diff --git a/content/software/k8s-on-nixos-part0.md b/content/software/k8s-on-nixos-part0.md index e3c1fe3..db4dd4b 100644 --- a/content/software/k8s-on-nixos-part0.md +++ b/content/software/k8s-on-nixos-part0.md @@ -1,5 +1,5 @@ --- -Title: K8s on NixOS - Chapter 0: Preface +Title: "K8s on NixOS - Chapter 0: Preface" Date: 2025-03-14 Modified: 2025-03-16 Category: software diff --git a/content/software/k8s-on-nixos-part1.md b/content/software/k8s-on-nixos-part1.md index a3d905f..c70595f 100644 --- a/content/software/k8s-on-nixos-part1.md +++ b/content/software/k8s-on-nixos-part1.md @@ -1,5 +1,5 @@ --- -Title: K8s on NixOS - Chapter 1: Getting the nodes ready +Title: "K8s on NixOS - Chapter 1: Getting the nodes ready" Date: 2025-03-17 Category: software Tags: nix, nixos, flakes, server, qemu, libvirt, ssh, make diff --git a/content/software/k8s-on-nixos-part2.md b/content/software/k8s-on-nixos-part2.md index b45a2bb..43ab4d6 100644 --- a/content/software/k8s-on-nixos-part2.md +++ b/content/software/k8s-on-nixos-part2.md @@ -1,5 +1,5 @@ --- -Title: K8s on NixOS - Chapter 2: Certificates (PKI) +Title: "K8s on NixOS - Chapter 2: Certificates (PKI)" Date: 2025-03-14 Category: software Tags: certificates, ca, pki @@ -25,12 +25,12 @@ services.etcd.extraConf = { ## Intermediate CAs -In a production scenario you would probably create intermediate CAs. It can be a good idea to do that, so you can keep +In a production scenario you would maybe create intermediate CAs. It can be a good idea to do that, so you can keep your root CA safe and secure in an offline location and use your intermediate for operational tasks. Maybe you have a -bigger PKI infrastructure with more use cases. In the case of a etcd and k8s setup it makes little sense to do that. The -security gain is minimal at best. +bigger PKI infrastructure with more use cases. In the case of an etcd and k8s setup it makes little sense to do that. +The security gain is minimal at best, so the operational overhead doesn't remedy the security benefits. -So if you want, you can create intermediate CAs, but I will skip this step. If you do you have to adapt the +So if you want, you can create intermediate CAs, but I will skip this step. If you do, you have to adapt the `ca_constraints` to have a `max_path_len=1` for the root CAs and `max_path_len=0` for the intermediate CAs. Make sure to also set `pathlenzero=true` for the intermediate CAs. @@ -125,7 +125,7 @@ It configures profiles for all types of certificates we're gonna need. - Server - Client & Server -We will use eliptic curve for all of our certificates. I don't know if they're better then RSA. I just think they are +We will use eliptic curves for all of our certificates. I don't know if they're better then RSA. I just guess they are and I like that the file size is smaller. Ask a cryptography expert what you should use if you want a proper recommendation. @@ -175,7 +175,7 @@ will create the file `./pki/k8s-root/k8s-root-csr.json` with this content: { "C": "DE", "L": "Berlin", - "O": "wired", + "O": "my-cluster", "OU": "k8s", "ST": "Berlin" } @@ -207,7 +207,7 @@ Peer to peer communication need a certificate which has the key usages client an { "C": "DE", "L": "Berlin", - "O": "wired", + "O": "my-cluster", "OU": "etcd", "ST": "Berlin" } @@ -217,7 +217,7 @@ Peer to peer communication need a certificate which has the key usages client an "::1", "127.0.0.1", "node-01", - "2a00:1328:e101:1301::1" + "2001:db8:0:a::1" ] } ``` diff --git a/content/software/k8s-on-nixos-part3.md b/content/software/k8s-on-nixos-part3.md index 3bbc867..3963d1e 100644 --- a/content/software/k8s-on-nixos-part3.md +++ b/content/software/k8s-on-nixos-part3.md @@ -1,5 +1,5 @@ --- -Title: K8s on NixOS - Chapter 3: Etcd +Title: "K8s on NixOS - Chapter 3: Etcd" Date: 2025-03-14 Category: software Tags: etcd @@ -11,7 +11,7 @@ Status: Draft # Building the etcd cluster Make sure to disable IPv6 temporary addresses in your setup. We already did this by setting `networking.tempAddresses = -"disabled";` in out `common.nix` file. If not set, etcd will use temporary addresses to connect to it's peers and +"disabled";` in our `common.nix` file. If not set, etcd will use temporary addresses to connect to it's peers and connections will be rejected, because only the manually set IP addresses are configured to be trusted peers. - https://etcd.io/docs/v3.5/op-guide/security/ @@ -21,7 +21,7 @@ connections will be rejected, because only the manually set IP addresses are con { config, ip6Address, clusterNodes, ... }: { services.etcd = { - # opened manually for the 2a00:1328:e101:1301::/64 network + # opened manually for the 2001:db8:0:a::/64 network openFirewall = false; # Name of the cluster; must be unique to identify this cluster initialClusterToken = "k8s-etcd-cluster"; @@ -32,19 +32,19 @@ connections will be rejected, because only the manually set IP addresses are con initialCluster = map (node: "${node.hostName}=https://[${node.ip6Address}]:2380") clusterNodes; clientCertAuth = true; # Certificate authority file to use for clients - trustedCaFile = config.age.secrets.k8s-root-crt.path; + trustedCaFile = config.age.secrets.etcd-root-crt.path; # Cert file to use for clients - certFile = config.age.secrets.k8s-etcd-peer-crt.path; + certFile = config.age.secrets.etcd-peer-crt.path; # Key file to use for clients - keyFile = config.age.secrets.k8s-etcd-peer-key.path; + keyFile = config.age.secrets.etcd-peer-key.path; peerClientCertAuth = true; # Certificate authority file to use for peer to peer communication - peerTrustedCaFile = config.age.secrets.k8s-root-crt.path; + peerTrustedCaFile = config.age.secrets.etcd-root-crt.path; # Cert file to use for peer to peer communication - peerCertFile = config.age.secrets.k8s-etcd-peer-crt.path; + peerCertFile = config.age.secrets.etcd-peer-crt.path; # Key file to use for peer to peer communication - peerKeyFile = config.age.secrets.k8s-etcd-peer-key.path; + peerKeyFile = config.age.secrets.etcd-peer-key.path; extraConf = { "ETCD_AUTO_COMPACTION_RETENTION" = "1h"; # clean up old revisions after 1h @@ -54,7 +54,7 @@ connections will be rejected, because only the manually set IP addresses are con networking.firewall.extraInputRules = '' # 2379/tcp etcd client requests # 2380/tcp etcd peer communication - ip6 saddr 2a00:1328:e101:1301::/64 tcp dport { 2379, 2380 } accept comment "etcd" + ip6 saddr 2001:db8:0:a::/64 tcp dport { 2379, 2380 } accept comment "etcd" ''; } ```