=\"Release\" src=\"https://img.shields.io/github/v/release/kommodity-io/kommodity?include_prereleases\u0026label=release\u0026style=flat-square\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/kommodity-io/kommodity/blob/main/LICENSE\"\u003e\u003cimg alt=\"License\" src=\"https://img.shields.io/github/license/kommodity-io/kommodity?style=flat-square\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u003e **One binary. Kubernetes APIs. Verifiable machines. Encrypted disks.**\n\u003e\n\u003e Kommodity packages Cluster API, Talos Linux providers, and hardware-rooted\n\u003e security services into a single binary so that compliant, multi-cloud\n\u003e Kubernetes clusters are as routine to deploy as any other workload.\n\n---\n\n## Table of Contents\n\n- [Why Kommodity](#why-kommodity)\n- [What's in the Box](#whats-in-the-box)\n- [Architecture](#architecture)\n- [Features](#features)\n- [Quick Start](#quick-start)\n- [Deployment](#deployment)\n- [Configuration](#configuration)\n- [CAPI Provider Versions](#capi-provider-versions)\n- [Further Reading](#further-reading)\n- [License](#license)\n\n---\n\n## Why Kommodity\n\nSovereign cloud — keeping control of your infrastructure, your encryption keys,\nand your audit trail — usually means stitching together cloud-specific tooling,\nbespoke key management, and ad-hoc attestation. The result is fragile, expensive,\nand locked to whoever sold you \"sovereign\" first.\n\nKommodity takes the opposite approach: assemble proven, open-source building\nblocks (Cluster API, Talos Linux, Kine, TPM attestation) and ship them as a\nsingle binary that speaks the Kubernetes API. The same `kubectl` and Helm\nworkflows work across Scaleway, Azure, KubeVirt, Docker, and bare metal.\n\n| Without Kommodity                               | With Kommodity                                         |\n| ----------------------------------------------- | ------------------------------------------------------ |\n| Learn each cloud's APIs, consoles, and quirks   | One Kubernetes-native control plane for every provider |\n| Trust machines because they're \"on the network\" | TPM-attested boot — no quote, no secrets               |\n| Cloud-provider KMS holds the encryption keys    | Per-volume LUKS keys live in your database             |\n| Different ops model per environment             | Same GitOps, RBAC, and audit logs everywhere           |\n| Compliance bolted on after deployment           | Encryption, attestation, and audit logging by default  |\n\n---\n\n## What's in the Box\n\nA single `kommodity` binary that combines:\n\n- **Kubernetes API server** — built on `k8s.io/apiserver` with extension and aggregation layer support\n- **Cluster API controllers** — cluster, machine, and machine-deployment lifecycle\n- **Talos Linux providers** — bootstrap and control-plane providers for immutable nodes\n- **[Kine](https://github.com/k3s-io/kine)** — etcd shim that lets any [supported SQL backend](https://deepwiki.com/k3s-io/kine#backend-driver-architecture) (PostgreSQL, MySQL, SQLite, NATS, …) replace etcd\n- **KMS service** — networked LUKS2 key management with per-volume AES-256-GCM and AAD binding\n- **Attestation service** — TPM 2.0 quote verification gated by per-cluster policy\n- **Metadata service** — Talos machine config delivery, gated by attestation\n- **Talos proxy** — HTTP CONNECT proxy that tunnels gRPC into private-network workload clusters\n- **Cluster autoscaler integration** — scales `MachineDeployment` replicas based on pending pods\n- **Web UI** — kubeconfig retrieval, cluster overview, machine deployment drill-down\n\n---\n\n## Architecture\n\n![Kommodity Architecture](images/kommodity-architecture.excalidraw.png)\n\nFor the security architecture — TPM attestation flow and disk encryption key\nmanagement — see [SECURITY.md](SECURITY.md).\n\n---\n\n## Features\n\n### One API, Any Cloud\n\nProvision Kubernetes clusters with vanilla Cluster API resources. Today\nKommodity ships with providers for Scaleway, Azure, KubeVirt, and Docker; CAPI's\nprovider ecosystem means more can be added without touching Kommodity itself.\n\n### OIDC Authentication\n\nPlug Kommodity into Google, Azure AD, or any other OpenID Connect provider.