talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Add controller proxy certs.

Browse Source
This commit is contained in:
Tom Alexander
2025-12-14 14:48:53 -05:00
parent f18b7d0da9
commit f2a505131a
8 changed files with 165 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
nix/kubernetes/roles/kube_apiserver/default.nix
View File

@@ -70,8 +70,8 @@ in
"--requestheader-extra-headers-prefix=X-Remote-Extra-"
"--requestheader-group-headers=X-Remote-Group"
"--requestheader-username-headers=X-Remote-User"
"--proxy-client-cert-file=/var/lib/kubernetes/{{ node_name }}-proxy.pem"
"--proxy-client-key-file=/var/lib/kubernetes/{{ node_name }}-proxy-key.pem"
"--proxy-client-cert-file=/.persist/keys/kube/${config.networking.hostName}-proxy.pem"
"--proxy-client-key-file=/.persist/keys/kube/${config.networking.hostName}-proxy-key.pem"
"--enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
"--etcd-cafile=/.persist/keys/kube/ca.pem"
"--etcd-certfile=/.persist/keys/kube/kubernetes.pem"
@@ -91,7 +91,8 @@ in
"--tls-private-key-file=/.persist/keys/kube/kubernetes-key.pem"
"--tls-min-version=VersionTLS13"
"--kubelet-preferred-address-types=InternalIP,ExternalDNS,ExternalIP,Hostname,InternalDNS"
"--service-cluster-ip-range=10.197.0.0/16"
# "--service-cluster-ip-range=10.197.0.0/16"
"--service-cluster-ip-range=2620:11f:7001:7:ffff:ffff:0ac5:0000/16"
"--enable-aggregator-routing=true"
"--v=2"
]