feat: add go-task, set up prettier, format yaml (#50)

2021-08-03 09:13:56 -04:00
1 parent 99370f6d8d
commit 525be88214
@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
- name: Discuss on Discord
+  - name: Discuss on Discord
-  url: https://discord.com/invite/sTMX7Vh
+    url: https://discord.com/invite/sTMX7Vh
-  about: Join our Discord community
+    about: Join our Discord community
@@ -0,0 +1,23 @@
 ---
 default: true
 # MD013/line-length - Line length
 MD013:
  # Number of characters
  line_length: 240
  # Number of characters for headings
  heading_line_length: 80
  # Number of characters for code blocks
  code_block_line_length: 80
  # Include code blocks
  code_blocks: true
  # Include tables
  tables: true
  # Include headings
  headings: true
  # Include headings
  headers: true
  # Strict length checking
  strict: false
  # Stern length checking
  stern: false
@@ -0,0 +1,2 @@
 *.sops.yaml
 gotk-components.yaml
@@ -0,0 +1,5 @@
 ---
 trailingComma: "es5"
 tabWidth: 2
 semi: false
 singleQuote: false
@@ -1,10 +1,10 @@
 ignore: |
-  .github/
+  *.sops.yaml
-  crds.yaml
+  gotk-components.yaml
 extends: default
 rules:
  truthy:
-    allowed-values: ['true', 'false', 'on', 'yes']
+    allowed-values: ["true", "false", "on"]
  comments:
    min-spaces-from-content: 1
  line-length: disable
@@ -14,6 +14,4 @@ rules:
  brackets:
    min-spaces-inside: 0
    max-spaces-inside: 0
-  indentation:
+  indentation: enable
    spaces: 2
    indent-sequences: consistent
@@ -1,44 +1,43 @@
 ---
 name: Schedule - Update Flux
 on: # yamllint disable-line rule:truthy
  workflow_dispatch:
  schedule:
-  - cron: '0 12 * * *'
+    - cron: "0 12 * * *"
 jobs:
  flux-upgrade:
    runs-on: ubuntu-20.04
    steps:
-    - uses: actions/checkout@v2
+      - uses: actions/checkout@v2
-      with:
+        with:
-        fetch-depth: 1
+          fetch-depth: 1
-    - name: Setup Flux CLI
+      - name: Setup Flux CLI
-      uses: fluxcd/flux2/action@main
+        uses: fluxcd/flux2/action@main
-    - name: Upgrade Flux
+      - name: Upgrade Flux
-      id: upgrade
+        id: upgrade
-      run: |
+        run: |
-        CLI_VERSION="$(flux -v)"
+          CLI_VERSION="$(flux -v)"
-        VERSION="v${CLI_VERSION#*flux version }"
+          VERSION="v${CLI_VERSION#*flux version }"
-        flux install --version="${VERSION}" \
+          flux install --version="${VERSION}" \
-          --network-policy=false \
+            --network-policy=false \
-          --export > ./cluster/base/flux-system/gotk-components.yaml
+            --export > ./cluster/base/flux-system/gotk-components.yaml
-        echo "::set-output name=flux_version::$VERSION"
+          echo "::set-output name=flux_version::$VERSION"
-    - name: Create pull request for Flux upgrade
+      - name: Create pull request for Flux upgrade
-      uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v3
-      with:
+        with:
-        token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
-        branch: "flux/upgrade-${{ steps.upgrade.outputs.flux_version }}"
+          branch: "flux/upgrade-${{ steps.upgrade.outputs.flux_version }}"
-        delete-branch: true
+          delete-branch: true
-        title: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}"
+          title: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}"
-        signoff: false
+          signoff: false
-        committer: GitHub <noreply@github.com>
+          committer: GitHub <noreply@github.com>
-        author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
-        commit-message: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}"
+          commit-message: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}"
-        body: |
+          body: |
-          Release notes: https://github.com/fluxcd/flux2/releases/tag/${{ steps.upgrade.outputs.flux_version }}
+            Release notes: https://github.com/fluxcd/flux2/releases/tag/${{ steps.upgrade.outputs.flux_version }}
-        labels: flux/upgrade
+          labels: flux/upgrade
@@ -1,24 +1,23 @@
 ---
 name: Invalid Template
 on:
  issues:
    types:
-    - labeled
+      - labeled
-    - unlabeled
+      - unlabeled
-    - reopened
+      - reopened
 jobs:
  support:
    runs-on: ubuntu-20.04
    steps:
-    - uses: dessant/support-requests@v2
+      - uses: dessant/support-requests@v2
-      with:
+        with:
-        github-token: ${{ github.token }}
+          github-token: ${{ github.token }}
-        support-label: 'template-incomplete'
+          support-label: "template-incomplete"
-        issue-comment: >
+          issue-comment: >
-          :wave: @{issue-author}, please follow the template provided.
