feat: refactor config file (#1267)

Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-28 12:41:31 -05:00
1 parent e4427a8325
commit 889ca07692
@@ -1,52 +1,50 @@
 ---
 skip_tests: true

-bootstrap_distribution: k0s
-bootstrap_github_username: onedr0p
-bootstrap_github_repository_name: flux-cluster-template
-bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-bootstrap_timezone: Etc/UTC
-bootstrap_acme_email: fake@example.com
-bootstrap_acme_production_enabled: false
-bootstrap_flux_github_webhook_token: fake
-bootstrap_cloudflare_domain: fake
-bootstrap_cloudflare_token: fake
-bootstrap_cloudflare_account_tag: fake
-bootstrap_cloudflare_tunnel_secret: fake
-bootstrap_cloudflare_tunnel_id: fake
-bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kube_api_addr: 10.10.10.254
-bootstrap_kube_additional_tls_sans: ["fake"]
-bootstrap_k8s_gateway_addr: 10.10.10.253
-bootstrap_external_ingress_addr: 10.10.10.252
-bootstrap_internal_ingress_addr: 10.10.10.251
-bootstrap_dns_server: 1.1.1.1
-bootstrap_cluster_cidr: 10.42.0.0/16
-bootstrap_service_cidr: 10.43.0.0/16
-bootstrap_nodes:
-  master:
-    - name: k8s-0
-      address: 10.10.10.100
-      ssh:
-        username: fake
-    - name: k8s-1
-      address: 10.10.10.101
-      ssh:
-        username: fake
-    - name: k8s-2
-      address: 10.10.10.102
-      ssh:
-        username: fake
-  worker:
-    - name: k8s-3
-      address: 10.10.10.103
-      ssh:
-        username: fake
-    - name: k8s-4
-      address: 10.10.10.104
-      ssh:
-        username: fake
-    - name: k8s-5
-      address: 10.10.10.105
-      ssh:
-        username: fake
+distribution: k0s
+timezone: Etc/UTC
+
+cluster:
+  nodes:
+    host_network: 10.10.10.0/24
+    dns_servers: ["1.1.1.1"]
+    search_domain: "fake"
+    inventory:
+      - name: k8s-controller-0
+        address: 10.10.10.100
+        controller: true
+        ssh_username: fake
+      - name: k8s-worker-0
+        address: 10.10.10.101
+        controller: false
+        ssh_username: fake
+  pod_network: 10.69.0.0/16
+  service_network: 10.96.0.0/16
+  endpoint_vip: 10.10.10.254
+  tls_sans: ["fake"]
+
+flux:
+  enabled: true
+  github:
+    username: onedr0p
+    address: https://github.com/onedr0p/flux-cluster-template
+    branch: main
+    webhook:
+      enabled: true
+      token: fake
+  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+
+cloudflare:
+  enabled: true
+  domain: fake
+  token: take
+  acme:
+    email: fake@example.com
+    production: false
+  tunnel:
+    account_id: fake
+    id: fake
+    secret: fake
+    ingress_vip: 10.10.10.252
+  ingress_vip: 10.10.10.251
+  gateway_vip: 10.10.10.253
@@ -1,52 +1,50 @@
 ---
 skip_tests: true

-bootstrap_distribution: k3s
-bootstrap_github_username: onedr0p
-bootstrap_github_repository_name: flux-cluster-template
-bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-bootstrap_timezone: Etc/UTC
-bootstrap_acme_email: fake@example.com
-bootstrap_acme_production_enabled: false
-bootstrap_flux_github_webhook_token: fake
-bootstrap_cloudflare_domain: fake
-bootstrap_cloudflare_token: fake
-bootstrap_cloudflare_account_tag: fake
-bootstrap_cloudflare_tunnel_secret: fake
-bootstrap_cloudflare_tunnel_id: fake
-bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kube_api_addr: 10.10.10.254
-bootstrap_kube_additional_tls_sans: ["fake"]
-bootstrap_k8s_gateway_addr: 10.10.10.253
-bootstrap_external_ingress_addr: 10.10.10.252
-bootstrap_internal_ingress_addr: 10.10.10.251
-bootstrap_dns_server: 1.1.1.1
-bootstrap_cluster_cidr: 10.42.0.0/16
-bootstrap_service_cidr: 10.43.0.0/16
-bootstrap_nodes:
-  master:
-    - name: k8s-0
-      address: 10.10.10.100
-      ssh:
-        username: fake
-    - name: k8s-1
-      address: 10.10.10.101
-      ssh:
-        username: fake
-    - name: k8s-2
-      address: 10.10.10.102
-      ssh:
-        username: fake
-  worker:
-    - name: k8s-3
-      address: 10.10.10.103
-      ssh:
-        username: fake
-    - name: k8s-4
-      address: 10.10.10.104
-      ssh:
-        username: fake
-    - name: k8s-5
-      address: 10.10.10.105
-      ssh:
-        username: fake
+distribution: k3s
+timezone: Etc/UTC
+
+cluster:
+  nodes:
+    host_network: 10.10.10.0/24
+    dns_servers: ["1.1.1.1"]
+    search_domain: "fake"
+    inventory:
+      - name: k8s-controller-0
+        address: 10.10.10.100
+        controller: true
+        ssh_username: fake
+      - name: k8s-worker-0
+        address: 10.10.10.101
+        controller: false
+        ssh_username: fake
+  pod_network: 10.69.0.0/16
+  service_network: 10.96.0.0/16
+  endpoint_vip: 10.10.10.254
+  tls_sans: ["fake"]
+
+flux:
+  enabled: true
+  github:
+    username: onedr0p
+    address: https://github.com/onedr0p/flux-cluster-template
+    branch: main
+    webhook:
+      enabled: true
+      token: fake
+  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+
+cloudflare:
+  enabled: true
+  domain: fake
+  token: take
+  acme:
+    email: fake@example.com
+    production: false
+  tunnel:
+    account_id: fake
+    id: fake
+    secret: fake
+    ingress_vip: 10.10.10.252
+  ingress_vip: 10.10.10.251
+  gateway_vip: 10.10.10.253
@@ -1,54 +1,53 @@
 ---
 skip_tests: true

-bootstrap_distribution: k3s
-bootstrap_github_username: onedr0p
-bootstrap_github_repository_name: flux-cluster-template
-bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-bootstrap_timezone: Etc/UTC
-bootstrap_acme_email: fake@example.com
-bootstrap_acme_production_enabled: false
-bootstrap_flux_github_webhook_token: fake
-bootstrap_cloudflare_domain: fake
-bootstrap_cloudflare_token: fake
-bootstrap_cloudflare_account_tag: fake
-bootstrap_cloudflare_tunnel_secret: fake
-bootstrap_cloudflare_tunnel_id: fake
-bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kube_api_addr: 10.10.10.254
-bootstrap_kube_additional_tls_sans: ["fake"]
-bootstrap_k8s_gateway_addr: 10.10.10.253
-bootstrap_external_ingress_addr: 10.10.10.252
-bootstrap_internal_ingress_addr: 10.10.10.251
-bootstrap_dns_server: 1.1.1.1
-bootstrap_advanced_flags:
+distribution: k3s
+timezone: Etc/UTC
+
+cluster:
+  nodes:
+    host_network: 10.10.10.0/24
+    dns_servers: ["1.1.1.1"]
+    search_domain: "fake"
+    inventory:
+      - name: k8s-controller-0
+        address: 10.10.10.100
+        controller: true
+        ssh_username: fake
+      - name: k8s-worker-0
+        address: 10.10.10.101
+        controller: false
+        ssh_username: fake
+  pod_network: 10.42.0.0/16,fd7f:8f5:e87c:a::/64
+  service_network: 10.43.0.0/16,fd7f:8f5:e87c:e::/112
+  endpoint_vip: 10.10.10.254
+  tls_sans: ["fake"]
+
+flux:
+  enabled: true
+  github:
+    username: onedr0p
+    address: https://github.com/onedr0p/flux-cluster-template
+    branch: main
+    webhook:
+      enabled: true
+      token: fake
+  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+
+cloudflare:
+  enabled: true
+  domain: fake
+  token: take
+  acme:
+    email: fake@example.com
+    production: false
+  tunnel:
+    account_id: fake
+    id: fake
+    secret: fake
+    ingress_vip: 10.10.10.252
+  ingress_vip: 10.10.10.251
+  gateway_vip: 10.10.10.253
+
+feature_gates:
  dual_stack_ipv4_first: true
-bootstrap_cluster_cidr: 10.42.0.0/16,fd7f:8f5:e87c:a::/64
-bootstrap_service_cidr: 10.43.0.0/16,fd7f:8f5:e87c:e::/112
-bootstrap_nodes:
-  master:
-    - name: k8s-0
-      address: 10.10.10.100
-      ssh:
-        username: fake
-    - name: k8s-1
-      address: 10.10.10.101
-      ssh:
-        username: fake
-    - name: k8s-2
-      address: 10.10.10.102
-      ssh:
-        username: fake
-  worker:
-    - name: k8s-3
-      address: 10.10.10.103
-      ssh:
-        username: fake
-    - name: k8s-4
-      address: 10.10.10.104
-      ssh:
-        username: fake
-    - name: k8s-5
-      address: 10.10.10.105
-      ssh:
-        username: fake
@@ -1,52 +1,50 @@
 ---
 skip_tests: true

