fix
This commit is contained in:
parent
88431c9d5c
commit
dbb1183018
224
hosts/rke2.nix
224
hosts/rke2.nix
@ -10,6 +10,7 @@
|
|||||||
serverAddr = lib.mkOption {
|
serverAddr = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
description = "The server to join";
|
description = "The server to join";
|
||||||
|
default = "";
|
||||||
};
|
};
|
||||||
networkConfig = lib.mkOption {
|
networkConfig = lib.mkOption {
|
||||||
type = lib.types.submodule {
|
type = lib.types.submodule {
|
||||||
@ -41,142 +42,121 @@
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
# ----------------------------------------
|
config = {
|
||||||
# ---------- Base Configuration ----------
|
# ----------------------------------------
|
||||||
# ----------------------------------------
|
# ---------- Base Configuration ----------
|
||||||
|
# ----------------------------------------
|
||||||
|
|
||||||
# System Configuration
|
# OpenEBS Mayastor Requirements
|
||||||
system.stateVersion = "24.11";
|
boot.kernelModules = [ "nvme_tcp" ];
|
||||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
boot.kernel.sysctl = {
|
||||||
|
"vm.nr_hugepages" = 1024;
|
||||||
|
};
|
||||||
|
|
||||||
# Boot Configuration
|
# Network Configuration
|
||||||
boot.kernelModules = [ "nvme_tcp" ]; # OpenEBS Mayastor Requirement
|
networking = {
|
||||||
boot.kernel.sysctl = {
|
hostName = config.hostName;
|
||||||
"vm.nr_hugepages" = 1024;
|
networkmanager.enable = false;
|
||||||
};
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
|
||||||
|
|
||||||
# Network Configuration
|
# Interface Configuration
|
||||||
networking = {
|
inherit (config.networkConfig) defaultGateway nameservers;
|
||||||
hostName = config.hostName;
|
interfaces.${config.networkConfig.interface}.ipv4.addresses = [{
|
||||||
networkmanager.enable = false;
|
inherit (config.networkConfig) address;
|
||||||
|
prefixLength = 24;
|
||||||
|
}];
|
||||||
|
|
||||||
# Interface Configuration
|
firewall = {
|
||||||
inherit (config.networkConfig) defaultGateway nameservers;
|
enable = true;
|
||||||
interfaces.${config.networkConfig.interface}.ipv4.addresses = [{
|
|
||||||
inherit (config.networkConfig) address;
|
|
||||||
prefixLength = 24;
|
|
||||||
}];
|
|
||||||
|
|
||||||
firewall = {
|
allowedTCPPorts = [
|
||||||
|
# RKE2 Ports - https://docs.rke2.io/install/requirements#networking
|
||||||
|
6443 # Kubernetes API
|
||||||
|
9345 # RKE2 supervisor API
|
||||||
|
2379 # etcd Client Port
|
||||||
|
2380 # etcd Peer Port
|
||||||
|
2381 # etcd Metrics Port
|
||||||
|
10250 # kubelet metrics
|
||||||
|
9099 # Canal CNI health checks
|
||||||
|
|
||||||
|
# OpenEBS Mayastor - https://openebs.io/docs/user-guides/replicated-storage-user-guide/replicated-pv-mayastor/rs-installation#network-requirements
|
||||||
|
10124 # REST API
|
||||||
|
8420 # NVMf
|
||||||
|
4421 # NVMf
|
||||||
|
];
|
||||||
|
|
||||||
|
allowedUDPPorts = [
|
||||||
|
# RKE2 Ports - https://docs.rke2.io/install/requirements#networking
|
||||||
|
8472 # Canal CNI with VXLAN
|
||||||
