feat: refactor config file (#1267)

Signed-off-by: Devin Buhl <devin@buhl.casa>

.github/tests/config-k0s.yaml

@@ -1,52 +1,50 @@
 ---
 skip_tests: true
 
-bootstrap_distribution: k0s
+distribution: k0s
-bootstrap_github_username: onedr0p
+timezone: Etc/UTC
-bootstrap_github_repository_name: flux-cluster-template
+
-bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+cluster:
-bootstrap_timezone: Etc/UTC
+  nodes:
-bootstrap_acme_email: fake@example.com
+    host_network: 10.10.10.0/24
-bootstrap_acme_production_enabled: false
+    dns_servers: ["1.1.1.1"]
-bootstrap_flux_github_webhook_token: fake
+    search_domain: "fake"
-bootstrap_cloudflare_domain: fake
+    inventory:
-bootstrap_cloudflare_token: fake
+      - name: k8s-controller-0
-bootstrap_cloudflare_account_tag: fake
-bootstrap_cloudflare_tunnel_secret: fake
-bootstrap_cloudflare_tunnel_id: fake
-bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kube_api_addr: 10.10.10.254
-bootstrap_kube_additional_tls_sans: ["fake"]
-bootstrap_k8s_gateway_addr: 10.10.10.253
-bootstrap_external_ingress_addr: 10.10.10.252
-bootstrap_internal_ingress_addr: 10.10.10.251
-bootstrap_dns_server: 1.1.1.1
-bootstrap_cluster_cidr: 10.42.0.0/16
-bootstrap_service_cidr: 10.43.0.0/16
-bootstrap_nodes:
-  master:
-    - name: k8s-0
         address: 10.10.10.100
-      ssh:
+        controller: true
-        username: fake
+        ssh_username: fake
-    - name: k8s-1
+      - name: k8s-worker-0
         address: 10.10.10.101
-      ssh:
+        controller: false
-        username: fake
+        ssh_username: fake
-    - name: k8s-2
+  pod_network: 10.69.0.0/16
-      address: 10.10.10.102
+  service_network: 10.96.0.0/16
-      ssh:
+  endpoint_vip: 10.10.10.254
-        username: fake
+  tls_sans: ["fake"]
-  worker:
+
-    - name: k8s-3
+flux:
-      address: 10.10.10.103
+  enabled: true
-      ssh:
+  github:
-        username: fake
+    username: onedr0p
-    - name: k8s-4
+    address: https://github.com/onedr0p/flux-cluster-template
-      address: 10.10.10.104
+    branch: main
-      ssh:
+    webhook:
-        username: fake
+      enabled: true
-    - name: k8s-5
+      token: fake
-      address: 10.10.10.105
+  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-      ssh:
+
-        username: fake
+cloudflare:
+  enabled: true
+  domain: fake
+  token: take
+  acme:
+    email: fake@example.com
+    production: false
+  tunnel:
+    account_id: fake
+    id: fake
+    secret: fake
+    ingress_vip: 10.10.10.252
+  ingress_vip: 10.10.10.251
+  gateway_vip: 10.10.10.253

.github/tests/config-k3s-ipv4.yaml

@@ -1,52 +1,50 @@
 ---
 skip_tests: true
 
-bootstrap_distribution: k3s
+distribution: k3s
-bootstrap_github_username: onedr0p
+timezone: Etc/UTC
-bootstrap_github_repository_name: flux-cluster-template
+
-bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+cluster:
-bootstrap_timezone: Etc/UTC
+  nodes:
-bootstrap_acme_email: fake@example.com
+    host_network: 10.10.10.0/24
-bootstrap_acme_production_enabled: false
+    dns_servers: ["1.1.1.1"]
-bootstrap_flux_github_webhook_token: fake
+    search_domain: "fake"
-bootstrap_cloudflare_domain: fake
+    inventory:
-bootstrap_cloudflare_token: fake
+      - name: k8s-controller-0
-bootstrap_cloudflare_account_tag: fake
-bootstrap_cloudflare_tunnel_secret: fake
-bootstrap_cloudflare_tunnel_id: fake
-bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kube_api_addr: 10.10.10.254
-bootstrap_kube_additional_tls_sans: ["fake"]
-bootstrap_k8s_gateway_addr: 10.10.10.253
-bootstrap_external_ingress_addr: 10.10.10.252
-bootstrap_internal_ingress_addr: 10.10.10.251
-bootstrap_dns_server: 1.1.1.1
-bootstrap_cluster_cidr: 10.42.0.0/16
-bootstrap_service_cidr: 10.43.0.0/16
-bootstrap_nodes:
-  master:
-    - name: k8s-0
         address: 10.10.10.100
-      ssh:
+        controller: true
-        username: fake
+        ssh_username: fake
-    - name: k8s-1
+      - name: k8s-worker-0
         address: 10.10.10.101
-      ssh:
+        controller: false
-        username: fake
+        ssh_username: fake
-    - name: k8s-2
+  pod_network: 10.69.0.0/16
-      address: 10.10.10.102
+  service_network: 10.96.0.0/16
-      ssh:
+  endpoint_vip: 10.10.10.254
-        username: fake
+  tls_sans: ["fake"]
-  worker:
+
-    - name: k8s-3
+flux:
-      address: 10.10.10.103
+  enabled: true
-      ssh:
+  github:
-        username: fake
+    username: onedr0p
-    - name: k8s-4
+    address: https://github.com/onedr0p/flux-cluster-template
-      address: 10.10.10.104
+    branch: main
-      ssh:
+    webhook:
-        username: fake
+      enabled: true
-    - name: k8s-5
+      token: fake
-      address: 10.10.10.105
+  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-      ssh:
+
-        username: fake
+cloudflare:
+  enabled: true
+  domain: fake
+  token: take
+  acme:
+    email: fake@example.com
+    production: false
+  tunnel:
+    account_id: fake
+    id: fake
+    secret: fake
+    ingress_vip: 10.10.10.252
+  ingress_vip: 10.10.10.251
+  gateway_vip: 10.10.10.253

.github/tests/config-k3s-ipv6.yaml

@@ -1,54 +1,53 @@
 ---
 skip_tests: true
 
-bootstrap_distribution: k3s
+distribution: k3s
-bootstrap_github_username: onedr0p
+timezone: Etc/UTC
-bootstrap_github_repository_name: flux-cluster-template
+
-bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+cluster:
-bootstrap_timezone: Etc/UTC
+  nodes:
-bootstrap_acme_email: fake@example.com
+    host_network: 10.10.10.0/24
-bootstrap_acme_production_enabled: false
+    dns_servers: ["1.1.1.1"]
-bootstrap_flux_github_webhook_token: fake
+    search_domain: "fake"
-bootstrap_cloudflare_domain: fake
+    inventory:
-bootstrap_cloudflare_token: fake
+      - name: k8s-controller-0
-bootstrap_cloudflare_account_tag: fake
-bootstrap_cloudflare_tunnel_secret: fake
-bootstrap_cloudflare_tunnel_id: fake
-bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kube_api_addr: 10.10.10.254
-bootstrap_kube_additional_tls_sans: ["fake"]
-bootstrap_k8s_gateway_addr: 10.10.10.253
-bootstrap_external_ingress_addr: 10.10.10.252
-bootstrap_internal_ingress_addr: 10.10.10.251
-bootstrap_dns_server: 1.1.1.1
-bootstrap_advanced_flags:
-  dual_stack_ipv4_first: true
-bootstrap_cluster_cidr: 10.42.0.0/16,fd7f:8f5:e87c:a::/64
-bootstrap_service_cidr: 10.43.0.0/16,fd7f:8f5:e87c:e::/112
-bootstrap_nodes:
-  master:
-    - name: k8s-0
         address: 10.10.10.100
-      ssh:
+        controller: true
-        username: fake
+        ssh_username: fake
-    - name: k8s-1
+      - name: k8s-worker-0
         address: 10.10.10.101
-      ssh:
+        controller: false
-        username: fake
+        ssh_username: fake
-    - name: k8s-2
+  pod_network: 10.42.0.0/16,fd7f:8f5:e87c:a::/64
-      address: 10.10.10.102
+  service_network: 10.43.0.0/16,fd7f:8f5:e87c:e::/112
-      ssh:
+  endpoint_vip: 10.10.10.254
-        username: fake
+  tls_sans: ["fake"]
-  worker:
+
-    - name: k8s-3
+flux:
-      address: 10.10.10.103
+  enabled: true
-      ssh:
+  github:
-        username: fake
+    username: onedr0p
-    - name: k8s-4
+    address: https://github.com/onedr0p/flux-cluster-template
-      address: 10.10.10.104
+    branch: main
-      ssh:
+    webhook:
-        username: fake
+      enabled: true
-    - name: k8s-5
+      token: fake
-      address: 10.10.10.105
+  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-      ssh:
+
-        username: fake
+cloudflare:
+  enabled: true
+  domain: fake
+  token: take
+  acme:
+    email: fake@example.com
+    production: false
+  tunnel:
+    account_id: fake
+    id: fake
+    secret: fake
+    ingress_vip: 10.10.10.252
+  ingress_vip: 10.10.10.251
+  gateway_vip: 10.10.10.253
+
+feature_gates:
+  dual_stack_ipv4_first: true

