Skip to content

Commit 4773b9f

Browse files
farcallerfarcaller
authored
Add the nix setup guidelines (#244)
Signed-off-by: Vladimir Pouzanov <[email protected]>
1 parent 25eeaf3 commit 4773b9f

File tree

4 files changed

+192
-0
lines changed

4 files changed

+192
-0
lines changed

‎plugins/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,4 @@
44
|-------------|-------------|
55
| [kasane](kasane/) | The guestbook application as a `kasane` package. |
66
| [kustomized-helm](kustomized-helm/) | Application comprised of a `helm` chart and customized using `kustomize` |
7+
| [nix](nix/) | Application comprised of a `helm` chart built and customized using `nix` |

‎plugins/nix/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
result

‎plugins/nix/README.md

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# nix
2+
3+
[nix](https://nixos.org/) is a tool that takes a unique approach to package
4+
management and system configuration.
5+
6+
This setup is based on the [NixCon 2023 talk](https://www.youtube.com/watch?v=SEA1Qm8K4gY).
7+
8+
## Set up the argo-cd installation for nix support
9+
10+
This setup uses the stock `nixos/nix:latest` image without any modifications.
11+
That requires some changes in runtime, as nix cannot run as user 999 our of the
12+
box.
13+
14+
Add the following bits to the values.yaml of your helm deployment:
15+
16+
```yaml
17+
repoServer:
18+
volumes:
19+
- name: nix-cmp-config
20+
configMap:
21+
name: nix-cmp-config
22+
- name: nix-cmp-tmp
23+
emptyDir: {}
24+
- name: nix-cmp-nix
25+
emptyDir: {}
26+
- name: nix-cmp-home
27+
emptyDir: {}
28+
initContainers:
29+
- name: nix-bootstrap
30+
# the init container copies the whole nix store and profiles into the
31+
# temporary volume and makes sure the permissions are correct
32+
command:
33+
- "sh"
34+
- "-c"
35+
- "cp -a /nix/* /nixvol && chown -R 999 /nixvol/*"
36+
image: nixos/nix:latest
37+
# the image will always be updated at init step, so the one in the
38+
# extraContainers must have the policy of Never to always be the same
39+
# exact image.
40+
imagePullPolicy: Always
41+
volumeMounts:
42+
- mountPath: /nixvol
43+
name: nix-cmp-nix
44+
extraContainers:
45+
- name: nix-cmp-plugin
46+
command:
47+
- /var/run/argocd/argocd-cmp-server
48+
image: nixos/nix:latest
49+
imagePullPolicy: Never
50+
securityContext:
51+
runAsNonRoot: true
52+
runAsUser: 999
53+
volumeMounts:
54+
- mountPath: /var/run/argocd
55+
name: var-files
56+
- mountPath: /home/argocd/cmp-server/plugins
57+
name: plugins
58+
- mountPath: /home/argocd/cmp-server/config/plugin.yaml
59+
subPath: plugin.yaml
60+
name: nix-cmp-config
61+
- mountPath: /etc/passwd
62+
subPath: passwd
63+
name: nix-cmp-config
64+
- mountPath: /etc/nix/nix.conf
65+
subPath: nix.conf
66+
name: nix-cmp-config
67+
- mountPath: /tmp
68+
name: nix-cmp-tmp
69+
- mountPath: /nix
70+
name: nix-cmp-nix
71+
- mountPath: /home/nix
72+
name: nix-cmp-home
73+
```
74+
75+
## Add the plugin ConfigMap:
76+
77+
```yaml
78+
apiVersion: v1
79+
kind: ConfigMap
80+
metadata:
81+
name: nix-cmp-config
82+
namespace: argocd
83+
data:
84+
nix.conf: |
85+
build-users-group = nixbld
86+
sandbox = false
87+
experimental-features = nix-command flakes
88+
substituters = https://cache.nixos.org https://nixhelm.cachix.org
89+
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nixhelm.cachix.org-1:esqauAsR4opRF0UsGrA6H3gD21OrzMnBBYvJXeddjtY=
90+
passwd: |
91+
nix:x:999:30000:Nix build user 1:/home/nix:/bin/false
92+
root:x:0:0::/root:/bin/bash
93+
plugin.yaml: |
94+
apiVersion: argoproj.io/v1alpha1
95+
kind: ConfigManagementPlugin
96+
metadata:
97+
name: nix-cmp-plugin
98+
spec:
99+
discover:
100+
fileName: flake.nix
101+
generate:
102+
command:
103+
- sh
104+
- "-c"
105+
- cat result
106+
init:
107+
command:
108+
- sh
109+
- "-c"
110+
- |
111+
export OUTPUT="${ARGOCD_ENV_NIX_OUTPUT:-kubernetesConfiguration}"
112+
echo -ne "Building for $OUTPUT\n" >/dev/stderr
113+
if [ "$PARAM_VALUES" != "" ]; then
114+
echo -ne "With values\n" >/dev/stderr
115+
echo "$PARAM_VALUES" > values.json
116+
nix-shell -p git --run ''git add values.json''
117+
fi
118+
if [ "$PARAM_IMPURE" == "true" ]; then
119+
echo -ne "With impure\n" >/dev/stderr
120+
IMPURE_FLAG="--impure"
121+
else
122+
IMPURE_FLAG=""
123+
fi
124+
nix build $IMPURE_FLAG ".#${OUTPUT}"
125+
lockRepo: true
126+
name: nix-cmp-plugin
127+
version: v1.0
128+
```
129+
130+
## Create a nix-based application
131+
132+
```
133+
argocd app create simple-nginx \
134+
--repo https://github.com/argoproj/argocd-example-apps \
135+
--path plugins/nix \
136+
--dest-server https://kubernetes.default.svc \
137+
--dest-namespace default
138+
```

