Edge Artifact Build Configurations
During the EdgeForge process, you provide an .arg document that contains a list of parameters to configure the build of both the provider images and the Edge Installer ISO. This page lists the parameters available in the .arg file.
The build produces provider images and an installer ISO. The provider images are pushed to the registry specified by
IMAGE_REGISTRY and IMAGE_REPO. The final image tag follows the format:
$IMAGE_REGISTRY/$IMAGE_REPO:$K8S_DISTRIBUTION-$K8S_VERSION-$PE_VERSION-$CUSTOM_TAG
Where $PE_VERSION is the Palette Edge agent version, determined automatically from the CanvOS repository tag.
| Argument | Description | Allowed Values |
|---|---|---|
ARCH | Architecture of the image. Required. | amd64, arm64 |
AUTO_ENROLL_SECUREBOOT_KEYS | Determines whether to auto enroll keys used for Trusted Boot. | true, false. Default is false. |
BASE_IMAGE | The input base image from which provider images and the installer ISO are built. When omitted, the build uses a default Kairos base image for the specified OS. You must provide a value when building a FIPS-enabled image, a RHEL 9 STIG-based image, or an Ubuntu 24.04 STIG-based image. | Image URL. Example: docker.io/myorg/my-base:latest. |
BUNDLE_K8S_AND_AGENT_PROVIDER | Whether to include the Kubernetes and Palette agent binaries in the provider image. Set to false to build provider images for clusters that use systemd extensions. The installer ISO is not affected. | true, false. Default is true. |
CIS_HARDENING | Whether to harden Edge artifacts according to Center for Internet Security (CIS) standards. | true, false. Default is false. |
CLUSTERCONFIG | Path to a cluster definition file. For more information refer to Export Cluster Definition. | URL string. |
CUSTOM_TAG | A custom tag appended to the provider image tag. When set, the full image tag becomes $IMAGE_REGISTRY/$IMAGE_REPO:$K8S_DISTRIBUTION-$K8S_VERSION-$PE_VERSION-$CUSTOM_TAG. | Lowercase alphanumeric string without spaces. |
DISABLE_SELINUX | Disable Security-Enhanced Linux (SELinux) in the operating system. Set this to true when your cluster has applications that are not compatible with SELinux, such as KubeVirt. | true, false |
EDGE_CUSTOM_CONFIG | Path to the Edge custom configuration file. The file is used to provide public keys for the host to verify signatures. Refer to Embed a Public Key in Edge Artifacts for more information. | .edge_custom_config.yaml |
FIPS_ENABLED | Whether to generate FIPS-compliant binaries. When enabled, the build uses FIPS-specific image registries and packages. | true, false. Default is false. |
FORCE_INTERACTIVE_INSTALL | When set to true, Palette Edge Interactive Installer is selected by default in the Grand Unified Bootloader (GRUB) menu on first boot, enabling manual disk selection for ISO installation. Not supported for Unified Kernel Image (UKI) builds. On legacy BIOS systems, the selected disk must be either the first device in the BIOS boot order or the only bootable device. | true, false. Default is false. |
HTTP_PROXY | URL of the HTTP Proxy server. | URL string. |
HTTPS_PROXY | URL of the HTTPS Proxy server. | URL string. |
IMAGE_REGISTRY | The registry where built provider images are pushed. Required. | Registry hostname and namespace, without http or https. Example: docker.io/myorg. |
IMAGE_REPO | The repository name for the built provider images. Defaults to the value of OS_DISTRIBUTION if not set. | Your image repository name. Example: ubuntu. |
INCLUDE_MS_SECUREBOOT_KEYS | Whether to include Microsoft's secure boot keys in the set of keys to enroll in your device for secure boot. Almost every machine requires these keys. | true, false. Default is true. |
ISO_NAME | Name of the Installer ISO file. Uses the default name of installer.iso if omitted. | Lowercase alphanumeric string without spaces. The characters - and _ are allowed. |
IS_UKI | Determines whether to build UKI to enable Trusted Boot. Refer to Trusted Boot for more information. | true, false. Default is false. |
K8S_DISTRIBUTION | Kubernetes distribution to embed in the provider images. | k3s, rke2, kubeadm, kubeadm-fips, nodeadm, canonical |
K8S_VERSION | Kubernetes version to embed. The available versions vary depending on the specified K8S_DISTRIBUTION. Review the k8s_version.json file in the CanvOS repository for all supported versions. If omitted, the build produces images for all supported versions of the specified distribution. | Semantic Versioning patch release format - x.y.z. |
MAAS_IMAGE_NAME | Custom MAAS image name. | Lowercase alphanumeric string without spaces. The characters - and _ are allowed. |
MY_ORG | Name of the org to use during secure boot key generation. For more information, refer to Generate Keys. | String. |
NO_PROXY | URLs that should be excluded from the proxy. | Comma-separated URL string. |
OS_DISTRIBUTION | OS distribution. | ubuntu, opensuse-leap, rhel, hadron |
OS_VERSION | The Ubuntu OS version, or the Hadron OS version when OS_DISTRIBUTION is set to hadron. NOTES: - The value 20 is deprecated and will be removed in a future version. - Versions 20 and 22 automatically resolve to 20.04 and 22.04, respectively. | 20, 20.04, 22, 22.04, 24.04, v0.5.1 |
PROXY_CERT_PATH | Absolute path of the SSL Proxy certificate in the PEM format. This parameter is deprecated and will be removed in a future version. Provide the certificates in the certs folder in the root directory of the CanvOS repository instead. For more information, refer to Build Installer ISO. | Absolute path string. |
REGION | Region for the S3 bucket used for building AWS cloud images. | Lowercase alphanumeric string without spaces. The characters - and _ are allowed. |
S3_BUCKET | Name of the S3 bucket used for building AWS cloud images. | Lowercase alphanumeric string without spaces. The characters - and _ are allowed. |
S3_KEY | Object key used to save images in the configured S3 bucket when building AWS cloud images. This argument is optional. | Lowercase alphanumeric string without spaces. The characters - and _ are allowed. |
TWO_NODE | Whether to build a provider image that enables the host to be part of a two-node high availability cluster. Refer to Two-Node Architecture for more information. | true, false |
UBUNTU_PRO_KEY | Subscription key to a Ubuntu Pro subscription. A Ubuntu Pro subscription is needed to generate FIPS-compliant Edge artifacts with Ubuntu as the OS. | String. |
UKI_BRING_YOUR_OWN_KEYS | Whether to use your own Certificate Authority (CA) to generate secure boot keys. For more information, refer to the Generate Keys using an Existing CA tab in Generate Keys. | false |
UPDATE_KERNEL | Determines whether to upgrade the Kernel version to the latest from the upstream OS provider. Cannot be used together with FIPS_ENABLED. | true, false |