+            :wave: @{issue-author}, please follow the template provided.
-        close-issue: true
+          close-issue: true
-        lock-issue: true
+          lock-issue: true
-        issue-lock-reason: 'resolved'
+          issue-lock-reason: "resolved"
@@ -1,19 +1,32 @@
 ---
 name: Lint
 on: # yamllint disable-line rule:truthy
  workflow_dispatch:
  pull_request:
 jobs:
-  yaml:
+  yamllint:
    runs-on: ubuntu-20.04
    steps:
-    - uses: actions/checkout@v2
+      - uses: actions/checkout@v2
-    - name: yamllint
+      - name: yamllint
-      uses: reviewdog/action-yamllint@v1
+        uses: reviewdog/action-yamllint@v1
-      with:
+        with:
-        github_token: ${{ secrets.github_token }}
+          yamllint_flags: "-c .github/lint/.yamllint.yaml ./cluster"
-        reporter: github-pr-review
+  shellcheck:
-        yamllint_flags: '-c .github/yamllint.config.yaml ./cluster/'
+    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v2
      - name: shellcheck
        uses: reviewdog/action-shellcheck@v1
        with:
          path: "./hack"
          level: "error"
  markdownlint:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v2
      - name: markdownlint
        uses: reviewdog/action-markdownlint@v0.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -1,38 +1,36 @@
 ---
 name: Schedule - Renovate Helm Releases
 on: # yamllint disable-line rule:truthy
  workflow_dispatch:
  schedule:
-  - cron: '0 */12 * * *'
+    - cron: "0 */12 * * *"
 jobs:
  renovate-helm-releases:
    runs-on: ubuntu-20.04
    steps:
-    - uses: actions/checkout@v2
+      - uses: actions/checkout@v2
-      with:
+        with:
-        token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
-        fetch-depth: 1
+          fetch-depth: 1
-    - name: Renovate Helm Releases
+      - name: Renovate Helm Releases
-      uses: k8s-at-home/renovate-helm-releases@v1
+        uses: k8s-at-home/renovate-helm-releases@v1
-      with:
+        with:
-        cluster-path: "./cluster"
+          cluster-path: "./cluster"
-    - name: Create pull request for renovatebot helm-release annotations
+      - name: Create pull request for renovatebot helm-release annotations
-      uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v3
-      with:
+        with:
-        token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
-        branch: renovate-annotations
+          branch: renovate-annotations
-        delete-branch: true
+          delete-branch: true
-        title: "chore(deps): update renovate annotations"
+          title: "chore(deps): update renovate annotations"
-        signoff: false
+          signoff: false
-        committer: GitHub <noreply@github.com>
+          committer: GitHub <noreply@github.com>
-        author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
-        commit-message: "chore(deps): update renovate annotations"
+          commit-message: "chore(deps): update renovate annotations"
-        body: |
+          body: |
-          Update HelmReleases inorder for Renovate to pick up new versions of Helm charts
+            Update HelmReleases inorder for Renovate to pick up new versions of Helm charts
-        labels: renovate/annotations
+          labels: renovate/annotations
@@ -1,28 +1,27 @@
 ---
-
+name: "Support requests"
 name: 'Support requests'
 on:
  issues:
    types:
-    - labeled
+      - labeled
-    - unlabeled
+      - unlabeled
-    - reopened
+      - reopened
 jobs:
  support:
    runs-on: ubuntu-20.04
    steps:
-    - uses: dessant/support-requests@v2
+      - uses: dessant/support-requests@v2
-      with:
+        with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
-        support-label: 'support'
+          support-label: "support"
-        issue-comment: >
+          issue-comment: >
-          :wave: @{issue-author}, we use the issue tracker exclusively
+            :wave: @{issue-author}, we use the issue tracker exclusively
-          for bug reports and feature requests. However, this issue appears
+            for bug reports and feature requests. However, this issue appears
-          to be a support request. Please use our support channels
+            to be a support request. Please use our support channels
-          to get help with.
