feat!: Remove support for k3s and go full-on Talos (#1482)

bootstrap/overrides/readme.partial.yaml.j2

@@ -1,5 +1,5 @@
-<% Place user jinja template overrides in this file's directory %>
-<% Docs: https://mirkolenz.github.io/makejinja/makejinja.html %>
-<% Example: https://github.com/mirkolenz/makejinja/blob/main/tests/data/makejinja.toml %>
-<% Example: https://github.com/mirkolenz/makejinja/blob/main/tests/data/input1/not-empty.yaml.jinja %>
-<% Example: https://github.com/mirkolenz/makejinja/blob/main/tests/data/input2/not-empty.yaml.jinja %>
+#| Place user jinja template overrides in this file's directory |#
+#| Docs: https://mirkolenz.github.io/makejinja/makejinja.html |#
+#| Example: https://github.com/mirkolenz/makejinja/blob/main/tests/data/makejinja.toml |#
+#| Example: https://github.com/mirkolenz/makejinja/blob/main/tests/data/input1/not-empty.yaml.jinja |#
+#| Example: https://github.com/mirkolenz/makejinja/blob/main/tests/data/input2/not-empty.yaml.jinja |#

bootstrap/scripts/validation.py

@@ -7,9 +7,7 @@ import re
 import socket
 import sys
 
-DISTRIBUTIONS = ["k3s", "talos"]
-GLOBAL_CLI_TOOLS = ["age", "flux", "helmfile", "sops", "jq", "kubeconform", "kustomize"]
-TALOS_CLI_TOOLS = ["talosctl", "talhelper"]
+GLOBAL_CLI_TOOLS = ["age", "flux", "helmfile", "sops", "jq", "kubeconform", "kustomize", "talosctl", "talhelper"]
 CLOUDFLARE_TOOLS = ["cloudflared"]
 
 
@@ -51,67 +49,46 @@ def validate_network(cidr: str, family: int) -> str:
     return cidr
 
 
-def validate_node(node: dict, node_cidr: str, distribution: str) -> None:
+def validate_node(node: dict, node_cidr: str) -> None:
     if not node.get("name"):
         raise ValueError(f"A node is missing a name")
-    if not re.match(r"^[a-z0-9-\.]+$", node.get('name')):
+    if not re.match(r"^[a-z0-9-]+$", node.get('name')):
         raise ValueError(f"Node {node.get('name')} has an invalid name")
-    if distribution in ["k3s"]:
-        if not node.get("ssh_user") :
-            raise ValueError(f"Node {node.get('name')} is missing ssh_user")
-    if distribution in ["talos"]:
-        if not node.get("talos_disk"):
-            raise ValueError(f"Node {node.get('name')} is missing talos_disk")
-        if not node.get("talos_nic"):
-            raise ValueError(f"Node {node.get('name')} is missing talos_nic")
-        if not re.match(r"(?:[0-9a-fA-F]:?){12}", node.get("talos_nic")):
-            raise ValueError(f"Node {node.get('name')} has an invalid talos_nic, is this a MAC address?")
-    ip = validate_ip(node.get("address"))
-    if netaddr.IPAddress(ip, 4) not in netaddr.IPNetwork(node_cidr):
-        raise ValueError(f"Node {node.get('name')} is not in the node CIDR {node_cidr}")
-    port = 50000 if distribution in ["talos"] else 22
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-        sock.settimeout(5)
-        result = sock.connect_ex((ip, port))
-        if result != 0:
-            raise ValueError(f"Node {node.get('name')} port {port} is not open")
+    if not node.get("disk"):
+        raise ValueError(f"Node {node.get('name')} is missing disk")
+    if not node.get("mac_addr"):
+        raise ValueError(f"Node {node.get('name')} is missing mac_addr")
+    if not re.match(r"(?:[0-9a-fA-F]:?){12}", node.get("mac_addr")):
+        raise ValueError(f"Node {node.get('name')} has an invalid mac_addr, is this a MAC address?")
+    if node.get("address"):
+        ip = validate_ip(node.get("address"))
+        if netaddr.IPAddress(ip, 4) not in netaddr.IPNetwork(node_cidr):
+            raise ValueError(f"Node {node.get('name')} is not in the node CIDR {node_cidr}")
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+            sock.settimeout(5)
+            result = sock.connect_ex((ip, 50000))
+            if result != 0:
+                raise ValueError(f"Node {node.get('name')} port 50000 is not open")
 
 
-@required("bootstrap_distribution", "bootstrap_cloudflare")
-def validate_cli_tools(distribution: str, cloudflare: dict, **_) -> None:
-    if distribution not in DISTRIBUTIONS:
-        raise ValueError(f"Invalid distribution {distribution}")
+@required("bootstrap_cloudflare")
+def validate_cli_tools(cloudflare: dict, **_) -> None:
     for tool in GLOBAL_CLI_TOOLS:
         if not which(tool):
             raise ValueError(f"Missing required CLI tool {tool}")
-    for tool in TALOS_CLI_TOOLS if distribution in ["talos"] else []:
-        if not which(tool):
-            raise ValueError(f"Missing required CLI tool {tool}")
     for tool in CLOUDFLARE_TOOLS if cloudflare.get("enabled", False) else []:
         if not which(tool):
             raise ValueError(f"Missing required CLI tool {tool}")
 
 
-@required("bootstrap_distribution")
-def validate_distribution(distribution: str, **_) -> None:
-    if distribution not in DISTRIBUTIONS:
-        raise ValueError(f"Invalid distribution {distribution}")
-
-
-@required("bootstrap_timezone")
-def validate_timezone(timezone: str, **_) -> None:
-    if timezone not in available_timezones():
-        raise ValueError(f"Invalid timezone {timezone}")
-
-
 @required("bootstrap_sops_age_pubkey")
 def validate_age(key: str, **_) -> None:
     if not re.match(r"^age1[a-z0-9]{0,58}$", key):
         raise ValueError(f"Invalid Age public key {key}")
 
 
-@required("bootstrap_node_network", "bootstrap_node_inventory", "bootstrap_distribution")
-def validate_nodes(node_cidr: str, nodes: dict[list], distribution: str, **_) -> None:
+@required("bootstrap_node_network", "bootstrap_node_inventory")
+def validate_nodes(node_cidr: str, nodes: dict[list], **_) -> None:
     node_cidr = validate_network(node_cidr, 4)
 
     controllers = [node for node in nodes if node.get('controller') == True]
@@ -120,18 +97,16 @@ def validate_nodes(node_cidr: str, nodes: dict[list], distribution: str, **_) ->
     if len(controllers) % 2 == 0:
         raise ValueError(f"Must have an odd number of controller nodes")
     for node in controllers:
-        validate_node(node, node_cidr, distribution)
+        validate_node(node, node_cidr)
 
     workers = [node for node in nodes if node.get('controller') == False]
     for node in workers:
-        validate_node(node, node_cidr, distribution)
+        validate_node(node, node_cidr)
 
 
 def validate(data: dict) -> None:
     validate_python_version()
     validate_cli_tools(data)
-    validate_distribution(data)
-    validate_timezone(data)
     validate_age(data)
 
     if not data.get("skip_tests", False):

bootstrap/templates/.sops.yaml.j2

@@ -1,20 +1,12 @@
 ---
 creation_rules:
-  #% if bootstrap_distribution in ["talos"] %#
   - # IMPORTANT: This rule MUST be above the others
     path_regex: talos/.*\.sops\.ya?ml
     key_groups:
       - age:
           - "#{ bootstrap_sops_age_pubkey }#"
-  #% endif %#
   - path_regex: kubernetes/.*\.sops\.ya?ml
     encrypted_regex: "^(data|stringData)$"
     key_groups:
       - age:
           - "#{ bootstrap_sops_age_pubkey }#"
-  #% if bootstrap_distribution in ["k3s"] %#
-  - path_regex: ansible/.*\.sops\.ya?ml
-    key_groups:
-      - age:
-          - "#{ bootstrap_sops_age_pubkey }#"
-  #% endif %#

