Move the kubelet yaml config into nix.

nix/kubernetes/roles/kubelet/default.nix

@@ -8,6 +8,48 @@
 let
   # shellCommand = cmd: (lib.concatMapStringsSep " " lib.strings.escapeShellArg cmd);
   shellCommand = cmd: (builtins.concatStringsSep " " cmd);
+  to_yaml_file = ((import ../../../functions/to_yaml.nix) { inherit pkgs; }).to_yaml_file;
+
+  kubelet_config = {
+    kind = "KubeletConfiguration";
+    apiVersion = "kubelet.config.k8s.io/v1beta1";
+    address = "0.0.0.0";
+    authentication = {
+      anonymous = {
+        enabled = false;
+      };
+      webhook = {
+        enabled = true;
+      };
+      x509 = {
+        clientCAFile = "/.persist/keys/kube/ca.crt";
+      };
+    };
+    authorization = {
+      mode = "Webhook";
+    };
+    cgroupDriver = "systemd";
+    containerRuntimeEndpoint = "unix:///var/run/containerd/containerd.sock";
+    enableServer = true;
+    failSwapOn = false;
+    maxPods = 16;
+    memorySwap = {
+      swapBehavior = "NoSwap";
+    };
+    port = 10250;
+    # resolvConf = "/run/systemd/resolve/resolv.conf";
+    resolvConf = "${./files/resolv.conf}";
+    registerNode = true;
+    runtimeRequestTimeout = "15m";
+    tlsCertFile = "/.persist/keys/kube/kubelet.crt";
+    tlsPrivateKeyFile = "/.persist/keys/kube/kubelet.key";
+    # clusterDomain = "cluster.local";
+    # clusterDNS = [
+    #   "10.197.0.10"
+    #   "fd00:3e42:e349::10"
+    # ];
+  };
+  kubelet_config_file = (to_yaml_file "kubelet-config.yaml" kubelet_config);
 in
 {
   imports = [ ];
@@ -37,7 +79,7 @@ in
         ExecStart = (
           shellCommand [
             "${pkgs.kubernetes}/bin/kubelet"
-            "--config=${./files/kubelet-config.yaml}"
+            "--config=${kubelet_config_file}"
             "--kubeconfig=/.persist/keys/kube/kubelet.kubeconfig"
             "--v=2"
           ]