uboot: (firmwareOdroidC2/C4) don't invoke patch tool, use patches = [] instead

https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/generic/setup.sh#L948
this can do it nicely.

Signed-off-by: Anton Arapov <anton@deadbeef.mx>

pkgs/applications/networking/cluster/argo-rollouts/default.nix

@@ -0,0 +1,27 @@
+{ buildGoModule, lib, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "argo-rollouts";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "argoproj";
+    repo = "argo-rollouts";
+    rev = "v${version}";
+    sha256 = "sha256-1oF93+pN9wyCq5R5bTeMN/uzg9DHpc/AkX/d1lB5r1g=";
+  };
+
+  vendorSha256 = "sha256-URuIeF1ejKdMGxziJbujLctYheiIr/Jfo+gTzppZG9E=";
+
+  # Disable tests since some test fail because of missing test data
+  doCheck = false;
+
+  subPackages = [ "cmd/rollouts-controller" "cmd/kubectl-argo-rollouts" ];
+
+  meta = with lib; {
+    description = "Kubernetes Progressive Delivery Controller";
+    homepage = "https://github.com/argoproj/argo-rollouts/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ psibi ];
+  };
+}

pkgs/applications/networking/cluster/argo/default.nix

@@ -0,0 +1,72 @@
+{ lib, buildGoModule, buildGoPackage, fetchFromGitHub, installShellFiles, pkgsBuildBuild, stdenv }:
+
+let
+  # Argo can package a static server in the CLI using the `staticfiles` go module.
+  # We build the CLI without the static server for simplicity, but the tool is still required for
+  # compilation to succeed.
+  # See: https://github.com/argoproj/argo/blob/d7690e32faf2ac5842468831daf1443283703c25/Makefile#L117
+  staticfiles = pkgsBuildBuild.buildGoPackage rec {
+    name = "staticfiles";
+    src = fetchFromGitHub {
+      owner = "bouk";
+      repo = "staticfiles";
+      rev = "827d7f6389cd410d0aa3f3d472a4838557bf53dd";
+      sha256 = "0xarhmsqypl8036w96ssdzjv3k098p2d4mkmw5f6hkp1m3j67j61";
+    };
+
+    goPackagePath = "bou.ke/staticfiles";
+  };
+in
+buildGoModule rec {
+  pname = "argo";
+  version = "3.3.5";
+
+  src = fetchFromGitHub {
+    owner = "argoproj";
+    repo = "argo";
+    rev = "v${version}";
+    sha256 = "sha256-EeGpJliE38MroeScdmeMp36rEDld59zDEM5i4QqxYik=";
+  };
+
+  vendorSha256 = "sha256-cq452XEGMVbLvfJ/UiVyOvnUSJr196owB3SyBYnAmZ0=";
+
+  doCheck = false;
+
+  subPackages = [ "cmd/argo" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  preBuild = ''
+    mkdir -p ui/dist/app
+    echo "Built without static files" > ui/dist/app/index.html
+
+    ${staticfiles}/bin/staticfiles -o server/static/files.go ui/dist/app
+  '';
+
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/argoproj/argo-workflows/v3.buildDate=unknown"
+    "-X github.com/argoproj/argo-workflows/v3.gitCommit=${src.rev}"
+    "-X github.com/argoproj/argo-workflows/v3.gitTag=${src.rev}"
+    "-X github.com/argoproj/argo-workflows/v3.gitTreeState=clean"
+    "-X github.com/argoproj/argo-workflows/v3.version=${version}"
+  ];
+
+  postInstall = ''
+    for shell in bash zsh; do
+      ${if (stdenv.buildPlatform == stdenv.hostPlatform)
+        then "$out/bin/argo"
+        else "${pkgsBuildBuild.argo}/bin/argo"
+      } completion $shell > argo.$shell
+      installShellCompletion argo.$shell
+    done
+  '';
+
+  meta = with lib; {
+    description = "Container native workflow engine for Kubernetes";
+    homepage = "https://github.com/argoproj/argo";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ groodt ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/argocd-autopilot/default.nix

@@ -0,0 +1,54 @@
+{ lib, stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "argocd-autopilot";
+  version = "0.3.7";
+
+  src = fetchFromGitHub {
+    owner = "argoproj-labs";
+    repo = "argocd-autopilot";
+    rev = "v${version}";
+    sha256 = "sha256-dLmJQCASdWkzWOPQ0bdJLe2AD06+L2ghP2yWry1XL1k=";
+  };
+
+  vendorSha256 = "sha256-0v/HTiQf/mZUU1b55jAnSj86NEFOUaiM+/MrVvwJYBM=";
+
+  proxyVendor = true;
+
+  ldflags =
+    let package_url = "github.com/argoproj-labs/argocd-autopilot/pkg/store"; in
+    [
+      "-s"
+      "-w"
+      "-X ${package_url}.binaryName=${pname}"
+      "-X ${package_url}.version=${src.rev}"
+      "-X ${package_url}.buildDate=unknown"
+      "-X ${package_url}.gitCommit=${src.rev}"
+      "-X ${package_url}.installationManifestsURL=github.com/argoproj-labs/argocd-autopilot/manifests/base?ref=${src.rev}"
+      "-X ${package_url}.installationManifestsNamespacedURL=github.com/argoproj-labs/argocd-autopilot/manifests/insecure?ref=${src.rev}"
+    ];
+
+  subPackages = [ "cmd" ];
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/argocd-autopilot version | grep ${src.rev} > /dev/null
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -Dm755 "$GOPATH/bin/cmd" -T $out/bin/argocd-autopilot
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "ArgoCD Autopilot";
+    downloadPage = "https://github.com/argoproj-labs/argocd-autopilot";
+    homepage = "https://argocd-autopilot.readthedocs.io/en/stable/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ sagikazarmark bryanasdev000 ];
+  };
+}

pkgs/applications/networking/cluster/argocd/default.nix

@@ -0,0 +1,63 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "argocd";
+  version = "2.3.4";
+
+  src = fetchFromGitHub {
+    owner = "argoproj";
+    repo = "argo-cd";
+    rev = "v${version}";
+    sha256 = "sha256-pWDwmsLCXoK8EzipOPXUdYu75hPm5AIExXmgoA102Dg=";
+  };
+
+  vendorSha256 = "sha256-XrIIMnn65Y10KnVTsmw6vLE53Zra1lWNFgklmaj3gF8=";
+
+  # Set target as ./cmd per cli-local
+  # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
+  subPackages = [ "cmd" ];
+
+  ldflags =
+    let package_url = "github.com/argoproj/argo-cd/v2/common"; in
+    [
+      "-s" "-w"
+      "-X ${package_url}.version=${version}"
+      "-X ${package_url}.buildDate=unknown"
+      "-X ${package_url}.gitCommit=${src.rev}"
+      "-X ${package_url}.gitTag=${src.rev}"
+      "-X ${package_url}.gitTreeState=clean"
+      "-X ${package_url}.kubectlVersion=v0.23.1"
+      # NOTE: Update kubectlVersion when upgrading this package with
+      # go list -m k8s.io/client-go | head -n 1 | rev | cut -d' ' -f1 | rev
+      # Per https://github.com/argoproj/argo-cd/blob/master/Makefile#L18
+      # Will need a way to automate it :P
+    ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    install -Dm755 "$GOPATH/bin/cmd" -T $out/bin/argocd
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/argocd version --client | grep ${src.rev} > /dev/null
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd argocd \
+      --bash <($out/bin/argocd completion bash) \
+      --zsh <($out/bin/argocd completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "Declarative continuous deployment for Kubernetes";
+    downloadPage = "https://github.com/argoproj/argo-cd";
+    homepage = "https://argo-cd.readthedocs.io/en/stable/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ shahrukh330 bryanasdev000 ];
+  };
+}

pkgs/applications/networking/cluster/arkade/default.nix

@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "arkade";
+  version = "0.8.25";
+
+  src = fetchFromGitHub {
+    owner = "alexellis";
+    repo = "arkade";
+    rev = version;
+    sha256 = "sha256-m4vgQ4K73qmUMwPtviUQuRC2jNIDlE516WEZkFr3Upw=";
+  };
+
+  CGO_ENABLED = 0;
+
+  vendorSha256 = "sha256-E+fjDW7UIAYDiDI8Eb8atAtccEIRcV5hqYdSxRYM9fc=";
+
+  # Exclude pkg/get: tests downloading of binaries which fail when sandbox=true
+  subPackages = [
+    "."
+    "cmd"
+    "pkg/apps"
+    "pkg/archive"
+    "pkg/config"
+    "pkg/env"
+    "pkg/helm"
+    "pkg/k8s"
+    "pkg/types"
+  ];
+
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/alexellis/arkade/cmd.GitCommit=ref/tags/${version}"
+    "-X github.com/alexellis/arkade/cmd.Version=${version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/alexellis/arkade";
+    description = "Open Source Kubernetes Marketplace";
+    license = licenses.mit;
+    maintainers = with maintainers; [ welteki techknowlogick ];
+  };
+}

pkgs/applications/networking/cluster/assign-lb-ip/default.nix

@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "assign-lb-ip";
+  version = "2.3.1";
+
+  src = fetchFromGitHub {
+    owner = "Nordix";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Sfi58wcX61HNCmlDoparTqnfsuxu6barSnV0uYlC+ng=";
+  };
+
+  vendorSha256 = "sha256-N78a0pjs2Bg2Bslk/I0ntL88ui4IkRGenL0Pn17Lt/w=";
+
+  meta = with lib; {
+    description = "Assigns loadBalancerIP address to a Kubernetes service for testing purposes";
+    homepage    = "https://github.com/Nordix/assign-lb-ip";
+    license     = licenses.asl20;
+    maintainers = [ maintainers.starcraft66 ];
+  };
+}

pkgs/applications/networking/cluster/atlantis/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "atlantis";
+  version = "0.19.2";
+
+  src = fetchFromGitHub {
+    owner = "runatlantis";
+    repo = "atlantis";
+    rev = "v${version}";
+    sha256 = "sha256-cd2dhrqJl/VRhOYB1g9OpOnPV92EQm8f3rRGZGVN+IY=";
+  };
+
+  vendorSha256 = "sha256-ux+Hw/TjeiY9VYhIQxaltZGk5CkxAab8R7kAsTaMUGc=";
+
+  subPackages = [ "." ];
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/atlantis version | grep ${version} > /dev/null
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/runatlantis/atlantis";
+    description = "Terraform Pull Request Automation";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jpotier ];
+  };
+}

pkgs/applications/networking/cluster/bosh-cli/default.nix

@@ -0,0 +1,44 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, makeWrapper
+, openssh
+}:
+
+buildGoModule rec {
+  pname = "bosh-cli";
+
+  version = "6.4.17";
+
+  src = fetchFromGitHub {
+    owner = "cloudfoundry";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-oVL7tBtdFJt6ktctSZiNZMd6g1LEWQ/Hra4rcGM6BnQ=";
+  };
+  vendorSha256 = null;
+
+  postPatch = ''
+    substituteInPlace cmd/version.go --replace '[DEV BUILD]' '${version}'
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  subPackages = [ "." ];
+
+  doCheck = false;
+
+  postInstall = ''
+    mv $out/bin/bosh-cli $out/bin/bosh
+    wrapProgram $out/bin/bosh --prefix PATH : '${lib.makeBinPath [ openssh ]}'
+  '';
+
+  meta = with lib; {
+    description = "A command line interface to CloudFoundry BOSH";
+    homepage = "https://bosh.io";
+    changelog = "https://github.com/cloudfoundry/bosh-cli/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ris ];
+    mainProgram = "bosh";
+  };
+}

pkgs/applications/networking/cluster/cilium/default.nix

@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "cilium-cli";
+  version = "0.11.7";
+
+  src = fetchFromGitHub {
+    owner = "cilium";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-4+4E7v/b74DDekqymH8PR7/GfH3GGzSQFQk24VJisQ0=";
+  };
+
+  vendorSha256 = null;
+
+  meta = with lib; {
+    description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
+    license = licenses.asl20;
+    homepage = "https://www.cilium.io/";
+    maintainers = with maintainers; [ humancalico ];
+    mainProgram = "cilium";
+  };
+}

pkgs/applications/networking/cluster/civo/default.nix

@@ -0,0 +1,40 @@
+{ stdenv, lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "civo";
+  version = "1.0.28";
+
+  src = fetchFromGitHub {
+    owner  = "civo";
+    repo   = "cli";
+    rev    = "v${version}";
+    sha256 = "sha256-PuLmjX7ps0pdfaDpshWrc67OW83/jpB4HkNCi1fzpAU=";
+  };
+
+  vendorSha256 = "sha256-VMBMiwBFXKe+E4Xzcmhu2Ge5JzS+jIbUtxTfp+B0EWE=";
+
+  CGO_ENABLED = 0;
+
+  # Some lint checks fail
+  doCheck = false;
+
+  ldflags = [
+    "-s"
+    "-X github.com/civo/cli/cmd.VersionCli=${version}"
+    "-X github.com/civo/cli/cmd.CommitCli=${src.rev}"
+    "-X github.com/civo/cli/cmd.DateCli=unknown"
+  ];
+
+  doInstallCheck = false;
+
+  postInstall = ''
+    mv $out/bin/cli $out/bin/civo
+  '';
+
+  meta = with lib; {
+    description = "CLI for interacting with Civo resources";
+    homepage = "https://github.com/civo/cli";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ berryp ];
+  };
+}

pkgs/applications/networking/cluster/click/default.nix

@@ -0,0 +1,27 @@
+{ darwin, fetchFromGitHub, rustPlatform, lib, stdenv }:
+
+with rustPlatform;
+
+buildRustPackage rec {
+  pname = "click";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "databricks";
+    repo = "click";
+    sha256 = "18mpzvvww2g6y2d3m8wcfajzdshagihn59k03xvcknd5d8zxagl3";
+  };
+
+  cargoSha256 = "16r5rwdbqyb5xrjc55i30xb20crpyjc75zn10xxjkicmvrpwydp6";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+
+  meta = with lib; {
+    description = ''The "Command Line Interactive Controller for Kubernetes"'';
+    homepage = "https://github.com/databricks/click";
+    license = [ licenses.asl20 ];
+    maintainers = [ maintainers.mbode ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+}

pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix

@@ -0,0 +1,45 @@
+{ lib, buildGoModule, fetchFromGitHub, fetchurl, installShellFiles }:
+
+buildGoModule rec {
+  pname = "cloudfoundry-cli";
+  version = "8.3.0";
+
+  src = fetchFromGitHub {
+    owner = "cloudfoundry";
+    repo = "cli";
+    rev = "v${version}";
+    sha256 = "sha256-tC9U0yvuMEwO4mzWyUC+v+/H0EzgwTu02waTQrx19Bs=";
+  };
+  vendorSha256 = "sha256-aXq92SI4cgJrmo67SEfg8YKPEpO2UW2fcYnKq9TmAQg=";
+
+  subPackages = [ "." ];
+
+  # upstream have helpfully moved the bash completion script to a separate
+  # repo which receives no releases or even tags
+  bashCompletionScript = fetchurl {
+    url = "https://raw.githubusercontent.com/cloudfoundry/cli-ci/5f4f0d5d01e89c6333673f0fa96056749e71b3cd/ci/installers/completion/cf8";
+    sha256 = "06w26kpnjd3f2wdjhb4pp0kaq2gb9kf87v7pjd9n2g7s7qhdqyhy";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
+    "-X code.cloudfoundry.org/cli/version.binaryVersion=${version}"
+  ];
+
+  postInstall = ''
+    mv "$out/bin/cli" "$out/bin/cf"
+    installShellCompletion --bash $bashCompletionScript
+  '';
+
+  meta = with lib; {
+    description = "The official command line client for Cloud Foundry";
+    homepage = "https://github.com/cloudfoundry/cli";
+    maintainers = with maintainers; [ ris ];
+    mainProgram = "cf";
+    license = licenses.asl20;
+  };
+}

pkgs/applications/networking/cluster/clusterctl/default.nix

@@ -0,0 +1,41 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "clusterctl";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes-sigs";
+    repo = "cluster-api";
+    rev = "v${version}";
+    sha256 = "sha256-0hQ+FicY74I5Fpl4FQsYMtQyBgzRnUeXl/vsNQ6GHZw=";
+  };
+
+  vendorSha256 = "sha256-PLUN9d+oo7vHUUpiIBUgU1snPlsHOMt+8q+jQZzZC+8=";
+
+  subPackages = [ "cmd/clusterctl" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = let t = "sigs.k8s.io/cluster-api/version"; in [
+    "-X ${t}.gitMajor=${lib.versions.major version}"
+    "-X ${t}.gitMinor=${lib.versions.minor version}"
+    "-X ${t}.gitVersion=v${version}"
+  ];
+
+  postInstall = ''
+    # errors attempting to write config to read-only $HOME
+    export HOME=$TMPDIR
+
+    installShellCompletion --cmd clusterctl \
+      --bash <($out/bin/clusterctl completion bash) \
+      --zsh <($out/bin/clusterctl completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "Kubernetes cluster API tool";
+    homepage = "https://cluster-api.sigs.k8s.io/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ zowoq ];
+  };
+}

pkgs/applications/networking/cluster/cmctl/default.nix

@@ -0,0 +1,38 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "cmctl";
+  version = "1.8.0";
+
+  src = fetchFromGitHub {
+    owner = "cert-manager";
+    repo = "cert-manager";
+    rev = "v${version}";
+    sha256 = "sha256-h7GyzjVrfyMHY7yuNmmsym6KGKCQr5R71gjPBTUeMCg=";
+  };
+
+  vendorSha256 = "sha256-UYw9WdQ6VwzuuiOsa1yovkLZG7NmLYSW51p8UhmQMeI=";
+
+  subPackages = [ "cmd/ctl" ];
+
+  ldflags = [ "-s" "-w" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    mv $out/bin/ctl $out/bin/cmctl
+    installShellCompletion --cmd cmctl \
+      --bash <($out/bin/cmctl completion bash) \
+      --fish <($out/bin/cmctl completion fish) \
+      --zsh <($out/bin/cmctl completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "A CLI tool for managing Cert-Manager service on Kubernetes clusters";
+    downloadPage = "https://github.com/cert-manager/cert-manager";
+    license = licenses.asl20;
+    homepage = "https://cert-manager.io/";
+    maintainers = with maintainers; [ superherointj ];
+  };
+}
+

