feat(ansible): Add addon support (#836)

Taskfile.yaml

@@ -43,3 +43,5 @@ tasks:
     desc: Configure repository from Ansible vars
     dir: "{{.TEMPLATE_DIR}}"
     cmd: ansible-playbook configure.yaml
+    env:
+      ANSIBLE_DISPLAY_SKIPPED_HOSTS: "false"

template/configure.yaml

@@ -5,7 +5,19 @@
   vars_files:
     - defaults/main.yaml
     - vars/config.yaml
+    - vars/addons.yaml
   tasks:
+    - name: Get absolute path to this Git repository # noqa: command-instead-of-module
+      ansible.builtin.command: git rev-parse --show-toplevel
+      changed_when: false
+      check_mode: false
+      register: repository
+      failed_when: repository.rc != 0
+
+    - name: Set facts
+      ansible.builtin.set_fact:
+        repository_path: "{{ repository.stdout }}"
+
     - name: Verify configuration
       ansible.builtin.include_tasks: tasks/validation/main.yaml
 
@@ -17,3 +29,6 @@
 
     - name: Template Kubernetes configuration
       ansible.builtin.include_tasks: tasks/kubernetes/main.yaml
+
+    - name: Template Kubernetes addon configuration
+      ansible.builtin.include_tasks: tasks/addons/main.yaml

template/tasks/addons/grafana.yaml

@@ -0,0 +1,63 @@
+---
+- name: Set addon facts
+  ansible.builtin.set_fact:
+    addon_name: grafana
+    addon_namespace: monitoring
+
+- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'file' and 'sops' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0755"
+        force: true
+      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

template/tasks/addons/hajimari.yaml

@@ -0,0 +1,63 @@
+---
+- name: Set addon facts
+  ansible.builtin.set_fact:
+    addon_name: hajimari
+    addon_namespace: default
+
+- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'file' and 'sops' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0755"
+        force: true
+      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

template/tasks/addons/kube_prometheus_stack.yaml

@@ -0,0 +1,63 @@
+---
+- name: Set addon facts
+  ansible.builtin.set_fact:
+    addon_name: kube-prometheus-stack
+    addon_namespace: monitoring
+
+- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'file' and 'sops' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0755"
+        force: true
+      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

template/tasks/addons/kubernetes_dashboard.yaml

@@ -0,0 +1,63 @@
+---
+- name: Set addon facts
+  ansible.builtin.set_fact:
+    addon_name: kubernetes-dashboard
+    addon_namespace: monitoring
+
+- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'file' and 'sops' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0755"
+        force: true
+      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

template/tasks/addons/main.yaml

@@ -0,0 +1,21 @@
+---
+
+- name: Process addon hajimari
+  when: hajimari.enabled | default (false)
+  ansible.builtin.include_tasks: hajimari.yaml
+
+- name: Process addon grafana
+  when: grafana.enabled | default (false)
+  ansible.builtin.include_tasks: grafana.yaml
+
+- name: Process addon kubernetes-dashboard
+  when: kubernetes_dashboard.enabled | default (false)
+  ansible.builtin.include_tasks: kubernetes_dashboard.yaml
+
+- name: Process addon kube-prometheus-stack
+  when: kube_prometheus_stack.enabled | default (false)
+  ansible.builtin.include_tasks: kube_prometheus_stack.yaml
+
+- name: Process addon weave-gitops
+  when: weave_gitops.enabled | default (false)
+  ansible.builtin.include_tasks: weave_gitops.yaml

template/tasks/addons/weave_gitops.yaml

@@ -0,0 +1,63 @@
+---
+- name: Set addon facts
+  ansible.builtin.set_fact:
+    addon_name: weave-gitops
+    addon_namespace: flux-system
+
+- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'file' and 'sops' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0755"
+        force: true
+      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

template/tasks/ansible/main.yaml

@@ -1,15 +1,8 @@
 ---
-- name: Get absolute path to this Git repository # noqa: command-instead-of-module
-  ansible.builtin.command: git rev-parse --show-toplevel
-  changed_when: false
-  check_mode: false
-  register: repository_path
-  failed_when: repository_path.rc != 0
-
 - name: Template Ansible configuration
   ansible.builtin.template:
     src: "{{ item.src }}"
-    dest: "{{ repository_path.stdout }}/{{ item.dest }}"
+    dest: "{{ repository_path }}/{{ item.dest }}"
     mode: "0755"
   loop:
     - src: templates/ansible/supplemental.yaml.j2
@@ -18,34 +11,43 @@
       dest: ./ansible/inventory/hosts.yaml
 
