feat: migrate to python for data validation (#1214)

* feat: migrate to python for data validation

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: address PR comments

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: add unused kwargs to validate functions

Signed-off-by: Devin Buhl <devin@buhl.casa>

* chore: update renovate pip and ansible regex

Signed-off-by: Devin Buhl <devin@buhl.casa>

* feat: add bootstrap_nodes test

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: update taskfiles

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/scripts/loader.py

@@ -1,21 +1,40 @@
-import netaddr, bcrypt
+import bcrypt
+import netaddr
+
+import validation
 
 def nthhost(value: str, query: int) -> str:
     value = netaddr.IPNetwork(value)
-
     try:
         nth = int(query)
         if value.size > nth:
             return str(value[nth])
-
     except ValueError:
         return False
-
     return value
 
 def encrypt(value: str) -> str:
     return bcrypt.hashpw(value.encode(), bcrypt.gensalt(rounds=10)).decode("ascii")
 
 class Loader:
+    def __init__(self, data):
+        if data.get("skip_tests", False):
+            return
+        validation.validate_python_version()
+        validation.validate_cli_tools(data)
+        validation.validate_distribution(data)
+        validation.validate_github(data)
+        validation.validate_age(data)
+        validation.validate_timezone(data)
+        validation.validate_acme_email(data)
+        validation.validate_flux_github_webhook_token(data)
+        validation.validate_cloudflare(data)
+        validation.validate_host_network(data)
+        validation.validate_bootstrap_dns_server(data)
+        validation.validate_cilium_loadbalancer_mode(data)
+        validation.validate_local_storage_path(data)
+        validation.validate_cluster_cidrs(data)
+        validation.validate_nodes(data)
+
     def filters(self):
         return [nthhost, encrypt]

bootstrap/scripts/py_version_check.py

@@ -1,9 +0,0 @@
-import sys
-
-required_version = (3, 11, 0)
-
-if sys.version_info >= required_version:
-    print(f"Python version is greater than or equal to 3.11")
-else:
-    print("Python version is below 3.11. Please upgrade.")
-    exit(1)