pkgs/applications/networking/cluster/cni/default.nix

@@ -0,0 +1,23 @@
+{ lib, fetchFromGitHub, buildGoPackage }:
+
+buildGoPackage rec {
+  pname = "cni";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "containernetworking";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vxwNHIc3rFi7HKIEZrBcr7Oxs2iUtFYcfJK7aXDUv3k=";
+  };
+
+  goPackagePath = "github.com/containernetworking/cni";
+
+  meta = with lib; {
+    description = "Container Network Interface - networking for Linux containers";
+    license = licenses.asl20;
+    homepage = "https://github.com/containernetworking/cni";
+    maintainers = with maintainers; [ offline vdemeester ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -0,0 +1,50 @@
+{ lib, fetchFromGitHub, buildGoModule, nixosTests }:
+
+buildGoModule rec {
+  pname = "cni-plugins";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "containernetworking";
+    repo = "plugins";
+    rev = "v${version}";
+    sha256 = "sha256-I9OmTO5obTwAj4hkecUfmRYR4Q3rdllMfbpESv66eEQ=";
+  };
+
+  vendorSha256 = null;
+
+  doCheck = false;
+
+  ldflags = [
+    "-X github.com/containernetworking/plugins/pkg/utils/buildversion.BuildVersion=v${version}"
+  ];
+
+  subPackages = [
+    "plugins/ipam/dhcp"
+    "plugins/ipam/host-local"
+    "plugins/ipam/static"
+    "plugins/main/bridge"
+    "plugins/main/host-device"
+    "plugins/main/ipvlan"
+    "plugins/main/loopback"
+    "plugins/main/macvlan"
+    "plugins/main/ptp"
+    "plugins/main/vlan"
+    "plugins/meta/bandwidth"
+    "plugins/meta/firewall"
+    "plugins/meta/portmap"
+    "plugins/meta/sbr"
+    "plugins/meta/tuning"
+    "plugins/meta/vrf"
+  ];
+
+  passthru.tests = { inherit (nixosTests) cri-o podman; };
+
+  meta = with lib; {
+    description = "Some standard networking plugins, maintained by the CNI team";
+    homepage = "https://www.cni.dev/plugins/";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ cstrahan ] ++ teams.podman.members;
+  };
+}

pkgs/applications/networking/cluster/containerpilot/default.nix

@@ -0,0 +1,24 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  version = "3.9.0pre";
+  pname = "containerpilot";
+
+  src = fetchFromGitHub {
+    owner = "joyent";
+    repo = pname;
+    rev = "d999b632b0c96d9e27f092dc9f81a9d82dfe0106";
+    sha256 = "0wsc8canr1c9wzr1lv40yixj9l10c66i6d14yrljsyagl2z02v4n";
+  };
+
+  goPackagePath = "github.com/joyent/${pname}";
+  goDeps = ./deps.nix;
+
+  meta = with lib; {
+    homepage = "https://www.joyent.com/containerpilot";
+    description = "An application centric micro-orchestrator.";
+    platforms = platforms.unix;
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}

pkgs/applications/networking/cluster/containerpilot/deps.nix

@@ -0,0 +1,173 @@
+# file generated from go.mod using vgo2nix (https://github.com/nix-community/vgo2nix)
+[
+  {
+    goPackagePath = "github.com/beorn7/perks";
+    fetch = {
+      type = "git";
+      url = "https://github.com/beorn7/perks";
+      rev = "4c0e84591b9a";
+      sha256 = "1hrybsql68xw57brzj805xx2mghydpdiysv3gbhr7f5wlxj2514y";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/client9/reopen";
+    fetch = {
+      type = "git";
+      url = "https://github.com/client9/reopen";
+      rev = "1a6ccbeaae3f";
+      sha256 = "0iarv0sn9hb26sr75bwilz3m86kcfad4m5klmzixbd4yw1ipnffa";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/flynn/json5";
+    fetch = {
+      type = "git";
+      url = "https://github.com/flynn/json5";
+      rev = "7620272ed633";
+      sha256 = "1l3rqfis8b72mqwm88lx78d0mbdihyamj8cgg2pa5vfbq49cpydf";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev = "6a1fa9404c0a";
+      sha256 = "0dsd6vlfdyarn3v822x9p2s94gfi5lhvqc2vm3bqmqjgcik3c51z";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/consul";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/consul";
+      rev = "v1.0.1-rc1";
+      sha256 = "10xqi86n2h39q3qlkxfhnrqwm1bgijs5n2kryaq9yalv5p3qxczg";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/go-cleanhttp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/go-cleanhttp";
+      rev = "3573b8b52aa7";
+      sha256 = "1pbl6p7w5wp1c70x7fp94h4ynk2ajfa76rqin3d2hq1w2fcb7byr";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/go-rootcerts";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/go-rootcerts";
+      rev = "6bb64b370b90";
+      sha256 = "1a81fcm1i0ji2iva0dcimiichgwpbcb7lx0vyaks87zj5wf04qy9";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/serf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/serf";
+      rev = "91fd53b1d3e6";
+      sha256 = "0p9mhv6w85cxxl95kvl3rk04yif6v5bhf5kxw8i1cphv5kddv7j9";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
+    fetch = {
+      type = "git";
+      url = "https://github.com/matttproud/golang_protobuf_extensions";
+      rev = "v1.0.1";
+      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/go-homedir";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/go-homedir";
+      rev = "b8bc1bf76747";
+      sha256 = "13ry4lylalkh4g2vny9cxwvryslzyzwp9r92z0b10idhdq3wad1q";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/mapstructure";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/mapstructure";
+      rev = "d2dd02622084";
+      sha256 = "1idj9h0g9z3s21y2hivaf1dknxhpd7yy0kn6wk3311hlr7s543j5";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_golang";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_golang";
+      rev = "v0.8.0";
+      sha256 = "1xqny3147g12n4j03kxm8s9mvdbs3ln6i56c655mybrn9jjy48kd";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_model";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_model";
+      rev = "6f3806018612";
+      sha256 = "1413ibprinxhni51p0755dp57r9wvbw7xgj9nmdaxmhzlqhc86j4";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/common";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/common";
+      rev = "0866df4b85a1";
+      sha256 = "0zw4rxs6zh9vgxz5wwhjnwa6mgac8jh7mb63viircgh08r889chp";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/procfs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/procfs";
+      rev = "e645f4e5aaa8";
+      sha256 = "18hwygbawbqilz7h8fl25xpbciwalkslb4igqn4cr9d8sqp7d3np";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/sirupsen/logrus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sirupsen/logrus";
+      rev = "v1.0.0";
+      sha256 = "0kyvaa4m8w5wijjvrh0amd9bl3sci1vj4y9v9a97sx3rf7xww52l";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "94b76065f2d2";
+      sha256 = "0lxd3gmkvza3mah5m8nncdsgd1y6r25vaz4wzdmrs3i1ikzknn93";
+      moduleDir = "";
+    };
+  }
+]

pkgs/applications/networking/cluster/dnsname-cni/default.nix

@@ -0,0 +1,42 @@
+{
+  buildGoModule,
+  dnsmasq,
+  fetchFromGitHub,
+  lib,
+  nixosTests,
+  makeWrapper,
+}:
+
+buildGoModule rec {
+  pname = "cni-plugin-dnsname";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "dnsname";
+    rev = "v${version}";
+    sha256 = "sha256-kebN1OLMOrBKBz4aBV0VYm+LmLm6S0mKnVgG2u5I+d4=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  postInstall = ''
+    wrapProgram $out/bin/dnsname --prefix PATH : ${lib.makeBinPath [ dnsmasq ]}
+  '';
+
+  vendorSha256 = null;
+  subPackages = [ "plugins/meta/dnsname" ];
+
+  doCheck = false; # NOTE: requires root privileges
+
+  passthru.tests = {
+    inherit (nixosTests) podman-dnsname;
+  };
+
+  meta = with lib; {
+    description = "DNS name resolution for containers";
+    homepage = "https://github.com/containers/dnsname";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mikroskeem ];
+  };
+}

pkgs/applications/networking/cluster/docker-machine/default.nix

@@ -0,0 +1,33 @@
+# This file was generated by go2nix.
+{ lib, buildGoPackage, fetchFromGitHub, installShellFiles }:
+
+buildGoPackage rec {
+  pname = "machine";
+  version = "0.16.1";
+
+  goPackagePath = "github.com/docker/machine";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "docker";
+    repo = "machine";
+    sha256 = "0xxzxi5v7ji9j2k7kxhi0ah91lfa7b9rg3nywgx0lkv8dlgp8kmy";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    pushd go/src/${goPackagePath}/contrib/completion
+    installShellCompletion --bash bash/*
+    installShellCompletion --zsh zsh/*
+    popd
+  '';
+
+  meta = with lib; {
+    homepage = "https://docs.docker.com/machine/";
+    description = "Docker Machine is a tool that lets you install Docker Engine on virtual hosts, and manage Docker Engine on the hosts";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ offline tailhook ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/docker-machine/hyperkit.nix

@@ -0,0 +1,23 @@
+{ lib, buildGoModule, minikube }:
+
+buildGoModule rec {
+  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256 doCheck;
+
+  pname = "docker-machine-hyperkit";
+
+  buildPhase = ''
+    make docker-machine-driver-hyperkit COMMIT=${src.rev}
+  '';
+
+  installPhase = ''
+    install out/docker-machine-driver-hyperkit -Dt $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = "https://minikube.sigs.k8s.io/docs/drivers/hyperkit";
+    description = "HyperKit driver for docker-machine";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ atkinschang ];
+    platforms = platforms.darwin;
+  };
+}

pkgs/applications/networking/cluster/docker-machine/kvm-deps.nix

@@ -0,0 +1,21 @@
+# This file was generated by go2nix.
+[
+  {
+    goPackagePath = "github.com/docker/machine";
+    fetch = {
+      type = "git";
+      url = "https://github.com/docker/machine";
+      rev = "457c02d06a155827c1c4af9b5ab38c0b6b4e48ea";
+      sha256 = "0hx5bhjc7q9ml6h6d2a5csqg6vqwjj68599q0cccw3pcfrb34gmd";
+    };
+  }
+  {
+    goPackagePath = "github.com/libvirt/libvirt-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/libvirt/libvirt-go";
+      rev = "e9642325d747c353ca7b76b4893d5dbdc81c296f";
+      sha256 = "1822b2kbwyxb2gigbiashcs7v4fsyw7k3sdlqh43ga0l6058fmhl";
+    };
+  }
+]

pkgs/applications/networking/cluster/docker-machine/kvm.nix

@@ -0,0 +1,28 @@
+# This file was generated by go2nix.
+{ lib, buildGoPackage, fetchFromGitHub, libvirt, pkg-config }:
+
+buildGoPackage rec {
+  pname = "docker-machine-kvm";
+  version = "0.10.0";
+
+  goPackagePath = "github.com/dhiltgen/docker-machine-kvm";
+  goDeps = ./kvm-deps.nix;
+
+  src = fetchFromGitHub {
+    rev    = "v${version}";
+    owner  = "dhiltgen";
+    repo   = "docker-machine-kvm";
+    sha256 = "0ch4zwb6h7hnr5l3skj1daypvpyms2i666lbnmakpw1fw3zvjmgy";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libvirt ];
+
+  meta = with lib; {
+    homepage = "https://github.com/dhiltgen/docker-machine-kvm";
+    description = "KVM driver for docker-machine";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ offline ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/docker-machine/kvm2.nix

@@ -0,0 +1,27 @@
+{ lib, buildGoModule, minikube }:
+
+buildGoModule rec {
+  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256 doCheck;
+
+  pname = "docker-machine-kvm2";
+
+  postPatch = ''
+    sed -i '/GOARCH=$*/d' Makefile
+  '';
+
+  buildPhase = ''
+    make docker-machine-driver-kvm2 COMMIT=${src.rev}
+  '';
+
+  installPhase = ''
+    install out/docker-machine-driver-kvm2 -Dt $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = "https://minikube.sigs.k8s.io/docs/drivers/kvm2";
+    description = "KVM2 driver for docker-machine";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tadfisher atkinschang ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/cluster/docker-machine/xhyve.nix

@@ -0,0 +1,39 @@
+{ lib, stdenv, buildGoPackage, fetchFromGitHub, fetchpatch, pkg-config, cctools, Hypervisor, vmnet }:
+
+buildGoPackage rec {
+  pname = "docker-machine-xhyve";
+  version = "0.4.0";
+
+  goPackagePath = "github.com/zchee/docker-machine-driver-xhyve";
+
+  # https://github.com/machine-drivers/docker-machine-driver-xhyve/pull/225
+  patches = fetchpatch {
+    url = "https://github.com/machine-drivers/docker-machine-driver-xhyve/commit/546256494bf2ccc33e4125bf45f504b0e3027d5a.patch";
+    sha256 = "1i8wxqccqkxvqrbsyd0g9s0kdskd8xi2jv0c1bji9aj4rq0a8cgz";
+  };
+
+  preBuild = ''
+    make -C go/src/${goPackagePath} CC=${stdenv.cc}/bin/cc LIBTOOL=${cctools}/bin/libtool GIT_CMD=: lib9p
+    export CGO_CFLAGS=-I$(pwd)/go/src/${goPackagePath}/vendor/github.com/jceel/lib9p
+    export CGO_LDFLAGS=$(pwd)/go/src/${goPackagePath}/vendor/build/lib9p/lib9p.a
+  '';
+  tags = [ "lib9p" ];
+
+  src = fetchFromGitHub {
+    rev    = "v${version}";
+    owner  = "machine-drivers";
+    repo   = "docker-machine-driver-xhyve";
+    sha256 = "0000v97fr8xc5b39v44hsa87wrbk4bcwyaaivxv4hxlf4vlgg863";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ Hypervisor vmnet ];
+
+  meta = with lib; {
+    homepage = "https://github.com/machine-drivers/docker-machine-driver-xhyve";
+    description = "Xhyve driver for docker-machine";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ periklis ];
+    platforms = platforms.darwin;
+  };
+}

pkgs/applications/networking/cluster/driftctl/default.nix

@@ -0,0 +1,56 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "driftctl";
+  version = "0.31.0";
+
+  src = fetchFromGitHub {
+    owner = "snyk";
+    repo = "driftctl";
+    rev = "v${version}";
+    sha256 = "sha256-2h7tasHxeEe65BpUXmHkMsNmjiG+QofyGVqXPuk4Ej8=";
+  };
+
+  vendorSha256 = "sha256-bsIPEjD/kCUvkRKP85CjW3JJf1Hyx9b2pMY9S4HlKrA=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/snyk/driftctl/pkg/version.version=v${version}"
+    "-X github.com/snyk/driftctl/build.env=release"
+    "-X github.com/snyk/driftctl/build.enableUsageReporting=false"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd driftctl \
+      --bash <($out/bin/driftctl completion bash) \
+      --fish <($out/bin/driftctl completion fish) \
+      --zsh <($out/bin/driftctl completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/driftctl --help
+    $out/bin/driftctl version | grep "v${version}"
+    # check there's no telemetry flag
+    $out/bin/driftctl --help | grep -vz "telemetry"
+
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://driftctl.com/";
+    changelog = "https://github.com/snyk/driftctl/releases/tag/v${version}";
+    description = "Detect, track and alert on infrastructure drift";
+    longDescription = ''
+      driftctl is a free and open-source CLI that warns of infrastructure drift
+      and fills in the missing piece in your DevSecOps toolbox.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kaction jk ];
+  };
+}

pkgs/applications/networking/cluster/flink/default.nix

@@ -0,0 +1,38 @@
+{ lib, stdenv, fetchurl, makeWrapper, jre }:
+
+stdenv.mkDerivation rec {
+  pname = "flink";
+  version = "1.14.4";
+
+  src = fetchurl {
+    url = "mirror://apache/flink/${pname}-${version}/${pname}-${version}-bin-scala_2.11.tgz";
+    sha256 = "sha256-qvWUh+EQT/MljN5LCX2JLMEapIEGAbAljrCMTYsFqtw=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ jre ];
+
+  installPhase = ''
+    rm bin/*.bat || true
+
+    mkdir -p $out/bin $out/opt/flink
+    mv * $out/opt/flink/
+    makeWrapper $out/opt/flink/bin/flink $out/bin/flink \
+      --prefix PATH : ${jre}/bin
+
+    cat <<EOF >> $out/opt/flink/conf/flink-conf.yaml
+    env.java.home: ${jre}"
+    env.log.dir: /tmp/flink-logs
+    EOF
+  '';
+
+  meta = with lib; {
+    description = "A distributed stream processing framework";
+    homepage = "https://flink.apache.org";
+    downloadPage = "https://flink.apache.org/downloads.html";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ mbode ];
+  };
+}

pkgs/applications/networking/cluster/fluxcd/default.nix

@@ -0,0 +1,71 @@
+{ lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
+
+let
+  version = "0.31.0";
+  sha256 = "073ij9mllxvw6rg8nm8pj6b8m5jzgbiihr9kknhhpp788wya155d";
+  manifestsSha256 = "0kp75h119l9051p2xcjfwcllk4hilmq25fcrx86bm0646krvk0pk";
+
+  manifests = fetchzip {
+    url =
+      "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
+    sha256 = manifestsSha256;
+    stripRoot = false;
+  };
+
+in buildGoModule rec {
+  pname = "fluxcd";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "fluxcd";
+    repo = "flux2";
+    rev = "v${version}";
+    inherit sha256;
+  };
+
+  vendorSha256 = "sha256-XTtVSSqU2jWRZvudE6G5QaNaZxw3oESiMPnnQzDs/1w=";
+
+  postUnpack = ''
+    cp -r ${manifests} source/cmd/flux/manifests
+  '';
+
+  patches = [ ./patches/disable-tests-ssh_key.patch ];
+
+  ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
+
+  subPackages = [ "cmd/flux" ];
+
+  # Required to workaround test error:
+  #   panic: mkdir /homeless-shelter: permission denied
+  HOME = "$TMPDIR";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/flux --version | grep ${version} > /dev/null
+  '';
+
+  postInstall = ''
+    for shell in bash fish zsh; do
+      $out/bin/flux completion $shell > flux.$shell
+      installShellCompletion flux.$shell
+    done
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    description =
+      "Open and extensible continuous delivery solution for Kubernetes";
+    longDescription = ''
+      Flux is a tool for keeping Kubernetes clusters in sync
+      with sources of configuration (like Git repositories), and automating
+      updates to configuration when there is new code to deploy.
+    '';
+    homepage = "https://fluxcd.io";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bryanasdev000 jlesquembre superherointj ];
+    mainProgram = "flux";
+  };
+}