.github/tests/config-talos.yaml

@@ -1,52 +1,50 @@
 ---
 skip_tests: true
 
-bootstrap_distribution: talos
+distribution: talos
-bootstrap_github_username: onedr0p
+timezone: Etc/UTC
-bootstrap_github_repository_name: flux-cluster-template
+
-bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+cluster:
-bootstrap_timezone: Etc/UTC
+  nodes:
-bootstrap_acme_email: fake@example.com
+    host_network: 10.10.10.0/24
-bootstrap_acme_production_enabled: false
+    dns_servers: ["1.1.1.1"]
-bootstrap_flux_github_webhook_token: fake
+    search_domain: "fake"
-bootstrap_cloudflare_domain: fake
+    inventory:
-bootstrap_cloudflare_token: fake
+      - name: k8s-controller-0
-bootstrap_cloudflare_account_tag: fake
-bootstrap_cloudflare_tunnel_secret: fake
-bootstrap_cloudflare_tunnel_id: fake
-bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kube_api_addr: 10.10.10.254
-bootstrap_kube_additional_tls_sans: ["fake"]
-bootstrap_k8s_gateway_addr: 10.10.10.253
-bootstrap_external_ingress_addr: 10.10.10.252
-bootstrap_internal_ingress_addr: 10.10.10.251
-bootstrap_dns_server: 1.1.1.1
-bootstrap_cluster_cidr: 10.42.0.0/16
-bootstrap_service_cidr: 10.43.0.0/16
-bootstrap_nodes:
-  master:
-    - name: k8s-0
         address: 10.10.10.100
-      talos:
+        controller: true
-        disk_device: fake
+        talos_disk_device: fake
-    - name: k8s-1
+      - name: k8s-worker-0
         address: 10.10.10.101
-      talos:
+        controller: false
-        disk_device: fake
+        talos_disk_device: fake
-    - name: k8s-2
+  pod_network: 10.69.0.0/16
-      address: 10.10.10.102
+  service_network: 10.96.0.0/16
-      talos:
+  endpoint_vip: 10.10.10.254
-        disk_device: fake
+  tls_sans: ["fake"]
-  worker:
+
-    - name: k8s-3
+flux:
-      address: 10.10.10.103
+  enabled: true
-      talos:
+  github:
-        disk_device: fake
+    username: onedr0p
-    - name: k8s-4
+    address: https://github.com/onedr0p/flux-cluster-template
-      address: 10.10.10.104
+    branch: main
-      talos:
+    webhook:
-        disk_device: fake
+      enabled: true
-    - name: k8s-5
+      token: fake
-      address: 10.10.10.105
+  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-      talos:
+
-        disk_device: fake
+cloudflare:
+  enabled: true
+  domain: fake
+  token: take
+  acme:
+    email: fake@example.com
+    production: false
+  tunnel:
+    account_id: fake
+    id: fake
+    secret: fake
+    ingress_vip: 10.10.10.252
+  ingress_vip: 10.10.10.251
+  gateway_vip: 10.10.10.253

.github/workflows/e2e.yaml

@@ -77,9 +77,9 @@ jobs:
         shell: bash
         run: |
           task init
-          cp ./.github/tests/config-${{ matrix.config-files }}.yaml ./bootstrap/vars/config.yaml
+          cp ./.github/tests/config-${{ matrix.config-files }}.yaml ./config.yaml
           export BOOTSTRAP_AGE_PUBLIC_KEY=$(sed -n 's/# public key: //gp' age.key)
-          envsubst < ./bootstrap/vars/config.yaml | sponge ./bootstrap/vars/config.yaml
+          envsubst < ./config.yaml | sponge ./config.yaml
 
       - name: Run configure task
         shell: bash

.gitignore

@@ -21,3 +21,5 @@ Brewfile.lock.json
 .idea
 # wiki
 wiki
+# Bootstrap
+/config.yaml

.taskfiles/K0s/Taskfile.yaml

@@ -34,10 +34,10 @@ tasks:
     prompt: This will overwrite the existing kubeconfig... continue?
     cmds:
       - k0sctl kubeconfig --config {{.K0S_CONFIG_FILE}} > {{.KUBECONFIG_FILE}}
-      - sed -i {{if eq OS "darwin"}}''{{end}} 's|https://.+:6443|https://{{.kube_api_addr}}:6443|g' {{.KUBECONFIG_FILE}}
+      - sed -i {{if eq OS "darwin"}}''{{end}} 's|https://.+:6443|https://{{.endpoint}}:6443|g' {{.KUBECONFIG_FILE}}
     vars:
-      kube_api_addr:
+      endpoint:
-        sh: "yq '.bootstrap_kube_api_addr' {{.BOOTSTRAP_CONFIG_FILE}}"
+        sh: "yq '.cluster.endpoint_vip' {{.BOOTSTRAP_CONFIG_FILE}}"
     preconditions:
       - { msg: "Missing K0s config file", sh: "test -f {{.K0S_CONFIG_FILE}}" }
 

.taskfiles/Repository/Taskfile.yaml

@@ -28,6 +28,7 @@ tasks:
       - task: :k0s:.reset
       - task: :kubernetes:.reset
       - task: :sops:.reset
+      - task: :talos:.reset
 
   force-reset:
     desc: Reset repo back to HEAD

.taskfiles/Sops/Taskfile.yaml

@@ -22,7 +22,10 @@ tasks:
           file: "{{.ITEM}}"
     vars:
       file:
-        sh: find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \;
+        sh: |
+          if [ -d "{{.KUBERNETES_DIR}}" ]; then
+              find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \;
+          fi
 
   .encrypt-file:
     internal: true

.taskfiles/Talos/Taskfile.yaml

@@ -77,3 +77,7 @@ tasks:
       vars: ["node", "to"]
     preconditions:
       - { msg: "Node not found", sh: "talosctl --nodes {{.node}} get machineconfig" }
+
+  .reset:
+    internal: true
+    cmd: rm -rf {{.TALOS_DIR}}

README.md

@@ -1,18 +1,21 @@
-# Deploy a Kubernetes cluster backed by Flux
+# Deploy a Kubernetes cluster
 
-Welcome to my opinionated and extendable template for deploying a single Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos) backed by [Flux](https://fluxcd.io/flux/) to manage its state.
+Welcome to my opinionated and extensible template for deploying a single Kubernetes cluster. The goal of this project is to make it easier for people interested in using Kubernetes to deploy a cluster at home on bare-metal or VMs.
 
 ## 👋 Introduction
 
-The goal of this project is to make it easy for people interested in learning Kubernetes to deploy a cluster at home and become familiar with the GitOps tool Flux.
+There are currently 3 different types of configuration available with this template:
 
-This template implements Flux in a way that promotes legibility and ease of use for those who are new (or relatively new) to the technology and GitOps in general.
+1. "**Bare cluster**" - a distrubition of your choosing ([k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos)) that comes with only [kube-vip](https://github.com/kube-vip/kube-vip) and [Cilium](https://github.com/cilium/cilium) installed with the cluster.
-
+2. "**Flux cluster**" - Add-on to the "**Bare cluster**" to deploy an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as the SCM tool.
-If you are new to Flux and GitOps it is important to understand that **all changes** you want made to your Kubernetes cluster should be **commited to your Git repository** which Flux will pick up and attempt to apply. You're still free to make _dirty_ edits using `kubectl` but keep in mind that Flux might revert them once its reconcilation loop happens.
+3. "**Flux cluster w/ Cloudflare**" - Add-on to the "**Flux cluster**" that provides DNS and SSL with [Cloudflare](https://www.cloudflare.com/). [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) is also included to provide external access to certain applications deployed in your cluster.
 
