feat: add go-task, set up prettier, format yaml (#50)

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
-- name: Discuss on Discord
-  url: https://discord.com/invite/sTMX7Vh
-  about: Join our Discord community
+  - name: Discuss on Discord
+    url: https://discord.com/invite/sTMX7Vh
+    about: Join our Discord community

.github/lint/.markdownlint.yaml

@@ -0,0 +1,23 @@
+---
+default: true
+
+# MD013/line-length - Line length
+MD013:
+  # Number of characters
+  line_length: 240
+  # Number of characters for headings
+  heading_line_length: 80
+  # Number of characters for code blocks
+  code_block_line_length: 80
+  # Include code blocks
+  code_blocks: true
+  # Include tables
+  tables: true
+  # Include headings
+  headings: true
+  # Include headings
+  headers: true
+  # Strict length checking
+  strict: false
+  # Stern length checking
+  stern: false

.github/lint/.prettierignore

@@ -0,0 +1,2 @@
+*.sops.yaml
+gotk-components.yaml

.github/lint/.prettierrc.yaml

@@ -0,0 +1,5 @@
+---
+trailingComma: "es5"
+tabWidth: 2
+semi: false
+singleQuote: false

.github/lint/.yamllint.yaml

@@ -1,10 +1,10 @@
 ignore: |
-  .github/
-  crds.yaml
+  *.sops.yaml
+  gotk-components.yaml
 extends: default
 rules:
   truthy:
-    allowed-values: ['true', 'false', 'on', 'yes']
+    allowed-values: ["true", "false", "on"]
   comments:
     min-spaces-from-content: 1
   line-length: disable
@@ -14,6 +14,4 @@ rules:
   brackets:
     min-spaces-inside: 0
     max-spaces-inside: 0
-  indentation:
-    spaces: 2
-    indent-sequences: consistent
+  indentation: enable

.github/workflows/flux-schedule.yaml

@@ -1,44 +1,43 @@
 ---
-
 name: Schedule - Update Flux
 
 on: # yamllint disable-line rule:truthy
   workflow_dispatch:
   schedule:
-  - cron: '0 12 * * *'
+    - cron: "0 12 * * *"
 
 jobs:
   flux-upgrade:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 1
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 1
 
-    - name: Setup Flux CLI
-      uses: fluxcd/flux2/action@main
+      - name: Setup Flux CLI
+        uses: fluxcd/flux2/action@main
 
-    - name: Upgrade Flux
-      id: upgrade
-      run: |
-        CLI_VERSION="$(flux -v)"
-        VERSION="v${CLI_VERSION#*flux version }"
-        flux install --version="${VERSION}" \
-          --network-policy=false \
-          --export > ./cluster/base/flux-system/gotk-components.yaml
-        echo "::set-output name=flux_version::$VERSION"
+      - name: Upgrade Flux
+        id: upgrade
+        run: |
+          CLI_VERSION="$(flux -v)"
+          VERSION="v${CLI_VERSION#*flux version }"
+          flux install --version="${VERSION}" \
+            --network-policy=false \
+            --export > ./cluster/base/flux-system/gotk-components.yaml
+          echo "::set-output name=flux_version::$VERSION"
 
-    - name: Create pull request for Flux upgrade
-      uses: peter-evans/create-pull-request@v3
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        branch: "flux/upgrade-${{ steps.upgrade.outputs.flux_version }}"
-        delete-branch: true
-        title: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}"
-        signoff: false
-        committer: GitHub <noreply@github.com>
-        author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
-        commit-message: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}"
-        body: |
-          Release notes: https://github.com/fluxcd/flux2/releases/tag/${{ steps.upgrade.outputs.flux_version }}
-        labels: flux/upgrade
+      - name: Create pull request for Flux upgrade
+        uses: peter-evans/create-pull-request@v3
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: "flux/upgrade-${{ steps.upgrade.outputs.flux_version }}"
+          delete-branch: true
+          title: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}"
+          signoff: false
+          committer: GitHub <noreply@github.com>
+          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          commit-message: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}"
+          body: |
+            Release notes: https://github.com/fluxcd/flux2/releases/tag/${{ steps.upgrade.outputs.flux_version }}
+          labels: flux/upgrade