 # https://github.com/ansible-collections/community.sops/issues/153
-- name: Backup sops configuration file
-  ansible.builtin.copy:
-    src: "{{ repository_path.stdout }}/.sops.yaml"
-    dest: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    mode: "0755"
-- name: Remove sops configuration file
-  ansible.builtin.file:
-    path: "{{ repository_path.stdout }}/.sops.yaml"
-    state: absent
-
-- name: Template out node secrets
-  community.sops.sops_encrypt:
-    path: "{{ repository_path.stdout }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', 'templates/ansible/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
-    mode: "0755"
-    force: true
-  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
-  loop_control:
-    label: "{{ item.address }}"
-
-# https://github.com/ansible-collections/community.sops/issues/153
-- name: Restore sops configuration file
-  ansible.builtin.copy:
-    src: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    dest: "{{ repository_path.stdout }}/.sops.yaml"
-    mode: "0755"
-- name: Remove backup sops configuration file
-  ansible.builtin.file:
-    path: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    state: absent
+- name: Template Ansible encrypted files
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted node secrets
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', 'templates/ansible/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
+        mode: "0755"
+        force: true
+      loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
+      loop_control:
+        label: "{{ item.address }}"
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

template/tasks/kubernetes/main.yaml

@@ -1,58 +1,58 @@
 ---
-- name: Get absolute path to this Git repository # noqa: command-instead-of-module
-  ansible.builtin.command: git rev-parse --show-toplevel
-  changed_when: false
-  check_mode: false
-  register: repository_path
-  failed_when: repository_path.rc != 0
-
 - name: Ensure Kubernetes directories exist
+  when: item.state == 'directory'
   ansible.builtin.file:
-    path: "{{ repository_path.stdout }}/kubernetes/{{ item.path }}"
+    path: "{{ repository_path }}/kubernetes/{{ item.path }}"
     state: directory
     mode: "0755"
-  with_community.general.filetree:
-    - ../templates/kubernetes/
-  when: item.state == 'directory'
+  with_community.general.filetree: ["../templates/kubernetes/"]
 
 - name: Template Kubernetes unencrypted files
+  when: item.state == 'file' and 'sops' not in item.path
   ansible.builtin.template:
     src: "{{ item.src }}"
-    dest: "{{ repository_path.stdout }}/kubernetes/{{ item.path | replace('.j2', '') }}"
-  with_community.general.filetree:
-    - ../templates/kubernetes/
-  when: item.state == 'file' and 'sops' not in item.path
+    dest: "{{ repository_path }}/kubernetes/{{ item.path | replace('.j2', '') }}"
+    mode: "0755"
+  with_community.general.filetree: ["../templates/kubernetes/"]
 
 # https://github.com/ansible-collections/community.sops/issues/153
-- name: Backup sops configuration file
-  ansible.builtin.copy:
-    src: "{{ repository_path.stdout }}/.sops.yaml"
-    dest: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    mode: "0755"
-- name: Remove sops configuration file
-  ansible.builtin.file:
-    path: "{{ repository_path.stdout }}/.sops.yaml"
-    state: absent
-
-- name: Template Kubernetes unencrypted files
-  community.sops.sops_encrypt:
-    path: "{{ repository_path.stdout }}/kubernetes/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
-    mode: "0755"
-    force: true
-  with_community.general.filetree:
-    - ../templates/kubernetes/
-  when: item.state == 'file' and 'sops' in item.path
-
-# https://github.com/ansible-collections/community.sops/issues/153
-- name: Restore sops configuration file
-  ansible.builtin.copy:
-    src: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    dest: "{{ repository_path.stdout }}/.sops.yaml"
-    mode: "0755"
-- name: Remove backup sops configuration file
-  ansible.builtin.file:
-    path: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    state: absent
+- name: Template Kubernetes encrypted files
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template Kubernetes encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0755"
+        force: true
+      with_community.general.filetree: ["../templates/kubernetes/"]
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