 ## ✨ Features
 
-- Build a Kubernetes cluster with either [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos)
+> [!NOTE]
+> Features will vary depending on what type of configuration you choose, listed below is an overview of the full "**Flux cluster w/ Cloudflare**" setup.
+
+- Build a Kubernetes cluster with either [k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos)
 - Automated, reproducible, customizable setup through templates
 - Opinionated implementation of Flux with [strong community support](https://github.com/onedr0p/flux-cluster-template/tree/main#-help)
 - Encrypted secrets thanks to [SOPS](https://github.com/getsops/sops) and [Age](https://github.com/FiloSottile/age)
@@ -26,8 +29,8 @@ If you are new to Flux and GitOps it is important to understand that **all chang
 
 ## 📝 Pre-start checklist
 
-> [!IMPORTANT]
+> [!NOTE]
-> Before we get started everything below must be taken into consideration, you must...
+> Pre-start checklist items will vary depending on what type of configuration you choose, listed below is an overview of the full "**Flux cluster w/ Cloudflare**" setup.
 
 - [ ] have some experience with the following: Git/SCM, containers, networking and scripting.
 - [ ] bring a **positive attitude** and be ready to learn and fail a lot. _The more you fail, the more you can learn from._
@@ -41,7 +44,7 @@ If you are new to Flux and GitOps it is important to understand that **all chang
 
 Hopefully some of this peeked your interests!
 
-If you are marching forward, now is a good time to choose whether you will deploy a Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos). Talos and k0s support was recently added so I would advise using k3s until those have been tested more however feel free to use Talos or k0s and report any issues that you find. Keep the one you decide in mind as you continue along, some steps may vary on what you choose.
+If you are marching forward, now is a good time to choose whether you will deploy a Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos). Talos and k0s support was recently added so I would advise using k3s until those have been tested more however feel free to use Talos or k0s and report any issues that you find. Keep the one you decide in mind as you continue along, some steps may vary on what you choose.
 
 ### System requirements
 
@@ -166,7 +169,7 @@ You have two different options for setting up your local workstation. First one
 
 1. Start Docker and open your repository in VSCode. There will be a pop-up asking you to use the `devcontainer`, click the button to start using it.
 
-2. Continue on to 🔧 [**Stage 3**](#-stage-3-do-bootstrap-configuration)
+2. Continue on to 🔧 [**Stage 3**](#-stage-3-bootstrap-configuration)
 
 #### Non-devcontainer method
 
@@ -199,7 +202,7 @@ You have two different options for setting up your local workstation. First one
     task workstation:brew
     # or, Arch with yay/paru
     task workstation:arch
-    # or, Generic Linux (this pulls binaires in to ./bin)
+    # or, Generic Linux (YMMV, this pulls binaires in to ./bin)
     task workstation:generic-linux
     ```
 
@@ -211,90 +214,80 @@ You have two different options for setting up your local workstation. First one
     task workstation:venv
     ```
 
-5. Continue on to 🔧 [**Stage 3**](#-stage-3-do-bootstrap-configuration)
+5. Continue on to 🔧 [**Stage 3**](#-stage-3-bootstrap-configuration)
 
-### 🔧 Stage 3: Do bootstrap configuration
+### 🔧 Stage 3: Bootstrap configuration
 
-📍 _The_ `bootstrap/vars/config.yaml` contain necessary information that is **vital** to the bootstrap process._
+> [!IMPORTANT]
+> The [config.sample.yaml](https://github.com/onedr0p/flux-cluster-template/blob/main/config.sample.yaml) file contain necessary information that is **vital** to the bootstrap process.
 
-1. Generate the `bootstrap/vars/config.yaml` configuration file.
+1. Generate the `config.yaml` from the [config.sample.yaml](https://github.com/onedr0p/flux-cluster-template/blob/main/config.sample.yaml) configuration file.
 
     ```sh
     task init
     ```
 
-2. Choose between `k3s` or `k0s` for your Kubernetes distribution and fillout the appropriate vars in `bootstrap/vars/config.yaml`
+2. Setup Age private / public key (_**Skip if not using Flux**_)
-
-3. Setup Age private / public key
 
     📍 _Using [SOPS](https://github.com/getsops/sops) with [Age](https://github.com/FiloSottile/age) allows us to encrypt secrets and use them in Ansible and Flux._
 
-    3a. Create a Age private / public key (this file is gitignored)
+    2a. Create a Age private / public key (this file is gitignored)
 
       ```sh
       task sops:age-keygen
       ```
 
-    3b. Fill out the appropriate vars in `bootstrap/vars/config.yaml`
+    2b. Fill out the appropriate vars in `config.yaml`
 
-4. Create Cloudflare API Token
+3. Create Cloudflare API Token (_**Skip if not using Cloudflare**_)
 
     📍 _To use `cert-manager` with the Cloudflare DNS challenge you will need to create a API Token._
 
-   4a. Head over to Cloudflare and create a API Token by going [here](https://dash.cloudflare.com/profile/api-tokens).
+   1. Head over to Cloudflare and create a API Token by going [here](https://dash.cloudflare.com/profile/api-tokens).
-
+   2. Under the `API Tokens` section click the blue `Create Token` button.
-   4b. Under the `API Tokens` section click the blue `Create Token` button.
+   3. Click the blue `Use template` button for the `Edit zone DNS` template.
-
+   4. Name your token something like `home-kubernetes`
-   4c. Click the blue `Use template` button for the `Edit zone DNS` template.
+   5. Under `Permissions`, click `+ Add More` and add each permission below:
-
-   4d. Name your token something like `home-kubernetes`
-
-   4e. Under `Permissions`, click `+ Add More` and add each permission below:
 
       ```text
       Zone - DNS - Edit
       Account - Cloudflare Tunnel - Read
       ```
 
-   4f. Limit the permissions to a specific account and zone resources.
+   6. Limit the permissions to a specific account and zone resources.
+   7. Fill out the appropriate vars in `config.yaml`
 
-   4g. Fill out the appropriate vars in `bootstrap/vars/config.yaml`
+4. Create Cloudflare Tunnel (_**Skip if not using Cloudflare**_)
-
-5. Create Cloudflare Tunnel
 
     📍 _To expose services to the internet you will need to create a [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/)._
 
-    5a. Authenticate cloudflared to your domain
+    1. Authenticate cloudflared to your domain
 
         ```sh
         cloudflared tunnel login
         ```
 
-    5b. Create the tunnel
+    2. Create the tunnel
 
         ```sh
         cloudflared tunnel create k8s
         ```
 
-    5c. In the `~/.cloudflared` directory there will be a json file with details you need. Ignore the `cert.pem` file.
+    3. In the `~/.cloudflared` directory there will be a json file with details you need. Ignore the `cert.pem` file.
 
-    5d. Fill out the appropriate vars in `bootstrap/vars/config.yaml`
+    4. Fill out the appropriate vars in `config.yaml`
 
-6. Complete filling out the rest of the `bootstrap/vars/config.yaml` configuration file.
+5. Complete filling out the rest of the `config.yaml` configuration file.
 
