> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

> UserVolumeConfig is a user volume configuration document. User volume is automatically allocated as a partition on the specified disk and mounted under `/var/mnt/<name>`. The partition label is automatically generated as `u-<name>`.

# UserVolumeConfig

export const VersionWarningBanner = () => {
  const latestVersion = "v1.13";
  const [latestUrl, setLatestUrl] = useState(null);
  const [currentVersion, setCurrentVersion] = useState(null);
  const [isBeta, setIsBeta] = useState(false);
  const parseVersion = v => v.replace("v", "").split(".").map(Number);
  const isGreaterVersion = (a, b) => {
    const [aMajor, aMinor] = parseVersion(a);
    const [bMajor, bMinor] = parseVersion(b);
    if (aMajor > bMajor) return true;
    if (aMajor === bMajor && aMinor > bMinor) return true;
    return false;
  };
  useEffect(() => {
    if (typeof window === "undefined") return;
    const {pathname, hash, search} = window.location;
    const match = pathname.match(/\/talos\/(v\d+\.\d+)\//);
    if (!match) return;
    const detectedVersion = match[1];
    if (detectedVersion === latestVersion) return;
    setCurrentVersion(detectedVersion);
    if (isGreaterVersion(detectedVersion, latestVersion)) {
      setIsBeta(true);
    }
    const newPath = pathname.replace(`/talos/${detectedVersion}/`, `/talos/${latestVersion}/`);
    setLatestUrl(`${newPath}${search}${hash}`);
  }, []);
  if (!latestUrl || !currentVersion) return null;
  return <div className="not-prose sticky top-6 z-50 my-6">
      <div className="border border-yellow-500/30 bg-yellow-500/10 px-4 py-3 rounded-xl">
        <div className="text-sm">
          {isBeta ? <>
              ⚠️ You are viewing a <strong>beta version</strong> of Talos ({currentVersion}).
              This version may be unstable.
              <a href={latestUrl} className="ml-2 underline text-yellow-400 hover:text-yellow-300 font-medium">
                View latest stable version {latestVersion} →
              </a>
            </> : <>
              ⚠️ You are viewing an older version of Talos ({currentVersion}).
              <a href={latestUrl} className="ml-2 underline text-yellow-400 hover:text-yellow-300 font-medium">
                View the latest version {latestVersion} →
              </a>
            </>}
        </div>
      </div>
    </div>;
};

<VersionWarningBanner />

```yaml theme={null}
apiVersion: v1alpha1
kind: UserVolumeConfig
name: ceph-data # Name of the volume.
# The provisioning describes how the volume is provisioned.
provisioning:
    # The disk selector expression.
    diskSelector:
        match: disk.transport == "nvme" # The Common Expression Language (CEL) expression to match the disk.
    maxSize: 50GiB # The maximum size of the volume, if not specified the volume can grow to the size of the

    # # The minimum size of the volume.
    # minSize: 2.5GiB
# The filesystem describes how the volume is formatted.
filesystem:
    type: xfs # Filesystem type. Default is `xfs`.
# The encryption describes how the volume is encrypted.
encryption:
    provider: luks2 # Encryption provider to use for the encryption.
    # Defines the encryption keys generation and storage method.
    keys:
        - slot: 0 # Key slot number for LUKS2 encryption.
          # Enable TPM based disk encryption.
          tpm: {}

          # # KMS managed encryption key.
          # kms:
          #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
        - slot: 1 # Key slot number for LUKS2 encryption.
          # Key which value is stored in the configuration file.
          static:
            passphrase: topsecret # Defines the static passphrase value.

          # # KMS managed encryption key.
          # kms:
          #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

    # # Cipher to use for the encryption. Depends on the encryption provider.
    # cipher: aes-xts-plain64

    # # Defines the encryption sector size.
    # blockSize: 4096

    # # Additional --perf parameters for the LUKS2 encryption.
    # options:
    #     - no_read_workqueue
    #     - no_write_workqueue
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`name`</td>
      <td>string</td>

      <td />

      <td />
    </tr>

    <tr>
      <td>`provisioning`</td>
      <td><a href="#provisioning">ProvisioningSpec</a></td>
      <td>The provisioning describes how the volume is provisioned.</td>

      <td />
    </tr>

    <tr>
      <td>`filesystem`</td>
      <td><a href="#filesystem">FilesystemSpec</a></td>
      <td>The filesystem describes how the volume is formatted.</td>

      <td />
    </tr>

    <tr>
      <td>`encryption`</td>
      <td><a href="#encryption">EncryptionSpec</a></td>
      <td>The encryption describes how the volume is encrypted.</td>

      <td />
    </tr>
  </tbody>
</table>

## provisioning

ProvisioningSpec describes how the volume is provisioned.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`diskSelector`</td>
      <td><a href="#diskselector">DiskSelector</a></td>
      <td>The disk selector expression.</td>

      <td />
    </tr>

    <tr>
      <td>`grow`</td>
      <td>bool</td>
      <td>Should the volume grow to the size of the disk (if possible).</td>

      <td />
    </tr>

    <tr>
      <td>`minSize`</td>
      <td>ByteSize</td>

      <td />

      <td />
    </tr>

    <tr>
      <td>`maxSize`</td>
      <td>ByteSize</td>

      <td />

      <td />
    </tr>
  </tbody>
</table>

### diskSelector

DiskSelector selects a disk for the volume.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`match`</td>
      <td>Expression</td>
      <td>The Common Expression Language (CEL) expression to match the disk.</td>

      <td />
    </tr>
  </tbody>
</table>

## filesystem

FilesystemSpec configures the filesystem for the volume.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`type`</td>
      <td>FilesystemType</td>
      <td>Filesystem type. Default is `xfs`.</td>
      <td>`ext4`<br />`xfs`<br /></td>
    </tr>
  </tbody>
</table>

## encryption

EncryptionSpec represents volume encryption settings.

