import ../make-test-python.nix ( { pkgs, lib, k3s, etcd, ... }: { name = "${k3s.name}-etcd"; nodes = { etcd = { ... }: { services.etcd = { enable = true; openFirewall = true; listenClientUrls = [ "http://192.168.1.1:2379" "http://127.0.0.1:2379" ]; listenPeerUrls = [ "http://192.168.1.1:2380" ]; initialAdvertisePeerUrls = [ "http://192.168.1.1:2380" ]; initialCluster = [ "etcd=http://192.168.1.1:2380" ]; }; networking = { useDHCP = false; defaultGateway = "192.168.1.1"; interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [ { address = "192.168.1.1"; prefixLength = 24; } ]; }; }; k3s = { pkgs, ... }: { environment.systemPackages = with pkgs; [ jq ]; # k3s uses enough resources the default vm fails. virtualisation.memorySize = 1536; virtualisation.diskSize = 4096; services.k3s = { enable = true; role = "server"; extraFlags = builtins.toString [ "--datastore-endpoint=\"http://192.168.1.1:2379\"" "--disable" "coredns" "--disable" "local-storage" "--disable" "metrics-server" "--disable" "servicelb" "--disable" "traefik" "--node-ip" "192.168.1.2" ]; }; networking = { firewall = { allowedTCPPorts = [ 2379 2380 6443 ]; allowedUDPPorts = [ 8472 ]; }; useDHCP = false; defaultGateway = "192.168.1.2"; interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [ { address = "192.168.1.2"; prefixLength = 24; } ]; }; }; }; testScript = '' with subtest("should start etcd"): etcd.start() etcd.wait_for_unit("etcd.service") with subtest("should wait for etcdctl endpoint status to succeed"): etcd.wait_until_succeeds("etcdctl endpoint status") with subtest("should start k3s"): k3s.start() k3s.wait_for_unit("k3s") with subtest("should test if kubectl works"): k3s.wait_until_succeeds("k3s kubectl get node") with subtest("should wait for service account to show up; takes a sec"): k3s.wait_until_succeeds("k3s kubectl get serviceaccount default") with subtest("should create a sample secret object"): k3s.succeed("k3s kubectl create secret generic nixossecret --from-literal thesecret=abacadabra") with subtest("should check if secret is correct"): k3s.wait_until_succeeds("[[ $(kubectl get secrets nixossecret -o json | jq -r .data.thesecret | base64 -d) == abacadabra ]]") with subtest("should have a secret in database"): etcd.wait_until_succeeds("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]") with subtest("should delete the secret"): k3s.succeed("k3s kubectl delete secret nixossecret") with subtest("should not have a secret in database"): etcd.wait_until_fails("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]") with subtest("should shutdown k3s and etcd"): k3s.shutdown() etcd.shutdown() ''; meta.maintainers = etcd.meta.maintainers ++ k3s.meta.maintainers; } )