pkgs/applications/networking/cluster/fluxcd/patches/disable-tests-ssh_key.patch

@@ -0,0 +1,19 @@
+--- flux/cmd/flux/create_secret_git_test.go.orig	2021-12-07 13:46:21.196278468 +0100
++++ flux/cmd/flux/create_secret_git_test.go	2021-12-07 13:49:51.668566955 +0100
+@@ -20,16 +20,6 @@
+ 			args:   "create secret git podinfo-auth --url=https://github.com/stefanprodan/podinfo --username=my-username --password=my-password --namespace=my-namespace --export",
+ 			assert: assertGoldenFile("./testdata/create_secret/git/secret-git-basic.yaml"),
+ 		},
+-		{
+-			name:   "ssh key",
+-			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/ecdsa.private --namespace=my-namespace --export",
+-			assert: assertGoldenFile("testdata/create_secret/git/git-ssh-secret.yaml"),
+-		},
+-		{
+-			name:   "ssh key with password",
+-			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/ecdsa-password.private --password=password --namespace=my-namespace --export",
+-			assert: assertGoldenFile("testdata/create_secret/git/git-ssh-secret-password.yaml"),
+-		},
+ 	}
+ 
+ 	for _, tt := range tests {

pkgs/applications/networking/cluster/fluxcd/update.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep gnused jq
+
+set -x -eu -o pipefail
+
+NIXPKGS_PATH="$(git rev-parse --show-toplevel)"
+FLUXCD_PATH="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
+
+OLD_VERSION="$(nix-instantiate --eval -E "with import $NIXPKGS_PATH {}; fluxcd.version or (builtins.parseDrvName fluxcd.name).version" | tr -d '"')"
+LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/fluxcd/flux2/releases/latest | jq -r '.tag_name')
+LATEST_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')
+
+if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
+    SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/archive/refs/tags/${LATEST_TAG}.tar.gz)
+    SPEC_SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/releases/download/${LATEST_TAG}/manifests.tar.gz)
+
+    setKV () {
+        sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "${FLUXCD_PATH}/default.nix"
+    }
+
+    setKV version ${LATEST_VERSION}
+    setKV sha256 ${SHA256}
+    setKV manifestsSha256 ${SPEC_SHA256}
+    setKV vendorSha256 "0000000000000000000000000000000000000000000000000000" # The same as lib.fakeSha256
+
+    set +e
+    VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd $NIXPKGS_PATH 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
+    set -e
+
+    if [ -n "${VENDOR_SHA256:-}" ]; then
+        setKV vendorSha256 ${VENDOR_SHA256}
+    else
+        echo "Update failed. VENDOR_SHA256 is empty."
+        exit 1
+    fi
+
+    # `git` flag here is to be used by local maintainers to speed up the bump process
+    if [ $# -eq 1 ] && [ "$1" = "git" ]; then
+        git switch -c "package-fluxcd-${LATEST_VERSION}"
+        git add "$FLUXCD_PATH"/default.nix
+        git commit -m "fluxcd: ${OLD_VERSION} -> ${LATEST_VERSION}"
+    fi
+else
+    echo "fluxcd is already up-to-date at $OLD_VERSION"
+fi

pkgs/applications/networking/cluster/fluxctl/default.nix

@@ -0,0 +1,37 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "fluxctl";
+  version = "1.25.1";
+
+  src = fetchFromGitHub {
+    owner = "weaveworks";
+    repo = "flux";
+    rev = version;
+    sha256 = "sha256-l/BPnqa0j0yAdrl9BxFUKt94JwiNyPq1gKYuhGj/c8w=";
+  };
+
+  vendorSha256 = "sha256-PZriaKbgRKm7ssHOBmbzbma5LrRt0TsQiphSrtcT83k=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  doCheck = false;
+
+  subPackages = [ "cmd/fluxctl" ];
+
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
+
+  postInstall = ''
+    for shell in bash fish zsh; do
+      $out/bin/fluxctl completion $shell > fluxctl.$shell
+      installShellCompletion fluxctl.$shell
+    done
+  '';
+
+  meta = with lib; {
+    description = "CLI client for Flux, the GitOps Kubernetes operator";
+    homepage = "https://github.com/fluxcd/flux";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ Gonzih Br1ght0ne ];
+  };
+}

pkgs/applications/networking/cluster/fn-cli/default.nix

@@ -0,0 +1,36 @@
+{ lib, buildGoModule, fetchFromGitHub, docker }:
+
+buildGoModule rec {
+  pname = "fn";
+  version = "0.6.17";
+
+  src = fetchFromGitHub {
+    owner = "fnproject";
+    repo = "cli";
+    rev = version;
+    sha256 = "sha256-u/YISLlZFYlAUejSlaH7POA2WwKURPN8phFU86/caXU=";
+  };
+
+  vendorSha256 = null;
+
+  subPackages = ["."];
+
+  buildInputs = [
+    docker
+  ];
+
+  preBuild = ''
+    export HOME=$TMPDIR
+  '';
+
+  postInstall = ''
+    mv $out/bin/cli $out/bin/fn
+  '';
+
+  meta = with lib; {
+    description = "Command-line tool for the fn project";
+    homepage = "https://fnproject.io";
+    license = licenses.asl20;
+    maintainers = [ maintainers.c4605 ];
+  };
+}

pkgs/applications/networking/cluster/gatekeeper/default.nix

@@ -0,0 +1,39 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "gatekeeper";
+  version = "3.8.1";
+
+  src = fetchFromGitHub {
+    owner = "open-policy-agent";
+    repo = "gatekeeper";
+    rev = "v${version}";
+    sha256 = "sha256-zEUH88sjgR738BXK2oSSM6jf5oHZt0VJv61BcxclG1Q=";
+  };
+
+  vendorSha256 = null;
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  subPackages = [ "cmd/gator" ];
+
+  postInstall = ''
+    installShellCompletion --cmd gator \
+      --bash <($out/bin/gator completion bash) \
+      --fish <($out/bin/gator completion fish) \
+      --zsh <($out/bin/gator completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "Policy Controller for Kubernetes";
+    homepage = "https://github.com/open-policy-agent/gatekeeper";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -0,0 +1,36 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "glooctl";
+  version = "1.10.10";
+
+  src = fetchFromGitHub {
+    owner = "solo-io";
+    repo = "gloo";
+    rev = "v${version}";
+    hash = "sha256-Be0ejIQ3euKXX6wc1abXz8BphhrDnBMP0GzmnrF7C/4=";
+  };
+
+  subPackages = [ "projects/gloo/cli/cmd" ];
+  vendorSha256 = "1s3s4n2wgi4azwkmg9zw2a3gz378nb1i41p3s8aixfbf6fsqc6ga";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/glooctl
+
+    export HOME=$TMP
+    installShellCompletion --cmd glooctl \
+      --bash <($out/bin/glooctl completion bash) \
+      --zsh <($out/bin/glooctl completion zsh)
+  '';
+
+  ldflags = [ "-s" "-w" "-X github.com/solo-io/gloo/pkg/version.Version=${version}" ];
+
+  meta = with lib; {
+    description = "glooctl is the unified CLI for Gloo";
+    homepage = "https://docs.solo.io/gloo-edge/latest/reference/cli/glooctl/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ nelsonjeppesen ];
+  };
+}

pkgs/applications/networking/cluster/habitat/default.nix

@@ -0,0 +1,38 @@
+{ lib, fetchFromGitHub, rustPlatform, pkg-config
+, libsodium, libarchive, openssl, zeromq }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "habitat";
+  # Newer versions required protobuf, which requires some finesse to get to
+  # compile with the vendored protobuf crate.
+  version = "0.90.6";
+
+  src = fetchFromGitHub {
+    owner = "habitat-sh";
+    repo = "habitat";
+    rev = version;
+    sha256 = "0rwi0lkmhlq4i8fba3s9nd9ajhz2dqxzkgfp5i8y0rvbfmhmfd6b";
+  };
+
+  cargoSha256 = "1c058sjgd79ps8ahvxp25qyc3a6b2csb41vamrphv9ygai60mng6";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libsodium libarchive openssl zeromq ];
+
+  cargoBuildFlags = ["--package hab"];
+
+  checkPhase = ''
+    runHook preCheck
+    echo "Running cargo test"
+    cargo test --package hab
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "An application automation framework";
+    homepage = "https://www.habitat.sh";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ rushmorem ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/applications/networking/cluster/hadoop/default.nix

@@ -0,0 +1,133 @@
+{ lib
+, stdenv
+, fetchurl
+, makeWrapper
+, autoPatchelfHook
+, jdk8_headless
+, jdk11_headless
+, bash
+, coreutils
+, which
+, bzip2
+, cyrus_sasl
+, protobuf3_7
+, snappy
+, zlib
+, zstd
+, openssl
+, glibc
+, nixosTests
+, sparkSupport ? true
+, spark
+}:
+
+with lib;
+
+assert elem stdenv.system [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
+
+let
+  common = { pname, version, untarDir ? "${pname}-${version}", sha256, jdk, openssl ? null, nativeLibs ? [ ], libPatches ? "", tests }:
+    stdenv.mkDerivation rec {
+      inherit pname version jdk libPatches untarDir openssl;
+      src = fetchurl {
+        url = "mirror://apache/hadoop/common/hadoop-${version}/hadoop-${version}" + optionalString stdenv.isAarch64 "-aarch64" + ".tar.gz";
+        sha256 = sha256.${stdenv.system};
+      };
+      doCheck = true;
+
+      nativeBuildInputs = [ makeWrapper ]
+        ++ optional (stdenv.isLinux && (nativeLibs != [ ] || libPatches != "")) [ autoPatchelfHook ];
+      buildInputs = [ openssl ] ++ nativeLibs;
+
+      installPhase = ''
+        mkdir -p $out/{lib/${untarDir}/conf,bin,lib}
+        mv * $out/lib/${untarDir}
+      '' + optionalString stdenv.isLinux ''
+        # All versions need container-executor, but some versions can't use autoPatchelf because of broken SSL versions
+        patchelf --set-interpreter ${glibc.out}/lib64/ld-linux-x86-64.so.2 $out/lib/${untarDir}/bin/container-executor
+      '' + ''
+        for n in $(find $out/lib/${untarDir}/bin -type f ! -name "*.*"); do
+          makeWrapper "$n" "$out/bin/$(basename $n)"\
+            --set-default JAVA_HOME ${jdk.home}\
+            --set-default HADOOP_HOME $out/lib/${untarDir}\
+            --set-default HADOOP_CONF_DIR /etc/hadoop-conf/\
+            --prefix PATH : "${makeBinPath [ bash coreutils which]}"\
+            --prefix JAVA_LIBRARY_PATH : "${makeLibraryPath buildInputs}"
+        done
+      '' + optionalString sparkSupport ''
+        # Add the spark shuffle service jar to YARN
+        cp ${spark.src}/yarn/spark-${spark.version}-yarn-shuffle.jar $out/lib/${untarDir}/share/hadoop/yarn/
+      '' + libPatches;
+
+      passthru = { inherit tests; };
+
+      meta = {
+        homepage = "https://hadoop.apache.org/";
+        description = "Framework for distributed processing of large data sets across clusters of computers";
+        license = licenses.asl20;
+        sourceProvenance = with sourceTypes; [ binaryBytecode ];
+
+        longDescription = ''
+          The Apache Hadoop software library is a framework that allows for
+          the distributed processing of large data sets across clusters of
+          computers using a simple programming model. It is designed to
+          scale up from single servers to thousands of machines, each
+          offering local computation and storage. Rather than rely on
+          hardware to deliver high-avaiability, the library itself is
+          designed to detect and handle failures at the application layer,
+          so delivering a highly-availabile service on top of a cluster of
+          computers, each of which may be prone to failures.
+        '';
+        maintainers = with maintainers; [ volth illustris ];
+        platforms = attrNames sha256;
+      };
+    };
+in
+{
+  # Different version of hadoop support different java runtime versions
+  # https://cwiki.apache.org/confluence/display/HADOOP/Hadoop+Java+Versions
+  hadoop_3_3 = common rec {
+    pname = "hadoop";
+    version = "3.3.1";
+    untarDir = "${pname}-${version}";
+    sha256 = rec {
+      x86_64-linux = "1b3v16ihysqaxw8za1r5jlnphy8dwhivdx2d0z64309w57ihlxxd";
+      x86_64-darwin = x86_64-linux;
+      aarch64-linux = "00ln18vpi07jq2slk3kplyhcj8ad41n0yl880q5cihilk7daclxz";
+      aarch64-darwin = aarch64-linux;
+    };
+    jdk = jdk11_headless;
+    inherit openssl;
+    # TODO: Package and add Intel Storage Acceleration Library
+    nativeLibs = [ stdenv.cc.cc.lib protobuf3_7 zlib snappy ];
+    libPatches = ''
+      ln -s ${getLib cyrus_sasl}/lib/libsasl2.so $out/lib/${untarDir}/lib/native/libsasl2.so.2
+      ln -s ${getLib openssl}/lib/libcrypto.so $out/lib/${untarDir}/lib/native/
+      ln -s ${getLib zlib}/lib/libz.so.1 $out/lib/${untarDir}/lib/native/
+      ln -s ${getLib zstd}/lib/libzstd.so.1 $out/lib/${untarDir}/lib/native/
+      ln -s ${getLib bzip2}/lib/libbz2.so.1 $out/lib/${untarDir}/lib/native/
+    '' + optionalString stdenv.isLinux ''
+      # libjvm.so for Java >=11
+      patchelf --add-rpath ${jdk.home}/lib/server $out/lib/${untarDir}/lib/native/libnativetask.so.1.0.0
+      # Java 8 has libjvm.so at a different path
+      patchelf --add-rpath ${jdk.home}/jre/lib/amd64/server $out/lib/${untarDir}/lib/native/libnativetask.so.1.0.0
+    '';
+    tests = nixosTests.hadoop;
+  };
+  hadoop_3_2 = common rec {
+    pname = "hadoop";
+    version = "3.2.2";
+    sha256.x86_64-linux = "1hxq297cqvkfgz2yfdiwa3l28g44i2abv5921k2d6b4pqd33prwp";
+    jdk = jdk8_headless;
+    # not using native libs because of broken openssl_1_0_2 dependency
+    # can be manually overriden
+    tests = nixosTests.hadoop_3_2;
+  };
+  hadoop2 = common rec {
+    pname = "hadoop";
+    version = "2.10.1";
+    sha256.x86_64-linux = "1w31x4bk9f2swnx8qxx0cgwfg8vbpm6cy5lvfnbbpl3rsjhmyg97";
+    jdk = jdk8_headless;
+    tests = nixosTests.hadoop2;
+  };
+}

pkgs/applications/networking/cluster/helm-docs/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "helm-docs";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    owner = "norwoodj";
+    repo = "helm-docs";
+    rev = "v${version}";
+    sha256 = "sha256-OpS/CYBb2Ll6ktvEhqkw/bWMSrFa4duidK3Glu8EnPw=";
+  };
+
+  vendorSha256 = "sha256-FpmeOQ8nV+sEVu2+nY9o9aFbCpwSShQUFOmyzwEQ9Pw=";
+
+  subPackages = [ "cmd/helm-docs" ];
+  ldflags = [
+    "-w"
+    "-s"
+    "-X main.version=v${version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/norwoodj/helm-docs";
+    description = "A tool for automatically generating markdown documentation for Helm charts";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ sagikazarmark ];
+  };
+}

pkgs/applications/networking/cluster/helm/chart-testing/default.nix

@@ -0,0 +1,48 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "chart-testing";
+  version = "3.5.1";
+
+  src = fetchFromGitHub {
+    owner = "helm";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-LNCzz5me60R/moFfdJhGMgUToFxADiPL02G4QCv0DLg=";
+  };
+
+  vendorSha256 = "sha256-38ufXHzGlZgEh6swD/GhWbIYdY5uYznKCQ9OaoyOEiY=";
+
+  postPatch = ''
+    substituteInPlace pkg/config/config.go \
+      --replace "\"/etc/ct\"," "\"$out/etc/ct\","
+  '';
+
+  ldflags = [
+    "-w"
+    "-s"
+    "-X github.com/helm/chart-testing/v3/ct/cmd.Version=${version}"
+    "-X github.com/helm/chart-testing/v3/ct/cmd.GitCommit=${src.rev}"
+    "-X github.com/helm/chart-testing/v3/ct/cmd.BuildDate=19700101-00:00:00"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    install -Dm644 -t $out/etc/ct etc/chart_schema.yaml
+    install -Dm644 -t $out/etc/ct etc/lintconf.yaml
+
+    installShellCompletion --cmd ct \
+      --bash <($out/bin/ct completion bash) \
+      --zsh <($out/bin/ct completion zsh) \
+      --fish <($out/bin/ct completion fish) \
+  '';
+
+  meta = with lib; {
+    description = "A tool for testing Helm charts";
+    homepage = "https://github.com/helm/chart-testing";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ atkinschang ];
+    mainProgram = "ct";
+  };
+}

