From c17d543b21ba71e3371efce15285860295b5c97d Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Feb 2024 20:03:24 -0500 Subject: [PATCH] refactor!: project updates (#1326) * refactor!: flux is required again Signed-off-by: Devin Buhl * fix: delimiter that chomps Signed-off-by: Devin Buhl * fix: bootstrap_cloudflare logic Signed-off-by: Devin Buhl * fix: update tests Signed-off-by: Devin Buhl * fix: remove last quote Signed-off-by: Devin Buhl * chore: update readme Signed-off-by: Devin Buhl --------- Signed-off-by: Devin Buhl --- .devcontainer/ci/features/install.sh | 3 +- .gitattributes | 1 - .github/tests/config-k3s-ipv4.yaml | 66 ++-- .github/tests/config-k3s-ipv6.yaml | 68 ++--- .github/tests/config-talos.yaml | 69 ++--- .taskfiles/Flux/Taskfile.yaml | 4 +- .taskfiles/Kubernetes/Taskfile.yaml | 5 +- .taskfiles/Talos/Taskfile.yaml | 19 +- .taskfiles/Workstation/Archfile | 1 + .taskfiles/Workstation/Brewfile | 1 + .taskfiles/Workstation/Taskfile.yaml | 1 + LICENSE | 2 +- README.md | 44 +-- bootstrap/scripts/validation.py | 77 +---- bootstrap/templates/.sops.yaml.j2 | 16 +- bootstrap/templates/ansible/.mjfilter.py | 2 +- .../group_vars/controllers/main.yaml.j2 | 32 +- .../group_vars/kubernetes/main.yaml.j2 | 2 +- .../inventory/group_vars/workers/.mjfilter.py | 4 +- .../inventory/group_vars/workers/main.yaml.j2 | 10 +- .../templates/ansible/inventory/hosts.yaml.j2 | 32 +- .../playbooks/cluster-installation.yaml.j2 | 6 +- .../playbooks/cluster-kube-vip.yaml.j2 | 2 +- .../ansible/playbooks/cluster-nuke.yaml.j2 | 10 +- .../ansible/playbooks/cluster-prepare.yaml.j2 | 26 +- .../playbooks/cluster-rollout-update.yaml.j2 | 16 +- .../ansible/playbooks/tasks/cruft.yaml.j2 | 10 +- .../playbooks/tasks/kubeconfig.yaml.j2 | 6 +- .../playbooks/tasks/version-check.yaml.j2 | 5 +- .../templates/custom-cilium-helmchart.yaml.j2 | 6 +- .../playbooks/templates/kube-vip-ds.yaml.j2 | 2 +- .../playbooks/templates/kube-vip-rbac.yaml.j2 | 2 +- .../templates/kubernetes/apps/.mjfilter.py | 1 - .../cert-manager/issuers/.mjfilter.py | 2 +- .../cert-manager/issuers/secret.sops.yaml.j2 | 2 +- .../apps/cert-manager/cert-manager/ks.yaml.j2 | 4 +- .../apps/flux-system/kustomization.yaml.j2 | 2 - .../apps/flux-system/webhooks/.mjfilter.py | 6 - .../webhooks/app/github/ingress.yaml.j2 | 4 +- .../webhooks/app/github/kustomization.yaml.j2 | 4 +- .../webhooks/app/github/secret.sops.yaml.j2 | 2 +- .../kube-system/cilium/app/cilium-bgp.yaml.j2 | 30 +- .../cilium/app/helmrelease.yaml.j2 | 6 +- .../cilium/app/kustomization.yaml.j2 | 9 +- .../kubelet-csr-approver/.mjfilter.py | 2 +- .../app/helmrelease.yaml.j2 | 6 +- .../apps/kube-system/kustomization.yaml.j2 | 8 +- .../reloader/app/helmrelease.yaml.j2 | 2 +- .../apps/kube-system/spegel/.mjfilter.py | 2 +- .../kubernetes/apps/network/.mjfilter.py | 2 +- .../cloudflared/app/secret.sops.yaml.j2 | 8 +- .../echo-server/app/helmrelease.yaml.j2 | 4 +- .../external-dns/app/secret.sops.yaml.j2 | 2 +- .../certificates/kustomization.yaml.j2 | 4 +- .../external/helmrelease.yaml.j2 | 8 +- .../internal/helmrelease.yaml.j2 | 8 +- .../k8s-gateway/app/helmrelease.yaml.j2 | 2 +- .../apps/system-upgrade/k3s/.mjfilter.py | 2 +- .../apps/system-upgrade/kustomization.yaml.j2 | 12 +- .../system-upgrade-controller/.mjfilter.py | 2 +- .../app/rbac.yaml.j2 | 4 +- .../apps/system-upgrade/talos/.mjfilter.py | 6 +- .../system-upgrade/talos/app/plan.yaml.j2 | 2 +- .../kubernetes/bootstrap/.mjfilter.py | 1 - .../{ => flux}/github-deploy-key.sops.yaml.j2 | 10 +- .../{ => flux}/kustomization.yaml.j2 | 0 .../kubernetes/bootstrap/talos/.mjfilter.py | 1 + .../talos/apps/cilium-values.yaml.j2 | 4 + .../bootstrap/talos/apps/helmfile.yaml.j2 | 22 ++ .../apps/kubelet-csr-approver-values.yaml.j2 | 4 + .../{ => bootstrap}/talos/talconfig.yaml.j2 | 122 ++++---- .../templates/kubernetes/flux/.mjfilter.py | 1 - .../kubernetes/flux/config/cluster.yaml.j2 | 8 +- .../repositories/helm/external-dns.yaml.j2 | 4 +- .../repositories/helm/ingress-nginx.yaml.j2 | 4 +- .../repositories/helm/k8s-gateway.yaml.j2 | 4 +- .../repositories/helm/kustomization.yaml.j2 | 12 +- .../repositories/helm/postfinance.yaml.j2 | 4 +- .../flux/repositories/helm/xenitab.yaml.j2 | 4 +- .../flux/vars/cluster-secrets.sops.yaml.j2 | 10 +- .../flux/vars/cluster-settings.yaml.j2 | 18 +- .../templates/kubernetes/talos/.mjfilter.py | 1 - .../kubernetes/talos/cilium/.gitignore.j2 | 1 - .../talos/cilium/kustomization.yaml.j2 | 15 - .../kubernetes/talos/cilium/values.yaml.j2 | 4 - .../talos/kubelet-csr-approver/.gitignore.j2 | 1 - .../kustomization.yaml.j2 | 19 -- .../cilium-values-full.partial.yaml.j2 | 34 +-- .../cilium-values-init.partial.yaml.j2 | 32 +- .../partials/kube-vip-ds.partial.yaml.j2 | 2 +- ...ubelet-csr-approver-values.partial.yaml.j2 | 2 +- config.sample.yaml | 282 +++++++++--------- makejinja.toml | 12 +- 93 files changed, 591 insertions(+), 755 deletions(-) delete mode 100644 bootstrap/templates/kubernetes/apps/.mjfilter.py delete mode 100644 bootstrap/templates/kubernetes/apps/flux-system/webhooks/.mjfilter.py delete mode 100644 bootstrap/templates/kubernetes/bootstrap/.mjfilter.py rename