|
# 51820 # Canal CNI with WireGuard IPv4 (if using encryption)
|
||||||
|
# 51821 # Canal CNI with WireGuard IPv6 (if using encryption)
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# System Packages
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
htop
|
||||||
|
k9s
|
||||||
|
kubectl
|
||||||
|
kubernetes-helm
|
||||||
|
nfs-utils
|
||||||
|
vim
|
||||||
|
];
|
||||||
|
|
||||||
|
# ----------------------------------------
|
||||||
|
# ---------- RKE2 Configuration ----------
|
||||||
|
# ----------------------------------------
|
||||||
|
|
||||||
|
# RKE2 Join Token
|
||||||
|
environment.etc."rancher/rke2/node-token" = lib.mkIf (config.serverAddr != "") {
|
||||||
|
source = ../rke2-token;
|
||||||
|
mode = "0600";
|
||||||
|
user = "root";
|
||||||
|
group = "root";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Enable RKE2
|
||||||
|
services.rke2 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
role = "server";
|
||||||
|
|
||||||
allowedTCPPorts = [
|
disable = [
|
||||||
# RKE2 Ports - https://docs.rke2.io/install/requirements#networking
|
# Disable - Utilizing Traefik
|
||||||
6443 # Kubernetes API
|
"rke2-ingress-nginx"
|
||||||
9345 # RKE2 supervisor API
|
|
||||||
2379 # etcd Client Port
|
|
||||||
2380 # etcd Peer Port
|
|
||||||
2381 # etcd Metrics Port
|
|
||||||
10250 # kubelet metrics
|
|
||||||
9099 # Canal CNI health checks
|
|
||||||
|
|
||||||
# OpenEBS Mayastor - https://openebs.io/docs/user-guides/replicated-storage-user-guide/replicated-pv-mayastor/rs-installation#network-requirements
|
# Distable - Utilizing OpenEBS's Snapshot Controller
|
||||||
10124 # REST API
|
"rke2-snapshot-controller"
|
||||||
8420 # NVMf
|
"rke2-snapshot-controller-crd"
|
||||||
4421 # NVMf
|
"rke2-snapshot-validation-webhook"
|
||||||
];
|
];
|
||||||
|
|
||||||
allowedUDPPorts = [
|
# OpenEBS Scheduleable
|
||||||
# RKE2 Ports - https://docs.rke2.io/install/requirements#networking
|
nodeLabel = [
|
||||||
8472 # Canal CNI with VXLAN
|
"openebs.io/engine=mayastor"
|
||||||
# 51820 # Canal CNI with WireGuard IPv4 (if using encryption)
|
|
||||||
# 51821 # Canal CNI with WireGuard IPv6 (if using encryption)
|
|
||||||
];
|
];
|
||||||
|
|
||||||
|
} // lib.optionalAttrs (config.serverAddr != "") {
|
||||||
|
serverAddr = config.serverAddr;
|
||||||
|
tokenFile = "/etc/rancher/rke2/node-token";
|
||||||
};
|
};
|
||||||
};
|
|
||||||
|
|
||||||
# User Configuration
|
# Bootstrap Kubernetes Manifests
|
||||||
users.users.root = {
|
# system.activationScripts.k8s-manifests = {
|
||||||
openssh.authorizedKeys.keys = [
|
# deps = [ ];
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA8P84lWL/p13ZBFNwITm/dLWWL8s9pVmdOImM5gaJAiTLY+DheUvG6YsveB2/5STseiJ34g7Na9TW1mtTLL8zDqPvj3NbprQiYlLJKMbCk6dtfdD4nLMHl8B48e1h699XiZDp2/c+jJb0MkLOFrps+FbPqt7pFt1Pj29tFy8BCg0LGndu6KO+HqYS+aM5tp5hZESo1RReiJ8aHsu5X7wW46brN4gfyyu+8X4etSZAB9raWqlln9NKK7G6as6X+uPypvSjYGSTC8TSePV1iTPwOxPk2+1xBsK7EBLg3jNrrYaiXLnZvBOOhm11JmHzqEJ6386FfQO+0r4iDVxmvi+ojw== rsa-key-20141114"
|
# text = ''
|
||||||