bootstrap/scripts/validation.py

@@ -0,0 +1,215 @@
+from email_validator import validate_email, EmailNotValidError
+from functools import wraps
+from pathvalidate import is_valid_filepath, ValidationError
+from shutil import which
+from typing import Callable, Optional
+from zoneinfo import available_timezones
+import CloudFlare
+import netaddr
+import re
+import requests
+import socket
+import sys
+
+DISTRIBUTIONS             = ["k0s", "k3s", "talos"]
+CILIUM_LOADBALANCER_MODES = ["dsr", "snat"]
+GLOBAL_CLI_TOOLS          = ["age", "cloudflared", "flux", "sops", "jq", "kubeconform", "kustomize"]
+TALOS_CLI_TOOLS           = ["talosctl", "talhelper"]
+K0S_CLI_TOOLS             = ["k0sctl"]
+
+def required(*keys: str):
+    def wrapper_outter(func: Callable):
+        @wraps(func)
+        def wrapper(data: dict, *args, **kwargs) -> None:
+            for key in keys:
+                if data.get(key) is None:
+                    raise ValueError(f"Missing required key {key}")
+            return func(*[data[key] for key in keys], **kwargs)
+        return wrapper
+    return wrapper_outter
+
+def _validate_ip(ip: str) -> str:
+    try:
+        netaddr.IPAddress(ip)
+    except netaddr.core.AddrFormatError as e:
+        raise ValueError(f"Invalid IP address {ip}") from e
+    return ip
+
+def _validate_cidr(cidr: str, family: int) -> str:
+    try:
+        network = netaddr.IPNetwork(cidr)
+        if network.version != family:
+            raise ValueError(f"Invalid CIDR family {network.version}")
+    except netaddr.core.AddrFormatError as e:
+        raise ValueError(f"Invalid CIDR {cidr}") from e
+    return cidr
+
+def _validate_distribution(distribution: str) -> None:
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")
+    return distribution
+
+def _validate_node(node: dict, node_cidr: str, distribution: str) -> None:
+    if not node.get("name"):
+        raise ValueError(f"Node {node.get('name')} is missing a name")
+    if not node.get("username") and distribution not in ["k0s", "k3s"]:
+        raise ValueError(f"Node {node.get('username')} is missing a username")
+    if not node.get("diskSerial") and distribution in ["talos"]:
+        raise ValueError(f"Node {node.get('diskSerial')} is missing a disk serial")
+    ip = _validate_ip(node.get("address"))
+    if netaddr.IPAddress(ip, 4) not in netaddr.IPNetwork(node_cidr):
+        raise ValueError(f"Node {node.get('address')} is not in the node CIDR {node_cidr}")
+    port = 50000 if distribution == "talos" else 22
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.settimeout(5)
+        result = sock.connect_ex((ip, port))
+        if result != 0:
+            raise ValueError(f"Node {ip} port {port} is not open")
+
+def validate_python_version() -> None:
+    required_version = (3, 11, 0)
+    if sys.version_info < required_version:
+        raise ValueError(f"Python version is below 3.11. Please upgrade.")
+
+@required("bootstrap_distribution")
+def validate_cli_tools(distribution: str, **_) -> None:
+    distro = _validate_distribution(distribution)
+    for tool in GLOBAL_CLI_TOOLS:
+        if not which(tool):
+            raise ValueError(f"Missing required CLI tool {tool}")
+    for tool in TALOS_CLI_TOOLS if distro == "talos" else []:
+        if not which(tool):
+            raise ValueError(f"Missing required CLI tool {tool}")
+    for tool in K0S_CLI_TOOLS if distro == "k0s" else []:
+        if not which(tool):
+            raise ValueError(f"Missing required CLI tool {tool}")
+
+@required("bootstrap_distribution")
+def validate_distribution(distribution: str, **_) -> None:
+    _validate_distribution(distribution)
+
+@required("bootstrap_github_username", "bootstrap_github_repository_name", "bootstrap_github_repository_branch")
+def validate_github(username: str, repository: str, branch: str, **_) -> None:
+    try:
+        request = requests.get(f"https://api.github.com/repos/{username}/{repository}/branches/{branch}")
+        if request.status_code != 200:
+            raise ValueError(f"GitHub repository {username}/{repository} branch {branch} not found")
+    except requests.exceptions.RequestException as e:
+        raise ValueError(f"GitHub repository {username}/{repository} branch {branch} not found") from e
+
+@required("bootstrap_age_public_key")
+def validate_age(key: str, **_) -> None:
+    if not re.match(r"^age1[a-z0-9]{0,58}$", key):
+        raise ValueError(f"Invalid Age public key {key}")
+
+@required("bootstrap_timezone")
+def validate_timezone(timezone: str, **_) -> None:
+    if not timezone in available_timezones():
+        raise ValueError(f"Invalid timezone {timezone}")
+
+@required("bootstrap_ipv6_enabled", "bootstrap_cluster_cidr", "bootstrap_service_cidr")
+def validate_cluster_cidrs(ipv6_enabled: bool, cluster_cidr: str, service_cidr: str, **_) -> None:
+    if not isinstance(ipv6_enabled, bool):
+        raise ValueError(f"Invalid IPv6 enabled {ipv6_enabled}")
+
+    if cluster_cidr == service_cidr:
