feat: refactor config file (#1267)

Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-28 12:41:31 -05:00
1 parent e4427a8325
commit 889ca07692
@@ -1,20 +1,22 @@
+#% if flux.enabled %#
 ---
 creation_rules:
-  #% if bootstrap_distribution in ['talos'] %#
+  #% if distribution in ['talos'] %#
  - # IMPORTANT: This rule MUST be above the others
    path_regex: talos/.*\.sops\.ya?ml
    key_groups:
      - age:
-          - "#{ bootstrap_age_public_key }#"
+          - "#{ flux.sops_age_public_key }#"
  #% endif %#
  - path_regex: kubernetes/.*\.sops\.ya?ml
    encrypted_regex: "^(data|stringData)$"
    key_groups:
      - age:
-          - "#{ bootstrap_age_public_key }#"
-  #% if bootstrap_distribution in ['k0s', 'k3s'] %#
+          - "#{ flux.sops_age_public_key }#"
+  #% if distribution in ['k0s', 'k3s'] %#
  - path_regex: ansible/.*\.sops\.ya?ml
    key_groups:
      - age:
-          - "#{ bootstrap_age_public_key }#"
+          - "#{ flux.sops_age_public_key }#"
  #% endif %#
+#% endif %#
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']
+main = lambda data: data.get("distribution") in ['k0s', 'k3s']
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']
+main = lambda data: data.get("distribution") in ['k0s', 'k3s']
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -2,7 +2,7 @@
 k3s_become: true
 k3s_etcd_datastore: true
 k3s_install_hard_links: true
-k3s_registration_address: "#{ bootstrap_kube_api_addr }#"
+k3s_registration_address: "#{ cluster.endpoint_vip }#"
 # renovate: datasource=github-releases depName=k3s-io/k3s
 k3s_release_version: v1.29.0+k3s1
 k3s_server_manifests_templates:
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -1,12 +1,12 @@
 ---
 k3s_control_node: true
 k3s_server:
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-  cluster-cidr: "#{ bootstrap_cluster_cidr.split(',')[0] }#,#{ bootstrap_cluster_cidr.split(',')[1] }#"
-  service-cidr: "#{ bootstrap_service_cidr.split(',')[0] }#,#{ bootstrap_service_cidr.split(',')[1] }#"
+  #% if feature_gates.dual_stack_ipv4_first %#
+  cluster-cidr: "#{ cluster.pod_network.split(',')[0] }#,#{ cluster.pod_network.split(',')[1] }#"
+  service-cidr: "#{ cluster.service_network.split(',')[0] }#,#{ cluster.service_network.split(',')[1] }#"
  #% else %#
-  cluster-cidr: "#{ bootstrap_cluster_cidr }#"
-  service-cidr: "#{ bootstrap_service_cidr }#"
+  cluster-cidr: "#{ cluster.pod_network }#"
+  service-cidr: "#{ cluster.service_network }#"
  #% endif %#
  disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
  disable-cloud-controller: true
@@ -24,7 +24,7 @@ k3s_server:
  kubelet-arg:
    - "image-gc-high-threshold=55"
    - "image-gc-low-threshold=50"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
  #% else %#
  node-ip: "{{ ansible_host }}"
@@ -32,8 +32,8 @@ k3s_server:
  pause-image: registry.k8s.io/pause:3.9
  secrets-encryption: true
  tls-san:
-    - "#{ bootstrap_kube_api_addr }#"
-    #% for item in bootstrap_kube_additional_tls_sans %#
+    - "#{ cluster.endpoint_vip }#"
+    #% for item in cluster.tls_sans %#
    - "{{ item }}"
    #% endfor %#
  write-kubeconfig-mode: "644"
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -4,7 +4,7 @@ k3s_agent:
  kubelet-arg:
    - "image-gc-high-threshold=55"
    - "image-gc-low-threshold=50"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
  #% else %#
  node-ip: "{{ ansible_host }}"
@@ -3,17 +3,21 @@ kubernetes:
  children:
    master:
      hosts:
-      #% for item in bootstrap_nodes.master %#
+        #% for item in cluster.nodes.inventory %#
+        #% if item.controller %#
        "#{ item.name }#":
-          ansible_user: "#{ item.ssh.username }#"
+          ansible_user: "#{ item.ssh_username }#"
          ansible_host: "#{ item.address }#"
-      #% endfor %#
-    #% if bootstrap_nodes.worker|length > 0 %#
+        #% endif %#
+        #% endfor %#
+    #% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %#
    worker:
      hosts:
-      #% for item in bootstrap_nodes.worker %#
+        #% for item in cluster.nodes.inventory %#
+        #% if not item.controller %#
        "#{ item.name }#":
-          ansible_user: "#{ item.ssh.username }#"
+          ansible_user: "#{ item.ssh_username }#"
          ansible_host: "#{ item.address }#"
-      #% endfor %#
+        #% endif %#
+        #% endfor %#
