feat: refactor config file (#1267)

Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-28 12:41:31 -05:00
1 parent e4427a8325
commit 889ca07692
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -1,23 +0,0 @@
-
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app cert-manager-issuers
-  namespace: flux-system
-spec:
-  targetNamespace: cert-manager
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager
-  path: ./kubernetes/apps/cert-manager/cert-manager-issuers/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -32,8 +32,3 @@ spec:
      nameservers:
        - "1.1.1.1"
        - "9.9.9.9"
-    prometheus:
-      enabled: true
-      servicemonitor:
-        enabled: true
-        prometheusInstance: observability
@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: cert-manager-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"
@@ -18,3 +18,27 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
+#% if cloudflare.enabled %#
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cert-manager-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager
+  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+#% endif %#
@@ -4,4 +4,3 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cert-manager/ks.yaml
-  - ./cert-manager-issuers/ks.yaml
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("github").get("webhook").get("enabled") == True
@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  - ./addons/ks.yaml
+  - ./webhooks/ks.yaml
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -21,3 +22,4 @@ spec:
  tls:
    - hosts:
        - *host
+#% endif %#
@@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
+  #% if cloudflare.enabled %#
  - ./ingress.yaml
+  #% endif %#
  - ./receiver.yaml
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: github-webhook-token-secret
 stringData:
-  token: "#{ bootstrap_flux_github_webhook_token }#"
+  token: "#{ flux.github.webhook.token }#"
@@ -9,7 +9,7 @@ spec:
  commonMetadata:
    labels:
      app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/flux-system/addons/webhooks
+  path: ./kubernetes/apps/flux-system/webhooks/app
  prune: true
  sourceRef:
    kind: GitRepository
@@ -6,7 +6,7 @@ metadata:
  name: policy
 spec:
  loadBalancerIPs: true
-  # NOTE: This might need to be set if you have more than one active NIC on your nodes
+  # NOTE: This might need to be set if you have more than one active NIC on your hosts
  # interfaces:
  #   - ^eno[0-9]+
  nodeSelector:
@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  #% if not bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if not feature_gates.dual_stack_ipv4_first %#
  - ./cilium-l2.yaml
  #% endif %#
  - ./helmrelease.yaml
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['talos']
+main = lambda data: data.get("distribution") in ['talos']
@@ -4,11 +4,11 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cilium/ks.yaml
-  #% if bootstrap_distribution in ['talos'] %#
+  #% if distribution in ['talos'] %#
  - ./kubelet-csr-approver/ks.yaml
  #% endif %#
  - ./metrics-server/ks.yaml
-  #% if bootstrap_distribution in ['k0s', 'talos'] %#
+  #% if distribution in ['k0s', 'talos'] %#
  - ./spegel/ks.yaml
  #% endif %#
  - ./reloader/ks.yaml
@@ -28,7 +28,3 @@ spec:
      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      - --kubelet-use-node-status-port
      - --metric-resolution=15s
-    metrics:
-      enabled: true
-    serviceMonitor:
-      enabled: true
@@ -26,6 +26,3 @@ spec:
    fullnameOverride: reloader
    reloader:
      readOnlyRootFileSystem: true
-      podMonitor:
-        enabled: true
-        namespace: "{{ .Release.Namespace }}"
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'talos']
+main = lambda data: data.get("distribution") in ['k0s', 'talos']
@@ -24,15 +24,13 @@ spec:
    keepHistory: false
  values:
    spegel:
-      #% if bootstrap_distribution in ['k0s'] %#
+      #% if distribution in ['k0s'] %#
      containerdSock: /run/k0s/containerd.sock
      containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
-      #% elif bootstrap_distribution in ['talos'] %#
+      #% elif distribution in ['talos'] %#
      containerdSock: /run/containerd/containerd.sock
      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
