Initial deployment of k3s

.sops.yaml

@@ -8,6 +8,13 @@ creation_rules:
     key_groups:
       - pgp:
           - *min
+  - path_regex: secrets/k3s-token\.txt$
+    key_groups:
+      - pgp:
+          - *min
+        age:
+          - *silver
+          - *eidola
   - path_regex: secrets/eidola\.yaml$
     key_groups:
       - pgp:

nixos/hosts/eidola/configuration.nix

@@ -9,6 +9,7 @@
     ./mounts.nix
     ./secrets.nix
     ./nebula.nix
+    ./k3s.nix
   ];
 
   networking.hostName = "eidola"; # Define your hostname.

nixos/hosts/eidola/k3s.nix

@@ -0,0 +1,13 @@
+{config, ...}: {
+  sops.secrets."k3s-token" = {
+    sopsFile = ../../../secrets/k3s-token.txt;
+    format = "binary";
+  };
+
+  services.k3s = {
+    enable = true;
+    role = "agent";
+    serverAddr = "https://silver.int.min.rip:6443";
+    tokenFile = config.sops.secrets."k3s-token".path;
+  };
+}

nixos/hosts/eidola/mounts.nix

@@ -10,6 +10,11 @@
       "/var/lib/systemd/coredump"
       "/var/lib/nixos"
       "/var/db/sudo"
+
+      "/var/lib/rancher/k3s"
+      "/var/lib/kubelet"
+      "/var/lib/cni"
+      "/var/lib/containerd"
     ];
     files = [
       "/etc/machine-id"

nixos/hosts/silver/mounts.nix

@@ -15,6 +15,11 @@
       "/var/lib/acme"
 
       "/srv"
+
+      "/var/lib/rancher/k3s"
+      "/var/lib/kubelet"
+      "/var/lib/cni"
+      "/var/lib/containerd"
     ];
     files = [
       "/etc/machine-id"

nixos/hosts/silver/services/default.nix

@@ -7,6 +7,7 @@
     ./gitea.nix
     ./synapse.nix
     ./nebula.nix
+    ./k3s.nix
   ];
 
   security.acme = {

nixos/hosts/silver/services/k3s.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  ...
+}: {
+  sops.secrets."k3s-token" = {
+    sopsFile = ../../../../secrets/k3s-token.txt;
+    format = "binary";
+  };
+
+  services.k3s = {
+    enable = true;
+    role = "server";
+    clusterInit = true;
+    tokenFile = config.sops.secrets."k3s-token".path;
+
+    extraFlags = lib.concatStringsSep " " [
+      "--disable=traefik"
+      "--disable=servicelb"
+      "--disable=local-storage"
+      "--disable=helm-controller"
+      "--tls-san=silver.int.min.rip"
+    ];
+  };
+}

nixos/hosts/silver/services/nebula.nix

@@ -55,6 +55,12 @@ in {
         proto = "tcp";
         host = "any";
       }
+      # Allow `kube-apiserver` from anyone
+      {
+        port = 6443;
+        proto = "tcp";
+        host = "any";
+      }
     ];
   };
 }

scripts/rekey.sh

@@ -9,4 +9,4 @@ rekey_dir() {
   find $1 | xargs -i sops updatekeys -y {}
 }
 
-rekey_dir "secrets/*.yaml"
+rekey_dir "secrets/*"

