Skip to content

Commit 7e28421

Browse files
pennaepennae
committed
nixos/kubernetes: make lib option internal and readonly
this set almost certainly shouldn't be touched by users, nor listed in the manual. make it internal and use it only through the option path to make clear that this should not be modified.
1 parent abef4b1 commit 7e28421

6 files changed

Lines changed: 23 additions & 16 deletions

File tree

‎nixos/modules/services/cluster/kubernetes/controller-manager.nix‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ let
66
top = config.services.kubernetes;
77
otop = options.services.kubernetes;
88
cfg = top.controllerManager;
9+
klib = options.services.kubernetes.lib.default;
910
in
1011
{
1112
imports = [
@@ -56,7 +57,7 @@ in
5657
type = int;
5758
};
5859

59-
kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes controller manager";
60+
kubeconfig = klib.mkKubeConfigOptions "Kubernetes controller manager";
6061

6162
leaderElect = mkOption {
6263
description = "Whether to start leader election before executing main loop.";
@@ -129,7 +130,7 @@ in
129130
"--cluster-cidr=${cfg.clusterCidr}"} \
130131
${optionalString (cfg.featureGates != [])
131132
"--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
132-
--kubeconfig=${top.lib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
133+
--kubeconfig=${klib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
133134
--leader-elect=${boolToString cfg.leaderElect} \
134135
${optionalString (cfg.rootCaFile!=null)
135136
"--root-ca-file=${cfg.rootCaFile}"} \
@@ -156,7 +157,7 @@ in
156157
path = top.path;
157158
};
158159

159-
services.kubernetes.pki.certs = with top.lib; {
160+
services.kubernetes.pki.certs = with klib; {
160161
controllerManager = mkCert {
161162
name = "kube-controller-manager";
162163
CN = "kube-controller-manager";

‎nixos/modules/services/cluster/kubernetes/default.nix‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,8 @@ in {
192192
inherit mkKubeConfigOptions;
193193
};
194194
type = types.attrs;
195+
readOnly = true;
196+
internal = true;
195197
};
196198

197199
secretsPath = mkOption {

‎nixos/modules/services/cluster/kubernetes/kubelet.nix‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ let
66
top = config.services.kubernetes;
77
otop = options.services.kubernetes;
88
cfg = top.kubelet;
9+
klib = options.services.kubernetes.lib.default;
910

1011
cniConfig =
1112
if cfg.cni.config != [] && cfg.cni.configDir != null then
@@ -27,7 +28,7 @@ let
2728
config.Cmd = ["/bin/pause"];
2829
};
2930

30-
kubeconfig = top.lib.mkKubeConfig "kubelet" cfg.kubeconfig;
31+
kubeconfig = klib.mkKubeConfig "kubelet" cfg.kubeconfig;
3132

3233
manifestPath = "kubernetes/manifests";
3334

@@ -177,7 +178,7 @@ in
177178
type = str;
178179
};
179180

180-
kubeconfig = top.lib.mkKubeConfigOptions "Kubelet";
181+
kubeconfig = klib.mkKubeConfigOptions "Kubelet";
181182

182183
manifests = mkOption {
183184
description = "List of manifests to bootstrap with kubelet (only pods can be created as manifest entry)";
@@ -358,7 +359,7 @@ in
358359
services.kubernetes.kubelet.hostname = with config.networking;
359360
mkDefault (hostName + optionalString (domain != null) ".${domain}");
360361

361-
services.kubernetes.pki.certs = with top.lib; {
362+
services.kubernetes.pki.certs = with klib; {
362363
kubelet = mkCert {
363364
name = "kubelet";
364365
CN = top.kubelet.hostname;

‎nixos/modules/services/cluster/kubernetes/pki.nix‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
1-
{ config, lib, pkgs, ... }:
1+
{ config, options, lib, pkgs, ... }:
22

33
with lib;
44

55
let
66
top = config.services.kubernetes;
77
cfg = top.pki;
8+
klib = options.services.kubernetes.lib;
89

