diff --git a/ansible/inventory/group_vars/kubernetes/k3s.yml b/ansible/inventory/group_vars/kubernetes/k3s.yml
index 457e48a7..7bd5b891 100644
--- a/ansible/inventory/group_vars/kubernetes/k3s.yml
+++ b/ansible/inventory/group_vars/kubernetes/k3s.yml
@@ -4,31 +4,16 @@
 # ...see https://github.com/PyratLabs/ansible-role-k3s
 #
 
-# (string) Use a specific version of k3s
 # renovate: datasource=github-releases depName=k3s-io/k3s
 k3s_release_version: "v1.27.1+k3s1"
-
-# (bool) Install using hard links rather than symbolic links.
 k3s_install_hard_links: true
-
-# (bool) Escalate user privileges for all tasks
 k3s_become: true
-
-# (bool) Enable debug logging on the k3s service
 k3s_debug: false
-
-# (bool) Enable etcd embedded datastore
 k3s_etcd_datastore: true
-
-# (bool) Allow the use of unsupported configurations in k3s
 k3s_use_unsupported_config: true
-
-# (string) Control Plane registration address
 k3s_registration_address: "{{ kubevip_address }}"
-
-# (list) A list of URLs to deploy on the primary control plane. Read notes below.
 k3s_server_manifests_urls:
-  # Kube-vip
+  # Kube-vip RBAC
   - url: https://raw.githubusercontent.com/kube-vip/kube-vip/main/docs/manifests/rbac.yaml
     filename: custom-kube-vip-rbac.yaml
   # Essential Prometheus Operator CRDs
@@ -38,13 +23,9 @@ k3s_server_manifests_urls:
     filename: custom-prometheus-prometheusrules.yaml
   - url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.65.1/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
     filename: custom-prometheus-servicemonitors.yaml
-
-# (list) A flat list of templates to deploy on the primary control plane node
 # /var/lib/rancher/k3s/server/manifests
 k3s_server_manifests_templates:
   - custom-cilium-helmchart.yaml.j2
-
-# (list) A flat list of templates to deploy as static pods on all the control plane nodes
 # /var/lib/rancher/k3s/agent/pod-manifests
 k3s_server_pod_manifests_templates:
   - kube-vip-static-pod.yaml.j2
diff --git a/ansible/inventory/group_vars/kubernetes/os.yml b/ansible/inventory/group_vars/kubernetes/os.yml
index 48f42f4f..7494d495 100644
--- a/ansible/inventory/group_vars/kubernetes/os.yml
+++ b/ansible/inventory/group_vars/kubernetes/os.yml
@@ -1,9 +1,6 @@
 ---
-# (string) Timezone for the servers
-# timezone: "America/New_York"
 
-# (list) Additional ssh public keys to add to the nodes
-# ssh_authorized_keys:
+# ssh_authorized_keys: []
 
 fedora:
   packages:
diff --git a/ansible/inventory/group_vars/master/k3s.yml b/ansible/inventory/group_vars/master/k3s.yml
index c8925462..5bcc496b 100644
--- a/ansible/inventory/group_vars/master/k3s.yml
+++ b/ansible/inventory/group_vars/master/k3s.yml
@@ -2,44 +2,29 @@
 # https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
 # https://github.com/PyratLabs/ansible-role-k3s
 