    #% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Cluster Installation
  hosts: kubernetes
@@ -10,7 +10,7 @@
      ansible.builtin.pause:
        seconds: 5
  tasks:
-    #% if bootstrap_distribution in ['k3s'] %#
+    #% if distribution in ['k3s'] %#
    - name: Ensure Kubernetes is running
      ansible.builtin.include_role:
        name: xanmanning.k3s
@@ -21,9 +21,9 @@
    - name: Upgrade kube-vip
      ansible.builtin.template:
        src: templates/kube-vip-ds.yaml.j2
-        #% if bootstrap_distribution in ['k3s'] %#
+        #% if distribution in ['k3s'] %#
        dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml"
-        #% elif bootstrap_distribution in ['k0s'] %#
+        #% elif distribution in ['k0s'] %#
        dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml"
        #% endif %#
        mode: preserve
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Cluster Nuke
  hosts: kubernetes
@@ -98,6 +98,6 @@

    - name: Reboot
      ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
        reboot_timeout: 3600
 #% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Prepare System
  hosts: kubernetes
@@ -16,7 +16,7 @@
      block:
        - name: Locale | Set timezone
          community.general.timezone:
-            name: "#{ bootstrap_timezone }#"
+            name: "#{ timezone }#"

    - name: Packages
      block:
@@ -46,7 +46,6 @@
              ff02::2 ip6-allrouters
            dest: /etc/hosts
            mode: preserve
-        #% if bootstrap_advanced_flags.update_resolv_conf|default(true) %#
        # https://github.com/onedr0p/flux-cluster-template/discussions/635
        - name: Network Configuration | Remove immutable flag from /etc/resolv.conf
          ansible.builtin.file:
@@ -63,9 +62,10 @@
            mode: '0644'
            dest: /etc/resolv.conf
            content: |
-              search .
-              nameserver #{ bootstrap_dns_server }#
-        #% endif %#
+              search #{ cluster.nodes.search_domain|default('.', true) }#
+              #% for item in cluster.nodes.dns_servers %#
+              nameserver #{ item }#
+              #% endfor %#

    - name: System Configuration
      notify: Reboot
@@ -110,6 +110,6 @@
  handlers:
    - name: Reboot
      ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
        reboot_timeout: 3600
 #% endif %#
@@ -11,5 +11,5 @@
  tasks:
    - name: Reboot
      ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
        reboot_timeout: 3600
@@ -12,9 +12,9 @@
        seconds: 5
  tasks:
    - name: Details
-      #% if bootstrap_distribution in ['k3s'] %#
+      #% if distribution in ['k3s'] %#
      ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
-      #% elif bootstrap_distribution in ['k0s'] %#
+      #% elif distribution in ['k0s'] %#
      ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json"
      #% endif %#
      register: kubectl_get_node
@@ -32,9 +32,9 @@
        - name: Cordon
          kubernetes.core.k8s_drain:
            name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution in ['k3s'] %#
+            #% if distribution in ['k3s'] %#
            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
            kubeconfig: /var/lib/k0s/pki/admin.conf
            #% endif %#
            state: cordon
@@ -43,9 +43,9 @@
        - name: Drain
          kubernetes.core.k8s_drain:
            name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution in ['k3s'] %#
+            #% if distribution in ['k3s'] %#
            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
            kubeconfig: /var/lib/k0s/pki/admin.conf
            #% endif %#
            state: drain
@@ -78,9 +78,9 @@
        - name: Uncordon
          kubernetes.core.k8s_drain:
            name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution  in ['k3s'] %#
+            #% if distribution  in ['k3s'] %#
            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
            kubeconfig: /var/lib/k0s/pki/admin.conf
            #% endif %#
            state: uncordon
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -8,7 +8,7 @@ collections:
    version: 8.2.0
  - name: kubernetes.core
    version: 3.0.0
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 roles:
  - name: xanmanning.k3s
    src: https://github.com/PyratLabs/ansible-role-k3s