-    6a. Ensure `bootstrap_acme_production_enabled` is set to `false`.
+6. Once done run the following command which will verify and generate all the files needed to continue.
-
-7. Once done run the following command which will verify and generate all the files needed to continue.
-
-    📍 _The following configure task will create a `./ansible` directory for k3s or k0s and the following directories under `./kubernetes` for all distributions_
 
     ```sh
     task configure
     ```
 
-8. Push you changes to git
+7. Push you changes to git
 
-   📍 **Verify** all the `*.sops.yaml` and `*.sops.yaml` files under the `./ansible`, and `./kubernetes` directories are **encrypted** with SOPS
+   📍 **Verify** all the `*.sops.yaml` and `*.sops.yaml` files under `./kubernetes` directory is **encrypted** with SOPS
 
     ```sh
     git add -A
@@ -302,11 +295,11 @@ You have two different options for setting up your local workstation. First one
     git push
     ```
 
-9. Continue on to ⚡ [**Stage 4**](#-stage-4-prepare-your-nodes-for-kubernetes)
+8.  Continue on to ⚡ [**Stage 4**](#-stage-4-prepare-your-nodes-for-kubernetes)
 
 ### ⚡ Stage 4: Prepare your nodes for Kubernetes
 
-> [!NOTE]
+> [!IMPORTANT]
 > For **Talos** or **k0s** skip ahead to ⛵ [**Stage 5**](#-stage-5-install-kubernetes)
 
 #### k3s
@@ -401,7 +394,8 @@ You have two different options for setting up your local workstation. First one
 
 ### 🔹 Stage 6: Install Flux in your cluster
 
-📍 _Here we will be installing [flux](https://fluxcd.io/flux/) after some quick bootstrap steps._
+> [!IMPORTANT]
+> Skip this stage if you have **disabled** Flux in the `config.yaml`
 
 1. Verify Flux can be installed
 
@@ -433,7 +427,7 @@ You have two different options for setting up your local workstation. First one
     # source-controller-7d6875bcb4-zqw9f         1/1     Running   0          1h
     ```
 
-### 🎤 Verification Steps
+### 🎤 Flux w/ Cloudflare verification Steps
 
 _Mic check, 1, 2_ - In a few moments applications should be lighting up like Christmas in July 🎄
 
@@ -451,7 +445,7 @@ _Mic check, 1, 2_ - In a few moments applications should be lighting up like Chr
 
 4. 🧠 Now it's time to pause and go get some motel motor oil ☕ and admire you made it this far!
 
-## 📣 Post installation
+## 📣 Flux w/ Cloudflare post installation
 
 #### 🌐 Public DNS
 
@@ -504,7 +498,7 @@ By default Flux will periodically check your git repository for changes. In orde
 
 3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_flux_github_webhook_token` secret and save.
 
-#### 💥 Nuke
+## 💥 Nuke
 
 There might be a situation where you want to destroy your Kubernetes cluster. This will completely clean the OS of all traces of the Kubernetes distribution you chose and then reboot the nodes.
 