pkgs/applications/networking/cluster/helm/default.nix

@@ -0,0 +1,51 @@
+{ lib, stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kubernetes-helm";
+  version = "3.9.0";
+  gitCommit = "7ceeda6c585217a19a1131663d8cd1f7d641b2a7";
+
+  src = fetchFromGitHub {
+    owner = "helm";
+    repo = "helm";
+    rev = "v${version}";
+    sha256 = "sha256-pdWFCepVGSJmlYnvcJCaNaGSllbeh/oCdosrab8jA4s=";
+  };
+  vendorSha256 = "sha256-r0a38ZB6VlyzKB66+OAllRLXhqwO0qbksZjOrBWdjqM=";
+
+  subPackages = [ "cmd/helm" ];
+  ldflags = [
+    "-w"
+    "-s"
+    "-X helm.sh/helm/v3/internal/version.version=v${version}"
+    "-X helm.sh/helm/v3/internal/version.gitCommit=${gitCommit}"
+  ];
+
+  preCheck = ''
+    # skipping version tests because they require dot git directory
+    substituteInPlace cmd/helm/version_test.go \
+      --replace "TestVersion" "SkipVersion"
+  '' + lib.optionalString stdenv.isLinux ''
+    # skipping plugin tests on linux
+    substituteInPlace cmd/helm/plugin_test.go \
+      --replace "TestPluginDynamicCompletion" "SkipPluginDynamicCompletion" \
+      --replace "TestLoadPlugins" "SkipLoadPlugins"
+    substituteInPlace cmd/helm/helm_test.go \
+      --replace "TestPluginExitCode" "SkipPluginExitCode"
+  '';
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = ''
+    $out/bin/helm completion bash > helm.bash
+    $out/bin/helm completion zsh > helm.zsh
+    installShellCompletion helm.{bash,zsh}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/kubernetes/helm";
+    description = "A package manager for kubernetes";
+    mainProgram = "helm";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ rlupton20 edude03 saschagrunert Frostman Chili-Man techknowlogick ];
+  };
+}

pkgs/applications/networking/cluster/helm/plugins/default.nix

@@ -0,0 +1,13 @@
+{ callPackage }:
+
+{
+
+  helm-diff = callPackage ./helm-diff.nix { };
+
+  helm-git = callPackage ./helm-git.nix { };
+
+  helm-s3 = callPackage ./helm-s3.nix { };
+
+  helm-secrets = callPackage ./helm-secrets.nix { };
+
+}

pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix

@@ -0,0 +1,34 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "helm-diff";
+  version = "3.1.3";
+
+  src = fetchFromGitHub {
+    owner = "databus23";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-h26EOjKNrlcrs2DAYj0NmDRgNRKozjfw5DtxUgHNTa4=";
+  };
+
+  vendorSha256 = "sha256-+n/QBuZqtdgUkaBG7iqSuBfljn+AdEzDoIo5SI8ErQA=";
+
+  # NOTE: Remove the install and upgrade hooks.
+  postPatch = ''
+    sed -i '/^hooks:/,+2 d' plugin.yaml
+  '';
+
+  postInstall = ''
+    install -dm755 $out/${pname}
+    mv $out/bin $out/${pname}/
+    mv $out/${pname}/bin/{helm-,}diff
+    install -m644 -Dt $out/${pname} plugin.yaml
+  '';
+
+  meta = with lib; {
+    description = "A Helm plugin that shows a diff";
+    inherit (src.meta) homepage;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ yurrriq ];
+  };
+}

pkgs/applications/networking/cluster/helm/plugins/helm-git.nix

@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, coreutils
+, findutils
+, git
+, gnugrep
+, gnused
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "helm-git";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "aslafy-z";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0hvycqibmlw2zw3nm8rn73v5x1zcgm2jrfdlljbvc1n4n5vnzdrg";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  # NOTE: helm-git is comprised of shell scripts.
+  dontBuild = true;
+
+  installPhase = ''
+    install -dm755 $out/helm-git
+    install -m644 -Dt $out/helm-git plugin.yaml
+    cp helm-git helm-git-plugin.sh $out/helm-git/
+
+    patchShebangs $out/helm-git/helm-git{,-plugin.sh}
+    wrapProgram $out/helm-git/helm-git \
+        --prefix PATH : ${lib.makeBinPath [ coreutils findutils git gnugrep gnused ]}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The Helm downloader plugin that provides GIT protocol support";
+    inherit (src.meta) homepage;
+    license = licenses.mit;
+    maintainers = with maintainers; [ flokli ];
+  };
+}

pkgs/applications/networking/cluster/helm/plugins/helm-s3.nix

@@ -0,0 +1,37 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "helm-s3";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "hypnoglow";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-2BQ/qtoL+iFbuLvrJGUuxWFKg9u1sVDRcRm2/S0mgyc=";
+  };
+
+  vendorSha256 = "sha256-/9TiY0XdkiNxW5JYeC5WD9hqySCyYYU8lB+Ft5Vm96I=";
+
+  # NOTE: Remove the install and upgrade hooks.
+  postPatch = ''
+    sed -i '/^hooks:/,+2 d' plugin.yaml
+  '';
+
+  checkPhase = ''
+    make test-unit
+  '';
+
+  postInstall = ''
+    install -dm755 $out/${pname}
+    mv $out/bin $out/${pname}/
+    install -m644 -Dt $out/${pname} plugin.yaml
+  '';
+
+  meta = with lib; {
+    description = "A Helm plugin that shows a diff";
+    inherit (src.meta) homepage;
+    license = licenses.mit;
+    maintainers = with maintainers; [ yurrriq ];
+  };
+}

pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix

@@ -0,0 +1,44 @@
+{ lib, stdenv, fetchFromGitHub, makeWrapper, coreutils, findutils, getopt, gnugrep, gnused, sops, vault }:
+
+stdenv.mkDerivation rec {
+  pname = "helm-secrets";
+  version = "3.8.3";
+
+  src = fetchFromGitHub {
+    owner = "jkroepke";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-FpF/d+e5T6nb0OENaYLY+3ATZ+qcAeih5/yKI+AtfKA=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ getopt sops ];
+
+  # NOTE: helm-secrets is comprised of shell scripts.
+  dontBuild = true;
+
+  # NOTE: Remove the install and upgrade hooks.
+  postPatch = ''
+    sed -i '/^hooks:/,+2 d' plugin.yaml
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm755 $out/${pname} $out/${pname}/scripts
+    install -m644 -Dt $out/${pname} plugin.yaml
+    cp -r scripts/* $out/${pname}/scripts
+    wrapProgram $out/${pname}/scripts/run.sh \
+        --prefix PATH : ${lib.makeBinPath [ coreutils findutils getopt gnugrep gnused sops vault ]}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A Helm plugin that helps manage secrets";
+    inherit (src.meta) homepage;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ yurrriq ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/networking/cluster/helm/wrapper.nix

@@ -0,0 +1,44 @@
+{ symlinkJoin, lib, makeWrapper, writeText }:
+
+helm:
+
+let
+  wrapper = {
+    plugins ? [],
+    extraMakeWrapperArgs ? ""
+  }:
+  let
+
+  initialMakeWrapperArgs = [
+  ];
+
+  pluginsDir = symlinkJoin {
+    name = "helm-plugins";
+    paths = plugins;
+  };
+in
+  symlinkJoin {
+    name = "helm-${lib.getVersion helm}";
+
+    # Remove the symlinks created by symlinkJoin which we need to perform
+    # extra actions upon
+    postBuild = ''
+      wrapProgram "$out/bin/helm" \
+        "--set" "HELM_PLUGINS" "${pluginsDir}" ${extraMakeWrapperArgs}
+    '';
+    paths = [ helm pluginsDir ];
+
+    preferLocalBuild = true;
+
+    nativeBuildInputs = [ makeWrapper ];
+    passthru = { unwrapped = helm; };
+
+    meta = helm.meta // {
+      # To prevent builds on hydra
+      hydraPlatforms = [];
+      # prefer wrapper over the package
+      priority = (helm.meta.priority or 0) - 1;
+    };
+  };
+in
+  lib.makeOverridable wrapper

pkgs/applications/networking/cluster/helmfile/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "helmfile";
+  version = "0.144.0";
+
+  src = fetchFromGitHub {
+    owner = "roboll";
+    repo = "helmfile";
+    rev = "v${version}";
+    sha256 = "sha256-mfRPrgnOXqfmbpvaIxJNkgkdTEJKcFycrgFmQ7YDvTU=";
+  };
+
+  vendorSha256 = "sha256-ddf3m0DGsjubzp/aERvhfJ51UKKSNMC1Xu7ybyif8HA=";
+
+  doCheck = false;
+
+  subPackages = [ "." ];
+
+  ldflags = [ "-s" "-w" "-X github.com/roboll/helmfile/pkg/app/version.Version=${version}" ];
+
+  meta = {
+    description = "Deploy Kubernetes Helm charts";
+    homepage = "https://github.com/roboll/helmfile";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pneumaticat yurrriq ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/helmsman/default.nix

@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub, ... }:
+
+buildGoModule rec {
+  pname = "helmsman";
+  version = "3.8.1";
+
+  src = fetchFromGitHub {
+    owner = "Praqma";
+    repo = "helmsman";
+    rev = "v${version}";
+    sha256 = "sha256-njo5LlowlgWFK5G2lpgi7hdxtnSs8f5cT0oHI7bJxNc=";
+  };
+
+  vendorSha256 = "sha256-F+b4EXAxa4+O6yepx+9eRrdq294ZcQ+sODFUCKYpSuo=";
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Helm Charts (k8s applications) as Code tool";
+    homepage = "https://github.com/Praqma/helmsman";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lynty ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/hetzner-kube/default.nix

@@ -0,0 +1,49 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "hetzner-kube";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "xetys";
+    repo = "hetzner-kube";
+    rev = version;
+    sha256 = "1iqgpmljqx6rhmvsir2675waj78amcfiw08knwvlmavjgpxx2ysw";
+  };
+
+  patches = [
+    # Use $HOME instead of the OS user database.
+    # Upstream PR: https://github.com/xetys/hetzner-kube/pull/346
+    # Unfortunately, the PR patch does not apply against release.
+    ./fix-home.patch
+  ];
+
+  vendorSha256 = "1jh2f66ys6rmrrwrf5zqfprgcvziyq6l4z8bfqwxgf1ysnxx525h";
+
+  doCheck = false;
+
+  ldflags = [
+    "-X github.com/xetys/hetzner-kube/cmd.version=${version}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = ''
+    # Need a writable home, because it fails if unable to write config.
+    export HOME=$TMP
+    $out/bin/hetzner-kube completion bash > hetzner-kube
+    $out/bin/hetzner-kube completion zsh > _hetzner-kube
+    installShellCompletion --zsh _hetzner-kube
+    installShellCompletion --bash hetzner-kube
+  '';
+
+  meta = {
+    description = "A CLI tool for provisioning Kubernetes clusters on Hetzner Cloud";
+    homepage = "https://github.com/xetys/hetzner-kube";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ eliasp ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/hetzner-kube/fix-home.patch

@@ -0,0 +1,53 @@
+diff --git a/cmd/cluster_kubeconfig.go b/cmd/cluster_kubeconfig.go
+index 54cc0c9..fab288a 100644
+--- a/cmd/cluster_kubeconfig.go
++++ b/cmd/cluster_kubeconfig.go
+@@ -6,7 +6,7 @@ import (
+ 	"io/ioutil"
+ 	"log"
+ 	"os"
+-	"os/user"
++	"path/filepath"
+ 	"strings"
+ 
+ 	"github.com/spf13/cobra"
+@@ -52,9 +52,8 @@ Example 4: hetzner-kube cluster kubeconfig -n my-cluster -p > my-conf.yaml # pri
+ 		} else {
+ 			fmt.Println("create file")
+ 
+-			usr, _ := user.Current()
+-			dir := usr.HomeDir
+-			path := fmt.Sprintf("%s/.kube", dir)
++			dir, _ := os.UserHomeDir()
++			path := filepath.Join(dir, ".kube")
+ 
+ 			if _, err := os.Stat(path); os.IsNotExist(err) {
+ 				os.MkdirAll(path, 0755)
+diff --git a/cmd/config.go b/cmd/config.go
+index ce0f3e5..a03c4ba 100644
+--- a/cmd/config.go
++++ b/cmd/config.go
+@@ -8,7 +8,6 @@ import (
+ 	"io/ioutil"
+ 	"log"
+ 	"os"
+-	"os/user"
+ 	"path/filepath"
+ 
+ 	"github.com/hetznercloud/hcloud-go/hcloud"
+@@ -28,13 +27,8 @@ type AppSSHClient struct {
+ // NewAppConfig creates a new AppConfig struct using the locally saved configuration file. If no local
+ // configuration file is found a new config will be created.
+ func NewAppConfig() AppConfig {
+-	usr, err := user.Current()
+-	if err != nil {
+-		return AppConfig{}
+-	}
+-	if usr.HomeDir != "" {
+-		DefaultConfigPath = filepath.Join(usr.HomeDir, ".hetzner-kube")
+-	}
++	dir, _ := os.UserHomeDir()
++	DefaultConfigPath = filepath.Join(dir, ".hetzner-kube")
+ 
+ 	appConf := AppConfig{
+ 		Context: context.Background(),

pkgs/applications/networking/cluster/hubble/default.nix

@@ -0,0 +1,23 @@
+{ stdenv, lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "hubble";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "cilium";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-L8sRvIA89RiXjrG0WcH72iYKlNTFvmQrveA9k5EBRKo=";
+  };
+
+  vendorSha256 = null;
+
+  meta = with lib; {
+    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    description = "Network, Service & Security Observability for Kubernetes using eBPF";
+    license = licenses.asl20;
+    homepage = "https://github.com/cilium/hubble/";
+    maintainers = with maintainers; [ humancalico ];
+  };
+}

pkgs/applications/networking/cluster/istioctl/default.nix

@@ -0,0 +1,48 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "istioctl";
+  version = "1.13.3";
+
+  src = fetchFromGitHub {
+    owner = "istio";
+    repo = "istio";
+    rev = version;
+    sha256 = "sha256-XvV6OlGHW/eB0EUrmyTlFVbDjbxUpVo6WvrEnh6Q68I=";
+  };
+  vendorSha256 = "sha256-Ex86yLMTqqiSkJns/eeodmGswAzPVQAQOf8Wqi7DRaE=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  # Bundle release metadata
+  ldflags = let
+    attrs = [
+      "istio.io/pkg/version.buildVersion=${version}"
+      "istio.io/pkg/version.buildStatus=Nix"
+      "istio.io/pkg/version.buildTag=${version}"
+      "istio.io/pkg/version.buildHub=docker.io/istio"
+    ];
+  in ["-s" "-w" "${lib.concatMapStringsSep " " (attr: "-X ${attr}") attrs}"];
+
+  subPackages = [ "istioctl/cmd/istioctl" ];
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/istioctl version --remote=false | grep ${version} > /dev/null
+  '';
+
+  postInstall = ''
+    $out/bin/istioctl collateral --man --bash --zsh
+    installManPage *.1
+    installShellCompletion istioctl.bash
+    installShellCompletion --zsh _istioctl
+  '';
+
+  meta = with lib; {
+    description = "Istio configuration command line utility for service operators to debug and diagnose their Istio mesh";
+    homepage = "https://istio.io/latest/docs/reference/commands/istioctl";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ superherointj bryanasdev000 veehaitch ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/jx/default.nix

@@ -0,0 +1,49 @@
+{ stdenv, buildGoModule, fetchFromGitHub, lib, installShellFiles }:
+
+buildGoModule rec {
+  pname = "jx";
+  version = "2.1.155";
+
+  src = fetchFromGitHub {
+    owner = "jenkins-x";
+    repo = "jx";
+    rev = "v${version}";
+    sha256 = "sha256-kwcmZSOA26XuSgNSHitGaMohalnLobabXf4z3ybSJtk=";
+  };
+
+  vendorSha256 = "sha256-ZtcCBXcJXX9ThzY6T0MhNfDDzRC9PYzRB1VyS4LLXLs=";
+
+  doCheck = false;
+
+  subPackages = [ "cmd/jx" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s -w"
+    "-X github.com/jenkins-x/jx/pkg/version.Version=${version}"
+    "-X github.com/jenkins-x/jx/pkg/version.Revision=${src.rev}"
+    "-X github.com/jenkins-x/jx/pkg/version.GitTreeState=clean"
+  ];
+
+  postInstall = ''
+    for shell in bash zsh; do
+      $out/bin/jx completion $shell > jx.$shell
+      installShellCompletion jx.$shell
+    done
+  '';
+
+  meta = with lib; {
+    broken = stdenv.isDarwin;
+    description = "Command line tool for installing and using Jenkins X";
+    homepage = "https://jenkins-x.io";
+    longDescription = ''
+      Jenkins X provides automated CI+CD for Kubernetes with Preview
+      Environments on Pull Requests using Jenkins, Knative Build, Prow,
+      Skaffold and Helm.
+    '';
+    license = licenses.asl20 ;
+    maintainers = with maintainers; [ kalbasit ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}

pkgs/applications/networking/cluster/k0sctl/default.nix

@@ -0,0 +1,42 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "k0sctl";
+  version = "0.13.0";
+
+  src = fetchFromGitHub {
+    owner = "k0sproject";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-A50PbZTgv0EfL5aqTiTEOdfRXUgKGzTsRIiMgXItkxI=";
+  };
+
+  vendorSha256 = "sha256-2i6SoixE5RitRuJpOU4LdzN9JY/76c3mjsbsXlQp854=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/k0sproject/k0sctl/version.Environment=production"
+    "-X github.com/k0sproject/k0sctl/version.Version=${version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    for shell in bash zsh fish; do
+      installShellCompletion --cmd ${pname} \
+        --$shell <($out/bin/${pname} completion --shell $shell)
+    done
+  '';
+
+  meta = with lib; {
+    description = "A bootstrapping and management tool for k0s clusters.";
+    homepage = "https://k0sproject.io/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}

