NixOS tests

Author: Lillecarl

.github/workflows/ci.yaml

@@ -262,23 +262,27 @@ jobs:
       - name: Checkout
         uses: actions/checkout@main
 
+      - name: Ensure KVM is available
+        run: |
+          if [ ! -e /dev/kvm ]; then
+            echo "::warning::KVM not available, test will likely fail"
+          fi
+          sudo chmod 666 /dev/kvm || true
+
+
       - name: Setup Nix environment
         uses: ./.github/actions/setup-nix
         with:
           nixbuild_key: ${{ secrets.NIXBUILD_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           cache_key: test-nixos
 
-      - name: Ensure KVM is available
-        run: |
-          if [ ! -e /dev/kvm ]; then
-            echo "::warning::KVM not available, test will likely fail"
-          fi
-          sudo chmod 666 /dev/kvm || true
+      - name: Setup upterm session
+        uses: owenthereal/action-upterm@v1
 
-      - name: Run NixOS integration test
-        run: |
-          nix build --show-trace --file . nixosTests.containerd --print-build-logs
+      # - name: Run NixOS integration test
+      #   run: |
+      #     nix build --file . nixosTests.containerd.driverInteractive --out-link driver
 
   release:
     needs: [build, test-kind-cache, test-kind-nocache]

tests/nixos/cluster-module.nix

@@ -130,6 +130,16 @@
     cores = 4;
   };
 
+  # -- Interactive debug user --
+  users.users.nixkube = {
+    isNormalUser = true;
+    initialPassword = "nixkube";
+    extraGroups = [ "wheel" ];
+  };
+
+  # Allow nixkube to use sudo without password
+  security.sudo.wheelNeedsPassword = false;
+
   # Disable COW on etcd data dir (etcd doesn't tolerate COW filesystems)
   system.activationScripts.noCOWs.text = ''
     ${lib.getExe' pkgs.coreutils "mkdir"} --parents /var/lib/etcd
@@ -140,4 +150,11 @@
   systemd.tmpfiles.rules = [
     "d /var/run/nri 0755 root root -"
   ];
+
+  # Enable external networking for image pulls and nix binary cache access
+  networking = {
+    useDHCP = true;
+    firewall.enable = false;
+  };
+  systemd.services.systemd-resolved.enable = true;
 }