      #% endif %#
    service:
      registry:
        hostPort: 29999
-    serviceMonitor:
-      enabled: true
@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app certificates
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager-issuers
-  path: ./kubernetes/apps/network/certificates/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -82,9 +82,6 @@ spec:
        ports:
          http:
            port: *port
-    serviceMonitor:
-      main:
-        enabled: true
    persistence:
      config:
        enabled: true
@@ -4,10 +4,10 @@ kind: Secret
 metadata:
  name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
  credentials.json: |
    {
-      "AccountTag": "#{ bootstrap_cloudflare_account_tag }#",
-      "TunnelSecret": "#{ bootstrap_cloudflare_tunnel_secret }#",
-      "TunnelID": "#{ bootstrap_cloudflare_tunnel_id }#"
+      "AccountTag": "#{ cloudflare.tunnel.account_id }#",
+      "TunnelSecret": "#{ cloudflare.tunnel.secret }#",
+      "TunnelID": "#{ cloudflare.tunnel.id }#"
    }
@@ -10,7 +10,6 @@ spec:
    labels:
      app.kubernetes.io/name: *app
  dependsOn:
-    - name: certificates
    - name: external-dns
  path: ./kubernetes/apps/network/cloudflared/app
  prune: true
@@ -65,8 +65,6 @@ spec:
            port: *port
    ingress:
      main:
-        enabled: false
-      external:
        enabled: true
        className: external
        annotations:
@@ -41,7 +41,5 @@ spec:
    txtPrefix: k8s.
    txtOwnerId: default
    domainFilters: ["${SECRET_DOMAIN}"]
-    serviceMonitor:
-      enabled: true
    podAnnotations:
      secret.reloader.stakater.com/reload: external-dns-secret
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: external-dns-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./staging.yaml
-  #% if bootstrap_acme_production_enabled %#
+  #% if cloudflare.acme.production %#
  - ./production.yaml
  #% endif %#
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-external
+  name: ingress-nginx-external
 spec:
  interval: 30m
  chart:
@@ -26,13 +26,13 @@ spec:
    - name: cloudflared
      namespace: network
  values:
-    fullnameOverride: nginx-external
+    fullnameOverride: ingress-nginx-external
    controller:
      replicaCount: 1
      service:
        annotations:
          external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "#{ bootstrap_external_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: external
@@ -63,14 +63,8 @@ spec:
        proxy-body-size: 0
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
      extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -82,7 +76,7 @@ spec:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-external
+              app.kubernetes.io/instance: ingress-nginx-external
              app.kubernetes.io/component: controller
      resources:
        requests:
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-internal
+  name: ingress-nginx-internal
  namespace: network
 spec:
  interval: 30m
@@ -24,12 +24,12 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    fullnameOverride: nginx-internal
+    fullnameOverride: ingress-nginx-internal
    controller:
      replicaCount: 1
      service:
        annotations:
-          io.cilium/lb-ipam-ips: "#{ bootstrap_internal_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: internal
@@ -60,14 +60,8 @@ spec:
        proxy-body-size: 0
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
      extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -79,7 +73,7 @@ spec:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-internal
+              app.kubernetes.io/instance: ingress-nginx-internal
              app.kubernetes.io/component: controller
      resources:
        requests:
@@ -0,0 +1,66 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-certificates
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/network/ingress-nginx/certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-internal
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/internal
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-external
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/external
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -30,5 +30,5 @@ spec:
      type: LoadBalancer
