From 7dda3f6a84c704537a67c9a71b15bdfe19548d04 Mon Sep 17 00:00:00 2001
From: bgl gwyng <bgl@gwyng.com>
Date: Mon, 23 Mar 2026 14:29:04 +0900
Subject: [PATCH] nixos/rancher: fix warnings/assertions being silently dropped

lib.recursiveUpdate overwrites lists instead of merging them,
causing base module warnings and assertions to be silently dropped
by k3s.nix and rke2.nix. Replace with lib.mkMerge which properly
concatenates lists through the NixOS module system.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../modules/services/cluster/rancher/k3s.nix  | 35 +++++-----
 .../modules/services/cluster/rancher/rke2.nix | 65 ++++++++++---------
 2 files changed, 51 insertions(+), 49 deletions(-)

diff --git a/nixos/modules/services/cluster/rancher/k3s.nix b/nixos/modules/services/cluster/rancher/k3s.nix
index 0a8a1fc2be7b..7a509d4edd08 100644
--- a/nixos/modules/services/cluster/rancher/k3s.nix
+++ b/nixos/modules/services/cluster/rancher/k3s.nix
@@ -115,23 +115,24 @@ in
   # implementation
 
   config = lib.mkIf cfg.enable (
-    lib.recursiveUpdate baseModule.config {
-      warnings = (
-        lib.optional (
-          cfg.disableAgent && cfg.images != [ ]
-        ) "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node."
-      );
+    lib.mkMerge [
+      baseModule.config
+      {
+        warnings =
+          lib.optional (cfg.disableAgent && cfg.images != [ ])
+            "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node.";
 
-      assertions = [
-        {
-          assertion = cfg.role == "agent" -> !cfg.disableAgent;
-          message = "k3s: disableAgent must be false if role is 'agent'";
-        }
-        {
-          assertion = cfg.role == "agent" -> !cfg.clusterInit;
-          message = "k3s: clusterInit must be false if role is 'agent'";
-        }
-      ];
-    }
+        assertions = [
+          {
+            assertion = cfg.role == "agent" -> !cfg.disableAgent;
+            message = "k3s: disableAgent must be false if role is 'agent'";
+          }
+          {
+            assertion = cfg.role == "agent" -> !cfg.clusterInit;
+            message = "k3s: clusterInit must be false if role is 'agent'";
+          }
+        ];
+      }
+    ]
   );
 }
diff --git a/nixos/modules/services/cluster/rancher/rke2.nix b/nixos/modules/services/cluster/rancher/rke2.nix
index d1cd0b4630e7..6467a7de7646 100644
--- a/nixos/modules/services/cluster/rancher/rke2.nix
+++ b/nixos/modules/services/cluster/rancher/rke2.nix
@@ -121,40 +121,41 @@ in
   # implementation
 
   config = lib.mkIf cfg.enable (
-    lib.recursiveUpdate baseModule.config {
-      warnings = (
-        lib.optional (
+    lib.mkMerge [
+      baseModule.config
+      {
+        warnings = lib.optional (
           cfg.role == "agent" && cfg.cni != null
-        ) "rke2: cni should not be set if role is 'agent'"
-      );
+        ) "rke2: cni should not be set if role is 'agent'";
 
-      # Configure NetworkManager to ignore CNI network interfaces.
-      # See: https://docs.rke2.io/known_issues#networkmanager
-      environment.etc."NetworkManager/conf.d/rke2-canal.conf" = {
-        enable = config.networking.networkmanager.enable;
-        text = ''
-          [keyfile]
-          unmanaged-devices=interface-name:flannel*;interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
-        '';
-      };
-
-      # CIS hardening
-      # https://docs.rke2.io/security/hardening_guide#kernel-parameters
-      # https://github.com/rancher/rke2/blob/ef0fc7aa9d3bbaa95ce9b1895972488cbd92e302/bundle/share/rke2/rke2-cis-sysctl.conf
-      boot.kernel.sysctl = {
-        "vm.panic_on_oom" = 0;
-        "vm.overcommit_memory" = 1;
-        "kernel.panic" = 10;
-        "kernel.panic_on_oops" = 1;
-      };
-      # https://docs.rke2.io/security/hardening_guide#etcd-is-configured-properly
-      users = lib.mkIf cfg.cisHardening {
-        users.etcd = {
-          isSystemUser = true;
-          group = "etcd";
+        # Configure NetworkManager to ignore CNI network interfaces.
+        # See: https://docs.rke2.io/known_issues#networkmanager
+        environment.etc."NetworkManager/conf.d/rke2-canal.conf" = {
+          enable = config.networking.networkmanager.enable;
+          text = ''
+            [keyfile]
+            unmanaged-devices=interface-name:flannel*;interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
+          '';
         };
-        groups.etcd = { };
-      };
-    }
+
+        # CIS hardening
+        # https://docs.rke2.io/security/hardening_guide#kernel-parameters
+        # https://github.com/rancher/rke2/blob/ef0fc7aa9d3bbaa95ce9b1895972488cbd92e302/bundle/share/rke2/rke2-cis-sysctl.conf
+        boot.kernel.sysctl = {
+          "vm.panic_on_oom" = 0;
+          "vm.overcommit_memory" = 1;
+          "kernel.panic" = 10;
+          "kernel.panic_on_oops" = 1;
+        };
+        # https://docs.rke2.io/security/hardening_guide#etcd-is-configured-properly
+        users = lib.mkIf cfg.cisHardening {
+          users.etcd = {
+            isSystemUser = true;
+            group = "etcd";
+          };
+          groups.etcd = { };
+        };
+      }
+    ]
   );
 }