mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
Merge pull request #291 from ryan4yin/chore/retire-host-k3s
chore(hosts): retire the k3s cluster on the physical hosts
This commit is contained in:
6 files changed
+23
-328
No files matched your search
+12
-212
@@ -11,224 +11,24 @@ core*
|
||||
!core.nix
|
||||
!coredns*
|
||||
|
||||
# =============== Python.gitignore ===========================
|
||||
# =============== Python ===========================
|
||||
|
||||
# Byte-compiled / optimized / DLL files
|
||||
# Byte-compiled / optimized files
|
||||
__pycache__/
|
||||
*.py[codz]
|
||||
*.py[cod]
|
||||
*$py.class
|
||||
|
||||
# C extensions
|
||||
*.so
|
||||
|
||||
# Distribution / packaging
|
||||
.Python
|
||||
build/
|
||||
develop-eggs/
|
||||
dist/
|
||||
downloads/
|
||||
eggs/
|
||||
.eggs/
|
||||
lib/
|
||||
lib64/
|
||||
parts/
|
||||
sdist/
|
||||
var/
|
||||
wheels/
|
||||
share/python-wheels/
|
||||
*.egg-info/
|
||||
.installed.cfg
|
||||
*.egg
|
||||
MANIFEST
|
||||
|
||||
# PyInstaller
|
||||
# Usually these files are written by a python script from a template
|
||||
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
||||
*.manifest
|
||||
*.spec
|
||||
|
||||
# Installer logs
|
||||
pip-log.txt
|
||||
pip-delete-this-directory.txt
|
||||
|
||||
# Unit test / coverage reports
|
||||
htmlcov/
|
||||
.tox/
|
||||
.nox/
|
||||
.coverage
|
||||
.coverage.*
|
||||
.cache
|
||||
nosetests.xml
|
||||
coverage.xml
|
||||
*.cover
|
||||
*.py.cover
|
||||
.hypothesis/
|
||||
.pytest_cache/
|
||||
cover/
|
||||
|
||||
# Translations
|
||||
*.mo
|
||||
*.pot
|
||||
|
||||
# Django stuff:
|
||||
*.log
|
||||
local_settings.py
|
||||
db.sqlite3
|
||||
db.sqlite3-journal
|
||||
|
||||
# Flask stuff:
|
||||
instance/
|
||||
.webassets-cache
|
||||
|
||||
# Scrapy stuff:
|
||||
.scrapy
|
||||
|
||||
# Sphinx documentation
|
||||
docs/_build/
|
||||
|
||||
# PyBuilder
|
||||
.pybuilder/
|
||||
target/
|
||||
|
||||
# Jupyter Notebook
|
||||
.ipynb_checkpoints
|
||||
|
||||
# IPython
|
||||
profile_default/
|
||||
ipython_config.py
|
||||
|
||||
# pyenv
|
||||
# For a library or package, you might want to ignore these files since the code is
|
||||
# intended to run in multiple environments; otherwise, check them in:
|
||||
# .python-version
|
||||
|
||||
# pipenv
|
||||
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
|
||||
# However, in case of collaboration, if having platform-specific dependencies or dependencies
|
||||
# having no cross-platform support, pipenv may install dependencies that don't work, or not
|
||||
# install all needed dependencies.
|
||||
# Pipfile.lock
|
||||
|
||||
# UV
|
||||
# Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
|
||||
# This is especially recommended for binary packages to ensure reproducibility, and is more
|
||||
# commonly ignored for libraries.
|
||||
# uv.lock
|
||||
|
||||
# poetry
|
||||
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
|
||||
# This is especially recommended for binary packages to ensure reproducibility, and is more
|
||||
# commonly ignored for libraries.
|
||||
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
|
||||
# poetry.lock
|
||||
# poetry.toml
|
||||
|
||||
# pdm
|
||||
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
|
||||
# pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
|
||||
# https://pdm-project.org/en/latest/usage/project/#working-with-version-control
|
||||
# pdm.lock
|
||||
# pdm.toml
|
||||
.pdm-python
|
||||
.pdm-build/
|
||||
|
||||
# pixi
|
||||
# Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
|
||||
# pixi.lock
|
||||
# Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
|
||||
# in the .venv directory. It is recommended not to include this directory in version control.
|
||||
.pixi
|
||||
|
||||
# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
|
||||
__pypackages__/
|
||||
|
||||
# Celery stuff
|
||||
celerybeat-schedule
|
||||
celerybeat.pid
|
||||
|
||||
# Redis
|
||||
*.rdb
|
||||
*.aof
|
||||
*.pid
|
||||
|
||||
# RabbitMQ
|
||||
mnesia/
|
||||
rabbitmq/
|
||||
rabbitmq-data/
|
||||
|
||||
# ActiveMQ
|
||||
activemq-data/
|
||||