-bootstrap_distribution: talos
-bootstrap_github_username: onedr0p
-bootstrap_github_repository_name: flux-cluster-template
-bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-bootstrap_timezone: Etc/UTC
-bootstrap_acme_email: fake@example.com
-bootstrap_acme_production_enabled: false
-bootstrap_flux_github_webhook_token: fake
-bootstrap_cloudflare_domain: fake
-bootstrap_cloudflare_token: fake
-bootstrap_cloudflare_account_tag: fake
-bootstrap_cloudflare_tunnel_secret: fake
-bootstrap_cloudflare_tunnel_id: fake
-bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kube_api_addr: 10.10.10.254
-bootstrap_kube_additional_tls_sans: ["fake"]
-bootstrap_k8s_gateway_addr: 10.10.10.253
-bootstrap_external_ingress_addr: 10.10.10.252
-bootstrap_internal_ingress_addr: 10.10.10.251
-bootstrap_dns_server: 1.1.1.1
-bootstrap_cluster_cidr: 10.42.0.0/16
-bootstrap_service_cidr: 10.43.0.0/16
-bootstrap_nodes:
-  master:
-    - name: k8s-0
-      address: 10.10.10.100
-      talos:
-        disk_device: fake
-    - name: k8s-1
-      address: 10.10.10.101
-      talos:
-        disk_device: fake
-    - name: k8s-2
-      address: 10.10.10.102
-      talos:
-        disk_device: fake
-  worker:
-    - name: k8s-3
-      address: 10.10.10.103
-      talos:
-        disk_device: fake
-    - name: k8s-4
-      address: 10.10.10.104
-      talos:
-        disk_device: fake
-    - name: k8s-5
-      address: 10.10.10.105
-      talos:
-        disk_device: fake
+distribution: talos
+timezone: Etc/UTC
+
+cluster:
+  nodes:
+    host_network: 10.10.10.0/24
+    dns_servers: ["1.1.1.1"]
+    search_domain: "fake"
+    inventory:
+      - name: k8s-controller-0
+        address: 10.10.10.100
+        controller: true
+        talos_disk_device: fake
+      - name: k8s-worker-0
+        address: 10.10.10.101
+        controller: false
+        talos_disk_device: fake
+  pod_network: 10.69.0.0/16
+  service_network: 10.96.0.0/16
+  endpoint_vip: 10.10.10.254
+  tls_sans: ["fake"]
+
+flux:
+  enabled: true
+  github:
+    username: onedr0p
+    address: https://github.com/onedr0p/flux-cluster-template
+    branch: main
+    webhook:
+      enabled: true
+      token: fake
+  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+
+cloudflare:
+  enabled: true
+  domain: fake
+  token: take
+  acme:
+    email: fake@example.com
+    production: false
+  tunnel:
+    account_id: fake
+    id: fake
+    secret: fake
+    ingress_vip: 10.10.10.252
+  ingress_vip: 10.10.10.251
+  gateway_vip: 10.10.10.253
@@ -77,9 +77,9 @@ jobs:
        shell: bash
        run: |
          task init
-          cp ./.github/tests/config-${{ matrix.config-files }}.yaml ./bootstrap/vars/config.yaml
+          cp ./.github/tests/config-${{ matrix.config-files }}.yaml ./config.yaml
          export BOOTSTRAP_AGE_PUBLIC_KEY=$(sed -n 's/# public key: //gp' age.key)
-          envsubst < ./bootstrap/vars/config.yaml | sponge ./bootstrap/vars/config.yaml
+          envsubst < ./config.yaml | sponge ./config.yaml

      - name: Run configure task
        shell: bash
@@ -21,3 +21,5 @@ Brewfile.lock.json
 .idea
 # wiki
 wiki
+# Bootstrap
+/config.yaml
@@ -34,10 +34,10 @@ tasks:
    prompt: This will overwrite the existing kubeconfig... continue?
    cmds:
      - k0sctl kubeconfig --config {{.K0S_CONFIG_FILE}} > {{.KUBECONFIG_FILE}}
-      - sed -i {{if eq OS "darwin"}}''{{end}} 's|https://.+:6443|https://{{.kube_api_addr}}:6443|g' {{.KUBECONFIG_FILE}}
+      - sed -i {{if eq OS "darwin"}}''{{end}} 's|https://.+:6443|https://{{.endpoint}}:6443|g' {{.KUBECONFIG_FILE}}
    vars:
-      kube_api_addr:
-        sh: "yq '.bootstrap_kube_api_addr' {{.BOOTSTRAP_CONFIG_FILE}}"
+      endpoint:
+        sh: "yq '.cluster.endpoint_vip' {{.BOOTSTRAP_CONFIG_FILE}}"
    preconditions:
      - { msg: "Missing K0s config file", sh: "test -f {{.K0S_CONFIG_FILE}}" }

@@ -28,6 +28,7 @@ tasks:
      - task: :k0s:.reset
      - task: :kubernetes:.reset
      - task: :sops:.reset
+      - task: :talos:.reset

  force-reset:
    desc: Reset repo back to HEAD
@@ -22,7 +22,10 @@ tasks:
          file: "{{.ITEM}}"
    vars:
      file:
-        sh: find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \;
+        sh: |
+          if [ -d "{{.KUBERNETES_DIR}}" ]; then
+              find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \;
+          fi

  .encrypt-file:
    internal: true
@@ -77,3 +77,7 @@ tasks:
      vars: ["node", "to"]
    preconditions:
      - { msg: "Node not found", sh: "talosctl --nodes {{.node}} get machineconfig" }
+
+  .reset:
+    internal: true
+    cmd: rm -rf {{.TALOS_DIR}}
@@ -1,18 +1,21 @@
-# Deploy a Kubernetes cluster backed by Flux
+# Deploy a Kubernetes cluster

-Welcome to my opinionated and extendable template for deploying a single Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos) backed by [Flux](https://fluxcd.io/flux/) to manage its state.
+Welcome to my opinionated and extensible template for deploying a single Kubernetes cluster. The goal of this project is to make it easier for people interested in using Kubernetes to deploy a cluster at home on bare-metal or VMs.

