fix: update taskfiles and renovate config

Signed-off-by: Devin Buhl <devin@buhl.casa>

.github/renovate.json5

@@ -12,36 +12,25 @@
   "dependencyDashboardTitle": "Renovate Dashboard 🤖",
   "suppressNotifications": ["prEditedNotification", "prIgnoreNotification"],
   "rebaseWhen": "conflicted",
-  "schedule": ["on saturday"],
+  "schedule": ["every weekend"],
+  "ignorePaths": ["**/*.sops.*"],
   "flux": {
-    "fileMatch": [
+    "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"]
-      "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"
-    ]
   },
   "helm-values": {
-    "fileMatch": [
+    "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"]
-      "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"
-    ]
   },
   "helmfile": {
-    "fileMatch": [
+    "fileMatch": ["(^|/)helmfile\\.ya?ml(?:\\.j2)?$"]
-      "(^|/)helmfile\\.ya?ml(?:\\.j2)?$"
-    ]
   },
   "kubernetes": {
-    "fileMatch": [
+    "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"]
-      "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"
-    ]
   },
   "kustomize": {
-    "fileMatch": [
+    "fileMatch": ["(^|/)kustomization\\.ya?ml(?:\\.j2)?$"]
-      "(^|/)kustomization\\.ya?ml(?:\\.j2)?$"
-    ]
   },
   "pip_requirements": {
-    "fileMatch": [
+    "fileMatch": ["(^|/)[\\w-]*requirements(-\\w+)?\\.(txt|pip)(?:\\.j2)?$"]
-      "(^|/)[\\w-]*requirements(-\\w+)?\\.(txt|pip)(?:\\.j2)?$"
-    ]
   },
   // commit message topics
   "commitMessageTopic": "{{depName}}",
@@ -62,7 +51,7 @@
     {
       "description": ["Flux Group"],
       "groupName": "Flux",
-      "matchPackagePatterns": ["flux"],
+      "matchPackagePatterns": ["fluxcd"],
       "matchDatasources": ["docker", "github-tags"],
       "versioning": "semver",
       "group": {
@@ -71,10 +60,13 @@
       "separateMinorPatch": true
     },
     {
-      "description": ["System Upgrade Controller Group"],
+      "description": ["Talos Group"],
-      "groupName": "System Upgrade Controller",
+      "groupName": "Talos",
-      "matchPackagePatterns": ["system-upgrade-controller"],
+      "matchPackagePatterns": [
-      "matchDatasources": ["docker", "github-releases"],
+        "siderolabs/talosctl",
+        "siderolabs/installer"
+      ],
+      "matchDatasources": ["docker"],
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
       },
@@ -199,10 +191,7 @@
     {
       "customType": "regex",
       "description": ["Process custom dependencies"],
-      "fileMatch": [
+      "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"],
-        "(^|/).taskfiles/.+\\.ya?ml$",
-        "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"
-      ],
       "matchStrings": [
         // # renovate: datasource=helm depName=cilium repository=https://helm.cilium.io
         // version: 1.15.1

.taskfiles/Sops/Taskfile.yaml

@@ -2,9 +2,6 @@
 # yaml-language-server: $schema=https://taskfile.dev/schema.json
 version: "3"
 
-vars:
-  SOPS_CONFIG_FILE: "{{.ROOT_DIR}}/.sops.yaml"
-
 tasks:
 
   age-keygen:
@@ -13,7 +10,7 @@ tasks:
     status: ["test -f {{.AGE_FILE}}"]
 
   encrypt:
-    desc: Encrypt all Kubernetes SOPS secrets that are not already encrypted
+    desc: Encrypt all Kubernetes SOPS secrets
     cmds:
       - for: { var: file }
         task: .encrypt-file
@@ -21,10 +18,7 @@ tasks:
           file: "{{.ITEM}}"
     vars:
       file:
-        sh: |
+        sh: find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \;
-          if [ -d "{{.KUBERNETES_DIR}}" ]; then
-              find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \;
-          fi
 