@@ -515,7 +509,7 @@ task ansible:run playbook=cluster-nuke
 task k0s:reset
 ```
 
-### 🤖 Renovate
+## 🤖 Renovate
 
 [Renovate](https://www.mend.io/renovate) is a tool that automates dependency management. It is designed to scan your repository around the clock and open PRs for out-of-date dependencies it finds. Common dependencies it can discover are Helm charts, container images, GitHub Actions, Ansible roles... even Flux itself! Merging a PR will cause Flux to apply the update to your cluster.
 

Taskfile.yaml

@@ -11,7 +11,7 @@ vars:
   SCRIPTS_DIR: "{{.ROOT_DIR}}/scripts"
   # Files
   AGE_FILE: "{{.ROOT_DIR}}/age.key"
-  BOOTSTRAP_CONFIG_FILE: "{{.BOOTSTRAP_DIR}}/vars/config.yaml"
+  BOOTSTRAP_CONFIG_FILE: "{{.ROOT_DIR}}/config.yaml"
   KUBECONFIG_FILE: "{{.ROOT_DIR}}/kubeconfig"
   MAKEJINJA_CONFIG_FILE: "{{.ROOT_DIR}}/makejinja.toml"
   PIP_REQUIREMENTS_FILE: "{{.ROOT_DIR}}/requirements.txt"

bootstrap/scripts/validation.py

@@ -1,14 +1,8 @@
-from email_validator import validate_email, EmailNotValidError, EmailUndeliverableError
 from functools import wraps
 from shutil import which
-from typing import Callable, Optional
+from typing import Callable
 from zoneinfo import available_timezones
-import CloudFlare
-import json
 import netaddr
-import re
-import requests
-import socket
 import sys
 
 DISTRIBUTIONS = ["k0s", "k3s", "talos"]
@@ -25,54 +19,18 @@ def required(*keys: str):
                 if data.get(key) is None:
                     raise ValueError(f"Missing required key {key}")
             return func(*[data[key] for key in keys], **kwargs)
-
         return wrapper
-
     return wrapper_outter
 
 
-def _validate_ip(ip: str) -> str:
+def _validate_network(network: str, family: int) -> str:
     try:
-        netaddr.IPAddress(ip)
+        network = netaddr.IPNetwork(network)
-    except netaddr.core.AddrFormatError as e:
-        raise ValueError(f"Invalid IP address {ip}") from e
-    return ip
-
-
-def _validate_cidr(cidr: str, family: int) -> str:
-    try:
-        network = netaddr.IPNetwork(cidr)
         if network.version != family:
-            raise ValueError(f"Invalid CIDR family {network.version}")
+            raise ValueError(f"Invalid network family {network.version}")
     except netaddr.core.AddrFormatError as e:
-        raise ValueError(f"Invalid CIDR {cidr}") from e
+        raise ValueError(f"Invalid network {network}") from e
-    return cidr
+    return network
-
-
-def _validate_distribution(distribution: str) -> None:
-    if distribution not in DISTRIBUTIONS:
-        raise ValueError(f"Invalid distribution {distribution}")
-    return distribution
-
-
-def _validate_node(node: dict, node_cidr: str, distribution: str) -> None:
-    if not node.get("name"):
-        raise ValueError(f"A node is missing a name")
-    if not node.get("ssh", {}).get("username") and distribution in ["k0s", "k3s"]:
-        raise ValueError(f"Node {node.get('name')} is missing a SSH username")
-    if not node.get("talos", {}).get("disk_device") and distribution in ["talos"]:
-        raise ValueError(f"Node {node.get('name')} is missing a disk device")
-    if not re.match(r"^[a-z0-9-\.]+$", node.get('name')):
-        raise ValueError(f"Node {node.get('name')} has an invalid name")
-    ip = _validate_ip(node.get("address"))
-    if netaddr.IPAddress(ip, 4) not in netaddr.IPNetwork(node_cidr):
-        raise ValueError(f"Node {node.get('name')} is not in the node CIDR {node_cidr}")
-    port = 50000 if distribution == "talos" else 22
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-        sock.settimeout(5)
-        result = sock.connect_ex((ip, port))
-        if result != 0:
-            raise ValueError(f"Node {node.get('name')} port {port} is not open")
 
 
 def validate_python_version() -> None:
@@ -81,188 +39,76 @@ def validate_python_version() -> None:
         raise ValueError(f"Python version is below 3.11. Please upgrade.")
 
 
-@required("bootstrap_distribution")
+@required("distribution")
 def validate_cli_tools(distribution: str, **_) -> None:
-    _distribution = _validate_distribution(distribution)
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")
     for tool in GLOBAL_CLI_TOOLS:
         if not which(tool):
             raise ValueError(f"Missing required CLI tool {tool}")
-    for tool in TALOS_CLI_TOOLS if _distribution in ["talos"] else []:
+    for tool in TALOS_CLI_TOOLS if distribution in ["talos"] else []:
         if not which(tool):
             raise ValueError(f"Missing required CLI tool {tool}")
-    for tool in K0S_CLI_TOOLS if _distribution in ["k0s"] else []:
+    for tool in K0S_CLI_TOOLS if distribution in ["k0s"] else []:
         if not which(tool):
             raise ValueError(f"Missing required CLI tool {tool}")
 
 
-@required("bootstrap_distribution")
+@required("distribution")
 def validate_distribution(distribution: str, **_) -> None:
-    _validate_distribution(distribution)
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")
 
 
-@required("bootstrap_github_username", "bootstrap_github_repository_name", "bootstrap_advanced_flags")
+@required("timezone")
-def validate_github(username: str, repository: str, advanced_flags: dict, **_) -> None:
-    try:
-        request = requests.get(
-            f"https://api.github.com/repos/{username}/{repository}/branches/{advanced_flags.get('github_repository_branch', 'main')}")
-        if request.status_code != 200:
-            raise ValueError(
-                f"GitHub repository {username}/{repository} branch {advanced_flags.get('github_repository_branch', 'main')} not found")
-    except requests.exceptions.RequestException as e:
-        raise ValueError(
-            f"GitHub repository {username}/{repository} branch {advanced_flags.get('github_repository_branch', 'main')} not found") from e
-
-
-@required("bootstrap_age_public_key")
-def validate_age(key: str, **_) -> None:
-    if not re.match(r"^age1[a-z0-9]{0,58}$", key):
-        raise ValueError(f"Invalid Age public key {key}")
-
-
-@required("bootstrap_timezone")
 def validate_timezone(timezone: str, **_) -> None:
     if timezone not in available_timezones():
         raise ValueError(f"Invalid timezone {timezone}")
 
 
-@required("bootstrap_cluster_cidr", "bootstrap_service_cidr", "bootstrap_advanced_flags")
+@required("cluster", "feature_gates")
-def validate_cluster_cidrs(cluster_cidr: str, service_cidr: str, advanced_flags: dict, **_) -> None:
+def validate_cluster_networks(cluster: dict, feature_gates: dict, **_) -> None:
-    dual_stack_ipv4_first = advanced_flags.get("dual_stack_ipv4_first", False)
+    dual_stack_ipv4_first = feature_gates.get("dual_stack_ipv4_first", False)
+    pod_network = cluster.get("pod_network")
+    service_network = cluster.get("service_network")
 
-    if cluster_cidr == service_cidr:
+    if pod_network == service_network:
-        raise ValueError(f"Cluster CIDR {cluster_cidr} is the same as service CIDR {service_cidr}")
+        raise ValueError(f"Pod network {pod_network} is the same as service network {service_network}")
 
     if dual_stack_ipv4_first:
-        if len(cluster_cidr.split(",")) != 2:
+        if len(pod_network.split(",")) != 2:
-            raise ValueError(f"Invalid cluster CIDR {cluster_cidr}")
+            raise ValueError(f"Invalid pod network {pod_network}")
-        if len(service_cidr.split(",")) != 2:
+        if len(service_network.split(",")) != 2:
-            raise ValueError(f"Invalid service CIDR {service_cidr}")
+            raise ValueError(f"Invalid service network {service_network}")
-        cluster_ipv4, cluster_ipv6 = cluster_cidr.split(",")
+        cluster_ipv4, cluster_ipv6 = pod_network.split(",")
-        _validate_cidr(cluster_ipv4, 4)
+        _validate_network(cluster_ipv4, 4)
-        _validate_cidr(cluster_ipv6, 6)
+        _validate_network(cluster_ipv6, 6)
-        service_ipv4, service_ipv6 = service_cidr.split(",")
+        service_ipv4, service_ipv6 = service_network.split(",")
-        _validate_cidr(service_ipv4, 4)
+        _validate_network(service_ipv4, 4)
-        _validate_cidr(service_ipv6, 6)
+        _validate_network(service_ipv6, 6)
         return
 
-    if len(cluster_cidr.split(",")) != 1:
+    if len(pod_network.split(",")) != 1:
-        raise ValueError(f"Invalid cluster CIDR {cluster_cidr}")
+        raise ValueError(f"Invalid pod network {pod_network}")
-    if len(service_cidr.split(",")) != 1:
+    if len(service_network.split(",")) != 1:
-        raise ValueError(f"Invalid service CIDR {service_cidr}")
+        raise ValueError(f"Invalid service network {service_network}")
 
-    _validate_cidr(cluster_cidr, 4)
+    _validate_network(pod_network, 4)
-    _validate_cidr(service_cidr, 4)
+    _validate_network(service_network, 4)
 
 
-@required("bootstrap_acme_email", "bootstrap_acme_production_enabled")
+def massage_config(data: dict) -> dict:
-def validate_acme_email(email: str, acme_production: bool, **_) -> None:
+    data["flux"] = data.get("flux", {})
-    try:
+    data["cloudflare"] = data.get("cloudflare", {})
-        validate_email(email)
+    data["feature_gates"] = data.get("feature_gates", {})
-    except EmailUndeliverableError:
-        pass
-    except EmailNotValidError as e:
-        raise ValueError(f"Invalid ACME email {email}") from e
-
-
-@required("bootstrap_flux_github_webhook_token")
-def validate_flux_github_webhook_token(token: str, **_) -> None:
-    if not re.match(r"^[a-zA-Z0-9]+$", token):
-        raise ValueError(f"Invalid Flux GitHub webhook token ***")
-
-
-@required("bootstrap_cloudflare_domain", "bootstrap_cloudflare_token", "bootstrap_cloudflare_account_tag",
-          "bootstrap_cloudflare_tunnel_secret", "bootstrap_cloudflare_tunnel_id")
-def validate_cloudflare(domain: str, token: str, account_tag: str, tunnel_secret: str, tunnel_id: str, **_) -> None:
-    try:
-        cf = CloudFlare.CloudFlare(token=token)
-        zones = cf.zones.get(params={"name": domain})
-        if not zones:
-            raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it")
-    except CloudFlare.exceptions.CloudFlareAPIError as e:
-        raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it") from e
-    try:
-        request = requests.get(f"https://api.cloudflare.com/client/v4/accounts/{account_tag}/cfd_tunnel/{tunnel_id}",
-                               headers={"Authorization": f"Bearer {token}"})
-        if request.status_code != 200:
-            raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it")
-        if not json.loads(request.text)["success"]:
-            raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it")
-    except requests.exceptions.RequestException as e:
-        raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it") from e
-
-
-@required("bootstrap_dns_server")
-def validate_bootstrap_dns_server(dns_server: str, **_) -> None:
-    _validate_ip(dns_server)
-
-
-@required("bootstrap_node_cidr", "bootstrap_kube_api_addr", "bootstrap_k8s_gateway_addr",
-          "bootstrap_external_ingress_addr", "bootstrap_internal_ingress_addr")
-def validate_host_network(node_cidr: str, api_addr: str, gateway_addr: str, external_ingress_addr: str,
-                          internal_ingress_addr: str, **_) -> None:
-    _validate_cidr(node_cidr, 4)
-    _validate_ip(api_addr)
-    _validate_ip(gateway_addr)
-    _validate_ip(external_ingress_addr)
-    _validate_ip(internal_ingress_addr)
-
-    addrs = [api_addr, gateway_addr, external_ingress_addr, internal_ingress_addr]
-    unique = set(addrs)
-    if len(addrs) != len(unique):
-        raise ValueError(
-            f"{api_addr} and {gateway_addr} and {external_ingress_addr} and {internal_ingress_addr} are not unique")
-
-    node_cidr = netaddr.IPNetwork(node_cidr)
-    if netaddr.IPAddress(api_addr) not in node_cidr:
-        raise ValueError(f"Kubernetes API address {api_addr} is not in the node CIDR {node_cidr}")
-    if netaddr.IPAddress(gateway_addr) not in node_cidr:
-        raise ValueError(f"Kubernetes gateway address {gateway_addr} is not in the node CIDR {node_cidr}")
-    if netaddr.IPAddress(external_ingress_addr) not in node_cidr:
-        raise ValueError(
-            f"Kubernetes external ingress address {external_ingress_addr} is not in the node CIDR {node_cidr}")
-    if netaddr.IPAddress(internal_ingress_addr) not in node_cidr:
-        raise ValueError(
-            f"Kubernetes internal ingress address {internal_ingress_addr} is not in the node CIDR {node_cidr}")
-
-
-@required("bootstrap_node_cidr", "bootstrap_nodes", "bootstrap_distribution")
-def validate_nodes(node_cidr: str, nodes: dict[list], distribution: str, **_) -> None:
-    node_cidr = _validate_cidr(node_cidr, 4)
-
-    masters = nodes.get("master", [])
-    if len(masters) < 1:
-        raise ValueError(f"Must have at least one master node")
-    if len(masters) % 2 == 0:
-        raise ValueError(f"Must have an odd number of master nodes")
-    for node in masters:
-        _validate_node(node, node_cidr, distribution)
-
-    workers = nodes.get("worker", [])
-    for node in workers:
-        _validate_node(node, node_cidr, distribution)
-
-
-def massage(data: dict) -> dict:
-    data["bootstrap_advanced_flags"] = data.get("bootstrap_advanced_flags", {})
     return data
 
+
 def validate(data: dict) -> None:
-    user_data = massage(data)
+    user_config = massage_config(data)
 
     validate_python_version()
-    validate_cli_tools(user_data)
+    validate_cli_tools(user_config)
-    validate_distribution(user_data)
+    validate_distribution(user_config)
-    validate_age(user_data)
+    validate_timezone(user_config)
-    validate_timezone(user_data)
+    validate_cluster_networks(user_config)
-    validate_bootstrap_dns_server(user_data)
-    validate_cluster_cidrs(user_data)
-    validate_flux_github_webhook_token(user_data)
-    validate_host_network(user_data)
-    validate_acme_email(user_data)
-
-    if not user_data.get("bootstrap_private_github_repo"):
-        validate_github(user_data)
-
-    if not user_data.get("skip_tests", False):
-        validate_cloudflare(user_data)
-        validate_nodes(user_data)

bootstrap/templates/.sops.yaml.j2

@@ -1,20 +1,22 @@
+#% if flux.enabled %#
 ---
 creation_rules:
-  #% if bootstrap_distribution in ['talos'] %#
+  #% if distribution in ['talos'] %#
   - # IMPORTANT: This rule MUST be above the others
     path_regex: talos/.*\.sops\.ya?ml
     key_groups:
       - age:
-          - "#{ bootstrap_age_public_key }#"
+          - "#{ flux.sops_age_public_key }#"
   #% endif %#
   - path_regex: kubernetes/.*\.sops\.ya?ml
     encrypted_regex: "^(data|stringData)$"
     key_groups:
       - age:
-          - "#{ bootstrap_age_public_key }#"
+          - "#{ flux.sops_age_public_key }#"
-  #% if bootstrap_distribution in ['k0s', 'k3s'] %#
+  #% if distribution in ['k0s', 'k3s'] %#
   - path_regex: ansible/.*\.sops\.ya?ml
     key_groups:
       - age:
-          - "#{ bootstrap_age_public_key }#"
+          - "#{ flux.sops_age_public_key }#"
   #% endif %#
+#% endif %#

bootstrap/templates/ansible/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']
+main = lambda data: data.get("distribution") in ['k0s', 'k3s']

bootstrap/templates/ansible/inventory/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']
+main = lambda data: data.get("distribution") in ['k0s', 'k3s']

bootstrap/templates/ansible/inventory/group_vars/kubernetes/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -2,7 +2,7 @@
 k3s_become: true
 k3s_etcd_datastore: true
 k3s_install_hard_links: true
-k3s_registration_address: "#{ bootstrap_kube_api_addr }#"
+k3s_registration_address: "#{ cluster.endpoint_vip }#"
 # renovate: datasource=github-releases depName=k3s-io/k3s
 k3s_release_version: v1.29.0+k3s1
 k3s_server_manifests_templates:

bootstrap/templates/ansible/inventory/group_vars/master/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']

bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2

@@ -1,12 +1,12 @@
 ---
 k3s_control_node: true
 k3s_server:
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
-  cluster-cidr: "#{ bootstrap_cluster_cidr.split(',')[0] }#,#{ bootstrap_cluster_cidr.split(',')[1] }#"
+  cluster-cidr: "#{ cluster.pod_network.split(',')[0] }#,#{ cluster.pod_network.split(',')[1] }#"
-  service-cidr: "#{ bootstrap_service_cidr.split(',')[0] }#,#{ bootstrap_service_cidr.split(',')[1] }#"
+  service-cidr: "#{ cluster.service_network.split(',')[0] }#,#{ cluster.service_network.split(',')[1] }#"
   #% else %#
-  cluster-cidr: "#{ bootstrap_cluster_cidr }#"
+  cluster-cidr: "#{ cluster.pod_network }#"
-  service-cidr: "#{ bootstrap_service_cidr }#"
+  service-cidr: "#{ cluster.service_network }#"
   #% endif %#
   disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
   disable-cloud-controller: true
@@ -24,7 +24,7 @@ k3s_server:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
   node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
   #% else %#
   node-ip: "{{ ansible_host }}"
@@ -32,8 +32,8 @@ k3s_server:
   pause-image: registry.k8s.io/pause:3.9
   secrets-encryption: true
   tls-san:
-    - "#{ bootstrap_kube_api_addr }#"
+    - "#{ cluster.endpoint_vip }#"
-    #% for item in bootstrap_kube_additional_tls_sans %#
+    #% for item in cluster.tls_sans %#
     - "{{ item }}"
     #% endfor %#
   write-kubeconfig-mode: "644"

bootstrap/templates/ansible/inventory/group_vars/worker/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']

bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2

@@ -4,7 +4,7 @@ k3s_agent:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
   node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
   #% else %#
   node-ip: "{{ ansible_host }}"

bootstrap/templates/ansible/inventory/hosts.yaml.j2

@@ -3,17 +3,21 @@ kubernetes:
   children:
     master:
       hosts:
-      #% for item in bootstrap_nodes.master %#
+        #% for item in cluster.nodes.inventory %#
+        #% if item.controller %#
         "#{ item.name }#":
-          ansible_user: "#{ item.ssh.username }#"
+          ansible_user: "#{ item.ssh_username }#"
           ansible_host: "#{ item.address }#"
+        #% endif %#
         #% endfor %#
-    #% if bootstrap_nodes.worker|length > 0 %#
+    #% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %#
     worker:
       hosts:
-      #% for item in bootstrap_nodes.worker %#
+        #% for item in cluster.nodes.inventory %#
+        #% if not item.controller %#
         "#{ item.name }#":
-          ansible_user: "#{ item.ssh.username }#"
+          ansible_user: "#{ item.ssh_username }#"
           ansible_host: "#{ item.address }#"
+        #% endif %#
         #% endfor %#
     #% endif %#

bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Cluster Installation
   hosts: kubernetes

bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2

@@ -10,7 +10,7 @@
       ansible.builtin.pause:
         seconds: 5
   tasks:
-    #% if bootstrap_distribution in ['k3s'] %#
+    #% if distribution in ['k3s'] %#
     - name: Ensure Kubernetes is running
       ansible.builtin.include_role:
         name: xanmanning.k3s
@@ -21,9 +21,9 @@
     - name: Upgrade kube-vip
       ansible.builtin.template:
         src: templates/kube-vip-ds.yaml.j2
-        #% if bootstrap_distribution in ['k3s'] %#
+        #% if distribution in ['k3s'] %#
         dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml"
-        #% elif bootstrap_distribution in ['k0s'] %#
+        #% elif distribution in ['k0s'] %#
         dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml"
         #% endif %#
         mode: preserve

bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Cluster Nuke
   hosts: kubernetes
@@ -98,6 +98,6 @@
 
     - name: Reboot
       ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
         reboot_timeout: 3600
 #% endif %#

bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Prepare System
   hosts: kubernetes
@@ -16,7 +16,7 @@
       block:
         - name: Locale | Set timezone
           community.general.timezone:
-            name: "#{ bootstrap_timezone }#"
+            name: "#{ timezone }#"
 
     - name: Packages
       block:
@@ -46,7 +46,6 @@
               ff02::2 ip6-allrouters
             dest: /etc/hosts
             mode: preserve
-        #% if bootstrap_advanced_flags.update_resolv_conf|default(true) %#
         # https://github.com/onedr0p/flux-cluster-template/discussions/635
         - name: Network Configuration | Remove immutable flag from /etc/resolv.conf
           ansible.builtin.file:
@@ -63,9 +62,10 @@
             mode: '0644'
             dest: /etc/resolv.conf
             content: |
-              search .
+              search #{ cluster.nodes.search_domain|default('.', true) }#
-              nameserver #{ bootstrap_dns_server }#
+              #% for item in cluster.nodes.dns_servers %#
-        #% endif %#
+              nameserver #{ item }#
+              #% endfor %#
 
     - name: System Configuration
       notify: Reboot
@@ -110,6 +110,6 @@
   handlers:
     - name: Reboot
       ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
