talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix launching kube-apiserver.

Browse Source
This commit is contained in:
Tom Alexander 2025-12-14 23:24:23 -05:00 committed by Tom Alexander
parent f8b8005ab2
commit 65cd71f0c6
Signed by: talexander
GPG Key ID: 36C99E8B3C39D85F
2 changed files with 100 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
nix/kubernetes/keys/package/deploy-script/package.nix
View File

@ -85,6 +85,49 @@ let
group = 10016;
mode = "0640";
}
{
dest_dir = "/vm/${vm_name}/persist/keys/kube";
file = "${k8s.ca}/ca.crt";
owner = 10024;
group = 10024;
mode = "0640";
}
{
dest_dir = "/vm/${vm_name}/persist/keys/kube";
file = "${k8s.keys.kube-api-server}/kube-api-server.crt";
owner = 10024;
group = 10024;
mode = "0640";
}
{
dest_dir = "/vm/${vm_name}/persist/keys/kube";
file = "${k8s.keys.kube-api-server}/kube-api-server.key";
owner = 10024;
group = 10024;
mode = "0600";
}
{
dest_dir = "/vm/${vm_name}/persist/keys/kube";
file = "${k8s.encryption_config}/encryption-config.yaml";
name = "encryption-config.yaml";
owner = 10024;
group = 10024;
mode = "0600";
}
{
dest_dir = "/vm/${vm_name}/persist/keys/kube";
file = "${k8s.keys.service-accounts}/service-accounts.crt";
owner = 10024;
group = 10024;
mode = "0640";
}
{
dest_dir = "/vm/${vm_name}/persist/keys/kube";
file = "${k8s.keys.service-accounts}/service-accounts.key";
owner = 10024;
group = 10024;
mode = "0600";
}
# {
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
# file = "${self.kubernetes}/kubernetes.pem";