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -1,23 +0,0 @@
-
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app cert-manager-issuers
-  namespace: flux-system
-spec:
-  targetNamespace: cert-manager
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager
-  path: ./kubernetes/apps/cert-manager/cert-manager-issuers/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -32,8 +32,3 @@ spec:
      nameservers:
        - "1.1.1.1"
        - "9.9.9.9"
-    prometheus:
-      enabled: true
-      servicemonitor:
-        enabled: true
-        prometheusInstance: observability
@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: cert-manager-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"
@@ -18,3 +18,27 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
+#% if cloudflare.enabled %#
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cert-manager-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager
+  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+#% endif %#
@@ -4,4 +4,3 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cert-manager/ks.yaml
-  - ./cert-manager-issuers/ks.yaml
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("github").get("webhook").get("enabled") == True
@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  - ./addons/ks.yaml
+  - ./webhooks/ks.yaml
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -21,3 +22,4 @@ spec:
  tls:
    - hosts:
        - *host
+#% endif %#
@@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
+  #% if cloudflare.enabled %#
  - ./ingress.yaml
+  #% endif %#
  - ./receiver.yaml
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: github-webhook-token-secret
 stringData:
-  token: "#{ bootstrap_flux_github_webhook_token }#"
+  token: "#{ flux.github.webhook.token }#"
@@ -9,7 +9,7 @@ spec:
  commonMetadata:
    labels:
      app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/flux-system/addons/webhooks
+  path: ./kubernetes/apps/flux-system/webhooks/app
  prune: true
  sourceRef:
    kind: GitRepository
@@ -6,7 +6,7 @@ metadata:
  name: policy
 spec:
  loadBalancerIPs: true
-  # NOTE: This might need to be set if you have more than one active NIC on your nodes
+  # NOTE: This might need to be set if you have more than one active NIC on your hosts
  # interfaces:
  #   - ^eno[0-9]+
  nodeSelector:
@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  #% if not bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if not feature_gates.dual_stack_ipv4_first %#
  - ./cilium-l2.yaml
  #% endif %#
  - ./helmrelease.yaml
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['talos']
+main = lambda data: data.get("distribution") in ['talos']
@@ -4,11 +4,11 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cilium/ks.yaml
-  #% if bootstrap_distribution in ['talos'] %#
+  #% if distribution in ['talos'] %#
  - ./kubelet-csr-approver/ks.yaml
  #% endif %#
  - ./metrics-server/ks.yaml
-  #% if bootstrap_distribution in ['k0s', 'talos'] %#
+  #% if distribution in ['k0s', 'talos'] %#
  - ./spegel/ks.yaml
  #% endif %#
  - ./reloader/ks.yaml
@@ -28,7 +28,3 @@ spec:
      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      - --kubelet-use-node-status-port
      - --metric-resolution=15s
-    metrics:
-      enabled: true
-    serviceMonitor:
-      enabled: true
@@ -26,6 +26,3 @@ spec:
    fullnameOverride: reloader
    reloader:
      readOnlyRootFileSystem: true
-      podMonitor:
-        enabled: true
-        namespace: "{{ .Release.Namespace }}"
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'talos']
+main = lambda data: data.get("distribution") in ['k0s', 'talos']
@@ -24,15 +24,13 @@ spec:
    keepHistory: false
  values:
    spegel:
-      #% if bootstrap_distribution in ['k0s'] %#
+      #% if distribution in ['k0s'] %#
      containerdSock: /run/k0s/containerd.sock
      containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
-      #% elif bootstrap_distribution in ['talos'] %#
+      #% elif distribution in ['talos'] %#
      containerdSock: /run/containerd/containerd.sock
      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
      #% endif %#
    service:
      registry:
        hostPort: 29999
-    serviceMonitor:
-      enabled: true
@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app certificates
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager-issuers