         reboot_timeout: 3600
 #% endif %#

bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2

@@ -11,5 +11,5 @@
   tasks:
     - name: Reboot
       ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
         reboot_timeout: 3600

bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2

@@ -12,9 +12,9 @@
         seconds: 5
   tasks:
     - name: Details
-      #% if bootstrap_distribution in ['k3s'] %#
+      #% if distribution in ['k3s'] %#
       ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
-      #% elif bootstrap_distribution in ['k0s'] %#
+      #% elif distribution in ['k0s'] %#
       ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json"
       #% endif %#
       register: kubectl_get_node
@@ -32,9 +32,9 @@
         - name: Cordon
           kubernetes.core.k8s_drain:
             name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution in ['k3s'] %#
+            #% if distribution in ['k3s'] %#
             kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
             kubeconfig: /var/lib/k0s/pki/admin.conf
             #% endif %#
             state: cordon
@@ -43,9 +43,9 @@
         - name: Drain
           kubernetes.core.k8s_drain:
             name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution in ['k3s'] %#
+            #% if distribution in ['k3s'] %#
             kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
             kubeconfig: /var/lib/k0s/pki/admin.conf
             #% endif %#
             state: drain
@@ -78,9 +78,9 @@
         - name: Uncordon
           kubernetes.core.k8s_drain:
             name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution  in ['k3s'] %#
+            #% if distribution  in ['k3s'] %#
             kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
             kubeconfig: /var/lib/k0s/pki/admin.conf
             #% endif %#
             state: uncordon

bootstrap/templates/ansible/playbooks/tasks/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']

bootstrap/templates/ansible/playbooks/templates/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']

bootstrap/templates/ansible/requirements.yaml.j2

@@ -8,7 +8,7 @@ collections:
     version: 8.2.0
   - name: kubernetes.core
     version: 3.0.0
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 roles:
   - name: xanmanning.k3s
     src: https://github.com/PyratLabs/ansible-role-k3s

bootstrap/templates/kubernetes/apps/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True

bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/ks.yaml.j2

@@ -1,23 +0,0 @@
-
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app cert-manager-issuers
-  namespace: flux-system
-spec:
-  targetNamespace: cert-manager
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager
-  path: ./kubernetes/apps/cert-manager/cert-manager-issuers/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m

bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2

@@ -32,8 +32,3 @@ spec:
       nameservers:
         - "1.1.1.1"
         - "9.9.9.9"
-    prometheus:
-      enabled: true
-      servicemonitor:
-        enabled: true
-        prometheusInstance: observability

bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True

bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2

@@ -4,4 +4,4 @@ kind: Secret
 metadata:
   name: cert-manager-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"

bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2

@@ -18,3 +18,27 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+#% if cloudflare.enabled %#
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cert-manager-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager
+  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+#% endif %#

bootstrap/templates/kubernetes/apps/cert-manager/kustomization.yaml.j2

@@ -4,4 +4,3 @@ kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./cert-manager/ks.yaml
-  - ./cert-manager-issuers/ks.yaml

bootstrap/templates/kubernetes/apps/flux-system/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("github").get("webhook").get("enabled") == True

bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  - ./addons/ks.yaml
+  - ./webhooks/ks.yaml

bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2

@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -21,3 +22,4 @@ spec:
   tls:
     - hosts:
         - *host
+#% endif %#

bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2

@@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
+  #% if cloudflare.enabled %#
   - ./ingress.yaml
+  #% endif %#
   - ./receiver.yaml

bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2

@@ -4,4 +4,4 @@ kind: Secret
 metadata:
   name: github-webhook-token-secret
 stringData:
-  token: "#{ bootstrap_flux_github_webhook_token }#"
+  token: "#{ flux.github.webhook.token }#"

bootstrap/templates/kubernetes/apps/flux-system/webhooks/ks.yaml.j2

@@ -9,7 +9,7 @@ spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/flux-system/addons/webhooks
+  path: ./kubernetes/apps/flux-system/webhooks/app
   prune: true
   sourceRef:
     kind: GitRepository

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-l2.yaml.j2

@@ -6,7 +6,7 @@ metadata:
   name: policy
 spec:
   loadBalancerIPs: true
-  # NOTE: This might need to be set if you have more than one active NIC on your nodes
+  # NOTE: This might need to be set if you have more than one active NIC on your hosts
   # interfaces:
   #   - ^eno[0-9]+
   nodeSelector:

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2

@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  #% if not bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if not feature_gates.dual_stack_ipv4_first %#
   - ./cilium-l2.yaml
   #% endif %#
   - ./helmrelease.yaml

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['talos']
+main = lambda data: data.get("distribution") in ['talos']

bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2

@@ -4,11 +4,11 @@ kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./cilium/ks.yaml
-  #% if bootstrap_distribution in ['talos'] %#
+  #% if distribution in ['talos'] %#
   - ./kubelet-csr-approver/ks.yaml
   #% endif %#
   - ./metrics-server/ks.yaml
-  #% if bootstrap_distribution in ['k0s', 'talos'] %#
+  #% if distribution in ['k0s', 'talos'] %#
   - ./spegel/ks.yaml
   #% endif %#
   - ./reloader/ks.yaml

bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2

@@ -28,7 +28,3 @@ spec:
       - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
       - --kubelet-use-node-status-port
       - --metric-resolution=15s
-    metrics:
-      enabled: true
-    serviceMonitor:
-      enabled: true

bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2

@@ -26,6 +26,3 @@ spec:
     fullnameOverride: reloader
     reloader:
       readOnlyRootFileSystem: true
-      podMonitor:
-        enabled: true
-        namespace: "{{ .Release.Namespace }}"

bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'talos']
+main = lambda data: data.get("distribution") in ['k0s', 'talos']

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2

@@ -24,15 +24,13 @@ spec:
     keepHistory: false
   values:
     spegel:
-      #% if bootstrap_distribution in ['k0s'] %#
+      #% if distribution in ['k0s'] %#
       containerdSock: /run/k0s/containerd.sock
       containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
-      #% elif bootstrap_distribution in ['talos'] %#
+      #% elif distribution in ['talos'] %#
       containerdSock: /run/containerd/containerd.sock
       containerdRegistryConfigPath: /etc/cri/conf.d/hosts
       #% endif %#
     service:
       registry:
         hostPort: 29999
-    serviceMonitor:
-      enabled: true

bootstrap/templates/kubernetes/apps/network/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True

bootstrap/templates/kubernetes/apps/network/certificates/ks.yaml.j2

@@ -1,22 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app certificates
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager-issuers
-  path: ./kubernetes/apps/network/certificates/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m

bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2

@@ -82,9 +82,6 @@ spec:
         ports:
           http:
             port: *port
-    serviceMonitor:
-      main:
-        enabled: true
     persistence:
       config:
         enabled: true

bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2

@@ -4,10 +4,10 @@ kind: Secret
 metadata:
   name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
   credentials.json: |
     {
-      "AccountTag": "#{ bootstrap_cloudflare_account_tag }#",
+      "AccountTag": "#{ cloudflare.tunnel.account_id }#",
-      "TunnelSecret": "#{ bootstrap_cloudflare_tunnel_secret }#",
+      "TunnelSecret": "#{ cloudflare.tunnel.secret }#",
-      "TunnelID": "#{ bootstrap_cloudflare_tunnel_id }#"
+      "TunnelID": "#{ cloudflare.tunnel.id }#"
     }

bootstrap/templates/kubernetes/apps/network/cloudflared/ks.yaml.j2

@@ -10,7 +10,6 @@ spec:
     labels:
       app.kubernetes.io/name: *app
   dependsOn:
-    - name: certificates
     - name: external-dns
   path: ./kubernetes/apps/network/cloudflared/app
   prune: true

bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2

@@ -65,8 +65,6 @@ spec:
             port: *port
     ingress:
       main:
-        enabled: false
-      external:
         enabled: true
         className: external
         annotations:

bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2

@@ -41,7 +41,5 @@ spec:
     txtPrefix: k8s.
     txtOwnerId: default
     domainFilters: ["${SECRET_DOMAIN}"]
-    serviceMonitor:
-      enabled: true
     podAnnotations:
       secret.reloader.stakater.com/reload: external-dns-secret

bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2

@@ -4,4 +4,4 @@ kind: Secret
 metadata:
   name: external-dns-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"

bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2

@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./staging.yaml
-  #% if bootstrap_acme_production_enabled %#
+  #% if cloudflare.acme.production %#
   - ./production.yaml
   #% endif %#

bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2

@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-external
+  name: ingress-nginx-external
 spec:
   interval: 30m
   chart:
@@ -26,13 +26,13 @@ spec:
     - name: cloudflared
       namespace: network
   values:
-    fullnameOverride: nginx-external
+    fullnameOverride: ingress-nginx-external
     controller:
       replicaCount: 1