82
nix/kubernetes/roles/kube_apiserver/default.nix
View File

@ -6,7 +6,8 @@
}:
let
shellCommand = cmd: (lib.concatMapStringsSep " " lib.strings.escapeShellArg cmd);
# shellCommand = cmd: (lib.concatMapStringsSep " " lib.strings.escapeShellArg cmd);
shellCommand = cmd: (builtins.concatStringsSep " " cmd);
in
{
imports = [ ];
@ -54,47 +55,78 @@ in
Type = "notify";
ExecStart = (
shellCommand [
# NEW:
"${pkgs.kubernetes}/bin/kube-apiserver"
"--advertise-address=${config.me.kube_apiserver.internal_ip}"
"--allow-privileged=true"
"--apiserver-count=3"
"--audit-log-maxage=30"
"--audit-log-maxbackup=3"
"--audit-log-maxsize=100"
"--audit-log-path=/var/log/audit.log"
"--authorization-mode=Node,RBAC"
"--bind-address=0.0.0.0"
"--client-ca-file=/.persist/keys/kube/ca.pem"
"--requestheader-client-ca-file=/.persist/keys/kube/requestheader-client-ca.pem"
''--requestheader-allowed-names=""''
"--requestheader-extra-headers-prefix=X-Remote-Extra-"
"--requestheader-group-headers=X-Remote-Group"
"--requestheader-username-headers=X-Remote-User"
"--proxy-client-cert-file=/.persist/keys/kube/${config.networking.hostName}-proxy.pem"
"--proxy-client-key-file=/.persist/keys/kube/${config.networking.hostName}-proxy-key.pem"
"--client-ca-file=/.persist/keys/kube/ca.crt"
"--enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
"--etcd-cafile=/.persist/keys/kube/ca.pem"
"--etcd-certfile=/.persist/keys/kube/kubernetes.pem"
"--etcd-keyfile=/.persist/keys/kube/kubernetes-key.pem"
"--etcd-certfile=/.persist/keys/kube/kube-api-server.crt"
"--etcd-keyfile=/.persist/keys/kube/kube-api-server.key"
"--etcd-servers=${builtins.concatStringsSep "," config.me.kube_apiserver.etcd_services}"
"--event-ttl=1h"
"--encryption-provider-config=/.persist/keys/kube/encryption-config.yaml"
"--kubelet-certificate-authority=/.persist/keys/kube/ca.pem"
"--kubelet-client-certificate=/.persist/keys/kube/kubernetes.pem"
"--kubelet-client-key=/.persist/keys/kube/kubernetes-key.pem"
"--kubelet-certificate-authority=/.persist/keys/kube/ca.crt"
"--kubelet-client-certificate=/.persist/keys/kube/kube-api-server.crt"
"--kubelet-client-key=/.persist/keys/kube/kube-api-server.key"
"--runtime-config='api/all=true'"
"--service-account-key-file=/.persist/keys/kube/service-account.pem"
"--service-account-signing-key-file=/.persist/keys/kube/service-account-key.pem"
"--service-account-issuer=https://${config.me.kube_apiserver.external_ip}:6443"
"--service-account-key-file=/.persist/keys/kube/service-accounts.crt"
"--service-account-signing-key-file=/.persist/keys/kube/service-accounts.key"
"--service-account-issuer=https://server.kubernetes.local:6443"
"--service-node-port-range=30000-32767"
"--tls-cert-file=/.persist/keys/kube/kubernetes.pem"
"--tls-private-key-file=/.persist/keys/kube/kubernetes-key.pem"
"--tls-cert-file=/.persist/keys/kube/kube-api-server.crt"
"--tls-private-key-file=/.persist/keys/kube/kube-api-server.key"
"--tls-min-version=VersionTLS13"
"--kubelet-preferred-address-types=InternalIP,ExternalDNS,ExternalIP,Hostname,InternalDNS"
# "--service-cluster-ip-range=10.197.0.0/16"
"--service-cluster-ip-range=2620:11f:7001:7:ffff:ffff:0ac5:0000/16"
"--enable-aggregator-routing=true"
"--v=2"
# OLD:
# "${pkgs.kubernetes}/bin/kube-apiserver"
# "--advertise-address=${config.me.kube_apiserver.internal_ip}"
# "--allow-privileged=true"
# "--apiserver-count=3"
# "--audit-log-maxage=30"
# "--audit-log-maxbackup=3"
# "--audit-log-maxsize=100"
# "--audit-log-path=/var/log/audit.log"
# "--authorization-mode=Node,RBAC"
# "--bind-address=0.0.0.0"
# "--client-ca-file=/.persist/keys/kube/ca.pem"
# "--requestheader-client-ca-file=/.persist/keys/kube/requestheader-client-ca.pem"
# ''--requestheader-allowed-names=""''
# "--requestheader-extra-headers-prefix=X-Remote-Extra-"
# "--requestheader-group-headers=X-Remote-Group"
# "--requestheader-username-headers=X-Remote-User"
# "--proxy-client-cert-file=/.persist/keys/kube/${config.networking.hostName}-proxy.pem"
# "--proxy-client-key-file=/.persist/keys/kube/${config.networking.hostName}-proxy-key.pem"
# "--enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
# "--etcd-cafile=/.persist/keys/kube/ca.pem"
# "--etcd-certfile=/.persist/keys/kube/kubernetes.pem"
# "--etcd-keyfile=/.persist/keys/kube/kubernetes-key.pem"
# "--etcd-servers=${builtins.concatStringsSep "," config.me.kube_apiserver.etcd_services}"
# "--event-ttl=1h"
# "--encryption-provider-config=/.persist/keys/kube/encryption-config.yaml"
# "--kubelet-certificate-authority=/.persist/keys/kube/ca.pem"
# "--kubelet-client-certificate=/.persist/keys/kube/kubernetes.pem"
# "--kubelet-client-key=/.persist/keys/kube/kubernetes-key.pem"
# "--runtime-config='api/all=true'"
# "--service-account-key-file=/.persist/keys/kube/service-account.pem"
# "--service-account-signing-key-file=/.persist/keys/kube/service-account-key.pem"
# "--service-account-issuer=https://${config.me.kube_apiserver.external_ip}:6443"
# "--service-node-port-range=30000-32767"
# "--tls-cert-file=/.persist/keys/kube/kubernetes.pem"
# "--tls-private-key-file=/.persist/keys/kube/kubernetes-key.pem"
# "--tls-min-version=VersionTLS13"
# "--kubelet-preferred-address-types=InternalIP,ExternalDNS,ExternalIP,Hostname,InternalDNS"
# # "--service-cluster-ip-range=10.197.0.0/16"
# "--service-cluster-ip-range=2620:11f:7001:7:ffff:ffff:0ac5:0000/16"
# "--enable-aggregator-routing=true"
# "--v=2"
]
);
Restart = "on-failure";