| aos-registry-server.cache.anonymousRead | boolean | Whether the default cache view permits anonymous reads. |
| aos-registry-server.cache.bootstrapSocket | string matching /run/aos-registry-server/[A-Za-z0-9._-]+ | Volatile bootstrap control socket. |
| aos-registry-server.cache.bootstrapSocketGroup | string matching [A-Za-z_][A-Za-z0-9_-]* | Group assigned to the bootstrap socket. |
| aos-registry-server.cache.enable | boolean | Whether to run the AOS binary-cache server. |
| aos-registry-server.cache.listenAddress | string matching [^:[:space:]]+ | Binary-cache listen address. |
| aos-registry-server.cache.maxConcurrentBuilds | signed integer | Maximum concurrent builds admitted by the default view. |
| aos-registry-server.cache.port | TCP/UDP port number (1-65535) | Binary-cache listen port. |
| aos-registry-server.config | attribute set of attribute set of any value | Desired values for the package's declared config artifacts. |
| aos-registry-server.credentials | attribute set of submodule | Opaque references for the package's declared credentials. |
| aos-registry-server.enable | boolean | Whether at least one AOS registry-server workload may run. |
| aos-registry-server.git.basePath | string matching /var/lib/aos-registry-server(/[A-Za-z0-9._/-]+)? | Registry repository root beneath package-managed state. |
| aos-registry-server.git.enable | boolean | Whether to serve registry Git repositories. |
| aos-registry-server.git.exportAll | boolean | Whether git daemon exports repositories without git-daemon-export-ok. |
| aos-registry-server.git.listenAddress | string matching [^[:space:]]+ | Address passed to git daemon. |
| aos-registry-server.git.port | TCP/UDP port number (1-65535) | Git protocol listen port. |
| cilium.enable | boolean | Contribute the Cilium add-on to the selected Kubernetes owner. |
| cilium.kubeProxyReplacement | boolean | Replace kube-proxy with Cilium's eBPF service implementation. |
| cilium.operatorReplicas | signed integer | Number of Cilium operator replicas. |
| cloudcore.advertiseAddresses | list of string matching [A-Za-z0-9][A-Za-z0-9.:-]* | Addresses advertised to EdgeCore nodes. |
| cloudcore.config | attribute set of attribute set of any value | Desired values for the package's declared config artifacts. |
| cloudcore.credentials | attribute set of submodule | Opaque references for the package's declared credentials. |
| cloudcore.enable | boolean | Enable the package-owned KubeEdge CloudCore service. |
| cloudcore.https.address | string matching [A-Za-z0-9][A-Za-z0-9.:-]* | Address on which CloudHub accepts HTTPS enrollment requests. |
| cloudcore.https.enable | boolean | Enable CloudHub's HTTPS enrollment listener. |
| cloudcore.https.port | TCP/UDP port number (1-65535) | Signed HTTPS port admitted by the CloudCore expose firewall contract. |
| cloudcore.kubeApi.burst | signed integer | Kubernetes API request burst limit. |
| cloudcore.kubeApi.kubeconfig | submodule | Opaque credential reference for CloudCore's Kubernetes API kubeconfig. |
| cloudcore.kubeApi.qps | signed integer | Kubernetes API request rate. |
| cloudcore.monitorAddress | string matching [^
]+ | CloudCore metrics listener address. |
| cloudcore.nodeLimit | signed integer | Maximum simultaneously connected edge nodes. |
| cloudcore.tls.caCertificate | submodule | Opaque credential reference for the CloudHub certificate authority certificate. |
| cloudcore.tls.caPrivateKey | submodule | Opaque credential reference for the CloudHub certificate authority private key. |
| cloudcore.tls.serverCertificate | submodule | Opaque credential reference for the CloudHub server certificate. |
| cloudcore.tls.serverPrivateKey | submodule | Opaque credential reference for the CloudHub server private key. |
| cloudcore.websocket.address | string matching [A-Za-z0-9][A-Za-z0-9.:-]* | Address on which CloudHub accepts WebSocket connections from edge nodes. |
| cloudcore.websocket.enable | boolean | Enable CloudHub's WebSocket listener for connected edge nodes. |
| cloudcore.websocket.port | TCP/UDP port number (1-65535) | Signed WebSocket port admitted by the CloudCore expose firewall contract. |
| conntrack-tools.config | attribute set of attribute set of any value | Desired values for the package's declared config artifacts. |
| conntrack-tools.credentials | attribute set of submodule | Opaque references for the package's declared credentials. |
| conntrackd.enable | boolean | Enable the package-owned connection tracking daemon. |
| conntrackd.hashLimit | signed integer | Maximum number of tracked connections in daemon caches. |
| conntrackd.hashSize | signed integer | Number of daemon cache hash buckets. |
| conntrackd.logConnections | boolean | Log destroyed connections in statistics mode. |
| conntrackd.mode | one of ["stats","sync"] | Run as a local statistics collector or an FTFW state replicator. |
| conntrackd.netlinkBufferSize | signed integer | Initial netlink receive buffer size in bytes. |
| conntrackd.netlinkBufferSizeMaxGrowth | signed integer | Maximum dynamically grown netlink buffer size in bytes. |
| conntrackd.pollSeconds | signed integer or null | Optional kernel conntrack polling interval. |
| conntrackd.sync.ackWindowSize | signed integer | FTFW acknowledgement window size. |
| conntrackd.sync.checksum | boolean | Verify checksums on state replication messages. |
| conntrackd.sync.interface | string matching [A-Za-z0-9][A-Za-z0-9_.:-]* | Dedicated replication network interface. |