pkgs/applications/networking/cluster/k3s/default.nix

@@ -0,0 +1,329 @@
+{ stdenv
+, lib
+, makeWrapper
+, socat
+, iptables
+, iproute2
+, bridge-utils
+, btrfs-progs
+, conntrack-tools
+, buildGoModule
+, runc
+, rsync
+, kmod
+, libseccomp
+, pkg-config
+, ethtool
+, util-linux
+, fetchFromGitHub
+, fetchurl
+, fetchzip
+, fetchgit
+, zstd
+, yq-go
+, nixosTests
+}:
+
+with lib;
+
+# k3s is a kinda weird derivation. One of the main points of k3s is the
+# simplicity of it being one binary that can perform several tasks.
+# However, when you have a good package manager (like nix), that doesn't
+# actually make much of a difference; you don't really care if it's one binary
+# or 10 since with a good package manager, installing and running it is
+# identical.
+# Since upstream k3s packages itself as one large binary with several
+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
+# some exceptions.
+# K3s also carries patches to some packages (such as containerd and cni
+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
+# even if the upstream version of those binaries exist in nixpkgs already. In
+# the end, that means we have a thick k3s binary that behaves like the upstream
+# one for the most part.
+# However, k3s also bundles several pieces of unpatched software, from the
+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
+# Those pieces of software we entirely ignore upstream's handling of, and just
+# make sure they're in the path if desired.
+let
+  k3sVersion = "1.23.6+k3s1";     # k3s git tag
+  k3sCommit = "418c3fa858b69b12b9cefbcff0526f666a6236b9"; # k3s git commit at the above version
+  k3sRepoSha256 = "0fmw491dn5mpi058mr7sij51i5m4qg2grx30cnl3h2v4s0sdkx2i";
+  k3sVendorSha256 = "sha256-iHg5ySMaiSWXs98YGmxPwdZr4zdBIFma12dNEuf30Hs=";
+
+  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
+  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
+  traefikChartVersion = "10.19.3";
+  traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
+
+  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
+  k3sRootVersion = "0.11.0";
+  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
+
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
+  k3sCNIVersion = "1.0.1-k3s1";
+  k3sCNISha256 = "11ihlzzdnqf9p21y0a4ckpbxac016nm7746dcykhj26ym9zxyv92";
+
+  # taken from go.mod, the 'github.com/containerd/containerd' line
+  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
+  containerdVersion = "1.5.11-k3s2";
+  containerdSha256 = "16132snvrg8r0vwm6c0lz0q6fx686s2ix53nm3aka9a83xs75vf2";
+
+  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
+  criCtlVersion = "1.22.0-k3s1";
+
+  baseMeta = {
+    description = "A lightweight Kubernetes distribution";
+    license = licenses.asl20;
+    homepage = "https://k3s.io";
+    maintainers = with maintainers; [ euank mic92 superherointj ];
+    platforms = platforms.linux;
+  };
+
+  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
+  versionldflags = [
+    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
+    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
+    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
+    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/component-base/version.gitTreeState=clean"
+    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
+    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
+    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
+    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
+  ];
+
+  # bundled into the k3s binary
+  traefikChart = fetchurl {
+    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
+    sha256 = traefikChartSha256;
+  };
+  # so, k3s is a complicated thing to package
+  # This derivation attempts to avoid including any random binaries from the
+  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
+  # we don't care about doing, we can add those as build or runtime
+  # dependencies using a real package manager).
+  # In addition to those binaries, it's also configuration though (right now
+  # mostly strongswan configuration), and k3s does use those files.
+  # As such, we download it in order to grab 'etc' and bundle it into the final
+  # k3s binary.
+  k3sRoot = fetchzip {
+    # Note: marked as apache 2.0 license
+    url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
+    sha256 = k3sRootSha256;
+    stripRoot = false;
+  };
+  k3sCNIPlugins = buildGoModule rec {
+    pname = "k3s-cni-plugins";
+    version = k3sCNIVersion;
+    vendorSha256 = null;
+
+    subPackages = [ "." ];
+
+    src = fetchFromGitHub {
+      owner = "rancher";
+      repo = "plugins";
+      rev = "v${version}";
+      sha256 = k3sCNISha256;
+    };
+
+    postInstall = ''
+      mv $out/bin/plugins $out/bin/cni
+    '';
+
+    meta = baseMeta // {
+      description = "CNI plugins, as patched by rancher for k3s";
+    };
+  };
+  # Grab this separately from a build because it's used by both stages of the
+  # k3s build.
+  k3sRepo = fetchgit {
+    url = "https://github.com/k3s-io/k3s";
+    rev = "v${k3sVersion}";
+    sha256 = k3sRepoSha256;
+  };
+  # Stage 1 of the k3s build:
+  # Let's talk about how k3s is structured.
+  # One of the ideas of k3s is that there's the single "k3s" binary which can
+  # do everything you need, from running a k3s server, to being a worker node,
+  # to running kubectl.
+  # The way that actually works is that k3s is a single go binary that contains
+  # a bunch of bindata that it unpacks at runtime into directories (either the
+  # user's home directory or /var/lib/rancher if run as root).
+  # This bindata includes both binaries and configuration.
+  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
+  # First, we build all the binaries that get packed into the thick k3s binary
+  # (and output them from one derivation so they'll all be suitably patched up).
+  # Then, we bundle those binaries into our thick k3s binary and use that as
+  # the final single output.
+  # This approach was chosen because it ensures the bundled binaries all are
+  # correctly built to run with nix (we can lean on the existing buildGoModule
+  # stuff), and we can again lean on that tooling for the final k3s binary too.
+  # Other alternatives would be to manually run the
+  # strip/patchelf/remove-references step ourselves in the installPhase of the
+  # derivation when we've built all the binaries, but haven't bundled them in
+  # with generated bindata yet.
+
+  k3sServer = buildGoModule rec {
+    pname = "k3s-server";
+    version = k3sVersion;
+
+    src = k3sRepo;
+    vendorSha256 = k3sVendorSha256;
+
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libseccomp ];
+
+    subPackages = [ "cmd/server" ];
+    ldflags = versionldflags;
+
+    # create the multicall symlinks for k3s
+    postInstall = ''
+      mv $out/bin/server $out/bin/k3s
+      pushd $out
+      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+      ln -s k3s ./bin/k3s-agent
+      ln -s k3s ./bin/k3s-server
+      ln -s k3s ./bin/k3s-etcd-snapshot
+      ln -s k3s ./bin/k3s-secrets-encrypt
+      ln -s k3s ./bin/k3s-certificate
+      ln -s k3s ./bin/kubectl
+      ln -s k3s ./bin/crictl
+      ln -s k3s ./bin/ctr
+      popd
+    '';
+
+    meta = baseMeta // {
+      description = "The various binaries that get packaged into the final k3s binary";
+    };
+  };
+  k3sContainerd = buildGoModule {
+    pname = "k3s-containerd";
+    version = containerdVersion;
+    src = fetchFromGitHub {
+      owner = "k3s-io";
+      repo = "containerd";
+      rev = "v${containerdVersion}";
+      sha256 = containerdSha256;
+    };
+    vendorSha256 = null;
+    buildInputs = [ btrfs-progs ];
+    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
+    ldflags = versionldflags;
+  };
+in
+buildGoModule rec {
+  pname = "k3s";
+  version = k3sVersion;
+
+  src = k3sRepo;
+  vendorSha256 = k3sVendorSha256;
+
+  patches = [
+    ./patches/0001-scrips-download-strip-downloading-just-package-CRD.patch
+  ];
+
+  postPatch = ''
+    # Nix prefers dynamically linked binaries over static binary.
+
+    substituteInPlace scripts/package-cli \
+      --replace '"$LDFLAGS $STATIC" -o' \
+                '"$LDFLAGS" -o' \
+      --replace "STATIC=\"-extldflags \'-static\'\"" \
+                ""
+
+    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
+
+    substituteInPlace scripts/package-cli \
+      --replace '"''${GO}" generate' \
+                'GOFLAGS="" "''${GO}" generate'
+  '';
+
+  # Important utilities used by the kubelet, see
+  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
+  # Note the list in that issue is stale and some aren't relevant for k3s.
+  k3sRuntimeDeps = [
+    kmod
+    socat
+    iptables
+    iproute2
+    bridge-utils
+    ethtool
+    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
+    conntrack-tools
+  ];
+
+  buildInputs = k3sRuntimeDeps;
+
+  nativeBuildInputs = [
+    makeWrapper
+    rsync
+    yq-go
+    zstd
+  ];
+
+  # embedded in the final k3s cli
+  propagatedBuildInputs = [
+    k3sCNIPlugins
+    k3sContainerd
+    k3sServer
+    runc
+  ];
+
+  # We override most of buildPhase due to peculiarities in k3s's build.
+  # Specifically, it has a 'go generate' which runs part of the package. See
+  # this comment:
+  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
+  # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
+  buildPhase = ''
+    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
+
+    # copy needed 'go generate' inputs into place
+    mkdir -p ./bin/aux
+    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
+    ln -vsf ${runc}/bin/runc ./bin/runc
+    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
+    ln -vsf ${k3sContainerd}/bin/* ./bin/
+    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
+    mkdir -p ./build/static/charts
+    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
+    export TRAEFIK_CHART_FILE=${traefikChart}
+    # place the traefik chart using their code since it's complicated
+    # We trim the actual download, see patches
+    ./scripts/download
+
+    export ARCH=$GOARCH
+    export DRONE_TAG="v${k3sVersion}"
+    export DRONE_COMMIT="${k3sCommit}"
+    # use ./scripts/package-cli to run 'go generate' + 'go build'
+
+    ./scripts/package-cli
+    mkdir -p $out/bin
+  '';
+
+  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
+  doCheck = false;
+
+  installPhase = ''
+    # wildcard to match the arm64 build too
+    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
+    wrapProgram $out/bin/k3s \
+      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
+      --prefix PATH : "$out/bin"
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  passthru.tests = { inherit (nixosTests) k3s-single-node k3s-single-node-docker; };
+
+  meta = baseMeta;
+}

pkgs/applications/networking/cluster/k3s/patches/0001-scrips-download-strip-downloading-just-package-CRD.patch

@@ -0,0 +1,41 @@
+From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
+From: Euan Kemp <euank@euank.com>
+Date: Thu, 3 Feb 2022 23:50:40 -0800
+Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
+
+The CRD packaging is a complicated set of commands, so let's reuse it.
+---
+ scripts/download | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/scripts/download b/scripts/download
+index 5effc0562a..82361803ee 100755
+--- a/scripts/download
++++ b/scripts/download
+@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
+ mkdir -p ${CHARTS_DIR}
+ mkdir -p ${DATA_DIR}
+ 
+-curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
+-
+-git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
+-
+-git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
+-
+ setup_tmp() {
+     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
+     cleanup() {
+@@ -44,8 +38,8 @@ setup_tmp() {
+ 
+ download_and_package_traefik () {
+   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
+-  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
+-  code=$?
++  # nixpkgs: copy in our known traefik chart instead
++  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
+ 
+   if [ $code -ne 0 ]; then
+     echo "Error: Failed to download Traefik Helm chart!"
+-- 
+2.34.1
+

pkgs/applications/networking/cluster/k3s/update.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep gnused jq yq-go nix-prefetch
+
+set -x -eu -o pipefail
+
+WORKDIR=$(mktemp -d)
+trap "rm -rf ${WORKDIR}" EXIT
+
+NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"/
+NIXPKGS_K3S_FOLDER=$(cd $(dirname ${BASH_SOURCE[0]}); pwd -P)/
+cd ${NIXPKGS_K3S_FOLDER}
+
+LATEST_TAG_RAWFILE=${WORKDIR}/latest_tag.json
+curl --silent ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+    https://api.github.com/repos/k3s-io/k3s/releases > ${LATEST_TAG_RAWFILE}
+
+LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} | \
+    grep -v -e rc -e engine | tail -n +2 | head -n -1 | sed 's|[", ]||g' | sort -rV | head -n1)
+
+K3S_VERSION=$(echo ${LATEST_TAG_NAME} | sed 's/^v//')
+
+K3S_COMMIT=$(curl --silent ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+    https://api.github.com/repos/k3s-io/k3s/tags \
+    | jq -r "map(select(.name == \"${LATEST_TAG_NAME}\")) | .[0] | .commit.sha")
+
+K3S_REPO_SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/k3s-io/k3s/archive/refs/tags/${LATEST_TAG_NAME}.tar.gz)
+
+FILE_SCRIPTS_DOWNLOAD=${WORKDIR}/scripts-download
+curl --silent https://raw.githubusercontent.com/k3s-io/k3s/${K3S_COMMIT}/scripts/download > $FILE_SCRIPTS_DOWNLOAD
+
+FILE_SCRIPTS_VERSION=${WORKDIR}/scripts-version.sh
+curl --silent https://raw.githubusercontent.com/k3s-io/k3s/${K3S_COMMIT}/scripts/version.sh > $FILE_SCRIPTS_VERSION
+
+FILE_MANIFESTS_TRAEFIK=${WORKDIR}/manifests-traefik.yaml
+curl --silent https://raw.githubusercontent.com/k3s-io/k3s/${K3S_COMMIT}/manifests/traefik.yaml > $FILE_MANIFESTS_TRAEFIK
+
+FILE_GO_MOD=${WORKDIR}/go.mod
+curl --silent https://raw.githubusercontent.com/k3s-io/k3s/${K3S_COMMIT}/go.mod > $FILE_GO_MOD
+
+TRAEFIK_CHART_VERSION=$(yq e '.spec.chart' $FILE_MANIFESTS_TRAEFIK | awk 'match($0, /([0-9.]+)([0-9]{2})/,
+m) { print m[1]; exit; }')
+TRAEFIK_CHART_SHA256=$(nix-prefetch-url --quiet "https://helm.traefik.io/traefik/traefik-${TRAEFIK_CHART_VERSION}.tgz")
+
+K3S_ROOT_VERSION=$(grep 'VERSION_ROOT=' ${FILE_SCRIPTS_VERSION} \
+    | cut -d'=' -f2 | sed -e 's/"//g' -e 's/^v//')
+K3S_ROOT_SHA256=$(nix-prefetch-url --quiet --unpack \
+    "https://github.com/k3s-io/k3s-root/releases/download/v${K3S_ROOT_VERSION}/k3s-root-amd64.tar")
+
+CNIPLUGINS_VERSION=$(grep 'VERSION_CNIPLUGINS=' ${FILE_SCRIPTS_VERSION} \
+    | cut -d'=' -f2 | sed -e 's/"//g' -e 's/^v//')
+CNIPLUGINS_SHA256=$(nix-prefetch-url --quiet --unpack \
+    "https://github.com/rancher/plugins/archive/refs/tags/v${CNIPLUGINS_VERSION}.tar.gz")
+
+CONTAINERD_VERSION=$(grep github.com/containerd/containerd ${FILE_GO_MOD} \
+    | head -n1 | awk '{print $4}' | sed -e 's/"//g' -e 's/^v//')
+CONTAINERD_SHA256=$(nix-prefetch-url --quiet --unpack \
+    "https://github.com/k3s-io/containerd/archive/refs/tags/v${CONTAINERD_VERSION}.tar.gz")
+
+CRI_CTL_VERSION=$(grep github.com/kubernetes-sigs/cri-tools ${FILE_GO_MOD} \
+    | head -n1 | awk '{print $4}' | sed -e 's/"//g' -e 's/^v//')
+
+setKV () {
+    sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" ${NIXPKGS_K3S_FOLDER}default.nix
+}
+
+setKV k3sVersion ${K3S_VERSION}
+setKV k3sCommit ${K3S_COMMIT}
+setKV k3sRepoSha256 ${K3S_REPO_SHA256}
+
+setKV traefikChartVersion ${TRAEFIK_CHART_VERSION}
+setKV traefikChartSha256 ${TRAEFIK_CHART_SHA256}
+
+setKV k3sRootVersion ${K3S_ROOT_VERSION}
+setKV k3sRootSha256 ${K3S_ROOT_SHA256}
+
+setKV k3sCNIVersion ${CNIPLUGINS_VERSION}
+setKV k3sCNISha256 ${CNIPLUGINS_SHA256}
+
+setKV containerdVersion ${CONTAINERD_VERSION}
+setKV containerdSha256 ${CONTAINERD_SHA256}
+
+setKV criCtlVersion ${CRI_CTL_VERSION}
+
+set +e
+K3S_VENDOR_SHA256=$(nix-prefetch -I nixpkgs=${NIXPKGS_ROOT} "{ sha256 }: (import ${NIXPKGS_ROOT}. {}).k3s.go-modules.overrideAttrs (_: { vendorSha256 = sha256; })")
+set -e
+
+if [ -n "${K3S_VENDOR_SHA256:-}" ]; then
+    setKV k3sVendorSha256 ${K3S_VENDOR_SHA256}
+else
+    echo "Update failed. K3S_VENDOR_SHA256 is empty."
+    exit 1
+fi

pkgs/applications/networking/cluster/k3sup/default.nix

@@ -0,0 +1,48 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeWrapper
+, bash
+, openssh
+}:
+
+buildGoModule rec {
+  pname = "k3sup";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "alexellis";
+    repo = "k3sup";
+    rev = version;
+    sha256 = "sha256-6WYUmC2uVHFGLsfkA2EUOWmmo1dSKJzI4MEdRnlLgYY=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  vendorSha256 = "sha256-Pd+BgPWoxf1AhP0o5SgFSvy4LyUQB7peKWJk0BMy7ds=";
+
+  postConfigure = ''
+    substituteInPlace vendor/github.com/alexellis/go-execute/pkg/v1/exec.go \
+      --replace "/bin/bash" "${bash}/bin/bash"
+  '';
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/alexellis/k3sup/cmd.GitCommit=ref/tags/${version}"
+    "-X github.com/alexellis/k3sup/cmd.Version=${version}"
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/k3sup" \
+      --prefix PATH : ${lib.makeBinPath [ openssh ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/alexellis/k3sup";
+    description = "Bootstrap Kubernetes with k3s over SSH";
+    license = licenses.mit;
+    maintainers = with maintainers; [ welteki ];
+  };
+}

pkgs/applications/networking/cluster/k9s/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "k9s";
+  version = "0.25.18";
+
+  src = fetchFromGitHub {
+    owner  = "derailed";
+    repo   = "k9s";
+    rev    = "v${version}";
+    sha256 = "sha256-iUhMPtFX7qFULegiyhlT4aG9q3deZ8aRqyEcbZ9jY/s=";
+  };
+
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/derailed/k9s/cmd.version=${version}"
+    "-X github.com/derailed/k9s/cmd.commit=${src.rev}"
+  ];
+
+  vendorSha256 = "sha256-mMob7M9RQlqaVK0DgHpaAK9d1btzfQetnliUqFTvjJQ=";
+
+  preCheck = "export HOME=$(mktemp -d)";
+
+  # TODO investigate why some config tests are failing
+  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
+
+  meta = with lib; {
+    description = "Kubernetes CLI To Manage Your Clusters In Style";
+    homepage = "https://github.com/derailed/k9s";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ Gonzih markus1189 bryanasdev000 ];
+  };
+}

