---
title: Charmhub | Deploy Kubernetes Core using Charmhub - The Open Operator Collection
description: Deploy the latest version of Kubernetes Core on any cloud.
url: https://charmhub.io/kubernetes-core/configurations/kubernetes-control-plane
---

##### We've discontinued the registration of new Bundles

New Bundle registrations are no longer accepted. Existing bundles remain functional. We recommend using the Juju Terraform Provider for new deployments.

[Learn more](https://discourse.charmhub.io/t/discontinuing-new-charmhub-bundle-registrations/15344)

# Kubernetes Core

[Canonical Kubernetes](https://charmhub.io/publisher/containers "View all packages from Canonical Kubernetes")
| bundle

* [Canonical Kubernetes](https://charmhub.io/publisher/containers "View all packages from Canonical Kubernetes")
  | bundle
* [Cloud](https://charmhub.io/?filter=cloud)

Platform:

stable 1886

```
juju deploy kubernetes-core
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

* [Calico](https://charmhub.io/kubernetes-core/configurations/calico)
* [Containerd](https://charmhub.io/kubernetes-core/configurations/containerd)
* [Easyrsa](https://charmhub.io/kubernetes-core/configurations/easyrsa)
* [Etcd](https://charmhub.io/kubernetes-core/configurations/etcd)
* [Kubernetes Control Plane](https://charmhub.io/kubernetes-core/configurations/kubernetes-control-plane)
* [Kubernetes Worker](https://charmhub.io/kubernetes-core/configurations/kubernetes-worker)

[Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration)

* allow-privileged | string

  Default: auto

  Allows kube-apiserver to accept privileged containers. Supported values
  are "true", "false", and "auto".
  If "true", kube-apiserver allows privileged containers
  If "false", kube-apiserver never allows privileged containers
  If "auto", kube-apiserver allows privileged containers under the
  following conditions:
  \* any privileged cni is related
  \* container-runtime states nvidia\_enabled
  Any other configuration will result in the charm blocked with an error message.
* api-extra-args | string

  Space separated list of flags and key=value pairs that will be passed as arguments to
  kube-apiserver. For example a value like this:
  runtime-config=batch/v2alpha1=true profiling=true
  will result in kube-apiserver being run with the following options:
  --runtime-config=batch/v2alpha1=true --profiling=true
* audit-policy | string

  Default: apiVersion: audit.k8s.io/v1
  kind: Policy
  rules:
  # Don't log read-only requests from the apiserver
  - level: None
  users: ["system:apiserver"]
  verbs: ["get", "list", "watch"]
  # Don't log kube-proxy watches
  - level: None
  users: ["system:kube-proxy"]
  verbs: ["watch"]
  resources:
  - resources: ["endpoints", "services"]
  # Don't log nodes getting their own status
  - level: None
  userGroups: ["system:nodes"]
  verbs: ["get"]
  resources:
  - resources: ["nodes"]
  # Don't log kube-controller-manager and kube-scheduler getting endpoints
  - level: None
  users: ["system:unsecured"]
  namespaces: ["kube-system"]
  verbs: ["get"]
  resources:
  - resources: ["endpoints"]
  # Log everything else at the Request level.
  - level: Request
  omitStages:
  - RequestReceived

  Audit policy passed to kube-apiserver via --audit-policy-file.
  For more info, please refer to the upstream documentation at
  https://kubernetes.io/docs/tasks/debug-application-cluster/audit/
* audit-webhook-config | string

  Audit webhook config passed to kube-apiserver via --audit-webhook-config-file.
  For more info, please refer to the upstream documentation at
  https://kubernetes.io/docs/tasks/debug-application-cluster/audit/
* authn-webhook-endpoint | string

  Custom endpoint to check when authenticating kube-apiserver requests.
  This must be an https url accessible by the kubernetes-control-plane units. For example:
  https://your.server:8443/authenticate
  When a JSON-serialized TokenReview object is POSTed to this endpoint, it must
  respond with appropriate authentication details. For more info, please refer
  to the upstream documentation at
  https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
* authorization-mode | string

  Default: Node,RBAC

  Comma separated authorization modes. Allowed values are
  "RBAC", "Node", "Webhook", "ABAC", "AlwaysDeny" and "AlwaysAllow".
