Cluster configuration with command-line flags

To install the permanent management cluster in the console, run ./shtil-2.13.1 install INFRASTRUCTURE-PROVIDER-TYPE, substituting your own parameter values.

Parameters may differ depending on the provider type. Common installation parameters for any provider type are listed below. Parameters and command examples:

Shturval v2;
oVirt. For oVirt-like providers (zVirt, HostVM, RED Virtualization, ROSA Virtualization), parameters are identical; specify the provider subtype flag additionally;
vSphere
OpenStack, VK Cloud, Selectel.

Common installation parameters

Parameters for installation commands with any provider type

Parameter	Required	Description
`-a`, `--api-endpoint` [string]	Yes, for all providers except OpenStack/VK Cloud/Selectel	Management cluster API server address (IP or FQDN without port or protocol, for example, 192.168.1.100)
`--provider-name` [string]	No	Provider instance name (default “cluster-management-provider”)
`--cluster-name` [string]	No	Cluster name (default “cluster-management”)
`--pod-subnet` [string]	No	Pod subnet in CIDR format (default “172.16.0.0/16”)
`--service-subnet` [string]	No	Service subnet in CIDR format (default “10.96.0.0/12”)
`--ingress-default-fqdn` [string]	Yes, if `--ingress-vip` is not set. Not used for OpenStack/VK Cloud/Selectel	Wildcard DNS record for ingress (for example, `<cluster_name>.<base_domain>`)
`--ingress-vip` [string]	Yes, if `--ingress-default-fqdn` is not set. Cannot be used for OpenStack/VK Cloud/Selectel	VIP address for the ingress controller. To set an ingress VIP, specify `--use-external-ingress-lb` with value `false`
`--use-external-ingress-lb`	No	Use an external load balancer for Ingress. Default: false. Set to true for OpenStack, VK Cloud, and Selectel
`--secure`	No	Enable advanced security settings. Default: false
`--ingress-certs-ca-crt-path` [string]	No	Path to the certificate chain (your intermediate certificate -> corporate CA certificate) in PEM format, which can later be used to sign other certificates
`--ingress-certs-ca-key-path` [string]	No	Path to the intermediate CA private key
`--ingress-certs-acme-root-path` [string]	No	Path to the ACME CA root certificate file
`--ingress-certs-acme-url` [string]	No	ACME server address with port and resource path, for example: https://acme.corp.lan:8443/directory
`--ingress-certs-acme-email` [string]	No	ACME/Let’s Encrypt account email
`--ingress-certs-tls-crt-path` [string]	No	Path to the corporate certificate (PEM file) issued by the CA (in this case the file contains the certificate chain) or self-signed for the Ingress domain name
`--ingress-certs-tls-key-path` [string]	No	Path to the Ingress corporate certificate private key
`--enabled-system-services` [string]	No	Comma-separated list of enabled services. By default (if the flag is not set), the cluster installs services critical for platform operation plus monitoring and logging services. If the minimal flag is set to true, values of this parameter are ignored
`-b`, `--bootstrap-kubeconfig-path` [string]	No	Path to the temporary cluster kubeconfig. By default saved in $HOME/.shturval/shturval-bootstrap. Specify the path if the kubeconfig was moved
`--bootstrap-license` [string]	No	Shturval platform license. If the license contains special characters ($,<, >, *, &, ?, /,\ ), enclose it in single quotes. Required if `--bootstrap-kubeconfig-path` is not specified
`--bootstrap-registry` [string]	No	Registry address; default r.shturval.tech
`--bootstrap-insecure`	No	Skips security verification when connecting to the registry (default false)
`-f`, `--yaml-path` [string]	No	Path to the YAML file with configuration for permanent management cluster installation. Do not use together with other configuration flags. Configuration specified in flags overrides configuration in the YAML manifest
`--minimal`	No	Install a minimal service set (only services critical for platform operation). When minimal configuration is used, the `--enabled-system-services` parameter is unavailable. Default: false
`--platform-version` [string]	No	Shturval platform version. By default, the version matching the shtil utility version is installed
`-y`, `--overwrite`	No	Force update of configurations and resources when conflicts with existing resources occur. Use when rerunning the installation command after a configuration error
`-v`, `--verbosity`	No	Log verbosity; higher values produce more detailed output

