Add a bootstrap role.

nix/kubernetes/roles/bootstrap/default.nix

@@ -17,7 +17,7 @@
     };
 
     bootstrap.manifests = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = lib.literalExpression ''[ ${./files/clusterrole.yaml} ]'';
       description = "List of kubernetes manifests to load into the cluster.";
@@ -29,8 +29,9 @@
       {
         systemd.services.kube-bootstrap = {
           enable = true;
-          description = "Load initial kubernetes manifests into the cluster.";
+          description = "Load initial kubernetes manifests into the cluster";
           after = [ "kubernetes.target" ];
+          wantedBy = [ "multi-user.target" ];
           path = with pkgs; [
             kubectl
           ];
@@ -40,13 +41,13 @@
           };
           script =
             let
-              manifests = (lib.concatMapStringsSep " " lib.escapeShellArgs config.me.bootstrap.manifests);
+              manifests = (lib.concatMapStringsSep "," lib.escapeShellArg config.me.bootstrap.manifests);
             in
             ''
               set -o pipefail
               IFS=$'\n\t'
 
-              kubectl apply --server-side --force-conflicts -f ${manifests}
+              kubectl --kubeconfig=/.persist/keys/kube/kubelet.kubeconfig apply --server-side --force-conflicts -f ${manifests}
             '';
         };
       };

nix/kubernetes/roles/bootstrap/files/initial_clusterrole.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    rbac.authorization.kubernetes.io/autoupdate: "true"
+  labels:
+    kubernetes.io/bootstrapping: rbac-defaults
+  name: system:kube-apiserver-to-kubelet
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/proxy
+      - nodes/stats
+      - nodes/log
+      - nodes/spec
+      - nodes/metrics
+    verbs:
+      - "*"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:kube-apiserver
+  namespace: ""
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:kube-apiserver-to-kubelet
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: User
+    name: kubernetes