machine:
    install:
        image: ghcr.io/siderolabs/installer:v1.13.12
    kubelet:
        extraArgs:
          rotate-server-certificates: true
        # Reserve capacity so the scheduler, not kubelet's eviction manager,
        # decides how many pods a node carries. Without this, kubelet advertises
        # the node's full allocatable and only protects the OS/system pods once
        # memory is already critical (default: memory.available < 100Mi), which
        # on a ProDesk means OOM-killing workloads. With reservations the node
        # reports a smaller allocatable, so pods pack to a sustainable density.
        extraConfig:
          maxPods: 110
          systemReserved:
            cpu: 100m
            memory: 256Mi
            ephemeral-storage: 1Gi
          kubeReserved:
            cpu: 250m
            memory: 512Mi
            ephemeral-storage: 2Gi
          evictionHard:
            memory.available: 200Mi
            nodefs.available: 10%
            imagefs.available: 15%
    udev:
      rules:
        # set all disks to `none` scheduler (optimal setting for Ceph and ZFS)
        - SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", ATTR{queue/scheduler}="none"
        - SUBSYSTEM=="drm", GROUP="44", MODE="0660"
        # Allow ceph to recognize usb devices as scsi via udev custom rules
        # https://github.com/rook/rook/issues/14699#issuecomment-2350953135
        - ACTION=="add", ENV{ID_TYPE}=="disk", ENV{ID_BUS}=="usb", ENV{ID_BUS}="scsi"
        - ACTION=="change", ENV{ID_TYPE}=="disk", ENV{ID_BUS}=="usb", ENV{ID_BUS}="scsi"
        - ACTION=="online", ENV{ID_TYPE}=="disk", ENV{ID_BUS}=="usb", ENV{ID_BUS}="scsi"