diff --git a/nixos/release.nix b/nixos/release.nix
index 6a3fcea1768..842bf264c08 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -296,7 +296,11 @@ in rec {
   tests.kernel-copperhead = callTest tests/kernel-copperhead.nix {};
   tests.kernel-latest = callTest tests/kernel-latest.nix {};
   tests.kernel-lts = callTest tests/kernel-lts.nix {};
-  tests.kubernetes = callSubTestsOnTheseSystems ["x86_64-linux"] tests/kubernetes/default.nix {};
+  #tests.kubernetes = callSubTestsOnTheseSystems ["x86_64-linux"] tests/kubernetes/default.nix {};
+  tests.kubernetes.dns = callSubTestsOnTheseSystems ["x86_64-linux"] tests/kubernetes/dns.nix {};
+  ## kubernetes.e2e should eventually replace kubernetes.rbac when it works
+  #tests.kubernetes.e2e = callSubTestsOnTheseSystems ["x86_64-linux"] tests/kubernetes/e2e.nix {};
+  tests.kubernetes.rbac = callSubTestsOnTheseSystems ["x86_64-linux"] tests/kubernetes/rbac.nix {};
   tests.latestKernel.login = callTest tests/login.nix { latestKernel = true; };
   tests.ldap = callTest tests/ldap.nix {};
   #tests.lightdm = callTest tests/lightdm.nix {};
diff --git a/nixos/tests/kubernetes/certs.nix b/nixos/tests/kubernetes/certs.nix
index d3eff910c46..846b2ca6dbf 100644
--- a/nixos/tests/kubernetes/certs.nix
+++ b/nixos/tests/kubernetes/certs.nix
@@ -7,28 +7,59 @@
 }:
 let
   runWithCFSSL = name: cmd:
-    builtins.fromJSON (builtins.readFile (
-      pkgs.runCommand "${name}-cfss.json" {
-        buildInputs = [ pkgs.cfssl ];
-      } "cfssl ${cmd} > $out"
-    ));
+    let secrets = pkgs.runCommand "${name}-cfss.json" {
+        buildInputs = [ pkgs.cfssl pkgs.jq ];
+        outputs = [ "out" "cert" "key" "csr" ];
+      }
+      ''
+        (
+          echo "${cmd}"
+          cfssl ${cmd} > tmp
+          cat tmp | jq -r .key > $key
+          cat tmp | jq -r .cert > $cert
+          cat tmp | jq -r .csr > $csr
+
+          touch $out
+        ) 2>&1 | fold -w 80 -s
+      '';
+    in {
+      key = secrets.key;
+      cert = secrets.cert;
+      csr = secrets.csr;
+    };
 
   writeCFSSL = content:
     pkgs.runCommand content.name {
-      buildInputs = [ pkgs.cfssl ];
+      buildInputs = [ pkgs.cfssl pkgs.jq ];
     } ''
       mkdir -p $out
       cd $out
-      cat ${writeFile content} | cfssljson -bare ${content.name}
+
+      json=${pkgs.lib.escapeShellArg (builtins.toJSON content)}
+
+      # for a given $field in the json, treat the associated value as a
+      # file path and substitute the contents thereof into the $json
+      # object.
+      expandFileField() {
+        local field=$1
+        local path="$(echo "$json" | jq -r ".$field")"
+        json="$(echo "$json" | jq --arg val "$(cat "$path")" ".$field = \$val")"
+      }
+
+      ${pkgs.lib.optionalString (content ? key) "expandFileField key"}
+      ${pkgs.lib.optionalString (content ? ca) "expandFileField ca"}
+      ${pkgs.lib.optionalString (content ? cert) "expandFileField cert"}
+
+      echo "$json" | cfssljson -bare ${content.name}
     '';
 
   noCSR = content: pkgs.lib.filterAttrs (n: v: n != "csr") content;
   noKey = content: pkgs.lib.filterAttrs (n: v: n != "key") content;
 
-  writeFile = content: pkgs.writeText "content" (
-    if pkgs.lib.isAttrs content then builtins.toJSON content
-    else toString content
-  );
+  writeFile = content:
+    if pkgs.lib.isDerivation content
+    then content
+    else pkgs.writeText "content" (builtins.toJSON content);
 
   createServingCertKey = { ca, cn, hosts? [], size ? 2048, name ? cn }:
     noCSR (