feat(k8s): add the k3s-test-1 worker nodes (#307)

Add worker-1 (4 vCPU / 16 GiB) on shoryu, and worker-2 (4 vCPU / 16 GiB) plus worker-3 (2 vCPU / 8 GiB) on shushou, as microVMs. They come with a genK3sAgentModule and the per-host/output/home-manager wiring, and are labelled node-role.kubernetes.io/worker=true. The masters keep their control-plane:NoSchedule taint, so workloads land on the workers.

lib/default.nix

@@ -7,6 +7,7 @@
   attrs = import ./attrs.nix { inherit lib; };
 
   genK3sServerModule = import ./genK3sServerModule.nix;
+  genK3sAgentModule = import ./genK3sAgentModule.nix;
   genVmHostModule = import ./genVmHostModule.nix;
   genMicrovmGuestModule = import ./genMicrovmGuestModule.nix;
 

lib/genK3sAgentModule.nix

@@ -0,0 +1,45 @@
+{
+  pkgs,
+  masterHost,
+  tokenFile,
+  nodeLabels ? [ ],
+  k3sExtraArgs ? [ ],
+  ...
+}:
+let
+  package = pkgs.k3s;
+in
+{
+  environment.systemPackages = [ package ];
+
+  # Kernel modules required by cilium
+  boot.kernelModules = [
+    "ip6_tables"
+    "ip6table_mangle"
+    "ip6table_raw"
+    "ip6table_filter"
+  ];
+  networking.enableIPv6 = true;
+  networking.nat = {
+    enable = true;
+    enableIPv6 = true;
+  };
+
+  services.k3s = {
+    enable = true;
+    inherit package tokenFile;
+
+    role = "agent";
+    serverAddr = "https://${masterHost}:6443";
+    # https://docs.k3s.io/cli/agent
+    extraFlags =
+      let
+        flagList = [
+          "--data-dir /var/lib/rancher/k3s"
+        ]
+        ++ (map (label: "--node-label=${label}") nodeLabels)
+        ++ k3sExtraArgs;
+      in
+      pkgs.lib.concatStringsSep " " flagList;
+  };
+}