|
||||
# SageMath parsed files
|
||||
*.sage.py
|
||||
|
||||
# Environments
|
||||
.env
|
||||
.envrc
|
||||
.venv
|
||||
env/
|
||||
# virtualenvs
|
||||
.venv/
|
||||
venv/
|
||||
ENV/
|
||||
env.bak/
|
||||
venv.bak/
|
||||
env/
|
||||
|
||||
# Spyder project settings
|
||||
.spyderproject
|
||||
.spyproject
|
||||
# local secrets
|
||||
.env
|
||||
|
||||
# Rope project settings
|
||||
.ropeproject
|
||||
|
||||
# mkdocs documentation
|
||||
/site
|
||||
|
||||
# mypy
|
||||
# tooling caches
|
||||
.pytest_cache/
|
||||
.mypy_cache/
|
||||
.dmypy.json
|
||||
dmypy.json
|
||||
|
||||
# Pyre type checker
|
||||
.pyre/
|
||||
|
||||
# pytype static type analyzer
|
||||
.pytype/
|
||||
|
||||
# Cython debug symbols
|
||||
cython_debug/
|
||||
|
||||
# PyCharm
|
||||
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
|
||||
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
|
||||
# and can be added to the global gitignore or merged into this file. For a more nuclear
|
||||
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
|
||||
# .idea/
|
||||
|
||||
# Abstra
|
||||
# Abstra is an AI-powered process automation framework.
|
||||
# Ignore directories containing user credentials, local state, and settings.
|
||||
# Learn more at https://abstra.io/docs
|
||||
.abstra/
|
||||
|
||||
# Visual Studio Code
|
||||
# Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
|
||||
# that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
|
||||
# and can be added to the global gitignore or merged into this file. However, if you prefer,
|
||||
# you could uncomment the following to ignore the entire vscode folder
|
||||
# .vscode/
|
||||
|
||||
# Ruff stuff:
|
||||
.ruff_cache/
|
||||
|
||||
# PyPI configuration file
|
||||
.pypirc
|
||||
|
||||
# Marimo
|
||||
marimo/_static/
|
||||
marimo/_lsp/
|
||||
__marimo__/
|
||||
|
||||
# Streamlit
|
||||
.streamlit/secrets.toml
|
||||
|
||||
# the library modules under lib/ must stay tracked
|
||||
!lib/*.nix
|
||||
.coverage
|
||||
htmlcov/
|
||||
@@ -10,39 +10,10 @@ let
|
||||
# MoreFine - S500Plus
|
||||
hostName = "kubevirt-shoryu"; # Define your hostname.
|
||||
|
||||
coreModule = mylib.genKubeVirtHostModule {
|
||||
coreModule = mylib.genVmHostModule {
|
||||
inherit pkgs hostName;
|
||||
inherit (myvars) networking;
|
||||
};
|
||||
k3sModule = mylib.genK3sServerModule {
|
||||
inherit pkgs;
|
||||
kubeconfigFile = "/home/${myvars.username}/.kube/config";
|
||||
tokenFile = "/persistent/kubevirt-k3s-token";
|
||||
# the first node in the cluster should be the one to initialize the cluster
|
||||
clusterInit = true;
|
||||
# use my own domain & kube-vip's virtual IP for the API server
|
||||
# so that the API server can always be accessed even if some nodes are down
|
||||
masterHost = "kubevirt-cluster-1.writefor.fun";
|
||||
kubeletExtraArgs = [
|
||||
"--cpu-manager-policy=static"
|
||||
# https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/
|
||||
# we have to reserve some resources for for system daemons running as pods or system services
|
||||
# when cpu-manager's static policy is enabled
|
||||
# the memory we reserved here is also for the kernel, since kernel's memory is not accounted in pods
|
||||
"--system-reserved=cpu=1,memory=2Gi,ephemeral-storage=2Gi"
|
||||
];
|
||||
k3sExtraArgs = [
|
||||
# IPv4 Private CIDR(full) - 172.16.0.0/12
|
||||
# IPv4 Pod CIDR(full) - fdfd:cafe:00:0000::/64 ~ fdfd:cafe:00:7fff::/64
|
||||
# IPv4 Service CIDR(full) - fdfd:cafe:00:8000::/64 ~ fdfd:cafe:00:ffff::/64
|
||||
# "--cluster-cidr=172.16.0.0/16,fdfd:cafe:00:0001::/64"
|
||||
# "--service-cidr=172.17.0.0/16,fdfd:cafe:00:8001::/112"
|
||||
];
|
||||
nodeLabels = [
|
||||
"node-purpose=kubevirt"
|
||||
];
|
||||
# flannel is disabled; Cilium provides the pod network.
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = (mylib.scanPaths ./.) ++ [
|
||||
@@ -51,7 +22,6 @@ in
|
||||
./hardware-configuration.nix
|
||||
./preservation.nix
|
||||
coreModule
|
||||
k3sModule
|
||||
];
|
||||
|
||||
modules.btrbk.enable = true;
|
||||
|
||||
@@ -9,37 +9,10 @@
|
||||
let
|
||||
hostName = "kubevirt-shushou"; # Define your hostname.
