gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/rancher: fix warnings/assertions being silently dropped

Browse Source 
lib.recursiveUpdate overwrites lists instead of merging them,
causing base module warnings and assertions to be silently dropped
by k3s.nix and rke2.nix. Replace with lib.mkMerge which properly
concatenates lists through the NixOS module system.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
bgl gwyng
2026-03-26 16:03:01 +09:00
co-authored by Claude Opus 4.6
parent 6f2bd12ede
commit 7dda3f6a84
2 changed files with 51 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/cluster/rancher/k3s.nix
+18 -17
View File
@@ -115,23 +115,24 @@ in
# implementation
config = lib.mkIf cfg.enable (
lib.recursiveUpdate baseModule.config {
warnings = (
lib.optional (
cfg.disableAgent && cfg.images != [ ]
) "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node."
);
lib.mkMerge [
baseModule.config
{
warnings =
lib.optional (cfg.disableAgent && cfg.images != [ ])
"k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node.";
assertions = [
{
assertion = cfg.role == "agent" -> !cfg.disableAgent;
message = "k3s: disableAgent must be false if role is 'agent'";
}
{
assertion = cfg.role == "agent" -> !cfg.clusterInit;
message = "k3s: clusterInit must be false if role is 'agent'";
}
];
}
assertions = [
{
assertion = cfg.role == "agent" -> !cfg.disableAgent;
message = "k3s: disableAgent must be false if role is 'agent'";
}
{
assertion = cfg.role == "agent" -> !cfg.clusterInit;
message = "k3s: clusterInit must be false if role is 'agent'";
}
];
}
]
);
}
nixos/modules/services/cluster/rancher/rke2.nix
+33 -32
View File
@@ -121,40 +121,41 @@ in
# implementation
config = lib.mkIf cfg.enable (
lib.recursiveUpdate baseModule.config {
warnings = (
lib.optional (
lib.mkMerge [
baseModule.config
{
warnings = lib.optional (
cfg.role == "agent" && cfg.cni != null
) "rke2: cni should not be set if role is 'agent'"
);
) "rke2: cni should not be set if role is 'agent'";
# Configure NetworkManager to ignore CNI network interfaces.
# See: https://docs.rke2.io/known_issues#networkmanager
environment.etc."NetworkManager/conf.d/rke2-canal.conf" = {
enable = config.networking.networkmanager.enable;
text = ''
[keyfile]
unmanaged-devices=interface-name:flannel*;interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
'';
};
# CIS hardening
# https://docs.rke2.io/security/hardening_guide#kernel-parameters
# https://github.com/rancher/rke2/blob/ef0fc7aa9d3bbaa95ce9b1895972488cbd92e302/bundle/share/rke2/rke2-cis-sysctl.conf
boot.kernel.sysctl = {
"vm.panic_on_oom" = 0;
"vm.overcommit_memory" = 1;
"kernel.panic" = 10;
"kernel.panic_on_oops" = 1;
};
# https://docs.rke2.io/security/hardening_guide#etcd-is-configured-properly
users = lib.mkIf cfg.cisHardening {
users.etcd = {
isSystemUser = true;
group = "etcd";
# Configure NetworkManager to ignore CNI network interfaces.
# See: https://docs.rke2.io/known_issues#networkmanager
environment.etc."NetworkManager/conf.d/rke2-canal.conf" = {
enable = config.networking.networkmanager.enable;
text = ''
[keyfile]
unmanaged-devices=interface-name:flannel*;interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
'';
};
groups.etcd = { };
};
}
# CIS hardening
# https://docs.rke2.io/security/hardening_guide#kernel-parameters
# https://github.com/rancher/rke2/blob/ef0fc7aa9d3bbaa95ce9b1895972488cbd92e302/bundle/share/rke2/rke2-cis-sysctl.conf
boot.kernel.sysctl = {
"vm.panic_on_oom" = 0;
"vm.overcommit_memory" = 1;
"kernel.panic" = 10;
"kernel.panic_on_oops" = 1;
};
# https://docs.rke2.io/security/hardening_guide#etcd-is-configured-properly
users = lib.mkIf cfg.cisHardening {
users.etcd = {
isSystemUser = true;
group = "etcd";
};
groups.etcd = { };
};
}
]
);
}