talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Add requestheader-client-ca.

Browse Source
This commit is contained in:
Tom Alexander 2025-12-14 13:44:56 -05:00 committed by Tom Alexander
parent 626055e063
commit 1cd5ba2c5c
Signed by: talexander
GPG Key ID: 36C99E8B3C39D85F
8 changed files with 68 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
nix/kubernetes/hosts/controller0/default.nix
View File

@ -117,6 +117,7 @@
];
me.kube_apiserver.internal_ip = "2620:11f:7001:7:ffff:ffff:0ad7:01dd";
me.kube_apiserver.external_ip = "74.80.180.138";
me.kube_apiserver.etcd_services = [
"https://[2620:11f:7001:7:ffff:ffff:0ad7:01dd]:2379" # 10.215.1.221
"https://[2620:11f:7001:7:ffff:ffff:0ad7:01de]:2379" # 10.215.1.222

1
nix/kubernetes/hosts/controller1/default.nix
View File

@ -117,6 +117,7 @@
];
me.kube_apiserver.internal_ip = "2620:11f:7001:7:ffff:ffff:0ad7:01de";
me.kube_apiserver.external_ip = "74.80.180.138";
me.kube_apiserver.etcd_services = [
"https://[2620:11f:7001:7:ffff:ffff:0ad7:01dd]:2379" # 10.215.1.221
"https://[2620:11f:7001:7:ffff:ffff:0ad7:01de]:2379" # 10.215.1.222

1
nix/kubernetes/hosts/controller2/default.nix
View File

@ -117,6 +117,7 @@
];
me.kube_apiserver.internal_ip = "2620:11f:7001:7:ffff:ffff:0ad7:01df";
me.kube_apiserver.external_ip = "74.80.180.138";
me.kube_apiserver.etcd_services = [
"https://[2620:11f:7001:7:ffff:ffff:0ad7:01dd]:2379" # 10.215.1.221
"https://[2620:11f:7001:7:ffff:ffff:0ad7:01de]:2379" # 10.215.1.222

1
nix/kubernetes/keys/package/k8s-keys/package.nix
View File

@ -9,5 +9,6 @@ symlinkJoin {
k8s.kubernetes
k8s.ca
k8s.service_account
k8s.requestheader-client-ca
];
}

16
nix/kubernetes/keys/package/k8s-requestheader-client-ca/files/requestheader-client-ca-csr.json Normal file
View File

@ -0,0 +1,16 @@
{
"CN": "Kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "US",
"L": "Portland",
"O": "Kubernetes",
"OU": "CA",
"ST": "Oregon"
}
]
}

30
nix/kubernetes/keys/package/k8s-requestheader-client-ca/package.nix Normal file
View File

@ -0,0 +1,30 @@
# unpackPhase
# patchPhase
# configurePhase
# buildPhase
# checkPhase
# installPhase
# fixupPhase
# installCheckPhase
# distPhase
{
stdenv,
sqlite,
cfssl,
k8s,
all_hostnames,
...
}:
stdenv.mkDerivation (finalAttrs: {
name = "k8s-service-account";
nativeBuildInputs = [ cfssl ];
buildInputs = [ ];
unpackPhase = "true";
installPhase = ''
mkdir -p "$out"
cd "$out"
cfssl gencert -initca ${./files/requestheader-client-ca-csr.json} | cfssljson -bare requestheader-client-ca
'';
})

10
nix/kubernetes/keys/scope.nix
View File

@ -151,6 +151,13 @@ makeScope newScope (
group = 10024;
mode = "0600";
}
{
dest_dir = "/vm/${vm_name}/persist/keys/kube";
file = "${self.requestheader-client-ca}/requestheader-client-ca.pem";
owner = 10024;
group = 10024;
mode = "0600";
}
])
)
);
@ -196,6 +203,9 @@ makeScope newScope (
ca = (callPackage ./package/k8s-ca/package.nix additional_vars);
kubernetes = (callPackage ./package/k8s-kubernetes/package.nix additional_vars);
service_account = (callPackage ./package/k8s-service-account/package.nix additional_vars);
requestheader-client-ca = (
callPackage ./package/k8s-requestheader-client-ca/package.nix additional_vars
);
keys = (callPackage ./package/k8s-keys/package.nix additional_vars);
deploy_script = (writeShellScript "deploy-keys" deploy_script);
}

10
nix/kubernetes/roles/kube_apiserver/default.nix
View File

@ -26,6 +26,12 @@ in
description = "IP address this server should advertise.";
};
kube_apiserver.external_ip = lib.mkOption {
example = "192.168.1.10";
type = lib.types.str;
description = "IP address to reach this cluster externally.";
};
kube_apiserver.etcd_services = lib.mkOption {
default = [ ];
example = [ "https://192.168.1.10:2379" ];
@ -59,7 +65,7 @@ in
"--authorization-mode=Node,RBAC"
"--bind-address=0.0.0.0"
"--client-ca-file=/.persist/keys/kube/ca.pem"
"--requestheader-client-ca-file=/var/lib/kubernetes/requestheader-client-ca.pem"
"--requestheader-client-ca-file=/.persist/keys/kube/requestheader-client-ca.pem"
''--requestheader-allowed-names=""''
"--requestheader-extra-headers-prefix=X-Remote-Extra-"
"--requestheader-group-headers=X-Remote-Group"
@ -79,7 +85,7 @@ in
"--runtime-config='api/all=true'"
"--service-account-key-file=/.persist/keys/kube/service-account.pem"
"--service-account-signing-key-file=/.persist/keys/kube/service-account-key.pem"
"--service-account-issuer=https://{{ kubernetes_public_address }}:6443"
"--service-account-issuer=https://${config.me.kube_apiserver.external_ip}:6443"
"--service-node-port-range=30000-32767"
"--tls-cert-file=/.persist/keys/kube/kubernetes.pem"
"--tls-private-key-file=/.persist/keys/kube/kubernetes-key.pem"