|
||||
|
||||
coreModule = mylib.genKubeVirtHostModule {
|
||||
coreModule = mylib.genVmHostModule {
|
||||
inherit pkgs hostName;
|
||||
inherit (myvars) networking;
|
||||
};
|
||||
k3sModule = mylib.genK3sServerModule {
|
||||
inherit pkgs;
|
||||
kubeconfigFile = "/home/${myvars.username}/.kube/config";
|
||||
tokenFile = "/persistent/kubevirt-k3s-token";
|
||||
# use my own domain & kube-vip's virtual IP for the API server
|
||||
# so that the API server can always be accessed even if some nodes are down
|
||||
masterHost = "kubevirt-cluster-1.writefor.fun";
|
||||
kubeletExtraArgs = [
|
||||
"--cpu-manager-policy=static"
|
||||
# https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/
|
||||
# we have to reserve some resources for for system daemons running as pods or system services
|
||||
# when cpu-manager's static policy is enabled
|
||||
# the memory we reserved here is also for the kernel, since kernel's memory is not accounted in pods
|
||||
"--system-reserved=cpu=1,memory=2Gi,ephemeral-storage=2Gi"
|
||||
];
|
||||
k3sExtraArgs = [
|
||||
# IPv4 Private CIDR(full) - 172.16.0.0/12
|
||||
# IPv4 Pod CIDR(full) - fdfd:cafe:00:0000::/64 ~ fdfd:cafe:00:7fff::/64
|
||||
# IPv4 Service CIDR(full) - fdfd:cafe:00:8000::/64 ~ fdfd:cafe:00:ffff::/64
|
||||
# "--cluster-cidr=172.16.0.0/16,fdfd:cafe:00:0001::/64"
|
||||
# "--service-cidr=172.17.0.0/16,fdfd:cafe:00:8001::/112"
|
||||
];
|
||||
nodeLabels = [
|
||||
"node-purpose=kubevirt"
|
||||
];
|
||||
# flannel is disabled; Cilium provides the pod network.
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = (mylib.scanPaths ./.) ++ [
|
||||
@@ -48,7 +21,6 @@ in
|
||||
../kubevirt-shoryu/hardware-configuration.nix
|
||||
../kubevirt-shoryu/preservation.nix
|
||||
coreModule
|
||||
k3sModule
|
||||
];
|
||||
|
||||
modules.btrbk.enable = true;
|
||||
|
||||
@@ -9,37 +9,10 @@
|
||||
let
|
||||
hostName = "kubevirt-youko"; # Define your hostname.
|
||||
|
||||
coreModule = mylib.genKubeVirtHostModule {
|
||||
coreModule = mylib.genVmHostModule {
|
||||
inherit pkgs hostName;
|
||||
inherit (myvars) networking;
|
||||
};
|
||||
k3sModule = mylib.genK3sServerModule {
|
||||
inherit pkgs;
|
||||
kubeconfigFile = "/home/${myvars.username}/.kube/config";
|
||||
tokenFile = "/persistent/kubevirt-k3s-token";
|
||||
# use my own domain & kube-vip's virtual IP for the API server
|
||||
# so that the API server can always be accessed even if some nodes are down
|
||||
masterHost = "kubevirt-cluster-1.writefor.fun";
|
||||
kubeletExtraArgs = [
|
||||
"--cpu-manager-policy=static"
|
||||
# https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/
|
||||
# we have to reserve some resources for for system daemons running as pods or system services
|
||||
# when cpu-manager's static policy is enabled
|
||||
# the memory we reserved here is also for the kernel, since kernel's memory is not accounted in pods
|
||||
"--system-reserved=cpu=1,memory=2Gi,ephemeral-storage=2Gi"
|
||||
];
|
||||
k3sExtraArgs = [
|
||||
# IPv4 Private CIDR(full) - 172.16.0.0/12
|
||||
# IPv4 Pod CIDR(full) - fdfd:cafe:00:0000::/64 ~ fdfd:cafe:00:7fff::/64
|
||||
# IPv4 Service CIDR(full) - fdfd:cafe:00:8000::/64 ~ fdfd:cafe:00:ffff::/64
|
||||
# "--cluster-cidr=172.16.0.0/16,fdfd:cafe:00:0001::/64"
|
||||
# "--service-cidr=172.17.0.0/16,fdfd:cafe:00:8001::/112"
|
||||
];
|
||||
nodeLabels = [
|
||||
"node-purpose=kubevirt"
|
||||
];
