diff options
author | Jörg Thalheim <Mic92@users.noreply.github.com> | 2021-07-15 13:37:04 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-07-15 13:37:04 +0100 |
commit | f2b81f91beb90a78292ec5523c72116156490877 (patch) | |
tree | 8f90fa32b4aafa45399d73a559ee1de69168090e /nixos/modules/services/cluster/k3s/default.nix | |
parent | b04de31afc16b3ec5c56a0fdc7c36ee285331929 (diff) | |
parent | 11a38f62f0bfcb655e339498897b0d25ac37fa97 (diff) | |
download | nixpkgs-f2b81f91beb90a78292ec5523c72116156490877.tar nixpkgs-f2b81f91beb90a78292ec5523c72116156490877.tar.gz nixpkgs-f2b81f91beb90a78292ec5523c72116156490877.tar.bz2 nixpkgs-f2b81f91beb90a78292ec5523c72116156490877.tar.lz nixpkgs-f2b81f91beb90a78292ec5523c72116156490877.tar.xz nixpkgs-f2b81f91beb90a78292ec5523c72116156490877.tar.zst nixpkgs-f2b81f91beb90a78292ec5523c72116156490877.zip |
Merge pull request #125205 from Mic92/token-file
k3s: token file
Diffstat (limited to 'nixos/modules/services/cluster/k3s/default.nix')
-rw-r--r-- | nixos/modules/services/cluster/k3s/default.nix | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix index 300c182406c..d0fb8cc5098 100644 --- a/nixos/modules/services/cluster/k3s/default.nix +++ b/nixos/modules/services/cluster/k3s/default.nix @@ -35,10 +35,20 @@ in token = mkOption { type = types.str; - description = "The k3s token to use when connecting to the server. This option only makes sense for an agent."; + description = '' + The k3s token to use when connecting to the server. This option only makes sense for an agent. + WARNING: This option will expose store your token unencrypted world-readable in the nix store. + If this is undesired use the tokenFile option instead. + ''; default = ""; }; + tokenFile = mkOption { + type = types.nullOr types.path; + description = "File path containing k3s token to use when connecting to the server. This option only makes sense for an agent."; + default = null; + }; + docker = mkOption { type = types.bool; default = false; @@ -68,8 +78,8 @@ in message = "serverAddr should be set if role is 'agent'"; } { - assertion = cfg.role == "agent" -> cfg.token != ""; - message = "token should be set if role is 'agent'"; + assertion = cfg.role == "agent" -> cfg.token != "" || cfg.tokenFile != null; + message = "token or tokenFile should be set if role is 'agent'"; } ]; @@ -105,7 +115,12 @@ in "${cfg.package}/bin/k3s ${cfg.role}" ] ++ (optional cfg.docker "--docker") ++ (optional cfg.disableAgent "--disable-agent") - ++ (optional (cfg.role == "agent") "--server ${cfg.serverAddr} --token ${cfg.token}") + ++ (optional (cfg.role == "agent") "--server ${cfg.serverAddr} ${ + if cfg.tokenFile != null then + "--token-file ${cfg.tokenFile}" + else + "--token ${cfg.token}" + }") ++ [ cfg.extraFlags ] ); }; |