bootstrap/templates/kubernetes/bootstrap/{ => flux}/github-deploy-key.sops.yaml.j2 (86%) rename bootstrap/templates/kubernetes/bootstrap/{ => flux}/kustomization.yaml.j2 (100%) create mode 100644 bootstrap/templates/kubernetes/bootstrap/talos/.mjfilter.py create mode 100644 bootstrap/templates/kubernetes/bootstrap/talos/apps/cilium-values.yaml.j2 create mode 100644 bootstrap/templates/kubernetes/bootstrap/talos/apps/helmfile.yaml.j2 create mode 100644 bootstrap/templates/kubernetes/bootstrap/talos/apps/kubelet-csr-approver-values.yaml.j2 rename bootstrap/templates/kubernetes/{ => bootstrap}/talos/talconfig.yaml.j2 (62%) delete mode 100644 bootstrap/templates/kubernetes/flux/.mjfilter.py delete mode 100644 bootstrap/templates/kubernetes/talos/.mjfilter.py delete mode 100644 bootstrap/templates/kubernetes/talos/cilium/.gitignore.j2 delete mode 100644 bootstrap/templates/kubernetes/talos/cilium/kustomization.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/talos/cilium/values.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/talos/kubelet-csr-approver/.gitignore.j2 delete mode 100644 bootstrap/templates/kubernetes/talos/kubelet-csr-approver/kustomization.yaml.j2 diff --git a/.devcontainer/ci/features/install.sh b/.devcontainer/ci/features/install.sh index a41d9ab1..82bd4162 100644 --- a/.devcontainer/ci/features/install.sh +++ b/.devcontainer/ci/features/install.sh @@ -24,6 +24,7 @@ for app in \ "direnv/direnv!!?as=direnv&type=script" \ "fluxcd/flux2!!?as=flux&type=script" \ "go-task/task!!?as=task&type=script" \ + "helmfile/helmfile!!?as=helmfile&type=script" \ "kubecolor/kubecolor!!?as=kubecolor&type=script" \ "kubernetes-sigs/krew!!?as=krew&type=script" \ "kubernetes-sigs/kustomize!!?as=kustomize&type=script" \ @@ -40,7 +41,7 @@ done mkdir -p /home/vscode/.config/fish/{completions,conf.d} # Setup autocompletions for fish -for tool in cilium flux helm k9s kubectl kustomize talhelper talosctl; do +for tool in cilium flux helm helmfile k9s kubectl kustomize talhelper talosctl; do $tool completion fish > /home/vscode/.config/fish/completions/$tool.fish done gh completion --shell fish > /home/vscode/.config/fish/completions/gh.fish diff --git a/.gitattributes b/.gitattributes index 07f507f7..56ac7921 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,4 +1,3 @@ * text=auto eol=lf *.yaml.j2 linguist-language=YAML *.sops.* diff=sopsdiffer -*.sops.toml linguist-language=JSON diff --git a/.github/tests/config-k3s-ipv4.yaml b/.github/tests/config-k3s-ipv4.yaml index 606b4587..7948fee5 100644 --- a/.github/tests/config-k3s-ipv4.yaml +++ b/.github/tests/config-k3s-ipv4.yaml @@ -1,46 +1,32 @@ --- skip_tests: true -distribution: - type: k3s - -timezone: Etc/UTC - -nodes: - host_network: 10.10.10.0/24 - dns_servers: ["1.1.1.1"] - search_domain: "fake" - inventory: - - name: k8s-controller-0 - address: 10.10.10.100 - controller: true - ssh_username: fake - - name: k8s-worker-0 - address: 10.10.10.101 - controller: false - ssh_username: fake - - -cluster: - pod_network: 10.69.0.0/16 - service_network: 10.96.0.0/16 - endpoint_vip: 10.10.10.254 - tls_sans: ["fake"] - -flux: - enabled: true - github: - username: onedr0p - address: https://github.com/onedr0p/cluster-template - branch: main - webhook: - enabled: true - token: fake - private: - enabled: false - sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY - -cloudflare: +bootstrap_timezone: Etc/UTC +bootstrap_distribution: k3s +bootstrap_node_network: 10.10.10.0/24 +bootstrap_node_default_gateway: 10.10.10.1 +bootstrap_node_inventory: + - name: k8s-controller-0 + address: 10.10.10.100 + controller: true + ssh_user: fake + - name: k8s-worker-0 + address: 10.10.10.101 + controller: false + ssh_user: fake +bootstrap_dns_servers: ["1.1.1.1"] +bootstrap_search_domain: "fake" +bootstrap_pod_network: 10.69.0.0/16 +bootstrap_service_network: 10.96.0.0/16 +bootstrap_controllers_vip: 10.10.10.254 +bootstrap_tls_sans: ["fake"] +bootstrap_sops_age_pubkey: $BOOTSTRAP_AGE_PUBLIC_KEY +bootstrap_bgp: + enabled: false +bootstrap_github_address: https://github.com/onedr0p/cluster-template +bootstrap_github_branch: main +bootstrap_github_webhook_token: fake +bootstrap_cloudflare: enabled: true domain: fake token: take diff --git a/.github/tests/config-k3s-ipv6.yaml b/.github/tests/config-k3s-ipv6.yaml index f97137e2..5efa50c6 100644 --- a/.github/tests/config-k3s-ipv6.yaml +++ b/.github/tests/config-k3s-ipv6.yaml @@ -1,45 +1,32 @@ --- skip_tests: true -distribution: - type: k3s - -timezone: Etc/UTC - -nodes: - host_network: 10.10.10.0/24 - dns_servers: ["1.1.1.1"] - search_domain: "fake" - inventory: - - name: k8s-controller-0 - address: 10.10.10.100 - controller: true - ssh_username: fake - - name: k8s-worker-0 - address: 10.10.10.101 - controller: false - ssh_username: fake - -cluster: - pod_network: 10.42.0.0/16,fd7f:8f5:e87c:a::/64 - service_network: 10.43.0.0/16,fd7f:8f5:e87c:e::/112 - endpoint_vip: 10.10.10.254 - tls_sans: ["fake"] - -flux: - enabled: true - github: - username: onedr0p - address: https://github.com/onedr0p/cluster-template - branch: main - webhook: - enabled: true - token: fake - private: - enabled: false - sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY - -cloudflare: +bootstrap_timezone: Etc/UTC +bootstrap_distribution: k3s +bootstrap_node_network: 10.10.10.0/24 +bootstrap_node_default_gateway: 10.10.10.1 +bootstrap_node_inventory: + - name: k8s-controller-0 + address: 10.10.10.100 + controller: true + ssh_user: fake + - name: k8s-worker-0 + address: 10.10.10.101 + controller: false + ssh_user: fake +bootstrap_dns_servers: ["1.1.1.1"] +bootstrap_search_domain: "fake" +bootstrap_pod_network: 10.42.0.0/16,fd7f:8f5:e87c:a::/64 +bootstrap_service_network: 10.43.0.0/16,fd7f:8f5:e87c:e::/112 +bootstrap_controllers_vip: 10.10.10.254 +bootstrap_tls_sans: ["fake"] +bootstrap_sops_age_pubkey: $BOOTSTRAP_AGE_PUBLIC_KEY +bootstrap_bgp: + enabled: false +bootstrap_github_address: https://github.com/onedr0p/cluster-template +bootstrap_github_branch: main +bootstrap_github_webhook_token: fake +bootstrap_cloudflare: enabled: true domain: fake token: take @@ -53,6 +40,3 @@ cloudflare: ingress_vip: 10.10.10.252 ingress_vip: 10.10.10.251 gateway_vip: 10.10.10.253 - -feature_gates: - dual_stack_ipv4_first: true diff --git a/.github/tests/config-talos.yaml b/.github/tests/config-talos.yaml index ab1ea628..545a5469 100644 --- a/.github/tests/config-talos.yaml +++ b/.github/tests/config-talos.yaml @@ -1,47 +1,34 @@ --- skip_tests: true -distribution: - type: talos - talos: - schematicID: "df491c50a5acc05b977ef00c32050e1ceb0df746e40b33c643ac8a9bfb7c7263" - -timezone: Etc/UTC - -nodes: - host_network: 10.10.10.0/24 - dns_servers: ["1.1.1.1"] - search_domain: "fake" - inventory: - - name: k8s-controller-0 - address: 10.10.10.100 - controller: true - talos_disk_device: fake - - name: k8s-worker-0 - address: 10.10.10.101 - controller: false - talos_disk_device: fake - -cluster: - pod_network: 10.69.0.0/16 - service_network: 10.96.0.0/16 - endpoint_vip: 10.10.10.254 - tls_sans: ["fake"] - -flux: - enabled: true - github: - username: onedr0p - address: https://github.com/onedr0p/cluster-template - branch: main - webhook: - enabled: true - token: fake - private: - enabled: false - sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY - -cloudflare: +bootstrap_timezone: Etc/UTC +bootstrap_distribution: talos +boostrap_talos: + schematic_id: "df491c50a5acc05b977ef00c32050e1ceb0df746e40b33c643ac8a9bfb7c7263" +bootstrap_node_network: 10.10.10.0/24 +bootstrap_node_default_gateway: 10.10.10.1 +bootstrap_node_inventory: + - name: k8s-controller-0 + address: 10.10.10.100 + controller: true + talos_disk: fake + - name: k8s-worker-0 + address: 10.10.10.101 + controller: false + talos_disk: fake +bootstrap_dns_servers: ["1.1.1.1"] +bootstrap_search_domain: "fake" +bootstrap_pod_network: 10.69.0.0/16 +bootstrap_service_network: 10.96.0.0/16 +bootstrap_controllers_vip: 10.10.10.254 +bootstrap_tls_sans: ["fake"] +bootstrap_sops_age_pubkey: $BOOTSTRAP_AGE_PUBLIC_KEY +bootstrap_bgp: + enabled: false +bootstrap_github_address: https://github.com/onedr0p/cluster-template +bootstrap_github_branch: main +bootstrap_github_webhook_token: fake +bootstrap_cloudflare: enabled: true domain: fake token: take diff --git a/.taskfiles/Flux/Taskfile.yaml b/.taskfiles/Flux/Taskfile.yaml index 22f49fc5..62815435 100644 --- a/.taskfiles/Flux/Taskfile.yaml +++ b/.taskfiles/Flux/Taskfile.yaml @@ -7,7 +7,7 @@ vars: PROMETHEUS_OPERATOR_VERSION: v0.71.2 CLUSTER_SECRET_SOPS_FILE: "{{.KUBERNETES_DIR}}/flux/vars/cluster-secrets.sops.yaml" CLUSTER_SETTINGS_FILE: "{{.KUBERNETES_DIR}}/flux/vars/cluster-settings.yaml" - GITHUB_DEPLOY_KEY_FILE: "{{.KUBERNETES_DIR}}/bootstrap/github-deploy-key.sops.yaml" + GITHUB_DEPLOY_KEY_FILE: "{{.KUBERNETES_DIR}}/bootstrap/flux/github-deploy-key.sops.yaml" tasks: @@ -18,7 +18,7 @@ tasks: - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_scrapeconfigs.yaml - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml - - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --kustomize {{.KUBERNETES_DIR}}/bootstrap + - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --kustomize {{.KUBERNETES_DIR}}/bootstrap/flux - cat {{.AGE_FILE}} | kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename - - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename {{.CLUSTER_SETTINGS_FILE}} diff --git a/.taskfiles/Kubernetes/Taskfile.yaml b/.taskfiles/Kubernetes/Taskfile.yaml index 2f410cde..e4f52e0c 100644 --- a/.taskfiles/Kubernetes/Taskfile.yaml +++ b/.taskfiles/Kubernetes/Taskfile.yaml @@ -26,10 +26,7 @@ tasks: kubeconform: desc: Validate Kubernetes manifests with kubeconform - cmd: | - if [ -d "{{.KUBERNETES_DIR}}/flux" ]; then - bash {{.KUBECONFORM_SCRIPT}} {{.KUBERNETES_DIR}} - fi + cmd: bash {{.KUBECONFORM_SCRIPT}} {{.KUBERNETES_DIR}} preconditions: - { msg: "Missing kubeconform script", sh: "test -f {{.KUBECONFORM_SCRIPT}}" } diff --git a/.taskfiles/Talos/Taskfile.yaml b/.taskfiles/Talos/Taskfile.yaml index aa25bfb5..6ad1a58a 100644 --- a/.taskfiles/Talos/Taskfile.yaml +++ b/.taskfiles/Talos/Taskfile.yaml @@ -3,7 +3,7 @@ version: "3" vars: - TALOS_DIR: "{{.KUBERNETES_DIR}}/talos" + TALOS_DIR: "{{.KUBERNETES_DIR}}/bootstrap/talos" TALHELPER_SECRET_FILE: "{{.TALOS_DIR}}/talhelper.sops.yaml" TALHELPER_CONFIG_FILE: "{{.TALOS_DIR}}/talconfig.yaml" @@ -21,7 +21,7 @@ tasks: - task: bootstrap-apply - task: bootstrap-install - task: fetch-kubeconfig - - task: bootstrap-core-apps + - task: bootstrap-apps - talosctl health --server=false bootstrap-gensecret: @@ -61,14 +61,13 @@ tasks: preconditions: - { msg: "Missing talhelper config file", sh: "test -f {{.TALHELPER_CONFIG_FILE}}" } - bootstrap-core-apps: - desc: Bootstrap Helm apps + bootstrap-apps: + desc: Bootstrap core apps needed for Talos dir: "{{.TALOS_DIR}}" cmds: - - until kubectl wait --for=condition=Ready=False nodes --all --timeout=600s; do sleep 10; done - - kubectl --kubeconfig {{.KUBECONFIG_FILE}} kustomize --enable-helm ./cilium | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename - - - kubectl --kubeconfig {{.KUBECONFIG_FILE}} kustomize --enable-helm ./kubelet-csr-approver | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename - - - until kubectl wait --for=condition=Ready nodes --all --timeout=600s; do sleep 10; done + - until kubectl --kubeconfig {{.KUBECONFIG_FILE}} wait --for=condition=Ready=False nodes --all --timeout=600s; do sleep 10; done + - helmfile --file ./apps/helmfile.yaml apply + - until kubectl --kubeconfig {{.KUBECONFIG_FILE}} wait --for=condition=Ready nodes --all --timeout=600s; do sleep 10; done preconditions: - { msg: "Missing kubeconfig", sh: "test -f {{.KUBECONFIG_FILE}}" } @@ -95,13 +94,13 @@ tasks: soft-nuke: desc: Resets nodes back to maintenance mode so you can re-deploy again straight after - prompt: "This will destroy your cluster and reset the nodes back to maintenance mode. Are you sure?" + prompt: This will destroy your cluster and reset the nodes back to maintenance mode... continue? dir: "{{.TALOS_DIR}}" cmd: talhelper gencommand reset --extra-flags "--reboot --system-labels-to-wipe STATE --system-labels-to-wipe EPHEMERAL --graceful=false --wait=false" | bash hard-nuke: desc: Resets nodes back completely and reboots them - prompt: "This will destroy your cluster and reset the nodes. Are you sure?" + prompt: This will destroy your cluster and reset the nodes... continue? dir: "{{.TALOS_DIR}}" cmd: talhelper gencommand reset --extra-flags "--reboot --graceful=false --wait=false" | bash diff --git a/.taskfiles/Workstation/Archfile b/.taskfiles/Workstation/Archfile index 419895de..b1ad3160 100644 --- a/.taskfiles/Workstation/Archfile +++ b/.taskfiles/Workstation/Archfile @@ -5,6 +5,7 @@ flux-bin go-task go-yq helm +helmfile jq kubeconform kubectl-bin diff --git a/.taskfiles/Workstation/Brewfile b/.taskfiles/Workstation/Brewfile index 82f85c60..0d31dc67 100644 --- a/.taskfiles/Workstation/Brewfile +++ b/.taskfiles/Workstation/Brewfile @@ -7,6 +7,7 @@ brew "direnv" brew "fluxcd/tap/flux" brew "go-task/tap/go-task" brew "helm" +brew "helmfile" brew "jq" brew "kubeconform" brew "kubernetes-cli" diff --git a/.taskfiles/Workstation/Taskfile.yaml b/.taskfiles/Workstation/Taskfile.yaml index 98ad2460..09f309f6 100644 --- a/.taskfiles/Workstation/Taskfile.yaml +++ b/.taskfiles/Workstation/Taskfile.yaml @@ -56,6 +56,7 @@ tasks: - FiloSottile/age?as=age&type=script - fluxcd/flux2?as=flux&type=script - getsops/sops?as=sops&type=script + - helmfile/helmfile?as=helmfile&type=script - jqlang/jq?as=jq&type=script - kubernetes-sigs/kustomize?as=kustomize&type=script - siderolabs/talos?as=talosctl&type=script diff --git a/LICENSE b/LICENSE index 38d60cac..ab784ede 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2023 onedr0p +Copyright (c) 2024 onedr0p Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/README.md b/README.md index afec752c..6185cd0f 100644 --- a/README.md +++ b/README.md @@ -6,17 +6,12 @@ At a high level this project makes use of [makejinja](https://github.com/mirkole ## ✨ Features -The features included will depend on the type of configuration you want to use. There are currently **3 different types** of **configurations** available with this template. +The features included will depend on the type of configuration you want to use. There are currently **2 different types** of **configurations** available with this template. -1. **"Bare cluster"** - a Kubernetes distribution of your choosing: [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos) +1. **"Flux cluster"** - a Kubernetes distribution of your choosing: [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos). Deploys an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as the Git provider and [sops](https://github.com/getsops/sops) to manage secrets. - - **Required:** Debian 12 or Talos Linux installed on bare metal (or VMs) and some knowledge of [Containers](https://opencontainers.org/) and [YAML](https://yaml.org/). - - **Components:** [Cilium](https://github.com/cilium/cilium) and [kube-vip](https://github.com/kube-vip/kube-vip) _(k3s)_ - -2. **"Flux cluster"** - An addition to "**Bare cluster**" that deploys an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as the Git provider and [sops](https://github.com/getsops/sops) to manage secrets. - - - **Required:** Some knowledge of [Git](https://git-scm.com/) practices & terminology. - - **Components:** [flux](https://github.com/fluxcd/flux2), [cert-manager](https://github.com/cert-manager/cert-manager), [spegel](https://github.com/XenitAB/spegel), [reloader](https://github.com/stakater/Reloader), [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), and [openebs](https://github.com/openebs/openebs). + - **Required:** Debian 12 or Talos Linux installed on bare metal (or VMs) and some knowledge of [Containers](https://opencontainers.org/) and [YAML](https://yaml.org/). Some knowledge of [Git](https://git-scm.com/) practices & terminology is also required. + - **Components:** [Cilium](https://github.com/cilium/cilium) and [kube-vip](https://github.com/kube-vip/kube-vip) _(k3s)_. [flux](https://github.com/fluxcd/flux2), [cert-manager](https://github.com/cert-manager/cert-manager), [spegel](https://github.com/XenitAB/spegel), [reloader](https://github.com/stakater/Reloader), [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), and [openebs](https://github.com/openebs/openebs). 3. **"Flux cluster with Cloudflare"** - An addition to "**Flux cluster**" that provides DNS and SSL with [Cloudflare](https://www.cloudflare.com/). [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) is also included to provide external access to certain applications deployed in your cluster. @@ -259,25 +254,20 @@ You have two different options for setting up your local workstation. task ansible:deps ``` -4. Verify Ansible can view your config +4. Verify Ansible can view your config and ping your nodes ```sh task ansible:list - ``` - -5. Verify Ansible can ping your nodes - - ```sh task ansible:ping ``` -6. Run the Ansible prepare playbook (nodes wil reboot when done) +5. Run the Ansible prepare playbook (nodes wil reboot when done) ```sh task ansible:run playbook=cluster-prepare ``` -7. Continue on to ⛵ [**Stage 5**](#-stage-5-install-kubernetes) +6. Continue on to ⛵ [**Stage 5**](#-stage-5-install-kubernetes) ### ⛵ Stage 5: Install Kubernetes @@ -294,7 +284,6 @@ You have two different options for setting up your local workstation. 1. Install Kubernetes depending on the distribution you chose ```sh - # Install k3s task ansible:run playbook=cluster-installation ``` @@ -317,9 +306,6 @@ You have two different options for setting up your local workstation. ### 🔹 Stage 6: Install Flux in your cluster -> [!NOTE] -> Skip this stage if you have **disabled** Flux in the `config.yaml` - 1. Verify Flux can be installed ```sh @@ -332,7 +318,7 @@ You have two different options for setting up your local workstation. 2. Install Flux and sync the cluster to the Git repository - 📍 _Run `task flux:github-deploy-key` first if using a private repository_ + 📍 _Run `task flux:github-deploy-key` first if using a private repository._ ```sh task flux:bootstrap @@ -352,7 +338,7 @@ You have two different options for setting up your local workstation. # source-controller-7d6875bcb4-zqw9f 1/1 Running 0 1h ``` -### 🎤 Flux w/ Cloudflare verification Steps +### 🎤 Verification Steps _Mic check, 1, 2_ - In a few moments applications should be lighting up like Christmas in July 🎄 @@ -378,17 +364,17 @@ The `external-dns` application created in the `networking` namespace will handle #### 🏠 Home DNS -`k8s_gateway` will provide DNS resolution to external Kubernetes resources (i.e. points of entry to the cluster) from any device that uses your home DNS server. For this to work, your home DNS server must be configured to forward DNS queries for `${bootstrap_cloudflare_domain}` to `${bootstrap_k8s_gateway_addr}` instead of the upstream DNS server(s) it normally uses. This is a form of **split DNS** (aka split-horizon DNS / conditional forwarding). +`k8s_gateway` will provide DNS resolution to external Kubernetes resources (i.e. points of entry to the cluster) from any device that uses your home DNS server. For this to work, your home DNS server must be configured to forward DNS queries for `${bootstrap_cloudflare.domain}` to `${bootstrap_cloudflare.gateway_vip}` instead of the upstream DNS server(s) it normally uses. This is a form of **split DNS** (aka split-horizon DNS / conditional forwarding). > [!TIP] > Below is how to configure a Pi-hole for split DNS. Other platforms should be similar. > 1. Apply this file on the Pihole server while substituting the variables > ```sh > # /etc/dnsmasq.d/99-k8s-gateway-forward.conf -> server=/${bootstrap_cloudflare_domain}/${bootstrap_k8s_gateway_addr} +> server=/${bootstrap_cloudflare.domain}/${bootstrap_cloudflare.gateway_vip} > ``` > 2. Restart dnsmasq on the server. -> 3. Query an internal-only subdomain from your workstation (any `internal` class ingresses): `dig @${home-dns-server-ip} echo-server-internal.${bootstrap_cloudflare_domain}`. It should resolve to `${bootstrap_internal_ingress_addr}`. +> 3. Query an internal-only subdomain from your workstation (any `internal` class ingresses): `dig @${home-dns-server-ip} echo-server-internal.