Command examples

To install the platform in one command (installs both temporary and permanent clusters) in an open environment, append --bootstrap-license="ENTER-YOUR-LICENSE" to the required command to create the temporary cluster.
To install the platform in one command in a closed environment, append --bootstrap-license="ENTER-YOUR-LICENSE" and --bootstrap-registry="ENTER-YOUR-REGISTRY-ADDRESS" to create the temporary cluster.
To install with a certificate chain (your intermediate certificate -> corporate CA certificate), append --ingress-certs-ca-crt-path=ENTER-PATH-TO-INTERMEDIATE-CERTIFICATE and --ingress-certs-ca-key-path=ENTER-PATH-TO-INTERMEDIATE-CERT-PRIVATE-KEY
To install with corporate certificates, append --ingress-certs-tls-crt-path=ENTER-PATH-TO-CORPORATE-CERTIFICATE-PEM-FILE and --ingress-certs-tls-key-path=ENTER-PATH-TO-INTERMEDIATE-CERT-PRIVATE-KEY
To install with ACME certificates, append --ingress-certs-acme-root-path=ENTER-PATH-TO-ACME-CA-ROOT and --ingress-certs-acme-url=ENTER-ACME-SERVER-URL-WITH-PORT-AND-PATH

Installing a cluster with the Shturval v2 provider

Command to install the permanent management cluster with the Shturval v2 provider.

./shtil-2.13.1 install shturvalv2

Installation parameters for the permanent management cluster with the Shturval v2 provider

Parameter	Required	Description
`--path-ssh-private-key` [string]	Yes	Path to the private SSH key file
`--ssh-user` [string]	Yes	Username for SSH connections
`-c`, `--controlplane-nodes` [string]	Yes	IP addresses or FQDNs of Control Plane hosts, comma-separated
`-w`, `--worker-nodes` [string]	Yes	IP addresses or FQDNs of Worker nodes, comma-separated
`--use-external-kubeapi-lb`	No	Use an external load balancer for the cluster API IP

Example command to create a permanent cluster with self-signed certificates, API server VIP, and Ingress VIP


./shtil-2.13.1 install shturvalv2 \
 --ssh-user=CREATED-USERNAME \
 --path-ssh-private-key=ENTER-PATH-TO-PRIVATE-KEY \
 -c=ENTER-HOST-IP \
 -w=ENTER-HOST-IPS \
 --api-endpoint=ENTER-API-SERVER-IP \
 --ingress-vip=ENTER-INGRESS-IP-ADDRESS \
 --cluster-name=ENTER-CLUSTER-NAME \
 --provider-name=ENTER-PROVIDER-INSTANCE-NAME

Installing a cluster with the oVirt/zVirt/HostVM/RED Virtualization/ROSA Virtualization provider

Command to install the permanent management cluster with the oVirt/zVirt/HostVM/RED Virtualization/ROSA Virtualization provider.

./shtil-2.13.1 install ovirt

Installation parameters for the permanent management cluster with the oVirt/zVirt/HostVM/RED Virtualization/ROSA Virtualization provider

