kubernetes: reimplement client config as portable user module (#35) #39

Closed

hermes-bot wants to merge 1 commit from issue-35-kubernetes-client-user-module into main

hermes-bot commented

2026-10-23 11:20:13 +00:00

Member

Rewrites users/modules/kubernetes.nix as a clean, portable home-manager user module with a kubernetes.client.* namespace (fixes #35).

Behavior

kubernetes.client.enable installs the tools only (kubectl, kubernetes-helm, kubelogin, plus extraPackages) and leaves ~/.kube/config completely untouched — no config is written until a cluster CA is actually configured.
kubeconfig.enable renders ~/.kube/config via home.file; it auto-enables only once caFile / caData / clientCertificateFile / insecureSkipTlsVerify is set, and an explicit kubeconfig.enable = true without any CA source fails a module assertion, so the unsafe insecure-skip-tls-verify: true default from the old module can never return silently.
OIDC exec auth (oidc.*) generates the kubelogin exec block (device-code flow by default, OIDC_ISSUER_URL/OIDC_CLIENT_ID env, ${env:HOME}/.cache/kubelogin cache path — expanded by client-go, not a shell).
users/users/rpickler.nix is rewired to the new namespace with the Authentik issuer; the kubeconfig stays dormant until a sops-managed caFile is added.

Verified — evaluated against this repo's pinned flake inputs (nixpkgs + home-manager 26.05) with a harness covering:

tools-only enable → no home.file.".kube/config", tools on PATH — PASS
full kubeconfig with caData + OIDC → CA embedded, kubelogin exec block, force takeover, chmod 600 onChange hook, extraPackages merged — PASS
kubeconfig.enable with no CA → assertion rejects — PASS
rpickler's real module list (nixvim/hyprland/sops/… + this module) evaluates with the config dormant — PASS

Notes: hm 26.05 dropped home.file.<name>.mode/per-file target, so permissions are tightened by the activation onChange hook; prefer caFile/clientKeyFile paths over the *Data options to keep secret material out of the Nix store.

Rewrites `users/modules/kubernetes.nix` as a clean, portable home-manager user module with a `kubernetes.client.*` namespace (fixes #35). **Behavior** - `kubernetes.client.enable` installs the tools only (`kubectl`, `kubernetes-helm`, `kubelogin`, plus `extraPackages`) and leaves `~/.kube/config` completely untouched — no config is written until a cluster CA is actually configured. - `kubeconfig.enable` renders `~/.kube/config` via `home.file`; it auto-enables only once `caFile` / `caData` / `clientCertificateFile` / `insecureSkipTlsVerify` is set, and an explicit `kubeconfig.enable = true` without any CA source fails a module assertion, so the unsafe `insecure-skip-tls-verify: true` default from the old module can never return silently. - OIDC exec auth (`oidc.*`) generates the kubelogin `exec` block (device-code flow by default, `OIDC_ISSUER_URL`/`OIDC_CLIENT_ID` env, `${env:HOME}/.cache/kubelogin` cache path — expanded by client-go, not a shell). - `users/users/rpickler.nix` is rewired to the new namespace with the Authentik issuer; the kubeconfig stays dormant until a sops-managed `caFile` is added. **Verified** — evaluated against this repo's pinned flake inputs (nixpkgs + home-manager 26.05) with a harness covering: 1. tools-only enable → no `home.file.".kube/config"`, tools on PATH — PASS 2. full kubeconfig with `caData` + OIDC → CA embedded, kubelogin exec block, `force` takeover, `chmod 600` onChange hook, `extraPackages` merged — PASS 3. `kubeconfig.enable` with no CA → assertion rejects — PASS 4. rpickler's real module list (nixvim/hyprland/sops/… + this module) evaluates with the config dormant — PASS Notes: hm 26.05 dropped `home.file.<name>.mode`/per-file `target`, so permissions are tightened by the activation `onChange` hook; prefer `caFile`/`clientKeyFile` paths over the `*Data` options to keep secret material out of the Nix store.

hermes-bot added 1 commit

2026-10-23 11:20:14 +00:00

kubernetes: reimplement client config as portable user module (#35 ) 95b26bc915

Adds users/modules/kubernetes.nix, a dependency-free home-manager
module that installs the client tools and generates a declarative
~/.kube/config (CA by file/data/insecure, kubelogin-oidc exec auth or
client certificates). Exported via flake homeModules.kubernetes-client
so it can be imported from other (work) systems; wired into rpickler's
user config.

hermes-bot referenced this pull request

2026-10-23 11:21:37 +00:00

Rewrite kubernetes client config as user module #35