${bootstrap_cloudflare.domain}`. It should resolve to `${bootstrap_cloudflare.ingress_vip}`. If you're having trouble with DNS be sure to check out these two GitHub discussions: [Internal DNS](https://github.com/onedr0p/cluster-template/discussions/719) and [Pod DNS resolution broken](https://github.com/onedr0p/cluster-template/discussions/635). @@ -418,10 +404,10 @@ By default Flux will periodically check your git repository for changes. In orde 2. Piece together the full URL with the webhook path appended ```text - https://flux-webhook.${bootstrap_cloudflare_domain}/hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123 + https://flux-webhook.${bootstrap_cloudflare.domain}/hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123 ``` -3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_flux_github_webhook_token` secret and save. +3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_github_webhook_token` secret and save. ## 💥 Nuke @@ -430,10 +416,8 @@ There might be a situation where you want to destroy your Kubernetes cluster. Th ```sh # k3s: Remove all traces of k3s from the nodes task ansible:run playbook=cluster-nuke - # Talos: Reset your nodes back to maintenance mode and reboot task talos:soft-nuke - # Talos: Comletely format your the Talos installation and reboot task talos:hard-nuke ``` diff --git a/bootstrap/scripts/validation.py b/bootstrap/scripts/validation.py index 50090663..ef3e0bb6 100644 --- a/bootstrap/scripts/validation.py +++ b/bootstrap/scripts/validation.py @@ -6,7 +6,7 @@ import netaddr import sys DISTRIBUTIONS = ["k3s", "talos"] -GLOBAL_CLI_TOOLS = ["age", "cloudflared", "flux", "sops", "jq", "kubeconform", "kustomize"] +GLOBAL_CLI_TOOLS = ["age", "cloudflared", "flux", "helmfile", "sops", "jq", "kubeconform", "kustomize"] TALOS_CLI_TOOLS = ["talosctl", "talhelper"] def required(*keys: str): @@ -20,15 +20,6 @@ def required(*keys: str): return wrapper return wrapper_outter -def _validate_network(network: str, family: int) -> str: - try: - network = netaddr.IPNetwork(network) - if network.version != family: - raise ValueError(f"Invalid network family {network.version}") - except netaddr.core.AddrFormatError as e: - raise ValueError(f"Invalid network {network}") from e - return network - def validate_python_version() -> None: required_version = (3, 11, 0) @@ -36,11 +27,10 @@ def validate_python_version() -> None: raise ValueError(f"Python version is below 3.11. Please upgrade.") -@required("distribution") +@required("bootstrap_distribution") def validate_cli_tools(distribution: dict, **_) -> None: - distro = distribution.get("type") - if distro not in DISTRIBUTIONS: - raise ValueError(f"Invalid distribution {distro}") + if distribution not in DISTRIBUTIONS: + raise ValueError(f"Invalid distribution {distribution}") for tool in GLOBAL_CLI_TOOLS: if not which(tool): raise ValueError(f"Missing required CLI tool {tool}") @@ -49,65 +39,20 @@ def validate_cli_tools(distribution: dict, **_) -> None: raise ValueError(f"Missing required CLI tool {tool}") -@required("distribution") +@required("bootstrap_distribution") def validate_distribution(distribution: dict, **_) -> None: - distro = distribution.get("type") - if distro not in DISTRIBUTIONS: - raise ValueError(f"Invalid distribution {distro}") + if distribution not in DISTRIBUTIONS: + raise ValueError(f"Invalid distribution {distribution}") -@required("timezone") +@required("bootstrap_timezone") def validate_timezone(timezone: str, **_) -> None: if timezone not in available_timezones(): raise ValueError(f"Invalid timezone {timezone}") -@required("cluster", "feature_gates") -def validate_cluster_networks(cluster: dict, feature_gates: dict, **_) -> None: - dual_stack_ipv4_first = feature_gates.get("dual_stack_ipv4_first", False) - pod_network = cluster.get("pod_network") - service_network = cluster.get("service_network") - - if pod_network == service_network: - raise ValueError(f"Pod network {pod_network} is the same as service network {service_network}") - - if dual_stack_ipv4_first: - if len(pod_network.split(",")) != 2: - raise ValueError(f"Invalid pod network {pod_network}") - if len(service_network.split(",")) != 2: - raise ValueError(f"Invalid service network {service_network}") - cluster_ipv4, cluster_ipv6 = pod_network.split(",") - _validate_network(cluster_ipv4, 4) - _validate_network(cluster_ipv6, 6) - service_ipv4, service_ipv6 = service_network.split(",") - _validate_network(service_ipv4, 4) - _validate_network(service_ipv6, 6) - return - - if len(pod_network.split(",")) != 1: - raise ValueError(f"Invalid pod network {pod_network}") - if len(service_network.split(",")) != 1: - raise ValueError(f"Invalid service network {service_network}") - - _validate_network(pod_network, 4) - _validate_network(service_network, 4) - - -def massage_config(data: dict) -> dict: - data["distribution"] = data.get("distribution", {}) - data["nodes"] = data.get("nodes", []) - data["cluster"] = data.get("cluster", {}) - data["flux"] = data.get("flux", {}) - data["cloudflare"] = data.get("cloudflare", {}) - data["feature_gates"] = data.get("feature_gates", {}) - return data - - def validate(data: dict) -> None: - user_config = massage_config(data) - validate_python_version() - validate_cli_tools(user_config) - validate_distribution(user_config) - validate_timezone(user_config) - validate_cluster_networks(user_config) + validate_cli_tools(data) + validate_distribution(data) + validate_timezone(data) diff --git a/bootstrap/templates/.sops.yaml.j2 b/bootstrap/templates/.sops.yaml.j2 index 4eba71f0..4cec5261 100644 --- a/bootstrap/templates/.sops.yaml.j2 +++ b/bootstrap/templates/.sops.yaml.j2 @@ -1,22 +1,20 @@ -{% if flux.enabled %} --- creation_rules: - {% if distribution.type in ["talos"] %} + #% if bootstrap_distribution in ["talos"] %# - # IMPORTANT: This rule MUST be above the others path_regex: talos/.