-  path: ./kubernetes/apps/network/certificates/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -82,9 +82,6 @@ spec:
        ports:
          http:
            port: *port
-    serviceMonitor:
-      main:
-        enabled: true
    persistence:
      config:
        enabled: true
@@ -4,10 +4,10 @@ kind: Secret
 metadata:
  name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
  credentials.json: |
    {
-      "AccountTag": "#{ bootstrap_cloudflare_account_tag }#",
-      "TunnelSecret": "#{ bootstrap_cloudflare_tunnel_secret }#",
-      "TunnelID": "#{ bootstrap_cloudflare_tunnel_id }#"
+      "AccountTag": "#{ cloudflare.tunnel.account_id }#",
+      "TunnelSecret": "#{ cloudflare.tunnel.secret }#",
+      "TunnelID": "#{ cloudflare.tunnel.id }#"
    }
@@ -10,7 +10,6 @@ spec:
    labels:
      app.kubernetes.io/name: *app
  dependsOn:
-    - name: certificates
    - name: external-dns
  path: ./kubernetes/apps/network/cloudflared/app
  prune: true
@@ -65,8 +65,6 @@ spec:
            port: *port
    ingress:
      main:
-        enabled: false
-      external:
        enabled: true
        className: external
        annotations:
@@ -41,7 +41,5 @@ spec:
    txtPrefix: k8s.
    txtOwnerId: default
    domainFilters: ["${SECRET_DOMAIN}"]
-    serviceMonitor:
-      enabled: true
    podAnnotations:
      secret.reloader.stakater.com/reload: external-dns-secret
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: external-dns-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./staging.yaml
-  #% if bootstrap_acme_production_enabled %#
+  #% if cloudflare.acme.production %#
  - ./production.yaml
  #% endif %#
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-external
+  name: ingress-nginx-external
 spec:
  interval: 30m
  chart:
@@ -26,13 +26,13 @@ spec:
    - name: cloudflared
      namespace: network
  values:
-    fullnameOverride: nginx-external
+    fullnameOverride: ingress-nginx-external
    controller:
      replicaCount: 1
      service:
        annotations:
          external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "#{ bootstrap_external_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: external
@@ -63,14 +63,8 @@ spec:
        proxy-body-size: 0
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
      extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -82,7 +76,7 @@ spec:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-external
+              app.kubernetes.io/instance: ingress-nginx-external
              app.kubernetes.io/component: controller
      resources:
        requests:
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-internal
+  name: ingress-nginx-internal
  namespace: network
 spec:
  interval: 30m
@@ -24,12 +24,12 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    fullnameOverride: nginx-internal
+    fullnameOverride: ingress-nginx-internal
    controller:
      replicaCount: 1
      service:
        annotations:
-          io.cilium/lb-ipam-ips: "#{ bootstrap_internal_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: internal
@@ -60,14 +60,8 @@ spec:
        proxy-body-size: 0
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
      extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -79,7 +73,7 @@ spec:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-internal
+              app.kubernetes.io/instance: ingress-nginx-internal
              app.kubernetes.io/component: controller
      resources:
        requests:
@@ -0,0 +1,66 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-certificates
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/network/ingress-nginx/certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-internal
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/internal
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-external
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/external
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -30,5 +30,5 @@ spec:
      type: LoadBalancer
      port: 53
      annotations:
-        io.cilium/lb-ipam-ips: "#{ bootstrap_k8s_gateway_addr }#"
+        io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#"
      externalTrafficPolicy: Cluster
@@ -3,10 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  - ./certificates/ks.yaml
  - ./cloudflared/ks.yaml
  - ./echo-server/ks.yaml
  - ./external-dns/ks.yaml