bootstrap/templates/ansible/.ansible-lint.j2

@@ -1,9 +0,0 @@
-skip_list:
-  - yaml[commas]
-  - yaml[line-length]
-  - var-naming
-warn_list:
-  - command-instead-of-shell
-  - deprecated-command-syntax
-  - experimental
-  - no-changed-when

bootstrap/templates/ansible/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"]

bootstrap/templates/ansible/inventory/group_vars/controllers/main.yaml.j2

@@ -1,36 +0,0 @@
----
-k3s_control_node: true
-k3s_server:
-  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
-  cluster-cidr: "#{ bootstrap_pod_network.split(',')[0] }#,#{ bootstrap_pod_network.split(',')[1] }#"
-  service-cidr: "#{ bootstrap_service_network.split(',')[0] }#,#{ bootstrap_service_network.split(',')[1] }#"
-  #% else %#
-  cluster-cidr: "#{ bootstrap_pod_network }#"
-  service-cidr: "#{ bootstrap_service_network }#"
-  #% endif %#
-  disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
-  disable-cloud-controller: true
-  disable-kube-proxy: true
-  disable-network-policy: true
-  docker: false
-  embedded-registry: true
-  etcd-expose-metrics: true
-  flannel-backend: "none"
-  kube-apiserver-arg:
-    - "anonymous-auth=true"
-  kube-controller-manager-arg:
-    - "bind-address=0.0.0.0"
-  kube-scheduler-arg:
-    - "bind-address=0.0.0.0"
-  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
-  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
-  #% else %#
-  node-ip: "{{ ansible_host }}"
-  #% endif %#
-  secrets-encryption: true
-  tls-san:
-    - "#{ bootstrap_controllers_vip }#"
-    #% for item in bootstrap_tls_sans %#
-    - "#{ item }#"
-    #% endfor %#
-  write-kubeconfig-mode: "644"

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -1,23 +0,0 @@
----
-k3s_become: true
-k3s_etcd_datastore: true
-k3s_install_hard_links: true
-k3s_registration_address: "#{ bootstrap_controllers_vip }#"
-k3s_registries:
-  mirrors:
-    docker.io:
-    gcr.io:
-    ghcr.io:
-    k8s.gcr.io:
-    lscr.io:
-    mcr.microsoft.com:
-    public.ecr.aws:
-    quay.io:
-    registry.k8s.io:
-# renovate: datasource=github-releases depName=k3s-io/k3s
-k3s_release_version: v1.30.0+k3s1
-k3s_server_manifests_templates:
-  - custom-cilium-helmchart.yaml
-  - custom-kube-vip-ds.yaml
-  - custom-kube-vip-rbac.yaml
-k3s_use_unsupported_config: true

bootstrap/templates/ansible/inventory/group_vars/workers/.mjfilter.py

@@ -1,10 +0,0 @@
-main = lambda data: (
-    data.get("bootstrap_distribution", "k3s") in ["k3s"] and
-    len(
-        list(
-            filter(
-                lambda item: "controller" in item and item["controller"] is False, data.get("bootstrap_node_inventory")
-            )
-        )
-    ) > 0
-)

bootstrap/templates/ansible/inventory/group_vars/workers/main.yaml.j2

@@ -1,8 +0,0 @@
----
-k3s_control_node: false
-k3s_agent:
-  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
-  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
-  #% else %#
-  node-ip: "{{ ansible_host }}"
-  #% endif %#

bootstrap/templates/ansible/inventory/hosts.yaml.j2

@@ -1,29 +0,0 @@
----
-kubernetes:
-  children:
-    controllers:
-      hosts:
-        #% for item in bootstrap_node_inventory %#
-        #% if item.controller %#
-        "#{ item.name }#":
-          ansible_user: "#{ item.ssh_user }#"
-          ansible_host: "#{ item.address }#"
-          #% if item.ssh_key %#
-          ansible_ssh_private_key_file: "#{ item.ssh_key }#"
-          #% endif %#
-        #% endif %#
-        #% endfor %#
-    #% if bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length %#
-    workers:
-      hosts:
-        #% for item in bootstrap_node_inventory %#
-        #% if not item.controller %#
-        "#{ item.name }#":
-          ansible_user: "#{ item.ssh_user }#"
-          ansible_host: "#{ item.address }#"
-          #% if item.ssh_key %#
-          ansible_ssh_private_key_file: "#{ item.ssh_key }#"
-          #% endif %#
-        #% endif %#
-        #% endfor %#
-    #% endif %#

bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2

@@ -1,91 +0,0 @@
----
-- name: Cluster Installation
-  hosts: kubernetes
-  become: true
-  gather_facts: true
-  any_errors_fatal: true
-  pre_tasks:
-    - name: Pausing for 5 seconds...
-      ansible.builtin.pause:
-        seconds: 5
-  tasks:
-    - name: Check if cluster is installed
-      check_mode: false
-      ansible.builtin.stat:
-        path: /etc/rancher/k3s/config.yaml
-      register: k3s_installed
-
-    - name: Ignore manifests templates and urls if the cluster is already installed
-      when: k3s_installed.stat.exists
-      ansible.builtin.set_fact:
-        k3s_server_manifests_templates: []
-        k3s_server_manifests_urls: []
-
-    - name: Prevent downgrades
-      when: k3s_installed.stat.exists
-      ansible.builtin.include_tasks: tasks/version-check.yaml
-
-    - name: Ensure that the /opt/cni directory exists
-      ansible.builtin.file:
-        path: /opt/cni
-        mode: '755'
-        state: directory
-    - name: Ensure that the /opt/cni/bin is a link to /var/lib/rancher/k3s/data/current/bin
-      ansible.builtin.file:
-        src: /var/lib/rancher/k3s/data/current/bin
-        dest: /opt/cni/bin
-        follow: false
-        force: true
-        state: link
-
-    - name: Ensure that the /etc/cni directory exists
-      ansible.builtin.file:
-        path: /etc/cni
-        mode: '755'
-        state: directory
-    - name: Ensure that the /var/lib/rancher/k3s/agent/etc/cni/net.d directory exists
-      ansible.builtin.file:
-        path: /var/lib/rancher/k3s/agent/etc/cni/net.d
-        mode: '755'
-        state: directory
-    - name: Ensure that the /etc/cni/net.d is a link to /var/lib/rancher/k3s/agent/etc/cni/net.d
-      ansible.builtin.file:
-        src: /var/lib/rancher/k3s/agent/etc/cni/net.d
-        dest: /etc/cni/net.d
-        force: true
-        state: link
-
-    - name: Install Kubernetes
-      ansible.builtin.include_role:
-        name: xanmanning.k3s
-        public: true
-      vars:
-        k3s_state: installed
-
-    - name: Kubeconfig
-      ansible.builtin.include_tasks: tasks/kubeconfig.yaml
-
-    - name: Wait for custom manifests to rollout
-      when:
-        - k3s_primary_control_node
-        - (k3s_server_manifests_templates | length > 0
-            or k3s_server_manifests_urls | length > 0)
-      kubernetes.core.k8s_info:
-        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        kind: "{{ item.kind }}"
-        name: "{{ item.name }}"
-        namespace: "{{ item.namespace | default('') }}"
-        wait: true
-        wait_sleep: 10
-        wait_timeout: 360
-      loop:
-        - { name: cilium, kind: HelmChart, namespace: kube-system }
-        - { name: kube-vip, kind: DaemonSet, namespace: kube-system }
-
-    - name: Cilium
-      when: k3s_primary_control_node
-      ansible.builtin.include_tasks: tasks/cilium.yaml
-
-    - name: Cruft
-      when: k3s_primary_control_node
-      ansible.builtin.include_tasks: tasks/cruft.yaml

bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2

@@ -1,105 +0,0 @@
----
-- name: Cluster Nuke
-  hosts: kubernetes
-  become: true
-  gather_facts: true
-  any_errors_fatal: true
-  vars_prompt:
-    - name: nuke
-      prompt: |-
-        Are you sure you want to nuke this cluster?
-        Type 'YES I WANT TO DESTROY THIS CLUSTER' to proceed
-      default: "n"
-      private: false
-  pre_tasks:
-    - name: Check for confirmation
-      ansible.builtin.fail:
-        msg: Aborted nuking the cluster
-      when: nuke != 'YES I WANT TO DESTROY THIS CLUSTER'
-
-    - name: Pausing for 5 seconds...
-      ansible.builtin.pause:
-        seconds: 5
-  tasks:
-    - name: Stop Kubernetes # noqa: ignore-errors
-      ignore_errors: true
-      block:
-        - name: Stop Kubernetes
-          ansible.builtin.include_role:
-            name: xanmanning.k3s
-            public: true
-          vars:
-            k3s_state: stopped
-
-    # https://github.com/k3s-io/docs/blob/main/docs/installation/network-options.md
-    - name: Networking
-      block:
-        - name: Networking | Delete Cilium links
-          ansible.builtin.command:
-            cmd: "ip link delete {{ item }}"
-            removes: "/sys/class/net/{{ item }}"
-          loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
-        - name: Networking | Flush iptables
-          ansible.builtin.iptables:
-            table: "{{ item }}"
-            flush: true
-          loop: ["filter", "nat", "mangle", "raw"]
-        - name: Networking | Flush ip6tables
-          ansible.builtin.iptables:
-            table: "{{ item }}"
-            flush: true
-            ip_version: ipv6
-          loop: ["filter", "nat", "mangle", "raw"]
-        - name: Networking | Delete CNI bin link
-          ansible.builtin.file:
-            path: /opt/cni/bin
-            state: absent
-        - name: Networking | Delete CNI conf link
-          ansible.builtin.file:
-            path: /etc/cni/net.d
-            state: absent
-
-    - name: Check to see if k3s-killall.sh exits
-      ansible.builtin.stat:
-        path: /usr/local/bin/k3s-killall.sh
-      register: check_k3s_killall_script
-
-    - name: Check to see if k3s-uninstall.sh exits
-      ansible.builtin.stat:
-        path: /usr/local/bin/k3s-uninstall.sh
-      register: check_k3s_uninstall_script
-
-    - name: Run k3s-killall.sh
-      when: check_k3s_killall_script.stat.exists
-      ansible.builtin.command:
-        cmd: /usr/local/bin/k3s-killall.sh
-      register: k3s_killall
-      changed_when: k3s_killall.rc == 0
-
-    - name: Run k3s-uninstall.sh
-      when: check_k3s_uninstall_script.stat.exists
-      ansible.builtin.command:
-        cmd: /usr/local/bin/k3s-uninstall.sh
-      args:
-        removes: /usr/local/bin/k3s-uninstall.sh
-      register: k3s_uninstall
-      changed_when: k3s_uninstall.rc == 0
-
-    - name: Ensure hard links are removed
-      when:
-        - k3s_install_hard_links
-        - not ansible_check_mode
-      ansible.builtin.file:
-        path: "{{ k3s_install_dir }}/{{ item }}"
-        state: absent
-      loop: ["kubectl", "crictl", "ctr"]
-
-    - name: Remove local storage path
-      ansible.builtin.file:
-        path: /var/openebs/local
-        state: absent
-
-    - name: Reboot
-      ansible.builtin.reboot:
-        msg: Rebooting hosts
-        reboot_timeout: 3600

bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2

@@ -1,115 +0,0 @@
----
-- name: Prepare System
-  hosts: kubernetes
-  become: true
-  gather_facts: true
-  any_errors_fatal: true
-  pre_tasks:
-    - name: Pausing for 5 seconds...
-      ansible.builtin.pause:
-        seconds: 5
-    - name: Populate service facts
-      ansible.builtin.service_facts:
-  tasks:
-    - name: Locale
-      block:
-        - name: Locale | Set timezone
-          community.general.timezone:
-            name: "#{ bootstrap_timezone }#"
-
-    - name: Packages
-      block:
-        - name: Packages | Install
-          ansible.builtin.apt:
-            name: apt-transport-https,ca-certificates,conntrack,curl,dirmngr,gdisk,gnupg,hdparm,htop,
-              iptables,iputils-ping,ipvsadm,libseccomp2,lm-sensors,net-tools,nfs-common,
-              nvme-cli,open-iscsi,parted,psmisc,python3,python3-apt,python3-kubernetes,python3-yaml,
-              smartmontools,socat,software-properties-common,unzip,util-linux
-            install_recommends: false
-
-    - name: Network Configuration
-      notify: Reboot
-      block:
-        - name: Network Configuration | Set hostname
-          ansible.builtin.hostname:
-            name: "{{ inventory_hostname }}"
-        - name: Network Configuration | Update hosts
-          ansible.builtin.copy:
-            content: |
-              127.0.0.1 localhost
-              127.0.1.1 {{ inventory_hostname }}
-
-              # The following lines are desirable for IPv6 capable hosts
-              ::1     localhost ip6-localhost ip6-loopback
-              ff02::1 ip6-allnodes
-              ff02::2 ip6-allrouters
-            dest: /etc/hosts
-            mode: preserve
-        # https://github.com/onedr0p/cluster-template/discussions/635
-        - name: Network Configuration | Remove immutable flag from /etc/resolv.conf
-          ansible.builtin.file:
-            attributes: -i
-            path: /etc/resolv.conf
-        - name: Network Configuration | Remove /etc/resolv.conf
-          ansible.builtin.file:
-            attributes: -i
-            path: /etc/resolv.conf
-            state: absent
-        - name: Network Configuration | Add custom /etc/resolv.conf
-          ansible.builtin.copy:
-            attributes: +i
-            mode: '0644'
-            dest: /etc/resolv.conf
-            content: |
-              search #{ bootstrap_search_domain|default('.', true) }#
-              #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
-              nameserver #{ item }#
-              #% endfor %#
-
-    - name: System Configuration
-      notify: Reboot
-      block:
-        - name: System Configuration | Disable apparmor
-          when: ansible_facts.services['apparmor.service'] is defined
-          ansible.builtin.systemd:
-            name: apparmor
-            state: stopped
-            masked: true
-        - name: System Configuration | Disable swap
-          ansible.posix.mount:
-            name: "{{ item }}"
-            fstype: swap
-            state: absent
-          loop: ["none", "swap"]
-        - name: System Configuration | Create Kernel modules
-          ansible.builtin.copy:
-            dest: "/etc/modules-load.d/{{ item }}.conf"
-            mode: "0644"
-            content: "{{ item }}"
-          loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "iptable_mangle", "iptable_raw", "nbd", "overlay", "rbd", "xt_socket"]
-          register: modules_status
-        - name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler
-          when: modules_status.changed
-          ansible.builtin.systemd:
-            name: systemd-modules-load
-            state: restarted
-        - name: System Configuration | Sysctl
-          ansible.posix.sysctl:
-            name: "{{ item.key }}"
-            value: "{{ item.value }}"
-            sysctl_file: /etc/sysctl.d/99-kubernetes.conf
-            reload: true
-          with_dict: "{{ sysctl_config }}"
-          vars:
-            sysctl_config:
-              fs.inotify.max_queued_events: 65536
-              fs.inotify.max_user_watches: 524288
-              fs.inotify.max_user_instances: 8192
-              net.core.rmem_max: 2500000
-              net.core.wmem_max: 2500000
-
-  handlers:
-    - name: Reboot
-      ansible.builtin.reboot:
-        msg: Rebooting hosts
-        reboot_timeout: 3600

bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2

@@ -1,15 +0,0 @@
----
-- name: Reboot
-  hosts: kubernetes
-  become: true
-  gather_facts: true
-  any_errors_fatal: true
-  pre_tasks:
-    - name: Pausing for 5 seconds...
-      ansible.builtin.pause:
-        seconds: 5
-  tasks:
-    - name: Reboot
-      ansible.builtin.reboot:
-        msg: Rebooting hosts
-        reboot_timeout: 3600

bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2

@@ -1,70 +0,0 @@
----
-- name: Cluster rollout update
-  hosts: kubernetes
-  become: true
-  gather_facts: true
-  any_errors_fatal: true
-  serial: 1
-  pre_tasks:
-    - name: Pausing for 5 seconds...
-      ansible.builtin.pause:
-        seconds: 5
-  tasks:
-    - name: Details
-      ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
-      register: kubectl_get_node
-      delegate_to: "{{ groups['controllers'][0] }}"
-      failed_when: false
-      changed_when: false
-
-    - name: Update
-      when:
-        # When status.conditions[x].type == Ready then check stats.conditions[x].status for True|False
-        - kubectl_get_node['stdout'] | from_json | json_query("status.conditions[?type == 'Ready'].status")
-        # If spec.unschedulable is defined then the node is cordoned
-        - not (kubectl_get_node['stdout'] | from_json).spec.unschedulable is defined
-      block:
-        - name: Cordon
-          kubernetes.core.k8s_drain:
-            name: "{{ inventory_hostname }}"
-            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            state: cordon
-          delegate_to: "{{ groups['controllers'][0] }}"
-
-        - name: Drain
-          kubernetes.core.k8s_drain:
-            name: "{{ inventory_hostname }}"
-            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            state: drain
-            delete_options:
-              delete_emptydir_data: true
-              ignore_daemonsets: true
-              terminate_grace_period: 600
-              wait_timeout: 900
-            pod_selectors:
-              - app!=rook-ceph-osd # Rook Ceph
-          delegate_to: "{{ groups['controllers'][0] }}"
-
-        - name: Update
-          ansible.builtin.apt:
-            upgrade: dist
-            update_cache: true
-
-        - name: Check if reboot is required
-          ansible.builtin.stat:
-            path: /var/run/reboot-required
-          register: reboot_required
-
-        - name: Reboot
-          when: reboot_required.stat.exists
-          ansible.builtin.reboot:
-            msg: Rebooting node
-            post_reboot_delay: 60
-            reboot_timeout: 3600
-
-        - name: Uncordon
-          kubernetes.core.k8s_drain:
-            name: "{{ inventory_hostname }}"
-            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            state: uncordon
-          delegate_to: "{{ groups['controllers'][0] }}"

bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2

@@ -1,56 +0,0 @@
----
-- name: Cilium
-  block:
-    - name: Cilium | Check if Cilium HelmChart exists
-      kubernetes.core.k8s_info:
-        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: cilium
-        kind: HelmChart
-        namespace: kube-system
-      register: cilium_helmchart
-
-    - name: Cilium | Wait for Cilium to rollout
-      when: cilium_helmchart.resources | count > 0
-      kubernetes.core.k8s_info:
-        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: helm-install-cilium
-        kind: Job
-        namespace: kube-system
-        wait: true
-        wait_condition:
-          type: Complete
-          status: true
-        wait_timeout: 360
-
-    - name: Cilium | Patch the Cilium HelmChart to unmanage it
-      when: cilium_helmchart.resources | count > 0
-      kubernetes.core.k8s_json_patch:
-        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: cilium
-        kind: HelmChart
-        namespace: kube-system
-        patch:
-          - op: add
-            path: /metadata/annotations/helmcharts.helm.cattle.io~1unmanaged
-            value: "true"
-
-    - name: Cilium | Delete the Cilium HelmChart CR
-      when: cilium_helmchart.resources | count > 0
-      kubernetes.core.k8s:
-        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: cilium
-        kind: HelmChart
-        namespace: kube-system
-        state: absent
-
-    - name: Cilium | Force delete the Cilium HelmChart
-      when: cilium_helmchart.resources | count > 0
-      kubernetes.core.k8s:
-        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: cilium
-        kind: HelmChart
-        namespace: kube-system
-        state: patched
-        definition:
-          metadata:
-            finalizers: []

bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2

@@ -1,31 +0,0 @@
----
-- name: Cruft
-  block:
-    - name: Cruft | Get list of custom manifests
-      ansible.builtin.find:
-        paths: "{{ k3s_server_manifests_dir }}"
-        file_type: file
-        use_regex: true
-        patterns: ["^custom-.*"]
-      register: custom_manifest
-
-    - name: Cruft | Delete custom manifests
-      ansible.builtin.file:
-        path: "{{ item.path }}"
-        state: absent
-      loop: "{{ custom_manifest.files }}"
-
-    - name: Cruft | Get list of custom addons
-      kubernetes.core.k8s_info:
-        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        kind: Addon
-      register: addons_list
-
-    - name: Cruft | Delete addons
-      kubernetes.core.k8s:
-        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: "{{ item.metadata.name }}"
-        kind: Addon
-        namespace: kube-system
-        state: absent
-      loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}"

bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2

@@ -1,26 +0,0 @@
----
-- name: Get absolute path to this Git repository # noqa: command-instead-of-module
-  ansible.builtin.command: git rev-parse --show-toplevel
-  delegate_to: localhost
-  become: false
-  run_once: true
-  register: repository_path
-  changed_when: false
-  check_mode: false
-  failed_when: repository_path.rc != 0
-
-- name: Copy kubeconfig to the project directory
-  when: k3s_primary_control_node
-  ansible.builtin.fetch:
-    src: /etc/rancher/k3s/k3s.yaml
-    dest: "{{ repository_path.stdout }}/kubeconfig"
-    flat: true
-
-- name: Update kubeconfig with the correct load balancer address
-  delegate_to: localhost
-  become: false
-  run_once: true
-  ansible.builtin.replace:
-    path: "{{ repository_path.stdout }}/kubeconfig"
-    regexp: https://127.0.0.1:6443
-    replace: "https://{{ k3s_registration_address }}:6443"

bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2

@@ -1,17 +0,0 @@
----
-- name: Version Check
-  block:
-    - name: Get deployed k3s version
-      ansible.builtin.command: k3s --version
-      register: k3s_version
-      changed_when: false
-      failed_when: false
-
-    - name: Extract k3s version
-      ansible.builtin.set_fact:
-        current_k3s_version: "{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P<version>[a-z0-9\\.\\+]+).*\n.*', '\\g<version>') }}"
-
-    - name: Check if upgrades are allowed
-      ansible.builtin.assert:
-        that: ["k3s_release_version is version(current_k3s_version, '>=')"]
-        fail_msg: "Unable to upgrade k3s because the deployed version is higher than the one specified in the configuration"

bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2

@@ -1,17 +0,0 @@
----
-apiVersion: helm.cattle.io/v1
-kind: HelmChart
-metadata:
-  name: cilium
-  namespace: kube-system
-spec:
-  repo: https://helm.cilium.io/
-  chart: cilium
-  # renovate: datasource=helm depName=cilium repository=https://helm.cilium.io
-  version: 1.15.5
-  targetNamespace: kube-system
-  bootstrap: true
-  valuesContent: |-
-    #% filter indent(width=4, first=True) %#
-    #% include 'partials/cilium-values-init.partial.yaml.j2' %#
-    #% endfilter %#

bootstrap/templates/ansible/playbooks/templates/custom-kube-vip-ds.yaml.j2

@@ -1,2 +0,0 @@
----
-#% include 'partials/kube-vip-ds.partial.yaml.j2' %#

bootstrap/templates/ansible/playbooks/templates/custom-kube-vip-rbac.yaml.j2

@@ -1,2 +0,0 @@
----
-#% include 'partials/kube-vip-rbac.partial.yaml.j2' %#

bootstrap/templates/ansible/requirements.txt.j2

@@ -1,4 +0,0 @@
-ansible-lint==24.5.0
-ansible==9.5.1
-jmespath==1.0.1
-openshift==0.13.2

bootstrap/templates/ansible/requirements.yaml.j2

@@ -1,14 +0,0 @@
----
-collections:
-  - name: ansible.posix
-    version: 1.5.4
-  - name: ansible.utils
-    version: 4.1.0
-  - name: community.general
-    version: 8.6.0
-  - name: kubernetes.core
-    version: 3.1.0
-roles:
-  - name: xanmanning.k3s
-    src: https://github.com/PyratLabs/ansible-role-k3s
-    version: v3.4.4