 ## 👋 Introduction

-The goal of this project is to make it easy for people interested in learning Kubernetes to deploy a cluster at home and become familiar with the GitOps tool Flux.
+There are currently 3 different types of configuration available with this template:

-This template implements Flux in a way that promotes legibility and ease of use for those who are new (or relatively new) to the technology and GitOps in general.
-
-If you are new to Flux and GitOps it is important to understand that **all changes** you want made to your Kubernetes cluster should be **commited to your Git repository** which Flux will pick up and attempt to apply. You're still free to make _dirty_ edits using `kubectl` but keep in mind that Flux might revert them once its reconcilation loop happens.
+1. "**Bare cluster**" - a distrubition of your choosing ([k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos)) that comes with only [kube-vip](https://github.com/kube-vip/kube-vip) and [Cilium](https://github.com/cilium/cilium) installed with the cluster.
+2. "**Flux cluster**" - Add-on to the "**Bare cluster**" to deploy an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as the SCM tool.
+3. "**Flux cluster w/ Cloudflare**" - Add-on to the "**Flux cluster**" that provides DNS and SSL with [Cloudflare](https://www.cloudflare.com/). [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) is also included to provide external access to certain applications deployed in your cluster.

 ## ✨ Features

- Build a Kubernetes cluster with either [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos)
+> [!NOTE]
+> Features will vary depending on what type of configuration you choose, listed below is an overview of the full "**Flux cluster w/ Cloudflare**" setup.
+
+- Build a Kubernetes cluster with either [k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos)
 - Automated, reproducible, customizable setup through templates
 - Opinionated implementation of Flux with [strong community support](https://github.com/onedr0p/flux-cluster-template/tree/main#-help)
 - Encrypted secrets thanks to [SOPS](https://github.com/getsops/sops) and [Age](https://github.com/FiloSottile/age)
@@ -26,8 +29,8 @@ If you are new to Flux and GitOps it is important to understand that **all chang

 ## 📝 Pre-start checklist

-> [!IMPORTANT]
-> Before we get started everything below must be taken into consideration, you must...
+> [!NOTE]
+> Pre-start checklist items will vary depending on what type of configuration you choose, listed below is an overview of the full "**Flux cluster w/ Cloudflare**" setup.

 - [ ] have some experience with the following: Git/SCM, containers, networking and scripting.
 - [ ] bring a **positive attitude** and be ready to learn and fail a lot. _The more you fail, the more you can learn from._
@@ -41,7 +44,7 @@ If you are new to Flux and GitOps it is important to understand that **all chang

 Hopefully some of this peeked your interests!

-If you are marching forward, now is a good time to choose whether you will deploy a Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos). Talos and k0s support was recently added so I would advise using k3s until those have been tested more however feel free to use Talos or k0s and report any issues that you find. Keep the one you decide in mind as you continue along, some steps may vary on what you choose.
+If you are marching forward, now is a good time to choose whether you will deploy a Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos). Talos and k0s support was recently added so I would advise using k3s until those have been tested more however feel free to use Talos or k0s and report any issues that you find. Keep the one you decide in mind as you continue along, some steps may vary on what you choose.

 ### System requirements

@@ -166,7 +169,7 @@ You have two different options for setting up your local workstation. First one

 1. Start Docker and open your repository in VSCode. There will be a pop-up asking you to use the `devcontainer`, click the button to start using it.

-2. Continue on to 🔧 [**Stage 3**](#-stage-3-do-bootstrap-configuration)
+2. Continue on to 🔧 [**Stage 3**](#-stage-3-bootstrap-configuration)

 #### Non-devcontainer method

@@ -199,7 +202,7 @@ You have two different options for setting up your local workstation. First one
    task workstation:brew
    # or, Arch with yay/paru
    task workstation:arch
-    # or, Generic Linux (this pulls binaires in to ./bin)
+    # or, Generic Linux (YMMV, this pulls binaires in to ./bin)
    task workstation:generic-linux
    ```

@@ -211,90 +214,80 @@ You have two different options for setting up your local workstation. First one
    task workstation:venv
    ```

-5. Continue on to 🔧 [**Stage 3**](#-stage-3-do-bootstrap-configuration)
+5. Continue on to 🔧 [**Stage 3**](#-stage-3-bootstrap-configuration)

-### 🔧 Stage 3: Do bootstrap configuration
+### 🔧 Stage 3: Bootstrap configuration

-📍 _The_ `bootstrap/vars/config.yaml` contain necessary information that is **vital** to the bootstrap process._
+> [!IMPORTANT]
+> The [config.sample.yaml](https://github.com/onedr0p/flux-cluster-template/blob/main/config.sample.yaml) file contain necessary information that is **vital** to the bootstrap process.

-1. Generate the `bootstrap/vars/config.yaml` configuration file.
+1. Generate the `config.yaml` from the [config.sample.yaml](https://github.com/onedr0p/flux-cluster-template/blob/main/config.sample.yaml) configuration file.

    ```sh
    task init
    ```

-2. Choose between `k3s` or `k0s` for your Kubernetes distribution and fillout the appropriate vars in `bootstrap/vars/config.yaml`
-
-3. Setup Age private / public key
+2. Setup Age private / public key (_**Skip if not using Flux**_)

    📍 _Using [SOPS](https://github.com/getsops/sops) with [Age](https://github.com/FiloSottile/age) allows us to encrypt secrets and use them in Ansible and Flux._

-    3a. Create a Age private / public key (this file is gitignored)
+    2a. Create a Age private / public key (this file is gitignored)

      ```sh
      task sops:age-keygen
      ```

-    3b. Fill out the appropriate vars in `bootstrap/vars/config.yaml`
+    2b. Fill out the appropriate vars in `config.yaml`

-4. Create Cloudflare API Token
+3. Create Cloudflare API Token (_**Skip if not using Cloudflare**_)

    📍 _To use `cert-manager` with the Cloudflare DNS challenge you will need to create a API Token._

-   4a. Head over to Cloudflare and create a API Token by going [here](https://dash.cloudflare.com/profile/api-tokens).
+   1. Head over to Cloudflare and create a API Token by going [here](https://dash.cloudflare.com/profile/api-tokens).
+   2. Under the `API Tokens` section click the blue `Create Token` button.
+   3. Click the blue `Use template` button for the `Edit zone DNS` template.
+   4. Name your token something like `home-kubernetes`
+   5. Under `Permissions`, click `+ Add More` and add each permission below:

-   4b. Under the `API Tokens` section click the blue `Create Token` button.
+      ```text
+      Zone - DNS - Edit
+      Account - Cloudflare Tunnel - Read
+      ```

-   4c. Click the blue `Use template` button for the `Edit zone DNS` template.
+   6. Limit the permissions to a specific account and zone resources.
+   7. Fill out the appropriate vars in `config.yaml`

-   4d. Name your token something like `home-kubernetes`
-
-   4e. Under `Permissions`, click `+ Add More` and add each permission below:
-
-    ```text
-    Zone - DNS - Edit
-    Account - Cloudflare Tunnel - Read
-    ```
-
-   4f. Limit the permissions to a specific account and zone resources.
-
-   4g. Fill out the appropriate vars in `bootstrap/vars/config.yaml`
-
-5. Create Cloudflare Tunnel
+4. Create Cloudflare Tunnel (_**Skip if not using Cloudflare**_)

    📍 _To expose services to the internet you will need to create a [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/)._

-    5a. Authenticate cloudflared to your domain
+    1. Authenticate cloudflared to your domain

-      ```sh
-      cloudflared tunnel login
-      ```
+        ```sh
+        cloudflared tunnel login
+        ```

-    5b. Create the tunnel
+    2. Create the tunnel

-      ```sh
-      cloudflared tunnel create k8s
-      ```
+        ```sh
+        cloudflared tunnel create k8s
+        ```

-    5c. In the `~/.cloudflared` directory there will be a json file with details you need. Ignore the `cert.pem` file.
+    3. In the `~/.cloudflared` directory there will be a json file with details you need. Ignore the `cert.pem` file.

-    5d. Fill out the appropriate vars in `bootstrap/vars/config.yaml`
+    4. Fill out the appropriate vars in `config.yaml`

-6. Complete filling out the rest of the `bootstrap/vars/config.yaml` configuration file.
+5. Complete filling out the rest of the `config.yaml` configuration file.