+        raise ValueError(f"Cluster CIDR {cluster_cidr} is the same as service CIDR {service_cidr}")
+
+    if ipv6_enabled:
+        if len(cluster_cidr.split(",")) != 2:
+            raise ValueError(f"Invalid cluster CIDR {cluster_cidr}")
+        if len(service_cidr.split(",")) != 2:
+            raise ValueError(f"Invalid service CIDR {service_cidr}")
+        cluster_ipv4, cluster_ipv6 = cluster_cidr.split(",")
+        _validate_cidr(cluster_ipv4, 4)
+        _validate_cidr(cluster_ipv6, 6)
+        service_ipv4, service_ipv6 = service_cidr.split(",")
+        _validate_cidr(service_ipv4, 4)
+        _validate_cidr(service_ipv6, 6)
+        return
+
+    if len(cluster_cidr.split(",")) != 1:
+        raise ValueError(f"Invalid cluster CIDR {cluster_cidr}")
+    if len(service_cidr.split(",")) != 1:
+        raise ValueError(f"Invalid service CIDR {service_cidr}")
+
+    _validate_cidr(cluster_cidr, 4)
+    _validate_cidr(service_cidr, 4)
+
+@required("bootstrap_acme_email", "bootstrap_acme_production_enabled")
+def validate_acme_email(email: str, acme_production: bool, **_) -> None:
+    try:
+        validate_email(email)
+    except EmailNotValidError as e:
+        raise ValueError(f"Invalid ACME email {email}") from e
+
+@required("bootstrap_flux_github_webhook_token")
+def validate_flux_github_webhook_token(token: str, **_) -> None:
+    if not re.match(r"^[a-zA-Z0-9]+$", token):
+        raise ValueError(f"Invalid Flux GitHub webhook token ***")
+
+@required("bootstrap_cloudflare_domain", "bootstrap_cloudflare_token", "bootstrap_cloudflare_account_tag", "bootstrap_cloudflare_tunnel_secret", "bootstrap_cloudflare_tunnel_id")
+def validate_cloudflare(domain: str, token: str, account_tag: str, tunnel_secret: str, tunnel_id: str, **_) -> None:
+    try:
+      cf = CloudFlare.CloudFlare(token=token)
+      zones = cf.zones.get(params={"name": domain})
+      if not zones:
+          raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it")
+    except CloudFlare.exceptions.CloudFlareAPIError as e:
+      raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it") from e
+
+@required("bootstrap_cilium_loadbalancer_mode")
+def validate_cilium_loadbalancer_mode(mode: str, **_) -> None:
+    if mode not in CILIUM_LOADBALANCER_MODES:
+        raise ValueError(f"Invalid Cilium load balancer mode {mode}")
+
+@required("bootstrap_local_storage_path")
+def validate_local_storage_path(path: str, **_) -> None:
+    try:
+        if not is_valid_filepath(path, platform="linux"):
+            raise ValueError(f"Invalid local storage path {path}")
+    except ValidationError as e:
+        raise ValueError(f"Invalid local storage path {path}") from e
+
+@required("bootstrap_dns_server")
+def validate_bootstrap_dns_server(dns_server: str, **_) -> None:
+    _validate_ip(dns_server)
+
+@required("bootstrap_node_cidr", "bootstrap_kube_api_addr", "bootstrap_k8s_gateway_addr", "bootstrap_external_ingress_addr", "bootstrap_internal_ingress_addr")
+def validate_host_network(node_cidr: str, api_addr: str, gateway_addr: str, external_ingress_addr: str, internal_ingress_addr: str, **_) -> None:
+    _validate_cidr(node_cidr, 4)
+    _validate_ip(api_addr)
+    _validate_ip(gateway_addr)
+    _validate_ip(external_ingress_addr)
+    _validate_ip(internal_ingress_addr)
+
+    addrs = [api_addr, gateway_addr, external_ingress_addr, internal_ingress_addr]
+    unique = set(addrs)
+    if len(addrs) != len(unique):
+        raise ValueError(f"{api_addr} and {gateway_addr} and {external_ingress_addr} and {internal_ingress_addr} are not unique")
+
+    node_cidr = netaddr.IPNetwork(node_cidr)
+    if netaddr.IPAddress(api_addr) not in node_cidr:
+        raise ValueError(f"Kubernetes API address {api_addr} is not in the node CIDR {node_cidr}")
+    if netaddr.IPAddress(gateway_addr) not in node_cidr:
+        raise ValueError(f"Kubernetes gateway address {gateway_addr} is not in the node CIDR {node_cidr}")
+    if netaddr.IPAddress(external_ingress_addr) not in node_cidr:
+        raise ValueError(f"Kubernetes external ingress address {external_ingress_addr} is not in the node CIDR {node_cidr}")
+    if netaddr.IPAddress(internal_ingress_addr) not in node_cidr:
+        raise ValueError(f"Kubernetes internal ingress address {internal_ingress_addr} is not in the node CIDR {node_cidr}")
+
+@required("bootstrap_node_cidr", "bootstrap_nodes", "bootstrap_distribution")
+def validate_nodes(node_cidr: str, nodes: dict[list], distribution: str, **_) -> None:
+    node_cidr = _validate_cidr(node_cidr, 4)
+
+    masters = nodes.get("master", [])
+    if len(masters) < 1:
+        raise ValueError(f"Must have at least one master node")
+    if len(masters) % 2 == 0:
+        raise ValueError(f"Must have an odd number of master nodes")
+    for node in masters:
+        _validate_node(node, node_cidr, distribution)
+
+    workers = nodes.get("worker", [])
+    for node in workers:
+        _validate_node(node, node_cidr, distribution)