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2

@@ -1,3 +1,4 @@
+---
 autoDirectNodeRoutes: true
 bgpControlPlane:
   enabled: true
@@ -12,15 +13,8 @@ cluster:
   name: #{ bootstrap_cluster_name|default('home-kubernetes', true) }#
 cni:
   exclusive: false
-  #% if bootstrap_distribution in ["k3s"] %#
-  binPath: /var/lib/rancher/k3s/data/current/bin
-  confPath: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  #% endif %#
 containerRuntime:
   integration: containerd
-  #% if bootstrap_distribution in ["k3s"] %#
-  socketPath: /var/run/k3s/containerd/containerd.sock
-  #% endif %#
 # NOTE: devices might need to be set if you have more than one active NIC on your hosts
 # devices: eno+ eth+
 endpointRoutes:
@@ -29,19 +23,14 @@ hubble:
   enabled: false
 ipam:
   mode: kubernetes
-ipv4NativeRoutingCIDR: "#{ bootstrap_pod_network }#"
+ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
 #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
-ipv6NativeRoutingCIDR: "#{ bootstrap_pod_network_v6 }#"
+ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
 ipv6:
   enabled: true
 #% endif %#
-#% if bootstrap_distribution in ["k3s"] %#
-k8sServiceHost: 127.0.0.1
-k8sServicePort: 6444
-#% elif bootstrap_distribution in ["talos"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 7445
-#% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2

@@ -20,7 +20,57 @@ spec:
     cleanupOnFail: true
     remediation:
       retries: 3
+  valuesFrom:
+    - kind: ConfigMap
+      name: cilium-helm-values
   values:
-    #% filter indent(width=4, first=True) %#
-    #% include 'partials/cilium-values-full.partial.yaml.j2' %#
-    #% endfilter %#
+    #% if bootstrap_cloudflare.enabled %#
+    hubble:
+      enabled: true
+      metrics:
+        enabled:
+          - dns:query
+          - drop
+          - tcp
+          - flow
+          - port-distribution
+          - icmp
+          - http
+        serviceMonitor:
+          enabled: true
+        dashboards:
+          enabled: true
+          annotations:
+            grafana_folder: Cilium
+      relay:
+        enabled: true
+        rollOutPods: true
+        prometheus:
+          serviceMonitor:
+            enabled: true
+      ui:
+        enabled: true
+        rollOutPods: true
+        ingress:
+          enabled: true
+          className: internal
+          hosts: ["hubble.${SECRET_DOMAIN}"]
+    #% endif %#
+    operator:
+      prometheus:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+      dashboards:
+        enabled: true
+        annotations:
+          grafana_folder: Cilium
+    prometheus:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+        trustCRDsExist: true
+    dashboards:
+      enabled: true
+      annotations:
+        grafana_folder: Cilium

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2

@@ -3,3 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
+configMapGenerator:
+  - name: cilium-helm-values
+    files:
+      - values.yaml=./helm-values.yaml
+configurations:
+  - kustomizeconfig.yaml

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomizeconfig.yaml.j2

@@ -0,0 +1,7 @@
+---
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helm-values.yaml.j2

@@ -0,0 +1,58 @@
+---
+fullnameOverride: coredns
+replicaCount: 1
+k8sAppLabelOverride: kube-dns
+serviceAccount:
+  create: true
+service:
+  name: kube-dns
+  clusterIP: "#{ bootstrap_service_network | nthhost(10) }#"
+servers:
+  - zones:
+      - zone: .
+        scheme: dns://
+        use_tcp: true
+    port: 53
+    plugins:
+      - name: errors
+      - name: health
+        configBlock: |-
+          lameduck 5s
+      - name: ready
+      - name: log
+        configBlock: |-
+          class error
+      - name: prometheus
+        parameters: 0.0.0.0:9153
+      - name: kubernetes
+        parameters: cluster.local in-addr.arpa ip6.arpa
+        configBlock: |-
+          pods insecure
+          fallthrough in-addr.arpa ip6.arpa
+      - name: forward
+        parameters: . /etc/resolv.conf
+      - name: cache
+        parameters: 30
+      - name: loop
+      - name: reload
+      - name: loadbalance
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: node-role.kubernetes.io/control-plane
+              operator: Exists
+tolerations:
+  - key: CriticalAddonsOnly
+    operator: Exists
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: kubernetes.io/hostname
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/instance: coredns

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: coredns
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: coredns
+      version: 1.29.0
+      sourceRef:
+        kind: HelmRepository
+        name: coredns
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  valuesFrom:
+    - kind: ConfigMap
+      name: coredns-helm-values

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2

@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: coredns-helm-values
+    files:
+      - values.yaml=./helm-values.yaml
+configurations:
+  - kustomizeconfig.yaml

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomizeconfig.yaml.j2

@@ -0,0 +1,7 @@
+---
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2

@@ -1,20 +1,21 @@
 ---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app system-upgrade-controller
+  name: &app coredns
   namespace: flux-system
 spec:
-  targetNamespace: system-upgrade
+  targetNamespace: kube-system
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app
-  prune: true
+  path: ./kubernetes/apps/kube-system/coredns/app
+  prune: false # never should be deleted
   sourceRef:
     kind: GitRepository
     name: home-kubernetes
-  wait: true
+  wait: false
   interval: 30m
   retryInterval: 1m
   timeout: 5m

bootstrap/templates/kubernetes/apps/kube-system/kube-vip/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"]

bootstrap/templates/kubernetes/apps/kube-system/kube-vip/app/daemonset.yaml.j2

@@ -1,2 +0,0 @@
----
-#% include 'partials/kube-vip-ds.partial.yaml.j2' %#

bootstrap/templates/kubernetes/apps/kube-system/kube-vip/app/kustomization.yaml.j2

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./rbac.yaml
-  - ./daemonset.yaml

bootstrap/templates/kubernetes/apps/kube-system/kube-vip/app/rbac.yaml.j2

@@ -1,2 +0,0 @@
----
-#% include 'partials/kube-vip-rbac.partial.yaml.j2' %#

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helm-values.yaml.j2

@@ -1,2 +1,3 @@
+---
 providerRegex: ^(#{ (bootstrap_node_inventory | map(attribute='name') | join('|')) }#)$
 bypassDnsResolution: true

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2

@@ -20,10 +20,10 @@ spec:
     cleanupOnFail: true
     remediation:
       retries: 3
+  valuesFrom:
+    - kind: ConfigMap
+      name: kubelet-csr-approver-helm-values
   values:
-    #% filter indent(width=4, first=True) %#
-    #% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
-    #% endfilter %#
     metrics:
       enable: true
       serviceMonitor:

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/kustomization.yaml.j2

@@ -3,3 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
+configMapGenerator:
+  - name: kubelet-csr-approver-helm-values
+    files:
+      - values.yaml=./helm-values.yaml
+configurations:
+  - kustomizeconfig.yaml

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/kustomizeconfig.yaml.j2

@@ -0,0 +1,7 @@
+---
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2

@@ -4,12 +4,8 @@ kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./cilium/ks.yaml
+  - ./coredns/ks.yaml
   - ./metrics-server/ks.yaml
   - ./reloader/ks.yaml
-  #% if bootstrap_distribution in ["talos"] %#
   - ./kubelet-csr-approver/ks.yaml
   - ./spegel/ks.yaml
-  #% endif %#
-  #% if bootstrap_distribution in ["k3s"] %#
-  - ./kube-vip/ks.yaml
-  #% endif %#

bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2

@@ -25,9 +25,6 @@ spec:
       - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
       - --kubelet-use-node-status-port
       - --metric-resolution=15s
-      #% if bootstrap_distribution in ["k3s"] %#
-      - --kubelet-insecure-tls
-      #% endif %#
     metrics:
       enabled: true
     serviceMonitor:

bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helm-values.yaml.j2

@@ -0,0 +1,7 @@
+---
+spegel:
+  containerdSock: /run/containerd/containerd.sock
+  containerdRegistryConfigPath: /etc/cri/conf.d/hosts
+service:
+  registry:
+    hostPort: 29999

