diff options
| author | Felix Buehler <account@buehler.rocks> | 2024-02-03 11:16:23 +0100 |
|---|---|---|
| committer | Felix Buehler <account@buehler.rocks> | 2024-02-03 11:16:23 +0100 |
| commit | ffadbb6788b40d9bf84074ecabbf05de8be1daf8 (patch) | |
| tree | 2b036bd9120a8dd70b7933c568f05ccc5a1e76d0 /nixos | |
| parent | 237e77803ea0f34707b154dafcd2f8a47e54798f (diff) | |
| download | nixlib-ffadbb6788b40d9bf84074ecabbf05de8be1daf8.tar nixlib-ffadbb6788b40d9bf84074ecabbf05de8be1daf8.tar.gz nixlib-ffadbb6788b40d9bf84074ecabbf05de8be1daf8.tar.bz2 nixlib-ffadbb6788b40d9bf84074ecabbf05de8be1daf8.tar.lz nixlib-ffadbb6788b40d9bf84074ecabbf05de8be1daf8.tar.xz nixlib-ffadbb6788b40d9bf84074ecabbf05de8be1daf8.tar.zst nixlib-ffadbb6788b40d9bf84074ecabbf05de8be1daf8.zip | |
kubernetes: prefer 'install' over 'mkdir/chmod/chown'
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/services/cluster/kubernetes/pki.nix | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix index 35151ebd6bd7..4b7a86c44a0c 100644 --- a/nixos/modules/services/cluster/kubernetes/pki.nix +++ b/nixos/modules/services/cluster/kubernetes/pki.nix @@ -174,9 +174,8 @@ in '') (optionalString cfg.genCfsslAPIToken '' if [ ! -f "${cfsslAPITokenPath}" ]; then - head -c ${toString (cfsslAPITokenLength / 2)} /dev/urandom | od -An -t x | tr -d ' ' >"${cfsslAPITokenPath}" + install -u cfssl -m 400 <(head -c ${toString (cfsslAPITokenLength / 2)} /dev/urandom | od -An -t x | tr -d ' ') "${cfsslAPITokenPath}" fi - chown cfssl "${cfsslAPITokenPath}" && chmod 400 "${cfsslAPITokenPath}" '')]); systemd.services.kube-certmgr-bootstrap = { @@ -194,7 +193,7 @@ in if [ -f "${cfsslAPITokenPath}" ]; then ln -fs "${cfsslAPITokenPath}" "${certmgrAPITokenPath}" else - touch "${certmgrAPITokenPath}" && chmod 600 "${certmgrAPITokenPath}" + install -m 600 /dev/null "${certmgrAPITokenPath}" fi '' (optionalString (cfg.pkiTrustOnBootstrap) '' @@ -297,8 +296,7 @@ in exit 1 fi - echo $token > ${certmgrAPITokenPath} - chmod 600 ${certmgrAPITokenPath} + install -m 0600 <(echo $token) ${certmgrAPITokenPath} echo "Restarting certmgr..." >&1 systemctl restart certmgr |