\nGroup claims from the IdP map to authorization decisions; the\n`KOMMODITY_ADMIN_GROUP` you configure gets cluster-admin equivalence, alongside\nthe standard `system:masters`. For local development, set\n`KOMMODITY_INSECURE_DISABLE_AUTHENTICATION=true`.\n\n### Audit Logging\n\nNative support for the Kubernetes\n[audit policy format](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/).\nPoint `KOMMODITY_AUDIT_POLICY_FILE_PATH` at a policy file and every API request\nis captured with user, source IP, timestamp, and (optionally) request/response\nbodies.\n\n### Hardware-Rooted Machine Trust\n\nThe [attestation extension](https://github.com/kommodity-io/kommodity-attestation-extension)\nruns on every Talos node and submits a TPM-signed quote — covering Secure Boot,\nSELinux/AppArmor state, kernel lockdown, installed extensions, and PCR values —\nbefore the metadata service is willing to hand over machine configuration. A\nmachine that can't prove what it booted gets no secrets.\n\n### Sovereign Disk Encryption\n\nThe KMS service implements the SideroLabs\n[KMS gRPC API](https://github.com/siderolabs/kms-client) and seals LUKS2 keys\nfor the `STATE` and `EPHEMERAL` partitions with AES-256-GCM. Each volume gets\nits own key and AAD nonce; the AAD binds the ciphertext to the node UUID and\nthe requesting IP, so a leaked disk image is unreadable on its own. Key\nrevocation is `kubectl delete secret`.\n\n### Talos Proxy\n\nWhen the management plane manages clusters on private networks, the\nTalosControlPlane reconciler cannot reach Talos nodes directly on port 50000.\nA local HTTP CONNECT proxy intercepts those gRPC connections and tunnels them\nthrough a Kubernetes port-forward to a `talos-cluster-proxy` pod inside the\nworkload cluster. End-to-end mTLS is preserved. See\n[`pkg/talosproxy`](pkg/talosproxy/README.md) for details.\n\n### Auto-Bootstrap\n\nThe [auto-bootstrap extension](https://github.com/kommodity-io/kommodity-autobootstrap-extension)\nturns control-plane bring-up into a no-touch operation: every candidate node\nruns the same deterministic leader-election algorithm (earliest boot time,\nlowest IP as tiebreaker) over peers discovered in the configured CIDR, the\nwinner initializes etcd, and the rest join automatically. Private networks\nonly.\n\n### Autoscaling\n\nA cluster-autoscaler-compatible reconciler watches `MachineDeployment` replica\ncounts and requeues until they converge, so the upstream cluster autoscaler can\ndrive replicas the same way it would on any CAPI-managed cluster.\n\n### Web UI\n\nThe UI exposes the bits operators actually need without making them touch\n`kubectl`: per-cluster kubeconfig copy/download, an at-a-glance dashboard of\nclusters and machine counts, and a cluster detail page with machine-deployment\nbreakdowns (including GPU pools) and health status. With Kommodity running, the\noverview is at [`/ui`](http://localhost:8000/ui) and the per-cluster page at\n[`/ui/clusters/\u003ccluster-name\u003e`](http://localhost:8000/ui/clusters/).\n\n**Overview** — kubeconfig retrieval, cluster counts, and the clusters table:\n\n![Kommodity UI overview](images/kommodity-ui-overview.png)\n\n**Cluster details** — health, versions, and per-cluster machine deployments\nwith min/current/max replicas:\n\n![Kommodity UI cluster details](images/kommodity-ui-cluster-page.png)\n\n### Storage Backends\n\nKommodity uses Kine, so any database\n[supported by Kine](https://deepwiki.com/k3s-io/kine#backend-driver-architecture)\ncan back the API server. PostgreSQL is the default and best-tested.\n\n### Cluster Addons\n\nThe [`kommodity-cluster`](charts/kommodity-cluster) Helm chart ships with a\nfully-fledged addon lifecycle engine: every addon is a uniform unit with its\nown install mode, idempotency condition, upgrade policy, hook scripts, and\ninitial values — whether it's the built-in Cilium CNI or a chart you bring\nyourself.