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2

@@ -20,12 +20,9 @@ spec:
     cleanupOnFail: true
     remediation:
       retries: 3
+  valuesFrom:
+    - kind: ConfigMap
+      name: spegel-helm-values
   values:
-    spegel:
-      containerdSock: /run/containerd/containerd.sock
-      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
-    service:
-      registry:
-        hostPort: 29999
     serviceMonitor:
       enabled: true

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/kustomization.yaml.j2

@@ -3,3 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
+configMapGenerator:
+  - name: spegel-helm-values
+    files:
+      - values.yaml=./helm-values.yaml
+configurations:
+  - kustomizeconfig.yaml

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/kustomizeconfig.yaml.j2

@@ -0,0 +1,7 @@
+---
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

bootstrap/templates/kubernetes/apps/observability/kustomization.yaml.j2

@@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  - ./system-upgrade-controller/ks.yaml
-  - ./k3s/ks.yaml
+  - ./prometheus-operator-crds/ks.yaml

bootstrap/templates/kubernetes/apps/observability/namespace.yaml.j2

@@ -2,6 +2,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: system-upgrade
+  name: observability
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled

bootstrap/templates/kubernetes/apps/observability/prometheus-operator-crds/app/helmrelease.yaml.j2

@@ -0,0 +1,22 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: prometheus-operator-crds
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: prometheus-operator-crds
+      version: 11.0.0
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3

bootstrap/templates/kubernetes/apps/observability/prometheus-operator-crds/app/kustomization.yaml.j2

@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./plan.yaml
+  - ./helmrelease.yaml

bootstrap/templates/kubernetes/apps/observability/prometheus-operator-crds/ks.yaml.j2

@@ -2,15 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app kube-vip
+  name: &app prometheus-operator-crds
   namespace: flux-system
 spec:
-  targetNamespace: kube-system
+  targetNamespace: observability
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/kube-system/kube-vip/app
-  prune: true
+  path: ./kubernetes/apps/observability/prometheus-operator-crds/app
+  prune: false # never should be deleted
   sourceRef:
     kind: GitRepository
     name: home-kubernetes

bootstrap/templates/kubernetes/apps/system-upgrade/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"]

bootstrap/templates/kubernetes/apps/system-upgrade/k3s/app/plan.yaml.j2

@@ -1,50 +0,0 @@
----
-apiVersion: upgrade.cattle.io/v1
-kind: Plan
-metadata:
-  name: controllers
-spec:
-  version: "${KUBE_VERSION}"
-  upgrade:
-    image: rancher/k3s-upgrade
-  serviceAccountName: system-upgrade
-  concurrency: 1
-  cordon: true
-  nodeSelector:
-    matchExpressions:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-  tolerations:
-    - effect: NoSchedule
-      operator: Exists
-    - effect: NoExecute
-      operator: Exists
-    - key: node-role.kubernetes.io/control-plane
-      effect: NoSchedule
-      operator: Exists
-    - key: node-role.kubernetes.io/master
-      effect: NoSchedule
-      operator: Exists
-    - key: node-role.kubernetes.io/etcd
-      effect: NoExecute
-      operator: Exists
-    - key: CriticalAddonsOnly
-      operator: Exists
----
-apiVersion: upgrade.cattle.io/v1
-kind: Plan
-metadata:
-  name: workers
-spec:
-  version: "${KUBE_VERSION}"
-  serviceAccountName: system-upgrade
-  concurrency: 1
-  nodeSelector:
-    matchExpressions:
-      - key: node-role.kubernetes.io/control-plane
-        operator: DoesNotExist
-  prepare:
-    image: rancher/k3s-upgrade
-    args: ["prepare", "controllers"]
-  upgrade:
-    image: rancher/k3s-upgrade

bootstrap/templates/kubernetes/apps/system-upgrade/k3s/ks.yaml.j2

@@ -1,26 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app system-upgrade-k3s
-  namespace: flux-system
-spec:
-  targetNamespace: system-upgrade
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: system-upgrade-controller
-  path: ./kubernetes/apps/system-upgrade/k3s/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
-  postBuild:
-    substitute:
-      # renovate: datasource=github-releases depName=k3s-io/k3s
-      KUBE_VERSION: v1.30.0+k3s1

bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2

@@ -1,101 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: &app system-upgrade-controller
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.1.0
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-  values:
-    controllers:
-      system-upgrade-controller:
-        strategy: RollingUpdate
-        containers:
-          app:
-            image:
-              repository: docker.io/rancher/system-upgrade-controller
-              tag: v0.13.4
-            env:
-              SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
-              SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
-              SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
-              SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
-              SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
-              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.30.1
-              SYSTEM_UPGRADE_JOB_PRIVILEGED: true
-              SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
-              SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
-              SYSTEM_UPGRADE_CONTROLLER_NAME: *app
-              SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
-                valueFrom:
-                  fieldRef:
-                    fieldPath: metadata.namespace
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-    defaultPodOptions:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
-        runAsGroup: 65534
-        seccompProfile: { type: RuntimeDefault }
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: Exists
-      tolerations:
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
-          effect: NoSchedule
-        - key: node-role.kubernetes.io/master
-          operator: Exists
-          effect: NoSchedule
-    serviceAccount:
-      create: true
-      name: system-upgrade
-    persistence:
-      tmp:
-        type: emptyDir
-        globalMounts:
-          - path: /tmp
-      etc-ssl:
-        type: hostPath
-        hostPath: /etc/ssl
-        hostPathType: DirectoryOrCreate
-        globalMounts:
-          - path: /etc/ssl
-            readOnly: true
-      etc-pki:
-        type: hostPath
-        hostPath: /etc/pki
-        hostPathType: DirectoryOrCreate
-        globalMounts:
-          - path: /etc/pki
-            readOnly: true
-      etc-ca-certificates:
-        type: hostPath
-        hostPath: /etc/ca-certificates
-        hostPathType: DirectoryOrCreate
-        globalMounts:
-          - path: /etc/ca-certificates
-            readOnly: true

bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml.j2

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  # renovate: datasource=github-releases depName=rancher/system-upgrade-controller
-  - https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.4/crd.yaml
-  - helmrelease.yaml
-  - rbac.yaml

bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/rbac.yaml.j2

@@ -1,13 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: system-upgrade
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: system-upgrade
-    namespace: system-upgrade

bootstrap/templates/kubernetes/bootstrap/talos/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]

bootstrap/templates/kubernetes/bootstrap/talos/apps/cilium-values.yaml.j2

@@ -1,4 +0,0 @@
----
-#% filter indent(width=0, first=True) %#
-#% include 'partials/cilium-values-init.partial.yaml.j2' %#
-#% endfilter %#

bootstrap/templates/kubernetes/bootstrap/talos/apps/helmfile.yaml.j2

@@ -1,26 +0,0 @@
----
-repositories:
-  - name: cilium
-    url: https://helm.cilium.io
-  - name: postfinance
-    url: https://postfinance.github.io/kubelet-csr-approver
-
-helmDefaults:
-  wait: true
-  waitForJobs: true
-  timeout: 600
-  recreatePods: true
-  force: true
-
-releases:
-  - name: cilium
-    namespace: kube-system
-    chart: cilium/cilium
-    version: 1.15.5
-    values: ["./cilium-values.yaml"]
-  - name: kubelet-csr-approver
-    namespace: kube-system
-    chart: postfinance/kubelet-csr-approver
-    version: 1.1.0
-    values: ["./kubelet-csr-approver-values.yaml"]
-    needs: ["cilium"]

bootstrap/templates/kubernetes/bootstrap/talos/apps/kubelet-csr-approver-values.yaml.j2