.github/workflows/invalid-template.yaml

@@ -1,24 +1,23 @@
 ---
-
 name: Invalid Template
 
 on:
   issues:
     types:
-    - labeled
-    - unlabeled
-    - reopened
+      - labeled
+      - unlabeled
+      - reopened
 
 jobs:
   support:
     runs-on: ubuntu-20.04
     steps:
-    - uses: dessant/support-requests@v2
-      with:
-        github-token: ${{ github.token }}
-        support-label: 'template-incomplete'
-        issue-comment: >
-          :wave: @{issue-author}, please follow the template provided.
-        close-issue: true
-        lock-issue: true
-        issue-lock-reason: 'resolved'
+      - uses: dessant/support-requests@v2
+        with:
+          github-token: ${{ github.token }}
+          support-label: "template-incomplete"
+          issue-comment: >
+            :wave: @{issue-author}, please follow the template provided.
+          close-issue: true
+          lock-issue: true
+          issue-lock-reason: "resolved"

.github/workflows/lint.yaml

@@ -1,19 +1,32 @@
 ---
-
 name: Lint
 
 on: # yamllint disable-line rule:truthy
-  workflow_dispatch:
   pull_request:
 
 jobs:
-  yaml:
+  yamllint:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v2
-    - name: yamllint
-      uses: reviewdog/action-yamllint@v1
-      with:
-        github_token: ${{ secrets.github_token }}
-        reporter: github-pr-review
-        yamllint_flags: '-c .github/yamllint.config.yaml ./cluster/'
+      - uses: actions/checkout@v2
+      - name: yamllint
+        uses: reviewdog/action-yamllint@v1
+        with:
+          yamllint_flags: "-c .github/lint/.yamllint.yaml ./cluster"
+  shellcheck:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+      - name: shellcheck
+        uses: reviewdog/action-shellcheck@v1
+        with:
+          path: "./hack"
+          level: "error"
+  markdownlint:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+      - name: markdownlint
+        uses: reviewdog/action-markdownlint@v0.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/renovate-schedule.yaml

@@ -1,38 +1,36 @@
-
 ---
-
 name: Schedule - Renovate Helm Releases
 
 on: # yamllint disable-line rule:truthy
   workflow_dispatch:
   schedule:
-  - cron: '0 */12 * * *'
+    - cron: "0 */12 * * *"
 
 jobs:
   renovate-helm-releases:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v2
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        fetch-depth: 1
+      - uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 1
 
-    - name: Renovate Helm Releases
-      uses: k8s-at-home/renovate-helm-releases@v1
-      with:
-        cluster-path: "./cluster"
+      - name: Renovate Helm Releases
+        uses: k8s-at-home/renovate-helm-releases@v1
+        with:
+          cluster-path: "./cluster"
 
-    - name: Create pull request for renovatebot helm-release annotations
-      uses: peter-evans/create-pull-request@v3
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        branch: renovate-annotations
-        delete-branch: true
-        title: "chore(deps): update renovate annotations"
-        signoff: false
-        committer: GitHub <noreply@github.com>
-        author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
-        commit-message: "chore(deps): update renovate annotations"
-        body: |
-          Update HelmReleases inorder for Renovate to pick up new versions of Helm charts
-        labels: renovate/annotations
+      - name: Create pull request for renovatebot helm-release annotations
+        uses: peter-evans/create-pull-request@v3
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: renovate-annotations
+          delete-branch: true
+          title: "chore(deps): update renovate annotations"
+          signoff: false
+          committer: GitHub <noreply@github.com>
+          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          commit-message: "chore(deps): update renovate annotations"
+          body: |
+            Update HelmReleases inorder for Renovate to pick up new versions of Helm charts
+          labels: renovate/annotations

.github/workflows/support.yaml

@@ -1,28 +1,27 @@
 ---
-
-name: 'Support requests'
+name: "Support requests"
 
 on:
   issues:
     types:
-    - labeled
-    - unlabeled
-    - reopened
+      - labeled
+      - unlabeled
+      - reopened
 
 jobs:
   support:
     runs-on: ubuntu-20.04
     steps:
-    - uses: dessant/support-requests@v2
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        support-label: 'support'
-        issue-comment: >
-          :wave: @{issue-author}, we use the issue tracker exclusively
-          for bug reports and feature requests. However, this issue appears
-          to be a support request. Please use our support channels
-          to get help with.
-          - [Discord](https://discord.gg/sTMX7Vh)
-        close-issue: true
-        lock-issue: false
-        issue-lock-reason: 'off-topic'
+      - uses: dessant/support-requests@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          support-label: "support"
+          issue-comment: >
+            :wave: @{issue-author}, we use the issue tracker exclusively
+            for bug reports and feature requests. However, this issue appears
+            to be a support request. Please use our support channels
+            to get help with.
+            - [Discord](https://discord.gg/sTMX7Vh)
+          close-issue: true
+          lock-issue: false
+          issue-lock-reason: "off-topic"

