nixkube / nix + kube / nix-csi / nix-nri

Mount /nix into Kubernetes pods using the CSI ephemeral volumes or NRI(Node Resource Interface). Volumes share lifetime with Pods and are embedded into the Podspec.

Deploying nixkube

Stick your pubkeys in ./keys and they will be imported into the module system then run the following command and you'll have nixkube deployed.

nix run --file . kubenixEval.deploymentScript -- --yes --prune

If you'd rather mangle YAML yourself you can use

nix build --file . easykubenix.manifestYAMLFile

and stuff the result into Kustomize, a blender or your Kubernetes cluster

Deploying workloads

nixkube supports two methods for injecting Nix stores into pods:

CSI Ephemeral Volumes (Explicit)

Request Nix stores explicitly via CSI volumeAttributes. Specify one or more:

• storePath - Direct nix store path (highest priority)
• flakeRef - Flake reference to build
• nixExpr - Nix expression to evaluate and build

apiVersion: v1
kind: Pod
metadata:
  name: hello-csi
spec:
  containers:
  - name: hello
    image: nixos/nix:latest
    volumeMounts:
    - name: nix
      mountPath: /nix
  volumes:
  - name: nix
    ephemeral:
      volumeClaimTemplate:
        spec:
          accessModes: ["ReadOnlyMany"]
          storageClassName: ephemeral-storage
          resources:
            requests:
              storage: 1Gi
          csi:
            driver: nixkube
            volumeAttributes:
              x86_64-linux: /nix/store/hello-......
              aarch64-linux: /nix/store/hello-......
              flakeRef: github:nixos/nixpkgs/nixos-unstable#hello
              nixExpr: |
                let
                  nixpkgs = builtins.fetchTree {
                    type = "github";
                    owner = "nixos";
                    repo = "nixpkgs";
                    ref = "nixos-unstable";
                  };
                  pkgs = import nixpkgs { };
                in
                pkgs.hello

The first successful option by priority wins.

Tip: For command arrays and environment variables, use lib.getExe to reference executables without managing full store paths:

command = [ (lib.getExe pkgs.hello) ]
env = {
  name = "HELLO_CONFIG";
  value = pkgs.hello-config;
}

NRI Plugin (Automatic via Annotations)

Use pod annotations to automatically inject Nix stores without explicit volume requests:

apiVersion: v1
kind: Pod
metadata:
  name: hello-nri
  annotations:
    nix-nri/pod: |
      /nix/store/hello-......
    nix-nri/pod@aarch64-linux: |
      /nix/store/hello-aarch64-......
spec:
  containers:
  - name: hello
    image: nixos/nix:latest
    # /nix is automatically mounted by NRI plugin

Examples:

• multi-system example
• single-system ci example(s)

Documentation

---

This project is made possible by