Gardener settings & export
PaaSbox exposes a curated set of Gardener settings, in Gardener’s own field names and schema, so that nothing you configure is PaaSbox-specific. You paste a JSON or YAML block per cluster or per pool in the console or the API; it is validated against this list, merged into the cluster definition, and the platform’s own fields are re-asserted afterwards.
Per cluster
Section titled “Per cluster”| Setting | Range or values | Notes |
|---|---|---|
kubernetes.kubelet.maxPods | 10–500, default 110 | must fit the node CIDR mask |
kubernetes.kubelet.podPidsLimit | integer | |
kubernetes.kubelet.registryPullQPS / registryBurst | integer | |
kubernetes.kubelet.imageGCHighThresholdPercent / imageGCLowThresholdPercent | 0–100 | |
kubernetes.kubelet.serializeImagePulls | true / false | |
kubernetes.kubelet.failSwapOn | true / false | |
kubernetes.kubeControllerManager.nodeCIDRMaskSize | 16–28 | create-time only |
kubernetes.verticalPodAutoscaler.enabled | true / false | default true |
systemComponents.nodeLocalDNS.enabled | true / false | default false |
systemComponents.coreDNS.autoscaling.mode | horizontal, cluster-proportional | |
maintenance.timeWindow.begin / end | HHMMSS+ZZZZ | at least 30 minutes |
maintenance.autoUpdate.kubernetesVersion / machineImageVersion | true / false | default true |
maintenance.confineSpecUpdateRollout | true / false | apply spec changes only in the window |
hibernation.schedules[] | cron start, end, location | time zone names |
Per pool
Section titled “Per pool”| Setting | Range or values | Notes |
|---|---|---|
maxSurge / maxUnavailable | count or percent | pooled pools keep fixed values |
labels, taints, annotations | key/value; taints with effect | reserved key prefixes rejected |
kubernetes.kubelet.* | as per cluster | overrides the cluster value for this pool |
sysctls | keys under net., kernel., vm., fs. | |
machineControllerManager.machineDrainTimeout / machineHealthTimeout / machineCreationTimeout | durations | defaults 2h, 10m, 10m |
providerConfig.placementGroupType | spread | maximum + maxSurge ≤ 10 |
providerConfig.publicIP.enableIPv4 / enableIPv6 | true / false | IPv6 on a private node is rejected |
Egress, per cluster
Section titled “Egress, per cluster”Private clusters are configured through the console’s egress card or the API’s egress settings; the values map to the provider’s infrastructure configuration. See private clusters for what each one does.
| Setting | Values |
|---|---|
egress.mode | public, nat |
egress.nat.serverType | a type your datacentre sells |
egress.nat.image | debian, ubuntu |
egress.nat.sshAllowFrom[] | CIDRs; applies in both modes |
egress.nat.allowList.mode | enforce, audit |
egress.nat.allowList.cidrs[] / fqdns[] | destinations |
egress.nat.logging.drops / flows / forwardTo | booleans; host:port |
egress.nat.metricsAllowFrom[] | CIDRs |
What the platform owns
Section titled “What the platform owns”These fields are set by the platform from your choices in the composer and are re-asserted after every merge, so a settings block cannot change them: cluster and pool names, machine type and image, minimum and maximum, zones, pool priority, the public-address setting of a pool in a private cluster, the hibernation state, the seed, the credentials binding, the cluster’s purpose, the control plane’s failure tolerance, and the egress mode. Change them in the composer; the console explains why a change is refused when it is.
Not exposed: kubeAPIServer.* (your identity provider is configured through
bring your own identity provider), seedName, purpose, per-pool
Kubernetes versions, existingNetwork by id, and the cloud-controller flags. The reasoning is on
how it is built.
Export
Section titled “Export”Export as Gardener YAML on the cluster page, or GET …/clusters/{name}/export on the API, returns
the exact Shoot object the platform applies, with:
- the namespace and the seed removed;
- the credentials binding replaced by a placeholder;
- no token, no secret, no key;
- a note listing what travels and what does not.
The export applies unchanged to any Gardener landscape that has the Hetzner stack installed — the exit kit bootstraps one — after you fill in the placeholder with your own credentials binding.