\n\n**Bundled addons**\n\n| Addon                   | Default    | Install mode   | Namespace             | What it gives you                                                                |\n| ----------------------- | ---------- | -------------- | --------------------- | -------------------------------------------------------------------------------- |\n| **Cilium**              | ✅ enabled | `HelmInstall`  | `kube-system`         | eBPF CNI, kube-proxy replacement, Hubble UI/relay, BGP control plane             |\n| **talos-cluster-proxy** | ✅ enabled | `HelmInstall`  | `talos-cluster-proxy` | In-cluster gRPC proxy used by Kommodity to reach Talos nodes on private networks |\n| **ArgoCD**              | ⬜️ opt-in  | `KubectlApply` | `argocd`              | GitOps control plane; install-once-then-adopt by default                         |\n\n**Lifecycle controls (every addon)**\n\n| Field                                              | Purpose                                                                                       |\n| -------------------------------------------------- | --------------------------------------------------------------------------------------------- |\n| `lifecycle.install.mode`                           | `HelmInstall` for chart releases or `KubectlApply` for plain manifests                        |\n| `lifecycle.install.condition`                      | Skip re-install when a target resource already exists (required for `KubectlApply`)           |\n| `lifecycle.upgrade.disable`                        | After the initial install, leave the addon untouched — hand ongoing management to ArgoCD/Flux |\n| `namespace`                                        | Target namespace (defaults to the addon name)                                                 |\n| `chart.{repository,name,version}`                  | Pinned OCI or HTTPS Helm chart coordinates                                                    |\n| `initialExtraValues`                               | Values merged into the chart **at first install only** (immutable thereafter)                 |\n| `extraEnvs`                                        | Extra env vars on the installer job, including `secretKeyRef` for credentials                 |\n| `preInstallationScript` / `postInstallationScript` | Shell hooks run around the install for migrations or bootstrap glue                           |\n\n**Bring your own addon**\n\nAny Helm chart on any OCI/HTTPS registry is a first-class addon. Drop it under\n`kommodity.addons.\u003cname\u003e` and you get the same lifecycle, GitOps handoff, hook\nscripts, and credential injection as the built-ins. The pattern fits the\n\"replace managed services with sovereign equivalents\" use case — for example,\n[CNPG](https://cloudnative-pg.io/) instead of RDS/Cloud SQL,\n[Strimzi](https://strimzi.io/) instead of managed Kafka,\n[Rook/Ceph](https://rook.io/) instead of managed object storage:\n\n```yaml\nkommodity:\n  addons:\n    cnpg:\n      enabled: true\n      namespace: cnpg-system\n      lifecycle:\n        install:\n          mode: HelmInstall\n        upgrade:\n          disable: true # hand ongoing reconciliation to GitOps\n      chart:\n        repository: https://cloudnative-pg.github.io/charts\n        name: cloudnative-pg\n        version: 0.23.0\n      initialExtraValues:\n        monitoring:\n          enabled: true\n```\n\nSet `upgrade.disable: true` on day one and your GitOps tool can \"adopt\" the\nrelease without Kommodity fighting it on every reconcile. See the default\n[`values.yaml`](charts/kommodity-cluster/values.yaml) for the full schema and\nper-addon examples.\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- A recent Go (we recommend [gvm][gvm]):\n\n  ```bash\n  gvm install go1.26.1 -B\n  gvm use go1.26.1 --default\n  ```\n\n- [Caddy](https://caddyserver.com/docs/install) for local TLS termination (bootstrapped by `make setup`).\n- The `kubectl` `oidc-login` plugin if you want OIDC locally:\n\n  ```bash\n  kubectl krew install oidc-login\n  ```\n\n### Run It Locally\n\n```bash\ngit clone https://github.com/kommodity-io/kommodity\ncd kommodity\n\n# Boot PostgreSQL + Caddy, run code generation\nmake setup\n\n# Build the UI (must run before `make run`)\nmake build-ui\n\n# Run Kommodity\nmake run\n```\n\nThen point `kubectl` at it:\n\n```bash\nkubectl --kubeconfig kommodity.yaml api-resources\nkubectl --kubeconfig kommodity.yaml create -f examples/namespace.yaml\n```\n\nA minimal kubeconfig for OIDC-authenticated local use:\n\n```yaml\napiVersion: v1\nkind: Config\nclusters:\n  - name: kommodity\n    cluster:\n      server: https://localhost:5443\n      insecure-skip-tls-verify: true\nusers:\n  - name: oidc\n    user:\n      exec:\n        apiVersion: client.authentication.k8s.io/v1\n        command: kubectl\n        args:\n          - oidc-login\n          - get-token\n          - --oidc-issuer-url=ISSUER_URL\n          - --oidc-client-id=YOUR_CLIENT_ID\n          - --oidc-extra-scope=email\n        interactiveMode: Always\ncontexts:\n  - name: kommodity-context\n    context:\n      cluster: kommodity\n      user: oidc\ncurrent-context: kommodity-context\n```\n\n### Useful Make Targets\n\n```bash\nmake build                            # binary in bin/\nmake build-ui                         # UI assets (htmx/templates)\nmake run                              # run locally against the docker-compose stack\nmake teardown                         # tear down the docker-compose stack\nmake run-kubevirt-integration-test    # deploy a workload cluster on local KubeVirt\nmake run-scaleway-integration-test    # deploy a workload cluster on Scaleway (costs $$)\nmake run-helm-unit-tests              # helm unittest for charts/kommodity-cluster\n```\n\n### Get a Workload Cluster's kubeconfig\n\nFrom the UI (per-cluster copy/download), or from the CLI:\n\n```bash\nkubectl --kubeconfig kommodity.yaml get secrets \u003ccluster\u003e-kubeconfig -ojson \\\n  | jq -r '.data.value' | base64 -d \u003e workload.kubeconfig\n```\n\nFor `talosctl`:\n\n```bash\nkubectl --kubeconfig kommodity.yaml get secrets \u003ccluster\u003e-talosconfig -ojson \\\n  | jq -r '.data.talosconfig' | base64 -d \u003e talosconfig\ntalosctl --talosconfig talosconfig kubeconfig -n \u003ccontrolplane-ip\u003e\n```\n\n---\n\n## Deployment\n\n### Helm — `kommodity-cluster`\n\nOnce Kommodity itself is running, deploy workload clusters with the\n[`kommodity-cluster`](charts/kommodity-cluster) chart:\n\n```bash\n# Provider credentials (Scaleway example)\nkubectl --kubeconfig kommodity.yaml create secret generic scaleway-secret \\\n  --from-literal=SCW_ACCESS_KEY=\u003ckey\u003e \\\n  --from-literal=SCW_SECRET_KEY=\u003csecret\u003e \\\n  --from-literal=SCW_DEFAULT_REGION=fr-par \\\n  --from-literal=SCW_DEFAULT_PROJECT_ID=\u003cproject-id\u003e\n\n# Render and apply\nhelm template my-cluster oci://ghcr.io/kommodity-io/charts/kommodity-cluster \\\n  -f values.scaleway.yaml | kubectl --kubeconfig kommodity.yaml apply -f -\n```\n\nA minimal `values.scaleway.yaml`:\n\n```yaml\nkommodity:\n  provider:\n    name: Scaleway\n    secret:\n      name: scaleway-secret\n  region: fr-par\n  controlplane:\n    replicas: 3\n    sku: PLAY2-NANO\n  nodepools:\n    default:\n      replicas: 2\n      sku: PLAY2-NANO\n```\n\nProvider-specific examples (Scaleway, Azure, KubeVirt, Docker) live in\n[`charts/kommodity-cluster`](charts/kommodity-cluster).\n\n### Terraform — Azure\n\nThe [`kommodity_azure_deployment`](terraform/modules/kommodity_azure_deployment)\nmodule provisions Kommodity itself on Azure: VNet, PostgreSQL Flexible Server,\nContainer App, Log Analytics, and a custom-domain HTTPS endpoint backed by an\nAzure-managed certificate.\n\nSee [`terraform/examples`](terraform/examples) for end-to-end examples.\n\n### Single Binary\n\nThe binary itself has no hidden runtime dependencies beyond a PostgreSQL\nconnection. Drop it on any host, point it at a database, and run.\n\n---\n\n## Configuration\n\nKommodity is configured via environment variables.\n\n| Variable                                           | Description                                                       | Default                 |\n| -------------------------------------------------- | ----------------------------------------------------------------- | ----------------------- |\n| `KOMMODITY_PORT`                                   | Port for the Kommodity server                                     | `5000`                  |\n| `KOMMODITY_BASE_URL`                               | Base URL for the Kommodity server                                 | `http://localhost:5000` |\n| `KOMMODITY_DB_URI`                                 | PostgreSQL connection URI                                         | (none)                  |\n| `KOMMODITY_DEVELOPMENT_MODE`                       | Enable development mode                                           | `false`                 |\n| `KOMMODITY_INSECURE_DISABLE_AUTHENTICATION`        | Disable authentication for local development                      | `false`                 |\n| `KOMMODITY_ADMIN_GROUP`                            | Group name granted