pkgs/applications/networking/cluster/kanif/default.nix

@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchurl, perl , taktuk}:
+
+stdenv.mkDerivation rec {
+  version = "1.2.2";
+  pname = "kanif";
+
+  src = fetchurl {
+    url = "https://gforge.inria.fr/frs/download.php/26773/${pname}-${version}.tar.gz";
+    sha256 = "3f0c549428dfe88457c1db293cfac2a22b203f872904c3abf372651ac12e5879";
+  };
+
+  preBuild = ''
+      substituteInPlace ./kanif --replace "/usr/bin/perl" "${perl}/bin/perl"
+      substituteInPlace ./kanif --replace '$taktuk_command = "taktuk";' '$taktuk_command = "${taktuk}/bin/taktuk";'
+  '';
+
+  meta = {
+    description = "Cluster management and administration swiss army knife";
+    longDescription = ''
+      Kanif is a tool for high performance computing clusters management and
+      administration. It combines the main functionalities of well-known cluster
+      management tools such as c3, pdsh and dsh, and mimics their syntax. It
+      provides three tools to run the same command on several nodes ("parallel
+      ssh", using the 'kash' command), to broadcast the copy of files or
+      directories to several nodes ('kaput' command), and to gather several
+      remote files or directories locally ('kaget' command). It relies on TakTuk
+      for efficiency and scalability.'';
+    homepage = "http://taktuk.gforge.inria.fr/kanif";
+    license = lib.licenses.gpl2;
+    maintainers = [ lib.maintainers.bzizou ];
+    platforms = lib.platforms.linux;
+  };
+
+}
+

pkgs/applications/networking/cluster/kbst/default.nix

@@ -0,0 +1,40 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kbst";
+  version = "0.1.5";
+
+  src = fetchFromGitHub{
+    owner = "kbst";
+    repo = "kbst";
+    rev = "v${version}";
+    sha256 = "0cz327fl6cqj9rdi8zw6xrazzigjymhn1hsbjr9xxvfvfnn67xz2";
+  };
+
+  ldflags =
+    let package_url = "github.com/kbst/kbst"; in
+    [
+      "-s" "-w"
+      "-X ${package_url}.version=${version}"
+      "-X ${package_url}.buildDate=unknown"
+      "-X ${package_url}.gitCommit=${src.rev}"
+      "-X ${package_url}.gitTag=v${version}"
+      "-X ${package_url}.gitTreeState=clean"
+    ];
+
+  vendorSha256 = "sha256-DZ47Bj8aFfBnxU9+e1jZiTMF75rCJtcj4yUfZRJWCic=";
+
+  doCheck = false;
+
+  doPostInstallCheck = true;
+  PostInstallCheckPhase = ''
+    $out/bin/kbst help | grep v${version} > /dev/null
+  '';
+
+  meta = with lib; {
+    description = "Kubestack framework CLI";
+    homepage = "https://www.kubestack.com/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mtrsk ];
+  };
+}

pkgs/applications/networking/cluster/kconf/default.nix

@@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kconf";
+  version = "1.11.0";
+
+  src = fetchFromGitHub {
+    owner = "particledecay";
+    repo = "kconf";
+    rev = "v${version}";
+    sha256 = "sha256-V+B1vqI/MLASqEy6DZiB71h7EkUfrxVKIMxriRK6pyY=";
+  };
+
+  vendorSha256 = "sha256-Fq3V3vYaofB0TWt3t7uW1Dd7MlwMvh8RaRVpdq9XZh4=";
+
+  ldflags = [
+      "-s" "-w" "-X github.com/particledecay/kconf/build.Version=${version}"
+  ];
+
+  meta = with lib; {
+    description = "An opinionated command line tool for managing multiple kubeconfigs";
+    homepage = "https://github.com/particledecay/kconf";
+    license = licenses.mit;
+    maintainers = with maintainers; [ thmzlt ];
+  };
+}

pkgs/applications/networking/cluster/kfctl/default.nix

@@ -0,0 +1,32 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kfctl";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "kubeflow";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-FY7o4QULobLY1djfcc2l6awE/v2stN7cc2lffMkjoPc=";
+  };
+
+  vendorSha256 = "sha256-+6sxXp0LKegZjEFv1CIQ6xYh+hXLn+o9LggRYamCzpI=";
+
+  subPackages = [ "cmd/kfctl" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+  installShellCompletion --cmd eksctl \
+    --bash <($out/bin/kfctl completion bash) \
+    --zsh <($out/bin/kfctl completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "A CLI for deploying and managing Kubeflow";
+    homepage = "https://github.com/kubeflow/kfctl";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mvnetbiz ];
+  };
+}

pkgs/applications/networking/cluster/kn/default.nix

@@ -0,0 +1,44 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kn";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "knative";
+    repo = "client";
+    rev = "knative-v${version}";
+    sha256 = "sha256-Q67dictDE+HWw99lFAiidBvIL30mMAkjYb2CDLDcalw=";
+  };
+
+  vendorSha256 = null;
+
+  subPackages = [ "cmd/kn" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-X knative.dev/client/pkg/kn/commands/version.Version=v${version}"
+    "-X knative.dev/client/pkg/kn/commands/version.VersionEventing=v${version}"
+    "-X knative.dev/client/pkg/kn/commands/version.VersionServing=v${version}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd kn \
+      --bash <($out/bin/kn completion bash) \
+      --zsh <($out/bin/kn completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/kn version | grep ${version} > /dev/null
+  '';
+
+  meta = with lib; {
+    description = "The Knative client kn is your door to the Knative world. It allows you to create Knative resources interactively from the command line or from within scripts";
+    homepage = "https://github.com/knative/client";
+    changelog = "https://github.com/knative/client/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bryanasdev000 ];
+  };
+}

pkgs/applications/networking/cluster/kompose/default.nix

@@ -0,0 +1,41 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, kompose }:
+
+buildGoModule rec {
+  pname = "kompose";
+  version = "1.26.1";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes";
+    repo = "kompose";
+    rev = "v${version}";
+    sha256 = "sha256-NfzqGG5ZwPpmjhvcvXN1AA+kfZG/oujbAEtXkm1mzeU=";
+  };
+
+  vendorSha256 = "sha256-OR5U2PnebO0a+lwU09Dveh0Yxk91cmSRorTxQIO5lHc=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [ "-s" "-w" ];
+
+  checkFlags = [ "-short" ];
+
+  postInstall = ''
+    for shell in bash zsh; do
+      $out/bin/kompose completion $shell > kompose.$shell
+      installShellCompletion kompose.$shell
+    done
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = kompose;
+    command = "kompose version";
+  };
+
+  meta = with lib; {
+    description = "A tool to help users who are familiar with docker-compose move to Kubernetes";
+    homepage = "https://kompose.io";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ thpham vdemeester ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/kontemplate/default.nix

@@ -0,0 +1,34 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  pname = "kontemplate";
+  version       = "1.8.0";
+  goPackagePath = "github.com/tazjin/kontemplate";
+  goDeps        = ./deps.nix;
+
+  src = fetchFromGitHub {
+    owner  = "tazjin";
+    repo   = "kontemplate";
+    rev    = "v${version}";
+    sha256 = "123mjmmm4hynraq1fpn3j5i0a1i87l265kkjraxxxbl0zacv74i1";
+  };
+
+  meta = with lib; {
+    description      = "Extremely simple Kubernetes resource templates";
+    homepage         = "http://kontemplate.works";
+    downloadPage     = "https://github.com/tazjin/kontemplate/releases";
+    license          = licenses.gpl3;
+    maintainers      = with maintainers; [ mbode tazjin ];
+    platforms        = platforms.unix;
+
+    longDescription = ''
+      Kontemplate is a simple CLI tool that can take sets of
+      Kubernetes resource files with placeholders and insert values
+      per environment.
+
+      It can be used as a simple way of deploying the same set of
+      resources to different Kubernetes contexts with context-specific
+      configuration.
+    '';
+  };
+}

pkgs/applications/networking/cluster/kontemplate/deps.nix

@@ -0,0 +1,111 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
+[
+  {
+    goPackagePath = "github.com/Masterminds/goutils";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/goutils";
+      rev = "41ac8693c5c10a92ea1ff5ac3a7f95646f6123b0";
+      sha256 = "180px47gj936qyk5bkv5mbbgiil9abdjq6kwkf7sq70vyi9mcfiq";
+    };
+  }
+  {
+    goPackagePath = "github.com/Masterminds/semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/semver";
+      rev = "5bc3b9184d48f1412b300b87a200cf020d9254cf";
+      sha256 = "1vdfm653v50jf63cw0kg2hslx50cn4mk6lj3p51bi11jrg48kfng";
+    };
+  }
+  {
+    goPackagePath = "github.com/Masterminds/sprig";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/sprig";
+      rev = "6f509977777c33eae63b2136d97f7b976cb971cc";
+      sha256 = "05h9k6fhjxnpwlihj3z02q9kvqvnq53jix0ab84sx0666bci3cdh";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/template";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/template";
+      rev = "fb15b899a75114aa79cc930e33c46b577cc664b1";
+      sha256 = "1vlasv4dgycydh5wx6jdcvz40zdv90zz1h7836z7lhsi2ymvii26";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "c3de453c63f4bdb4dadffab9805ec00426c505f7";
+      sha256 = "0js37zlgv37y61j4a2d46jh72xm5kxmpaiw0ya9v944bjpc386my";
+    };
+  }
+  {
+    goPackagePath = "github.com/ghodss/yaml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ghodss/yaml";
+      rev = "25d852aebe32c875e9c044af3eef9c7dc6bc777f";
+      sha256 = "1w9yq0bxzygc4qwkwwiy7k1k1yviaspcqqv18255k2xkjv5ipccz";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/uuid";
+      rev = "c2e93f3ae59f2904160ceaab466009f965df46d6";
+      sha256 = "0zw8fvl6jqg0fmv6kmvhss0g4gkrbvgyvl2zgy5wdbdlgp4fja0h";
+    };
+  }
+  {
+    goPackagePath = "github.com/huandu/xstrings";
+    fetch = {
+      type = "git";
+      url = "https://github.com/huandu/xstrings";
+      rev = "8bbcf2f9ccb55755e748b7644164cd4bdce94c1d";
+      sha256 = "1ivvc95514z63k7cpz71l0dwlanffmsh1pijhaqmp41kfiby8rsx";
+    };
+  }
+  {
+    goPackagePath = "github.com/imdario/mergo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/imdario/mergo";
+      rev = "4c317f2286be3bd0c4f1a0e622edc6398ec4656d";
+      sha256 = "0bihha1qsgfjk14yv1hwddv3d8dzxpbjlaxwwyys6lhgxz1cr9h9";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "9756ffdc24725223350eb3266ffb92590d28f278";
+      sha256 = "0q7hxaaq6lp0v8qqzifvysl47z5rfdlrxkh3d29vsl3wyby3dxl8";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v2";
+      rev = "947dcec5ba9c011838740e680966fd7087a71d0d";
+      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "51d6538a90f86fe93ac480b35f37b2be17fef232";
+      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
+    };
+  }
+]

pkgs/applications/networking/cluster/kops/default.nix

@@ -0,0 +1,69 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+let
+  generic = { version, sha256, rev ? version, ... }@attrs:
+    let attrs' = builtins.removeAttrs attrs [ "version" "sha256" "rev" ]; in
+    buildGoModule
+      {
+        pname = "kops";
+        inherit version;
+
+        src = fetchFromGitHub {
+          rev = rev;
+          owner = "kubernetes";
+          repo = "kops";
+          inherit sha256;
+        };
+
+        vendorSha256 = null;
+
+        nativeBuildInputs = [ installShellFiles ];
+
+        subPackages = [ "cmd/kops" ];
+
+        ldflags = [
+          "-s"
+          "-w"
+          "-X k8s.io/kops.Version=${version}"
+          "-X k8s.io/kops.GitVersion=${version}"
+        ];
+
+        doCheck = false;
+
+        postInstall = ''
+          installShellCompletion --cmd kops \
+            --bash <($GOPATH/bin/kops completion bash) \
+            --fish <($GOPATH/bin/kops completion fish) \
+            --zsh <($GOPATH/bin/kops completion zsh)
+        '';
+
+        meta = with lib; {
+          description = "Easiest way to get a production Kubernetes up and running";
+          homepage = "https://github.com/kubernetes/kops";
+          changelog = "https://github.com/kubernetes/kops/tree/master/docs/releases";
+          license = licenses.asl20;
+          maintainers = with maintainers; [ offline zimbatm diegolelis yurrriq ];
+          platforms = platforms.unix;
+        };
+      } // attrs';
+in
+rec {
+  mkKops = generic;
+
+  kops_1_21 = mkKops rec {
+    version = "1.21.4";
+    sha256 = "sha256-f2xOVa3N/GH5IoI6H/QwDdKTeQoF/kEHX6lNytCZ9cs=";
+    rev = "v${version}";
+  };
+
+  kops_1_22 = mkKops rec {
+    version = "1.22.4";
+    sha256 = "sha256-osU7yI77ZALGrAGuP8qAgv+ogDRn+BSVmcjPbi/WEKE=";
+    rev = "v${version}";
+  };
+
+  kops_1_23 = mkKops rec {
+    version = "1.23.2";
+    sha256 = "sha256-9GANjGRS9QaJw+CEeMv/f+rEu37QV2YxMvSRSH6+3PM=";
+    rev = "v${version}";
+  };
+}

pkgs/applications/networking/cluster/kpt/default.nix

@@ -0,0 +1,27 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "kpt";
+  version = "0.39.2";
+
+  src = fetchFromGitHub {
+    owner = "GoogleContainerTools";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-PG4SzycXRguKyaQ7LDnTtxF3EgqcjfjeEWD5rROXBPI=";
+  };
+
+  vendorSha256 = "sha256-CoXlUX9hkP8gijA/vg19AS9030w95A2oKGD1wjzO8ak=";
+
+  subPackages = [ "." ];
+
+  ldflags = [ "-s" "-w" "-X github.com/GoogleContainerTools/kpt/run.version=${version}" ];
+
+  meta = with lib; {
+    description = "A toolkit to help you manage, manipulate, customize, and apply Kubernetes Resource configuration data files";
+    homepage = "https://googlecontainertools.github.io/kpt/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mikefaille ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}

pkgs/applications/networking/cluster/krane/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gem 'krane'

pkgs/applications/networking/cluster/krane/Gemfile.lock

@@ -0,0 +1,121 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (7.0.3)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+    addressable (2.8.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    colorize (0.8.1)
+    concurrent-ruby (1.1.10)
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
+    ejson (1.3.1)
+    faraday (1.10.0)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.0)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.3)
+      multipart-post (>= 1.2, < 3)
+    faraday-net_http (1.0.1)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
+    ffi (1.15.5)
+    ffi-compiler (1.0.1)
+      ffi (>= 1.0.0)
+      rake
+    googleauth (0.17.1)
+      faraday (>= 0.17.3, < 2.0)
+      jwt (>= 1.4, < 3.0)
+      memoist (~> 0.16)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (~> 0.15)
+    http (4.4.1)
+      addressable (~> 2.3)
+      http-cookie (~> 1.0)
+      http-form_data (~> 2.2)
+      http-parser (~> 1.2.0)
+    http-accept (1.7.0)
+    http-cookie (1.0.4)
+      domain_name (~> 0.5)
+    http-form_data (2.3.0)
+    http-parser (1.2.3)
+      ffi-compiler (>= 1.0, < 2.0)
+    i18n (1.10.0)
+      concurrent-ruby (~> 1.0)
+    jsonpath (1.1.2)
+      multi_json
+    jwt (2.3.0)
+    krane (2.4.6)
+      activesupport (>= 5.0)
+      colorize (~> 0.8)
+      concurrent-ruby (~> 1.1)
+      ejson (~> 1.0)
+      googleauth (~> 0.8)
+      jsonpath (~> 1.0)
+      kubeclient (~> 4.9)
+      oj (~> 3.0)
+      statsd-instrument (>= 2.8, < 4)
+      thor (>= 1.0, < 2.0)
+    kubeclient (4.9.3)
+      http (>= 3.0, < 5.0)
+      jsonpath (~> 1.0)
+      recursive-open-struct (~> 1.1, >= 1.1.1)
+      rest-client (~> 2.0)
+    memoist (0.16.2)
+    mime-types (3.4.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2022.0105)
+    minitest (5.15.0)
+    multi_json (1.15.0)
+    multipart-post (2.1.1)
+    netrc (0.11.0)
+    oj (3.13.11)
+    os (1.1.4)
+    public_suffix (4.0.7)
+    rake (13.0.6)
+    recursive-open-struct (1.1.3)
+    rest-client (2.1.0)
+      http-accept (>= 1.7.0, < 2.0)
+      http-cookie (>= 1.0.2, < 2.0)
+      mime-types (>= 1.16, < 4.0)
+      netrc (~> 0.8)
+    ruby2_keywords (0.0.5)
+    signet (0.16.1)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.0)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
+    statsd-instrument (3.1.2)
+    thor (1.2.1)
+    tzinfo (2.0.4)
+      concurrent-ruby (~> 1.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.8.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  krane
+
+BUNDLED WITH
+   2.3.9

pkgs/applications/networking/cluster/krane/default.nix

@@ -0,0 +1,19 @@
+{ lib
+, bundlerApp
+, bundlerUpdateScript
+}:
+
+bundlerApp {
+  pname = "krane";
+  gemdir = ./.;
+  exes = [ "krane" ];
+
+  passthru.updateScript = bundlerUpdateScript "krane";
+
+  meta = with lib; {
+    description = "A command-line tool that helps you ship changes to a Kubernetes namespace and understand the result";
+    homepage = "https://github.com/Shopify/krane";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kira-bruneau ];
+  };
+}