*\.sops\.ya?ml key_groups: - age: - - "{{ flux.sops_age_public_key }}" - {% endif %} + - "#{ bootstrap_sops_age_pubkey }#" + #% endif %# - path_regex: kubernetes/.*\.sops\.ya?ml encrypted_regex: "^(data|stringData)$" key_groups: - age: - - "{{ flux.sops_age_public_key }}" - {% if distribution.type in ["k3s"] %} + - "#{ bootstrap_sops_age_pubkey }#" + #% if bootstrap_distribution in ["k3s"] %# - path_regex: ansible/.*\.sops\.ya?ml key_groups: - age: - - "{{ flux.sops_age_public_key }}" - {% endif %} -{% endif %} + - "#{ bootstrap_sops_age_pubkey }#" + #% endif %# diff --git a/bootstrap/templates/ansible/.mjfilter.py b/bootstrap/templates/ansible/.mjfilter.py index c6bb3e8b..0979f9a6 100644 --- a/bootstrap/templates/ansible/.mjfilter.py +++ b/bootstrap/templates/ansible/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["k3s"] +main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"] diff --git a/bootstrap/templates/ansible/inventory/group_vars/controllers/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/controllers/main.yaml.j2 index c8676777..a5796e35 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/controllers/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/controllers/main.yaml.j2 @@ -1,13 +1,13 @@ --- k3s_control_node: true k3s_server: - {% if feature_gates.dual_stack_ipv4_first %} - cluster-cidr: "{{ cluster.pod_network.split(',')[0] }},{{ cluster.pod_network.split(',')[1] }}" - service-cidr: "{{ cluster.service_network.split(',')[0] }},{{ cluster.service_network.split(',')[1] }}" - {% else %} - cluster-cidr: "{{ cluster.pod_network }}" - service-cidr: "{{ cluster.service_network }}" - {% endif %} + #% if bootstrap_feature_gates.dual_stack_ipv4_first %# + cluster-cidr: "#{ bootstrap_pod_network.split(',')[0] }#,#{ bootstrap_pod_network.split(',')[1] }#" + service-cidr: "#{ bootstrap_service_network.split(',')[0] }#,#{ bootstrap_service_network.split(',')[1] }#" + #% else %# + cluster-cidr: "#{ bootstrap_pod_network }#" + service-cidr: "#{ bootstrap_service_network }#" + #% endif %# disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"] disable-cloud-controller: true disable-kube-proxy: true @@ -25,16 +25,16 @@ k3s_server: kubelet-arg: - "image-gc-high-threshold=55" - "image-gc-low-threshold=50" - {% if feature_gates.dual_stack_ipv4_first %} - node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}" - {% else %} - node-ip: "{% raw %}{{ ansible_host }}{% endraw %}" - {% endif %} + #% if bootstrap_feature_gates.dual_stack_ipv4_first %# + node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}" + #% else %# + node-ip: "{{ ansible_host }}" + #% endif %# pause-image: registry.k8s.io/pause:3.9 secrets-encryption: true tls-san: - - "{{ cluster.endpoint_vip }}" - {% for item in cluster.tls_sans %} - - "{{ item }}" - {% endfor %} + - "#{ bootstrap_controllers_vip }#" + #% for item in bootstrap_tls_sans %# + - "#{ item }#" + #% endfor %# write-kubeconfig-mode: "644" diff --git a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 index f36ddb37..bf1aeb1b 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 @@ -2,7 +2,7 @@ k3s_become: true k3s_etcd_datastore: true k3s_install_hard_links: true -k3s_registration_address: "{{ cluster.endpoint_vip }}" +k3s_registration_address: "#{ bootstrap_controllers_vip }#" k3s_registries: mirrors: docker.io: diff --git a/bootstrap/templates/ansible/inventory/group_vars/workers/.mjfilter.py b/bootstrap/templates/ansible/inventory/group_vars/workers/.mjfilter.py index 6de73cf6..8fb17eac 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/workers/.mjfilter.py +++ b/bootstrap/templates/ansible/inventory/group_vars/workers/.mjfilter.py @@ -1,9 +1,9 @@ main = lambda data: ( - data.get("distribution").get("type", "k3s") in ["k3s"] and + data.get("bootstrap_distribution", "k3s") in ["k3s"] and len( list( filter( - lambda item: "controller" in item and item["controller"] is False, data.get("nodes").get("inventory") + lambda item: "controller" in item and item["controller"] is False, data.get("bootstrap_node_inventory") ) ) ) > 0 diff --git a/bootstrap/templates/ansible/inventory/group_vars/workers/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/workers/main.yaml.j2 index 8318f037..428852e0 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/workers/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/workers/main.yaml.j2 @@ -4,9 +4,9 @@ k3s_agent: kubelet-arg: - "image-gc-high-threshold=55" - "image-gc-low-threshold=50" - {% if feature_gates.dual_stack_ipv4_first %} - node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}" - {% else %} - node-ip: "{% raw %}{{ ansible_host }}{% endraw %}" - {% endif %} + #% if bootstrap_feature_gates.dual_stack_ipv4_first %# + node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}" + #% else %# + node-ip: "{{ ansible_host }}" + #% endif %# pause-image: registry.k8s.io/pause:3.9 diff --git a/bootstrap/templates/ansible/inventory/hosts.yaml.j2 b/bootstrap/templates/ansible/inventory/hosts.yaml.j2 index 663991ca..8960a23d 100644 --- a/bootstrap/templates/ansible/inventory/hosts.