910
csrCA = pkgs.writeText "kube-pki-cacert-csr.json" (builtins.toJSON {
1011
key = {
@@ -29,7 +30,7 @@ let
2930
cfsslAPITokenLength = 32;
3031

3132
clusterAdminKubeconfig = with cfg.certs.clusterAdmin;
32-
top.lib.mkKubeConfig "cluster-admin" {
33+
klib.mkKubeConfig "cluster-admin" {
3334
server = top.apiserverAddress;
3435
certFile = cert;
3536
keyFile = key;
@@ -250,7 +251,7 @@ in
250251
# - it would be better with a more Nix-oriented way of managing addons
251252
systemd.services.kube-addon-manager = mkIf top.addonManager.enable (mkMerge [{
252253
environment.KUBECONFIG = with cfg.certs.addonManager;
253-
top.lib.mkKubeConfig "addon-manager" {
254+
klib.mkKubeConfig "addon-manager" {
254255
server = top.apiserverAddress;
255256
certFile = cert;
256257
keyFile = key;
@@ -343,7 +344,7 @@ in
343344
'';
344345

345346
services.flannel = with cfg.certs.flannelClient; {
346-
kubeconfig = top.lib.mkKubeConfig "flannel" {
347+
kubeconfig = klib.mkKubeConfig "flannel" {
347348
server = top.apiserverAddress;
348349
certFile = cert;
349350
keyFile = key;

‎nixos/modules/services/cluster/kubernetes/proxy.nix‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ let
66
top = config.services.kubernetes;
77
otop = options.services.kubernetes;
88
cfg = top.proxy;
9+
klib = options.services.kubernetes.lib.default;
910
in
1011
{
1112
imports = [
@@ -43,7 +44,7 @@ in
4344
type = str;
4445
};
4546

46-
kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes proxy";
47+
kubeconfig = klib.mkKubeConfigOptions "Kubernetes proxy";
4748

4849
verbosity = mkOption {
4950
description = ''
@@ -72,7 +73,7 @@ in
7273
${optionalString (cfg.featureGates != [])
7374
"--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
7475
--hostname-override=${cfg.hostname} \
75-
--kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
76+
--kubeconfig=${klib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
7677
${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
7778
${cfg.extraOpts}
7879
'';
@@ -88,7 +89,7 @@ in
8889
services.kubernetes.proxy.hostname = with config.networking; mkDefault hostName;
8990

9091
services.kubernetes.pki.certs = {
91-
kubeProxyClient = top.lib.mkCert {
92+
kubeProxyClient = klib.mkCert {
9293
name = "kube-proxy-client";
9394
CN = "system:kube-proxy";
9495
action = "systemctl restart kube-proxy.service";

‎nixos/modules/services/cluster/kubernetes/scheduler.nix‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ let
66
top = config.services.kubernetes;
77
otop = options.services.kubernetes;
88
cfg = top.scheduler;
9+
klib = options.services.kubernetes.lib.default;
910
in
1011
{
1112
###### interface
@@ -32,7 +33,7 @@ in
3233
type = listOf str;
3334
};
3435

35-
kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes scheduler";
36+
kubeconfig = klib.mkKubeConfigOptions "Kubernetes scheduler";
3637

3738
leaderElect = mkOption {
3839
description = "Whether to start leader election before executing main loop.";
@@ -69,7 +70,7 @@ in
6970
--address=${cfg.address} \
7071
${optionalString (cfg.featureGates != [])
7172
"--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
72-
--kubeconfig=${top.lib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
73+
--kubeconfig=${klib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
7374
--leader-elect=${boolToString cfg.leaderElect} \
7475
--port=${toString cfg.port} \
7576
${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
@@ -87,7 +88,7 @@ in
8788
};
8889

8990
services.kubernetes.pki.certs = {
90-
schedulerClient = top.lib.mkCert {
91+
schedulerClient = klib.mkCert {
9192
name = "kube-scheduler-client";
9293
CN = "system:kube-scheduler";
9394
action = "systemctl restart kube-scheduler.service";

0 commit comments

Comments
 (0)