NixCon2023 Nix and Kubernetes: Deployments Done Right
Vložit
- čas přidán 27. 08. 2024
- media.ccc.de/v...
Nix is an amazing build tool not only for applications, but also for the infamous "yaml engineering". Join Volodymyr to learn about the journey of using nix along with argocd to deploy payloads into kubernetes.
What you will learn:
- Setting up nix to work with argocd
- Deploying simple applications written purely in nix
- Utilizing the public helm charts in nix, with custom configuration and resource overriding without the chart forking
- Using nixpkgs' modules system for complicated muti-cluster deployments
Vladimir "farcaller" Pouzanov
talks.nixcon.o...
#nixcon2023
LOVE the Tolkien reference! That was really well done.
I feel like yaml doesn’t have to be repetitive. It’s parsed so like just make a smarter parser and structure the requirements better, yeah?
I don’t particularly care yaml vs Toml most of the time they’re both a lot better than json.
Amazing!! But what about secrets? Do you let them go into the nix store?
You can use sops-nix to encrypt secrets and decrypt during deployment. I believe that they are encrypted in the nix store.
best thing to do with secrets in my experience is to keep them out of git and manifests in general as much as you can by using one of the various operators that can populate them for you from an external secret store.
inserting them with templates and such seems tempting but it's bound to leave secrets in all kinds of places where they don't belong (pod specs, etc.) and adds additional security concerns along the way from git to k8s.
Don't forget if you install nix on Mac you have to install it over, and over, and over, and over, and over again after nearly every macOS update.
macOS' behavior here is very annoying, but happily you don't really need a full reinstall, generally. Updates in macOS usually just overwrites the shell setup files that set up the Nix environment. If you use Nix-Darwin to manage those files, you can just nuke the replacements and let darwin-rebuild replace them again. You don't have to lose /nix/store and redownload/rebuild everything, at least!
@@vpxc Software on macOS should "just work".
@@joebobjoesayshi That's what people say! But in my experience, macOS has never lived up to that slogan.
@@vpxc It has in mine. I think I'll just use MacPorts. Nix shouldn't be released on macOS.
@@vpxc I just upgraded to Sonoma with no ill effects. I use the fish shell tho.