lib.recursiveUpdate overwrites lists instead of merging them,
causing base module warnings and assertions to be silently dropped
by k3s.nix and rke2.nix. Replace with lib.mkMerge which properly
concatenates lists through the NixOS module system.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
All kubernetes pods have an infra container (using `pause:latest`) to
setup networking etc. This image is loaded into containerd when kubelet
starts. However, due to a misconfiguration the image can get GC-ed and
kubelet tries to pull it from Docker Hub but the image does not exist
there. This prevents any new pods from being created.
Pinning of the infra image for kubernetes is delegated to the CRI
implementation (containerd) since Kubernetes 1.29, and the
`--pod-infra-container-image` flag does nothing and will be fully
removed in 1.35.
containerd (config version 2) uses the `sandbox_image` setting to know
what images to pin. However, while it normalizes `pause:latest` to
`docker.io/library/pause:latest` in the image list, it does not
normalize the setting value when checking if the image should be pinned
or not. Using the fully qualified name in the setting is enough to make
it be correctly pinned after a full containerd restart.
- services.kubernetes.addons.dns.coredns is now
services.kubernetes.addons.dns.corednsImage
- the default value of the option is now a simple
dockerTools-buildImage
- added rel note for nixos 26.05
K3s module was moved from `nixos/.../k3s` to `nixos/.../rancher`.
`rke2/default.nix` was moved to `rancher/rke2.nix`, and some options from RKE2 were migrated into the common `default.nix` for backwards compatibility.
Manifest generation was also changed, instead of multi-doc YAML files the module now generates `kind: List` manifests.
systemd 258 has the following changes noted in systemd.resource-control(5):
> `CPUAccounting=` setting is deprecated, because it is always available on the unified cgroup hierarchy and such setting has no effect.
This commit removes it from the three services using it directly, as well as one instance of example text.
Signed-off-by: benaryorg <binary@benary.org>
This, and commits to k3s and util-linux close#409339.
The util-linux.withPatches API was a temporary hack for the 25.05
release to fix Kubernetes, and is going away.
While we're at it, we should use util-linuxMinimal because we do not
need things such as systemd support for kubelet initialization.
By being in sync with the pname, it makes it easier to walk back from
the pname that shows in the /nix/store back to the attribute.
This change should not cause any rebuild.
The message incorrectly stated that 'agentToken' or 'agentTokenFile' should be set when role is 'agent', which is misleading. Corrected it to state that these should NOT be set for the 'agent' role.
This enables fetching Helm charts from OCI-based registries. OCI charts
will be detected by checking that the repo has a `oci://` prefix, the
behaviour for regular chart registries remains the same. The `name`
field can be omitted for OCI charts.