bootstrap/tasks/validation/age.yaml

@@ -1,21 +0,0 @@
----
-- name: Query age key file
-  ansible.builtin.stat:
-    path: "{{ repository_path }}/age.key"
-  register: result
-
-- name: Check if age key file exists
-  ansible.builtin.assert:
-    that: result.stat.exists
-    success_msg: Age file {{ repository_path }}/age.key exists
-    fail_msg: Age file {{ repository_path }}/age.key does not exist
-
-- name: Query age key file contents
-  ansible.builtin.set_fact:
-    age_contents: "{{ lookup('file', repository_path + '/age.key') }}"
-
-- name: Check if age public keys match
-  ansible.builtin.assert:
-    that: bootstrap_age_public_key in age_contents
-    success_msg: Age public key {{ bootstrap_age_public_key }} exists
-    fail_msg: Age public key {{ bootstrap_age_public_key }} does not exist

bootstrap/tasks/validation/cli.yaml

@@ -1,26 +0,0 @@
----
-- name: Check if required CLI tools are present
-  ansible.builtin.shell: command -v {{ item }} >/dev/null 2>&1
-  loop: ["age", "cloudflared", "flux", "sops", "jq", "kubeconform", "kustomize"]
-  changed_when: false
-  check_mode: false
-  register: result
-  failed_when: result.rc != 0 and result.rc != 127
-
-- name: Check if required CLI tools are present for k0s
-  when: bootstrap_distribution == "k0s"
-  ansible.builtin.shell: command -v {{ item }} >/dev/null 2>&1
-  loop: ["k0sctl"]
-  changed_when: false
-  check_mode: false
-  register: result
-  failed_when: result.rc != 0 and result.rc != 127
-
-- name: Check if required CLI tools are present for talos
-  when: bootstrap_distribution == "talos"
-  ansible.builtin.shell: command -v {{ item }} >/dev/null 2>&1
-  loop: ["talhelper", "talosctl"]
-  changed_when: false
-  check_mode: false
-  register: result
-  failed_when: result.rc != 0 and result.rc != 127

bootstrap/tasks/validation/cloudflare.yaml

@@ -1,38 +0,0 @@
----
-- name: Query Cloudflare zone
-  when: not ci_test|default(false)
-  ansible.builtin.uri:
-    url: https://api.cloudflare.com/client/v4/zones?name={{ bootstrap_cloudflare_domain }}&status=active
-    headers:
-      Authorization: Bearer {{ bootstrap_cloudflare_token }}
-      Content-Type: application/json
-    timeout: 5
-    return_content: true
-    body_format: json
-  register: result
-
-- name: Check if Cloudflare zone exists
-  when: not ci_test|default(false)
-  ansible.builtin.assert:
-    that: result.json.success is true
-    success_msg: Cloudflare zone {{ bootstrap_cloudflare_domain }} exists
-    fail_msg: Cloudflare zone {{ bootstrap_cloudflare_domain }} does not exist
-
-- name: Query Cloudflared tunnel
-  when: not ci_test|default(false)
-  ansible.builtin.uri:
-    url: https://api.cloudflare.com/client/v4/accounts/{{ bootstrap_cloudflare_account_tag }}/cfd_tunnel/{{ bootstrap_cloudflare_tunnel_id }}
-    headers:
-      Authorization: Bearer {{ bootstrap_cloudflare_token }}
-      Content-Type: application/json
-    timeout: 5
-    return_content: true
-    body_format: json
-  register: result
-
-- name: Check if Cloudflared tunnel exists
-  when: not ci_test|default(false)
-  ansible.builtin.assert:
-    that: result.json.success is true
-    success_msg: Cloudflared tunnel {{ bootstrap_cloudflare_tunnel_id }} exists
-    fail_msg: Cloudflared tunnel {{ bootstrap_cloudflare_tunnel_id }} does not exist