.pre-commit-config.yaml

@@ -1,28 +1,29 @@
+---
 fail_fast: false
 repos:
-- repo: https://github.com/adrienverge/yamllint
-  rev: v1.26.2
-  hooks:
-  - args:
-    - -c
-    - .github/yamllint.config.yaml
-    id: yamllint
-- repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.0.1
-  hooks:
-  - id: trailing-whitespace
-  - id: end-of-file-fixer
-  - id: mixed-line-ending
-- repo: https://github.com/Lucas-C/pre-commit-hooks
-  rev: v1.1.10
-  hooks:
-  - id: remove-crlf
-  - id: remove-tabs
-- repo: https://github.com/sirosen/fix-smartquotes
-  rev: 0.2.0
-  hooks:
-  - id: fix-smartquotes
-- repo: https://github.com/k8s-at-home/sops-pre-commit
-  rev: v2.0.3
-  hooks:
-  - id: forbid-secrets
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.26.2
+    hooks:
+      - args:
+          - --config-file
+          - .github/lint/.yamllint.yaml
+        id: yamllint
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.0.1
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: mixed-line-ending
+  - repo: https://github.com/Lucas-C/pre-commit-hooks
+    rev: v1.1.10
+    hooks:
+      - id: remove-crlf
+      - id: remove-tabs
+  - repo: https://github.com/sirosen/fix-smartquotes
+    rev: 0.2.0
+    hooks:
+      - id: fix-smartquotes
+  - repo: https://github.com/k8s-at-home/sops-pre-commit
+    rev: v2.0.3
+    hooks:
+      - id: forbid-secrets

.taskfiles/flux.yml

@@ -0,0 +1,9 @@
+---
+version: "3"
+
+tasks:
+  sync:
+    desc: Sync flux-system with the Git Repository
+    cmds:
+      - flux reconcile source git flux-system
+    silent: true

.taskfiles/format.yml

@@ -0,0 +1,33 @@
+---
+version: "3"
+
+tasks:
+  all:
+    - task: markdown
+    - task: yaml
+  markdown:
+    desc: Format Markdown
+    cmds:
+      - >-
+        prettier
+        --ignore-path '.github/lint/.prettierignore'
+        --config '.github/lint/.prettierrc.yaml'
+        --list-different
+        --ignore-unknown
+        --parser=markdown
+        --write '*.md' '**/*.md'
+    ignore_error: true
+  yaml:
+    desc: Format YAML
+    cmds:
+      - >-
+        prettier
+        --ignore-path '.github/lint/.prettierignore'
+        --config
+        '.github/lint/.prettierrc.yaml'
+        --list-different
+        --ignore-unknown
+        --parser=yaml
+        --write '*.y*ml'
+        '**/*.y*ml'
+    ignore_error: true

.taskfiles/lint.yml

@@ -0,0 +1,26 @@
+---
+version: "3"
+
+tasks:
+  all:
+    - task: markdown
+    - task: yaml
+    - task: format
+
+  markdown:
+    desc: Lint Markdown
+    cmds:
+      - markdownlint -c '.github/lint/.markdownlint.yaml' *.md **/*.md
+    ignore_errors: true
+
+  yaml:
+    desc: Lint YAML
+    cmds:
+      - yamllint -c '.github/lint/.yamllint.yaml' .
+    ignore_errors: true
+
+  format:
+    desc: Lint general formatting
+    cmds:
+      - prettier --ignore-path '.github/lint/.prettierignore' --config '.github/lint/.prettierrc.yaml' --check .
+    ignore_errors: true

.taskfiles/pre-commit.yml

@@ -0,0 +1,12 @@
+---
+version: "3"
+
+tasks:
+  init:
+    desc: Initialize pre-commit hooks
+    cmds:
+      - pre-commit install-hooks
+  run:
+    desc: Run pre-commit
+    cmds:
+      - pre-commit run --all-files