pkgs/applications/networking/cluster/krane/gemset.nix

@@ -0,0 +1,521 @@
+{
+  activesupport = {
+    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z05zyc57f8ywvdvls6nx93vrhyyzzpgz729mwampz1qb8vvcspj";
+      type = "gem";
+    };
+    version = "7.0.3";
+  };
+  addressable = {
+    dependencies = ["public_suffix"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "022r3m9wdxljpbya69y2i3h9g3dhhfaqzidf95m6qjzms792jvgp";
+      type = "gem";
+    };
+    version = "2.8.0";
+  };
+  colorize = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "133rqj85n400qk6g3dhf2bmfws34mak1wqihvh3bgy9jhajw580b";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
+  concurrent-ruby = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
+      type = "gem";
+    };
+    version = "1.1.10";
+  };
+  domain_name = {
+    dependencies = ["unf"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lcqjsmixjp52bnlgzh4lg9ppsk52x9hpwdjd53k8jnbah2602h0";
+      type = "gem";
+    };
+    version = "0.5.20190701";
+  };
+  ejson = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gmfyyzzvb9k5nm1a5x83d7krajfghghfsakhxmdpvncyj2vnrpa";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
+  faraday = {
+    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-multipart" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "faraday-retry" "ruby2_keywords"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00palwawk897p5gypw5wjrh93d4p0xz2yl9w93yicb4kq7amh8d4";
+      type = "gem";
+    };
+    version = "1.10.0";
+  };
+  faraday-em_http = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12cnqpbak4vhikrh2cdn94assh3yxza8rq2p9w2j34bqg5q4qgbs";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  faraday-em_synchrony = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vgrbhkp83sngv6k4mii9f2s9v5lmp693hylfxp2ssfc60fas3a6";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  faraday-excon = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h09wkb0k0bhm6dqsd47ac601qiaah8qdzjh8gvxfd376x1chmdh";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  faraday-httpclient = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fyk0jd3ks7fdn8nv3spnwjpzx2lmxmg2gh4inz3by1zjzqg33sc";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  faraday-multipart = {
+    dependencies = ["multipart-post"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03qfi9020ynf7hkdiaq01sd2mllvw7fg4qiin3pk028b4wv23j3j";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  faraday-net_http = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fi8sda5hc54v1w3mqfl5yz09nhx35kglyx72w7b8xxvdr0cwi9j";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  faraday-net_http_persistent = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dc36ih95qw3rlccffcb0vgxjhmipsvxhn6cw71l7ffs0f7vq30b";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  faraday-patron = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19wgsgfq0xkski1g7m96snv39la3zxz6x7nbdgiwhg5v82rxfb6w";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  faraday-rack = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h184g4vqql5jv9s9im6igy00jp6mrah2h14py6mpf9bkabfqq7g";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  faraday-retry = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "153i967yrwnswqgvnnajgwp981k9p50ys1h80yz3q94rygs59ldd";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  ffi = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1862ydmclzy1a0cjbvm8dz7847d9rch495ib0zb64y84d3xd4bkg";
+      type = "gem";
+    };
+    version = "1.15.5";
+  };
+  ffi-compiler = {
+    dependencies = ["ffi" "rake"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0c2caqm9wqnbidcb8dj4wd3s902z15qmgxplwyfyqbwa0ydki7q1";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  googleauth = {
+    dependencies = ["faraday" "jwt" "memoist" "multi_json" "os" "signet"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08l9qb2an7a60r3xjlkrfna8b8sfnj5c2hlfdygbnpvb1p7cpafl";
+      type = "gem";
+    };
+    version = "0.17.1";
+  };
+  http = {
+    dependencies = ["addressable" "http-cookie" "http-form_data" "http-parser"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z8vmvnkrllkpzsxi94284di9r63g9v561a16an35izwak8g245y";
+      type = "gem";
+    };
+    version = "4.4.1";
+  };
+  http-accept = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09m1facypsdjynfwrcv19xcb1mqg8z6kk31g8r33pfxzh838c9n6";
+      type = "gem";
+    };
+    version = "1.7.0";
+  };
+  http-cookie = {
+    dependencies = ["domain_name"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19370bc97gsy2j4hanij246hv1ddc85hw0xjb6sj7n1ykqdlx9l9";
+      type = "gem";
+    };
+    version = "1.0.4";
+  };
+  http-form_data = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1wx591jdhy84901pklh1n9sgh74gnvq1qyqxwchni1yrc49ynknc";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  http-parser = {
+    dependencies = ["ffi-compiler"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18qqvckvqjffh88hfib6c8pl9qwk9gp89w89hl3f2s1x8hgyqka1";
+      type = "gem";
+    };
+    version = "1.2.3";
+  };
+  i18n = {
+    dependencies = ["concurrent-ruby"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0b2qyvnk4yynlg17ymkq4g5xgr275637fhl1mjh0valw3cb1fhhg";
+      type = "gem";
+    };
+    version = "1.10.0";
+  };
+  jsonpath = {
+    dependencies = ["multi_json"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fkdjic88hh0accp0sbx5mcrr9yaqwampf5c3214212d4i614138";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  jwt = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bg8pjx0mpvl10k6d8a6gc8dzlv2z5jkqcjbjcirnk032iriq838";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  krane = {
+    dependencies = ["activesupport" "colorize" "concurrent-ruby" "ejson" "googleauth" "jsonpath" "kubeclient" "oj" "statsd-instrument" "thor"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "16rf7qzwshlbhrc9fdgq44fcf2qbgjwik1kwkv1gncy12lvwfdmz";
+      type = "gem";
+    };
+    version = "2.4.6";
+  };
+  kubeclient = {
+    dependencies = ["http" "jsonpath" "recursive-open-struct" "rest-client"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ih04d0vgj91rl66iaqh8jmpskwz3g6mgajid0wlzi5skxqqxlym";
+      type = "gem";
+    };
+    version = "4.9.3";
+  };
+  memoist = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0i9wpzix3sjhf6d9zw60dm4371iq8kyz7ckh2qapan2vyaim6b55";
+      type = "gem";
+    };
+    version = "0.16.2";
+  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ipw892jbksbxxcrlx9g5ljq60qx47pm24ywgfbyjskbcl78pkvb";
+      type = "gem";
+    };
+    version = "3.4.1";
+  };
+  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "003gd7mcay800k2q4pb2zn8lwwgci4bhi42v2jvlidm8ksx03i6q";
+      type = "gem";
+    };
+    version = "3.2022.0105";
+  };
+  minitest = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
+      type = "gem";
+    };
+    version = "5.15.0";
+  };
+  multi_json = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      type = "gem";
+    };
+    version = "1.15.0";
+  };
+  multipart-post = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zgw9zlwh2a6i1yvhhc4a84ry1hv824d6g2iw2chs3k5aylpmpfj";
+      type = "gem";
+    };
+    version = "2.1.1";
+  };
+  netrc = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gzfmcywp1da8nzfqsql2zqi648mfnx6qwkig3cv36n9m0yy676y";
+      type = "gem";
+    };
+    version = "0.11.0";
+  };
+  oj = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bm8sdh7vz7ss3y21v961rd8nww23w5g4yhgvnd7jk331kdjyyzl";
+      type = "gem";
+    };
+    version = "3.13.11";
+  };
+  os = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gwd20smyhxbm687vdikfh1gpi96h8qb1x28s2pdcysf6dm6v0ap";
+      type = "gem";
+    };
+    version = "1.1.4";
+  };
+  public_suffix = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1f3knlwfwm05sfbaihrxm4g772b79032q14c16q4b38z8bi63qcb";
+      type = "gem";
+    };
+    version = "4.0.7";
+  };
+  rake = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15whn7p9nrkxangbs9hh75q585yfn66lv0v2mhj6q6dl6x8bzr2w";
+      type = "gem";
+    };
+    version = "13.0.6";
+  };
+  recursive-open-struct = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nnyr6qsqrcszf6c10n4zfjs8h9n67zvsmx6mp8brkigamr8llx3";
+      type = "gem";
+    };
+    version = "1.1.3";
+  };
+  rest-client = {
+    dependencies = ["http-accept" "http-cookie" "mime-types" "netrc"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1qs74yzl58agzx9dgjhcpgmzfn61fqkk33k1js2y5yhlvc5l19im";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  ruby2_keywords = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vz322p8n39hz3b4a9gkmz9y7a5jaz41zrm2ywf31dvkqm03glgz";
+      type = "gem";
+    };
+    version = "0.0.5";
+  };
+  signet = {
+    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jwyggz80xb3yi2hycmmw214c4072g8i56y0b0gsmpkiyk5d0vh1";
+      type = "gem";
+    };
+    version = "0.16.1";
+  };
+  statsd-instrument = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1q98rkmgrzb59zmswhr6863z6dk042i90jbp9pflwa2vy2xkfj0y";
+      type = "gem";
+    };
+    version = "3.1.2";
+  };
+  thor = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0inl77jh4ia03jw3iqm5ipr76ghal3hyjrd6r8zqsswwvi9j2xdi";
+      type = "gem";
+    };
+    version = "1.2.1";
+  };
+  tzinfo = {
+    dependencies = ["concurrent-ruby"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "10qp5x7f9hvlc0psv9gsfbxg4a7s0485wsbq1kljkxq94in91l4z";
+      type = "gem";
+    };
+    version = "2.0.4";
+  };
+  unf = {
+    dependencies = ["unf_ext"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bh2cf73i2ffh4fcpdn9ir4mhq8zi50ik0zqa1braahzadx536a9";
+      type = "gem";
+    };
+    version = "0.1.4";
+  };
+  unf_ext = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bf120xbq23zjyf8zi8h1576d71g58srr8rndig0whn10w72vrxz";
+      type = "gem";
+    };
+    version = "0.0.8.1";
+  };
+}

pkgs/applications/networking/cluster/krelay/default.nix

@@ -0,0 +1,32 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "krelay";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "knight42";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-7P+pGiML/1aZEpYAWtAPEhrBAo8e8ATcemrH8tD73w8=";
+  };
+
+  vendorSha256 = "sha256-PrL3GYP5K6ZaSAShwuDQA7WfOVJeQraxZ8jrtnajR9g=";
+
+  subPackages = [ "cmd/client" ];
+
+  ldflags = [ "-s" "-w" "-X github.com/knight42/krelay/pkg/constants.ClientVersion=${version}" ];
+
+  postInstall = ''
+    mv $out/bin/client $out/bin/kubectl-relay
+  '';
+
+  meta = with lib; {
+    description = "A better alternative to `kubectl port-forward` that can forward TCP or UDP traffic to IP/Host which is accessible inside the cluster.";
+    homepage = "https://github.com/knight42/krelay";
+    changelog = "https://github.com/knight42/krelay/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ivankovnatsky ];
+    mainProgram = "kubectl-relay";
+  };
+}

pkgs/applications/networking/cluster/kube-capacity/default.nix

@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kube-capacity";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "robscott";
+    repo = pname;
+    sha256 = "sha256-+1qewL8N3WTS7GW6fpL2+RPbFQQ/3DDMgShtBi+lRtg=";
+  };
+
+  vendorSha256 = "sha256-sMobdarMMktf34LbQnyZ6sgbfiJhWxWSQR0F+4x5J58=";
+
+  meta = with lib; {
+    description =
+      "A simple CLI that provides an overview of the resource requests, limits, and utilization in a Kubernetes cluster";
+    homepage = "https://github.com/robscott/kube-capacity";
+    changelog = "https://github.com/robscott/kube-capacity/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = [ maintainers.bryanasdev000 ];
+  };
+}

pkgs/applications/networking/cluster/kube-router/default.nix

@@ -0,0 +1,36 @@
+{ lib, buildGoModule, fetchFromGitHub, testers, kube-router }:
+
+buildGoModule rec {
+  pname = "kube-router";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "cloudnativelabs";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-WBnJPCZHtJWckoFvE8e+eAa2EC/RA7yOMlW+Cemw53Q=";
+  };
+
+  vendorSha256 = "sha256-5co+288KZf/dx/jZ7xIGh6kxuW3DdbpAsrZgYob3nWk=";
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/cloudnativelabs/kube-router/pkg/version.Version=${version}"
+    "-X github.com/cloudnativelabs/kube-router/pkg/version.BuildDate=Nix"
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = kube-router;
+  };
+
+  meta = with lib; {
+    homepage = "https://www.kube-router.io/";
+    description = "All-in-one router, firewall and service proxy for Kubernetes";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ colemickens johanot ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/cluster/kube-score/default.nix

@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kube-score";
+  version = "1.14.0";
+
+  src = fetchFromGitHub {
+    owner = "zegl";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-6/+S1aj2qoUPz+6+8Z4Z5dpfyOi/DnrLLUpPgBn/OxU=";
+  };
+
+  vendorSha256 = "sha256-0Zi62FmX4rFl3os2ehtussSSUPJtxLq7622CEdeKZCs=";
+
+  meta = with lib; {
+    description = "Kubernetes object analysis with recommendations for improved reliability and security";
+    homepage    = "https://github.com/zegl/kube-score";
+    license     = licenses.mit;
+    maintainers = [ maintainers.j4m3s ];
+  };
+}

pkgs/applications/networking/cluster/kube3d/default.nix

@@ -0,0 +1,72 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+, k3sVersion ? null
+}:
+
+let
+  hasVPrefix = ver: (builtins.elemAt (lib.stringToCharacters ver) 0) == "v";
+  k3sVersionSet =
+    if k3sVersion != null then
+      if hasVPrefix k3sVersion then throw "k3sVersion should not have a v prefix" else true
+    else
+      false;
+in
+buildGoModule rec {
+  pname = "kube3d";
+  version = "5.4.1";
+
+  src = fetchFromGitHub {
+    owner = "k3d-io";
+    repo = "k3d";
+    rev = "v${version}";
+    sha256 = "sha256-DVQrD4JMei9yRFzuiVb6AcydEupNSlpgYLfGWWRiaao=";
+  };
+  vendorSha256 = null;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  excludedPackages = [ "tools" "docgen" ];
+
+  ldflags =
+    let t = "github.com/k3d-io/k3d/v5/version"; in
+    [ "-s" "-w" "-X ${t}.Version=v${version}" ] ++ lib.optionals k3sVersionSet [ "-X ${t}.K3sVersion=v${k3sVersion}" ];
+
+   preCheck = ''
+    # skip test that uses networking
+    substituteInPlace version/version_test.go \
+      --replace "TestGetK3sVersion" "SkipGetK3sVersion"
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd k3d \
+      --bash <($out/bin/k3d completion bash) \
+      --fish <($out/bin/k3d completion fish) \
+      --zsh <($out/bin/k3d completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/k3d --help
+    $out/bin/k3d --version | grep -e "k3d version v${version}" ${lib.optionalString k3sVersionSet "-e \"k3s version v${k3sVersion}\""}
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/k3d-io/k3d/";
+    changelog = "https://github.com/k3d-io/k3d/blob/v${version}/CHANGELOG.md";
+    description = "A helper to run k3s (Lightweight Kubernetes. 5 less than k8s) in a docker container - k3d";
+    longDescription = ''
+      k3s is the lightweight Kubernetes distribution by Rancher: rancher/k3s
+
+      k3d creates containerized k3s clusters. This means, that you can spin up a
+      multi-node k3s cluster on a single machine using docker.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ kuznero jlesquembre ngerstle jk ricochet ];
+    platforms = platforms.linux ++ platforms.darwin;
+    mainProgram = "k3d";
+  };
+}

pkgs/applications/networking/cluster/kubebuilder/default.nix

@@ -0,0 +1,49 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeWrapper
+, git
+, go
+, gnumake
+}:
+
+buildGoModule rec {
+  pname = "kubebuilder";
+  version = "3.3.0";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes-sigs";
+    repo = "kubebuilder";
+    rev = "v${version}";
+    sha256 = "sha256-xLeS0vfYuLEdzuou67ViduaBf62+Yqk+scaCCK+Xetk=";
+  };
+  vendorSha256 = "sha256-zE/y9FAoUZBmWiUMWbc66CwkK0h7SEXzfZY3KkjtQ0A=";
+
+  subPackages = ["cmd"];
+
+  ldflags = [
+    "-X main.kubeBuilderVersion=v${version}"
+    "-X main.goos=${go.GOOS}"
+    "-X main.goarch=${go.GOARCH}"
+    "-X main.gitCommit=v${version}"
+    "-X main.buildDate=v${version}"
+  ];
+
+  doCheck = true;
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/kubebuilder
+    wrapProgram $out/bin/kubebuilder \
+      --prefix PATH : ${lib.makeBinPath [ go gnumake ]}
+  '';
+
+  allowGoReference = true;
+  nativeBuildInputs = [ makeWrapper git ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kubernetes-sigs/kubebuilder";
+    description = "SDK for building Kubernetes APIs using CRDs";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ cmars ];
+  };
+}

pkgs/applications/networking/cluster/kubecfg/default.nix

@@ -0,0 +1,33 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kubecfg";
+  version = "0.26.0";
+
+  src = fetchFromGitHub {
+    owner = "kubecfg";
+    repo = "kubecfg";
+    rev = "v${version}";
+    sha256 = "sha256-ekojX7gl8wC7GlHG3Y+dwry7jxjIm5dbS7cNN1xu4kY=";
+  };
+
+  vendorSha256 = "sha256-dPdF3qTrYRbKUepgo6WVIVyGnaWxhQ0371fzXlBD8rE=";
+
+  ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd kubecfg \
+      --bash <($out/bin/kubecfg completion --shell=bash) \
+      --zsh  <($out/bin/kubecfg completion --shell=zsh)
+  '';
+
+  meta = {
+    description = "A tool for managing Kubernetes resources as code";
+    homepage = "https://github.com/kubecfg/kubecfg";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ benley ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/kubecolor/default.nix