+  - ./ingress-nginx/ks.yaml
  - ./k8s-gateway/ks.yaml
-  - ./nginx-external/ks.yaml
-  - ./nginx-internal/ks.yaml
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-external
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-external/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-internal
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-internal/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -6,15 +6,13 @@ metadata:
  namespace: flux-system
 spec:
  interval: 30m
-  ref:
-    branch: "#{ bootstrap_advanced_flags.github_repository_branch|default('main', true) }#"
-  #% if bootstrap_private_github_repo %#
+  url: "#{ flux.github.address }#"
+  #% if flux.github.address.startswith('ssh://') %#
  secretRef:
    name: github-deploy-key
-  url: "ssh://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#"
-  #% else %#
-  url: "https://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#.git"
  #% endif %#
+  ref:
+    branch: "#{ flux.github.branch|default('main', true) }#"
  ignore: |
    # exclude all
    /*
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: backube
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://backube.github.io/helm-charts
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: bitnami
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://registry-1.docker.io/bitnamicharts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: coredns
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://coredns.github.io/helm
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: csi-driver-nfs
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: csi-driver-smb
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: descheduler
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubernetes-sigs.github.io/descheduler
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://kubernetes-sigs.github.io/external-dns
+#% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: grafana
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://grafana.github.io/helm-charts
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://kubernetes.github.io/ingress-nginx
+#% endif %#
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://ori-edge.github.io/k8s_gateway
+#% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: kubernetes-dashboard
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubernetes.github.io/dashboard
@@ -2,26 +2,20 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./backube.yaml
-  - ./bitnami.yaml
  - ./bjw-s.yaml
  - ./cilium.yaml
-  - ./coredns.yaml
-  - ./csi-driver-nfs.yaml
-  - ./csi-driver-smb.yaml
-  - ./descheduler.yaml
+  #% if cloudflare.enabled %#
  - ./external-dns.yaml
-  - ./grafana.yaml
  - ./ingress-nginx.yaml
-  - ./jetstack.yaml
  - ./k8s-gateway.yaml
-  - ./kubernetes-dashboard.yaml
-  - ./longhorn.yaml
+  #% endif %#
+  - ./jetstack.yaml
  - ./metrics-server.yaml
  - ./openebs.yaml
-  - ./piraeus.yaml
+  #% if distribution in ['talos'] %#
  - ./postfinance.yaml
-  - ./prometheus-community.yaml
+  #% endif %#
  - ./stakater.yaml
-  - ./weave-gitops.yaml
+  #% if distribution in ['k0s', 'talos'] %#
  - ./xenitab.yaml
+  #% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: longhorn
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://charts.longhorn.io
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: piraeus
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://piraeus.io/helm-charts
@@ -1,3 +1,4 @@
+#% if distribution in ['talos'] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://postfinance.github.io/kubelet-csr-approver
+#% endif %#
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: prometheus-community
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/prometheus-community/charts
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: weave-gitops
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/weaveworks/charts
@@ -1,3 +1,4 @@
+#% if distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,3 +9,4 @@ spec:
  type: oci
  interval: 5m
  url: oci://ghcr.io/xenitab/helm-charts
+#% endif %#
@@ -5,6 +5,9 @@ metadata:
  name: cluster-secrets
  namespace: flux-system
 stringData:
-  SECRET_DOMAIN: "#{ bootstrap_cloudflare_domain }#"
-  SECRET_ACME_EMAIL: "#{ bootstrap_acme_email }#"
-  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
+  #% if cloudflare.enabled %#