bootstrap/tasks/validation/github.yaml

@@ -1,48 +0,0 @@
----
-- name: Query Github username
-  when: not ci_test|default(false)
-  ansible.builtin.uri:
-    url: https://api.github.com/users/{{ bootstrap_github_username }}
-    timeout: 5
-    return_content: true
-    body_format: json
-  register: result
-
-- name: Check if username exists
-  when: not ci_test|default(false)
-  ansible.builtin.assert:
-    that: result.json.login == bootstrap_github_username
-    success_msg: Github user {{ bootstrap_github_username }} exists
-    fail_msg: Github user {{ bootstrap_github_username }} does not exist
-
-- name: Query Github repo
-  when: (not ci_test|default(false)) and (not bootstrap_private_github_repo|default(false))
-  ansible.builtin.uri:
-    url: https://api.github.com/repos/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}
-    timeout: 5
-    return_content: true
-    body_format: json
-  register: result
-
-- name: Check if repo exists
-  when: (not ci_test|default(false)) and (not bootstrap_private_github_repo|default(false))
-  ansible.builtin.assert:
-    that: result.json.full_name == bootstrap_github_username + '/' + bootstrap_github_repository_name
-    success_msg: Github repo {{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }} exists
-    fail_msg: Github repo {{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }} does not exist
-
-- name: Query Github repo branch
-  when: (not ci_test|default(false)) and (not bootstrap_private_github_repo|default(false))
-  ansible.builtin.uri:
-    url: https://api.github.com/repos/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}/branches/{{ bootstrap_github_repository_branch|default('main', true) }}
-    timeout: 5
-    return_content: true
-    body_format: json
-  register: result
-
-- name: Check if repo branch exists
-  when: (not ci_test|default(false)) and (not bootstrap_private_github_repo|default(false))
-  ansible.builtin.assert:
-    that: result.json.name == bootstrap_github_repository_branch|default('main', true)
-    success_msg: Github repo branch {{ bootstrap_github_repository_branch|default('main', true) }} exists
-    fail_msg: Github repo branch {{ bootstrap_github_repository_branch|default('main', true) }} does not exist

bootstrap/tasks/validation/main.yaml

@@ -1,6 +0,0 @@
----
-- name: Verify configuration
-  ansible.builtin.include_tasks: "{{ task }}.yaml"
-  loop: [vars, age, cli, net, cloudflare, github]
-  loop_control:
-    loop_var: task