README.md

@@ -50,6 +50,8 @@ Already provisioned Bare metal or VMs with any modern operating system like Ubun
 | [pre-commit](https://github.com/pre-commit/pre-commit)             | Runs checks during `git commit`                                     |    `2.12.0`     |    ❌     |
 | [kustomize](https://kustomize.io/)                                 | Template-free way to customize application configuration            |     `4.1.0`     |    ❌     |
 | [helm](https://helm.sh/)                                           | Manage Kubernetes applications                                      |     `3.5.4`     |    ❌     |
+| [go-task](https://github.com/go-task/task)                         | A task runner / simpler Make alternative written in Go              |     `3.7.0`     |    ❌     |
+| [prettier](https://github.com/prettier/prettier)                   | Prettier is an opinionated code formatter.                          |     `2.3.2`     |    ❌     |
 
 ### :warning:  pre-commit
 
@@ -252,23 +254,23 @@ export BOOTSTRAP_INGRESS_NGINX_LB="169.254.1.10"
 
 ```sh
 envsubst < ./tmpl/.sops.yaml > ./.sops.yaml
-envsubst < ./tmpl/cluster-secrets.yaml > ./cluster/base/cluster-secrets.yaml
+envsubst < ./tmpl/cluster-secrets.sops.yaml > ./cluster/base/cluster-secrets.sops.yaml
 envsubst < ./tmpl/cluster-settings.yaml > ./cluster/base/cluster-settings.yaml
 envsubst < ./tmpl/gotk-sync.yaml > ./cluster/base/flux-system/gotk-sync.yaml
-envsubst < ./tmpl/secret.enc.yaml > ./cluster/core/cert-manager/secret.enc.yaml
+envsubst < ./tmpl/secret.sops.yaml > ./cluster/core/cert-manager/secret.sops.yaml
 ```
 
 6. **Verify** all the above files have the correct information present
 
-7. Encrypt `cluster/cluster-secrets.yaml` and `cert-manager/secret.enc.yaml` with SOPS
+7. Encrypt `cluster/cluster-secrets.sops.yaml` and `cert-manager/secret.sops.yaml` with SOPS
 
 ```sh
 export GPG_TTY=$(tty)
-sops --encrypt --in-place ./cluster/base/cluster-secrets.yaml
-sops --encrypt --in-place ./cluster/core/cert-manager/secret.enc.yaml
+sops --encrypt --in-place ./cluster/base/cluster-secrets.sops.yaml
+sops --encrypt --in-place ./cluster/core/cert-manager/secret.sops.yaml
 ```
 
-:round_pushpin: Variables defined in `cluster-secrets.yaml` and `cluster-settings.yaml` will be usable anywhere in your YAML manifests under `./cluster`
+:round_pushpin: Variables defined in `cluster-secrets.sops.yaml` and `cluster-settings.sops.yaml` will be usable anywhere in your YAML manifests under `./cluster`
 
 8. **Verify** all the above files are **encrypted** with SOPS
 

Taskfile.yml

@@ -0,0 +1,16 @@
+---
+version: "3"
+
+vars:
+  PROJECT_DIR:
+    sh: "git rev-parse --show-toplevel"
+  CLUSTER_DIR: "{{.PROJECT_DIR}}/cluster"
+
+env:
+  KUBECONFIG: "{{.PROJECT_DIR}}/kubeconfig"
+
+includes:
+  flux: .taskfiles/flux.yml
+  format: .taskfiles/format.yml
+  lint: .taskfiles/lint.yml
+  pre-commit: .taskfiles/pre-commit.yml

cluster/apps/default/homer/config-pvc.yaml

@@ -5,7 +5,7 @@ metadata:
   name: homer-config
 spec:
   accessModes:
-  - ReadWriteOnce
+    - ReadWriteOnce
   storageClassName: local-path
   resources:
     requests:

cluster/apps/default/homer/helm-release.yaml

@@ -26,13 +26,13 @@ spec:
         annotations:
           kubernetes.io/ingress.class: "nginx"
         hosts:
-        - host: "homer.${SECRET_DOMAIN}"
-          paths:
-          - path: /
-            pathType: Prefix
+          - host: "homer.${SECRET_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
         tls:
-        - hosts:
-          - "homer.${SECRET_DOMAIN}"
+          - hosts:
+              - "homer.${SECRET_DOMAIN}"
     persistence:
       config:
         enabled: true

cluster/apps/default/homer/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- config-pvc.yaml
-- helm-release.yaml
+  - config-pvc.yaml
+  - helm-release.yaml

cluster/apps/default/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- homer
+  - homer

cluster/apps/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- default
-- networking
-- system-upgrade
+  - default
+  - networking
+  - system-upgrade

cluster/apps/networking/ingress-nginx/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- helm-release.yaml
+  - helm-release.yaml

cluster/apps/networking/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ingress-nginx
-- wildcard-certificate
+  - ingress-nginx
+  - wildcard-certificate

