diff options
author | Jörg Thalheim <joerg@thalheim.io> | 2021-04-09 11:50:03 +0200 |
---|---|---|
committer | Jörg Thalheim <joerg@thalheim.io> | 2021-06-01 13:35:04 +0200 |
commit | 11a38f62f0bfcb655e339498897b0d25ac37fa97 (patch) | |
tree | 517370b3fbf3c34e8f39f1e8fc8dfe25768a32c8 /nixos/modules/services/cluster | |
parent | 852739337bd5ab4c57fd1eab9e62e76ac2f1a7cc (diff) | |
download | nixpkgs-11a38f62f0bfcb655e339498897b0d25ac37fa97.tar nixpkgs-11a38f62f0bfcb655e339498897b0d25ac37fa97.tar.gz nixpkgs-11a38f62f0bfcb655e339498897b0d25ac37fa97.tar.bz2 nixpkgs-11a38f62f0bfcb655e339498897b0d25ac37fa97.tar.lz nixpkgs-11a38f62f0bfcb655e339498897b0d25ac37fa97.tar.xz nixpkgs-11a38f62f0bfcb655e339498897b0d25ac37fa97.tar.zst nixpkgs-11a38f62f0bfcb655e339498897b0d25ac37fa97.zip |
k3s: add tokenFile option
To avoid having secrets in the nix store.
Diffstat (limited to 'nixos/modules/services/cluster')
-rw-r--r-- | nixos/modules/services/cluster/k3s/default.nix | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix index b5506057db8..99e47e867b3 100644 --- a/nixos/modules/services/cluster/k3s/default.nix +++ b/nixos/modules/services/cluster/k3s/default.nix @@ -35,10 +35,20 @@ in token = mkOption { type = types.str; - description = "The k3s token to use when connecting to the server. This option only makes sense for an agent."; + description = '' + The k3s token to use when connecting to the server. This option only makes sense for an agent. + WARNING: This option will expose store your token unencrypted world-readable in the nix store. + If this is undesired use the tokenFile option instead. + ''; default = ""; }; + tokenFile = mkOption { + type = types.nullOr types.path; + description = "File path containing k3s token to use when connecting to the server. This option only makes sense for an agent."; + default = null; + }; + docker = mkOption { type = types.bool; default = false; @@ -68,8 +78,8 @@ in message = "serverAddr should be set if role is 'agent'"; } { - assertion = cfg.role == "agent" -> cfg.token != ""; - message = "token should be set if role is 'agent'"; + assertion = cfg.role == "agent" -> cfg.token != "" || cfg.tokenFile != null; + message = "token or tokenFile should be set if role is 'agent'"; } ]; @@ -104,7 +114,12 @@ in "${cfg.package}/bin/k3s ${cfg.role}" ] ++ (optional cfg.docker "--docker") ++ (optional cfg.disableAgent "--disable-agent") - ++ (optional (cfg.role == "agent") "--server ${cfg.serverAddr} --token ${cfg.token}") + ++ (optional (cfg.role == "agent") "--server ${cfg.serverAddr} ${ + if cfg.tokenFile != null then + "--token-file ${cfg.tokenFile}" + else + "--token ${cfg.token}" + }") ++ [ cfg.extraFlags ] ); }; |