Serge Bazanski | 55a486a | 2022-06-11 18:27:01 +0000 | [diff] [blame] | 1 | { config, pkgs, lib, machines, ... }: |
| 2 | |
| 3 | with lib; |
| 4 | |
| 5 | let |
| 6 | # Pin for kubelet and proxy. |
| 7 | k8spkgs = import (fetchGit { |
| 8 | # Now at 1.16.5 |
| 9 | name = "nixos-unstable-2020-01-22"; |
| 10 | url = https://github.com/nixos/nixpkgs-channels/; |
| 11 | rev = "a96ed5d70427bdc2fbb9e805784e1b9621157a98"; |
| 12 | }) {}; |
| 13 | |
| 14 | cfg = config.hscloud.kube.data; |
| 15 | |
| 16 | # All control plane nodes. |
| 17 | controlNodes = let |
| 18 | list = mapAttrsToList (_: v: v) machines; |
| 19 | filtered = filter (m: (m.config ? hscloud.kube.control) && (m.config.hscloud.kube.control.enable)) list; |
| 20 | sorted = sort (a: b: a.config.hscloud.base.fqdn < b.config.hscloud.base.fqdn) filtered; |
| 21 | in sorted; |
| 22 | |
| 23 | fqdn = config.hscloud.base.fqdn; |
| 24 | |
| 25 | pki = config.hscloud.kube.pki; |
| 26 | |
| 27 | in { |
| 28 | options.hscloud.kube.data = { |
| 29 | enable = mkEnableOption "kubernetes data plane"; |
| 30 | podNet = mkOption { |
| 31 | type = types.str; |
| 32 | description = "Subnet in which this node will run pods. Must be exclusive with podNets of other nodes."; |
| 33 | }; |
| 34 | }; |
| 35 | |
Serge Bazanski | 55a486a | 2022-06-11 18:27:01 +0000 | [diff] [blame] | 36 | imports = [ |
Serge Bazanski | 55a486a | 2022-06-11 18:27:01 +0000 | [diff] [blame] | 37 | ./kube-common.nix |
| 38 | ]; |
| 39 | |
Serge Bazanski | 55a486a | 2022-06-11 18:27:01 +0000 | [diff] [blame] | 40 | config = mkIf cfg.enable { |
| 41 | # If we're not running the control plane, render a hostsfile that points at |
| 42 | # all other control plane nodes. Otherwise, the control plane module will |
| 43 | # make this hostsfile contain the node itself. |
| 44 | networking.extraHosts = mkIf (!config.hscloud.kube.control.enable) (concatStringsSep "\n" (map |
| 45 | (n: '' |
| 46 | ${n.config.hscloud.base.mgmtIf} ${n.config.hscloud.base.fqdn} |
| 47 | '') |
| 48 | controlNodes)); |
| 49 | |
| 50 | # this seems to depend on flannel |
| 51 | # TODO(q3k): file issue |
| 52 | systemd.services.kubelet-online = { |
| 53 | script = pkgs.lib.mkForce "sleep 1"; |
| 54 | }; |
| 55 | |
| 56 | services.kubernetes = { |
| 57 | # The kubelet wants to mkfs.ext4 when mounting pvcs. |
| 58 | path = [ pkgs.e2fsprogs ]; |
| 59 | |
| 60 | proxy = { |
| 61 | enable = true; |
| 62 | kubeconfig = pki.kube.proxy.config; |
| 63 | extraOpts = '' |
| 64 | --hostname-override=${fqdn}\ |
| 65 | --proxy-mode=iptables |
| 66 | ''; |
| 67 | }; |
| 68 | |
| 69 | kubelet = { |
| 70 | enable = true; |
| 71 | unschedulable = false; |
| 72 | hostname = fqdn; |
| 73 | tlsCertFile = pki.kube.kubelet.cert; |
| 74 | tlsKeyFile = pki.kube.kubelet.key; |
Serge Bazanski | 9251121 | 2023-04-01 13:50:02 +0000 | [diff] [blame] | 75 | clientCaFile = pki.kube.kubelet.ca; |
Serge Bazanski | 55a486a | 2022-06-11 18:27:01 +0000 | [diff] [blame] | 76 | nodeIp = config.hscloud.base.ipAddr; |
| 77 | networkPlugin = "cni"; |
| 78 | clusterDns = "10.10.12.254"; |
| 79 | kubeconfig = pki.kube.kubelet.config; |
| 80 | extraOpts = '' |
| 81 | --read-only-port=0 |
| 82 | ''; |
| 83 | package = config.hscloud.kube.packageKubelet; |
| 84 | }; |
| 85 | }; |
| 86 | }; |
| 87 | } |