machine:
  features:
    kubernetesTalosAPIAccess:
      enabled: true
      allowedRoles:
        - os:admin
      allowedKubernetesNamespaces:
        - system-upgrade
cluster:
  controllerManager:
    extraArgs:
      bind-address: 0.0.0.0
  proxy:
    extraArgs:
      metrics-bind-address: 0.0.0.0:10249
  apiServer:
    extraArgs:
      enable-aggregator-routing: "true"
      feature-gates: MutatingAdmissionPolicy=true
      runtime-config: admissionregistration.k8s.io/v1alpha1=true
    admissionControl:
      - name: PodSecurity
        configuration:
          exemptions:
            namespaces:
              - metallb
              - metallb-config
              - topolvm-system
              - longhorn-system
              - kyverno
              - system-upgrade
              - openebs
              - snapshot-controller
              - volsync
              - flux-system
  scheduler:
    extraArgs:
      bind-address: 0.0.0.0
    config:
      apiVersion: kubescheduler.config.k8s.io/v1
      kind: KubeSchedulerConfiguration
      profiles:
        - pluginConfig:
            - args:
                defaultConstraints:
                  - maxSkew: 1
                    topologyKey: kubernetes.io/hostname
                    whenUnsatisfiable: ScheduleAnyway
                defaultingType: List
              name: PodTopologySpread
          plugins:
            score:
              disabled:
                - name: ImageLocality
          schedulerName: default-scheduler