summaryrefslogtreecommitdiffstats
path: root/nixos/modules/virtualisation
diff options
context:
space:
mode:
Diffstat (limited to 'nixos/modules/virtualisation')
-rw-r--r--nixos/modules/virtualisation/amazon-image.nix3
-rw-r--r--nixos/modules/virtualisation/azure-agent.nix2
-rw-r--r--nixos/modules/virtualisation/brightbox-image.nix2
-rw-r--r--nixos/modules/virtualisation/ec2-metadata-fetcher.nix80
-rw-r--r--nixos/modules/virtualisation/nixos-containers.nix22
-rw-r--r--nixos/modules/virtualisation/openstack-config.nix2
-rw-r--r--nixos/modules/virtualisation/openstack-metadata-fetcher.nix21
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix2
-rw-r--r--nixos/modules/virtualisation/xen-dom0.nix4
9 files changed, 107 insertions, 31 deletions
diff --git a/nixos/modules/virtualisation/amazon-image.nix b/nixos/modules/virtualisation/amazon-image.nix
index 44cb60809452..26297a7d0f1f 100644
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@@ -11,6 +11,7 @@ with lib;
let
cfg = config.ec2;
metadataFetcher = import ./ec2-metadata-fetcher.nix {
+ inherit (pkgs) curl;
targetRoot = "$targetRoot/";
wgetExtraOptions = "-q";
};
@@ -123,7 +124,7 @@ in
boot.initrd.extraUtilsCommands =
''
# We need swapon in the initrd.
- copy_bin_and_libs ${pkgs.utillinux}/sbin/swapon
+ copy_bin_and_libs ${pkgs.util-linux}/sbin/swapon
'';
# Don't put old configurations in the GRUB menu. The user has no
diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix
index e85482af8392..81413792eda0 100644
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@@ -22,7 +22,7 @@ let
nettools # for hostname
procps # for pidof
shadow # for useradd, usermod
- utillinux # for (u)mount, fdisk, sfdisk, mkswap
+ util-linux # for (u)mount, fdisk, sfdisk, mkswap
parted
];
pythonPath = [ pythonPackages.pyasn1 ];
diff --git a/nixos/modules/virtualisation/brightbox-image.nix b/nixos/modules/virtualisation/brightbox-image.nix
index d0efbcc808aa..4498e3a73618 100644
--- a/nixos/modules/virtualisation/brightbox-image.nix
+++ b/nixos/modules/virtualisation/brightbox-image.nix
@@ -27,7 +27,7 @@ in
popd
'';
diskImageBase = "nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.raw";
- buildInputs = [ pkgs.utillinux pkgs.perl ];
+ buildInputs = [ pkgs.util-linux pkgs.perl ];
exportReferencesGraph =
[ "closure" config.system.build.toplevel ];
}
diff --git a/nixos/modules/virtualisation/ec2-metadata-fetcher.nix b/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
index b531787c31a2..dca5c2abd4e0 100644
--- a/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
+++ b/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
@@ -1,23 +1,77 @@
-{ targetRoot, wgetExtraOptions }:
+{ curl, targetRoot, wgetExtraOptions }:
+# Note: be very cautious about dependencies, each dependency grows
+# the closure of the initrd. Ideally we would not even require curl,
+# but there is no reasonable way to send an HTTP PUT request without
+# it. Note: do not be fooled: the wget referenced in this script
+# is busybox's wget, not the fully featured one with --method support.
+#
+# Make sure that every package you depend on here is already listed as
+# a channel blocker for both the full-sized and small channels.
+# Otherwise, we risk breaking user deploys in released channels.
+#
+# Also note: OpenStack's metadata service for its instances aims to be
+# compatible with the EC2 IMDS. Where possible, try to keep the set of
+# fetched metadata in sync with ./openstack-metadata-fetcher.nix .
''
metaDir=${targetRoot}etc/ec2-metadata
mkdir -m 0755 -p "$metaDir"
+ rm -f "$metaDir/*"
- echo "getting EC2 instance metadata..."
+ get_imds_token() {
+ # retry-delay of 1 selected to give the system a second to get going,
+ # but not add a lot to the bootup time
+ ${curl}/bin/curl \
+ -v \
+ --retry 3 \
+ --retry-delay 1 \
+ --fail \
+ -X PUT \
+ --connect-timeout 1 \
+ -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \
+ http://169.254.169.254/latest/api/token
+ }
- if ! [ -e "$metaDir/ami-manifest-path" ]; then
- wget ${wgetExtraOptions} -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
- fi
+ preflight_imds_token() {
+ # retry-delay of 1 selected to give the system a second to get going,
+ # but not add a lot to the bootup time
+ ${curl}/bin/curl \
+ -v \
+ --retry 3 \
+ --retry-delay 1 \
+ --fail \
+ --connect-timeout 1 \
+ -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
+ http://169.254.169.254/1.0/meta-data/instance-id
+ }
- if ! [ -e "$metaDir/user-data" ]; then
- wget ${wgetExtraOptions} -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
- fi
+ try=1
+ while [ $try -le 3 ]; do
+ echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."
