ctrl 配置

本页列出 ctrl 配置文件的每个表与键，由带注释的示例 ctrl.example.toml 生成，ctrl 的测试核对示例与它读取的键一致；说明保持英文。示例中注释掉的表与键是可选的。

[database]复制标题链接

[identity]复制标题链接

[storage]复制标题链接

[api]复制标题链接

The ctrl API: the Workspace face and the Operator face share this one mTLS listener. kibo and, later, a tenant platform connect here with identities the control-client CA issued; there is no plaintext or unauthenticated Workspace endpoint.

[node_api]复制标题链接

[telemetry]复制标题链接

可选。

Optional. ctrl's own metrics in the Prometheus text format at GET /metrics, including the cluster state it reads from the database when scraped. Plain HTTP without authentication: bind loopback and scrape from this host, or bind 0.0.0.0 in a container and let only the collector reach the port. Omit the section to open no listener. [metrics] below is a different thing: the store for per-Instance readings.

[data_plane]复制标题链接

How ctrl names node data-plane certificates. ctrl derives every node's primary data-plane host as "<node_id>.<host_suffix>" and signs it with the internal server CA. default_extra_hosts are deployment-wide extra names (an IP, a loopback address, or an external DNS name) added to every node's leaf beyond that derived host and the per-node extras an Operator declares on the enrollment grant. None of them may be the ctrl identity.host. host_suffix is required.

[exposure]复制标题链接

The registrable domain Exposure hostnames live under. Every Exposure is "<random label>.<zone>", served through the deployment tunnel and the gateway. Leave it empty to refuse CreateExposure on this deployment. It must not share a registrable domain with identity.host or data_plane.host_suffix: the pages behind it are written by an Agent, and sharing a domain would pull cookie scope and the phishing surface onto the control plane.

[workspace]复制标题链接

How many accepted Workspace commands ctrl runs at once, across every node: this many creates, starts and transfer restores; separately this many stops, deletes and data-plane revocations; and half as many (at least one) transfer exports and imports. A command holds a database connection only while it reads or writes, not while it waits on the node.

[transfer]复制标题链接

Optional. Workspace transfer archives live in the artifact store below. An export larger than max_archive_bytes fails (at most 5368709120, one upload request); an archive is deleted archive_retention_seconds after its export completed, and a Transfer not imported by then becomes EXPIRED. These are the defaults.

[template_artifact_store]复制标题链接

Required for node_api artifact tickets, Operator publication, and Workspace transfer archives. The runtime identity needs both the kibotos-template/v1/ and kibotos-transfer/v1/ prefixes of the bucket; transfer archives are user data, so enable encryption at rest on it.

[metrics]复制标题链接

可选。

Optional. ctrl writes the instance info series kibotos_instance_info (value 1, labels instance_id, workspace_id and the Workspace labels listed below) to the metrics store as soon as it sees an Instance running and again every 60 s, and hands every node the store's address with a write token so the nodes push their guest samples there. Omit the section to write nothing: nodes then sample nothing. Every kibotos-ctrl command that loads this file validates the section and reads the key and CA files, so kibotos-ctrl must be able to read them.

[traces]复制标题链接

可选。

Optional: the trace store. ctrl pushes its own spans there and hands every node the address with a push token, so the nodes push theirs too. Omit the section to produce no spans anywhere. Every kibotos-ctrl command that loads this file validates the section and reads the key and CA files.