   .encrypt-file:
     internal: true

.taskfiles/Talos/Taskfile.yaml

@@ -6,6 +6,7 @@ vars:
   TALOS_DIR: "{{.KUBERNETES_DIR}}/bootstrap/talos"
   TALHELPER_SECRET_FILE: "{{.TALOS_DIR}}/talsecret.sops.yaml"
   TALHELPER_CONFIG_FILE: "{{.TALOS_DIR}}/talconfig.yaml"
+  HELMFILE_FILE: "{{.TALOS_DIR}}/helmfile.yaml"
 
 env:
   TALOSCONFIG: "{{.TALOS_DIR}}/clusterconfig/talosconfig"
@@ -16,66 +17,45 @@ tasks:
     desc: Bootstrap the Talos cluster
     dir: "{{.TALOS_DIR}}"
     cmds:
-      - task: bootstrap-gensecret
+      - |
-      - task: bootstrap-genconfig
+        if [ ! -f "{{.TALHELPER_SECRET_FILE}}" ]; then
-      - task: bootstrap-apply
+            talhelper gensecret > {{.TALHELPER_SECRET_FILE}}
-      - task: bootstrap-install
+            sops --encrypt --in-place {{.TALHELPER_SECRET_FILE}}
-      - task: fetch-kubeconfig
+        fi
-      - task: bootstrap-apps
+      - talhelper genconfig --secret-file {{.TALHELPER_SECRET_FILE}}
-      - talosctl health --server=false
+      - talhelper gencommand apply --extra-flags=--insecure | bash
-
-  bootstrap-gensecret:
-    desc: Generate the Talos secrets
-    dir: "{{.TALOS_DIR}}"
-    cmds:
-      - talhelper gensecret > {{.TALHELPER_SECRET_FILE}}
-      - task: :sops:.encrypt-file
-        vars:
-          file: "{{.TALHELPER_SECRET_FILE}}"
-    status: ["test -f {{.TALHELPER_SECRET_FILE}}"]
-    preconditions:
-      - msg: Missing talhelper config file
-        sh: test -f {{.TALHELPER_CONFIG_FILE}}
-
-  bootstrap-genconfig:
-    desc: Generate the Talos configs
-    dir: "{{.TALOS_DIR}}"
-    cmd: talhelper genconfig --secret-file {{.TALHELPER_SECRET_FILE}}
-    preconditions:
-      - msg: Missing talhelper config file
-        sh: test -f {{.TALHELPER_CONFIG_FILE}}
-      - msg: Missing talhelper secret file
-        sh: test -f {{.TALHELPER_SECRET_FILE}}
-
-  bootstrap-apply:
-    desc: Apply the Talos configs to the nodes
-    dir: "{{.TALOS_DIR}}"
-    cmd: talhelper gencommand apply --extra-flags=--insecure | bash
-    preconditions:
-      - msg: Missing talhelper config file
-        sh: test -f {{.TALHELPER_CONFIG_FILE}}
-
-  bootstrap-install:
-    desc: Install the Talos cluster
-    dir: "{{.TALOS_DIR}}"
-    cmds:
-      - echo "Installing Talos... ignore the errors and be patient"
       - until talhelper gencommand bootstrap | bash; do sleep 10; done
-      - sleep 10
+      - task: fetch-kubeconfig
+      - task: install-helm-apps
+      - talosctl health --server=false
+    preconditions:
+      - msg: Missing talhelper config file
+        sh: test -f {{.TALHELPER_CONFIG_FILE}}
+      - msg: Missing Sops config file
+        sh: test -f {{.SOPS_CONFIG_FILE}}
+      - msg: Missing Sops Age key file
+        sh: test -f {{.AGE_FILE}}
+
+  fetch-kubeconfig:
+    desc: Fetch kubeconfig
+    dir: "{{.TALOS_DIR}}"
+    cmd: until talhelper gencommand kubeconfig --extra-flags "{{.ROOT_DIR}} --force" | bash; do sleep 10; done
     preconditions:
       - msg: Missing talhelper config file
         sh: test -f {{.TALHELPER_CONFIG_FILE}}
 
-  bootstrap-apps:
+  install-helm-apps:
     desc: Bootstrap core apps needed for Talos
     dir: "{{.TALOS_DIR}}"
     cmds:
       - until kubectl --kubeconfig {{.KUBECONFIG_FILE}} wait --for=condition=Ready=False nodes --all --timeout=600s; do sleep 10; done
-      - helmfile --kubeconfig {{.KUBECONFIG_FILE}} --file helmfile.yaml apply --skip-diff-on-install --suppress-diff
+      - helmfile --kubeconfig {{.KUBECONFIG_FILE}} --file {{.HELMFILE_FILE}} apply --skip-diff-on-install --suppress-diff
       - until kubectl --kubeconfig {{.KUBECONFIG_FILE}} wait --for=condition=Ready nodes --all --timeout=600s; do sleep 10; done
     preconditions:
       - msg: Missing kubeconfig
         sh: test -f {{.KUBECONFIG_FILE}}
+      - msg: Missing helmfile
+        sh: test -f {{.HELMFILE_FILE}}
 
   upgrade-talos:
     desc: Upgrade talos on a node
@@ -95,13 +75,8 @@ tasks:
       - msg: Node not found
         sh: talosctl --nodes {{.node}} get machineconfig
 
