feat: implement mjfilter file for templates (#1244)

* feat: implement mjfilter file for templates

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: use data.get in mjfilters

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

.envrc

@@ -4,6 +4,7 @@ export SOPS_AGE_KEY_FILE="$(expand_path ./age.key)"
 # Venv
 PATH_add "$(expand_path ./.venv/bin)"
 export VIRTUAL_ENV="$(expand_path ./.venv)"
+export PYTHONDONTWRITEBYTECODE="1"
 # Ann Seabelle
 export ANSIBLE_COLLECTIONS_PATH=$(expand_path ./.venv/galaxy)
 export ANSIBLE_ROLES_PATH=$(expand_path ./.venv/galaxy/ansible_roles)

.gitignore

@@ -1,7 +1,3 @@
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
 # Trash
 .DS_Store
 Thumbs.db

Taskfile.yaml

@@ -17,6 +17,8 @@ vars:
   SOPS_AGE_FILE: "{{.ROOT_DIR}}/age.key"
   # Binaries
   PYTHON_BIN: python3
+  # Python
+  PYTHONDONTWRITEBYTECODE: "1"
 
 includes:
   ansible: .taskfiles/Ansible/Taskfile.yaml

bootstrap/scripts/plugin.py

@@ -1,12 +1,18 @@
+import importlib.util
+import sys
+from collections.abc import Callable
+from pathlib import Path
 from typing import Any
-import bcrypt
-import makejinja
-import netaddr
 
+from typing import Any
+from bcrypt import hashpw, gensalt
+from netaddr import IPNetwork
+
+import makejinja
 import validation
 
 def nthhost(value: str, query: int) -> str:
-    value = netaddr.IPNetwork(value)
+    value = IPNetwork(value)
     try:
         nth = int(query)
         if value.size > nth:
@@ -16,11 +22,40 @@ def nthhost(value: str, query: int) -> str:
     return value
 
 def encrypt(value: str) -> str:
-    return bcrypt.hashpw(value.encode(), bcrypt.gensalt(rounds=10)).decode("ascii")
+    return hashpw(value.encode(), gensalt(rounds=10)).decode("ascii")
+
+def import_filter(file: Path) -> Callable[[dict[str, Any]], bool]:
+    module_path = file.relative_to(Path.cwd()).with_suffix("")
+    module_name = str(module_path).replace("/", ".")
+    spec = importlib.util.spec_from_file_location(module_name, file)
+    assert spec is not None
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[module_name] = module
+    assert spec.loader is not None
+    spec.loader.exec_module(module)
+    return module.main
 
 class Plugin(makejinja.plugin.Plugin):
-    def __init__(self, data: dict[str, Any]):
+    def __init__(self, data: dict[str, Any], config: makejinja.config.Config):
+        self._data = data
+        self._config = config
+
+        self._excluded_dirs: set[Path] = set()
+        for input_path in config.inputs:
+            for filter_file in input_path.rglob(".mjfilter.py"):
+                filter_func = import_filter(filter_file)
+                if filter_func(data) is False:
+                    self._excluded_dirs.add(filter_file.parent)
+
         validation.validate(data)
 
     def filters(self) -> makejinja.plugin.Filters:
         return [nthhost, encrypt]
+
+    def path_filters(self):
+        return [self._mjfilter_func]
+
+    def _mjfilter_func(self, path: Path) -> bool:
+        return not any(
+            path.is_relative_to(excluded_dir) for excluded_dir in self._excluded_dirs
+        )

bootstrap/templates/ansible/.ansible-lint.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] %#
 skip_list:
   - yaml[commas]
   - yaml[line-length]
@@ -8,4 +7,3 @@ warn_list:
   - deprecated-command-syntax
   - experimental
   - no-changed-when
-#% endif %#

bootstrap/templates/ansible/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']

bootstrap/templates/ansible/inventory/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']

bootstrap/templates/ansible/inventory/group_vars/kubernetes/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k3s']

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 # https://github.com/PyratLabs/ansible-role-k3s
 # renovate: datasource=github-releases depName=k3s-io/k3s
@@ -13,4 +12,3 @@ k3s_server_manifests_templates:
   - custom-cilium-helmchart.yaml
   - kube-vip-ds.yaml
   - kube-vip-rbac.yaml
-#% endif %#

bootstrap/templates/ansible/inventory/group_vars/master/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k3s']

bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 # https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
 # https://github.com/PyratLabs/ansible-role-k3s
@@ -40,4 +39,3 @@ k3s_server:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
-#% endif %#

bootstrap/templates/ansible/inventory/group_vars/worker/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k3s']

bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 # https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
 # https://github.com/PyratLabs/ansible-role-k3s
@@ -13,4 +12,3 @@ k3s_agent:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
-#% endif %#