+            to get help with.
-          - [Discord](https://discord.gg/sTMX7Vh)
+            - [Discord](https://discord.gg/sTMX7Vh)
-        close-issue: true
+          close-issue: true
-        lock-issue: false
+          lock-issue: false
-        issue-lock-reason: 'off-topic'
+          issue-lock-reason: "off-topic"
@@ -1,28 +1,29 @@
 ---
 fail_fast: false
 repos:
- repo: https://github.com/adrienverge/yamllint
+  - repo: https://github.com/adrienverge/yamllint
-  rev: v1.26.2
+    rev: v1.26.2
-  hooks:
+    hooks:
-  - args:
+      - args:
-    - -c
+          - --config-file
-    - .github/yamllint.config.yaml
+          - .github/lint/.yamllint.yaml
-    id: yamllint
+        id: yamllint
- repo: https://github.com/pre-commit/pre-commit-hooks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.0.1
+    rev: v4.0.1
-  hooks:
+    hooks:
-  - id: trailing-whitespace
+      - id: trailing-whitespace
-  - id: end-of-file-fixer
+      - id: end-of-file-fixer
-  - id: mixed-line-ending
+      - id: mixed-line-ending
- repo: https://github.com/Lucas-C/pre-commit-hooks
+  - repo: https://github.com/Lucas-C/pre-commit-hooks
-  rev: v1.1.10
+    rev: v1.1.10
-  hooks:
+    hooks:
-  - id: remove-crlf
+      - id: remove-crlf
-  - id: remove-tabs
+      - id: remove-tabs
- repo: https://github.com/sirosen/fix-smartquotes
+  - repo: https://github.com/sirosen/fix-smartquotes
-  rev: 0.2.0
+    rev: 0.2.0
-  hooks:
+    hooks:
-  - id: fix-smartquotes
+      - id: fix-smartquotes
- repo: https://github.com/k8s-at-home/sops-pre-commit
+  - repo: https://github.com/k8s-at-home/sops-pre-commit
-  rev: v2.0.3
+    rev: v2.0.3
-  hooks:
+    hooks:
-  - id: forbid-secrets
+      - id: forbid-secrets
@@ -0,0 +1,9 @@
 ---
 version: "3"
 tasks:
  sync:
    desc: Sync flux-system with the Git Repository
    cmds:
      - flux reconcile source git flux-system
    silent: true
@@ -0,0 +1,33 @@
 ---
 version: "3"
 tasks:
  all:
    - task: markdown
    - task: yaml
  markdown:
    desc: Format Markdown
    cmds:
      - >-
        prettier
        --ignore-path '.github/lint/.prettierignore'
        --config '.github/lint/.prettierrc.yaml'
        --list-different
        --ignore-unknown
        --parser=markdown
        --write '*.md' '**/*.md'
    ignore_error: true
  yaml:
    desc: Format YAML
    cmds:
      - >-
        prettier
        --ignore-path '.github/lint/.prettierignore'
        --config
        '.github/lint/.prettierrc.yaml'
        --list-different
        --ignore-unknown
        --parser=yaml
        --write '*.y*ml'
        '**/*.y*ml'
    ignore_error: true
@@ -0,0 +1,26 @@
 ---
 version: "3"
 tasks:
  all:
    - task: markdown
    - task: yaml
    - task: format
  markdown:
    desc: Lint Markdown
    cmds:
      - markdownlint -c '.github/lint/.markdownlint.yaml' *.md **/*.md
    ignore_errors: true
  yaml:
    desc: Lint YAML
    cmds:
      - yamllint -c '.github/lint/.yamllint.yaml' .
    ignore_errors: true
  format:
    desc: Lint general formatting
    cmds:
      - prettier --ignore-path '.github/lint/.prettierignore' --config '.github/lint/.prettierrc.yaml' --check .