+  SECRET_DOMAIN: "#{ cloudflare.domain }#"
+  SECRET_ACME_EMAIL: "#{ cloudflare.acme.email }#"
+  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
+  #% endif %#
@@ -5,13 +5,9 @@ metadata:
  name: cluster-settings
  namespace: flux-system
 data:
-  TIMEZONE: "#{ bootstrap_timezone }#"
-  COREDNS_ADDR: "#{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }#"
-  KUBE_API_ADDR: "#{ bootstrap_kube_api_addr }#"
-  CLUSTER_CIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
-  SERVICE_CIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
-  NODE_CIDR: "#{ bootstrap_node_cidr }#"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-  CLUSTER_CIDR_V6: "#{ bootstrap_cluster_cidr.split(',')[1] }#"
-  SERVICE_CIDR_V6: "#{ bootstrap_service_cidr.split(',')[1] }#"
+  TIMEZONE: "#{ timezone }#"
+  CLUSTER_CIDR: "#{ cluster.pod_network.split(',')[0] }#"
+  NODE_CIDR: "#{ cluster.nodes.host_network }#"
+  #% if feature_gates.dual_stack_ipv4_first %#
+  CLUSTER_CIDR_V6: "#{ cluster.pod_network.split(',')[1] }#"
  #% endif %#
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s']
+main = lambda data: data.get("distribution") in ['k0s']
@@ -5,14 +5,20 @@ metadata:
  name: home-kubernetes
 spec:
  hosts:
-    #% for item in bootstrap_nodes.master %#
+    #% for item in cluster.nodes.inventory %#
+    #% if item.controller %#
    - role: controller+worker
+    #% else %#
+    - role: worker
+    #% endif %#
      ssh:
        address: "#{ item.address }#"
-        user: "#{ item.ssh.username }#"
+        user: "#{ item.ssh_username }#"
+      #% if item.controller %#
      installFlags:
        - --disable-components=metrics-server
        - --no-taints
+      #% endif %#
      files:
        - name: bootstrap-scripts
          src: scripts
@@ -20,25 +26,9 @@ spec:
        apply:
          before:
            - bash apply-system.sh "#{ item.name }#"
+            #% if item.controller %#
            - bash apply-kube-vip.sh
-        reset:
-          before:
-            - bash reset-cilium.sh
-          after:
-            - bash reset-system.sh
-    #% endfor %#
-    #% for item in bootstrap_nodes.worker %#
-    - role: worker
-      ssh:
-        address: "#{ item.address }#"
-        user: "#{ item.ssh.username }#"
-      files:
-        - name: bootstrap-scripts
-          src: scripts
-      hooks:
-        apply:
-          before:
-            - bash apply-system.sh "#{ item.name }#"
+            #% endif %#
        reset:
          before:
            - bash reset-cilium.sh
@@ -65,23 +55,25 @@ spec:
              listen-metrics-urls: http://0.0.0.0:2381
        api:
          sans:
-            #% if bootstrap_kube_api_addr %#
-            - "#{ bootstrap_kube_api_addr }#"
+            #% if cluster.endpoint_vip %#
+            - "#{ cluster.endpoint_vip }#"
            #% endif %#
-            #% for item in bootstrap_kube_additional_tls_sans %#
+            #% for item in cluster.tls_sans %#
            - "#{ item }#"
            #% endfor %#
-            #% for item in bootstrap_nodes.master %#
+            #% for item in controllers %#
+            #% if item.controller %#
            - "#{ item.address }#"
            - "#{ item.name }#"
+            #% endif %#
            #% endfor %#
        network:
-          podCIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
-          serviceCIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
+          podCIDR: "#{ cluster.pod_network.split(',')[0] }#"
+          serviceCIDR: "#{ cluster.service_network.split(',')[0] }#"
          provider: custom
          kubeProxy:
            disabled: true
-          nodeLocalLoadBalancing:
+          sLocalLoadBalancing:
            enabled: true
            type: EnvoyProxy
        extensions:
@@ -22,7 +22,7 @@ EOF
 fi

 # Timezone
-timedatectl set-timezone "#{ bootstrap_timezone }#"
+timedatectl set-timezone "#{ timezone }#"

 # Install Packages
 apt-get install -y --no-install-recommends \
@@ -31,16 +31,16 @@ apt-get install -y --no-install-recommends \
    nvme-cli open-iscsi parted psmisc python3 python3-apt python3-kubernetes python3-yaml \
    smartmontools socat software-properties-common unzip util-linux

-#% if bootstrap_advanced_flags.update_resolv_conf|default(true) %#
 # Update DNS
 chattr -i /etc/resolv.conf
 rm -f /etc/resolv.conf
 cat >/etc/resolv.conf <<EOF
-search .