bootstrap/tasks/validation/net.yaml

@@ -1,214 +0,0 @@
----
-- name: Check if master node count is odd
-  ansible.builtin.assert:
-    that:
-      - bootstrap_nodes.master | length > 0
-      - bootstrap_nodes.master | length is odd
-    success_msg: Master node count {{ bootstrap_nodes.master | length }} is correct.
-    fail_msg: Master node count {{ bootstrap_nodes.master | length }} is not greater than 0 or is not odd.
-
-- name: Check if node CIDR is ipv4
-  ansible.builtin.assert:
-    that: bootstrap_node_cidr is ansible.utils.ipv4
-    success_msg: Node CIDR {{ bootstrap_node_cidr }} is valid.
-    fail_msg: Node CIDR {{ bootstrap_node_cidr }} is invalid.
-
-- name: Check if cluster CIDR is ipv4 OR ipv6
-  when: not bootstrap_ipv6_enabled|default(false)
-  ansible.builtin.assert:
-    that: bootstrap_cluster_cidr is ansible.utils.ipv4 or bootstrap_cluster_cidr is ansible.utils.ipv6
-    success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
-    fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.
-
-- name: Check if service CIDR is ipv4 OR ipv6
-  when: not bootstrap_ipv6_enabled|default(false)
-  ansible.builtin.assert:
-    that: bootstrap_service_cidr is ansible.utils.ipv4 or bootstrap_service_cidr is ansible.utils.ipv6
-    success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
-    fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.
-
-- name: Check if cluster CIDR is ipv4 AND ipv6
-  when: bootstrap_ipv6_enabled|default(false)
-  ansible.builtin.assert:
-    that: >
-      (
-        bootstrap_cluster_cidr.split(',')[0] is ansible.utils.ipv4 or
-          bootstrap_cluster_cidr.split(',')[1] is ansible.utils.ipv4
-      ) and (
-        bootstrap_cluster_cidr.split(',')[1] is ansible.utils.ipv6 or
-          bootstrap_cluster_cidr.split(',')[0] is ansible.utils.ipv6
-      )
-    success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
-    fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.
-
-- name: Check if service CIDR is ipv4 AND ipv6
-  when: bootstrap_ipv6_enabled|default(false)
-  ansible.builtin.assert:
-    that: >
-      (
-        bootstrap_service_cidr.split(',')[0] is ansible.utils.ipv4 or
-          bootstrap_service_cidr.split(',')[1] is ansible.utils.ipv4
-      ) and (
-        bootstrap_service_cidr.split(',')[1] is ansible.utils.ipv6 or
-          bootstrap_service_cidr.split(',')[0] is ansible.utils.ipv6
-      )
-    success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
-    fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.
-
-- name: Check if k8s_gateway is ipv4
-  ansible.builtin.assert:
-    that: bootstrap_k8s_gateway_addr is ansible.utils.ipv4
-    success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is valid.
-    fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is invalid.
-
-- name: Check if k8s_gateway is in node CIDR
-  ansible.builtin.assert:
-    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_k8s_gateway_addr)
-    success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is within {{ bootstrap_node_cidr }}.
-    fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is not within {{ bootstrap_node_cidr }}.
-
-- name: Check if internal ingress is ipv4
-  ansible.builtin.assert:
-    that: bootstrap_internal_ingress_addr is ansible.utils.ipv4
-    success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is valid.
-    fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is invalid.
-
-- name: Check if internal ingress is in node CIDR
-  ansible.builtin.assert:
-    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_internal_ingress_addr)
-    success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is within {{ bootstrap_node_cidr }}.
-    fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is not within {{ bootstrap_node_cidr }}.
-
-- name: Check if external ingress is ipv4
-  ansible.builtin.assert:
-    that: bootstrap_external_ingress_addr is ansible.utils.ipv4
-    success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is valid.
-    fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is invalid.
-
-- name: Check external ingress is in node CIDR
-  ansible.builtin.assert:
-    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_external_ingress_addr)
-    success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is within {{ bootstrap_node_cidr }}.
-    fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is not within {{ bootstrap_node_cidr }}.
-
-- name: Check if Kube API address is ipv4
-  ansible.builtin.assert:
-    that: bootstrap_kube_api_addr is ansible.utils.ipv4
-    success_msg: Kube API address {{ bootstrap_kube_api_addr }} is valid.
-    fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is invalid.
-
-- name: Check if Kube API address is in node CIDR
-  ansible.builtin.assert:
-    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kube_api_addr)
-    success_msg: Kube API address {{ bootstrap_kube_api_addr }} is within {{ bootstrap_node_cidr }}.
-    fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is not within {{ bootstrap_node_cidr }}.
-
-- name: Check if DNS server is ipv4
-  ansible.builtin.assert:
-    that: bootstrap_dns_server is ansible.utils.ipv4
-    success_msg: DNS server {{ bootstrap_dns_server }} is valid.
-    fail_msg: DNS server {{ bootstrap_dns_server }} is invalid.
-
-- name: Check if all IP addresses are unique
-  ansible.builtin.assert:
-    that: >
-      [
-        bootstrap_k8s_gateway_addr,
-        bootstrap_external_ingress_addr,
-        bootstrap_internal_ingress_addr,
-        bootstrap_kube_api_addr
-      ] | unique | length == 4
-    success_msg: All IP addresses are unique.
-    fail_msg: All IP addresses are not unique.
-
-- name: Check if nodes are not the same IPs as k8s_gateway or ingress external/internal
-  when: not bootstrap_kube_vip_enabled|default(true)
-  ansible.builtin.assert:
-    that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr)
-    success_msg: Node address {{ item.address }} is different than k8s_gateway or ingress-nginx.
-    fail_msg: Node address {{ item.address }} is not different than k8s_gateway or ingress-nginx.
-    quiet: true
-  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker|default([]) }}"
-  loop_control:
-    label: "{{ item.address }}"
-
-- name: Check if nodes are not the same IPs as k8s_gateway, ingress external/internal or Kube API address
-  when: (bootstrap_distribution == "k3s") and (bootstrap_kube_vip_enabled|default(true))
-  ansible.builtin.assert:
-    that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kube_api_addr)
-    success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or Kube API.
-    fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or Kube API.
-    quiet: true
-  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker|default([]) }}"
-  loop_control:
-    label: "{{ item.address }}"
-
-- name: Check if node addresses are ipv4
-  ansible.builtin.assert:
-    that: item.address is ansible.utils.ipv4
-    success_msg: Node address {{ item.address }} is valid.
-    fail_msg: Node address {{ item.address }} is invalid.
-    quiet: true
-  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker|default([]) }}"
-  loop_control:
-    label: "{{ item.address }}"
-
-- name: Check if node addresses are in node CIDR
-  ansible.builtin.assert:
-    that: bootstrap_node_cidr | ansible.utils.network_in_usable(item.address)
-    success_msg: Node address {{ item.address }} is within {{ bootstrap_node_cidr }}.
-    fail_msg: Node address {{ item.address }} is not within {{ bootstrap_node_cidr }}.
-    quiet: true
-  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker|default([]) }}"
-  loop_control:
-    label: "{{ item.address }}"
-
-- name: Check if node IP addresses are unique
-  ansible.builtin.assert:
-    that: >
-      (
-        (bootstrap_nodes.master + bootstrap_nodes.worker|default([])) | map(attribute='address') | list
-      ) | unique | length
-      ==
-      (
-        (bootstrap_nodes.master + bootstrap_nodes.worker|default([])) | map(attribute='address') | list
-      ) | length
-    success_msg: All node IP addresses are unique.
-    fail_msg: All node IP addresses are not unique.
-    quiet: true
-
-- name: Check if node names are unique
-  ansible.builtin.assert:
-    that: >
-      (
-        (bootstrap_nodes.master + bootstrap_nodes.worker|default([])) | map(attribute='name') | list
-      ) | unique | length
-      ==
-      (
-        (bootstrap_nodes.master + bootstrap_nodes.worker|default([])) | map(attribute='name') | list
-      ) | length
-    success_msg: All node names are unique.
-    fail_msg: All node names are not unique.
-    quiet: true
-
-- name: Check if SSH ports are reachable
-  when: (not ci_test|default(false)) and (not bootstrap_distribution == "talos")
-  ansible.builtin.wait_for:
-    host: "{{ item.address }}"
-    port: 22
-    timeout: 10
-  connection: local
-  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker|default([]) }}"
-  loop_control:
-    label: "{{ item.address }}"
-
-- name: Check if Talos ports are reachable
-  when: (not ci_test|default(false)) and (bootstrap_distribution == "talos")
-  ansible.builtin.wait_for:
-    host: "{{ item.address }}"
-    port: 50000
-    timeout: 10
-  connection: local
-  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker|default([]) }}"
-  loop_control:
-    label: "{{ item.address }}"