template/tasks/sops/main.yaml

@@ -1,13 +1,6 @@
 ---
-- name: Get absolute path to this Git repository # noqa: command-instead-of-module
-  ansible.builtin.command: git rev-parse --show-toplevel
-  changed_when: false
-  check_mode: false
-  register: repository_path
-  failed_when: repository_path.rc != 0
-
-- name: Template out sops configuration file
+- name: Template Sops configuration file
   ansible.builtin.template:
     src: "templates/.sops.yaml.j2"
-    dest: "{{ repository_path.stdout }}/.sops.yaml"
+    dest: "{{ repository_path }}/.sops.yaml"
     mode: "0755"

template/tasks/validation/net.yaml

@@ -2,10 +2,10 @@
 - name: Verify master node count
   ansible.builtin.assert:
     that:
-      - "{{ bootstrap_hosts.master | length > 0 }}"
-      - "{{ bootstrap_hosts.master | length is odd }}"
-    success_msg: "Master node count {{ bootstrap_hosts.master | length }} is correct."
-    fail_msg: "Master node count {{ bootstrap_hosts.master | length }} is not greater than 0 or is not odd."
+      - "{{ bootstrap_nodes.master | length > 0 }}"
+      - "{{ bootstrap_nodes.master | length is odd }}"
+    success_msg: "Master node count {{ bootstrap_nodes.master | length }} is correct."
+    fail_msg: "Master node count {{ bootstrap_nodes.master | length }} is not greater than 0 or is not odd."
 
 - name: Verify node CIDR
   ansible.builtin.assert:
@@ -68,7 +68,7 @@
     success_msg: "Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or kube-vip."
     fail_msg: "Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or kube-vip."
     quiet: true
-  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
+  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
   loop_control:
      label: "{{ item.address }}"
 
@@ -78,7 +78,7 @@
     success_msg: "Node address {{ item.address }} is within {{ bootstrap_node_cidr }}."
     fail_msg: "Node address {{ item.address }} is not within {{ bootstrap_node_cidr }}."
     quiet: true
-  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
+  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
   loop_control:
      label: "{{ item.address }}"
 
@@ -89,6 +89,6 @@
     search_regex: OpenSSH
     timeout: 10
   connection: local
-  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
+  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
   loop_control:
      label: "{{ item.address }}"

template/templates/addons/grafana/app/secret.sops.yaml.j2

@@ -6,4 +6,4 @@ metadata:
   namespace: monitoring
 stringData:
   admin-user: admin
-  admin-password: "{{ bootstrap_grafana_admin_password }}"
+  admin-password: "{{ grafana.password }}"

template/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2

@@ -89,7 +89,7 @@ spec:
     kubeControllerManager:
       enabled: true
       endpoints: &cp
-      {% for item in bootstrap_hosts.master %}
+      {% for item in bootstrap_nodes.master %}
         - {{ item.address }}
       {% endfor %}
       serviceMonitor:

template/templates/addons/weave-gitops/app/secret.sops.yaml.j2

@@ -7,4 +7,4 @@ metadata:
 type: Opaque
 stringData:
   username: admin
-  password: "{{ bootstrap_weave_gitops_admin_password | password_hash('bcrypt', rounds=10) }}"
+  password: "{{ weave_gitops.password | password_hash('bcrypt', rounds=10) }}"

template/templates/ansible/hosts.yaml.j2

@@ -4,15 +4,15 @@ kubernetes:
   children:
     master:
       hosts:
-      {% for item in bootstrap_hosts.master %}
+      {% for item in bootstrap_nodes.master %}
         {{ item.name }}:
           ansible_user: {{ item.username }}
           ansible_host: {{ item.address }}
       {% endfor %}
-    {% if bootstrap_hosts.worker | default([]) | length > 0 %}
+    {% if bootstrap_nodes.worker | default([]) | length > 0 %}
     worker:
       hosts:
-      {% for item in bootstrap_hosts.worker %}
+      {% for item in bootstrap_nodes.worker %}
         {{ item.name }}:
           ansible_user: {{ item.username }}
           ansible_host: {{ item.address }}