    ignore_errors: true
@@ -0,0 +1,12 @@
 ---
 version: "3"
 tasks:
  init:
    desc: Initialize pre-commit hooks
    cmds:
      - pre-commit install-hooks
  run:
    desc: Run pre-commit
    cmds:
      - pre-commit run --all-files
@@ -50,6 +50,8 @@ Already provisioned Bare metal or VMs with any modern operating system like Ubun
 | [pre-commit](https://github.com/pre-commit/pre-commit)             | Runs checks during `git commit`                                     |    `2.12.0`     |    ❌     |
 | [kustomize](https://kustomize.io/)                                 | Template-free way to customize application configuration            |     `4.1.0`     |    ❌     |
 | [helm](https://helm.sh/)                                           | Manage Kubernetes applications                                      |     `3.5.4`     |    ❌     |
 | [go-task](https://github.com/go-task/task)                         | A task runner / simpler Make alternative written in Go              |     `3.7.0`     |    ❌     |
 | [prettier](https://github.com/prettier/prettier)                   | Prettier is an opinionated code formatter.                          |     `2.3.2`     |    ❌     |
 ### :warning:&nbsp; pre-commit
@@ -252,23 +254,23 @@ export BOOTSTRAP_INGRESS_NGINX_LB="169.254.1.10"
 ```sh
 envsubst < ./tmpl/.sops.yaml > ./.sops.yaml
-envsubst < ./tmpl/cluster-secrets.yaml > ./cluster/base/cluster-secrets.yaml
+envsubst < ./tmpl/cluster-secrets.sops.yaml > ./cluster/base/cluster-secrets.sops.yaml
 envsubst < ./tmpl/cluster-settings.yaml > ./cluster/base/cluster-settings.yaml
 envsubst < ./tmpl/gotk-sync.yaml > ./cluster/base/flux-system/gotk-sync.yaml
-envsubst < ./tmpl/secret.enc.yaml > ./cluster/core/cert-manager/secret.enc.yaml
+envsubst < ./tmpl/secret.sops.yaml > ./cluster/core/cert-manager/secret.sops.yaml
 ```
 6. **Verify** all the above files have the correct information present
-7. Encrypt `cluster/cluster-secrets.yaml` and `cert-manager/secret.enc.yaml` with SOPS
+7. Encrypt `cluster/cluster-secrets.sops.yaml` and `cert-manager/secret.sops.yaml` with SOPS
 ```sh
 export GPG_TTY=$(tty)
-sops --encrypt --in-place ./cluster/base/cluster-secrets.yaml
+sops --encrypt --in-place ./cluster/base/cluster-secrets.sops.yaml
-sops --encrypt --in-place ./cluster/core/cert-manager/secret.enc.yaml
+sops --encrypt --in-place ./cluster/core/cert-manager/secret.sops.yaml
 ```
-:round_pushpin: Variables defined in `cluster-secrets.yaml` and `cluster-settings.yaml` will be usable anywhere in your YAML manifests under `./cluster`
+:round_pushpin: Variables defined in `cluster-secrets.sops.yaml` and `cluster-settings.sops.yaml` will be usable anywhere in your YAML manifests under `./cluster`
 8. **Verify** all the above files are **encrypted** with SOPS
@@ -0,0 +1,16 @@
 ---
 version: "3"
 vars:
  PROJECT_DIR:
    sh: "git rev-parse --show-toplevel"
  CLUSTER_DIR: "{{.PROJECT_DIR}}/cluster"
 env:
  KUBECONFIG: "{{.PROJECT_DIR}}/kubeconfig"
 includes:
  flux: .taskfiles/flux.yml
  format: .taskfiles/format.yml
  lint: .taskfiles/lint.yml
  pre-commit: .taskfiles/pre-commit.yml
@@ -5,7 +5,7 @@ metadata:
  name: homer-config
 spec:
  accessModes:
-  - ReadWriteOnce
+    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
@@ -26,13 +26,13 @@ spec:
        annotations:
          kubernetes.io/ingress.class: "nginx"
        hosts:
-        - host: "homer.${SECRET_DOMAIN}"
+          - host: "homer.${SECRET_DOMAIN}"
-          paths:
+            paths:
-          - path: /
+              - path: /
-            pathType: Prefix
+                pathType: Prefix
        tls:
-        - hosts:
+          - hosts:
-          - "homer.${SECRET_DOMAIN}"
+              - "homer.${SECRET_DOMAIN}"
    persistence:
      config:
        enabled: true
@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- config-pvc.yaml
+  - config-pvc.yaml
- helm-release.yaml
+  - helm-release.yaml
@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- homer
