374e6bcc40
Format all Nix files using the officially approved formatter,
making the CI check introduced in the previous commit succeed:
nix-build ci -A fmt.check
This is the next step of the of the [implementation](https://github.com/NixOS/nixfmt/issues/153)
of the accepted [RFC 166](https://github.com/NixOS/rfcs/pull/166).
This commit will lead to merge conflicts for a number of PRs,
up to an estimated ~1100 (~33%) among the PRs with activity in the past 2
months, but that should be lower than what it would be without the previous
[partial treewide format](https://github.com/NixOS/nixpkgs/pull/322537).
Merge conflicts caused by this commit can now automatically be resolved while rebasing using the
[auto-rebase script](8616af08d9/maintainers/scripts/auto-rebase).
If you run into any problems regarding any of this, please reach out to the
[formatting team](https://nixos.org/community/teams/formatting/) by
pinging @NixOS/nix-formatting.
121 lines
3.2 KiB
Nix
121 lines
3.2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
options,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
with lib;
|
|
|
|
let
|
|
top = config.services.kubernetes;
|
|
otop = options.services.kubernetes;
|
|
cfg = top.proxy;
|
|
in
|
|
{
|
|
imports = [
|
|
(mkRenamedOptionModule
|
|
[ "services" "kubernetes" "proxy" "address" ]
|
|
[ "services" "kubernetes" "proxy" "bindAddress" ]
|
|
)
|
|
];
|
|
|
|
###### interface
|
|
options.services.kubernetes.proxy = with lib.types; {
|
|
|
|
bindAddress = mkOption {
|
|
description = "Kubernetes proxy listening address.";
|
|
default = "0.0.0.0";
|
|
type = str;
|
|
};
|
|
|
|
enable = mkEnableOption "Kubernetes proxy";
|
|
|
|
extraOpts = mkOption {
|
|
description = "Kubernetes proxy extra command line options.";
|
|
default = "";
|
|
type = separatedString " ";
|
|
};
|
|
|
|
featureGates = mkOption {
|
|
description = "Attribute set of feature gates.";
|
|
default = top.featureGates;
|
|
defaultText = literalExpression "config.${otop.featureGates}";
|
|
type = attrsOf bool;
|
|
};
|
|
|
|
hostname = mkOption {
|
|
description = "Kubernetes proxy hostname override.";
|
|
default = config.networking.hostName;
|
|
defaultText = literalExpression "config.networking.hostName";
|
|
type = str;
|
|
};
|
|
|
|
kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes proxy";
|
|
|
|
verbosity = mkOption {
|
|
description = ''
|
|
Optional glog verbosity level for logging statements. See
|
|
<https://github.com/kubernetes/community/blob/master/contributors/devel/logging.md>
|
|
'';
|
|
default = null;
|
|
type = nullOr int;
|
|
};
|
|
|
|
};
|
|
|
|
###### implementation
|
|
config = mkIf cfg.enable {
|
|
systemd.services.kube-proxy = {
|
|
description = "Kubernetes Proxy Service";
|
|
wantedBy = [ "kubernetes.target" ];
|
|
after = [ "kube-apiserver.service" ];
|
|
path = with pkgs; [
|
|
iptables
|
|
conntrack-tools
|
|
];
|
|
serviceConfig = {
|
|
Slice = "kubernetes.slice";
|
|
ExecStart = ''
|
|
${top.package}/bin/kube-proxy \
|
|
--bind-address=${cfg.bindAddress} \
|
|
${optionalString (top.clusterCidr != null) "--cluster-cidr=${top.clusterCidr}"} \
|
|
${
|
|
optionalString (cfg.featureGates != { })
|
|
"--feature-gates=${
|
|
concatStringsSep "," (
|
|
builtins.attrValues (mapAttrs (n: v: "${n}=${trivial.boolToString v}") cfg.featureGates)
|
|
)
|
|
}"
|
|
} \
|
|
--hostname-override=${cfg.hostname} \
|
|
--kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
|
|
${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
|
|
${cfg.extraOpts}
|
|
'';
|
|
WorkingDirectory = top.dataDir;
|
|
Restart = "on-failure";
|
|
RestartSec = 5;
|
|
};
|
|
unitConfig = {
|
|
StartLimitIntervalSec = 0;
|
|
};
|
|
};
|
|
|
|
services.kubernetes.proxy.hostname = with config.networking; mkDefault hostName;
|
|
|
|
services.kubernetes.pki.certs = {
|
|
kubeProxyClient = top.lib.mkCert {
|
|
name = "kube-proxy-client";
|
|
CN = "system:kube-proxy";
|
|
action = "systemctl restart kube-proxy.service";
|
|
};
|
|
};
|
|
|
|
services.kubernetes.proxy.kubeconfig.server = mkDefault top.apiserverAddress;
|
|
};
|
|
|
|
meta.buildDocsInSandbox = false;
|
|
}
|