change k3s data dir to external disk

add additional SAN to k3s certificates
update README with k8s certificate instructions
open port for kubectl

README.md

@@ -25,3 +25,47 @@ Additionally, it deploys an age identity, which is later used for decrypting sec
 ## Deployment
 
 Deployment can simply be done as follows: `deploy`
+
+## Creating an admin certificate for k3s
+
+Create the admin's private key:
+```
+openssl genpkey -algorithm ed25519 -out <username>-key.pem
+```
+
+Create a CSR for the admin:
+```
+openssl req -new -key <username>-key.pem -out <username>.csr -subj "/CN=<username>"
+```
+
+Create a Kubernetes CSR object on the cluster:
+```
+k3s kubectl create -f - <<EOF
+apiVersion: certificates.k8s.io/v1
+kind: CertificateSigningRequest
+metadata:
+  name: <username>-csr
+spec:
+  request: $(cat <username>.csr | base64 | tr -d '\n')
+  expirationSeconds: 307584000 # 10 years
+  signerName: kubernetes.io/kube-apiserver-client
+  usages:
+    - digital signature
+    - key encipherment
+    - client auth
+EOF
+```
+
+Approve and sign the admin's CSR:
+```
+k3s kubectl certificate approve <username>-csr
+```
+
+Extract the resulting signed certificate from the CSR object:
+```
+k3s kubectl get csr <username>-csr -o jsonpath='{.status.certificate}' | base64 --decode > <username>.crt
+```
+
+## TODO
+
+1. Manage the bootstrap k3s clusterrolebinding with kubenix: `k3s kubectl create clusterrolebinding pim-cluster-admin --user=pim --clusterrole=cluster-admin`.

configuration.nix

@@ -177,4 +177,9 @@
 
   services.k3s.enable = true;
   services.k3s.role = "server";
+  # Temporary fix: by default the full hostname of the server (jefke.hyp) is not included into the Subject Alternative Name of certificates of the server.
+  # We can hardcode this as a CLI flag to k3s.
+  services.k3s.extraFlags = "--tls-san jefke.hyp --data-dir /mnt/data/k3s";
+
+  virtualisation.libvirtd.enable = true;
 }

flake.nix

@@ -24,6 +24,7 @@
       pkgs = nixpkgs.legacyPackages.${system};
       pkgs-unstable = nixpkgs-unstable.legacyPackages.${system};
       machines = import ./machines;
+      # TODO: Maybe use mergeAttrLists
       mkNixosSystems = systemDef:
         nixpkgs.lib.foldlAttrs (acc: name: machine:
           acc // {
@@ -44,6 +45,7 @@
           pkgs-unstable.deploy-rs
           pkgs.openssl
           pkgs.postgresql_15
+          pkgs.kubectl
         ];
       };
 

nftables.conf

@@ -15,6 +15,7 @@ table inet nixos-fw {
 	chain input-allow {
 		tcp dport 22 accept
 		tcp dport 5432 accept comment "PostgreSQL server"
+		tcp dport 6443 accept comment "k3s"
 		icmp type echo-request accept comment "allow ping"
 		icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
 		ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"