-    6a. Ensure `bootstrap_acme_production_enabled` is set to `false`.
-
-7. Once done run the following command which will verify and generate all the files needed to continue.
-
-    📍 _The following configure task will create a `./ansible` directory for k3s or k0s and the following directories under `./kubernetes` for all distributions_
+6. Once done run the following command which will verify and generate all the files needed to continue.

    ```sh
    task configure
    ```

-8. Push you changes to git
+7. Push you changes to git

-   📍 **Verify** all the `*.sops.yaml` and `*.sops.yaml` files under the `./ansible`, and `./kubernetes` directories are **encrypted** with SOPS
+   📍 **Verify** all the `*.sops.yaml` and `*.sops.yaml` files under `./kubernetes` directory is **encrypted** with SOPS

    ```sh
    git add -A
@@ -302,11 +295,11 @@ You have two different options for setting up your local workstation. First one
    git push
    ```

-9. Continue on to ⚡ [**Stage 4**](#-stage-4-prepare-your-nodes-for-kubernetes)
+8.  Continue on to ⚡ [**Stage 4**](#-stage-4-prepare-your-nodes-for-kubernetes)

 ### ⚡ Stage 4: Prepare your nodes for Kubernetes

-> [!NOTE]
+> [!IMPORTANT]
 > For **Talos** or **k0s** skip ahead to ⛵ [**Stage 5**](#-stage-5-install-kubernetes)

 #### k3s
@@ -401,7 +394,8 @@ You have two different options for setting up your local workstation. First one

 ### 🔹 Stage 6: Install Flux in your cluster

-📍 _Here we will be installing [flux](https://fluxcd.io/flux/) after some quick bootstrap steps._
+> [!IMPORTANT]
+> Skip this stage if you have **disabled** Flux in the `config.yaml`

 1. Verify Flux can be installed

@@ -433,7 +427,7 @@ You have two different options for setting up your local workstation. First one
    # source-controller-7d6875bcb4-zqw9f         1/1     Running   0          1h
    ```

-### 🎤 Verification Steps
+### 🎤 Flux w/ Cloudflare verification Steps

 _Mic check, 1, 2_ - In a few moments applications should be lighting up like Christmas in July 🎄

@@ -451,7 +445,7 @@ _Mic check, 1, 2_ - In a few moments applications should be lighting up like Chr

 4. 🧠 Now it's time to pause and go get some motel motor oil ☕ and admire you made it this far!

-## 📣 Post installation
+## 📣 Flux w/ Cloudflare post installation

 #### 🌐 Public DNS

@@ -504,7 +498,7 @@ By default Flux will periodically check your git repository for changes. In orde

 3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_flux_github_webhook_token` secret and save.

-#### 💥 Nuke
+## 💥 Nuke

 There might be a situation where you want to destroy your Kubernetes cluster. This will completely clean the OS of all traces of the Kubernetes distribution you chose and then reboot the nodes.