cluster-admin equivalence                      | (none)                  |\n| `KOMMODITY_OIDC_ISSUER_URL`                        | OIDC issuer URL                                                   | (none)                  |\n| `KOMMODITY_OIDC_CLIENT_ID`                         | OIDC client ID                                                    | (none)                  |\n| `KOMMODITY_OIDC_USERNAME_CLAIM`                    | OIDC claim used for the username                                  | `email`                 |\n| `KOMMODITY_OIDC_GROUPS_CLAIM`                      | OIDC claim used for groups                                        | `groups`                |\n| `KOMMODITY_INFRASTRUCTURE_PROVIDERS`               | Comma-separated providers to enable                               | all                     |\n| `KOMMODITY_ATTESTATION_NONCE_TTL`                  | TTL for attestation nonces (e.g. `5m`, `1h`)                      | `5m`                    |\n| `KOMMODITY_AUDIT_POLICY_FILE_PATH`                 | Path to a Kubernetes audit policy file                            | (none)                  |\n| `KOMMODITY_TALOS_PROXY_ENABLED`                    | Enable the HTTP CONNECT Talos gRPC proxy                          | `true`                  |\n| `KOMMODITY_TALOS_PROXY_PORT`                       | Local listen port for the proxy                                   | `15050`                 |\n| `KOMMODITY_TALOS_PROXY_NAMESPACE`                  | Namespace of the talos-cluster-proxy service in workload clusters | `talos-cluster-proxy`   |\n| `KOMMODITY_TALOS_PROXY_SERVICE_NAME`               | Name of the talos-cluster-proxy service                           | `talos-cluster-proxy`   |\n| `KOMMODITY_TALOS_PROXY_IDLE_TIMEOUT`               | Idle timeout before unused tunnels are closed                     | `1m`                    |\n| `KOMMODITY_GARBAGE_COLLECTOR_ENABLED`              | Enable the embedded garbage collector                             | `false`                 |\n| `KOMMODITY_GARBAGE_COLLECTOR_WORKERS`              | Number of garbage collector workers                               | `5`                     |\n| `KOMMODITY_GARBAGE_COLLECTOR_SYNC_PERIOD`          | Resync period for the garbage collector                           | `30s`                   |\n| `KOMMODITY_GARBAGE_COLLECTOR_INITIAL_SYNC_TIMEOUT` | Timeout waiting for initial informer sync                         | `60s`                   |\n\nProvider settings are managed in\n[`pkg/provider/providers.yaml`](pkg/provider/providers.yaml): name, repository,\nGo module, CRD filter/deny lists, and API scheme locations. Providers must be\ncompatible with Cluster API `v1.10.x`.\n\n---\n\n## CAPI Provider Versions\n\n| Provider                                 | Version  | Type           |\n| ---------------------------------------- | -------- | -------------- |\n| cluster-api                              | v1.10.10 | Core           |\n| cluster-api-control-plane-provider-talos | v0.5.13  | Control Plane  |\n| cluster-api-bootstrap-provider-talos     | v0.6.12  | Bootstrap      |\n| cluster-api-provider-scaleway            | v0.1.5   | Infrastructure |\n| cluster-api-provider-kubevirt            | v0.1.10  | Infrastructure |\n| cluster-api-provider-azure               | v1.21.0  | Infrastructure |\n\n### Limitations\n\n- Helm [`hooks`](https://helm.sh/docs/topics/charts_hooks/) are not supported.\n\n---\n\n## Further Reading\n\n- [SECURITY.md](SECURITY.md) — disk encryption and machine trust internals\n- [Talos Linux Documentation](https://docs.siderolabs.com/talos/)\n- [Cluster API Documentation](https://cluster-api.sigs.k8s.io/)\n- [Kine — etcd shim for SQL databases](https://github.com/k3s-io/kine)\n- [Attestation Extension](https://github.com/kommodity-io/kommodity-attestation-extension)\n- [Auto-Bootstrap Extension](https://github.com/kommodity-io/kommodity-autobootstrap-extension)\n\n---\n\n## License\n\nKommodity is licensed under the [Apache License 2.0](LICENSE).\n\n[gvm]: https://github.com/moovweb/gvm\n[semver]: https://semver.org\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkommodity-io%2Fkommodity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkommodity-io%2Fkommodity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkommodity-io%2Fkommodity/lists"}