Parameter	Required	Description
`-u`, `--url-provider` [string]	Yes	URL for connecting to the oVirt API (provider Engine). Specify the full Engine address and append `/ovirt-engine/api`. For example, https://ovirt.company.domain/ovirt-engine/api
`--user-provider` [string]	Yes	Account username for connecting to the provider Engine, for example, username@domain
`--password-provider` [string]	Yes	Account password for connecting to the provider Engine. If the password contains special characters, enclose it in single quotes
`--tls-insecure-provider`	No	Disable TLS certificate verification (default true)
`--tls-cert-path-provider` [string]	No	Path to the CA public certificate
`--sub-type-provider` [string]	No	Provider subtype. One of: zvirt, hostvm, redvirt, rosavirt
`--datacenter-provider` [string]	Yes	oVirt datacenter name
`--datacenter-cluster-provider` [string]	Yes	oVirt cluster name within the datacenter
`--vnic-profile-provider` [string]	Yes	oVirt VNIC profile name
`-t`, `--template` [string]	Yes	VM template name in the selected datacenter. The Kubernetes version of the VM template must match the Shturval and shtil version
`--provider-csi-storage` [string]	Yes	Storage domain for dynamic Persistent Volume provisioning via CSI (Container Storage Interface). The specified storage must exist in the selected datacenter
`--allow-csi`	No	Enable CSI integration and allow installation in the cluster. Default: false
`--control-plane` [int]	No	Number of Control Plane nodes in the cluster. Integer from 1 to 5. Default: 1
`--cores-control-plane` [int]	No	Number of CPU cores for Control Plane nodes. Default: 4
`--sockets-control-plane` [int]	No	Number of CPU sockets for Control Plane nodes. Default: 1
`--threads-control-plane` [int]	No	Number of CPU threads per socket for Control Plane nodes. Default: 1
`--memory-control-plane` [int]	No	RAM in MB for Control Plane nodes. Must be greater than 8000. Default: 16000
`--disk-control-plane` [int]	No	Disk size in GB for Control Plane nodes. Default: 100
`--workers` [int]	No	Number of Worker nodes in the cluster. Default: 3
`--cores-workers` [int]	No	Number of CPU cores for Worker nodes. Default: 8
`--sockets-workers` [int]	No	Number of CPU sockets for Worker nodes. Default: 1
`--threads-workers` [int]	No	Number of CPU threads per socket for Worker nodes. Default: 1
`--memory-workers` [int]	No	RAM in MB for Worker nodes. Default: 32000
`--disk-workers` [int]	No	Disk size in GB for Worker nodes. Default: 300

Example command to create a permanent cluster with the zVirt provider, self-signed certificates, API server VIP, and external Ingress load balancer


./shtil-2.13.1 install ovirt \
  --api-endpoint=ENTER-API-SERVER-IP \
  --ingress-default-fqdn=ENTER-INGRESS-FQDN \
  --use-external-ingress-lb=true \
  --url-provider="ENTER-OVIRT-API-URL" \
  --user-provider="ENTER-ACCOUNT-USERNAME" \
  --password-provider="ENTER-ACCOUNT-PASSWORD" \
  --datacenter-provider=ENTER-DATACENTER \
  --datacenter-cluster-provider=ENTER-CLUSTER-IN-DATACENTER \
  --vnic-profile-provider=ENTER-VNIC-PROFILE-NAME \
  --template=ENTER-VM-TEMPLATE-NAME \
  --sub-type-provider=zvirt \
  --cluster-name=ENTER-CLUSTER-NAME \
  --provider-name=ENTER-PROVIDER-NAME \
  --provider-csi-storage=ENTER-CSI-STORAGE-NAME \
  --control-plane=CONTROL-PLANE-NODE-COUNT \
  --cores-control-plane=ENTER-CPU-CORES-FOR-CONTROL-PLANE \
  --sockets-control-plane=ENTER-CPU-SOCKETS-FOR-CONTROL-PLANE \
  --threads-control-plane=ENTER-CPU-THREADS-FOR-CONTROL-PLANE \
  --memory-control-plane=ENTER-MEMORY-FOR-CONTROL-PLANE \
  --disk-control-plane=ENTER-DISK-SIZE-FOR-CONTROL-PLANE \
  --workers=ENTER-WORKER-NODE-COUNT \
  --cores-workers=ENTER-CPU-CORES-FOR-WORKER \
  --sockets-workers=ENTER-CPU-SOCKETS-FOR-WORKER \
  --threads-workers=ENTER-CPU-THREADS-FOR-WORKER \
  --memory-workers=ENTER-MEMORY-FOR-WORKER \
  --disk-workers=ENTER-DISK-SIZE-FOR-WORKER

Installing a cluster with the vSphere provider

Command to install the permanent management cluster with the vSphere provider.