@@ -515,7 +509,7 @@ task ansible:run playbook=cluster-nuke
 task k0s:reset
 ```

-### 🤖 Renovate
+## 🤖 Renovate

 [Renovate](https://www.mend.io/renovate) is a tool that automates dependency management. It is designed to scan your repository around the clock and open PRs for out-of-date dependencies it finds. Common dependencies it can discover are Helm charts, container images, GitHub Actions, Ansible roles... even Flux itself! Merging a PR will cause Flux to apply the update to your cluster.

@@ -11,7 +11,7 @@ vars:
  SCRIPTS_DIR: "{{.ROOT_DIR}}/scripts"
  # Files
  AGE_FILE: "{{.ROOT_DIR}}/age.key"
-  BOOTSTRAP_CONFIG_FILE: "{{.BOOTSTRAP_DIR}}/vars/config.yaml"
+  BOOTSTRAP_CONFIG_FILE: "{{.ROOT_DIR}}/config.yaml"
  KUBECONFIG_FILE: "{{.ROOT_DIR}}/kubeconfig"
  MAKEJINJA_CONFIG_FILE: "{{.ROOT_DIR}}/makejinja.toml"
  PIP_REQUIREMENTS_FILE: "{{.ROOT_DIR}}/requirements.txt"
@@ -1,14 +1,8 @@
-from email_validator import validate_email, EmailNotValidError, EmailUndeliverableError
 from functools import wraps
 from shutil import which
-from typing import Callable, Optional
+from typing import Callable
 from zoneinfo import available_timezones
-import CloudFlare
-import json
 import netaddr
-import re
-import requests
-import socket
 import sys

 DISTRIBUTIONS = ["k0s", "k3s", "talos"]
@@ -25,54 +19,18 @@ def required(*keys: str):
                if data.get(key) is None:
                    raise ValueError(f"Missing required key {key}")
            return func(*[data[key] for key in keys], **kwargs)
-
        return wrapper
-
    return wrapper_outter


-def _validate_ip(ip: str) -> str:
+def _validate_network(network: str, family: int) -> str:
    try:
-        netaddr.IPAddress(ip)
-    except netaddr.core.AddrFormatError as e:
-        raise ValueError(f"Invalid IP address {ip}") from e
-    return ip
-
-
-def _validate_cidr(cidr: str, family: int) -> str:
-    try:
-        network = netaddr.IPNetwork(cidr)
+        network = netaddr.IPNetwork(network)
        if network.version != family:
-            raise ValueError(f"Invalid CIDR family {network.version}")
+            raise ValueError(f"Invalid network family {network.version}")
    except netaddr.core.AddrFormatError as e:
-        raise ValueError(f"Invalid CIDR {cidr}") from e
-    return cidr
-
-
-def _validate_distribution(distribution: str) -> None:
-    if distribution not in DISTRIBUTIONS:
-        raise ValueError(f"Invalid distribution {distribution}")
-    return distribution
-
-
-def _validate_node(node: dict, node_cidr: str, distribution: str) -> None:
-    if not node.get("name"):
-        raise ValueError(f"A node is missing a name")
-    if not node.get("ssh", {}).get("username") and distribution in ["k0s", "k3s"]:
-        raise ValueError(f"Node {node.get('name')} is missing a SSH username")
-    if not node.get("talos", {}).get("disk_device") and distribution in ["talos"]:
-        raise ValueError(f"Node {node.get('name')} is missing a disk device")
-    if not re.match(r"^[a-z0-9-\.]+$", node.get('name')):
-        raise ValueError(f"Node {node.get('name')} has an invalid name")
-    ip = _validate_ip(node.get("address"))
-    if netaddr.IPAddress(ip, 4) not in netaddr.IPNetwork(node_cidr):
-        raise ValueError(f"Node {node.get('name')} is not in the node CIDR {node_cidr}")
-    port = 50000 if distribution == "talos" else 22
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-        sock.settimeout(5)
-        result = sock.connect_ex((ip, port))
-        if result != 0:
-            raise ValueError(f"Node {node.get('name')} port {port} is not open")
+        raise ValueError(f"Invalid network {network}") from e
+    return network


 def validate_python_version() -> None:
@@ -81,188 +39,76 @@ def validate_python_version() -> None:
        raise ValueError(f"Python version is below 3.11. Please upgrade.")


-@required("bootstrap_distribution")
+@required("distribution")
 def validate_cli_tools(distribution: str, **_) -> None:
-    _distribution = _validate_distribution(distribution)
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")
    for tool in GLOBAL_CLI_TOOLS:
        if not which(tool):
            raise ValueError(f"Missing required CLI tool {tool}")
-    for tool in TALOS_CLI_TOOLS if _distribution in ["talos"] else []:
+    for tool in TALOS_CLI_TOOLS if distribution in ["talos"] else []:
        if not which(tool):
            raise ValueError(f"Missing required CLI tool {tool}")
-    for tool in K0S_CLI_TOOLS if _distribution in ["k0s"] else []:
+    for tool in K0S_CLI_TOOLS if distribution in ["k0s"] else []:
        if not which(tool):
            raise ValueError(f"Missing required CLI tool {tool}")


-@required("bootstrap_distribution")
+@required("distribution")
 def validate_distribution(distribution: str, **_) -> None:
-    _validate_distribution(distribution)
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")


-@required("bootstrap_github_username", "bootstrap_github_repository_name", "bootstrap_advanced_flags")
-def validate_github(username: str, repository: str, advanced_flags: dict, **_) -> None:
-    try:
-        request = requests.get(
-            f"https://api.github.com/repos/{username}/{repository}/branches/{advanced_flags.get('github_repository_branch', 'main')}")
-        if request.status_code != 200:
-            raise ValueError(
-                f"GitHub repository {username}/{repository} branch {advanced_flags.get('github_repository_branch', 'main')} not found")
-    except requests.exceptions.RequestException as e:
-        raise ValueError(
-            f"GitHub repository {username}/{repository} branch {advanced_flags.get('github_repository_branch', 'main')} not found") from e
-
-
-@required("bootstrap_age_public_key")
-def validate_age(key: str, **_) -> None:
-    if not re.match(r"^age1[a-z0-9]{0,58}$", key):
-        raise ValueError(f"Invalid Age public key {key}")
-
-
-@required("bootstrap_timezone")
+@required("timezone")
 def validate_timezone(timezone: str, **_) -> None:
    if timezone not in available_timezones():
        raise ValueError(f"Invalid timezone {timezone}")


-@required("bootstrap_cluster_cidr", "bootstrap_service_cidr", "bootstrap_advanced_flags")
-def validate_cluster_cidrs(cluster_cidr: str, service_cidr: str, advanced_flags: dict, **_) -> None:
-    dual_stack_ipv4_first = advanced_flags.get("dual_stack_ipv4_first", False)
+@required("cluster", "feature_gates")
+def validate_cluster_networks(cluster: dict, feature_gates: dict, **_) -> None:
+    dual_stack_ipv4_first = feature_gates.get("dual_stack_ipv4_first", False)
+    pod_network = cluster.get("pod_network")
+    service_network = cluster.get("service_network")

-    if cluster_cidr == service_cidr:
-        raise ValueError(f"Cluster CIDR {cluster_cidr} is the same as service CIDR {service_cidr}")
+    if pod_network == service_network:
+        raise ValueError(f"Pod network {pod_network} is the same as service network {service_network}")

    if dual_stack_ipv4_first:
-        if len(cluster_cidr.split(",")) != 2:
-            raise ValueError(f"Invalid cluster CIDR {cluster_cidr}")
-        if len(service_cidr.split(",")) != 2:
-            raise ValueError(f"Invalid service CIDR {service_cidr}")
-        cluster_ipv4, cluster_ipv6 = cluster_cidr.split(",")
-        _validate_cidr(cluster_ipv4, 4)
-        _validate_cidr(cluster_ipv6, 6)
-        service_ipv4, service_ipv6 = service_cidr.split(",")
-        _validate_cidr(service_ipv4, 4)
-        _validate_cidr(service_ipv6, 6)
+        if len(pod_network.split(",")) != 2:
+            raise ValueError(f"Invalid pod network {pod_network}")
+        if len(service_network.split(",")) != 2:
+            raise ValueError(f"Invalid service network {service_network}")
+        cluster_ipv4, cluster_ipv6 = pod_network.split(",")
+        _validate_network(cluster_ipv4, 4)
+        _validate_network(cluster_ipv6, 6)
+        service_ipv4, service_ipv6 = service_network.split(",")
+        _validate_network(service_ipv4, 4)
+        _validate_network(service_ipv6, 6)
        return

-    if len(cluster_cidr.split(",")) != 1:
-        raise ValueError(f"Invalid cluster CIDR {cluster_cidr}")
-    if len(service_cidr.split(",")) != 1:
-        raise ValueError(f"Invalid service CIDR {service_cidr}")
+    if len(pod_network.split(",")) != 1:
+        raise ValueError(f"Invalid pod network {pod_network}")
+    if len(service_network.split(",")) != 1:
+        raise ValueError(f"Invalid service network {service_network}")

-    _validate_cidr(cluster_cidr, 4)
-    _validate_cidr(service_cidr, 4)
+    _validate_network(pod_network, 4)
+    _validate_network(service_network, 4)


-@required("bootstrap_acme_email", "bootstrap_acme_production_enabled")
-def validate_acme_email(email: str, acme_production: bool, **_) -> None:
-    try:
-        validate_email(email)
-    except EmailUndeliverableError:
-        pass
-    except EmailNotValidError as e:
-        raise ValueError(f"Invalid ACME email {email}") from e
-
-
-@required("bootstrap_flux_github_webhook_token")
-def validate_flux_github_webhook_token(token: str, **_) -> None:
-    if not re.match(r"^[a-zA-Z0-9]+$", token):
-        raise ValueError(f"Invalid Flux GitHub webhook token ***")
-
-