+  - homer
@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- default
+  - default
- networking
+  - networking
- system-upgrade
+  - system-upgrade
@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- helm-release.yaml
+  - helm-release.yaml
@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- ingress-nginx
+  - ingress-nginx
- wildcard-certificate
+  - wildcard-certificate
@@ -11,5 +11,5 @@ spec:
    kind: ClusterIssuer
  commonName: "${SECRET_DOMAIN}"
  dnsNames:
-  - "${SECRET_DOMAIN}"
+    - "${SECRET_DOMAIN}"
-  - "*.${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"
@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- certificate.yaml
+  - certificate.yaml
@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- system-upgrade-controller
+  - system-upgrade-controller
@@ -12,14 +12,14 @@ spec:
  channel: https://update.k3s.io/v1-release/channels/v1.20
  nodeSelector:
    matchExpressions:
-    - key: node-role.kubernetes.io/master
+      - key: node-role.kubernetes.io/master
-      operator: NotIn
+        operator: NotIn
-      values:
+        values:
-      - "true"
+          - "true"
  prepare:
    image: rancher/k3s-upgrade
    args:
-    - "prepare"
+      - "prepare"
-    - "k3s-server"
+      - "k3s-server"
  upgrade:
    image: rancher/k3s-upgrade
@@ -2,5 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- server-plan.yaml
+  - server-plan.yaml
- agent-plan.yaml
+  - agent-plan.yaml
@@ -11,12 +11,12 @@ spec:
  cordon: true
  nodeSelector:
    matchExpressions:
-    - key: node-role.kubernetes.io/master
+      - key: node-role.kubernetes.io/master
-      operator: In
+        operator: In
-      values:
+        values:
-      - "true"
+          - "true"
  tolerations:
-  - key: "node-role.kubernetes.io/master"
+    - key: "node-role.kubernetes.io/master"
-    operator: "Exists"
+      operator: "Exists"
  upgrade:
    image: rancher/k3s-upgrade
@@ -7,7 +7,7 @@ metadata:
 spec:
  interval: 10m0s
  dependsOn:
-  - name: core
+    - name: core
  path: ./cluster/apps
  prune: true
  sourceRef:
@@ -20,7 +20,7 @@ spec:
  postBuild:
    substitute: {}
    substituteFrom:
-    - kind: ConfigMap
+      - kind: ConfigMap
-      name: cluster-settings
+        name: cluster-settings
-    - kind: Secret
+      - kind: Secret
-      name: cluster-secrets
+        name: cluster-secrets
@@ -7,7 +7,7 @@ metadata:
 spec:
  interval: 10m0s
  dependsOn:
-  - name: crds
+    - name: crds
  path: ./cluster/core
  prune: false
  sourceRef:
@@ -20,7 +20,7 @@ spec:
  postBuild:
    substitute: {}
    substituteFrom:
-    - kind: ConfigMap
+      - kind: ConfigMap
-      name: cluster-settings
+        name: cluster-settings
-    - kind: Secret
+      - kind: Secret
-      name: cluster-secrets
+        name: cluster-secrets
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- bitnami-charts.yaml
+  - bitnami-charts.yaml
- ingress-nginx-charts.yaml
+  - ingress-nginx-charts.yaml
- jetstack-charts.yaml
+  - jetstack-charts.yaml
- k8s-at-home-charts.yaml
+  - k8s-at-home-charts.yaml
- metallb-charts.yaml
+  - metallb-charts.yaml
@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- helm
+  - helm
@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- gotk-components.yaml
+  - gotk-components.yaml
- gotk-sync.yaml
+  - gotk-sync.yaml
- charts
+  - charts
@@ -20,12 +20,12 @@ spec:
    webhook:
      enabled: true
    extraArgs:
-    - --dns01-recursive-nameservers=1.1.1.1:53
+      - --dns01-recursive-nameservers=1.1.1.1:53
-    - --dns01-recursive-nameservers-only
+      - --dns01-recursive-nameservers-only
    cainjector:
      replicaCount: 1
    podDnsPolicy: "None"
    podDnsConfig:
      nameservers:
-      - "1.1.1.1"
+        - "1.1.1.1"
-      - "8.8.8.8"
+        - "8.8.8.8"
@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- helm-release.yaml
+  - helm-release.yaml
- letsencrypt-production.yaml
+  - letsencrypt-production.yaml
- letsencrypt-staging.yaml
