feat(k3s): add k3s systemd service and kubeconfig for kyber - #1580
Conversation
Manages k3s as a Nix-declared system service on kyber instead of requiring a manual curl install. Splits concerns across config/kube (kubeconfig) and services/k3s (systemd service). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughSummary by CodeRabbit
WalkthroughThis pull request introduces a new K3s service module for Home Manager with conditional deployment on Linux systems. Changes include a systemd service unit template, activation logic for unit installation and systemd reloading, kubeconfig provisioning, and conditional K3s package installation alongside Kubernetes tooling. Changes
Sequence Diagram(s)sequenceDiagram
participant Activation as Home Manager<br/>Activation
participant FileSystem as File System
participant Systemd as Systemd
Activation->>FileSystem: Generate ~/.config/k3s/k3s.service<br/>(from template)
Activation->>FileSystem: Compare with /etc/systemd/system/k3s.service
alt File differs or missing
Activation->>FileSystem: Copy unit to /etc/systemd/system/
Activation->>Systemd: Reload systemd daemon
Activation->>Systemd: Enable k3s service
Activation->>Systemd: Start k3s service
end
Activation->>FileSystem: Check /etc/rancher/k3s/k3s.yaml
alt Kubeconfig exists
Activation->>FileSystem: Ensure ~/.kube directory
Activation->>FileSystem: Copy to ~/.kube/config
Activation->>FileSystem: Set ownership & 0600 permissions
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRAdds a What changed?
Description generated by Mesa. Update settings |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces k3s service management and automated kubeconfig synchronization for the user environment. It includes a new systemd service for k3s and activation scripts to ensure the kubeconfig is accessible for non-root kubectl usage. Review feedback suggests maintaining alphabetical order in module imports, implementing idempotency checks in the kubeconfig sync script to prevent unnecessary sudo prompts, and addressing inconsistencies in sudo detection and service restart behavior within the k3s setup.
| ./hammerspoon | ||
| ./jj | ||
| ./k3s | ||
| ./kube |
There was a problem hiding this comment.
The module list should maintain alphabetical order. ./kube should come after ./karabiner.
./karabiner
./kube
| if [ -n "$SUDO_CMD" ]; then | ||
| mkdir -p "$KUBE_DIR" | ||
| $SUDO_CMD cp "$K3S_KUBECONFIG" "$KUBE_DIR/config" | ||
| $SUDO_CMD chown "$(id -u):$(id -g)" "$KUBE_DIR/config" | ||
| chmod 600 "$KUBE_DIR/config" | ||
| fi |
There was a problem hiding this comment.
The script currently overwrites the kubeconfig on every activation, which can trigger unnecessary sudo password prompts. Adding an idempotency check using diff (similar to the pattern used in the k3s service activation) would be more efficient. Additionally, if sudo is not found, the script fails gracefully with a warning to improve debuggability.
| if [ -n "$SUDO_CMD" ]; then | |
| mkdir -p "$KUBE_DIR" | |
| $SUDO_CMD cp "$K3S_KUBECONFIG" "$KUBE_DIR/config" | |
| $SUDO_CMD chown "$(id -u):$(id -g)" "$KUBE_DIR/config" | |
| chmod 600 "$KUBE_DIR/config" | |
| fi | |
| if [ -n "$SUDO_CMD" ]; then | |
| mkdir -p "$KUBE_DIR" | |
| if [ ! -f "$KUBE_DIR/config" ] || ! $SUDO_CMD diff -q "$K3S_KUBECONFIG" "$KUBE_DIR/config" >/dev/null 2>&1; then | |
| $SUDO_CMD cp "$K3S_KUBECONFIG" "$KUBE_DIR/config" | |
| $SUDO_CMD chown "$(id -u):$(id -g)" "$KUBE_DIR/config" | |
| chmod 600 "$KUBE_DIR/config" | |
| fi | |
| else | |
| echo "Warning: sudo not found, skipping kubeconfig sync" >&2 | |
| fi |
References
- Maintain consistency with established patterns for writing scripts that are extracted from Nix expressions.
| $DRY_RUN_CMD sudo cp "${k3sServiceFile}" /etc/systemd/system/k3s.service | ||
| $DRY_RUN_CMD sudo ${pkgs.systemd}/bin/systemctl daemon-reload | ||
| $DRY_RUN_CMD sudo ${pkgs.systemd}/bin/systemctl enable --now k3s |
There was a problem hiding this comment.
This activation script uses sudo directly, which is inconsistent with the detection logic implemented in config/kube/activate.sh. For better compatibility (e.g., on NixOS where the sudo wrapper is at a specific path), consider using a consistent detection method or ensuring sudo is in the PATH. Also, note that systemctl enable --now will not restart the service if the unit file has changed; if a configuration update requires a service restart, you may want to add
References
- Maintain consistency with established patterns for writing scripts that are extracted from Nix expressions.
Config module owns the replaceVars rendering and exposes the result via modules.k3s.serviceFile. Service module just consumes it. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- k3s package available on all Linux via programs/k8s - config/k3s renders k3s.service to ~/.config/k3s/ via home.file - services/k3s just reads the rendered file and installs it (kyber-only) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The kubeconfig depends on k3s running, so it belongs in the service activation alongside the systemd setup. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 participant
Summary
services/k3s/module: installspkgs.k3sand manages a systemd system service on kyber via activation scriptconfig/kube/module: copies k3s kubeconfig to~/.kube/configfor non-root kubectl access (kyber-only)default.nixindexesTest plan
home-manager switch --flake .#kyberon kyber and verify k3s service startskubectl get nodesworks without sudo after activationhost.isKyber)🤖 Generated with Claude Code
Summary by cubic
Add a
k3ssystemd service and kubeconfig setup on kyber to run Kubernetes without manual installs. Also shipsk3sviahome-manager/programs/k8son Linux sokubectlworks without sudo.New Features
k3s.serviceto~/.config/k3s/k3s.serviceand install it to/etc/systemd/system/k3s.service; reload, enable, and start (idempotent via diff)./etc/rancher/k3s/k3s.yamlto~/.kube/configwith correct ownership and 600 perms.k3stoprograms/k8sfor Linux hosts.Refactors
config/k3susingpkgs.replaceVars; service reads the rendered file instead of rendering it.Written for commit 97d0297. Summary will update on new commits.