+ IMDS_TOKEN=$(get_imds_token) && break
+ try=$((try + 1))
+ sleep 1
+ done
- if ! [ -e "$metaDir/hostname" ]; then
- wget ${wgetExtraOptions} -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
+ if [ "x$IMDS_TOKEN" == "x" ]; then
+ echo "failed to fetch an IMDS2v token."
fi
- if ! [ -e "$metaDir/public-keys-0-openssh-key" ]; then
- wget ${wgetExtraOptions} -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
- fi
+ try=1
+ while [ $try -le 10 ]; do
+ echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."
+ preflight_imds_token && break
+ try=$((try + 1))
+ sleep 1
+ done
+
+ echo "getting EC2 instance metadata..."
+
+ wget_imds() {
+ wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@";
+ }
+
+ wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
+ wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
+ wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
+ wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
''
diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index 8fbb4efd2019..26398afb3cf5 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -614,17 +614,17 @@ in
'';
};
- timeoutStartSec = mkOption {
- type = types.str;
- default = "1min";
- description = ''
- Time for the container to start. In case of a timeout,
- the container processes get killed.
- See <citerefentry><refentrytitle>systemd.time</refentrytitle>
- <manvolnum>7</manvolnum></citerefentry>
- for more information about the format.
- '';
- };
+ timeoutStartSec = mkOption {
+ type = types.str;
+ default = "1min";
+ description = ''
+ Time for the container to start. In case of a timeout,
+ the container processes get killed.
+ See <citerefentry><refentrytitle>systemd.time</refentrytitle>
+ <manvolnum>7</manvolnum></citerefentry>
+ for more information about the format.
+ '';
+ };
bindMounts = mkOption {
type = with types; attrsOf (submodule bindMountOpts);
diff --git a/nixos/modules/virtualisation/openstack-config.nix b/nixos/modules/virtualisation/openstack-config.nix
index c2da5d0d2301..d01e0f23aba1 100644
--- a/nixos/modules/virtualisation/openstack-config.nix
+++ b/nixos/modules/virtualisation/openstack-config.nix
@@ -3,7 +3,7 @@
with lib;
let
- metadataFetcher = import ./ec2-metadata-fetcher.nix {
+ metadataFetcher = import ./openstack-metadata-fetcher.nix {
targetRoot = "/";
wgetExtraOptions = "--retry-connrefused";
};
diff --git a/nixos/modules/virtualisation/openstack-metadata-fetcher.nix b/nixos/modules/virtualisation/openstack-metadata-fetcher.nix
new file mode 100644
index 000000000000..8c191397cf9a
--- /dev/null
+++ b/nixos/modules/virtualisation/openstack-metadata-fetcher.nix
@@ -0,0 +1,21 @@
+{ targetRoot, wgetExtraOptions }:
+
+# OpenStack's metadata service aims to be EC2-compatible. Where
+# possible, try to keep the set of fetched metadata in sync with
+# ./ec2-metadata-fetcher.nix .
+''
+ metaDir=${targetRoot}etc/ec2-metadata
+ mkdir -m 0755 -p "$metaDir"
+ rm -f "$metaDir/*"
+
+ echo "getting instance metadata..."
+
+ wget_imds() {
+ wget ${wgetExtraOptions} "$@"
+ }
+
+ wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
+ wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
+ wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
+ wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
+''
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 33da920e94cc..447d1f091c8c 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -190,7 +190,7 @@ let
'' else ''
''}
'';
- buildInputs = [ pkgs.utillinux ];
+ buildInputs = [ pkgs.util-linux ];
QEMU_OPTS = "-nographic -serial stdio -monitor none"
+ lib.optionalString cfg.useEFIBoot (
" -drive if=pflash,format=raw,unit=0,readonly=on,file=${efiFirmware}"
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index 7b2a66c43489..5ad647769bbd 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -201,8 +201,8 @@ in
''
if [ -d /proc/xen ]; then
${pkgs.kmod}/bin/modprobe xenfs 2> /dev/null
- ${pkgs.utillinux}/bin/mountpoint -q /proc/xen || \
- ${pkgs.utillinux}/bin/mount -t xenfs none /proc/xen
+ ${pkgs.util-linux}/bin/mountpoint -q /proc/xen || \
+ ${pkgs.util-linux}/bin/mount -t xenfs none /proc/xen
fi
'';
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 01:33:27 +0000