bootstrap/templates/ansible/inventory/hosts.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] %#
 ---
 kubernetes:
   children:
@@ -18,4 +17,3 @@ kubernetes:
           ansible_host: "#{ item.address }#"
       #% endfor %#
     #% endif %#
-#% endif %#

bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] %#
 ---
 - name: Cluster kube-vip
   hosts: master
@@ -28,4 +27,3 @@
         dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml"
         #% endif %#
         mode: preserve
-#% endif %#

bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] %#
 ---
 - name: Reboot
   hosts: kubernetes
@@ -14,4 +13,3 @@
       ansible.builtin.reboot:
         msg: Rebooting nodes
         reboot_timeout: 3600
-#% endif %#

bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] %#
 ---
 # https://github.com/kevincoakley/ansible-role-k8s-rolling-update
 - name: Cluster rollout update
@@ -56,8 +55,7 @@
               terminate_grace_period: 600
               wait_timeout: 900
             pod_selectors:
-              # Rook Ceph
+              - app!=rook-ceph-osd # Rook Ceph
-              - app!=rook-ceph-osd
           delegate_to: "{{ groups['master'][0] }}"
 
         - name: Update
@@ -87,4 +85,3 @@
             #% endif %#
             state: uncordon
           delegate_to: "{{ groups['master'][0] }}"
-#% endif %#

bootstrap/templates/ansible/playbooks/tasks/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k3s']

bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 - name: Cilium
   block:
@@ -55,4 +54,3 @@
         definition:
           metadata:
             finalizers: []
-#% endif %#

bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 # https://github.com/k3s-io/k3s/issues/1971
 - name: Cruft
@@ -31,4 +30,3 @@
         namespace: kube-system
         state: absent
       loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}"
-#% endif %#

bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 - name: Get absolute path to this Git repository # noqa: command-instead-of-module
   ansible.builtin.command: git rev-parse --show-toplevel
@@ -25,4 +24,3 @@
     path: "{{ repository_path.stdout }}/kubeconfig"
     regexp: https://127.0.0.1:6443
     replace: "https://{{ k3s_registration_address }}:6443"
-#% endif %#

bootstrap/templates/ansible/playbooks/templates/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k3s']

bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 # https://docs.k3s.io/helm
 apiVersion: helm.cattle.io/v1
@@ -17,4 +16,3 @@ spec:
     #% filter indent(width=4, first=True) %#
     #% include 'partials/cilium-values-init.partial.yaml.j2' %#
     #% endfilter %#
-#% endif %#

bootstrap/templates/ansible/playbooks/templates/kube-vip-ds.yaml.j2

@@ -1,4 +1,2 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 #% include 'partials/kube-vip-ds.partial.yaml.j2' %#
-#% endif %#

bootstrap/templates/ansible/playbooks/templates/kube-vip-rbac.yaml.j2

@@ -1,4 +1,2 @@
-#% if bootstrap_distribution in ['k3s'] %#
 ---
 #% include 'partials/kube-vip-rbac.partial.yaml.j2' %#
-#% endif %#

bootstrap/templates/ansible/requirements.txt.j2

@@ -1,7 +1,5 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] %#
 # Ansible
 ansible-lint==6.22.2
 ansible==9.1.0
 jmespath==1.0.1
 openshift==0.13.2
-#% endif %#

bootstrap/templates/ansible/requirements.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] %#
 ---
 collections:
   - name: ansible.posix
@@ -15,4 +14,3 @@ roles:
     src: https://github.com/PyratLabs/ansible-role-k3s
     version: v3.4.3
 #% endif %#
-#% endif %#

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_discord_template_notifier", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_discord_template_notifier.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -61,4 +60,3 @@ spec:
           - path: /data/config.toml
             subPath: config.toml
             readOnly: true
-#% endif %#

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2

@@ -1,8 +1,6 @@
-#% if addon_discord_template_notifier.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_discord_template_notifier.enabled %#
 ---
 apiVersion: v1
 kind: Secret
@@ -13,4 +12,3 @@ stringData:
     retry_limit = 5
     sink.type = "discord"
     sink.url = "#{ discord_template_notifier.webhook_url }#"
-#% endif %#