-nameserver #{ bootstrap_dns_server }#
+search #{ cluster.nodes.search_domain|default('.', true) }#
+#% for item in cluster.nodes.dns_servers %#
+nameserver #{ item }#
+#% endfor %#
 EOF
 chattr +i /etc/resolv.conf
-#% endif %#

 # Kernel Modules
 for module in br_netfilter ceph ip_vs ip_vs_rr nbd overlay rbd; do
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['talos']
+main = lambda data: data.get("distribution") in ['talos']
@@ -6,15 +6,15 @@ talosVersion: v1.6.3
 kubernetesVersion: v1.29.1

 clusterName: &cluster home-kubernetes
-endpoint: https://#{ bootstrap_kube_api_addr }#:6443
+endpoint: https://#{ cluster.endpoint_vip }#:6443
 clusterPodNets:
-  - "#{ bootstrap_cluster_cidr.split(',')[0] }#"
+  - "#{ cluster.pod_network.split(',')[0] }#"
 clusterSvcNets:
-  - "#{ bootstrap_service_cidr.split(',')[0] }#"
+  - "#{ cluster.service_network.split(',')[0] }#"
 additionalApiServerCertSans: &sans
-  - "#{ bootstrap_kube_api_addr }#"
+  - "#{ cluster.endpoint_vip }#"
  - 127.0.0.1
-  #% for item in bootstrap_kube_additional_tls_sans %#
+  #% for item in cluster.tls_sans %#
  - "#{ item }#"
  #% endfor %#
 additionalMachineCertSans: *sans
@@ -22,47 +22,33 @@ cniConfig:
  name: none

 nodes:
-  #% for item in bootstrap_nodes.master %#
+  #% for item in cluster.nodes.inventory %#
  - hostname: "#{ item.name }#"
    ipAddress: "#{ item.address }#"
-    #% if item.talos.disk_device.startswith('/') %#
-    installDisk: "#{ item.talos.disk_device }#"
+    #% if item.talos_disk_device.startswith('/') %#
+    installDisk: "#{ item.talos_disk_device }#"
    #% else %#
    installDiskSelector:
-      serial: "#{ item.talos.disk_device }#"
+      serial: "#{ item.talos_disk_device }#"
    #% endif %#
+    #% if item.controller %#
    controlPlane: true
-    networkInterfaces:
-      - interface: eth0
-        dhcp: false
-        addresses:
-          - "#{ item.address }#/#{ bootstrap_node_cidr.split('/') | last }#"
-        mtu: 1500
-        routes:
-          - network: 0.0.0.0/0
-            gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
-        vip:
-          ip: "#{ bootstrap_kube_api_addr }#"
-  #% endfor %#
-  #% for item in bootstrap_nodes.worker %#
-  - hostname: "#{ item.name }#"
-    ipAddress: "#{ item.address }#"
-    #% if item.talos.disk_device.startswith('/') %#
-    installDisk: "#{ item.talos.disk_device }#"
    #% else %#
-    installDiskSelector:
-      serial: "#{ item.talos.disk_device }#"
-    #% endif %#
    controlPlane: false
+    #% endif %#
    networkInterfaces:
      - interface: eth0
        dhcp: false
        addresses:
-          - "#{ item.address }#/#{ bootstrap_node_cidr.split('/') | last }#"
+          - "#{ item.address }#/#{ cluster.nodes.host_network.split('/') | last }#"
        mtu: 1500
        routes:
          - network: 0.0.0.0/0
-            gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
+            gateway: "#{ cluster.nodes.host_network | nthhost(1) }#"
+        #% if item.controller %#
+        vip:
+          ip: "#{ cluster.endpoint_vip }#"
+        #% endif %#
  #% endfor %#

 controlPlane:
@@ -106,7 +92,7 @@ controlPlane:
            rotate-server-certificates: true
          nodeIP:
            validSubnets:
-              - "#{ bootstrap_node_cidr }#"
+              - "#{ cluster.nodes.host_network }#"

    # Enable KubePrism
    - &kubePrismPatch |-
@@ -121,7 +107,9 @@ controlPlane:
      machine:
        network:
          nameservers:
-            - "#{ bootstrap_dns_server }#"
+            #% for item in cluster.nodes.dns_servers %#
+            - #{ item }#
+            #% endfor %#

    # Configure NTP
    - &ntpPatch |-
@@ -159,7 +147,7 @@ controlPlane:
          extraArgs:
            listen-metrics-urls: http://0.0.0.0:2381
          advertisedSubnets:
-            - "#{ bootstrap_node_cidr }#"
+            - "#{ cluster.nodes.host_network }#"