./shtil-2.13.1 install vsphere

Installation parameters for the permanent management cluster with the vSphere provider

Parameter	Required	Description
`--address-vcenter` [string]	Yes	IP address or FQDN of the provider Engine
`--user-vcenter` [string]	Yes	Account username for connecting to the provider Engine, for example, username@domain.
`--password-vcenter` [string]	Yes	Account password for connecting to the provider Engine. If the password contains special characters, enclose it in single quotes
`--provider-datacenter` [string]	Yes	Provider Engine datacenter, for example, /MyCloud
`--provider-datastore` [string]	Yes	Datastore in the provider Engine datacenter, for example, MyCloud-example
`--provider-resource-pool` [string]	Yes	Resource pool path for virtual machines, for example, /MyCloud/hosts/MyCloud/Resources/poolname
`--provider-network` [string]	Yes	Network in the provider Engine datacenter, for example, /MyCloud/network/dvPG-example-3245. A DHCP server must be available on the network to assign IP addresses to created VMs. The specified network must exist
`--provider-folder` [string]	Yes	Virtual machine folder in the provider Engine datacenter, for example, MyCloud/vm/MyCloud/myfolder
`--provider-clone-mode` [string]	No	VM clone mode. Values: fullClone, linkedClone. Default: linkedClone. linkedClone is faster and uses less space; fullClone creates independent virtual machines
`--provider-storage-policy` [string]	No	StoragePolicy name in the Datastore. Required if the Datastore has more than one Storage Policy
`-t`, `--template` [string]	Yes	Virtual machine template name. The Kubernetes version of the VM template must match the Shturval and shtil version
`--enable-csi`	No	Enable CSI integration. Default: false
`--control-plane` [int]	No	Number of Control Plane nodes in the cluster. Default: 1
`--cpu-control-plane` [int]	No	Number of CPU cores for Control Plane nodes. Default: 4
`--memory-control-plane` [int]	No	RAM in MB for Control Plane nodes. Default: 16000
`--disk-control-plane` [int]	No	Disk size in GB for Control Plane nodes. Default: 100
`--workers` [int]	No	Number of Worker nodes in the cluster. Default: 3
`--cpu-workers` [int]	No	Number of CPU cores for Worker nodes. Default: 8
`--memory-workers` [int]	No	RAM in MB for Worker nodes. Default: 32000
`--disk-workers` [int]	No	Disk size in GB for Worker nodes. Default: 300

Example command to create a permanent cluster with the vSphere provider, self-signed certificates, 1 Control Plane and 3 Worker nodes, and VIPs for the API server and Ingress


./shtil-2.13.1 install vsphere \
 --api-endpoint=ENTER-API-SERVER-IP \
 --ingress-vip=ENTER-INGRESS-IP-ADDRESS \
 --address-vcenter="ENTER-VCENTER-ADDRESS" \
 --user-vcenter="ENTER-USERNAME" \
 --password-vcenter="ENTER-USER-PASSWORD" \
 --provider-datacenter=ENTER-DATACENTER \
 --provider-datastore=ENTER-DATASTORE-IN-DATACENTER \
 --provider-resource-pool="ResourcePool-IN-DATACENTER" \
 --provider-network="ENTER-NETWORK" \
 --provider-folder="FOLDER-IN-DATACENTER" \
 --template=ENTER-VM-TEMPLATE-NAME

Installing a cluster with the OpenStack/VK Cloud/Selectel provider

Command to install the permanent management cluster with the OpenStack provider.