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_discord_template_notifier.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/default/homepage/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_homepage", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_homepage.enabled %#
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -76,4 +75,3 @@ data:
           dateStyle: long
           timeStyle: short
           hourCycle: h23
-#% endif %#

bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_homepage.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -86,4 +85,3 @@ spec:
             path: /app/config/widgets.yaml
     serviceAccount:
       create: true
-#% endif %#

bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_homepage.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -6,4 +5,3 @@ resources:
   - ./configmap.yaml
   - ./helmrelease.yaml
   - ./secret.sops.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_homepage.enabled %#
 ---
 apiVersion: v1
 kind: Secret
@@ -10,4 +9,3 @@ stringData:
   HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "#{ bootstrap_cloudflare_token }#"
   HOMEPAGE_VAR_GRAFANA_USERNAME: admin
   HOMEPAGE_VAR_GRAFANA_PASSWORD: "#{ grafana.password }#"
-#% endif %#

bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_homepage.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_weave_gitops", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_weave_gitops.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -55,4 +54,3 @@ spec:
       impersonationResourceNames: ["admin"]
     podAnnotations:
       secret.reloader.stakater.com/reload: cluster-user-auth
-#% endif %#

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2

@@ -1,8 +1,6 @@
-#% if addon_weave_gitops.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_weave_gitops.enabled %#
 ---
 apiVersion: v1
 kind: Secret
@@ -8,4 +7,3 @@ type: Opaque
 stringData:
   username: admin
   password: "#{ addon_weave_gitops.password | encrypt }#"
-#% endif %#

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_weave_gitops.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['talos']

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['talos'] %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -27,4 +26,3 @@ spec:
     #% filter indent(width=4, first=True) %#
     #% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
     #% endfilter %#
-#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/kustomization.yaml.j2

@@ -1,7 +1,5 @@
-#% if bootstrap_distribution in ['talos'] %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['talos'] %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'talos']

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -28,10 +27,12 @@ spec:
       #% if bootstrap_distribution in ['k0s'] %#
       containerdSock: /run/k0s/containerd.sock
       containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
+      #% elif bootstrap_distribution in ['talos'] %#
+      containerdSock: /run/containerd/containerd.sock
+      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
       #% endif %#
     service:
       registry:
         hostPort: 29999
     serviceMonitor:
       enabled: true
-#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/kustomization.yaml.j2

@@ -1,7 +1,5 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/spegel/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/longhorn-system/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s'] and data.get("addon_longhorn", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/longhorn-system/kustomization.yaml.j2

@@ -1,8 +1,6 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] and addon_longhorn.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./longhorn/ks.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/longhorn-system/longhorn/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] and addon_longhorn.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -45,4 +44,3 @@ spec:
       ingressClassName: internal
       host: longhorn.${SECRET_DOMAIN}
       tls: true
-#% endif %#

bootstrap/templates/kubernetes/apps/longhorn-system/longhorn/app/kustomization.yaml.j2

@@ -1,8 +1,6 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] and addon_longhorn.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
   - ./snapshot.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/longhorn-system/longhorn/app/snapshot.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] and addon_longhorn.enabled %#
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
@@ -13,4 +12,3 @@ allowVolumeExpansion: true
 volumeBindingMode: Immediate
 metadata:
   name: longhorn-snapshot
-#% endif %#

bootstrap/templates/kubernetes/apps/longhorn-system/longhorn/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] and addon_longhorn.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/longhorn-system/namespace.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s', 'k3s'] and addon_longhorn.enabled %#
 ---
 apiVersion: v1
 kind: Namespace
@@ -6,4 +5,3 @@ metadata:
   name: longhorn-system
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/grafana/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_grafana", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_grafana.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -180,4 +179,3 @@ spec:
       storageClassName: openebs-hostpath
     testFramework:
       enabled: false
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2

@@ -1,8 +1,6 @@
-#% if addon_grafana.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_grafana.enabled %#
 ---
 apiVersion: v1
 kind: Secret
@@ -7,4 +6,3 @@ metadata:
 stringData:
   admin-user: admin
   admin-password: "#{ grafana.password }#"
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_grafana.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_kube_prometheus_stack", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_kube_prometheus_stack.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -159,4 +158,3 @@ spec:
           multicluster:
             etcd:
               enabled: true
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2

@@ -1,7 +1,5 @@
-#% if addon_kube_prometheus_stack.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_kube_prometheus_stack.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_kubernetes_dashboard", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_kubernetes_dashboard.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -45,4 +44,3 @@ spec:
             - *host
     metricsScraper:
       enabled: true
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2

@@ -1,8 +1,6 @@
-#% if addon_kubernetes_dashboard.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./rbac.yaml
   - ./helmrelease.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_kubernetes_dashboard.enabled %#
 # For dashboard sign in token:
 # kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
 ---
@@ -38,4 +37,3 @@ subjects:
   - kind: ServiceAccount
     name: kubernetes-dashboard
     namespace: observability
-#% endif %#

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_kubernetes_dashboard.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -22,4 +21,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_csi_driver_nfs", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_csi_driver_nfs.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -29,4 +28,3 @@ spec:
     #% if bootstrap_distribution in ['k0s'] %#
     kubeletDir: /var/lib/k0s/kubelet
     #% endif %#
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2

