{"action":"created","comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/comments/214550788","pull_request_review_id":151630697,"id":214550788,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIxNDU1MDc4OA==","diff_hunk":"@@ -230,556 +126,22 @@ in {\n       type = types.path;\n     };\n \n+    easyCerts = mkOption {\n+      description = \"Automatically setup x509 certificates and keys for the entire cluster.\";\n+      default = false;\n+      type = types.bool;\n+    };\n+\n     featureGates = mkOption {\n-      description = \"List set of feature gates\";\n+      description = \"List set of feature gates.\";","path":"nixos/modules/services/cluster/kubernetes/default.nix","position":241,"original_position":241,"commit_id":"c8b56eeb5d5f781a51d61a17e10b57927102a02e","original_commit_id":"f23157af7f3bb8c0887d73d0f6e7fbde7bd6bd86","user":{"login":"srhb","id":219362,"node_id":"MDQ6VXNlcjIxOTM2Mg==","avatar_url":"https://avatars2.githubusercontent.com/u/219362?v=4","gravatar_id":"","url":"https://api.github.com/users/srhb","html_url":"https://github.com/srhb","followers_url":"https://api.github.com/users/srhb/followers","following_url":"https://api.github.com/users/srhb/following{/other_user}","gists_url":"https://api.github.com/users/srhb/gists{/gist_id}","starred_url":"https://api.github.com/users/srhb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/srhb/subscriptions","organizations_url":"https://api.github.com/users/srhb/orgs","repos_url":"https://api.github.com/users/srhb/repos","events_url":"https://api.github.com/users/srhb/events{/privacy}","received_events_url":"https://api.github.com/users/srhb/received_events","type":"User","site_admin":false},"body":"Another \"list set\"","created_at":"2018-09-02T19:36:37Z","updated_at":"2018-09-02T19:50:36Z","html_url":"https://github.com/NixOS/nixpkgs/pull/45670#discussion_r214550788","pull_request_url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/45670","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/NixOS/nixpkgs/pulls/comments/214550788"},"html":{"href":"https://github.com/NixOS/nixpkgs/pull/45670#discussion_r214550788"},"pull_request":{"href":"https://api.github.com/repos/NixOS/nixpkgs/pulls/45670"}}},"pull_request":{"url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/45670","id":211072239,"node_id":"MDExOlB1bGxSZXF1ZXN0MjExMDcyMjM5","html_url":"https://github.com/NixOS/nixpkgs/pull/45670","diff_url":"https://github.com/NixOS/nixpkgs/pull/45670.diff","patch_url":"https://github.com/NixOS/nixpkgs/pull/45670.patch","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/45670","number":45670,"state":"open","locked":false,"title":"nixos/kubernetes: Module refactor","user":{"login":"johanot","id":998763,"node_id":"MDQ6VXNlcjk5ODc2Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/998763?v=4","gravatar_id":"","url":"https://api.github.com/users/johanot","html_url":"https://github.com/johanot","followers_url":"https://api.github.com/users/johanot/followers","following_url":"https://api.github.com/users/johanot/following{/other_user}","gists_url":"https://api.github.com/users/johanot/gists{/gist_id}","starred_url":"https://api.github.com/users/johanot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johanot/subscriptions","organizations_url":"https://api.github.com/users/johanot/orgs","repos_url":"https://api.github.com/users/johanot/repos","events_url":"https://api.github.com/users/johanot/events{/privacy}","received_events_url":"https://api.github.com/users/johanot/received_events","type":"User","site_admin":false},"body":"### Big note: Depends on https://github.com/NixOS/nixpkgs/pull/45567 getting merged for PKI bootstrapping to work as intended, and for tests to run clean.