‎plugins/nix/flake.nix

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
inputs.nixhelm.url = "github:farcaller/nixhelm";
3+
inputs.kubegen.url = "github:farcaller/nix-kube-generators";
4+
5+
outputs = { self, nixpkgs, nixhelm, kubegen, flake-utils }: flake-utils.lib.eachDefaultSystem (system:
6+
let
7+
pkgs = nixpkgs.legacyPackages.${system};
8+
kubelib = kubegen.lib { inherit pkgs; };
9+
10+
addResources = yamlObjects: resources: builtins.foldl'
11+
(acc: y: acc ++ [ y ])
12+
resources
13+
yamlObjects;
14+
15+
# You can define k8s objects using standard nix syntax
16+
configMap = {
17+
apiVersion = "v1";
18+
kind = "ConfigMap";
19+
metadata.name = "website";
20+
data."index.html" = ''
21+
<html>
22+
<body>
23+
<h1>Hello, nix world!</h1>
24+
</body>
25+
</html>
26+
'';
27+
};
28+
in
29+
{
30+
packages.kubernetesConfiguration = pkgs.lib.pipe
31+
{
32+
name = "nginx";
33+
# nixhelm provides a repository of various public helm charts converted to nix
34+
chart = nixhelm.chartsDerivations.${system}.bitnami.nginx;
35+
namespace = "default";
36+
values = {
37+
replicaCount = 2;
38+
revisionHistoryLimit = 3;
39+
staticSiteConfigmap = configMap.metadata.name;
40+
};
41+
} [
42+
# lib.pipe is a handy function to run the processing over several functions in a sequence.
43+
# The final output must gnerate a YAML file.
44+
kubelib.buildHelmChart
45+
builtins.readFile
46+
kubelib.fromYAML
47+
(addResources [configMap])
48+
kubelib.mkList
49+
kubelib.toYAMLFile
50+
];
51+
});
52+
}

0 commit comments

Comments
 (0)