diff options
author | Robert Hensing <roberth@users.noreply.github.com> | 2021-06-02 08:18:48 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-06-02 08:18:48 +0200 |
commit | d9e45124431c887bedf665169d20d98e5854d113 (patch) | |
tree | ef668ee66fd5ff1bef3ac50c637ccdaadae968ed /nixos | |
parent | 6a882635f23e709968e77b584ca452e04c5a4ee4 (diff) | |
parent | 1d781e5c80d3c392933479a114e9e3857a1d9529 (diff) |
Merge pull request #124589 from hercules-ci/containers-dnsname
nixos/podman-dnsname: init
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/virtualisation/containers.nix | 22 | ||||
-rw-r--r-- | nixos/modules/virtualisation/podman-dnsname.nix | 36 | ||||
-rw-r--r-- | nixos/modules/virtualisation/podman.nix | 24 | ||||
-rw-r--r-- | nixos/tests/all-tests.nix | 1 | ||||
-rw-r--r-- | nixos/tests/podman-dnsname.nix | 42 |
5 files changed, 123 insertions, 2 deletions
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix index 3974caf2233b5..45d4f877ae5b2 100644 --- a/nixos/modules/virtualisation/containers.nix +++ b/nixos/modules/virtualisation/containers.nix @@ -48,6 +48,23 @@ in description = "containers.conf configuration"; }; + containersConf.cniPlugins = mkOption { + type = types.listOf types.package; + defaultText = '' + [ + pkgs.cni-plugins + ] + ''; + example = lib.literalExample '' + [ + pkgs.cniPlugins.dnsname + ] + ''; + description = '' + CNI plugins to install on the system. + ''; + }; + registries = { search = mkOption { type = types.listOf types.str; @@ -97,8 +114,11 @@ in }; config = lib.mkIf cfg.enable { + + virtualisation.containers.containersConf.cniPlugins = [ pkgs.cni-plugins ]; + virtualisation.containers.containersConf.settings = { - network.cni_plugin_dirs = [ "${pkgs.cni-plugins}/bin/" ]; + network.cni_plugin_dirs = map (p: "${lib.getBin p}/bin") cfg.containersConf.cniPlugins; engine = { init_path = "${pkgs.catatonit}/bin/catatonit"; } // lib.optionalAttrs cfg.ociSeccompBpfHook.enable { diff --git a/nixos/modules/virtualisation/podman-dnsname.nix b/nixos/modules/virtualisation/podman-dnsname.nix new file mode 100644 index 0000000000000..beef19755079c --- /dev/null +++ b/nixos/modules/virtualisation/podman-dnsname.nix @@ -0,0 +1,36 @@ +{ config, lib, pkgs, ... }: +let + inherit (lib) + mkOption + mkIf + types + ; + + cfg = config.virtualisation.podman; + +in +{ + options = { + virtualisation.podman = { + + defaultNetwork.dnsname.enable = mkOption { + type = types.bool; + default = false; + description = '' + Enable DNS resolution in the default podman network. + ''; + }; + + }; + }; + + config = { + virtualisation.containers.containersConf.cniPlugins = mkIf cfg.defaultNetwork.dnsname.enable [ pkgs.dnsname-cni ]; + virtualisation.podman.defaultNetwork.extraPlugins = + lib.optional cfg.defaultNetwork.dnsname.enable { + type = "dnsname"; + domainName = "dns.podman"; + capabilities.aliases = true; + }; + }; +} diff --git a/nixos/modules/virtualisation/podman.nix b/nixos/modules/virtualisation/podman.nix index b16afb6689491..e245004e04a6e 100644 --- a/nixos/modules/virtualisation/podman.nix +++ b/nixos/modules/virtualisation/podman.nix @@ -2,6 +2,7 @@ let cfg = config.virtualisation.podman; toml = pkgs.formats.toml { }; + json = pkgs.formats.json { }; inherit (lib) mkOption types; @@ -22,9 +23,23 @@ let done ''; + net-conflist = pkgs.runCommand "87-podman-bridge.conflist" { + nativeBuildInputs = [ pkgs.jq ]; + extraPlugins = builtins.toJSON cfg.defaultNetwork.extraPlugins; + jqScript = '' + . + { "plugins": (.plugins + $extraPlugins) } + ''; + } '' + jq <${cfg.package}/etc/cni/net.d/87-podman-bridge.conflist \ + --argjson extraPlugins "$extraPlugins" \ + "$jqScript" \ + >$out + ''; + in { imports = [ + ./podman-dnsname.nix ./podman-network-socket.nix (lib.mkRenamedOptionModule [ "virtualisation" "podman" "libpod" ] [ "virtualisation" "containers" "containersConf" ]) ]; @@ -99,6 +114,13 @@ in ''; }; + defaultNetwork.extraPlugins = lib.mkOption { + type = types.listOf json.type; + default = []; + description = '' + Extra CNI plugin configurations to add to podman's default network. + ''; + }; }; @@ -107,7 +129,7 @@ in environment.systemPackages = [ cfg.package ] ++ lib.optional cfg.dockerCompat dockerCompat; - environment.etc."cni/net.d/87-podman-bridge.conflist".source = "${cfg.package}/etc/cni/net.d/87-podman-bridge.conflist"; + environment.etc."cni/net.d/87-podman-bridge.conflist".source = net-conflist; virtualisation.containers = { enable = true; # Enable common /etc/containers configuration diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index f6417170a6fc9..413db7063b82b 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -335,6 +335,7 @@ in plotinus = handleTest ./plotinus.nix {}; podgrab = handleTest ./podgrab.nix {}; podman = handleTestOn ["x86_64-linux"] ./podman.nix {}; + podman-dnsname = handleTestOn ["x86_64-linux"] ./podman-dnsname.nix {}; podman-tls-ghostunnel = handleTestOn ["x86_64-linux"] ./podman-tls-ghostunnel.nix {}; pomerium = handleTestOn ["x86_64-linux"] ./pomerium.nix {}; postfix = handleTest ./postfix.nix {}; diff --git a/nixos/tests/podman-dnsname.nix b/nixos/tests/podman-dnsname.nix new file mode 100644 index 0000000000000..dd352f754dcf2 --- /dev/null +++ b/nixos/tests/podman-dnsname.nix @@ -0,0 +1,42 @@ +import ./make-test-python.nix ( + { pkgs, lib, ... }: + let + inherit (pkgs) writeTextDir python3 curl; + webroot = writeTextDir "index.html" "<h1>Hi</h1>"; + in + { + name = "podman-dnsname"; + meta = { + maintainers = with lib.maintainers; [ roberth ] ++ lib.teams.podman.members; + }; + + nodes = { + podman = { pkgs, ... }: { + virtualisation.podman.enable = true; + virtualisation.podman.defaultNetwork.dnsname.enable = true; + }; + }; + + testScript = '' + podman.wait_for_unit("sockets.target") + + with subtest("DNS works"): # also tests inter-container tcp routing + podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg") + podman.succeed( + "podman run -d --name=webserver -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin -w ${webroot} scratchimg ${python3}/bin/python -m http.server 8000" + ) + podman.succeed("podman ps | grep webserver") + podman.succeed(""" + for i in `seq 0 120`; do + podman run --rm --name=client -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg ${curl}/bin/curl http://webserver:8000 >/dev/console \ + && exit 0 + sleep 0.5 + done + exit 1 + """) + podman.succeed("podman stop webserver") + podman.succeed("podman rm webserver") + + ''; + } +) |