* authorization-webhook-config-file | string

  Authorization webhook config passed to kube-apiserver via --authorization-webhook-config-file.
  For more info, please refer to the upstream documentation at
  https://kubernetes.io/docs/reference/access-authn-authz/webhook/
* channel | string

  Default: 1.35/stable

  Snap channel to install Kubernetes control plane services from
* controller-manager-extra-args | string

  Space separated list of flags and key=value pairs that will be passed as arguments to
  kube-controller-manager. For example a value like this:
  runtime-config=batch/v2alpha1=true profiling=true
  will result in kube-controller-manager being run with the following options:
  --runtime-config=batch/v2alpha1=true --profiling=true
* default-cni | string

  Default CNI network to use when multiple CNI subordinates are related.
  The value of this config should be the application name of a related CNI
  subordinate. For example:
  juju config kubernetes-control-plane default-cni=flannel
  If unspecified, then the default CNI network is chosen alphabetically.
* default-storage | string

  Default: auto

  The storage class to make the default storage class.
  Setting to "auto" is the same as setting "ceph-xfs"
  Any value is allowed, if it matches the name of a storage class,
  it alone will be selected as the default storage class for the cluster.
* dns-provider | string

  Default: auto

  DNS provider addon to use. Can be "auto", "core-dns", or "none".
  CoreDNS is only supported on Kubernetes 1.14+.
  When set to "auto", the behavior is as follows:
  - New deployments of Kubernetes 1.14+ will use CoreDNS
  - Upgraded deployments will continue to use whichever provider was
  previously used.
* dns\_domain | string

  Default: cluster.local

  The local domain for cluster dns
* enable-dashboard-addons | boolean

  Default: True

  Deploy the Kubernetes Dashboard
* enable-metrics | boolean

  Default: True

  If true the metrics server for Kubernetes will be deployed onto the cluster
  managed entirely by kubernetes addons. Consider disabling this option and deploying
  `kubernetes-metrics-server-operator` into a kubernetes model.
* enable-nvidia-plugin | string

  Default: false

  Deprecation notice: This option is deprecated and may be removed in a future release.
  If set to anything other than "false", the charm will be blocked with an error message.
  Consult https://ubuntu.com/kubernetes/docs/gpu-workers to learn how to deploy GPU workers.
* extra\_sans | string

  Space-separated list of extra SAN entries to add to the x509 certificate
  created for the control plane nodes.
* ha-cluster-dns | string

  DNS entry to use with the HA Cluster subordinate charm.
  Mutually exclusive with ha-cluster-vip.
* ha-cluster-vip | string

  Virtual IP for the charm to use with the HA Cluster subordinate charm
  Mutually exclusive with ha-cluster-dns. Multiple virtual IPs are
  separated by spaces.
* ignore-kube-system-pods | string

  Space separated list of pod names in the kube-system namespace to ignore
  when checking for running pods. Any non-Running Pod whose name is on
  this list, will be ignored during the check.
* ignore-missing-cni | boolean

  If ignore-missing-cni is set to true, the charm will not enter a blocked state if a CNI has not been configured/provided via relation.
  If ignore-missing-cni is set to false, and a CNI has not been configured/provided via relation, then the charm will enter a blocked state with the message: "Missing CNI relation or config".
* image-registry | string

  Default: rocks.canonical.com:443/cdk

  Container image registry to use for CDK. This includes addons like the Kubernetes dashboard,
  metrics server, ingress, and dns along with non-addon images including the pause
  container and default backend image.
* kubelet-extra-args | string

  Space separated list of flags and key=value pairs that will be passed as arguments to
  kubelet. For example a value like this:
  runtime-config=batch/v2alpha1=true profiling=true
  will result in kubelet being run with the following options:
  --runtime-config=batch/v2alpha1=true --profiling=true
  Note: As of Kubernetes 1.10.x, many of Kubelet's args have been deprecated, and can
  be set with kubelet-extra-config instead.
* kubelet-extra-config | string

  Default: {}

