feat: move system-upgrade-controller to addons

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/tasks/addons/main.yaml

@@ -20,6 +20,10 @@
   when: kube_prometheus_stack.enabled | default(false)
   ansible.builtin.include_tasks: kube_prometheus_stack.yaml
 
+- name: Process addon system-upgrade-controller
+  when: system_upgrade_controller.enabled | default(false)
+  ansible.builtin.include_tasks: system_upgrade_controller.yaml
+
 - name: Process addon weave-gitops
   when: weave_gitops.enabled | default(false)
   ansible.builtin.include_tasks: weave_gitops.yaml

bootstrap/tasks/addons/system_upgrade_controller.yaml

@@ -0,0 +1,63 @@
+---
+- name: Set addon facts
+  ansible.builtin.set_fact:
+    addon_name: system-upgrade-controller
+    addon_namespace: system-upgrade
+
+- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'file' and 'sops' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+    mode: "0644"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0644"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0644"
+        force: true
+      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0644"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0644"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2

@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  # NOTE: Only enable system-upgrade-controller if you also update the version of k3s in the following file
+  {% if system_upgrade_controller.enabled | default(false) %}
-  # otherwise if you run ansible against an already provisioned cluster you might downgrade it
+  - ./system-upgrade-controller/ks.yaml
-  # https://github.com/onedr0p/flux-cluster-template/blob/main/ansible/inventory/group_vars/kubernetes/main.yaml
+  {% endif %}
-  # - ./system-upgrade-controller/ks.yaml

bootstrap/vars/addons.sample.yaml

@@ -33,3 +33,10 @@ csi_driver_nfs:
     #   server: # dns name or ip address of nfs server
     #   share:  # exported share (path)
     # ...
+
+# https://github.com/rancher/system-upgrade-controller
+system_upgrade_controller:
+  # WARNING: Only enable this if you also track the version of k3s in the
+  # ansible configuration files. Running ansible against an already provisioned
+  # cluster with this enabled might cause your cluster to be downgraded.
+  enabled: false