       service:
         annotations:
           external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "#{ bootstrap_external_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#"
         externalTrafficPolicy: Cluster
       ingressClassResource:
         name: external
@@ -63,14 +63,8 @@ spec:
         proxy-body-size: 0
         proxy-buffer-size: 16k
         ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
       extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
         default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
         #% else %#
         default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -82,7 +76,7 @@ spec:
           labelSelector:
             matchLabels:
               app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-external
+              app.kubernetes.io/instance: ingress-nginx-external
               app.kubernetes.io/component: controller
       resources:
         requests:

bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2

@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-internal
+  name: ingress-nginx-internal
   namespace: network
 spec:
   interval: 30m
@@ -24,12 +24,12 @@ spec:
   uninstall:
     keepHistory: false
   values:
-    fullnameOverride: nginx-internal
+    fullnameOverride: ingress-nginx-internal
     controller:
       replicaCount: 1
       service:
         annotations:
-          io.cilium/lb-ipam-ips: "#{ bootstrap_internal_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#"
         externalTrafficPolicy: Cluster
       ingressClassResource:
         name: internal
@@ -60,14 +60,8 @@ spec:
         proxy-body-size: 0
         proxy-buffer-size: 16k
         ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
       extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
         default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
         #% else %#
         default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -79,7 +73,7 @@ spec:
           labelSelector:
             matchLabels:
               app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-internal
+              app.kubernetes.io/instance: ingress-nginx-internal
               app.kubernetes.io/component: controller
       resources:
         requests:

bootstrap/templates/kubernetes/apps/network/ingress-nginx/ks.yaml.j2

@@ -0,0 +1,66 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-certificates
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/network/ingress-nginx/certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-internal
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/internal
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-external
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/external
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2

@@ -30,5 +30,5 @@ spec:
       type: LoadBalancer
       port: 53
       annotations:
-        io.cilium/lb-ipam-ips: "#{ bootstrap_k8s_gateway_addr }#"
+        io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#"
       externalTrafficPolicy: Cluster

bootstrap/templates/kubernetes/apps/network/kustomization.yaml.j2

@@ -3,10 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  - ./certificates/ks.yaml
   - ./cloudflared/ks.yaml
   - ./echo-server/ks.yaml
   - ./external-dns/ks.yaml
+  - ./ingress-nginx/ks.yaml
   - ./k8s-gateway/ks.yaml
-  - ./nginx-external/ks.yaml
-  - ./nginx-internal/ks.yaml

bootstrap/templates/kubernetes/apps/network/nginx-external/ks.yaml.j2

@@ -1,22 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-external
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-external/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m

bootstrap/templates/kubernetes/apps/network/nginx-internal/ks.yaml.j2

@@ -1,22 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-internal
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-internal/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m

bootstrap/templates/kubernetes/bootstrap/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True

bootstrap/templates/kubernetes/flux/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True

bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2

@@ -6,15 +6,13 @@ metadata:
   namespace: flux-system
 spec:
   interval: 30m
-  ref:
+  url: "#{ flux.github.address }#"
-    branch: "#{ bootstrap_advanced_flags.github_repository_branch|default('main', true) }#"
+  #% if flux.github.address.startswith('ssh://') %#
-  #% if bootstrap_private_github_repo %#
   secretRef:
     name: github-deploy-key
-  url: "ssh://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#"
-  #% else %#
-  url: "https://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#.git"
   #% endif %#
+  ref:
+    branch: "#{ flux.github.branch|default('main', true) }#"
   ignore: |
     # exclude all
     /*

bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: backube
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://backube.github.io/helm-charts

bootstrap/templates/kubernetes/flux/repositories/helm/bitnami.yaml.j2

@@ -1,10 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: bitnami
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://registry-1.docker.io/bitnamicharts

bootstrap/templates/kubernetes/flux/repositories/helm/coredns.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: coredns
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://coredns.github.io/helm

bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: csi-driver-nfs
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts

bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-smb.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: csi-driver-smb
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts

bootstrap/templates/kubernetes/flux/repositories/helm/descheduler.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: descheduler
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubernetes-sigs.github.io/descheduler

bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2

@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
   interval: 1h
   url: https://kubernetes-sigs.github.io/external-dns
+#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/grafana.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: grafana
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://grafana.github.io/helm-charts

bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2

@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
   interval: 1h
   url: https://kubernetes.github.io/ingress-nginx
+#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2

@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
   interval: 1h
   url: https://ori-edge.github.io/k8s_gateway
+#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/kubernetes-dashboard.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: kubernetes-dashboard
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubernetes.github.io/dashboard

bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2

@@ -2,26 +2,20 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./backube.yaml
-  - ./bitnami.yaml
   - ./bjw-s.yaml
   - ./cilium.yaml
-  - ./coredns.yaml
+  #% if cloudflare.enabled %#
-  - ./csi-driver-nfs.yaml
-  - ./csi-driver-smb.yaml
-  - ./descheduler.yaml
   - ./external-dns.yaml
-  - ./grafana.yaml
   - ./ingress-nginx.yaml
-  - ./jetstack.yaml
   - ./k8s-gateway.yaml
-  - ./kubernetes-dashboard.yaml
+  #% endif %#
-  - ./longhorn.yaml
+  - ./jetstack.yaml
   - ./metrics-server.yaml
   - ./openebs.yaml
-  - ./piraeus.yaml
+  #% if distribution in ['talos'] %#
   - ./postfinance.yaml
-  - ./prometheus-community.yaml
+  #% endif %#
   - ./stakater.yaml
-  - ./weave-gitops.yaml
+  #% if distribution in ['k0s', 'talos'] %#
   - ./xenitab.yaml
+  #% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/longhorn.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: longhorn
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://charts.longhorn.io

bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: piraeus
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://piraeus.io/helm-charts

bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2

@@ -1,3 +1,4 @@
+#% if distribution in ['talos'] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
   interval: 1h
   url: https://postfinance.github.io/kubelet-csr-approver
+#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/prometheus-community.yaml.j2

@@ -1,10 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: prometheus-community
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/prometheus-community/charts

bootstrap/templates/kubernetes/flux/repositories/helm/weave-gitops.yaml.j2

@@ -1,10 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: weave-gitops
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/weaveworks/charts

bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2

@@ -1,3 +1,4 @@
+#% if distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,3 +9,4 @@ spec:
   type: oci
   interval: 5m
   url: oci://ghcr.io/xenitab/helm-charts
+#% endif %#

bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2

@@ -5,6 +5,9 @@ metadata:
   name: cluster-secrets
   namespace: flux-system
 stringData:
-  SECRET_DOMAIN: "#{ bootstrap_cloudflare_domain }#"
+  SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
-  SECRET_ACME_EMAIL: "#{ bootstrap_acme_email }#"
+  #% if cloudflare.enabled %#
-  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  SECRET_DOMAIN: "#{ cloudflare.domain }#"
+  SECRET_ACME_EMAIL: "#{ cloudflare.acme.email }#"
+  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
+  #% endif %#

bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2

@@ -5,13 +5,9 @@ metadata:
   name: cluster-settings
   namespace: flux-system
 data:
-  TIMEZONE: "#{ bootstrap_timezone }#"
+  TIMEZONE: "#{ timezone }#"
-  COREDNS_ADDR: "#{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }#"
+  CLUSTER_CIDR: "#{ cluster.pod_network.split(',')[0] }#"
-  KUBE_API_ADDR: "#{ bootstrap_kube_api_addr }#"
+  NODE_CIDR: "#{ cluster.nodes.host_network }#"
-  CLUSTER_CIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
+  #% if feature_gates.dual_stack_ipv4_first %#
-  SERVICE_CIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
+  CLUSTER_CIDR_V6: "#{ cluster.pod_network.split(',')[1] }#"
-  NODE_CIDR: "#{ bootstrap_node_cidr }#"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-  CLUSTER_CIDR_V6: "#{ bootstrap_cluster_cidr.split(',')[1] }#"
-  SERVICE_CIDR_V6: "#{ bootstrap_service_cidr.split(',')[1] }#"
   #% endif %#