--- title: "Add-on list" slug: "k8s-k8suse-addon-catalog" updated: 2026-10-08T06:51:30Z published: 2026-10-08T06:51:30Z canonical: "guide.ncloud-docs.com/k8s-k8suse-addon-catalog" --- > ## Documentation Index > Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt > Use this file to discover all available pages before exploring further. # Add-on list Available in VPC The following add-ons are provided by Ncloud Kubernetes Service (NKS). | Add-on | Name | Category | Description | Canary upgrade | | --- | --- | --- | --- | --- | | `nks-csi` | NKS Block Storage CSI | storage | CSI driver for using block storage as a PersistentVolume | Not supported | | `nks-nas-csi` | NKS NAS (NFS) CSI | storage | CSI driver for using NAS (NFS) volume as a PersistentVolume | Not supported | | `external-dns` | ExternalDNS | network | Controller that automatically registers and manages DNS names for Services and Ingresses in external DNS | Not supported | | `nks-gateway-adapter` | NKS Gateway API Adapter | network | Adapter that connects Gateway API resources (Gateway, HTTPRoute) to NAVER Cloud ALB | Not supported | | `istio` | Istio | network | Service mesh control plane that provides traffic management, mTLS-based security, and observability for service-to-service communication | Supported | Note When installing or editing an add-on, you can enter the settings provided by each add-on. This document describes all settings available for each add-on, including their meanings and examples. The settings you can actually specify and their allowed ranges may vary depending on the add-on version, so specify them based on the add-on configuration schema displayed when you select a version in the **Add add-on** or **Edit add-on** popup. ## NKS Block Storage CSI This CSI driver uses block storage as a Kubernetes PersistentVolume. Installing this add-on allows you to dynamically provision block storage-based volumes and mount them to pods. After installation, see the [Block Storage CSI examples](/docs/en/k8s-k8sexamples-bscsi) for usage instructions. ### Settings The available settings are as follows. | Item | Description | Type | Default | | --- | --- | --- | --- | | `scheduling.nodeSelector` | Node label conditions for deploying components. | Object (string map) | N/A | | `scheduling.extraTolerations` | - List of tolerations for deploying components to nodes with taints. - Required tolerations for driver operation are automatically included and cannot be removed using this setting. | Array | N/A | | `scheduling.extraTolerations[].key` | Target taint key. | String | N/A | | `scheduling.extraTolerations[].operator` | Method for comparing the key and value. Either `Exists` or `Equal`. | String | N/A | | `scheduling.extraTolerations[].value` | Value to compare when the `operator` is `Equal`. | String | N/A | | `scheduling.extraTolerations[].effect` | Effect of the target taint. One of `NoSchedule`, `PreferNoSchedule`, or `NoExecute`. | String | N/A | | `scheduling.extraTolerations[].tolerationSeconds` | Time in seconds to remain on the node when the `effect` is `NoExecute`. | Integer | N/A | The following is an example. ``` { "scheduling": { "nodeSelector": { "role": "storage" }, "extraTolerations": [ { "key": "dedicated", "operator": "Equal", "value": "storage", "effect": "NoSchedule" } ] } } ``` ## NKS NAS (NFS) CSI This CSI driver uses NAS (NFS) volume as Kubernetes PersistentVolume. Use it when you need a shared volume that multiple pods can access simultaneously. After installation, see the [NAS volume CSI examples](/docs/en/k8s-k8sexamples-nascsi) for usage instructions. ### Settings The available settings are as follows. | Item | Description | Type | Default | | --- | --- | --- | --- | | `scheduling.nodeSelector` | Node label conditions for deploying components. | Object (string map) | N/A | | `scheduling.extraTolerations` | - List of tolerations for deploying components to nodes with taints. - Required tolerations for driver operation are automatically included and cannot be removed using this setting. | Array | N/A | | `scheduling.extraTolerations[].key` | Target taint key. | String | N/A | | `scheduling.extraTolerations[].operator` | Method for comparing the key and value. Either `Exists` or `Equal`. | String | N/A | | `scheduling.extraTolerations[].value` | Value to compare when the `operator` is `Equal`. | String | N/A | | `scheduling.extraTolerations[].effect` | Effect of the target taint. One of `NoSchedule`, `PreferNoSchedule`, or `NoExecute`. | String | N/A | | `scheduling.extraTolerations[].tolerationSeconds` | Time in seconds to remain on the node when the `effect` is `NoExecute`. | Integer | N/A | The following is an example. ``` { "scheduling": { "nodeSelector": { "role": "storage" }, "extraTolerations": [ { "key": "dedicated", "operator": "Equal", "value": "storage", "effect": "NoSchedule" } ] } } ``` ## ExternalDNS This controller automatically registers and manages DNS names configured for Kubernetes Services and Ingresses with an external DNS service. Installing this add-on eliminates the need to manually manage domains exposed by workloads. After installation, see the [ExternalDNS use cases](/docs/en/k8s-k8sexamples-externaldns-vpc) for usage instructions. ### Settings The settings provided by ExternalDNS are as follows. | Item | Description | Type | Default | Example | | --- | --- | --- | --- | --- | | `sources` | Resource types for which DNS records are created. 1 or more of `service`, `ingress`, and `crd`. | Array | `service`, `ingress`, `crd` | `["ingress"]` | | `domainFilter` | - Limit the domains to manage. - Only records for the specified domains are created and managed. If left empty, no limit applies. | String | Empty | `example.com,foo.io` | | `annotationFilter` | Process only resources with the specified annotation. | String | Empty | `external-dns.alpha.kubernetes.io/include=true` | | `labelFilter` | Process only resources with the specified label. | String | Empty | `team=infra` | | `txtPrefix` | Prefix added to TXT record names used for ownership tracking. | String | `_edns.` | `_edns.` | | `txtSuffix` | - Suffix added to TXT record names used for ownership tracking. - Cannot be used with `txtPrefix` (see the caution below). | String | Empty | `-edns` | | `policy` | - DNS record synchronization policy. - `sync`: Applies all creations, modifications, and deletions. - `upsert-only`: Does not delete. - `create-only`: Performs creation only. | String | `upsert-only` | `sync` | | `logLevel` | Log output level. One of `debug`, `info`, `warn`, or `error`. | String | `info` | `debug` | | `credentials.secretName` | - Name of the Secret containing the access key used for external DNS authentication. - If left empty, authentication is performed using the node's Node IAM Role. - The Secret must be created in advance by the user (see below). | String | Empty | `external-dns-credentials` | | `scheduling.nodeSelector` | Node label conditions for deploying components. | Object (string map) | N/A | `{"role":"external-dns"}` | | `scheduling.extraTolerations` | List of tolerations for deploying components to nodes with taints. | Array | N/A | — | | `scheduling.extraTolerations[].key` | Target taint key. | String | N/A | `dedicated` | | `scheduling.extraTolerations[].operator` | Method for comparing the key and value. Either `Exists` or `Equal`. | String | N/A | `Equal` | | `scheduling.extraTolerations[].value` | Value to compare when the `operator` is `Equal`. | String | N/A | `dns` | | `scheduling.extraTolerations[].effect` | Effect of the target taint. One of `NoSchedule`, `PreferNoSchedule`, or `NoExecute`. | String | N/A | `NoSchedule` | | `scheduling.extraTolerations[].tolerationSeconds` | Time in seconds to remain on the node when the `effect` is `NoExecute`. | Integer | N/A | `300` | The following is an example. ``` { "sources": ["service", "ingress", "crd"], "domainFilter": "example.com,foo.io", "annotationFilter": "external-dns.alpha.kubernetes.io/include=true", "labelFilter": "team=infra", "txtPrefix": "", "txtSuffix": "-edns", "policy": "sync", "logLevel": "info", "credentials": { "secretName": "external-dns-credentials" }, "scheduling": { "nodeSelector": { "role": "external-dns" }, "extraTolerations": [ { "key": "dedicated", "operator": "Equal", "value": "dns", "effect": "NoSchedule" } ] } } ``` ## NKS Gateway API Adapter This adapter connects Gateway API resources (Gateway, HTTPRoute) to NAVER Cloud Application Load Balancer (ALB). Installing this add-on allows you to configure external traffic routing using standard Gateway API resources. After installation, see [Using Gateway API](/docs/en/gateway-api-use) for usage instructions. ### Settings The available settings are as follows. | Item | Description | Type | Default | | --- | --- | --- | --- | | `scheduling.nodeSelector` | Node label conditions for deploying components. | Object (string map) | N/A | | `scheduling.extraTolerations` | List of tolerations for deploying components to nodes with taints. | Array | N/A | | `scheduling.extraTolerations[].key` | Target taint key. | String | N/A | | `scheduling.extraTolerations[].operator` | Method for comparing the key and value. Either `Exists` or `Equal`. | String | N/A | | `scheduling.extraTolerations[].value` | Value to compare when the `operator` is `Equal`. | String | N/A | | `scheduling.extraTolerations[].effect` | Effect of the target taint. One of `NoSchedule`, `PreferNoSchedule`, or `NoExecute`. | String | N/A | | `scheduling.extraTolerations[].tolerationSeconds` | Time in seconds to remain on the node when the `effect` is `NoExecute`. | Integer | N/A | The following is an example. ``` { "scheduling": { "nodeSelector": { "role": "gateway" }, "extraTolerations": [ { "key": "dedicated", "operator": "Equal", "value": "gateway", "effect": "NoSchedule" } ] } } ``` ## Istio Istio is a service mesh that provides traffic management, mTLS-based security, and observability for service-to-service communication within a cluster. This add-on installs the Istio control plane (istiod). For information on sidecar injection and using mesh features, see the [official Istio documentation](https://istio.io/latest/docs/). This add-on supports Canary upgrades. Each installed version line has a Revision (e.g., the Revision of version `1.30.3` is `1-30`), and each namespace uses the `istio.io/rev` label to specify the Revision whose sidecars are injected into it. For the upgrade procedure, see Canary upgrade in [Add-on installation and management](/docs/en/k8s-k8suse-addon-manage). ### Settings The settings provided by Istio are as follows. The `meshConfig` field passes Istio's mesh configuration (MeshConfig) as is. For the behavior of each field, see the [Istio MeshConfig reference](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/). | Item | Description | Type | Default | | --- | --- | --- | --- | | `meshConfig.accessLogFile` | - Sidecar access log output destination. - Only an empty value (no output) or `/dev/stdout` (standard output) can be specified. | String | Empty | | `meshConfig.accessLogEncoding` | Access log encoding. Either `TEXT` or `JSON`. | String | `TEXT` | | `meshConfig.accessLogFormat` | Access log format string. If empty, the Istio default format is used. | String | Empty | | `meshConfig.outboundTrafficPolicy.mode` | Policy for traffic leaving the mesh. Either `ALLOW_ANY` or `REGISTRY_ONLY`. | String | `ALLOW_ANY` | | `meshConfig.defaultConfig.terminationDrainDuration` | Connection drain wait time when the sidecar terminates. Specified with a time unit (e.g., `30s`). | String | `5s` | | `meshConfig.meshMTLS.minProtocolVersion` | Minimum TLS version for mesh mTLS. One of `TLS_AUTO`, `TLSV1_2`, or `TLSV1_3`. | String | `TLS_AUTO` | | `meshConfig.defaultHttpRetryPolicy.attempts` | Default number of HTTP retries. If `0`, default retries are disabled. | Integer | N/A | | `meshConfig.defaultHttpRetryPolicy.retryOn` | Conditions for retrying (comma-separated). | String | N/A | | `meshConfig.discoverySelectors` | List of label selectors that limit the namespaces watched by the control plane. | Array | N/A | | `meshConfig.discoverySelectors[].matchLabels` | Labels that must