\r\n\r\n###### Motivation for this change\r\n\r\n- kubernetes v1.11 should be part of NixOS 18.09. (#43882)\r\n- security within the cluster should be the default rather than something that needs extra configuration and manual setup. (#43395)\r\n\r\n###### This PR includes\r\n\r\n1. major refactoring of the nixos/kubernetes module. \r\n2. package upgrade of kubernetes: 1.10.5 -> 1.11.2\r\n3. manual chapter for kubernetes and release notes\r\n\r\nThe primary focus of the refactoring has been to enforce RBAC (role-based-access-control) and TLS-encryption across all cluster components. This turned out to be a cumbersome task, especially due to secret bootstrapping and exchange, which is not a trivial task. I ended up picking a solution similar to how kubeadm does cluster bootstrap. For any node to successfully join a cluster, a shared key must be manually (by an admin) copied from the master to the node, before the required node certificates can be signed and issued by the master. This is to ensure that any secrets don't end up in the store.\r\n\r\nSecondary focus has been to make it easier to enable and disable individual cluster components independently and to make the use of `services.kubernetes.roles` more intuitive and (most importantly) optional. \r\n\r\nUnfortunately, upgrade from kube-dns to coredns did not happen as part of this PR. I suspect this will not make it to 18.09, unless somebody finds time to change and test. Similarly, the change from cmdline params to config files will have to wait to a later round. \r\n\r\nI hope that this refactoring makes the foundation for further improvements and updates to the module in the future.\r\n\r\nfixes #43882, fixes #43395\r\n\r\nThanks to @srhb for much appreciated help and advise during development of this!\r\n\r\n@kalbasit @colemickens @steveeJ Can I ask you guys for review help? \r\nI have a GCE cluster running 1 master and 2 nodes, for which you can get testing/playground access on request.\r\n\r\n###### Things done\r\n\r\n<!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->\r\n\r\n- [X] Tested using sandboxing ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file) on non-NixOS)\r\n- Built on platform(s)\r\n   - [X] NixOS\r\n   - [ ] macOS\r\n   - [ ] other Linux distributions\r\n- [X] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))\r\n- [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run \"nox-review wip\"`\r\n- [X] Tested execution of all binary files (usually in `./result/bin/`)\r\n- [ ] Determined the impact on package closure size (by running `nix path-info -S` before and after)\r\n- [X] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).\r\n\r\n---\r\n","created_at":"2018-08-27T10:45:05Z","updated_at":"2018-09-02T19:50:36Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d492cf1050b06f10ab9247d927d4388ea27e0b2d","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":731735222,"node_id":"MDU6TGFiZWw3MzE3MzUyMjI=","url":"https://api.github.com/repos/NixOS/nixpkgs/labels/10.rebuild-darwin:%201-10","name":"10.rebuild-darwin: 1-10","color":"eeffee","default":false},{"id":731733923,"node_id":"MDU6TGFiZWw3MzE3MzM5MjM=","url":"https://api.github.com/repos/NixOS/nixpkgs/labels/10.rebuild-linux:%201-10","name":"10.rebuild-linux: 1-10","color":"eeffee","default":false},{"id":60265212,"node_id":"MDU6TGFiZWw2MDI2NTIxMg==","url":"https://api.github.com/repos/NixOS/nixpkgs/labels/6.topic:%20nixos","name":"6.topic: nixos","color":"fef2c0","default":false},{"id":290122698,"node_id":"MDU6TGFiZWwyOTAxMjI2OTg=","url":"https://api.github.com/repos/NixOS/nixpkgs/labels/8.has:%20changelog","name":"8.has: changelog","color":"009800","default":false},{"id":290122655,"node_id":"MDU6TGFiZWwyOTAxMjI2NTU=","url":"https://api.github.com/repos/NixOS/nixpkgs/labels/8.has:%20documentation","name":"8.has: documentation","color":"009800","default":false},{"id":290122884,"node_id":"MDU6TGFiZWwyOTAxMjI4ODQ=","url":"https://api.github.com/repos/NixOS/nixpkgs/labels/8.has:%20module%20(update)","name":"8.has: module (update)","color":"009800","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/45670/commits","review_comments_url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/45670/comments","review_comment_url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/45670/comments","statuses_url":"https://api.github.com/repos/NixOS/nixpkgs/statuses/c8b56eeb5d5f781a51d61a17e10b57927102a02e","head":{"label":"johanot:kubernetes-1.11","ref":"kubernetes-1.11","sha":"c8b56eeb5d5f781a51d61a17e10b57927102a02e","user":{"login":"johanot","id":998763,"node_id":"MDQ6VXNlcjk5ODc2Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/998763?v=4","gravatar_id":"","url":"https://api.github.com/users/johanot","html_url":"https://github.com/johanot","followers_url":"https://api.github.com/users/johanot/followers","following_url":"https://api.github.com/users/johanot/following{/other_user}","gists_url":"https://api.github.com/users/johanot/gists{/gist_id}","starred_url":"https://api.github.com/users/johanot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johanot/subscriptions","organizations_url":"https://api.github.com/users/johanot/orgs","repos_url":"https://api.github.com/users/johanot/repos","events_url":"https://api.github.com/users/johanot/events{/privacy}","received_events_url":"https://api.github.com/users/johanot/received_events","type":"User","site_admin":false},"repo":{"id":131477909,"node_id":"MDEwOlJlcG9zaXRvcnkxMzE0Nzc5MDk=","name":"nixpkgs","full_name":"johanot/nixpkgs","owner":{"login":"johanot","id":998763,"node_id":"MDQ6VXNlcjk5ODc2Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/998763?v=4","gravatar_id":"","url":"https://api.github.com/users/johanot","html_url":"https://github.com/johanot","followers_url":"https://api.github.com/users/johanot/followers","following_url":"https://api.github.com/users/johanot/following{/other_user}","gists_url":"https://api.github.com/users/johanot/gists{/gist_id}","starred_url":"https://api.github.com/users/johanot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johanot/subscriptions","organizations_url":"https://api.github.com/users/johanot/orgs","repos_url":"https://api.github.com/users/johanot/repos","events_url":"https://api.github.com/users/johanot/events{/privacy}","received_events_url":"https://api.github.com/users/johanot/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/johanot/nixpkgs","description":"Nix Packages collection","fork":true,"url":"https://api.github.com/repos/johanot/nixpkgs","forks_url":"https://api.github.com/repos/johanot/nixpkgs/forks","keys_url":"https://api.github.com/repos/johanot/nixpkgs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/johanot/nixpkgs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/johanot/nixpkgs/teams","hooks_url":"https://api.github.com/repos/johanot/nixpkgs/hooks","issue_events_url":"https://api.github.com/repos/johanot/nixpkgs/issues/events{/number}","events_url":"https://api.github.com/repos/johanot/nixpkgs/events","assignees_url":"https://api.github.com/repos/johanot/nixpkgs/assignees{/user}","branches_url":"https://api.github.com/repos/johanot/nixpkgs/branches{/branch}","tags_url":"https://api.github.com/repos/johanot/nixpkgs/tags","blobs_url":"https://api.github.com/repos/johanot/nixpkgs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/johanot/nixpkgs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/johanot/nixpkgs/git/refs{/sha}","trees_url":"https://api.github.com/repos/johanot/nixpkgs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/johanot/nixpkgs/statuses/{sha}","languages_url":"https://api.github.com/repos/johanot/nixpkgs/languages","stargazers_url":"https://api.github.com/repos/johanot/nixpkgs/stargazers","contributors_url":"https://api.github.com/repos/johanot/nixpkgs/contributors","subscribers_url":"https://api.github.com/repos/johanot/nixpkgs/subscribers","subscription_url":"https://api.github.com/repos/johanot/nixpkgs/subscription","commits_url":"https://api.github.com/repos/johanot/nixpkgs/commits{/sha}","git_commits_url":"https://api.github.com/repos/johanot/nixpkgs/git/commits{/sha}","comments_url":"https://api.github.com/repos/johanot/nixpkgs/comments{/number}","issue_comment_url":"https://api.github.com/repos/johanot/nixpkgs/issues/comments{/number}","contents_url":"https://api.github.com/repos/johanot/nixpkgs/contents/{+path}","compare_url":"https://api.github.com/repos/johanot/nixpkgs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/johanot/nixpkgs/merges","archive_url":"https://api.github.com/repos/johanot/nixpkgs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/johanot/nixpkgs/downloads","issues_url":"https://api.github.com/repos/johanot/nixpkgs/issues{/number}","pulls_url":"https://api.github.com/repos/johanot/nixpkgs/pulls{/number}","milestones_url":"https://api.github.com/repos/johanot/nixpkgs/milestones{/number}","notifications_url":"https://api.github.com/repos/johanot/nixpkgs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/johanot/nixpkgs/labels{/name}","releases_url":"https://api.github.com/repos/johanot/nixpkgs/releases{/id}","deployments_url":"https://api.github.com/repos/johanot/nixpkgs/deployments","created_at":"2018-04-29T08:25:42Z","updated_at":"2018-04-29T08:26:18Z","pushed_at":"2018-08-29T08:05:50Z","git_url":"git://github.com/johanot/nixpkgs.git","ssh_url":"git@github.com:johanot/nixpkgs.git","clone_url":"https://github.com/johanot/nixpkgs.git","svn_url":"https://github.com/johanot/nixpkgs","homepage":null,"size":828154,"stargazers_count":0,"watchers_count":0,"language":"Nix","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"NixOS:master","ref":"master","sha":"718ee42eb974c52e0e0c7b56c70cd7dabcaf09b7","user":{"login":"NixOS","id":487568,"node_id":"MDEyOk9yZ2FuaXphdGlvbjQ4NzU2OA==","avatar_url":"https://avatars3.githubusercontent.com/u/487568?v=4","gravatar_id":"","url":"https://api.github.com/users/NixOS","html_url":"https://github.com/NixOS","followers_url":"https://api.github.com/users/NixOS/followers","following_url":"https://api.github.com/users/NixOS/following{/other_user}","gists_url":"https://api.github.com/users/NixOS/gists{/gist_id}","starred_url":"https://api.github.com/users/NixOS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NixOS/subscriptions","organizations_url":"https://api.github.com/users/NixOS/orgs","repos_url":"https://api.github.com/users/NixOS/repos","events_url":"https://api.github.com/users/NixOS/events{/privacy}","received_events_url":"https://api.github.com/users/NixOS/received_events","type":"Organization","site_admin":false},"repo":{"id":4542716,"node_id":"MDEwOlJlcG9zaXRvcnk0NTQyNzE2","name":"nixpkgs","full_name":"NixOS/nixpkgs","owner":{"login":"NixOS","id":487568,"node_id":"MDEyOk9yZ2FuaXphdGlvbjQ4NzU2OA==","avatar_url":"https://avatars3.githubusercontent.com/u/487568?v=4","gravatar_id":"","url":"https://api.github.com/users/NixOS","html_url":"https://github.com/NixOS","followers_url":"https://api.github.com/users/NixOS/followers","following_url":"https://api.github.com/users/NixOS/following{/other_user}","gists_url":"https://api.github.com/users/NixOS/gists{/gist_id}","starred_url":"https://api.github.com/users/NixOS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NixOS/subscriptions","organizations_url":"https://api.github.com/users/NixOS/orgs","repos_url":"https://api.github.com/users/NixOS/repos","events_url":"https://api.github.com/users/NixOS/events{/privacy}","received_events_url":"https://api.github.com/users/NixOS/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/NixOS/nixpkgs","description":"Nix Packages