-@required("bootstrap_cloudflare_domain", "bootstrap_cloudflare_token", "bootstrap_cloudflare_account_tag",
-          "bootstrap_cloudflare_tunnel_secret", "bootstrap_cloudflare_tunnel_id")
-def validate_cloudflare(domain: str, token: str, account_tag: str, tunnel_secret: str, tunnel_id: str, **_) -> None:
-    try:
-        cf = CloudFlare.CloudFlare(token=token)
-        zones = cf.zones.get(params={"name": domain})
-        if not zones:
-            raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it")
-    except CloudFlare.exceptions.CloudFlareAPIError as e:
-        raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it") from e
-    try:
-        request = requests.get(f"https://api.cloudflare.com/client/v4/accounts/{account_tag}/cfd_tunnel/{tunnel_id}",
-                               headers={"Authorization": f"Bearer {token}"})
-        if request.status_code != 200:
-            raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it")
-        if not json.loads(request.text)["success"]:
-            raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it")
-    except requests.exceptions.RequestException as e:
-        raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it") from e
-
-
-@required("bootstrap_dns_server")
-def validate_bootstrap_dns_server(dns_server: str, **_) -> None:
-    _validate_ip(dns_server)
-
-
-@required("bootstrap_node_cidr", "bootstrap_kube_api_addr", "bootstrap_k8s_gateway_addr",
-          "bootstrap_external_ingress_addr", "bootstrap_internal_ingress_addr")
-def validate_host_network(node_cidr: str, api_addr: str, gateway_addr: str, external_ingress_addr: str,
-                          internal_ingress_addr: str, **_) -> None:
-    _validate_cidr(node_cidr, 4)
-    _validate_ip(api_addr)
-    _validate_ip(gateway_addr)
-    _validate_ip(external_ingress_addr)
-    _validate_ip(internal_ingress_addr)
-
-    addrs = [api_addr, gateway_addr, external_ingress_addr, internal_ingress_addr]
-    unique = set(addrs)
-    if len(addrs) != len(unique):
-        raise ValueError(
-            f"{api_addr} and {gateway_addr} and {external_ingress_addr} and {internal_ingress_addr} are not unique")
-
-    node_cidr = netaddr.IPNetwork(node_cidr)
-    if netaddr.IPAddress(api_addr) not in node_cidr:
-        raise ValueError(f"Kubernetes API address {api_addr} is not in the node CIDR {node_cidr}")
-    if netaddr.IPAddress(gateway_addr) not in node_cidr:
-        raise ValueError(f"Kubernetes gateway address {gateway_addr} is not in the node CIDR {node_cidr}")
-    if netaddr.IPAddress(external_ingress_addr) not in node_cidr:
-        raise ValueError(
-            f"Kubernetes external ingress address {external_ingress_addr} is not in the node CIDR {node_cidr}")
-    if netaddr.IPAddress(internal_ingress_addr) not in node_cidr:
-        raise ValueError(
-            f"Kubernetes internal ingress address {internal_ingress_addr} is not in the node CIDR {node_cidr}")
-
-
-@required("bootstrap_node_cidr", "bootstrap_nodes", "bootstrap_distribution")
-def validate_nodes(node_cidr: str, nodes: dict[list], distribution: str, **_) -> None:
-    node_cidr = _validate_cidr(node_cidr, 4)
-
-    masters = nodes.get("master", [])
-    if len(masters) < 1:
-        raise ValueError(f"Must have at least one master node")
-    if len(masters) % 2 == 0:
-        raise ValueError(f"Must have an odd number of master nodes")
-    for node in masters:
-        _validate_node(node, node_cidr, distribution)
-
-    workers = nodes.get("worker", [])
-    for node in workers:
-        _validate_node(node, node_cidr, distribution)
-
-
-def massage(data: dict) -> dict:
-    data["bootstrap_advanced_flags"] = data.get("bootstrap_advanced_flags", {})
+def massage_config(data: dict) -> dict:
+    data["flux"] = data.get("flux", {})
+    data["cloudflare"] = data.get("cloudflare", {})
+    data["feature_gates"] = data.get("feature_gates", {})
    return data

+
 def validate(data: dict) -> None:
-    user_data = massage(data)
+    user_config = massage_config(data)

    validate_python_version()
-    validate_cli_tools(user_data)
-    validate_distribution(user_data)
-    validate_age(user_data)
-    validate_timezone(user_data)
-    validate_bootstrap_dns_server(user_data)
-    validate_cluster_cidrs(user_data)
-    validate_flux_github_webhook_token(user_data)
-    validate_host_network(user_data)
-    validate_acme_email(user_data)
-
-    if not user_data.get("bootstrap_private_github_repo"):
-        validate_github(user_data)
-
-    if not user_data.get("skip_tests", False):
-        validate_cloudflare(user_data)
-        validate_nodes(user_data)
+    validate_cli_tools(user_config)
+    validate_distribution(user_config)
+    validate_timezone(user_config)
+    validate_cluster_networks(user_config)
@@ -1,20 +1,22 @@
+#% if flux.enabled %#
 ---
 creation_rules:
-  #% if bootstrap_distribution in ['talos'] %#
+  #% if distribution in ['talos'] %#
  - # IMPORTANT: This rule MUST be above the others
    path_regex: talos/.*\.sops\.ya?ml
    key_groups:
      - age:
-          - "#{ bootstrap_age_public_key }#"
+          - "#{ flux.sops_age_public_key }#"
  #% endif %#
  - path_regex: kubernetes/.*\.sops\.ya?ml
    encrypted_regex: "^(data|stringData)$"
    key_groups:
      - age:
-          - "#{ bootstrap_age_public_key }#"
-  #% if bootstrap_distribution in ['k0s', 'k3s'] %#
+          - "#{ flux.sops_age_public_key }#"
+  #% if distribution in ['k0s', 'k3s'] %#
  - path_regex: ansible/.*\.sops\.ya?ml
    key_groups:
      - age:
-          - "#{ bootstrap_age_public_key }#"
+          - "#{ flux.sops_age_public_key }#"
  #% endif %#
+#% endif %#
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']
+main = lambda data: data.get("distribution") in ['k0s', 'k3s']
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']
+main = lambda data: data.get("distribution") in ['k0s', 'k3s']
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -2,7 +2,7 @@
 k3s_become: true
 k3s_etcd_datastore: true
 k3s_install_hard_links: true
-k3s_registration_address: "#{ bootstrap_kube_api_addr }#"
+k3s_registration_address: "#{ cluster.endpoint_vip }#"
 # renovate: datasource=github-releases depName=k3s-io/k3s
 k3s_release_version: v1.29.0+k3s1
 k3s_server_manifests_templates:
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -1,12 +1,12 @@
 ---
 k3s_control_node: true
 k3s_server:
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-  cluster-cidr: "#{ bootstrap_cluster_cidr.split(',')[0] }#,#{ bootstrap_cluster_cidr.split(',')[1] }#"
-  service-cidr: "#{ bootstrap_service_cidr.split(',')[0] }#,#{ bootstrap_service_cidr.split(',')[1] }#"
+  #% if feature_gates.dual_stack_ipv4_first %#
+  cluster-cidr: "#{ cluster.pod_network.split(',')[0] }#,#{ cluster.pod_network.split(',')[1] }#"
+  service-cidr: "#{ cluster.service_network.split(',')[0] }#,#{ cluster.service_network.split(',')[1] }#"
  #% else %#
-  cluster-cidr: "#{ bootstrap_cluster_cidr }#"
-  service-cidr: "#{ bootstrap_service_cidr }#"
+  cluster-cidr: "#{ cluster.pod_network }#"
+  service-cidr: "#{ cluster.service_network }#"
  #% endif %#
  disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
  disable-cloud-controller: true
@@ -24,7 +24,7 @@ k3s_server:
  kubelet-arg:
    - "image-gc-high-threshold=55"
    - "image-gc-low-threshold=50"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
  #% else %#
  node-ip: "{{ ansible_host }}"
@@ -32,8 +32,8 @@ k3s_server:
  pause-image: registry.k8s.io/pause:3.9
  secrets-encryption: true
  tls-san:
-    - "#{ bootstrap_kube_api_addr }#"
-    #% for item in bootstrap_kube_additional_tls_sans %#
+    - "#{ cluster.endpoint_vip }#"
+    #% for item in cluster.tls_sans %#
    - "{{ item }}"
    #% endfor %#
  write-kubeconfig-mode: "644"
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -4,7 +4,7 @@ k3s_agent:
  kubelet-arg:
    - "image-gc-high-threshold=55"
    - "image-gc-low-threshold=50"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if feature_gates.dual_stack_ipv4_first %#
  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
  #% else %#
  node-ip: "{{ ansible_host }}"
@@ -3,17 +3,21 @@ kubernetes:
  children:
    master:
      hosts:
-      #% for item in bootstrap_nodes.master %#
+        #% for item in cluster.nodes.inventory %#
+        #% if item.controller %#
        "#{ item.name }#":
-          ansible_user: "#{ item.ssh.username }#"
+          ansible_user: "#{ item.ssh_username }#"
          ansible_host: "#{ item.address }#"
-      #% endfor %#
-    #% if bootstrap_nodes.worker|length > 0 %#
+        #% endif %#
+        #% endfor %#
+    #% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %#
    worker:
      hosts:
-      #% for item in bootstrap_nodes.worker %#
+        #% for item in cluster.nodes.inventory %#
+        #% if not item.controller %#
        "#{ item.name }#":
-          ansible_user: "#{ item.ssh.username }#"
+          ansible_user: "#{ item.ssh_username }#"
          ansible_host: "#{ item.address }#"
-      #% endfor %#
+        #% endif %#
+        #% endfor %#
    #% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Cluster Installation
  hosts: kubernetes
@@ -10,7 +10,7 @@
      ansible.builtin.pause:
        seconds: 5
  tasks:
-    #% if bootstrap_distribution in ['k3s'] %#
+    #% if distribution in ['k3s'] %#
    - name: Ensure Kubernetes is running