|
||||
# flannel is disabled; Cilium provides the pod network.
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = (mylib.scanPaths ./.) ++ [
|
||||
@@ -48,7 +21,6 @@ in
|
||||
../kubevirt-shoryu/hardware-configuration.nix
|
||||
../kubevirt-shoryu/preservation.nix
|
||||
coreModule
|
||||
k3sModule
|
||||
];
|
||||
|
||||
modules.btrbk.enable = true;
|
||||
|
||||
+1
-1
@@ -8,7 +8,7 @@
|
||||
|
||||
genK3sServerModule = import ./genK3sServerModule.nix;
|
||||
genK3sAgentModule = import ./genK3sAgentModule.nix;
|
||||
genKubeVirtHostModule = import ./genKubeVirtHostModule.nix;
|
||||
genVmHostModule = import ./genVmHostModule.nix;
|
||||
genKubeVirtGuestModule = import ./genKubeVirtGuestModule.nix;
|
||||
genMicrovmGuestModule = import ./genMicrovmGuestModule.nix;
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (networking) proxyGateway proxyGateway6 nameservers;
|
||||
inherit (networking) proxyGateway proxyGateway6;
|
||||
inherit (networking.hostsAddr.${hostName}) iface ipv4;
|
||||
ipv4WithMask = "${ipv4}/24";
|
||||
in
|
||||
@@ -20,13 +20,11 @@ in
|
||||
"fat"
|
||||
"vfat"
|
||||
"exfat"
|
||||
"nfs" # required by longhorn
|
||||
"nfs"
|
||||
];
|
||||
|
||||
boot.kernelModules = [
|
||||
"kvm-amd"
|
||||
"vfio-pci"
|
||||
];
|
||||
# KVM for the microVMs and the libvirt domains.
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModprobeConfig = "options kvm_amd nested=1"; # for amd cpu
|
||||
|
||||
boot.kernel.sysctl = {
|
||||
@@ -52,33 +50,18 @@ in
|
||||
|
||||
# NOTE: vm.swappiness is intentionally NOT set here; it comes from
|
||||
# modules/nixos/base/zram.nix (mkDefault 180, tuned for the zram device).
|
||||
# The previous hard-coded 0 disabled swapping entirely, so the zram device
|
||||
# (already enabled by that module) was never used.
|
||||
};
|
||||
|
||||
# zram itself is provided by modules/nixos/base/zram.nix (enabled by default).
|
||||
# Kill the greediest process before the host starts thrashing / gets OOM-killed.
|
||||
# (defaults: trigger at 10% free mem / swap, kill hard at half of that.)
|
||||
services.earlyoom.enable = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Validate Hardware Virtualization Support via:
|
||||
# virt-host-validate qemu
|
||||
libvirt
|
||||
kubevirt # virtctl
|
||||
];
|
||||
|
||||
# Workaround for longhorn running on NixOS
|
||||
# https://github.com/longhorn/longhorn/issues/2166
|
||||
systemd.tmpfiles.rules = [
|
||||
"L+ /usr/local/bin - - - - /run/current-system/sw/bin/"
|
||||
];
|
||||
# Longhorn uses open-iscsi to create block devices.
|
||||
services.openiscsi = {
|
||||
name = "iqn.2020-08.org.linux-iscsi.initiatorhost:${hostName}";
|
||||
enable = true;
|
||||
};
|
||||
|
||||
networking = {
|
||||
inherit hostName;
|
||||
|
||||
@@ -89,9 +72,9 @@ in
|
||||
networking.useNetworkd = true;
|
||||
systemd.network.enable = true;
|
||||
|
||||
# Linux bridge for the VMs' secondary network. It replaces the previous OVS
|
||||
# bridge: the `bridge` CNI plugin attaches the VM taps to br0, and the host
|
||||
# keeps its own address on br0 (the physical NIC is just a bridge port).
|
||||
# Linux bridge for the VMs: the microVM taps and the libvirt domains attach to
|
||||
# br0, and the host keeps its own address on it (the physical NIC is just a
|
||||
# bridge port).
|
||||
systemd.network.netdevs."10-br0" = {
|
||||
netdevConfig = {
|
||||
Name = "br0";
|
||||
@@ -99,8 +82,6 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
# systemd.services."systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug";
|
||||
|
||||
# Set the host's address on the bridge interface instead of the physical interface!
|
||||
systemd.network.networks = {
|
||||
"10-br0" = {
|
||||
Reference in new issue
Block a user