];
|
# mkdir -p /var/lib/rancher/rke2/server/manifests
|
||||||
hashedPassword = null; # Disable Password Login
|
|
||||||
};
|
|
||||||
|
|
||||||
# System Packages
|
# # Base Configs
|
||||||
environment.systemPackages = with pkgs; [
|
# cp ${../k8s/openebs.yaml} /var/lib/rancher/rke2/server/manifests/openebs-base.yaml
|
||||||
htop
|
# cp ${../k8s/kasten.yaml} /var/lib/rancher/rke2/server/manifests/kasten-base.yaml
|
||||||
k9s
|
|
||||||
kubectl
|
|
||||||
kubernetes-helm
|
|
||||||
nfs-utils
|
|
||||||
vim
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enable SSH Server
|
# # OpenEBS Disk Pool
|
||||||
services.openssh = {
|
# cp ${pkgs.substituteAll {
|
||||||
enable = true;
|
# src = ../k8s/openebs-disk-pool.yaml;
|
||||||
settings = {
|
# hostName = config.hostName;
|
||||||
PasswordAuthentication = false; # Disable Password Login
|
# dataDiskID = config.dataDiskID;
|
||||||
PermitRootLogin = "prohibit-password"; # Disable Password Login
|
# }} /var/lib/rancher/rke2/server/manifests/openebs-disk-pool-${config.hostName}.yaml
|
||||||
};
|
# '';
|
||||||
};
|
# };
|
||||||
|
|
||||||
# ----------------------------------------
|
|
||||||
# ---------- RKE2 Configuration ----------
|
|
||||||
# ----------------------------------------
|
|
||||||
|
|
||||||
# RKE2 Join Token
|
|
||||||
environment.etc."rancher/rke2/node-token" = lib.mkIf (config.serverAddr != "") {
|
|
||||||
source = ../rke2-token;
|
|
||||||
mode = "0600";
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
};
|
|
||||||
|
|
||||||
# Enable RKE2
|
|
||||||
services.rke2 = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
disable = [
|
|
||||||
# Disable - Utilizing Traefik
|
|
||||||
"rke2-ingress-nginx"
|
|
||||||
|
|
||||||
# Distable - Utilizing OpenEBS's Snapshot Controller
|
|
||||||
"rke2-snapshot-controller"
|
|
||||||
"rke2-snapshot-controller-crd"
|
|
||||||
"rke2-snapshot-validation-webhook"
|
|
||||||
];
|
|
||||||
|
|
||||||
# OpenEBS Scheduleable
|
|
||||||
nodeLabel = [
|
|
||||||
"openebs.io/engine=mayastor"
|
|
||||||
];
|
|
||||||
|
|
||||||
role = "server";
|
|
||||||
serverAddr = config.serverAddr;
|
|
||||||
tokenFile = lib.mkIf (config.serverAddr != "") "/etc/rancher/rke2/node-token";
|
|
||||||
};
|
|
||||||
|
|
||||||
# Bootstrap Kubernetes Manifests
|
|
||||||
system.activationScripts.k8s-manifests = {
|
|
||||||
deps = [ ];
|
|
||||||
text = ''
|
|
||||||
mkdir -p /var/lib/rancher/rke2/server/manifests
|
|
||||||
|
|
||||||
# Base Configs
|
|
||||||
cp ${../k8s/openebs.yaml} /var/lib/rancher/rke2/server/manifests/openebs-base.yaml
|
|
||||||
cp ${../k8s/kasten.yaml} /var/lib/rancher/rke2/server/manifests/kasten-base.yaml
|
|
||||||
|
|
||||||
# OpenEBS Disk Pool
|
|
||||||
cp ${pkgs.substituteAll {
|
|
||||||
src = ../k8s/openebs-disk-pool.yaml;
|
|
||||||
hostName = config.hostName;
|
|
||||||
dataDiskID = config.dataDiskID;
|
|
||||||
}} /var/lib/rancher/rke2/server/manifests/openebs-disk-pool-${config.hostName}.yaml
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user