      ansible.builtin.include_role:
        name: xanmanning.k3s
@@ -21,9 +21,9 @@
    - name: Upgrade kube-vip
      ansible.builtin.template:
        src: templates/kube-vip-ds.yaml.j2
-        #% if bootstrap_distribution in ['k3s'] %#
+        #% if distribution in ['k3s'] %#
        dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml"
-        #% elif bootstrap_distribution in ['k0s'] %#
+        #% elif distribution in ['k0s'] %#
        dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml"
        #% endif %#
        mode: preserve
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Cluster Nuke
  hosts: kubernetes
@@ -98,6 +98,6 @@

    - name: Reboot
      ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
        reboot_timeout: 3600
 #% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 ---
 - name: Prepare System
  hosts: kubernetes
@@ -16,7 +16,7 @@
      block:
        - name: Locale | Set timezone
          community.general.timezone:
-            name: "#{ bootstrap_timezone }#"
+            name: "#{ timezone }#"

    - name: Packages
      block:
@@ -46,7 +46,6 @@
              ff02::2 ip6-allrouters
            dest: /etc/hosts
            mode: preserve
-        #% if bootstrap_advanced_flags.update_resolv_conf|default(true) %#
        # https://github.com/onedr0p/flux-cluster-template/discussions/635
        - name: Network Configuration | Remove immutable flag from /etc/resolv.conf
          ansible.builtin.file:
@@ -63,9 +62,10 @@
            mode: '0644'
            dest: /etc/resolv.conf
            content: |
-              search .
-              nameserver #{ bootstrap_dns_server }#
-        #% endif %#
+              search #{ cluster.nodes.search_domain|default('.', true) }#
+              #% for item in cluster.nodes.dns_servers %#
+              nameserver #{ item }#
+              #% endfor %#

    - name: System Configuration
      notify: Reboot
@@ -110,6 +110,6 @@
  handlers:
    - name: Reboot
      ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
        reboot_timeout: 3600
 #% endif %#
@@ -11,5 +11,5 @@
  tasks:
    - name: Reboot
      ansible.builtin.reboot:
-        msg: Rebooting nodes
+        msg: Rebooting hosts
        reboot_timeout: 3600
@@ -12,9 +12,9 @@
        seconds: 5
  tasks:
    - name: Details
-      #% if bootstrap_distribution in ['k3s'] %#
+      #% if distribution in ['k3s'] %#
      ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
-      #% elif bootstrap_distribution in ['k0s'] %#
+      #% elif distribution in ['k0s'] %#
      ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json"
      #% endif %#
      register: kubectl_get_node
@@ -32,9 +32,9 @@
        - name: Cordon
          kubernetes.core.k8s_drain:
            name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution in ['k3s'] %#
+            #% if distribution in ['k3s'] %#
            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
            kubeconfig: /var/lib/k0s/pki/admin.conf
            #% endif %#
            state: cordon
@@ -43,9 +43,9 @@
        - name: Drain
          kubernetes.core.k8s_drain:
            name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution in ['k3s'] %#
+            #% if distribution in ['k3s'] %#
            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
            kubeconfig: /var/lib/k0s/pki/admin.conf
            #% endif %#
            state: drain
@@ -78,9 +78,9 @@
        - name: Uncordon
          kubernetes.core.k8s_drain:
            name: "{{ inventory_hostname }}"
-            #% if bootstrap_distribution  in ['k3s'] %#
+            #% if distribution  in ['k3s'] %#
            kubeconfig: /etc/rancher/k3s/k3s.yaml
-            #% elif bootstrap_distribution in ['k0s'] %#
+            #% elif distribution in ['k0s'] %#
            kubeconfig: /var/lib/k0s/pki/admin.conf
            #% endif %#
            state: uncordon
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k3s']
+main = lambda data: data.get("distribution") in ['k3s']
@@ -8,7 +8,7 @@ collections:
    version: 8.2.0
  - name: kubernetes.core
    version: 3.0.0
-#% if bootstrap_distribution in ['k3s'] %#
+#% if distribution in ['k3s'] %#
 roles:
  - name: xanmanning.k3s
    src: https://github.com/PyratLabs/ansible-role-k3s
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -1,23 +0,0 @@
-
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app cert-manager-issuers
-  namespace: flux-system
-spec:
-  targetNamespace: cert-manager
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager
-  path: ./kubernetes/apps/cert-manager/cert-manager-issuers/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -32,8 +32,3 @@ spec:
      nameservers:
        - "1.1.1.1"
        - "9.9.9.9"
-    prometheus:
-      enabled: true
-      servicemonitor:
-        enabled: true
-        prometheusInstance: observability
@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: cert-manager-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"
@@ -18,3 +18,27 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
+#% if cloudflare.enabled %#
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cert-manager-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager
+  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+#% endif %#
@@ -4,4 +4,3 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cert-manager/ks.yaml
-  - ./cert-manager-issuers/ks.yaml
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("github").get("webhook").get("enabled") == True
@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  - ./addons/ks.yaml
+  - ./webhooks/ks.yaml
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -21,3 +22,4 @@ spec:
  tls:
    - hosts:
        - *host
+#% endif %#
@@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
+  #% if cloudflare.enabled %#
  - ./ingress.yaml
+  #% endif %#
  - ./receiver.yaml
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: github-webhook-token-secret
 stringData:
-  token: "#{ bootstrap_flux_github_webhook_token }#"
+  token: "#{ flux.github.webhook.token }#"
@@ -9,7 +9,7 @@ spec:
  commonMetadata:
    labels:
      app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/flux-system/addons/webhooks
+  path: ./kubernetes/apps/flux-system/webhooks/app
  prune: true
  sourceRef:
    kind: GitRepository
@@ -6,7 +6,7 @@ metadata:
  name: policy
 spec:
  loadBalancerIPs: true
-  # NOTE: This might need to be set if you have more than one active NIC on your nodes
+  # NOTE: This might need to be set if you have more than one active NIC on your hosts
  # interfaces:
  #   - ^eno[0-9]+
  nodeSelector:
@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  #% if not bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if not feature_gates.dual_stack_ipv4_first %#
  - ./cilium-l2.yaml
  #% endif %#
  - ./helmrelease.yaml
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['talos']
+main = lambda data: data.get("distribution") in ['talos']
@@ -4,11 +4,11 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cilium/ks.yaml
-  #% if bootstrap_distribution in ['talos'] %#
+  #% if distribution in ['talos'] %#
  - ./kubelet-csr-approver/ks.yaml
  #% endif %#
  - ./metrics-server/ks.yaml
-  #% if bootstrap_distribution in ['k0s', 'talos'] %#
+  #% if distribution in ['k0s', 'talos'] %#
  - ./spegel/ks.yaml
  #% endif %#
  - ./reloader/ks.yaml
@@ -28,7 +28,3 @@ spec:
      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      - --kubelet-use-node-status-port
      - --metric-resolution=15s
-    metrics:
-      enabled: true
-    serviceMonitor:
-      enabled: true
@@ -26,6 +26,3 @@ spec:
    fullnameOverride: reloader
    reloader:
      readOnlyRootFileSystem: true
-      podMonitor:
-        enabled: true
-        namespace: "{{ .Release.Namespace }}"
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'talos']
+main = lambda data: data.get("distribution") in ['k0s', 'talos']
@@ -24,15 +24,13 @@ spec:
    keepHistory: false
  values:
    spegel:
-      #% if bootstrap_distribution in ['k0s'] %#
+      #% if distribution in ['k0s'] %#
      containerdSock: /run/k0s/containerd.sock
      containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
-      #% elif bootstrap_distribution in ['talos'] %#
+      #% elif distribution in ['talos'] %#
      containerdSock: /run/containerd/containerd.sock
      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
      #% endif %#
    service:
      registry:
        hostPort: 29999
-    serviceMonitor:
-      enabled: true
@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app certificates
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager-issuers
-  path: ./kubernetes/apps/network/certificates/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -82,9 +82,6 @@ spec:
        ports:
          http:
            port: *port
-    serviceMonitor:
-      main:
-        enabled: true
    persistence:
      config:
        enabled: true
@@ -4,10 +4,10 @@ kind: Secret
 metadata:
  name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
  credentials.json: |
    {
-      "AccountTag": "#{ bootstrap_cloudflare_account_tag }#",
-      "TunnelSecret": "#{ bootstrap_cloudflare_tunnel_secret }#",
-      "TunnelID": "#{ bootstrap_cloudflare_tunnel_id }#"
+      "AccountTag": "#{ cloudflare.tunnel.account_id }#",
