talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Add configs for a new kubernetes cluster on NixOS.

Browse Source
This commit is contained in:
Tom Alexander
2025-11-30 14:32:36 -05:00
parent d35cfaacbd
commit b16db4325f
58 changed files with 3221 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
nix/kubernetes/keys/package/k8s-ca/files/ca-csr.json Normal file
View File

@@ -0,0 +1,16 @@
{
"CN": "Kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "US",
"L": "Portland",
"O": "Kubernetes",
"OU": "CA",
"ST": "Oregon"
}
]
}

28
nix/kubernetes/keys/package/k8s-ca/package.nix Normal file
View File

@@ -0,0 +1,28 @@
# unpackPhase
# patchPhase
# configurePhase
# buildPhase
# checkPhase
# installPhase
# fixupPhase
# installCheckPhase
# distPhase
{
stdenv,
sqlite,
cfssl,
...
}:
stdenv.mkDerivation (finalAttrs: {
name = "k8s-ca";
nativeBuildInputs = [ cfssl ];
buildInputs = [ ];
unpackPhase = "true";
installPhase = ''
mkdir -p "$out"
cd "$out"
cfssl gencert -initca ${./files/ca-csr.json} | cfssljson -bare ca
'';
})

13
nix/kubernetes/keys/package/k8s-keys/files/ca-config.json Normal file
View File

@@ -0,0 +1,13 @@
{
"signing": {
"default": {
"expiry": "8760h"
},
"profiles": {
"kubernetes": {
"usages": ["signing", "key encipherment", "server auth", "client auth"],
"expiry": "8760h"
}
}
}
}

16
nix/kubernetes/keys/package/k8s-keys/files/kubernetes-csr.json Normal file
View File

@@ -0,0 +1,16 @@
{
"CN": "kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "US",
"L": "Portland",
"O": "Kubernetes",
"OU": "Kubernetes The Hard Way",
"ST": "Oregon"
}
]
}

12
nix/kubernetes/keys/package/k8s-keys/package.nix Normal file
View File

@@ -0,0 +1,12 @@
{
k8s,
symlinkJoin,
...
}:
symlinkJoin {
name = "k8s-keys";
paths = [
k8s.kubernetes
k8s.ca
];
}

13
nix/kubernetes/keys/package/k8s-kubernetes/files/ca-config.json Normal file
View File

@@ -0,0 +1,13 @@
{
"signing": {
"default": {
"expiry": "8760h"
},
"profiles": {
"kubernetes": {
"usages": ["signing", "key encipherment", "server auth", "client auth"],
"expiry": "8760h"
}
}
}
}

16
nix/kubernetes/keys/package/k8s-kubernetes/files/kubernetes-csr.json Normal file
View File

@@ -0,0 +1,16 @@
{
"CN": "kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "US",
"L": "Portland",
"O": "Kubernetes",
"OU": "Kubernetes The Hard Way",
"ST": "Oregon"
}
]
}

36
nix/kubernetes/keys/package/k8s-kubernetes/package.nix Normal file
View File

@@ -0,0 +1,36 @@
# unpackPhase
# patchPhase
# configurePhase
# buildPhase
# checkPhase
# installPhase
# fixupPhase
# installCheckPhase
# distPhase
{
stdenv,
sqlite,
cfssl,
k8s,
all_hostnames,
...
}:
stdenv.mkDerivation (finalAttrs: {
name = "k8s-keys";
nativeBuildInputs = [ cfssl ];
buildInputs = [ ];
unpackPhase = "true";
installPhase = ''
mkdir -p "$out"
cd "$out"
cfssl gencert \
-ca=${k8s.ca}/ca.pem \
-ca-key=${k8s.ca}/ca-key.pem \
-config=${./files/ca-config.json} \
-hostname=${builtins.concatStringsSep "," all_hostnames} \
-profile=kubernetes \
${./files/kubernetes-csr.json} | cfssljson -bare kubernetes
'';
})