@@ -1,4 +0,0 @@
----
-#% filter indent(width=0, first=True) %#
-#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
-#% endfilter %#

bootstrap/templates/kubernetes/bootstrap/talos/helmfile.yaml.j2

@@ -0,0 +1,43 @@
+---
+repositories:
+  - name: cilium
+    url: https://helm.cilium.io
+  - name: postfinance
+    url: https://postfinance.github.io/kubelet-csr-approver
+
+helmDefaults:
+  wait: true
+  waitForJobs: true
+  timeout: 600
+  recreatePods: true
+  force: true
+
+releases:
+  - name: prometheus-operator-crds
+    namespace: observability
+    chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
+    version: 11.0.0
+  - name: cilium
+    namespace: kube-system
+    chart: cilium/cilium
+    version: 1.15.5
+    values: ["../../../apps/kube-system/cilium/app/helm-values.yaml"]
+    needs: ["prometheus-operator-crds"]
+  - name: coredns
+    namespace: kube-system
+    chart: coredns/coredns
+    version: 1.29.0
+    values: ["../../../apps/kube-system/coredns/app/helm-values.yaml"]
+    needs: ["prometheus-operator-crds", "cilium"]
+  - name: kubelet-csr-approver
+    namespace: kube-system
+    chart: postfinance/kubelet-csr-approver
+    version: 1.1.0
+    values: ["../../../apps/kube-system/kubelet-csr-approver/app/helm-values.yaml"]
+    needs: ["prometheus-operator-crds", "cilium", "coredns"]
+  - name: spegel
+    namespace: kube-system
+    chart: oci://ghcr.io/spegel-org/helm-charts/spegel
+    version: v0.0.22
+    values: ["../../../apps/kube-system/spegel/app/helm-values.yaml"]
+    needs: ["prometheus-operator-crds", "cilium", "coredns", "kubelet-csr-approver"]

bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2

@@ -6,13 +6,13 @@ talosVersion: v1.7.2
 kubernetesVersion: v1.30.1
 
 clusterName: &cluster #{ bootstrap_cluster_name|default('home-kubernetes', true) }#
-endpoint: https://#{ bootstrap_controllers_vip }#:6443
+endpoint: https://#{ bootstrap_controller_vip }#:6443
 clusterPodNets:
   - "#{ bootstrap_pod_network.split(',')[0] }#"
 clusterSvcNets:
   - "#{ bootstrap_service_network.split(',')[0] }#"
 additionalApiServerCertSans: &sans
-  - "#{ bootstrap_controllers_vip }#"
+  - "#{ bootstrap_controller_vip }#"
   - 127.0.0.1 # KubePrism
   #% for item in bootstrap_tls_sans %#
   - "#{ item }#"
@@ -25,30 +25,29 @@ nodes:
   #% for item in bootstrap_node_inventory %#
   - hostname: "#{ item.name }#"
     ipAddress: "#{ item.address }#"
-    #% if item.talos_disk.startswith('/') %#
-    installDisk: "#{ item.talos_disk }#"
+    #% if item.disk.startswith('/') %#
+    installDisk: "#{ item.disk }#"
     #% else %#
     installDiskSelector:
-      serial: "#{ item.talos_disk }#"
+      serial: "#{ item.disk }#"
     #% endif %#
-    #% if bootstrap_talos.secureboot.enabled %#
+    #% if bootstrap_secureboot.enabled %#
     machineSpec:
       secureboot: true
-    talosImageURL: factory.talos.dev/installer-secureboot/#{ bootstrap_talos.schematic_id }#
+    talosImageURL: factory.talos.dev/installer-secureboot/#{ bootstrap_schematic_id }#
     #% else %#
-    talosImageURL: factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#
+    talosImageURL: factory.talos.dev/installer/#{ bootstrap_schematic_id }#
     #% endif %#
     controlPlane: #{ (item.controller) | string | lower }#
     networkInterfaces:
       - deviceSelector:
-          hardwareAddr: "#{ item.talos_nic | lower }#"
-        dhcp: false
-        #% if bootstrap_talos.vlan %#
+          hardwareAddr: "#{ item.mac_addr | lower }#"
+        #% if bootstrap_vlan %#
         vlans:
-          - vlanId: #{ bootstrap_talos.vlan }#
+          - vlanId: #{ bootstrap_vlan }#
             addresses:
               - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
-            mtu: 1500
+            mtu: #{ item.mtu | default(1500) }#
             routes:
               - network: 0.0.0.0/0
                 #% if bootstrap_node_default_gateway %#
@@ -58,12 +57,13 @@ nodes:
                 #% endif %#
             #% if item.controller %#
             vip:
-              ip: "#{ bootstrap_controllers_vip }#"
+              ip: "#{ bootstrap_controller_vip }#"
             #% endif %#
         #% else %#
+        #% if item.address %#
+        dhcp: false
         addresses:
           - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
-        mtu: 1500
         routes:
           - network: 0.0.0.0/0
             #% if bootstrap_node_default_gateway %#
@@ -71,12 +71,16 @@ nodes:
             #% else %#
             gateway: "#{ bootstrap_node_network | nthhost(1) }#"
             #% endif %#
+        #% else %#
+        dhcp: true
+        #% endif %#
+        mtu: #{ item.mtu | default(1500) }#
         #% if item.controller %#
         vip:
-          ip: "#{ bootstrap_controllers_vip }#"
+          ip: "#{ bootstrap_controller_vip }#"
         #% endif %#
         #% endif %#
-    #% if bootstrap_talos.user_patches %#
+    #% if bootstrap_user_patches %#
     patches:
       - "@./patches/node_#{ item.name }#.yaml"
     #% endif %#
@@ -123,21 +127,28 @@ patches:
         nodeIP:
           validSubnets: ["#{ bootstrap_node_network }#"]
 
+  #% if bootstrap_dns_servers | length %#
   # Force nameserver
   - |-
     machine:
       network:
         nameservers:
-          #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
+          #% for item in bootstrap_dns_servers %#
           - #{ item }#
           #% endfor %#
+  #% endif %#
 
+  #% if bootstrap_ntp_servers | length %#
   # Configure NTP
   - |-
     machine:
       time:
         disabled: false
-        servers: ["time.cloudflare.com"]
+        servers:
+          #% for item in bootstrap_ntp_servers %#
+          - #{ item }#
+          #% endfor %#
+  #% endif %#
 
   # Custom sysctl settings
   - |-
@@ -159,7 +170,7 @@ patches:
             source: /var/openebs/local
             options: ["bind", "rshared", "rw"]
 
-  #% if bootstrap_talos.secureboot.enabled and bootstrap_talos.secureboot.encrypt_disk_with_tpm %#
+  #% if bootstrap_secureboot.enabled and bootstrap_secureboot.encrypt_disk_with_tpm %#
   # Encrypt system disk with TPM
   - |-
     machine:
@@ -176,7 +187,7 @@ patches:
               tpm: {}
   #% endif %#
 
