← Schema index / Config Reference
pki schema
Canonical generated docsThis section is generated from
caco config schema --json. The table below preserves the runtime field path, type, required/default markers, and canonical description for every value in this slice.PKI configuration — certificate authority node selection and bootstrap authority.
| Field path | Type | Required | Default | Canonical description |
|---|---|---|---|---|
pki | section | optional | PKI configuration — certificate authority node selection and bootstrap authority. | |
└ pki.authority_node | string | optional | Node responsible for cluster CA (default: first beads primary node). | |
└ pki.bootstrap | map | optional | Bootstrap authority for pre-mTLS join and CSR-based issuance. | |
└ pki.bootstrap.public_url | string | required | Canonical HTTPS URL for pre-mTLS join and issuance traffic. | |
└ pki.bootstrap.bind_port | integer | optional | Authority-local bootstrap listener port (default: 8443; may differ from public_url when exposed through ingress/funnel). | |
└ pki.bootstrap.exposure | string | optional | funnel | Bootstrap exposure mode: funnel (default) or tailnet_direct for direct Tailnet HTTPS without Tailscale Funnel management. |
└ pki.bootstrap.token_env | string | optional | Env var name containing the bootstrap bearer token (mutually exclusive with token_file). | |
└ pki.bootstrap.token_file | string | optional | File path containing the bootstrap bearer token (mutually exclusive with token_env). | |
└ pki.bootstrap.server_ca_file | string | optional | CA file to pin HTTPS server trust before cluster CA is installed. |