template/templates/kubernetes/apps/default/kustomization.yaml.j2

@@ -1,7 +1,9 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  - ./echo-server/ks.yaml
+  {% if hajimari.enabled | default(false) %}
   - ./hajimari/ks.yaml
+  {% endif %}

template/templates/kubernetes/apps/flux-system/kustomization.yaml.j2

@@ -1,7 +1,10 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./addons/ks.yaml
+  {% if weave_gitops.enabled | default(false) %}
   - ./weave-gitops/ks.yaml
+  {% endif %}

template/templates/kubernetes/apps/monitoring/kustomization.yaml.j2

@@ -1,8 +1,15 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
+  {% if grafana.enabled | default(false) %}
   - ./grafana/ks.yaml
+  {% endif %}
+  {% if kube_prometheus_stack.enabled | default(false) %}
   - ./kube-prometheus-stack/ks.yaml
+  {% endif %}
+  {% if kubernetes_dashboard.enabled | default(false) %}
   - ./kubernetes-dashboard/ks.yaml
+  {% endif %}

template/templates/kubernetes/apps/networking/echo-server/app/helmrelease.yaml.j2

@@ -4,7 +4,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: echo-server
-  namespace: default
+  namespace: networking
 spec:
   interval: 30m
   chart:

template/templates/kubernetes/apps/networking/echo-server/app/kustomization.yaml.j2

@@ -1,6 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: default
+namespace: networking
 resources:
   - ./helmrelease.yaml

template/templates/kubernetes/apps/networking/echo-server/ks.yaml.j2

@@ -5,7 +5,7 @@ metadata:
   name: cluster-apps-echo-server
   namespace: flux-system
 spec:
-  path: ./kubernetes/apps/default/echo-server/app
+  path: ./kubernetes/apps/networking/echo-server/app
   prune: true
   sourceRef:
     kind: GitRepository

template/templates/kubernetes/apps/networking/kustomization.yaml.j2

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./cloudflared/ks.yaml
+  - ./echo-server/ks.yaml
   - ./external-dns/ks.yaml
   - ./ingress-nginx/ks.yaml
   - ./k8s-gateway/ks.yaml

template/vars/.gitignore

@@ -1 +1,2 @@
+addons.yaml
 config.yaml

template/vars/addons.sample.yaml

@@ -0,0 +1,26 @@
+---
+#
+# Addons configuration - addons.yaml is gitignored
+#
+
+# https://github.com/toboshii/hajimari
+hajimari:
+  enabled: false
+
+# https://github.com/grafana/grafana
+grafana:
+  enabled: false
+  # password:
+
+# https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
+kube_prometheus_stack:
+  enabled: false
+
+# https://github.com/kubernetes/dashboard
+kubernetes_dashboard:
+  enabled: false
+
+# https://github.com/weaveworks/weave-gitops
+weave_gitops:
+  enabled: false
+  # password:

template/vars/config.sample.yaml

@@ -1,6 +1,6 @@
 ---
 #
-# Bootstrap configuration - This file is gitignored
+# Bootstrap configuration - config.yaml is gitignored
 #
 
 # Github username (e.g. onedr0p)
@@ -16,10 +16,6 @@ bootstrap_acme_email:
 
 # Flux github webhook token (openssl rand -hex 12)
 bootstrap_flux_github_webhook_token:
-# Grafana admin password (openssl rand -hex 12)
-bootstrap_grafana_admin_password:
-# Weave GitOps dashboard password (openssl rand -hex 12)
-bootstrap_weave_gitops_admin_password:
 
 # Cloudflare domain
 bootstrap_cloudflare_domain:
@@ -45,7 +41,7 @@ bootstrap_cluster_cidr: 10.42.0.0/16
 bootstrap_service_cidr: 10.43.0.0/16
 
 # Node information
-bootstrap_hosts:
+bootstrap_nodes:
   # Use only 1, 3 or more odd master nodes, recommended is 3
   master: []
     # - name: kube0