-  #% if bootstrap_talos.user_patches %#
+  #% if bootstrap_user_patches %#
   # User specified global patches
   - "@./patches/global.yaml"
   #% endif %#
@@ -218,13 +229,11 @@ controlPlane:
             enabled: true
             allowedRoles: ["os:admin"]
             allowedKubernetesNamespaces: ["system-upgrade"]
-
-    #% if bootstrap_talos.user_patches %#
+    #% if bootstrap_user_patches %#
     # User specified controlPlane patches
     - "@./patches/controlPlane.yaml"
     #% endif %#
-
-#% if ((bootstrap_talos.user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %#
+#% if ((bootstrap_user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %#
 worker:
   patches:
     # User specified worker patches

bootstrap/templates/kubernetes/flux/config/flux.yaml.j2

@@ -24,7 +24,7 @@ spec:
     kind: OCIRepository
     name: flux-manifests
   patches:
-    # Remove the network policies that does not work with k3s
+    # Remove the network policies
     - patch: |
         $patch: delete
         apiVersion: networking.k8s.io/v1

bootstrap/templates/kubernetes/flux/repositories/helm/coredns.yaml.j2

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: coredns
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://coredns.github.io/helm

bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2

@@ -4,16 +4,16 @@ kind: Kustomization
 resources:
   - ./bjw-s.yaml
   - ./cilium.yaml
+  - ./coredns.yaml
+  - ./jetstack.yaml
+  - ./metrics-server.yaml
+  - ./openebs.yaml
+  - ./postfinance.yaml
+  - ./prometheus-community.yaml
+  - ./spegel.yaml
+  - ./stakater.yaml
   #% if bootstrap_cloudflare.enabled %#
   - ./external-dns.yaml
   - ./ingress-nginx.yaml
   - ./k8s-gateway.yaml
   #% endif %#
-  - ./jetstack.yaml
-  - ./metrics-server.yaml
-  - ./openebs.yaml
-  #% if bootstrap_distribution in ["talos"] %#
-  - ./postfinance.yaml
-  - ./spegel.yaml
-  #% endif %#
-  - ./stakater.yaml

bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ["talos"] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
@@ -8,4 +7,3 @@ metadata:
 spec:
   interval: 1h
   url: https://postfinance.github.io/kubelet-csr-approver
-#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/prometheus-community.yaml.j2

@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus-community
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 5m
+  url: oci://ghcr.io/prometheus-community/charts

bootstrap/templates/kubernetes/flux/repositories/helm/spegel.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ["talos"] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
@@ -9,4 +8,3 @@ spec:
   type: oci
   interval: 5m
   url: oci://ghcr.io/spegel-org/helm-charts
-#% endif %#

bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2

@@ -5,7 +5,6 @@ metadata:
   name: cluster-settings
   namespace: flux-system
 data:
-  TIMEZONE: "#{ bootstrap_timezone }#"
   CLUSTER_CIDR: "#{ bootstrap_pod_network.split(',')[0] }#"
   NODE_CIDR: "#{ bootstrap_node_network }#"
   #% if bootstrap_feature_gates.dual_stack_ipv4_first %#

bootstrap/templates/partials/cilium-values-full.partial.yaml.j2

@@ -1,129 +0,0 @@
-autoDirectNodeRoutes: true
-bgpControlPlane:
-  enabled: true
-bpf:
-  masquerade: false
-cgroup:
-  automount:
-    enabled: false
-  hostRoot: /sys/fs/cgroup
-cluster:
-  id: 1
-  name: #{ bootstrap_cluster_name|default('home-kubernetes', true) }#
-cni:
-  exclusive: false
-  #% if bootstrap_distribution in ["k3s"] %#
-  binPath: /var/lib/rancher/k3s/data/current/bin
-  confPath: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  #% endif %#
-containerRuntime:
-  integration: containerd
-  #% if bootstrap_distribution in ["k3s"] %#
-  socketPath: /var/run/k3s/containerd/containerd.sock
-  #% endif %#
-# NOTE: devices might need to be set if you have more than one active NIC on your hosts
-# devices: eno+ eth+
-endpointRoutes:
-  enabled: true
-#% if bootstrap_cloudflare.enabled %#
-hubble:
-  enabled: true
-  metrics:
-    enabled:
-      - dns:query
-      - drop
-      - tcp
-      - flow
-      - port-distribution
-      - icmp
-      - http
-    serviceMonitor:
-      enabled: true
-    dashboards:
-      enabled: true
-      annotations:
-        grafana_folder: Cilium
-  relay:
-    enabled: true
-    rollOutPods: true
-    prometheus:
-      serviceMonitor:
-        enabled: true
-  ui:
-    enabled: true
-    rollOutPods: true
-    ingress:
-      enabled: true
-      className: internal
-      hosts: ["hubble.${SECRET_DOMAIN}"]
-#% else %#
-hubble:
-  enabled: false
-#% endif %#
-ipam:
-  mode: kubernetes
-ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-#% if bootstrap_feature_gates.dual_stack_ipv4_first %#
-ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
-ipv6:
-  enabled: true
-#% endif %#
-#% if bootstrap_distribution in ["k3s"] %#
-k8sServiceHost: 127.0.0.1
-k8sServicePort: 6444
-#% elif bootstrap_distribution in ["talos"] %#
-k8sServiceHost: 127.0.0.1
-k8sServicePort: 7445
-#% endif %#
-kubeProxyReplacement: true
-kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
-l2announcements:
-  #% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %#
-  enabled: false # https://github.com/cilium/cilium/issues/28985
-  #% else %#
-  enabled: true
-  #% endif %#
-loadBalancer:
-  algorithm: maglev
-  mode: snat
-localRedirectPolicy: true
-operator:
-  replicas: 1
-  rollOutPods: true
-  prometheus:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-  dashboards:
-    enabled: true
-    annotations:
-      grafana_folder: Cilium
-prometheus:
-  enabled: true
-  serviceMonitor:
-    enabled: true
-    trustCRDsExist: true
-dashboards:
-  enabled: true
-  annotations:
-    grafana_folder: Cilium
-rollOutCiliumPods: true
-routingMode: native
-securityContext:
-  capabilities:
-    ciliumAgent:
-      - CHOWN
-      - KILL
-      - NET_ADMIN
-      - NET_RAW
-      - IPC_LOCK
-      - SYS_ADMIN
-      - SYS_RESOURCE
-      - DAC_OVERRIDE
-      - FOWNER
-      - SETGID
-      - SETUID
-    cleanCiliumState:
-      - NET_ADMIN
-      - SYS_ADMIN
-      - SYS_RESOURCE

bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2

@@ -1,74 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: kube-vip
-  namespace: kube-system
-  labels:
-    app.kubernetes.io/name: kube-vip
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kube-vip
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: kube-vip
-    spec:
-      containers:
-        - name: kube-vip
-          image: ghcr.io/kube-vip/kube-vip:v0.8.0
-          imagePullPolicy: IfNotPresent
-          args: ["manager"]
-          env:
-            - name: address
-              value: "#{ bootstrap_controllers_vip }#"
-            - name: vip_arp
-              value: "true"
-            - name: lb_enable
-              value: "true"
-            - name: port
-              value: "6443"
-            - name: vip_cidr
-              value: "32"
-            - name: cp_enable
-              value: "true"
-            - name: cp_namespace
-              value: kube-system
-            - name: vip_ddns
-              value: "false"
-            - name: svc_enable
-              value: "false"
-            - name: vip_leaderelection
-              value: "true"
-            - name: vip_leaseduration
-              value: "15"
-            - name: vip_renewdeadline
-              value: "10"
-            - name: vip_retryperiod
-              value: "2"
-            - name: prometheus_server
-              value: :2112
-          securityContext:
-            capabilities:
-              add: ["NET_ADMIN", "NET_RAW", "SYS_TIME"]
-      hostAliases:
-        - hostnames:
-            - kubernetes
-          ip: 127.0.0.1
-      hostNetwork: true
-      serviceAccountName: kube-vip
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/master
-                    operator: Exists
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: Exists
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists

bootstrap/templates/partials/kube-vip-rbac.partial.yaml.j2

@@ -1,41 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kube-vip
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    rbac.authorization.kubernetes.io/autoupdate: "true"
-  name: system:kube-vip-role
-rules:
-  - apiGroups: [""]
-    resources: ["services/status"]
-    verbs: ["update"]
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["list","get","watch", "update"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["list","get","watch", "update", "patch"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["list", "get", "watch", "update", "create"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["list","get","watch", "update"]
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: system:kube-vip-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:kube-vip-role
-subjects:
-- kind: ServiceAccount
-  name: kube-vip
-  namespace: kube-system