cluster/apps/networking/wildcard-certificate/certificate.yaml

@@ -11,5 +11,5 @@ spec:
     kind: ClusterIssuer
   commonName: "${SECRET_DOMAIN}"
   dnsNames:
-  - "${SECRET_DOMAIN}"
-  - "*.${SECRET_DOMAIN}"
+    - "${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"

cluster/apps/networking/wildcard-certificate/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- certificate.yaml
+  - certificate.yaml

cluster/apps/system-upgrade/kustomization.yaml

@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- system-upgrade-controller
+  - system-upgrade-controller

cluster/apps/system-upgrade/system-upgrade-controller/agent-plan.yaml

@@ -12,14 +12,14 @@ spec:
   channel: https://update.k3s.io/v1-release/channels/v1.20
   nodeSelector:
     matchExpressions:
-    - key: node-role.kubernetes.io/master
-      operator: NotIn
-      values:
-      - "true"
+      - key: node-role.kubernetes.io/master
+        operator: NotIn
+        values:
+          - "true"
   prepare:
     image: rancher/k3s-upgrade
     args:
-    - "prepare"
-    - "k3s-server"
+      - "prepare"
+      - "k3s-server"
   upgrade:
     image: rancher/k3s-upgrade

cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml

@@ -2,5 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- server-plan.yaml
-- agent-plan.yaml
+  - server-plan.yaml
+  - agent-plan.yaml

cluster/apps/system-upgrade/system-upgrade-controller/server-plan.yaml

@@ -11,12 +11,12 @@ spec:
   cordon: true
   nodeSelector:
     matchExpressions:
-    - key: node-role.kubernetes.io/master
-      operator: In
-      values:
-      - "true"
+      - key: node-role.kubernetes.io/master
+        operator: In
+        values:
+          - "true"
   tolerations:
-  - key: "node-role.kubernetes.io/master"
-    operator: "Exists"
+    - key: "node-role.kubernetes.io/master"
+      operator: "Exists"
   upgrade:
     image: rancher/k3s-upgrade

cluster/base/apps.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   interval: 10m0s
   dependsOn:
-  - name: core
+    - name: core
   path: ./cluster/apps
   prune: true
   sourceRef:
@@ -20,7 +20,7 @@ spec:
   postBuild:
     substitute: {}
     substituteFrom:
-    - kind: ConfigMap
-      name: cluster-settings
-    - kind: Secret
-      name: cluster-secrets
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

cluster/base/core.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   interval: 10m0s
   dependsOn:
-  - name: crds
+    - name: crds
   path: ./cluster/core
   prune: false
   sourceRef:
@@ -20,7 +20,7 @@ spec:
   postBuild:
     substitute: {}
     substituteFrom:
-    - kind: ConfigMap
-      name: cluster-settings
-    - kind: Secret
-      name: cluster-secrets
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

cluster/base/flux-system/charts/helm/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- bitnami-charts.yaml
-- ingress-nginx-charts.yaml
-- jetstack-charts.yaml
-- k8s-at-home-charts.yaml
-- metallb-charts.yaml
+  - bitnami-charts.yaml
+  - ingress-nginx-charts.yaml
+  - jetstack-charts.yaml
+  - k8s-at-home-charts.yaml
+  - metallb-charts.yaml

cluster/base/flux-system/charts/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- helm
+  - helm

cluster/base/flux-system/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- gotk-components.yaml
-- gotk-sync.yaml
-- charts
+  - gotk-components.yaml
+  - gotk-sync.yaml
+  - charts

cluster/core/cert-manager/helm-release.yaml

@@ -20,12 +20,12 @@ spec:
     webhook:
       enabled: true
     extraArgs:
-    - --dns01-recursive-nameservers=1.1.1.1:53
-    - --dns01-recursive-nameservers-only
+      - --dns01-recursive-nameservers=1.1.1.1:53
+      - --dns01-recursive-nameservers-only
     cainjector:
       replicaCount: 1
     podDnsPolicy: "None"
     podDnsConfig:
       nameservers:
-      - "1.1.1.1"
-      - "8.8.8.8"
+        - "1.1.1.1"
+        - "8.8.8.8"

cluster/core/cert-manager/kustomization.yaml

@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- helm-release.yaml
-- letsencrypt-production.yaml
-- letsencrypt-staging.yaml
-- secret.enc.yaml
+  - helm-release.yaml
+  - letsencrypt-production.yaml
+  - letsencrypt-staging.yaml
+  - secret.enc.yaml