    # Disable default API server admission plugins.
    - |-
@@ -8,13 +8,14 @@ cluster:
  id: 1
 containerRuntime:
  integration: containerd
-  #% if bootstrap_distribution in ['k3s'] %#
+  #% if distribution in ['k3s'] %#
  socketPath: /var/run/k3s/containerd/containerd.sock
-  #% elif bootstrap_distribution in ['k0s'] %#
+  #% elif distribution in ['k0s'] %#
  socketPath: /var/run/k0s/containerd.sock
  #% endif %#
 endpointRoutes:
  enabled: true
+#% if cloudflare.enabled %#
 hubble:
  enabled: true
  metrics:
@@ -49,28 +50,32 @@ hubble:
      tls:
        - hosts:
            - "hubble.${SECRET_DOMAIN}"
+#% else %#
+hubble:
+  enabled: false
+#% endif %#
 ipam:
  mode: kubernetes
 ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+#% if feature_gates.dual_stack_ipv4_first %#
 ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
 ipv6:
  enabled: true
 #% endif %#
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 6444
-#% elif bootstrap_distribution in ['k0s'] %#
+#% elif distribution in ['k0s'] %#
 k8sServiceHost: localhost
 k8sServicePort: 7443
-#% elif bootstrap_distribution in ['talos'] %#
+#% elif distribution in ['talos'] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 7445
 #% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
  # https://github.com/cilium/cilium/issues/28985
  enabled: false
  #% else %#
@@ -87,23 +92,6 @@ localRedirectPolicy: true
 operator:
  replicas: 1
  rollOutPods: true
-  prometheus:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-  dashboards:
-    enabled: true
-    annotations:
-      grafana_folder: Cilium
-prometheus:
-  enabled: true
-  serviceMonitor:
-    enabled: true
-    trustCRDsExist: true
-dashboards:
-  enabled: true
-  annotations:
-    grafana_folder: Cilium
 rollOutCiliumPods: true
 routingMode: native
 securityContext:
@@ -8,9 +8,9 @@ cluster:
  id: 1
 containerRuntime:
  integration: containerd
-  #% if bootstrap_distribution in ['k3s'] %#
+  #% if distribution in ['k3s'] %#
  socketPath: /var/run/k3s/containerd/containerd.sock
-  #% elif bootstrap_distribution in ['k0s'] %#
+  #% elif distribution in ['k0s'] %#
  socketPath: /var/run/k0s/containerd.sock
  #% endif %#
 endpointRoutes:
@@ -19,26 +19,26 @@ hubble:
  enabled: false
 ipam:
  mode: kubernetes
-ipv4NativeRoutingCIDR: "#{ bootstrap_cluster_cidr }#"
-#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-ipv6NativeRoutingCIDR: "#{ bootstrap_cluster_cidr_v6 }#"
+ipv4NativeRoutingCIDR: "#{ cluster.pod_network }#"
+#% if feature_gates.dual_stack_ipv4_first %#
+ipv6NativeRoutingCIDR: "#{ cluster.pod_network_v6 }#"
 ipv6:
  enabled: true
 #% endif %#
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 6444
-#% elif bootstrap_distribution in ['k0s'] %#
+#% elif distribution in ['k0s'] %#
 k8sServiceHost: localhost
 k8sServicePort: 7443
-#% elif bootstrap_distribution in ['talos'] %#
+#% elif distribution in ['talos'] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 7445
 #% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
  # https://github.com/cilium/cilium/issues/28985
  enabled: false
  #% else %#
@@ -21,7 +21,7 @@ spec:
          args: ["manager"]
          env:
            - name: address
-              value: "#{ bootstrap_kube_api_addr }#"
+              value: "#{ cluster.endpoint_vip }#"
            - name: vip_arp
              value: "true"
            - name: lb_enable
@@ -1,2 +1,2 @@
-providerRegex: ^(#{ (bootstrap_nodes.master + bootstrap_nodes.worker|default([])) | map(attribute='name') | join('|') }#)$
+providerRegex: ^(#{ (nodes | map(attribute='name') | join('|')) }#)$
 bypassDnsResolution: true
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("flux").get("enabled") == True`
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("cloudflare").get("enabled") == True`