-# (bool) Specify if a host (or host group) are part of the control plane
 k3s_control_node: true
-
-# (dict) k3s settings for all control-plane nodes
 k3s_server:
   node-ip: "{{ ansible_host }}"
   tls-san:
     - "{{ kubevip_address }}"
-  # Disable Docker - this will use the default containerd CRI
   docker: false
-  flannel-backend: "none" # This needs to be in quotes
+  flannel-backend: "none"             # This needs to be in quotes
   disable:
-    # Disable flannel - replaced with Calico
-    - flannel
-    # Disable local-path-provisioner - installed with Flux
-    - local-storage
-    # Disable metrics-server - installed with Flux
-    - metrics-server
-    # Disable servicelb - replaced with metallb and installed with Flux
-    - servicelb
-    # Disable traefik - replaced with ingress-nginx and installed with Flux
-    - traefik
+    - flannel                         # Disable flannel                 - replaced with Cilium
+    - local-storage                   # Disable local-path-provisioner  - installed with Flux
+    - metrics-server                  # Disable metrics-server          - installed with Flux
+    - servicelb                       # Disable servicelb               - replaced with metallb and installed with Flux
+    - traefik                         # Disable traefik                 - replaced with ingress-nginx and installed with Flux
   disable-network-policy: true
   disable-cloud-controller: true
-  disable-kube-proxy: true
+  disable-kube-proxy: true            # Cilium uses eBPF
   write-kubeconfig-mode: "644"
-  # Network CIDR to use for pod IPs
   cluster-cidr: "{{ cluster_cidr }}"
-  # Network CIDR to use for service IPs
   service-cidr: "{{ service_cidr }}"
   kube-controller-manager-arg:
-    # Required to monitor kube-controller-manager with kube-prometheus-stack
-    - "bind-address=0.0.0.0"
+    - "bind-address=0.0.0.0"          # Required to monitor kube-controller-manager with kube-prometheus-stack
   kube-scheduler-arg:
-    # Required to monitor kube-scheduler with kube-prometheus-stack
-    - "bind-address=0.0.0.0"
-  # Required to monitor etcd with kube-prometheus-stack
-  etcd-expose-metrics: true
+    - "bind-address=0.0.0.0"          # Required to monitor kube-scheduler with kube-prometheus-stack
+  etcd-expose-metrics: true           # Required to monitor etcd with kube-prometheus-stack
   kube-apiserver-arg:
-    # Required for HAProxy health-checks
-    - "anonymous-auth=true"
+    - "anonymous-auth=true"           # Required for HAProxy health-checks
diff --git a/ansible/inventory/group_vars/worker/k3s.yml b/ansible/inventory/group_vars/worker/k3s.yml
index d2a44e05..47682571 100644
--- a/ansible/inventory/group_vars/worker/k3s.yml
+++ b/ansible/inventory/group_vars/worker/k3s.yml
@@ -2,9 +2,6 @@
 # https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
 # https://github.com/PyratLabs/ansible-role-k3s
 
-# (bool) Specify if a host (or host group) are part of the control plane
 k3s_control_node: false
-
-# (dict) k3s settings for all worker nodes
 k3s_agent:
   node-ip: "{{ ansible_host }}"
diff --git a/configure b/configure
index 697ad873..91dda1bb 100755
--- a/configure
+++ b/configure
@@ -59,8 +59,8 @@ main() {
             > "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
         sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
         # generate ansible settings
-        envsubst < "${PROJECT_DIR}/tmpl/ansible/kube-vip.yml" \
-            > "${PROJECT_DIR}/ansible/inventory/group_vars/kubernetes/kube-vip.yml"
+        envsubst < "${PROJECT_DIR}/tmpl/ansible/supplemental.yml" \
+            > "${PROJECT_DIR}/ansible/inventory/group_vars/kubernetes/supplemental.yml"
         # generate ansible hosts file and secrets
         generate_ansible_hosts
         generate_ansible_host_secrets
diff --git a/tmpl/ansible/kube-vip.yml b/tmpl/ansible/supplemental.yml
similarity index 74%
rename from tmpl/ansible/kube-vip.yml
rename to tmpl/ansible/supplemental.yml
index fbfd042a..7b803b72 100644
--- a/tmpl/ansible/kube-vip.yml
+++ b/tmpl/ansible/supplemental.yml
@@ -1,5 +1,5 @@
 ---
-# (string) The ARP address kube-vip broadcasts
+timezone: "${BOOTSTRAP_TIMEZONE}"
 kubevip_address: "${BOOTSTRAP_KUBE_VIP_ADDR}"
 cluster_cidr: "${BOOTSTRAP_CLUSTER_CIDR}"
 service_cidr: "${BOOTSTRAP_SERVICE_CIDR}"