      port: 53
      annotations:
-        io.cilium/lb-ipam-ips: "#{ bootstrap_k8s_gateway_addr }#"
+        io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#"
      externalTrafficPolicy: Cluster
@@ -3,10 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  - ./certificates/ks.yaml
  - ./cloudflared/ks.yaml
  - ./echo-server/ks.yaml
  - ./external-dns/ks.yaml
+  - ./ingress-nginx/ks.yaml
  - ./k8s-gateway/ks.yaml
-  - ./nginx-external/ks.yaml
-  - ./nginx-internal/ks.yaml
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-external
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-external/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-internal
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-internal/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -6,15 +6,13 @@ metadata:
  namespace: flux-system
 spec:
  interval: 30m
-  ref:
-    branch: "#{ bootstrap_advanced_flags.github_repository_branch|default('main', true) }#"
-  #% if bootstrap_private_github_repo %#
+  url: "#{ flux.github.address }#"
+  #% if flux.github.address.startswith('ssh://') %#
  secretRef:
    name: github-deploy-key
-  url: "ssh://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#"
-  #% else %#
-  url: "https://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#.git"
  #% endif %#
+  ref:
+    branch: "#{ flux.github.branch|default('main', true) }#"
  ignore: |
    # exclude all
    /*
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: backube
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://backube.github.io/helm-charts
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: bitnami
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://registry-1.docker.io/bitnamicharts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: coredns
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://coredns.github.io/helm
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: csi-driver-nfs
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: csi-driver-smb
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: descheduler
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubernetes-sigs.github.io/descheduler
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://kubernetes-sigs.github.io/external-dns
+#% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: grafana
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://grafana.github.io/helm-charts
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://kubernetes.github.io/ingress-nginx
+#% endif %#
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://ori-edge.github.io/k8s_gateway
+#% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: kubernetes-dashboard
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubernetes.github.io/dashboard
@@ -2,26 +2,20 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./backube.yaml
-  - ./bitnami.yaml
  - ./bjw-s.yaml
  - ./cilium.yaml
-  - ./coredns.yaml
-  - ./csi-driver-nfs.yaml
-  - ./csi-driver-smb.yaml
-  - ./descheduler.yaml
+  #% if cloudflare.enabled %#
  - ./external-dns.yaml
-  - ./grafana.yaml
  - ./ingress-nginx.yaml
-  - ./jetstack.yaml
  - ./k8s-gateway.yaml
-  - ./kubernetes-dashboard.yaml
-  - ./longhorn.yaml
+  #% endif %#
+  - ./jetstack.yaml
  - ./metrics-server.yaml
  - ./openebs.yaml
-  - ./piraeus.yaml
+  #% if distribution in ['talos'] %#
  - ./postfinance.yaml
-  - ./prometheus-community.yaml
+  #% endif %#
  - ./stakater.yaml
-  - ./weave-gitops.yaml
+  #% if distribution in ['k0s', 'talos'] %#
  - ./xenitab.yaml
+  #% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: longhorn
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://charts.longhorn.io
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: piraeus
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://piraeus.io/helm-charts
@@ -1,3 +1,4 @@
+#% if distribution in ['talos'] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://postfinance.github.io/kubelet-csr-approver
+#% endif %#
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: prometheus-community
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/prometheus-community/charts
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: weave-gitops
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/weaveworks/charts
