Rewrite kubernetes client config as user module

kubernetes.client.enable = tools only (kubectl, helm, kubelogin, extraPackages); ~/.kube/config is not touched until a cluster CA is configured.
kubernetes.client.kubeconfig.enable renders ~/.kube/config (takes over an existing file via force, chmod 600 after activation). It auto-enables only once caFile/caData/clientCertificateFile/insecureSkipTlsVerify is set, and an explicit enable without any CA source now fails a module assertion — the old module's silent insecure-skip-tls-verify: true fallback can't return.
kubernetes.client.oidc.* generates the kubelogin exec credential plugin (device-code flow, Authentik issuer via OIDC_ISSUER_URL/OIDC_CLIENT_ID, ${env:HOME}/.cache/kubelogin cache path expanded by client-go).
users/users/rpickler.nix switched to the new namespace (kubernetes.client = { enable = true; server = "https://lurch.lan:6443"; oidc = {...}; }); kubeconfig stays dormant until you add e.g. caFile = "/run/secrets/…/kube-ca.pem".

Verified by evaluating against this repo's pinned nixpkgs/home-manager 26.05 inputs: tools-only mode leaves home.file.".kube/config" undeclared; full config renders CA data + kubelogin exec + k9s from extraPackages; missing-CA enable is rejected; and rpickler's complete home-manager module list (nixvim, hyprland, sops, …) still evaluates with the config dormant.

Note: home-manager 26.05 removed home.file.<name>.mode, hence the activation-hook chmod. Prefer caFile/clientKeyFile paths over caData/clientKeyData so secret material stays out of the Nix store.

Rewritten as a portable user module — PR #39 (`issue-35-kubernetes-client-user-module`). Summary of the new `users/modules/kubernetes.nix`: - `kubernetes.client.enable` = tools only (`kubectl`, `helm`, `kubelogin`, `extraPackages`); `~/.kube/config` is **not touched** until a cluster CA is configured. - `kubernetes.client.kubeconfig.enable` renders `~/.kube/config` (takes over an existing file via `force`, `chmod 600` after activation). It auto-enables only once `caFile`/`caData`/`clientCertificateFile`/`insecureSkipTlsVerify` is set, and an explicit enable without any CA source now **fails a module assertion** — the old module's silent `insecure-skip-tls-verify: true` fallback can't return. - `kubernetes.client.oidc.*` generates the kubelogin exec credential plugin (device-code flow, Authentik issuer via `OIDC_ISSUER_URL`/`OIDC_CLIENT_ID`, `${env:HOME}/.cache/kubelogin` cache path expanded by client-go). - `users/users/rpickler.nix` switched to the new namespace (`kubernetes.client = { enable = true; server = "https://lurch.lan:6443"; oidc = {...}; }`); kubeconfig stays dormant until you add e.g. `caFile = "/run/secrets/…/kube-ca.pem"`. Verified by evaluating against this repo's pinned nixpkgs/home-manager 26.05 inputs: tools-only mode leaves `home.file.".kube/config"` undeclared; full config renders CA data + kubelogin exec + k9s from `extraPackages`; missing-CA enable is rejected; and rpickler's complete home-manager module list (nixvim, hyprland, sops, …) still evaluates with the config dormant. Note: home-manager 26.05 removed `home.file.<name>.mode`, hence the activation-hook chmod. Prefer `caFile`/`clientKeyFile` paths over `caData`/`clientKeyData` so secret material stays out of the Nix store.

hermes-bot referenced this issue from a commit

2026-10-26 09:09:47 +00:00

rpickler: fully generate ~/.kube/config from user-space sops (issue #35 review)

hermes-bot referenced this issue from a commit

2026-10-30 16:08:30 +00:00

rpickler: home-manager secrets in their own file users/secrets.yaml (issue #35 review)

Rows
Columns

Rewrite kubernetes client config as user module #35