nixos/k3s: use the systemd driver for docker + unified cgroups
This is necessary for it to work at all. The single-node-docker test will fail without this change. Also add a release note for it.
This commit is contained in:
parent
8aaa0699db
commit
e6d1c597f1
|
@ -364,6 +364,20 @@
|
|||
relying on the insecure behaviour before upgrading.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<literal>services.k3s.enable</literal> no longer implies
|
||||
<literal>systemd.enableUnifiedCgroupHierarchy = false</literal>,
|
||||
and will default to the <quote>systemd</quote> cgroup driver
|
||||
when using <literal>services.k3s.docker = true</literal>. This
|
||||
change may require a reboot to take effect, and k3s may not be
|
||||
able to run if the boot cgroup hierarchy does not match its
|
||||
configuration. The previous behavior may be retained by
|
||||
explicitly setting
|
||||
<literal>systemd.enableUnifiedCgroupHierarchy = false</literal>
|
||||
in your configuration.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The DHCP server (<literal>services.dhcpd4</literal>,
|
||||
|
|
|
@ -121,6 +121,10 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||
|
||||
- `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading.
|
||||
|
||||
- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
|
||||
This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
|
||||
The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.
|
||||
|
||||
- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
|
||||
The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
|
||||
The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
|
||||
|
|
|
@ -114,6 +114,7 @@ in
|
|||
[
|
||||
"${cfg.package}/bin/k3s ${cfg.role}"
|
||||
] ++ (optional cfg.docker "--docker")
|
||||
++ (optional (cfg.docker && config.systemd.enableUnifiedCgroupHierarchy) "--kubelet-arg=cgroup-driver=systemd")
|
||||
++ (optional cfg.disableAgent "--disable-agent")
|
||||
++ (optional (cfg.serverAddr != "") "--server ${cfg.serverAddr}")
|
||||
++ (optional (cfg.token != "") "--token ${cfg.token}")
|
||||
|
|
Loading…
Reference in a new issue