@@ -1,3 +1,4 @@
+#% if distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,3 +9,4 @@ spec:
  type: oci
  interval: 5m
  url: oci://ghcr.io/xenitab/helm-charts
+#% endif %#
@@ -5,6 +5,9 @@ metadata:
  name: cluster-secrets
  namespace: flux-system
 stringData:
-  SECRET_DOMAIN: "#{ bootstrap_cloudflare_domain }#"
-  SECRET_ACME_EMAIL: "#{ bootstrap_acme_email }#"
-  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
+  #% if cloudflare.enabled %#
+  SECRET_DOMAIN: "#{ cloudflare.domain }#"
+  SECRET_ACME_EMAIL: "#{ cloudflare.acme.email }#"
+  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
+  #% endif %#
@@ -5,13 +5,9 @@ metadata:
  name: cluster-settings
  namespace: flux-system
 data:
-  TIMEZONE: "#{ bootstrap_timezone }#"
-  COREDNS_ADDR: "#{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }#"
-  KUBE_API_ADDR: "#{ bootstrap_kube_api_addr }#"
-  CLUSTER_CIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
-  SERVICE_CIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
-  NODE_CIDR: "#{ bootstrap_node_cidr }#"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-  CLUSTER_CIDR_V6: "#{ bootstrap_cluster_cidr.split(',')[1] }#"
-  SERVICE_CIDR_V6: "#{ bootstrap_service_cidr.split(',')[1] }#"
+  TIMEZONE: "#{ timezone }#"
+  CLUSTER_CIDR: "#{ cluster.pod_network.split(',')[0] }#"
+  NODE_CIDR: "#{ cluster.nodes.host_network }#"
+  #% if feature_gates.dual_stack_ipv4_first %#
+  CLUSTER_CIDR_V6: "#{ cluster.pod_network.split(',')[1] }#"
  #% endif %#
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s']
+main = lambda data: data.get("distribution") in ['k0s']
@@ -5,14 +5,20 @@ metadata:
  name: home-kubernetes
 spec:
  hosts:
-    #% for item in bootstrap_nodes.master %#
+    #% for item in cluster.nodes.inventory %#
+    #% if item.controller %#
    - role: controller+worker
+    #% else %#
+    - role: worker
+    #% endif %#
      ssh:
        address: "#{ item.address }#"
-        user: "#{ item.ssh.username }#"
+        user: "#{ item.ssh_username }#"
+      #% if item.controller %#
      installFlags:
        - --disable-components=metrics-server
        - --no-taints
+      #% endif %#
      files:
        - name: bootstrap-scripts
          src: scripts
@@ -20,25 +26,9 @@ spec:
        apply:
          before:
            - bash apply-system.sh "#{ item.name }#"
+            #% if item.controller %#
            - bash apply-kube-vip.sh
-        reset:
-          before:
-            - bash reset-cilium.sh
-          after:
-            - bash reset-system.sh
-    #% endfor %#
-    #% for item in bootstrap_nodes.worker %#
-    - role: worker
-      ssh:
-        address: "#{ item.address }#"
-        user: "#{ item.ssh.username }#"
-      files:
-        - name: bootstrap-scripts
-          src: scripts
-      hooks:
-        apply:
-          before:
-            - bash apply-system.sh "#{ item.name }#"
+            #% endif %#
        reset:
          before:
            - bash reset-cilium.sh
@@ -65,23 +55,25 @@ spec:
              listen-metrics-urls: http://0.0.0.0:2381
        api:
          sans:
-            #% if bootstrap_kube_api_addr %#
-            - "#{ bootstrap_kube_api_addr }#"
+            #% if cluster.endpoint_vip %#
+            - "#{ cluster.endpoint_vip }#"
            #% endif %#
-            #% for item in bootstrap_kube_additional_tls_sans %#
+            #% for item in cluster.tls_sans %#
            - "#{ item }#"
            #% endfor %#
-            #% for item in bootstrap_nodes.master %#
+            #% for item in controllers %#
+            #% if item.controller %#
            - "#{ item.address }#"
            - "#{ item.name }#"
+            #% endif %#
            #% endfor %#
        network:
-          podCIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
-          serviceCIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
+          podCIDR: "#{ cluster.pod_network.split(',')[0] }#"
+          serviceCIDR: "#{ cluster.service_network.split(',')[0] }#"
          provider: custom
          kubeProxy:
            disabled: true
-          nodeLocalLoadBalancing:
+          sLocalLoadBalancing:
            enabled: true
            type: EnvoyProxy
        extensions:
@@ -22,7 +22,7 @@ EOF
 fi