-  fetch-kubeconfig:
-    desc: Generate talos kubeconfig
-    dir: "{{.TALOS_DIR}}"
-    cmd: until talhelper gencommand kubeconfig --extra-flags "{{.ROOT_DIR}} --force" | bash; do sleep 10; done
-
   nuke:
-    desc: Resets nodes back to maintenance mode so you can re-deploy again straight after
+    desc: Resets nodes back to maintenance mode
     prompt: This will destroy your cluster and reset the nodes back to maintenance mode... continue?
     dir: "{{.TALOS_DIR}}"
     cmd: talhelper gencommand reset --extra-flags "--reboot {{- if eq .CLI_FORCE false }}--system-labels-to-wipe STATE --system-labels-to-wipe EPHEMERAL{{ end }} --graceful=false --wait=false" | bash

Taskfile.yaml

@@ -14,6 +14,7 @@ vars:
   KUBECONFIG_FILE: "{{.ROOT_DIR}}/kubeconfig"
   MAKEJINJA_CONFIG_FILE: "{{.ROOT_DIR}}/makejinja.toml"
   PIP_REQUIREMENTS_FILE: "{{.ROOT_DIR}}/requirements.txt"
+  SOPS_CONFIG_FILE: "{{.ROOT_DIR}}/.sops.yaml"
   # Binaries
   PYTHON_BIN: python3
 
@@ -24,23 +25,19 @@ env:
   VIRTUAL_ENV: "{{.ROOT_DIR}}/.venv"
 
 includes:
-  kubernetes:
+  kubernetes: .taskfiles/Kubernetes
-    aliases: ["k8s"]
+  flux: .taskfiles/Flux
-    taskfile: .taskfiles/Kubernetes/Taskfile.yaml
+  repository: .taskfiles/Repository
-  flux: .taskfiles/Flux/Taskfile.yaml
+  talos: .taskfiles/Talos
-  repository:
+  sops: .taskfiles/Sops
-    aliases: ["repo"]
+  workstation: .taskfiles/Workstation
-    taskfile: .taskfiles/Repository/Taskfile.yaml
-  talos: .taskfiles/Talos/Taskfile.yaml
-  sops: .taskfiles/Sops/Taskfile.yaml
-  workstation: .taskfiles/Workstation/Taskfile.yaml
   user:
     taskfile: .taskfiles/User
     optional: true
 
 tasks:
 
-  default: task -l
+  default: task --list
 
   init:
     desc: Initialize configuration files
@@ -49,7 +46,8 @@ tasks:
       - cmd: echo === Configuration file copied ===
       - cmd: echo Proceed with updating the configuration files...
       - cmd: echo {{.BOOTSTRAP_CONFIG_FILE}}
-    status: ["test -f {{.BOOTSTRAP_CONFIG_FILE}}"]
+    status:
+      - test -f {{.BOOTSTRAP_CONFIG_FILE}}
     silent: true
 
   configure:
@@ -65,10 +63,14 @@ tasks:
     internal: true
     cmd: "{{.VIRTUAL_ENV}}/bin/makejinja"
     preconditions:
-      - { msg: "Missing virtual environment", sh: "test -d {{.VIRTUAL_ENV}}" }
+      - msg: Missing virtual environment
-      - { msg: "Missing Makejinja config file", sh: "test -f {{.MAKEJINJA_CONFIG_FILE}}" }
+        sh: test -d {{.VIRTUAL_ENV}}
-      - { msg: "Missing Makejinja plugin file", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/plugin.py" }
+      - msg: Missing Makejinja config file
-      - { msg: "Missing bootstrap config file", sh: "test -f {{.BOOTSTRAP_CONFIG_FILE}}" }
+        sh: test -f {{.MAKEJINJA_CONFIG_FILE}}
+      - msg: Missing Makejinja plugin file
+        sh: test -f {{.BOOTSTRAP_DIR}}/scripts/plugin.py
+      - msg: Missing bootstrap config file
+        sh: test -f {{.BOOTSTRAP_CONFIG_FILE}}
 
   .validate:
     internal: true