@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubecolor";
+  version = "0.0.20";
+
+  src = fetchFromGitHub {
+    owner = "hidetatz";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-bKHEp9AxH1CcObhNzD3BkNOdyWZu7JrEdsXpo49wEcI=";
+  };
+
+  vendorSha256 = "sha256-C1K7iEugA4HBLthcOI7EZ6H4YHW6el8X6FjVN1BeJR0=";
+
+  ldflags = [ "-s" "-w" "-X main.Version=${version}" ];
+
+  meta = with lib; {
+    description = "Colorizes kubectl output";
+    homepage = "https://github.com/hidetatz/kubecolor";
+    changelog = "https://github.com/hidetatz/kubecolor/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ivankovnatsky SuperSandro2000 ];
+  };
+}

pkgs/applications/networking/cluster/kubeconform/default.nix

@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubeconform";
+  version = "0.4.13";
+
+  src = fetchFromGitHub {
+    owner = "yannh";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-hKsGti04pUZj02uzah7ccImmg/qn31ceVfk11aTa9rk=";
+  };
+
+  vendorSha256 = null;
+
+  meta = with lib; {
+    description = "A FAST Kubernetes manifests validator, with support for Custom Resources!";
+    homepage    = "https://github.com/yannh/kubeconform/";
+    license     = licenses.asl20;
+    maintainers = [ maintainers.j4m3s ];
+  };
+}

pkgs/applications/networking/cluster/kubectl-doctor/default.nix

@@ -0,0 +1,27 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubectl-doctor";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "emirozer";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-yp5OfSDxIASiCgISUVNxfe3dsLukgIoHARVPALIaQfY=";
+  };
+
+  vendorSha256 = "sha256-pdg65q7iMkcpFvSVUTa07m5URLQNNEfWQ4mdGu4suBM=";
+
+  postInstall = ''
+    mv $out/bin/{cmd,kubectl-doctor}
+  '';
+
+  meta = with lib; {
+    description = "kubectl cluster triage plugin for k8s";
+    homepage = "https://github.com/emirozer/kubectl-doctor";
+    changelog = "https://github.com/emirozer/kubectl-doctor/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = [ maintainers.zimbatm ];
+  };
+}

pkgs/applications/networking/cluster/kubectl-evict-pod/default.nix

@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubectl-evict-pod";
+  version = "0.0.10";
+
+  src = fetchFromGitHub {
+    owner = "rajatjindal";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Z4fJzU317p7K+klcDQAukXAfZOpHd3PlH5fKO0PgKHA=";
+  };
+
+  vendorSha256 = "sha256-8VTrywlzrzoBEi/xOqkwhGW/R2B2oGqgh01Gv9FcW80=";
+
+  meta = with lib; {
+    description = "This plugin evicts the given pod and is useful for testing pod disruption budget rules";
+    homepage    = "https://github.com/rajatjindal/kubectl-evict-pod";
+    license     = licenses.asl20;
+    maintainers = [ maintainers.j4m3s ];
+  };
+}

pkgs/applications/networking/cluster/kubectl-example/default.nix

@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubectl-example";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "seredot";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-7tqeIE6Ds8MrLH9k8cdzpeJP9pXVptduoEFE0zdrLlo=";
+  };
+
+  vendorSha256 = null;
+
+  meta = with lib; {
+    description = "kubectl plugin for retrieving resource example YAMLs";
+    homepage = "https://github.com/seredot/kubectl-example";
+    changelog = "https://github.com/seredot/kubectl-example/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = [ maintainers.bryanasdev000 ];
+  };
+}

pkgs/applications/networking/cluster/kubectl-tree/default.nix

@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubectl-tree";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "ahmetb";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-5+INUr7ewSJrFwdhDgdrRu+xDB3FkWRjWbbVJO8cgkc=";
+  };
+
+  vendorSha256 = "sha256-/GLzIoFHXpTmY2601zA83tB2V2XS0rWy1bEDQ6P6D8k=";
+
+  meta = with lib; {
+    description = "kubectl plugin to browse Kubernetes object hierarchies as a tree";
+    homepage = "https://github.com/ahmetb/kubectl-tree";
+    changelog = "https://github.com/ahmetb/kubectl-tree/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = [ maintainers.ivankovnatsky ];
+  };
+}

pkgs/applications/networking/cluster/kubedb-cli/default.nix

@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubedb-cli";
+  version = "0.25.0";
+
+  src = fetchFromGitHub {
+    owner = "kubedb";
+    repo = "cli";
+    rev = "v${version}";
+    sha256 = "sha256-hRLju3nVLy0eDgqGeReHaF8p7oOlpo1T0IbLq4h/uwg=";
+  };
+
+  vendorSha256 = null;
+
+  # Don't compile the documentation stuff
+  subPackages = [ "cmd/kubectl-dba" ];
+
+  meta = with lib; {
+    description = "kubectl plugin for KubeDB by AppsCode.";
+    homepage    = "https://github.com/kubedb/cli";
+    license     = licenses.unfree;
+    maintainers = [ maintainers.starcraft66 ];
+  };
+}

pkgs/applications/networking/cluster/kubelogin-oidc/default.nix

@@ -0,0 +1,30 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubelogin";
+  version = "1.25.1";
+
+  src = fetchFromGitHub {
+    owner = "int128";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-BKJ6dZMGW+Md+YUEEgWtPdfiFiOP5Nfb+awx8FXB+bM=";
+  };
+
+  subPackages = ["."];
+
+  vendorSha256 = "sha256-mu4NHeYZBM4C5qpj2wRTLsRNLDvZGNkppKGDw621mp4=";
+
+  # Rename the binary instead of symlinking to avoid conflict with the
+  # Azure version of kubelogin
+  postInstall = ''
+    mv $out/bin/kubelogin $out/bin/kubectl-oidc_login
+  '';
+
+  meta = with lib; {
+    description = "A Kubernetes credential plugin implementing OpenID Connect (OIDC) authentication";
+    inherit (src.meta) homepage;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ benley ];
+  };
+}

pkgs/applications/networking/cluster/kubelogin/default.nix

@@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildGoModule, go }:
+
+buildGoModule rec {
+  pname = "kubelogin";
+  version = "0.0.11";
+
+  src = fetchFromGitHub {
+    owner = "Azure";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-+u+75Z2Efaq16g7kGNq1GHavXwtKvNO6dytniUr8mlE=";
+  };
+
+  vendorSha256 = "sha256-vJfTf9gD/qrsPAfJeMYLjGa90mYLOshgDehv2Fcl6xM=";
+
+  ldflags = [
+    "-X main.version=${version}"
+    "-X main.goVersion=${lib.getVersion go}"
+  ];
+
+  meta = with lib; {
+    description = "A Kubernetes credential plugin implementing Azure authentication";
+    inherit (src.meta) homepage;
+    license = licenses.mit;
+    maintainers = with maintainers; [ yurrriq ];
+  };
+}

pkgs/applications/networking/cluster/kubemqctl/default.nix

@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubemqctl";
+  version = "3.5.1";
+  src = fetchFromGitHub {
+    owner = "kubemq-io";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0daqvd1y6b87xvnpdl2k0sa91zdmp48r0pgp6dvnb2l44ml8a4z0";
+  };
+
+  ldflags = [ "-w" "-s" "-X main.version=${version}" ];
+
+  doCheck = false; # TODO tests are failing
+
+  vendorSha256 = "1agn6i7cnsb5igvvbjzlaa5fgssr5h7h25y440q44bk16jxk6s74";
+
+  meta = {
+    homepage = "https://github.com/kubemq-io/kubemqctl";
+    description = "Kubemqctl is a command line interface (CLI) for Kubemq Kubernetes Message Broker.";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ brianmcgee ];
+  };
+}

pkgs/applications/networking/cluster/kubent/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubent";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "doitintl";
+    repo = "kube-no-trouble";
+    rev = "${version}";
+    sha256 = "0pwb9g1hhfqn3rl87fg6sf07m7aviadljb05bbnd241hhlcyslv6";
+  };
+
+  vendorSha256 = "1z4cvk936l7011fbimsgpw89yqzyikw9jb4184l37mnj9hl5wpcp";
+
+  ldflags = [
+    "-w" "-s"
+    "-X main.version=v${version}"
+  ];
+
+  subPackages = [ "cmd/kubent" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/doitintl/kube-no-trouble";
+    description = "Easily check your cluster for use of deprecated APIs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ peterromfeldhk ];
+  };
+}

pkgs/applications/networking/cluster/kubeone/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "kubeone";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "kubermatic";
+    repo = "kubeone";
+    rev = "v${version}";
+    sha256 = "sha256-uij5daVHKIfxx+8UTmU/HKSbf/RTRFuO8mCQdsC80qI=";
+  };
+
+  vendorSha256 = "sha256-kI5i1us3Ooh603HOz9Y+HlfPUy/1J8z89/jvKEenpLw=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd kubeone \
+      --bash <($out/bin/kubeone completion bash) \
+      --zsh <($out/bin/kubeone completion zsh)
+  '';
+
+  meta = {
+    description = "Automate cluster operations on all your cloud, on-prem, edge, and IoT environments.";
+    homepage = "https://kubeone.io/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ lblasc ];
+  };
+}

pkgs/applications/networking/cluster/kubergrunt/default.nix

@@ -0,0 +1,31 @@
+{ buildGoModule, lib, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubergrunt";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "gruntwork-io";
+    repo = "kubergrunt";
+    rev = "v${version}";
+    sha256 = "sha256-K94cGU+cFHOrAGXjHQFFFJYhZi9zNfdlGy5eb2DkcV8=";
+  };
+
+  vendorSha256 = "sha256-95rteSEMOBQnAw0QKuj5Yyi8n3xXGl0Tm97WiyTGxVw=";
+
+  # Disable tests since it requires network access and relies on the
+  # presence of certain AWS infrastructure
+  doCheck = false;
+
+  postInstall = ''
+    # The binary is named kubergrunt
+    mv $out/bin/cmd $out/bin/kubergrunt
+  '';
+
+  meta = with lib; {
+    description = "Collection of commands to fill in the gaps between Terraform, Helm, and Kubectl";
+    homepage = "https://github.com/gruntwork-io/kubergrunt";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ psibi ];
+  };
+}

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -0,0 +1,96 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, which
+, go
+, makeWrapper
+, rsync
+, installShellFiles
+, kubectl
+, nixosTests
+
+, components ? [
+    "cmd/kubelet"
+    "cmd/kube-apiserver"
+    "cmd/kube-controller-manager"
+    "cmd/kube-proxy"
+    "cmd/kube-scheduler"
+    "test/e2e/e2e.test"
+  ]
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kubernetes";
+  version = "1.23.7";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes";
+    repo = "kubernetes";
+    rev = "v${version}";
+    sha256 = "sha256-YHlcopB47HVLO/4QI8HxjMBzCpcHVnlAz3EOmZI+EG8=";
+  };
+
+  nativeBuildInputs = [ makeWrapper which go rsync installShellFiles ];
+
+  outputs = [ "out" "man" "pause" ];
+
+  patches = [ ./fixup-addonmanager-lib-path.patch ];
+
+  postPatch = ''
+    substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
+    patchShebangs ./hack
+  '';
+
+  WHAT = lib.concatStringsSep " " ([
+    "cmd/kubeadm"
+  ] ++ components);
+
+  postBuild = ''
+    ./hack/update-generated-docs.sh
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    for p in $WHAT; do
+      install -D _output/local/go/bin/''${p##*/} -t $out/bin
+    done
+
+    cc build/pause/linux/pause.c -o pause
+    install -D pause -t $pause/bin
+
+    rm docs/man/man1/kubectl*
+    installManPage docs/man/man1/*.[1-9]
+
+    ln -s ${kubectl}/bin/kubectl $out/bin/kubectl
+
+    # Unfortunately, kube-addons-main.sh only looks for the lib file in either the
+    # current working dir or in /opt. We have to patch this for now.
+    substitute cluster/addons/addon-manager/kube-addons-main.sh $out/bin/kube-addons \
+      --subst-var out
+
+    chmod +x $out/bin/kube-addons
+    patchShebangs $out/bin/kube-addons
+    wrapProgram $out/bin/kube-addons --set "KUBECTL_BIN" "$out/bin/kubectl"
+
+    cp cluster/addons/addon-manager/kube-addons.sh $out/bin/kube-addons-lib.sh
+
+    installShellCompletion --cmd kubeadm \
+      --bash <($out/bin/kubeadm completion bash) \
+      --zsh <($out/bin/kubeadm completion zsh)
+    runHook postInstall
+  '';
+
+  disallowedReferences = [ go ];
+
+  GOFLAGS = [ "-trimpath" ];
+
+  meta = with lib; {
+    description = "Production-Grade Container Scheduling and Management";
+    license = licenses.asl20;
+    homepage = "https://kubernetes.io";
+    maintainers = with maintainers; [ ] ++ teams.kubernetes.members;
+    platforms = platforms.linux;
+  };
+
+  passthru.tests = nixosTests.kubernetes;
+}

pkgs/applications/networking/cluster/kubernetes/fixup-addonmanager-lib-path.patch

@@ -0,0 +1,23 @@
+diff --git a/cluster/addons/addon-manager/kube-addons-main.sh b/cluster/addons/addon-manager/kube-addons-main.sh
+index 849973470d1..e4fef30eaea 100755
+--- a/cluster/addons/addon-manager/kube-addons-main.sh
++++ b/cluster/addons/addon-manager/kube-addons-main.sh
+@@ -17,17 +17,7 @@
+ # Import required functions. The addon manager is installed to /opt in
+ # production use (see the Dockerfile)
+ # Disabling shellcheck following files as the full path would be required.
+-if [ -f "kube-addons.sh" ]; then
+-  # shellcheck disable=SC1091
+-  source "kube-addons.sh"
+-elif [ -f "/opt/kube-addons.sh" ]; then
+-  # shellcheck disable=SC1091
+-  source "/opt/kube-addons.sh"
+-else
+-  # If the required source is missing, we have to fail.
+-  log ERR "== Could not find kube-addons.sh (not in working directory or /opt) at $(date -Is) =="
+-  exit 1
+-fi
++source "@out@/bin/kube-addons-lib.sh"
+ 
+ # The business logic for whether a given object should be created
+ # was already enforced by salt, and /etc/kubernetes/addons is the

pkgs/applications/networking/cluster/kubernetes/kubectl.nix

@@ -0,0 +1,38 @@
+{ lib, stdenv, kubernetes }:
+
+stdenv.mkDerivation rec {
+  pname = "kubectl";
+
+  inherit (kubernetes)
+    disallowedReferences
+    GOFLAGS
+    nativeBuildInputs
+    postBuild
+    postPatch
+    src
+    version
+    ;
+
+  outputs = [ "out" "man" ];
+
+  WHAT = "cmd/kubectl";
+
+  installPhase = ''
+    runHook preInstall
+    install -D _output/local/go/bin/kubectl -t $out/bin
+
+    installManPage docs/man/man1/kubectl*
+
+    installShellCompletion --cmd kubectl \
+      --bash <($out/bin/kubectl completion bash) \
+      --fish <($out/bin/kubectl completion fish) \
+      --zsh <($out/bin/kubectl completion zsh)
+    runHook postInstall
+  '';
+
+  meta = kubernetes.meta // {
+    description = "Kubernetes CLI";
+    homepage = "https://github.com/kubernetes/kubectl";
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/kubernix/default.nix

@@ -0,0 +1,24 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "kubernix";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "saschagrunert";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "04dzfdzjwcwwaw9min322g30q0saxpq5kqzld4f22fmk820ki6gp";
+  };
+
+  cargoSha256 = "133h6mkz9aylhligy16pfjzsl94xxj0rk2zjm08dhg0inj84z3yv";
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Single dependency Kubernetes clusters for local testing, experimenting and development";
+    homepage = "https://github.com/saschagrunert/kubernix";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ saschagrunert ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/cluster/kubeseal/default.nix

@@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubeseal";
+  version = "0.17.5";
+
+  src = fetchFromGitHub {
+    owner = "bitnami-labs";
+    repo = "sealed-secrets";
+    rev = "v${version}";
+    sha256 = "0wrsfbsjf74qss4mfhjpc1h4lhfmwib83bd2i28g4yd00qq958vj";
+  };
+
+  vendorSha256 = "sha256-/rZRDH5Id8ft2oe0U/uhEgBgb0nhaQ8O5wjrSftvBzA=";
+
+  subPackages = [ "cmd/kubeseal" ];
+
+  ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
+
+  meta = with lib; {
+    description = "A Kubernetes controller and tool for one-way encrypted Secrets";
+    homepage = "https://github.com/bitnami-labs/sealed-secrets";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ groodt ];
+  };
+}

pkgs/applications/networking/cluster/kubespy/default.nix

@@ -0,0 +1,33 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kubespy";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "pulumi";
+    repo = "kubespy";
+    sha256 = "1xrwhxw2y0zpzsxp1rlm1wd0aqw6jda5ai5y1ards5djqsbsv87g";
+  };
+
+  vendorSha256 = "0ajhbjs9ijpxp3svvj7pjiac78ps7vkqmqrizq18mllsry0m9pcl";
+
+  doCheck = false;
+
+  # TODO: enable after https://github.com/pulumi/kubespy/issues/72 is addressed.
+  # postInstall = ''
+  # 	for shell in bash zsh; do
+  # 		$out/bin/kubespy completion $shell > kubespy.$shell
+  # 		installShellCompletion kubespy.$shell
+  # 	done
+  # '';
+
+  meta = with lib; {
+    description = "A tool to observe Kubernetes resources in real time";
+    homepage = "https://github.com/pulumi/kubespy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ blaggacao ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/kubetail/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, lib, ... }:
+
+stdenv.mkDerivation rec {
+  pname = "kubetail";
+  version = "1.6.13";
+
+  src = fetchFromGitHub {
+    owner = "johanhaleby";
+    repo = "kubetail";
+    rev = version;
+    sha256 = "sha256-EkOewNInzEEEgMOffYoRaKwhgYuBXgHaCkVgWg2mIDE=";
+  };
+
+  installPhase = ''
+    install -Dm755 kubetail                 "$out/bin/kubetail"
+    install -Dm755 completion/kubetail.bash "$out/share/bash-completion/completions/kubetail"
+    install -Dm755 completion/kubetail.fish "$out/share/fish/vendor_completions.d/kubetail.fish"
+    install -Dm755 completion/kubetail.zsh  "$out/share/zsh/site-functions/_kubetail"
+  '';
+
+  meta = with lib; {
+    description = "Bash script to tail Kubernetes logs from multiple pods at the same time";
+    longDescription = ''
+      Bash script that enables you to aggregate (tail/follow) logs from
+      multiple pods into one stream. This is the same as running "kubectl logs
+      -f " but for multiple pods.
+    '';
+    homepage = "https://github.com/johanhaleby/kubetail";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kalbasit ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/networking/cluster/kubeval/default.nix

@@ -0,0 +1,28 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, makeWrapper
+}:
+
+buildGoModule rec {
+  pname = "kubeval";
+  version = "0.16.1";
+
+  src = fetchFromGitHub {
+    owner = "instrumenta";
+    repo = "kubeval";
+    rev = "v${version}";
+    sha256 = "sha256-pwJOV7V78H2XaMiiJvKMcx0dEwNDrhgFHmCRLAwMirg=";
+  };
+
+  vendorSha256 = "sha256-OAFxEb7IWhyRBEi8vgmekDSL/YpmD4EmUfildRaPR24=";
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Validate your Kubernetes configuration files";
+    homepage = "https://github.com/instrumenta/kubeval";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ johanot nicknovitski ];
+  };
+}