./shtil-2.13.1 install openstack

Command to install the permanent management cluster with the VK Cloud provider.

./shtil-2.13.1 install vkcloud

Command to install the permanent management cluster with the Selectel provider.

./shtil-2.13.1 install selectel

Installation parameters for the permanent management cluster with the OpenStack/VK Cloud/Selectel provider

Parameter	Required	Description
`--url-auth` [string]	Yes for OpenStack; No for VK Cloud and Selectel	OpenStack authorization service (Keystone) URL. Port is required, for example, http://10.11.111.111:5000
`--project-id` [string]	Yes	Project identifier
`--project-domain-id` [string]	Yes	Project domain identifier
`--tls-insecure-provider`	No	Skip TLS certificate verification. Default: false
`--tls-cert-path` [string]	No	Path to the public CA certificate file in PEM format
`--region-name` [string]	No	Region name. For example, RegionOne
`--interface` [string]	No	Endpoint interface, for example, public
`--identity-api-version` [string]	No	OpenStack Identity API version. Default: 3
`--token` [string]	Yes for OpenStack if –login and –password are not set. Not used for VK Cloud and Selectel	Authentication token. Cannot be used together with –login and –password. Available only for OpenStack
`--login` [string]	Yes if –token is not set	Service account name with heat_stack_owner and admin roles. Must be set together with –password
`--password` [string]	Yes for OpenStack if –token is not set	Service account password. Must be set together with –login
`--user-domain-name` [string]	Yes for OpenStack if –token is not set	User domain name. Required for OpenStack or VK Cloud
`--cloud-name` [string]	Yes	Cloud name
`--ssh-key-name` [string]	Yes	SSH key pair name for VM access over SSH
`--node-cidr` [string]	Yes	Node subnet. For example, 10.0.0.0/24. Must not overlap with the pod subnet (podSubnet) or service subnet (serviceSubnet)
`--external-network-id` [string]	Yes	External network identifier
`--flavors` [string]	Yes	Virtual machine types. Comma-separated
`--volume-types` [string]	Yes	Disk types. Comma-separated
`--availability-zones` [string]	No	Availability zones. Comma-separated
`--manage-security-groups`	No	Allow Security Group management. Default: true
`--disable-port-security`	No	Disable port security. Default: false
`--dns` [string]	No	DNS servers for the node subnet, comma-separated
`--machine-image-name` [string]	Yes	Virtual machine template name. The Kubernetes version of the VM template must match the Shturval and shtil version
`--enable-csi`	No	Enable CSI integration. Default: false
`--control-plane` [int]	No	Number of Control Plane nodes in the cluster. Default: 1
`--flavor-name-cp` [string]	No	Virtual machine type for Control Plane nodes. If omitted, the first value from `--flavors` is used
`--volume-type-cp` [string]	No	Disk type for Control Plane nodes. If omitted, the first value from –volume-types is used
`--availability-zone-cp` [string]	No	Availability zone for Control Plane nodes. If omitted, the first value from –availability-zones is used
`--disk-cp` [int]	No	Disk size in GB for Control Plane nodes. Default: 100
`--workers` [int]	No	Number of Worker nodes in the cluster. Default: 3
`--flavor-name-workers` [string]	No	Virtual machine type for Worker nodes. If omitted, the first value from `--flavors` is used
`--volume-type-workers` [string]	No	Disk type for Worker nodes. If omitted, the first value from –volume-types is used
`--availability-zone-workers` [string]	No	Availability zone for Worker nodes. If omitted, the first value from –availability-zones is used
`--disk-workers` [int]	No	Disk size in GB for Worker nodes. Default: 100