  Extra configuration to be passed to kubelet. Any values specified in this
  config will be merged into a KubeletConfiguration file that is passed to
  the kubelet service via the --config flag. This can be used to override
  values provided by the charm.
  The value for this config must be a YAML mapping that can be safely
  merged with a KubeletConfiguration file. For example:
  {evictionHard: {memory.available: 200Mi}}
  For more information about KubeletConfiguration, see upstream docs:
  https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/
* labels | string

  Default: node-role.kubernetes.io/control-plane=

  Labels can be used to organize and to select subsets of nodes in the
  cluster. Declare node labels in key=value format, separated by spaces.
* loadbalancer-ips | string

  Space separated list of IP addresses of loadbalancers in front of the control plane.
  These can be either virtual IP addresses that have been floated in front of the control
  plane or the IP of a loadbalancer appliance such as an F5. Currently, workers will only
  use the first address that is specified.
* proxy-extra-args | string

  Space separated list of flags and key=value pairs that will be passed as arguments to
  kube-proxy. For example a value like this:
  runtime-config=batch/v2alpha1=true profiling=true
  will result in kube-apiserver being run with the following options:
  --runtime-config=batch/v2alpha1=true --profiling=true
* proxy-extra-config | string

  Default: {}

  Extra configuration to be passed to kube-proxy. Any values specified in
  this config will be merged into a KubeProxyConfiguration file that is
  passed to the kube-proxy service via the --config flag. This can be used
  to override values provided by the charm.
  The value for this config must be a YAML mapping that can be safely
  merged with a KubeProxyConfiguration file. For example:
  {mode: ipvs, ipvs: {strictARP: true}}
  For more information about KubeProxyConfiguration, see upstream docs:
  https://kubernetes.io/docs/reference/config-api/kube-proxy-config.v1alpha1/
* register-with-taints | string

  Default: node-role.kubernetes.io/control-plane:NoSchedule

  Space-separated list of taints to apply to this node at registration time.
  This config is only used at deploy time when Kubelet first registers the
  node with Kubernetes. To change node taints after deploy time, use kubectl
  instead.
  For more information, see the upstream Kubernetes documentation about
  taints:
  https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
* scheduler-extra-args | string

  Space separated list of flags and key=value pairs that will be passed as arguments to
  kube-scheduler. For example a value like this:
  runtime-config=batch/v2alpha1=true profiling=true
  will result in kube-scheduler being run with the following options:
  --runtime-config=batch/v2alpha1=true --profiling=true
* service-cidr | string

  Default: 10.152.183.0/24

  CIDR to use for Kubernetes services. After deployment it is
  only possible to increase the size of the IP range. It is not possible to
  change or shrink the address range after deployment.
* sysctl | string

  Default: {net.ipv4.conf.all.forwarding: 1, net.ipv4.conf.all.rp\_filter: 1, net.ipv4.neigh.default.gc\_thresh1: 128, net.ipv4.neigh.default.gc\_thresh2: 28672, net.ipv4.neigh.default.gc\_thresh3: 32768, net.ipv6.neigh.default.gc\_thresh1: 128, net.ipv6.neigh.default.gc\_thresh2: 28672, net.ipv6.neigh.default.gc\_thresh3: 32768, fs.inotify.max\_user\_instances: 8192, fs.inotify.max\_user\_watches: 1048576, kernel.panic: 10, kernel.panic\_on\_oops: 1, vm.overcommit\_memory: 1}

  YAML formatted associative array of sysctl values, e.g.:
  '{kernel.pid\_max: 4194303}'. Note that kube-proxy handles
  the conntrack settings. The proper way to alter them is to
  use the proxy-extra-args config to set them, e.g.:
  juju config kubernetes-control-plane proxy-extra-args="conntrack-min=1000000 conntrack-max-per-core=250000"
  juju config kubernetes-worker proxy-extra-args="conntrack-min=1000000 conntrack-max-per-core=250000"
  The proxy-extra-args conntrack-min and conntrack-max-per-core can be set to 0 to ignore
  kube-proxy's settings and use the sysctl settings instead. Note the fundamental difference between
  the setting of conntrack-max-per-core vs nf\_conntrack\_max.