match. | Object (string map) | N/A | | `meshConfig.discoverySelectors[].matchExpressions` | List of label expressions (`key`, `operator`, `values`). `operator` is one of `In`, `NotIn`, `Exists`, or `DoesNotExist`. | Array | N/A | | `meshConfig.extensionProviders` | List of tracing extension providers. For each item, specify `name` and either `zipkin` or `opentelemetry`. | Array | N/A | | `meshConfig.extensionProviders[].name` | Provider name. | String | N/A | | `meshConfig.extensionProviders[].zipkin.service` / `.port` | Zipkin collector service address and port. | String/Integer | N/A | | `meshConfig.extensionProviders[].opentelemetry.service` / `.port` | OpenTelemetry collector service address and port. | String/Integer | N/A | | `nodeSelector` | Label conditions for the nodes on which to deploy the control plane (istiod) on. | Object (string map) | N/A | | `tolerations` | - List of tolerations for deploying the control plane to nodes with taints. - Tolerations required for operation are automatically included and cannot be removed with this field. | Array | N/A | | `tolerations[].key` | Target taint key. | String | N/A | | `tolerations[].operator` | Method for comparing the key and value. Either `Exists` or `Equal`. | String | N/A | | `tolerations[].value` | Value to compare when the `operator` is `Equal`. | String | N/A | | `tolerations[].effect` | Effect of the target taint. One of `NoSchedule`, `PreferNoSchedule`, or `NoExecute`. | String | N/A | | `tolerations[].tolerationSeconds` | Time in seconds to remain on the node when the `effect` is `NoExecute`. | Integer | N/A | The following is an example. ``` { "meshConfig": { "accessLogFile": "/dev/stdout", "accessLogEncoding": "JSON", "outboundTrafficPolicy": { "mode": "REGISTRY_ONLY" }, "meshMTLS": { "minProtocolVersion": "TLSV1_2" }, "extensionProviders": [ { "name": "otel", "opentelemetry": { "service": "otel-collector.observability.svc.cluster.local", "port": 4317 } } ] }, "nodeSelector": { "role": "mesh" }, "tolerations": [ { "key": "dedicated", "operator": "Equal", "value": "mesh", "effect": "NoSchedule" } ] } ``` Note Settings are applied to the control plane of the installed version (Revision). If you specify settings to apply to the new version when starting a Canary upgrade, they replace the current settings. ### Canary upgrade and workload migration When you start a Canary upgrade, the control plane of the new Revision is installed alongside the existing Revision. Workloads continue to use the Revision specified in the namespace's `istio.io/rev` label. If you change the label to the new Revision and restart the workloads, the restarted pods run with sidecars of the new Revision. Migrate namespaces sequentially, starting with those that have the smallest impact, and verify that they work properly. ``` # Switch the namespace to the new revision (e.g., 1-30) kubectl label namespace istio.io/rev=1-30 --overwrite # Restart workloads (the new revision applies starting with restarted pods) kubectl rollout restart deployment -n ``` If issues are found, revert the label to the existing Revision and restart the workloads again to return to the existing Revision. Caution Confirming removes the control plane of the existing Revision. In namespaces where the existing Revision label remains, sidecars are not injected into pods restarted afterward, so switch the labels of all namespaces to the new Revision before confirming. When canceling, revert the namespaces switched to the new Revision back to the existing Revision before proceeding. For details on how Revision-based upgrades work, see [Canary upgrades in the official Istio documentation](https://istio.io/latest/docs/setup/upgrade/canary/). ## Version compatibility The add-on versions available for installation vary depending on the cluster's Kubernetes version. When installing or editing an add-on, only versions compatible with the cluster can be selected. For the supported versions of each add-on, see the version compatibility table in [Add-on version](/docs/en/k8s-k8suse-addon-releasenote).