nixos

commit 1f3a6e2bd33a204df73b6a5fc131e966e5184253
parent 5d2bb2383a8f2a5fef3583a0122f61685c5212b5
Author: MTRNord <mtrnord1@gmail.com>
Date:   Tue, 12 Sep 2023 14:32:01 +0200

Make a kubernetes worker

Diffstat:
M
nixos/worker-1/configuration.nix
 | 
2
++
A
nixos/worker-1/kubernetes.nix
 | 
47
+++++++++++++++++++++++++++++++++++++++++++++++

2 files changed, 49 insertions(+), 0 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -34,6 +34,8 @@
     ../common/lib/fail2ban.nix
     ../common/lib/podman.nix
     ../common/lib/asterisk.nix
+
+    ./kubernetes.nix
   ];
 
   nixpkgs = {
diff --git a/nixos/worker-1/kubernetes.nix b/nixos/worker-1/kubernetes.nix
@@ -0,0 +1,47 @@
+{ lib, pkgs, config, ... }:
+{
+  environment.persistence."/persist" = {
+    directories = [
+      "/var/lib/kubernetes/"
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    cri-o
+    kubernetes
+    iproute2
+    ethtool
+    socat
+    cni
+  ];
+
+  boot.kernelModules = [ "br_netfilter" ];
+
+  boot.kernel.sysctl = {
+    # TODO IPV6/DualStack
+    "net.ipv4.ip_forward" = 1;
+    "net.bridge.bridge-nf-call-iptables" = 1;
+  };
+
+  virtualisation.cri-o.enable = true;
+
+  services.kubernetes = {
+    apiserverAddress = "https://[2a01:4f9:4a:451c:2::5]:6443";
+    masterAddress = "[2a01:4f9:4a:451c:2::5]";
+    roles = [ "node" ];
+    kubelet = {
+      enable = true;
+      kubeconfig = {
+        server = "https://[2a01:4f9:4a:451c:2::5]:6443";
+      };
+      extraOpts = "--fail-swap-on=false";
+      taints = {
+        "arm64" = {
+          key = "arch";
+          value = "arm64";
+          effect = "NoSchedule";
+        };
+      };
+    };
+  };
+}