cluster/core/cert-manager/letsencrypt-production.yaml

@@ -10,9 +10,9 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-production
     solvers:
-    - dns01:
-        cloudflare:
-          email: "${SECRET_CLOUDFLARE_EMAIL}"
-          apiTokenSecretRef:
-            name: cloudflare-token-secret
-            key: cloudflare-token
+      - dns01:
+          cloudflare:
+            email: "${SECRET_CLOUDFLARE_EMAIL}"
+            apiTokenSecretRef:
+              name: cloudflare-token-secret
+              key: cloudflare-token

cluster/core/cert-manager/letsencrypt-staging.yaml

@@ -10,9 +10,9 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-staging
     solvers:
-    - dns01:
-        cloudflare:
-          email: "${SECRET_CLOUDFLARE_EMAIL}"
-          apiTokenSecretRef:
-            name: cloudflare-token-secret
-            key: cloudflare-token
+      - dns01:
+          cloudflare:
+            email: "${SECRET_CLOUDFLARE_EMAIL}"
+            apiTokenSecretRef:
+              name: cloudflare-token-secret
+              key: cloudflare-token

cluster/core/cert-manager/secret.enc.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-    name: cloudflare-token-secret
-    namespace: cert-manager
+  name: cloudflare-token-secret
+  namespace: cert-manager
 stringData:
-    cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}
+  cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}

cluster/core/kustomization.yaml

@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- namespaces
-- metallb-system
-- cert-manager
-- system-upgrade
+  - namespaces
+  - metallb-system
+  - cert-manager
+  - system-upgrade

cluster/core/metallb-system/helm-release.yaml

@@ -18,7 +18,7 @@ spec:
   values:
     configInline:
       address-pools:
-      - name: default
-        protocol: layer2
-        addresses:
-        - "${METALLB_LB_RANGE}"
+        - name: default
+          protocol: layer2
+          addresses:
+            - "${METALLB_LB_RANGE}"

cluster/core/metallb-system/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- helm-release.yaml
+  - helm-release.yaml

cluster/core/namespaces/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- cert-manager.yaml
-- metallb-system.yaml
-- networking.yaml
+  - cert-manager.yaml
+  - metallb-system.yaml
+  - networking.yaml

cluster/core/system-upgrade/kustomization.yaml

@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: system-upgrade
 resources:
-- https://github.com/rancher/system-upgrade-controller/releases/download/v0.6.2/system-upgrade-controller.yaml
+  - https://github.com/rancher/system-upgrade-controller/releases/download/v0.6.2/system-upgrade-controller.yaml

cluster/crds/cert-manager/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-# renovate: registryUrl=https://charts.jetstack.io chart=cert-manager
-- https://github.com/jetstack/cert-manager/releases/download/v1.4.2/cert-manager.crds.yaml
+  # renovate: registryUrl=https://charts.jetstack.io chart=cert-manager
+  - https://github.com/jetstack/cert-manager/releases/download/v1.4.2/cert-manager.crds.yaml

cluster/crds/kustomization.yaml

@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- cert-manager
+  - cert-manager

tmpl/.sops.yaml

@@ -1,6 +1,6 @@
 ---
 creation_rules:
-- encrypted_regex: '^(data|stringData)$'
-  pgp: >-
-    ${FLUX_KEY_FP},
-    ${PERSONAL_KEY_FP}
+  - encrypted_regex: "^(data|stringData)$"
+    pgp: >-
+      ${FLUX_KEY_FP},
+      ${PERSONAL_KEY_FP}

tmpl/cluster-secrets.sops.yaml

@@ -0,0 +1,9 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cluster-secrets
+  namespace: flux-system
+stringData:
+  SECRET_DOMAIN: ${BOOTSTRAP_DOMAIN}
+  SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL}

tmpl/cluster-secrets.yaml

@@ -1,9 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: cluster-secrets
-    namespace: flux-system
-stringData:
-    SECRET_DOMAIN: ${BOOTSTRAP_DOMAIN}
-    SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL}

tmpl/gotk-sync.yaml

@@ -26,4 +26,4 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sops-gpg
+      name: sops-gpg

tmpl/secret.enc.yaml

@@ -1,8 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: cloudflare-token-secret
-    namespace: cert-manager
-stringData:
-    cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}

tmpl/secret.sops.yaml

@@ -0,0 +1,8 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-token-secret
+  namespace: cert-manager
+stringData:
+  cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}