update IPs

content/software/k8s-on-nixos-part0.md

@@ -1,5 +1,5 @@
 ---
-Title: K8s on NixOS - Chapter 0: Preface
+Title: "K8s on NixOS - Chapter 0: Preface"
 Date: 2025-03-14
 Modified: 2025-03-16
 Category: software

content/software/k8s-on-nixos-part1.md

@@ -1,5 +1,5 @@
 ---
-Title: K8s on NixOS - Chapter 1: Getting the nodes ready
+Title: "K8s on NixOS - Chapter 1: Getting the nodes ready"
 Date: 2025-03-17
 Category: software
 Tags: nix, nixos, flakes, server, qemu, libvirt, ssh, make

content/software/k8s-on-nixos-part2.md

@@ -1,5 +1,5 @@
 ---
-Title: K8s on NixOS - Chapter 2: Certificates (PKI)
+Title: "K8s on NixOS - Chapter 2: Certificates (PKI)"
 Date: 2025-03-14
 Category: software
 Tags: certificates, ca, pki
@@ -25,12 +25,12 @@ services.etcd.extraConf = {
 
 ## Intermediate CAs
 
-In a production scenario you would probably create intermediate CAs. It can be a good idea to do that, so you can keep
+In a production scenario you would maybe create intermediate CAs. It can be a good idea to do that, so you can keep
 your root CA safe and secure in an offline location and use your intermediate for operational tasks. Maybe you have a
-bigger PKI infrastructure with more use cases. In the case of a etcd and k8s setup it makes little sense to do that. The
-security gain is minimal at best.
+bigger PKI infrastructure with more use cases. In the case of an etcd and k8s setup it makes little sense to do that.
+The security gain is minimal at best, so the operational overhead doesn't remedy the security benefits.
 
-So if you want, you can create intermediate CAs, but I will skip this step. If you do you have to adapt the
+So if you want, you can create intermediate CAs, but I will skip this step. If you do, you have to adapt the
 `ca_constraints` to have a `max_path_len=1` for the root CAs and  `max_path_len=0` for the intermediate CAs. Make sure
 to also set `pathlenzero=true` for the intermediate CAs.
 
@@ -125,7 +125,7 @@ It configures profiles for all types of certificates we're gonna need.
 - Server
 - Client & Server
 
-We will use eliptic curve for all of our certificates. I don't know if they're better then RSA. I just think they are
+We will use eliptic curves for all of our certificates. I don't know if they're better then RSA. I just guess they are
 and I like that the file size is smaller. Ask a cryptography expert what you should use if you want a proper
 recommendation.
 
@@ -175,7 +175,7 @@ will create the file `./pki/k8s-root/k8s-root-csr.json` with this content:
     {
       "C": "DE",
       "L": "Berlin",
-      "O": "wired",
+      "O": "my-cluster",
       "OU": "k8s",
       "ST": "Berlin"
     }
@@ -207,7 +207,7 @@ Peer to peer communication need a certificate which has the key usages client an
     {
       "C": "DE",
       "L": "Berlin",
-      "O": "wired",
+      "O": "my-cluster",
       "OU": "etcd",
       "ST": "Berlin"
     }
@@ -217,7 +217,7 @@ Peer to peer communication need a certificate which has the key usages client an
     "::1",
     "127.0.0.1",
     "node-01",
-    "2a00:1328:e101:1301::1"
+    "2001:db8:0:a::1"
   ]
 }
 ```

content/software/k8s-on-nixos-part3.md

@@ -1,5 +1,5 @@
 ---
-Title: K8s on NixOS - Chapter 3: Etcd
+Title: "K8s on NixOS - Chapter 3: Etcd"
 Date: 2025-03-14
 Category: software
 Tags: etcd
@@ -11,7 +11,7 @@ Status: Draft
 # Building the etcd cluster
 
 Make sure to disable IPv6 temporary addresses in your setup. We already did this by setting `networking.tempAddresses =
-"disabled";` in out `common.nix` file. If not set, etcd will use temporary addresses to connect to it's peers and
+"disabled";` in our `common.nix` file. If not set, etcd will use temporary addresses to connect to it's peers and
 connections will be rejected, because only the manually set IP addresses are configured to be trusted peers.
 
 - https://etcd.io/docs/v3.5/op-guide/security/
@@ -21,7 +21,7 @@ connections will be rejected, because only the manually set IP addresses are con
 { config, ip6Address, clusterNodes, ... }:
 {
   services.etcd = {
-    # opened manually for the 2a00:1328:e101:1301::/64 network
+    # opened manually for the 2001:db8:0:a::/64 network
     openFirewall = false;
     # Name of the cluster; must be unique to identify this cluster
     initialClusterToken = "k8s-etcd-cluster";
@@ -32,19 +32,19 @@ connections will be rejected, because only the manually set IP addresses are con
     initialCluster = map (node: "${node.hostName}=https://[${node.ip6Address}]:2380") clusterNodes;
     clientCertAuth = true;
     # Certificate authority file to use for clients
-    trustedCaFile = config.age.secrets.k8s-root-crt.path;
+    trustedCaFile = config.age.secrets.etcd-root-crt.path;
     # Cert file to use for clients
-    certFile = config.age.secrets.k8s-etcd-peer-crt.path;
+    certFile = config.age.secrets.etcd-peer-crt.path;
     # Key file to use for clients
-    keyFile = config.age.secrets.k8s-etcd-peer-key.path;
+    keyFile = config.age.secrets.etcd-peer-key.path;
 
     peerClientCertAuth = true;
     # Certificate authority file to use for peer to peer communication
-    peerTrustedCaFile = config.age.secrets.k8s-root-crt.path;
+    peerTrustedCaFile = config.age.secrets.etcd-root-crt.path;
     # Cert file to use for peer to peer communication
-    peerCertFile = config.age.secrets.k8s-etcd-peer-crt.path;
+    peerCertFile = config.age.secrets.etcd-peer-crt.path;
     # Key file to use for peer to peer communication
-    peerKeyFile = config.age.secrets.k8s-etcd-peer-key.path;
+    peerKeyFile = config.age.secrets.etcd-peer-key.path;
 
     extraConf = {
       "ETCD_AUTO_COMPACTION_RETENTION" = "1h"; # clean up old revisions after 1h
@@ -54,7 +54,7 @@ connections will be rejected, because only the manually set IP addresses are con
   networking.firewall.extraInputRules = ''
     # 2379/tcp etcd client requests
     # 2380/tcp etcd peer communication
-    ip6 saddr 2a00:1328:e101:1301::/64 tcp dport { 2379, 2380 } accept comment "etcd"
+    ip6 saddr 2001:db8:0:a::/64 tcp dport { 2379, 2380 } accept comment "etcd"
   '';
 }
 ```