@@ -1,8 +1,8 @@
-#% if addon_csi_driver_nfs.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
+  #% if addon_csi_driver_nfs.storage_class|length > 0 %#
   - ./storageclass.yaml
-#% endif %#
+  #% endif %#

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_csi_driver_nfs.enabled %#
 #% for item in addon_csi_driver_nfs.storage_class %#
 ---
 apiVersion: storage.k8s.io/v1
@@ -13,4 +12,3 @@ reclaimPolicy: Delete
 volumeBindingMode: Immediate
 mountOptions: ["hard", "noatime"]
 #% endfor %#
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_csi_driver_nfs.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_csi_driver_smb", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_csi_driver_smb.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -30,4 +29,3 @@ spec:
       #% else %#
       kubelet: /var/lib/kubelet
       #% endif %#
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/app/kustomization.yaml.j2

@@ -1,11 +1,11 @@
-#% if addon_csi_driver_smb.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
+  #% if addon_csi_driver_smb.storage_class|length > 0 %#
   - ./storageclass.yaml
+  #% endif %#
   #% if addon_csi_driver_smb.create_secrets|default(true) %#
   - ./secrets.sops.yaml
   #% endif %#
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/app/secrets.sops.yaml.j2

@@ -1,4 +1,4 @@
-#% if addon_csi_driver_smb.enabled and addon_csi_driver_smb.create_secrets|default(true) %#
+#% if addon_csi_driver_smb.create_secrets|default(true) %#
 #% for item in addon_csi_driver_smb.storage_class %#
 #% if not item.existing_secret_name %#
 ---

bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/app/storageclass.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_csi_driver_smb.enabled %#
 #% for item in addon_csi_driver_smb.storage_class %#
 ---
 apiVersion: storage.k8s.io/v1
@@ -22,4 +21,3 @@ mountOptions:
   - cache=strict
   - noserverino # required to prevent data corruption
 #% endfor %#
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_csi_driver_smb.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +18,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/volsync/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("addon_volsync", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_volsync.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -40,4 +39,3 @@ spec:
       tag: *tag
     metrics:
       disableAuth: true
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2

@@ -1,8 +1,6 @@
-#% if addon_volsync.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
   - ./prometheusrule.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_volsync.enabled %#
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
@@ -22,4 +21,3 @@ spec:
           for: 15m
           labels:
             severity: critical
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if addon_volsync.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -10,10 +9,6 @@ spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
-  #% if addon_longhorn.enabled %#
-  dependsOn:
-    - name: longhorn
-  #% endif %#
   path: ./kubernetes/apps/storage/volsync/snapshot-controller
   prune: true
   sourceRef:
@@ -43,4 +38,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2

@@ -25,6 +25,11 @@ spec:
       retries: 3
   uninstall:
     keepHistory: false
+  #% if bootstrap_distribution in ['k0s', 'k3s'] and addon_longhorn.enabled %#
+  dependsOn:
+    - name: longhorn
+      namespace: longhorn-system
+  #% endif %#
   values:
     controller:
       #% if bootstrap_distribution in ['k0s', 'k3s'] and addon_longhorn.enabled %#

bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2

@@ -1,7 +1,5 @@
-#% if addon_volsync.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k3s'] and data.get("addon_system_upgrade_controller", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -102,4 +101,3 @@ spec:
         globalMounts:
           - path: /etc/ca-certificates
             readOnly: true
-#% endif %#

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -7,4 +6,3 @@ resources:
   - https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.2/crd.yaml
   - helmrelease.yaml
   - rbac.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -12,4 +11,3 @@ subjects:
   - kind: ServiceAccount
     name: system-upgrade
     namespace: tools
-#% endif %#

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -41,4 +40,3 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-#% endif %#

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
@@ -17,4 +16,3 @@ spec:
     args: ["prepare", "server"]
   upgrade:
     image: rancher/k3s-upgrade
-#% endif %#

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2

@@ -1,8 +1,6 @@
-#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./server.yaml
   - ./agent.yaml
-#% endif %#

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
@@ -22,4 +21,3 @@ spec:
     - {key: CriticalAddonsOnly, operator: Exists}
   upgrade:
     image: rancher/k3s-upgrade
-#% endif %#

bootstrap/templates/kubernetes/k0s/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution") in ['k0s']

bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2

@@ -1,4 +1,3 @@
-#% if bootstrap_distribution in ['k0s'] %#
 ---
 apiVersion: k0sctl.k0sproject.io/v1beta1
 kind: Cluster
@@ -98,4 +97,3 @@ spec:
                   #% filter indent(width=18, first=True) %#
                   #% include 'partials/cilium-values-init.partial.yaml.j2' %#
                   #% endfilter %#
-#% endif %#