bootstrap/tasks/validation/vars.yaml

@@ -1,48 +0,0 @@
----
-- name: Check if required bootstrap vars are set
-  ansible.builtin.assert:
-    that:
-      - item in vars
-      - vars[item] != None
-    success_msg: Required bootstrap var {{ item }} exists and is defined
-    fail_msg: Required bootstrap var {{ item }} does not exists or is not defined
-  loop:
-    - bootstrap_acme_email
-    - bootstrap_age_public_key
-    - bootstrap_cilium_loadbalancer_mode
-    - bootstrap_cloudflare_account_tag
-    - bootstrap_cloudflare_domain
-    - bootstrap_cloudflare_token
-    - bootstrap_cloudflare_tunnel_id
-    - bootstrap_cloudflare_tunnel_secret
-    - bootstrap_cluster_cidr
-    - bootstrap_distribution
-    - bootstrap_dns_server
-    - bootstrap_external_ingress_addr
-    - bootstrap_flux_github_webhook_token
-    - bootstrap_github_repository_branch
-    - bootstrap_github_repository_name
-    - bootstrap_github_username
-    - bootstrap_internal_ingress_addr
-    - bootstrap_ipv6_enabled
-    - bootstrap_k8s_gateway_addr
-    - bootstrap_kube_api_addr
-    - bootstrap_local_storage_path
-    - bootstrap_node_cidr
-    - bootstrap_service_cidr
-    - bootstrap_timezone
-
-- name: Check if bootstrap distribution is valid
-  ansible.builtin.assert:
-    that: bootstrap_distribution in ['k0s', 'k3s', 'talos']
-    success_msg: Distribution {{ bootstrap_distribution }} is valid
-    fail_msg: Distribution {{ bootstrap_distribution }} is not valid
-
-- name: Check if bootstrap node names are valid
-  ansible.builtin.assert:
-    that: item.name is match('^[a-z0-9-\.]+$')
-    success_msg: Node name {{ item.name }} is valid
-    fail_msg: Node name {{ item.name }} is not valid
-  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker|default([]) }}"
-  loop_control:
-    label: "{{ item.name }}"