 # Timezone
-timedatectl set-timezone "#{ bootstrap_timezone }#"
+timedatectl set-timezone "#{ timezone }#"

 # Install Packages
 apt-get install -y --no-install-recommends \
@@ -31,16 +31,16 @@ apt-get install -y --no-install-recommends \
    nvme-cli open-iscsi parted psmisc python3 python3-apt python3-kubernetes python3-yaml \
    smartmontools socat software-properties-common unzip util-linux

-#% if bootstrap_advanced_flags.update_resolv_conf|default(true) %#
 # Update DNS
 chattr -i /etc/resolv.conf
 rm -f /etc/resolv.conf
 cat >/etc/resolv.conf <<EOF
-search .
-nameserver #{ bootstrap_dns_server }#
+search #{ cluster.nodes.search_domain|default('.', true) }#
+#% for item in cluster.nodes.dns_servers %#
+nameserver #{ item }#
+#% endfor %#
 EOF
 chattr +i /etc/resolv.conf
-#% endif %#

 # Kernel Modules
 for module in br_netfilter ceph ip_vs ip_vs_rr nbd overlay rbd; do
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['talos']
+main = lambda data: data.get("distribution") in ['talos']
@@ -6,15 +6,15 @@ talosVersion: v1.6.3
 kubernetesVersion: v1.29.1

 clusterName: &cluster home-kubernetes
-endpoint: https://#{ bootstrap_kube_api_addr }#:6443
+endpoint: https://#{ cluster.endpoint_vip }#:6443
 clusterPodNets:
-  - "#{ bootstrap_cluster_cidr.split(',')[0] }#"
+  - "#{ cluster.pod_network.split(',')[0] }#"
 clusterSvcNets:
-  - "#{ bootstrap_service_cidr.split(',')[0] }#"
+  - "#{ cluster.service_network.split(',')[0] }#"
 additionalApiServerCertSans: &sans
-  - "#{ bootstrap_kube_api_addr }#"
+  - "#{ cluster.endpoint_vip }#"
  - 127.0.0.1
-  #% for item in bootstrap_kube_additional_tls_sans %#
+  #% for item in cluster.tls_sans %#
  - "#{ item }#"
  #% endfor %#
 additionalMachineCertSans: *sans
@@ -22,47 +22,33 @@ cniConfig:
  name: none

 nodes:
-  #% for item in bootstrap_nodes.master %#
+  #% for item in cluster.nodes.inventory %#
  - hostname: "#{ item.name }#"
    ipAddress: "#{ item.address }#"
-    #% if item.talos.disk_device.startswith('/') %#
-    installDisk: "#{ item.talos.disk_device }#"
+    #% if item.talos_disk_device.startswith('/') %#
+    installDisk: "#{ item.talos_disk_device }#"
    #% else %#
    installDiskSelector:
-      serial: "#{ item.talos.disk_device }#"
+      serial: "#{ item.talos_disk_device }#"
    #% endif %#
+    #% if item.controller %#
    controlPlane: true
-    networkInterfaces:
-      - interface: eth0
-        dhcp: false
-        addresses:
-          - "#{ item.address }#/#{ bootstrap_node_cidr.split('/') | last }#"
-        mtu: 1500
-        routes:
-          - network: 0.0.0.0/0
-            gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
-        vip:
-          ip: "#{ bootstrap_kube_api_addr }#"
-  #% endfor %#
-  #% for item in bootstrap_nodes.worker %#
-  - hostname: "#{ item.name }#"
-    ipAddress: "#{ item.address }#"
-    #% if item.talos.disk_device.startswith('/') %#
-    installDisk: "#{ item.talos.disk_device }#"
    #% else %#
-    installDiskSelector:
-      serial: "#{ item.talos.disk_device }#"
-    #% endif %#
    controlPlane: false
+    #% endif %#
    networkInterfaces:
      - interface: eth0
        dhcp: false
        addresses:
-          - "#{ item.address }#/#{ bootstrap_node_cidr.split('/') | last }#"
+          - "#{ item.address }#/#{ cluster.nodes.host_network.split('/') | last }#"
        mtu: 1500
        routes:
          - network: 0.0.0.0/0
-            gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
+            gateway: "#{ cluster.nodes.host_network | nthhost(1) }#"
+        #% if item.controller %#
+        vip:
+          ip: "#{ cluster.endpoint_vip }#"
+        #% endif %#
  #% endfor %#

 controlPlane:
@@ -106,7 +92,7 @@ controlPlane:
            rotate-server-certificates: true
          nodeIP:
            validSubnets:
-              - "#{ bootstrap_node_cidr }#"
+              - "#{ cluster.nodes.host_network }#"

    # Enable KubePrism
    - &kubePrismPatch |-
@@ -121,7 +107,9 @@ controlPlane:
      machine:
        network:
          nameservers:
-            - "#{ bootstrap_dns_server }#"
+            #% for item in cluster.nodes.dns_servers %#
+            - #{ item }#
+            #% endfor %#

    # Configure NTP
    - &ntpPatch |-
@@ -159,7 +147,7 @@ controlPlane:
          extraArgs:
            listen-metrics-urls: http://0.0.0.0:2381
          advertisedSubnets:
-            - "#{ bootstrap_node_cidr }#"
+            - "#{ cluster.nodes.host_network }#"

    # Disable default API server admission plugins.
    - |-
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("flux").get("enabled") == True`
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("cloudflare").get("enabled") == True`