CNI, CSI, and resources

Signed integration packages may contribute only the CNI, CSI, and Kubernetes resource subtrees. They cannot enable k3s or change node and cluster credentials.

Roles and bootstrap

Select exactly one of k3s-worker, k3s-control-plane, or k3s-combined. Workers require serverUrl; every enabled role receives its cluster token through an opaque systemd credential.

{
  aos.apm.desiredPackages = ["k3s-combined"];
  k3s.enable = true;
  k3s.token.ref = "system-credential:k3s-token";
}