```yaml theme={null}
encryption:
    provider: luks2 # Encryption provider to use for the encryption.
    # Defines the encryption keys generation and storage method.
    keys:
        - slot: 0 # Key slot number for LUKS2 encryption.
          # Key which value is stored in the configuration file.
          static:
            passphrase: exampleKey # Defines the static passphrase value.

          # # KMS managed encryption key.
          # kms:
          #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
        - slot: 1 # Key slot number for LUKS2 encryption.
          # KMS managed encryption key.
          kms:
            endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key.
    cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider.
    blockSize: 4096 # Defines the encryption sector size.

    # # Additional --perf parameters for the LUKS2 encryption.
    # options:
    #     - no_read_workqueue
    #     - no_write_workqueue
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`provider`</td>
      <td>EncryptionProviderType</td>
      <td>Encryption provider to use for the encryption.</td>
      <td>`luks2`<br /></td>
    </tr>

    <tr>
      <td>`keys`</td>
      <td><a href="#keys%5B%5D">EncryptionKey</a></td>
      <td>Defines the encryption keys generation and storage method.</td>

      <td />
    </tr>

    <tr>
      <td>`cipher`</td>
      <td>string</td>
      <td>Cipher to use for the encryption. Depends on the encryption provider.</td>
      <td>`aes-xts-plain64`<br />`xchacha12,aes-adiantum-plain64`<br />`xchacha20,aes-adiantum-plain64`<br /></td>
    </tr>

    <tr>
      <td>`keySize`</td>
      <td>uint</td>
      <td>Defines the encryption key length.</td>

      <td />
    </tr>

    <tr>
      <td>`blockSize`</td>
      <td>uint64</td>
      <td>Defines the encryption sector size.</td>

      <td />
    </tr>

    <tr>
      <td>`options`</td>
      <td>\[]string</td>
      <td>Additional --perf parameters for the LUKS2 encryption.</td>
      <td>`no_read_workqueue`<br />`no_write_workqueue`<br />`same_cpu_crypt`<br /></td>
    </tr>
  </tbody>
</table>

### keys\[]

EncryptionKey represents configuration for disk encryption key.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`slot`</td>
      <td>int</td>
      <td>Key slot number for LUKS2 encryption.</td>

      <td />
    </tr>

    <tr>
      <td>`static`</td>
      <td><a href="#static">EncryptionKeyStatic</a></td>
      <td>Key which value is stored in the configuration file.</td>

      <td />
    </tr>

    <tr>
      <td>`nodeID`</td>
      <td><a href="#nodeid">EncryptionKeyNodeID</a></td>
      <td>Deterministically generated key from the node UUID and PartitionLabel.</td>

      <td />
    </tr>

    <tr>
      <td>`kms`</td>
      <td><a href="#kms">EncryptionKeyKMS</a></td>
      <td>KMS managed encryption key.</td>

      <td />
    </tr>

    <tr>
      <td>`tpm`</td>
      <td><a href="#tpm">EncryptionKeyTPM</a></td>
      <td>Enable TPM based disk encryption.</td>

      <td />
    </tr>
  </tbody>
</table>

#### static

EncryptionKeyStatic represents throw away key type.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`passphrase`</td>
      <td>string</td>
      <td>Defines the static passphrase value.</td>

      <td />
    </tr>
  </tbody>
</table>

#### nodeID

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

#### kms

EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server.

```yaml theme={null}
encryption:
    keys:
        - kms:
            endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`endpoint`</td>
      <td>string</td>
      <td>KMS endpoint to Seal/Unseal the key.</td>

      <td />
    </tr>
  </tbody>
</table>

#### tpm

EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`checkSecurebootStatusOnEnroll`</td>
      <td>bool</td>

      <td />

      <td />
    </tr>
  </tbody>
</table>