- All kubernetes components have been seperated into different files
- All TLS-enabled ports have been deprecated and disabled by default
- EasyCert option added to support automatic cluster PKI-bootstrap
- RBAC has been enforced for all cluster components by default
- NixOS kubernetes test cases make use of easyCerts to setup PKI

…lease note for NixOS 19.03

…ger bootstrap

- because the kube-addon-manager drops most of its privileges after
startup.

+ isolate etcd on the master node by letting it listen only on loopback
+ enabling kubelet on master and taint master with NoSchedule

The reason for the latter is that flannel requires all nodes to be "registered"
in the cluster in order to setup the cluster network. This means that the
kubelet is needed even at nodes on which we don't plan to schedule anything.

…net.env

The current postStart step on flannel causes flannel.service to
sometimes hang, even when it's commanded to stop.

…d might fail due to dockerd restarting

Before flannel is ready there is a brief time where docker will be
running with a default docker0 bridge. If kubernetes happens to spawn
containers before flannel is ready, docker can't be restarted when
flannel is ready because some containers are still running on the
docker0 bridge with potentially different network addresses.

Environment variables in `EnvironmentFile` override those defined via
`Environment` in the systemd service config.

Co-authored-by: Christian Albrecht <christian.albrecht@mayflower.de>

zola: 0.5.0 -> 0.5.1

nixos/kubernetes: Module refactor

Darwin and `aarch64-linux` builds currently fail[1][2].

Also cleaned up the `meta` section a bit.

[1] https://github.com/NixOS/nixpkgs/pull/56108/checks?check_run_id=66442317
[2] NixOS/nixpkgs#56108 (comment)

xsel: 2016-09-02 -> 2018-01-10

lepton: init at 1.2.1