bootstrap/templates/ansible/requirements.txt.j2

@@ -0,0 +1,7 @@
+#% if bootstrap_distribution in ['k3s', 'k0s'] %#
+# Ansible
+ansible-lint==6.22.2
+ansible==9.1.0
+jmespath==1.0.1
+openshift==0.13.2
+#% endif %#

bootstrap/templates/ansible/requirements.yaml.j2

@@ -0,0 +1,18 @@
+#% if bootstrap_distribution in ['k3s', 'k0s'] %#
+---
+collections:
+  - name: ansible.posix
+    version: 1.5.4
+  - name: ansible.utils
+    version: 3.0.0
+  - name: community.general
+    version: 8.2.0
+  - name: kubernetes.core
+    version: 3.0.0
+#% if bootstrap_distribution == 'k3s' %#
+roles:
+  - name: xanmanning.k3s
+    src: https://github.com/PyratLabs/ansible-role-k3s
+    version: v3.4.3
+#% endif %#
+#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2

@@ -8,6 +8,6 @@ resources:
   - ./kubelet-csr-approver/ks.yaml
   #% endif %#
   - ./metrics-server/ks.yaml
-  #% if bootstrap_distribution in ['k0s', 'talos'] and spegel|default({}) and spegel.enabled|default(false) %#
+  #% if bootstrap_distribution in ['k0s', 'talos'] and spegel.enabled %#
   - ./spegel/ks.yaml
   #% endif %#

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] and spegel|default({}) and spegel.enabled|default(false) %#
+#% if bootstrap_distribution in ['k0s', 'talos'] and spegel.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/kustomization.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] and spegel|default({}) and spegel.enabled|default(false) %#
+#% if bootstrap_distribution in ['k0s', 'talos'] and spegel.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/kubernetes/apps/kube-system/spegel/ks.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] and spegel|default({}) and spegel.enabled|default(false) %#
+#% if bootstrap_distribution in ['k0s', 'talos'] and spegel.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2

@@ -37,7 +37,7 @@ spec:
           before:
             - sudo bash /home/#{ item.username }#/k0s/hooks/apply-system.sh
             - sudo mv /home/#{ item.username }#/k0s/containerd/unprivileged-ports.toml /etc/k0s/containerd.d/unprivileged-ports.toml
-            #% if spegel|default({}) and spegel.enabled|default(false) %#
+            #% if spegel.enabled %#
             - sudo mv /home/#{ item.username }#/k0s/containerd/spegel.toml /etc/k0s/containerd.d/spegel.toml
             #% endif %#
         reset:

bootstrap/templates/kubernetes/k0s/resources/containerd/spegel.toml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == 'k0s' and spegel|default({}) and spegel.enabled|default(false) %#
+#% if bootstrap_distribution == 'k0s' and spegel.enabled %#
 [plugins."io.containerd.grpc.v1.cri".registry]
   config_path = "/var/lib/k0s/containerd/certs.d"
 [plugins."io.containerd.grpc.v1.cri".containerd]

bootstrap/templates/kubernetes/talos/talconfig.yaml.j2

@@ -77,7 +77,7 @@ controlPlane:
               [plugins."io.containerd.grpc.v1.cri"]
                 enable_unprivileged_ports = true
                 enable_unprivileged_icmp = true
-              #% if spegel|default({}) and spegel.enabled|default(false) %#
+              #% if spegel.enabled %#
               [plugins."io.containerd.grpc.v1.cri".containerd]
                 discard_unpacked_layers = false
               [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]

bootstrap/validate.yaml

@@ -1,28 +0,0 @@
----
-- name: Cluster Installation
-  hosts: localhost
-  connection: local
-  gather_facts: false
-  vars_files:
-    - vars/config.yaml
-    - vars/addons.yaml
-  tasks:
-    - name: Get absolute path to this Git repository # noqa: command-instead-of-module
-      ansible.builtin.command: git rev-parse --show-toplevel
-      changed_when: false
-      check_mode: false
-      register: repository
-      failed_when: repository.rc != 0
-
-    - name: Set facts
-      ansible.builtin.set_fact:
-        repository_path: "{{ repository.stdout }}"
-
-    - name: Override Kube API address when there is a single master node and no address is defined
-      when: bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr
-      ansible.builtin.set_fact:
-        bootstrap_kube_vip_enabled: false
-        bootstrap_kube_api_addr: "{{ bootstrap_nodes.master[0].address }}"
-
-    - name: Verify configuration
-      ansible.builtin.include_tasks: tasks/validation/main.yaml