node 配置

本页列出 node 配置文件的每个表与键，由带注释的示例 node.example.toml 生成，node 的测试核对示例与它读取的键一致；说明保持英文。示例中注释掉的表与键是可选的。

[backend]复制标题链接

[resources]复制标题链接

What this host can give its VMs: the physical CPU and memory less what the host itself needs. The node refuses to start when either exceeds the host's online CPUs or MemTotal. Overcommit is not written here: ctrl multiplies these by the ratios an operator sets with kibo node overcommit.

[storage]复制标题链接

The node runs as root and starts every VMM as the fixed system user kibotos-vmm (supplementary group kvm); the user is not configurable. Every directory from / down to the storage root and the socket root must be traversable by that user; the node checks this at startup and creates its own directories with group kibotos-vmm.

[[storage.pool]]复制标题链接

Every node declares at least one storage pool: a directory holding volumes/, retained-layers/, and a marker file the node never creates on its own (see kibotos-node storage-pool init). A pool's path may equal storage.root, which is how a single-node deployment keeps its Volumes and retained layers where they have always lived. Several nodes may declare the same id and path pointing at the same shared (for example NFS) storage; mark that pool shared = true so maintenance checks do not fail over objects another node holds there. Exactly one pool is default; with only one pool declared, it is the default implicitly.

A pool only this node reaches, such as its local disk, needs an id no other node uses: replace node-a below with this node's ID, the --node value its enrollment key was created with. ctrl takes the first storage registered under an id as that pool; another node declaring a different directory under the same id gets that pool refused and, without its default pool, can take no Workspace.

The pool's capacity is not set here. Once a node has declared the pool, set it in ctrl with kibo storage-pool set-capacity; until then the pool takes no new Volumes or retained layers.

[runtime]复制标题链接

[data_plane]复制标题链接

[telemetry]复制标题链接

可选。

Optional. The node's own metrics in the Prometheus text format at GET /metrics. Plain HTTP without authentication: bind loopback and scrape from this host. Omit the section to open no listener.

[ctrl]复制标题链接

The node authenticates to ctrl with the managed identity under <storage.root>/pki, created by kibotos-node join; nothing else is configured.

[host_network]复制标题链接

Omit the whole section when host networking is not assembled.

[host_network.public_internet]复制标题链接

可选。

Omit this sub-table when the node must never carry guest traffic to the public internet: every attachment then accepts the deny-all policy only. With it, the node advertises kibotos.service.public-internet=true once the provider has validated the profile against the host at startup. The host must forward every enabled family (net.ipv4.ip_forward=1, net.ipv6.conf.all.forwarding=1, persisted under /etc/sysctl.d/) and must have no forward chain the node does not own with a drop policy. The node checks these and never changes them; when they do not hold it still starts, logs "node offers no public internet egress" with the reason, and advertises no public egress until it is restarted with the host fixed.