collection","fork":false,"url":"https://api.github.com/repos/NixOS/nixpkgs","forks_url":"https://api.github.com/repos/NixOS/nixpkgs/forks","keys_url":"https://api.github.com/repos/NixOS/nixpkgs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/NixOS/nixpkgs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/NixOS/nixpkgs/teams","hooks_url":"https://api.github.com/repos/NixOS/nixpkgs/hooks","issue_events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/events{/number}","events_url":"https://api.github.com/repos/NixOS/nixpkgs/events","assignees_url":"https://api.github.com/repos/NixOS/nixpkgs/assignees{/user}","branches_url":"https://api.github.com/repos/NixOS/nixpkgs/branches{/branch}","tags_url":"https://api.github.com/repos/NixOS/nixpkgs/tags","blobs_url":"https://api.github.com/repos/NixOS/nixpkgs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/NixOS/nixpkgs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/NixOS/nixpkgs/git/refs{/sha}","trees_url":"https://api.github.com/repos/NixOS/nixpkgs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/NixOS/nixpkgs/statuses/{sha}","languages_url":"https://api.github.com/repos/NixOS/nixpkgs/languages","stargazers_url":"https://api.github.com/repos/NixOS/nixpkgs/stargazers","contributors_url":"https://api.github.com/repos/NixOS/nixpkgs/contributors","subscribers_url":"https://api.github.com/repos/NixOS/nixpkgs/subscribers","subscription_url":"https://api.github.com/repos/NixOS/nixpkgs/subscription","commits_url":"https://api.github.com/repos/NixOS/nixpkgs/commits{/sha}","git_commits_url":"https://api.github.com/repos/NixOS/nixpkgs/git/commits{/sha}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/comments{/number}","issue_comment_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments{/number}","contents_url":"https://api.github.com/repos/NixOS/nixpkgs/contents/{+path}","compare_url":"https://api.github.com/repos/NixOS/nixpkgs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/NixOS/nixpkgs/merges","archive_url":"https://api.github.com/repos/NixOS/nixpkgs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/NixOS/nixpkgs/downloads","issues_url":"https://api.github.com/repos/NixOS/nixpkgs/issues{/number}","pulls_url":"https://api.github.com/repos/NixOS/nixpkgs/pulls{/number}","milestones_url":"https://api.github.com/repos/NixOS/nixpkgs/milestones{/number}","notifications_url":"https://api.github.com/repos/NixOS/nixpkgs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/labels{/name}","releases_url":"https://api.github.com/repos/NixOS/nixpkgs/releases{/id}","deployments_url":"https://api.github.com/repos/NixOS/nixpkgs/deployments","created_at":"2012-06-04T02:49:46Z","updated_at":"2018-09-02T19:46:46Z","pushed_at":"2018-09-02T19:48:08Z","git_url":"git://github.com/NixOS/nixpkgs.git","ssh_url":"git@github.com:NixOS/nixpkgs.git","clone_url":"https://github.com/NixOS/nixpkgs.git","svn_url":"https://github.com/NixOS/nixpkgs","homepage":null,"size":847913,"stargazers_count":2739,"watchers_count":2739,"language":"Nix","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":2982,"mirror_url":null,"archived":false,"open_issues_count":3089,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":2982,"open_issues":3089,"watchers":2739,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/NixOS/nixpkgs/pulls/45670"},"html":{"href":"https://github.com/NixOS/nixpkgs/pull/45670"},"issue":{"href":"https://api.github.com/repos/NixOS/nixpkgs/issues/45670"},"comments":{"href":"https://api.github.com/repos/NixOS/nixpkgs/issues/45670/comments"},"review_comments":{"href":"https://api.github.com/repos/NixOS/nixpkgs/pulls/45670/comments"},"review_comment":{"href":"https://api.github.com/repos/NixOS/nixpkgs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/NixOS/nixpkgs/pulls/45670/commits"},"statuses":{"href":"https://api.github.com/repos/NixOS/nixpkgs/statuses/c8b56eeb5d5f781a51d61a17e10b57927102a02e"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"srhb"}}