Example command to create a permanent cluster with the VK Cloud provider


./shtil-2.13.1 install vkcloud \
 --url-auth="ENTER-URL-WITH-PORT" \
 --cloud-name="ENTER-CLOUD-NAME" \
 --project-id=ENTER-PROJECT-ID \
 --project-domain-id=ENTER-PROJECT-DOMAIN-ID \
 --user-domain-name=ENTER-USER-DOMAIN-NAME \
 --login=ENTER-SERVICE-ACCOUNT-NAME \
 --password="ENTER-SERVICE-ACCOUNT-PASSWORD" \
 --ssh-key-name=ENTER-SSH-KEY-PAIR-NAME \
 --node-cidr=ENTER-NODE-SUBNET \
 --external-network-id=ENTER-EXTERNAL-NETWORK-ID \
 --flavors="ENTER-FLAVOR-TYPES-COMMA-SEPARATED" \
 --volume-types="ENTER-DISK-TYPES-COMMA-SEPARATED" \
 --machine-image-name="ENTER-VM-TEMPLATE-NAME" \
 --use-external-ingress-lb=true

Platform installation command examples

To install the platform in one command, specify the required temporary cluster creation parameters in the permanent management cluster installation command for one of the providers.

Example platform installation command with the Shturval v2 provider in an open environment


./shtil-2.13.1 install shturvalv2 \
 --ssh-user=CREATED-USERNAME \
 --path-ssh-private-key=ENTER-PATH-TO-PRIVATE-KEY \
 -c=ENTER-HOST-IP \
 -w=ENTER-HOST-IPS-COMMA-SEPARATED-NO-SPACES \
 --api-endpoint=ENTER-YOUR-FQDN \
 --ingress-vip=ENTER-INGRESS-IP-ADDRESS \
 --use-external-kubeapi-lb=true \
 --bootstrap-license="ENTER-YOUR-LICENSE"

Example platform installation command with the Shturval v2 provider in a closed environment


./shtil-2.13.1 install shturvalv2 \
 --ssh-user=CREATED-USERNAME \
 --path-ssh-private-key=ENTER-PATH-TO-PRIVATE-KEY \
 -c=ENTER-HOST-IPS-COMMA-SEPARATED-NO-SPACES \
 -w=ENTER-HOST-IPS-COMMA-SEPARATED-NO-SPACES \
 --api-endpoint=ENTER-YOUR-FQDN \
 --ingress-vip=ENTER-INGRESS-IP-ADDRESS \
 --use-external-kubeapi-lb=true \
 --bootstrap-license="ENTER-YOUR-LICENSE" \
 --bootstrap-registry="ENTER-YOUR-REGISTRY-ADDRESS"

Example platform installation command with the vSphere provider in an open environment


./shtil-2.13.1 install vsphere \
 --api-endpoint=ENTER-API-SERVER-IP \
 --ingress-vip=ENTER-INGRESS-IP-ADDRESS \
 --address-vcenter="ENTER-VCENTER-ADDRESS" \
 --user-vcenter="ENTER-USERNAME" \
 --password-vcenter="ENTER-USER-PASSWORD" \
 --provider-datacenter=ENTER-DATACENTER \
 --provider-datastore=ENTER-DATASTORE-IN-DATACENTER \
 --provider-resource-pool="ResourcePool-IN-DATACENTER" \
 --provider-network="ENTER-NETWORK" \
 --provider-folder="FOLDER-IN-DATACENTER" \
 --template=ENTER-VM-TEMPLATE-NAME \
 --bootstrap-license="ENTER-YOUR-LICENSE"

Изменено 2026-02-12 at 00:00

Cluster configuration with command-line flags

Common installation parameters #

Command examples #

Installing a cluster with the Shturval v2 provider #

Installing a cluster with the oVirt/zVirt/HostVM/RED Virtualization/ROSA Virtualization provider #

Installing a cluster with the vSphere provider #

Installing a cluster with the OpenStack/VK Cloud/Selectel provider #

Platform installation command examples #