+  - letsencrypt-staging.yaml
- secret.enc.yaml
+  - secret.enc.yaml
@@ -10,9 +10,9 @@ spec:
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
-    - dns01:
+      - dns01:
-        cloudflare:
+          cloudflare:
-          email: "${SECRET_CLOUDFLARE_EMAIL}"
+            email: "${SECRET_CLOUDFLARE_EMAIL}"
-          apiTokenSecretRef:
+            apiTokenSecretRef:
-            name: cloudflare-token-secret
+              name: cloudflare-token-secret
-            key: cloudflare-token
+              key: cloudflare-token
@@ -10,9 +10,9 @@ spec:
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
-    - dns01:
+      - dns01:
-        cloudflare:
+          cloudflare:
-          email: "${SECRET_CLOUDFLARE_EMAIL}"
+            email: "${SECRET_CLOUDFLARE_EMAIL}"
-          apiTokenSecretRef:
+            apiTokenSecretRef:
-            name: cloudflare-token-secret
+              name: cloudflare-token-secret
-            key: cloudflare-token
+              key: cloudflare-token
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-    name: cloudflare-token-secret
+  name: cloudflare-token-secret
-    namespace: cert-manager
+  namespace: cert-manager
 stringData:
-    cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}
+  cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}
@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- namespaces
+  - namespaces
- metallb-system
+  - metallb-system
- cert-manager
+  - cert-manager
- system-upgrade
+  - system-upgrade
@@ -18,7 +18,7 @@ spec:
  values:
    configInline:
      address-pools:
-      - name: default
+        - name: default
-        protocol: layer2
+          protocol: layer2
-        addresses:
+          addresses:
-        - "${METALLB_LB_RANGE}"
+            - "${METALLB_LB_RANGE}"
@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- helm-release.yaml
+  - helm-release.yaml
@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- cert-manager.yaml
+  - cert-manager.yaml
- metallb-system.yaml
+  - metallb-system.yaml
- networking.yaml
+  - networking.yaml
@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: system-upgrade
 resources:
- https://github.com/rancher/system-upgrade-controller/releases/download/v0.6.2/system-upgrade-controller.yaml
+  - https://github.com/rancher/system-upgrade-controller/releases/download/v0.6.2/system-upgrade-controller.yaml
@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-# renovate: registryUrl=https://charts.jetstack.io chart=cert-manager
+  # renovate: registryUrl=https://charts.jetstack.io chart=cert-manager
- https://github.com/jetstack/cert-manager/releases/download/v1.4.2/cert-manager.crds.yaml
+  - https://github.com/jetstack/cert-manager/releases/download/v1.4.2/cert-manager.crds.yaml
@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- cert-manager
+  - cert-manager
@@ -1,6 +1,6 @@
 ---
 creation_rules:
- encrypted_regex: '^(data|stringData)$'
+  - encrypted_regex: "^(data|stringData)$"
-  pgp: >-
+    pgp: >-
-    ${FLUX_KEY_FP},
+      ${FLUX_KEY_FP},
-    ${PERSONAL_KEY_FP}
+      ${PERSONAL_KEY_FP}
@@ -0,0 +1,9 @@
 # yamllint disable
 apiVersion: v1
 kind: Secret
 metadata:
  name: cluster-secrets
  namespace: flux-system
 stringData:
  SECRET_DOMAIN: ${BOOTSTRAP_DOMAIN}
  SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL}
@@ -1,9 +0,0 @@
 # yamllint disable
 apiVersion: v1
 kind: Secret
 metadata:
    name: cluster-secrets
    namespace: flux-system
 stringData:
    SECRET_DOMAIN: ${BOOTSTRAP_DOMAIN}
    SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL}
@@ -1,8 +0,0 @@
 # yamllint disable
 apiVersion: v1
 kind: Secret
 metadata:
    name: cloudflare-token-secret
    namespace: cert-manager
 stringData:
    cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}
@@ -0,0 +1,8 @@
 # yamllint disable
 apiVersion: v1
 kind: Secret
 metadata:
  name: cloudflare-token-secret
  namespace: cert-manager
 stringData:
  cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}