+      "TunnelSecret": "#{ cloudflare.tunnel.secret }#",
+      "TunnelID": "#{ cloudflare.tunnel.id }#"
    }
@@ -10,7 +10,6 @@ spec:
    labels:
      app.kubernetes.io/name: *app
  dependsOn:
-    - name: certificates
    - name: external-dns
  path: ./kubernetes/apps/network/cloudflared/app
  prune: true
@@ -65,8 +65,6 @@ spec:
            port: *port
    ingress:
      main:
-        enabled: false
-      external:
        enabled: true
        className: external
        annotations:
@@ -41,7 +41,5 @@ spec:
    txtPrefix: k8s.
    txtOwnerId: default
    domainFilters: ["${SECRET_DOMAIN}"]
-    serviceMonitor:
-      enabled: true
    podAnnotations:
      secret.reloader.stakater.com/reload: external-dns-secret
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: external-dns-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./staging.yaml
-  #% if bootstrap_acme_production_enabled %#
+  #% if cloudflare.acme.production %#
  - ./production.yaml
  #% endif %#
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-external
+  name: ingress-nginx-external
 spec:
  interval: 30m
  chart:
@@ -26,13 +26,13 @@ spec:
    - name: cloudflared
      namespace: network
  values:
-    fullnameOverride: nginx-external
+    fullnameOverride: ingress-nginx-external
    controller:
      replicaCount: 1
      service:
        annotations:
          external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "#{ bootstrap_external_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: external
@@ -63,14 +63,8 @@ spec:
        proxy-body-size: 0
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
      extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -82,7 +76,7 @@ spec:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-external
+              app.kubernetes.io/instance: ingress-nginx-external
              app.kubernetes.io/component: controller
      resources:
        requests:
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-internal
+  name: ingress-nginx-internal
  namespace: network
 spec:
  interval: 30m
@@ -24,12 +24,12 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    fullnameOverride: nginx-internal
+    fullnameOverride: ingress-nginx-internal
    controller:
      replicaCount: 1
      service:
        annotations:
-          io.cilium/lb-ipam-ips: "#{ bootstrap_internal_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: internal
@@ -60,14 +60,8 @@ spec:
        proxy-body-size: 0
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
      extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -79,7 +73,7 @@ spec:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-internal
+              app.kubernetes.io/instance: ingress-nginx-internal
              app.kubernetes.io/component: controller
      resources:
        requests:
@@ -0,0 +1,66 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-certificates
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/network/ingress-nginx/certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-internal
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/internal
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-external
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/external
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -30,5 +30,5 @@ spec:
      type: LoadBalancer
      port: 53
      annotations:
-        io.cilium/lb-ipam-ips: "#{ bootstrap_k8s_gateway_addr }#"
+        io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#"
      externalTrafficPolicy: Cluster
@@ -3,10 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  - ./certificates/ks.yaml
  - ./cloudflared/ks.yaml
  - ./echo-server/ks.yaml
  - ./external-dns/ks.yaml
+  - ./ingress-nginx/ks.yaml
  - ./k8s-gateway/ks.yaml
-  - ./nginx-external/ks.yaml
-  - ./nginx-internal/ks.yaml
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-external
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-external/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-internal
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-internal/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -6,15 +6,13 @@ metadata:
  namespace: flux-system
 spec:
  interval: 30m
-  ref:
-    branch: "#{ bootstrap_advanced_flags.github_repository_branch|default('main', true) }#"
-  #% if bootstrap_private_github_repo %#
+  url: "#{ flux.github.address }#"
+  #% if flux.github.address.startswith('ssh://') %#
  secretRef:
    name: github-deploy-key
-  url: "ssh://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#"
-  #% else %#
-  url: "https://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#.git"
  #% endif %#
+  ref:
+    branch: "#{ flux.github.branch|default('main', true) }#"
  ignore: |
    # exclude all
    /*
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: backube
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://backube.github.io/helm-charts
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: bitnami
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://registry-1.docker.io/bitnamicharts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: coredns
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://coredns.github.io/helm
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: csi-driver-nfs
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: csi-driver-smb
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: descheduler
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubernetes-sigs.github.io/descheduler
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://kubernetes-sigs.github.io/external-dns
+#% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: grafana
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://grafana.github.io/helm-charts
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://kubernetes.github.io/ingress-nginx
+#% endif %#
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://ori-edge.github.io/k8s_gateway
+#% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: kubernetes-dashboard
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubernetes.github.io/dashboard
@@ -2,26 +2,20 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./backube.yaml
-  - ./bitnami.yaml
  - ./bjw-s.yaml
  - ./cilium.yaml
-  - ./coredns.yaml
-  - ./csi-driver-nfs.yaml
-  - ./csi-driver-smb.yaml
-  - ./descheduler.yaml
+  #% if cloudflare.enabled %#
  - ./external-dns.yaml
-  - ./grafana.yaml
  - ./ingress-nginx.yaml
-  - ./jetstack.yaml
  - ./k8s-gateway.yaml
-  - ./kubernetes-dashboard.yaml
-  - ./longhorn.yaml
+  #% endif %#
+  - ./jetstack.yaml
  - ./metrics-server.yaml
  - ./openebs.yaml
-  - ./piraeus.yaml
+  #% if distribution in ['talos'] %#
  - ./postfinance.yaml
-  - ./prometheus-community.yaml
+  #% endif %#
  - ./stakater.yaml
-  - ./weave-gitops.yaml
+  #% if distribution in ['k0s', 'talos'] %#
  - ./xenitab.yaml
+  #% endif %#
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: longhorn
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://charts.longhorn.io
@@ -1,9 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: piraeus
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://piraeus.io/helm-charts
@@ -1,3 +1,4 @@
+#% if distribution in ['talos'] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://postfinance.github.io/kubelet-csr-approver
+#% endif %#
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: prometheus-community
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/prometheus-community/charts
@@ -1,10 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: weave-gitops
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 5m
-  url: oci://ghcr.io/weaveworks/charts
@@ -1,3 +1,4 @@
+#% if distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,3 +9,4 @@ spec:
  type: oci
  interval: 5m
  url: oci://ghcr.io/xenitab/helm-charts
+#% endif %#
@@ -5,6 +5,9 @@ metadata:
  name: cluster-secrets
  namespace: flux-system
 stringData:
-  SECRET_DOMAIN: "#{ bootstrap_cloudflare_domain }#"
-  SECRET_ACME_EMAIL: "#{ bootstrap_acme_email }#"
-  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
+  #% if cloudflare.enabled %#
+  SECRET_DOMAIN: "#{ cloudflare.domain }#"
+  SECRET_ACME_EMAIL: "#{ cloudflare.acme.email }#"
+  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
+  #% endif %#
@@ -5,13 +5,9 @@ metadata:
  name: cluster-settings
  namespace: flux-system
 data:
-  TIMEZONE: "#{ bootstrap_timezone }#"
-  COREDNS_ADDR: "#{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }#"
-  KUBE_API_ADDR: "#{ bootstrap_kube_api_addr }#"
-  CLUSTER_CIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
-  SERVICE_CIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
-  NODE_CIDR: "#{ bootstrap_node_cidr }#"
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-  CLUSTER_CIDR_V6: "#{ bootstrap_cluster_cidr.split(',')[1] }#"
-  SERVICE_CIDR_V6: "#{ bootstrap_service_cidr.split(',')[1] }#"
+  TIMEZONE: "#{ timezone }#"
+  CLUSTER_CIDR: "#{ cluster.pod_network.split(',')[0] }#"
+  NODE_CIDR: "#{ cluster.nodes.host_network }#"
+  #% if feature_gates.dual_stack_ipv4_first %#
+  CLUSTER_CIDR_V6: "#{ cluster.pod_network.split(',')[1] }#"
  #% endif %#
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("flux").get("enabled") == True`
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("cloudflare").get("enabled") == True`