secrets/k3s-token.txt

@@ -0,0 +1,30 @@
+{
+	"data": "ENC[AES256_GCM,data:vXYcfWeyHiWcH+m80Jpz+YVEMUxAcmE9eyBzwxTqKb0PSaiAQgnx8WWD503hJuAl/E5i70I0c0zj1foqTILGxw==,iv:LAp+2f4k7IXCclEFLifiZmKZUxNWLPiVmPzp4MTkGK0=,tag:2YoMCI+TR1QBx3aibXug7Q==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19yhycdgqczrvttszq97ccljh684x3r7f5dj4p0wdwqsrusqlcayse0vsh3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSGNGY3I3eXl0RFFuRFNU\nMVVqTFowVzRsYUpqZlIrTFNKeFFFZGZnQ1FZCnl6VWxraENxeHJqOWZQMmpMTzZY\nVWdXTlg3OXBIMlUxMTRqb0FqbEdzWTAKLS0tIFBFTFRMQUhydEJpUjBGb0NPdytE\nMjlxenNDNzhXNkNoSWJJZjRKYSt4REkKQm9wMW0FDs9zY8XcC4XwmWq8vey2sjDF\nfPPVSJA9VJTj6Oec6u4A6aeNv9YjFbpnv3Q+Vy2YR1wjAgcjfu9qZQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1uqxzduupzes3tgfrrlret0n6thyldmlef60nqfzk689lmg6yayvsqpwxj6",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2TlJoYWU3V3N1QS9rMTVq\ncmZTeElGQWZYMEh2My9NaHFCT0hJdWN0S2gwCk91ZlMxckxhRUx6STRiNEVudlNP\nQTNRSEV6NXR1b1lUZk9RVjhBbW5WREkKLS0tIGVYRFZnK2x5MWx0WTdXanhCdTFr\nWVFTVWFYNnF1anZEOWtyT296cnA0b1EKY6KcgefJDOnyVbs3C5USwAfrA3vihfh7\nxxYdIFffyxq6N3+8k2VXg9FSeY6wAKdQuNg/08bNuz4O9tcaGSozug==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-11-04T02:46:42Z",
+		"mac": "ENC[AES256_GCM,data:DLeiPKDuOLmylGu7d9pkeIPcPgz92zJ8j5SfOJOkV6k9FogMMxqqoOtg9BmvkyVh0AMO7PGcK/RLd7e2xvjr6g1AUMf8qywYZL3XDxKGr5yZJNldTQOssThvbMAny/ubyNsULTL54adqBV6MikfUd3mRSAV4Quj+yZkKtAuBgOE=,iv:uM0F+bpSAz8p8d33pRtvZGSejTtrCOl4+WHNUAzpLBI=,tag:sTMQuwVV8Ds/Gw2VkOh0Pg==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2024-11-04T02:46:42Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwAAAAAAAAAAAQ/+LWksDzEz7A95gEXPailyDpngtQovg1dTKv9nMJMYo+hr\nnOS1iR0nITg5Ihantt9DEU18OzEEROZr4skAXoel/qP6GEstIHCA1BpzwTdn5QMC\nVCmOGgbjMFoXoCkgyPaUmclNnyZNldODALTmJ+vtY+7457kXCcnBXY4rd9lJNQ9I\n3l8jx9seQFSixA+8rhl5UnBQeGBCT1cMmNiLIr42tMLI9gQgKGbceTQ5AT5Exjks\nLy9IetYwq+VuyJDUnowgK1ZP92DrUVqalpWa2ZdVN3qSGSFEjUZjwKIkCObyu4Zr\nRU8T8VBi2pNAQuVRrpK1WC6TkoMC3QqoMimn8UAlYnpmuRvmJvksHbW3cqx5WxOx\nlWPI9JfyYhzXbzMxTdFUQ1TN6OT4OAPU5fQ59ivPJKqDxKKziauER1kXvwlaVkLR\n1l55HtzOwukJKXigNwxEHZPJzOnM8q+r//XDY4uEDAqogQGw7cFENEn9R/GZQ45c\nZnKBphx2va+6SweAa//w47DCdITLawb4VFOAeIf1m6dx5SY4aEIPefdz7bjwGqRC\nCdLsyrt6maQoJxz6odPOeuKwgoRIigH08FQrTR5VWEHH2bWouXsNfpl4FNRzSb/T\nm0bVKblFDiOcFVMk0roJBx8spm6PKTxBTVCyFh0EE9bS0eyJNp+LNzQ5mJHfgF/S\nXgHMw5JevU+7LUZkOZlzx1xfOSmKKLbPg+cts43wRQBTWgDdOZIgVigHwH0AdCJ0\niZdCA942v+urI20TKx1jbcnwofSndkzqSs4HGn4338ZyPzRGHrUMDzEfY8cx2Ro=\n=MKO9\n-----END PGP MESSAGE-----",
+				"fp": "78795D9EBD425CBB3E850BC45DF91852CB14CEFF"
+			}
+		],
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}