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/hosts.yaml.j2 @@ -3,21 +3,21 @@ kubernetes: children: controllers: hosts: - {% for item in nodes.inventory %} - {% if item.controller %} - "{{ item.name }}": - ansible_user: "{{ item.ssh_username }}" - ansible_host: "{{ item.address }}" - {% endif %} - {% endfor %} - {% if nodes.inventory | selectattr('controller', 'equalto', False) | list | length %} + #% for item in bootstrap_node_inventory %# + #% if item.controller %# + "#{ item.name }#": + ansible_user: "#{ item.ssh_user }#" + ansible_host: "#{ item.address }#" + #% endif %# + #% endfor %# + #% if bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length %# workers: hosts: - {% for item in nodes.inventory %} - {% if not item.controller %} - "{{ item.name }}": - ansible_user: "{{ item.ssh_username }}" - ansible_host: "{{ item.address }}" - {% endif %} - {% endfor %} - {% endif %} + #% for item in bootstrap_node_inventory %# + #% if not item.controller %# + "#{ item.name }#": + ansible_user: "#{ item.ssh_user }#" + ansible_host: "#{ item.address }#" + #% endif %# + #% endfor %# + #% endif %# diff --git a/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 index 8bc09552..54c2f87a 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 @@ -42,9 +42,9 @@ or k3s_server_manifests_urls | length > 0) kubernetes.core.k8s_info: kubeconfig: /etc/rancher/k3s/k3s.yaml - kind: "{% raw %}{{ item.kind }}{% endraw %}" - name: "{% raw %}{{ item.name }}{% endraw %}" - namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}" + kind: "{{ item.kind }}" + name: "{{ item.name }}" + namespace: "{{ item.namespace | default('') }}" wait: true wait_sleep: 10 wait_timeout: 360 diff --git a/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 index e72b6ea6..d3ff98bf 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 @@ -20,5 +20,5 @@ - name: Upgrade kube-vip ansible.builtin.template: src: templates/kube-vip-ds.yaml.j2 - dest: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}/kube-vip-ds.yaml" + dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml" mode: preserve diff --git a/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 index ea7ea6e5..a99265b8 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 @@ -36,17 +36,17 @@ block: - name: Networking | Delete Cilium links ansible.builtin.command: - cmd: "ip link delete {% raw %}{{ item }}{% endraw %}" - removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}" + cmd: "ip link delete {{ item }}" + removes: "/sys/class/net/{{ item }}" loop: ["cilium_host", "cilium_net", "cilium_vxlan"] - name: Networking | Flush iptables ansible.builtin.iptables: - table: "{% raw %}{{ item }}{% endraw %}" + table: "{{ item }}" flush: true loop: ["filter", "nat", "mangle", "raw"] - name: Networking | Flush ip6tables ansible.builtin.iptables: - table: "{% raw %}{{ item }}{% endraw %}" + table: "{{ item }}" flush: true ip_version: ipv6 loop: ["filter", "nat", "mangle", "raw"] @@ -86,7 +86,7 @@ - k3s_install_hard_links - not ansible_check_mode ansible.builtin.file: - path: "{% raw %}{{ k3s_install_dir }}{% endraw %}/{% raw %}{{ item }}{% endraw %}" + path: "{{ k3s_install_dir }}/{{ item }}" state: absent loop: ["kubectl", "crictl", "ctr"] diff --git a/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 index 4b667d88..364418bc 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 @@ -15,7 +15,7 @@ block: - name: Locale | Set timezone community.general.timezone: - name: "{{ timezone }}" + name: "#{ bootstrap_timezone }#" - name: Packages block: @@ -32,12 +32,12 @@ block: - name: Network Configuration | Set hostname ansible.builtin.hostname: - name: "{% raw %}{{ inventory_hostname }}{% endraw %}" + name: "{{ inventory_hostname }}" - name: Network Configuration | Update hosts ansible.builtin.copy: content: | 127.0.0.1 localhost - 127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %} + 127.0.1.1 {{ inventory_hostname }} # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback @@ -61,10 +61,10 @@ mode: '0644' dest: /etc/resolv.conf content: | - search {{ nodes.search_domain|default('.', true) }} - {% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %} - nameserver {{ item }} - {% endfor %} + search #{ bootstrap_search_domain|default('.', true) }# + #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %# + nameserver #{ item }# + #% endfor %# - name: System Configuration notify: Reboot @@ -77,15 +77,15 @@ masked: true - name: System Configuration | Disable swap ansible.posix.mount: - name: "{% raw %}{{ item }}{% endraw %}" + name: "{{ item }}" fstype: swap state: absent loop: ["none", "swap"] - name: System Configuration | Create Kernel modules ansible.builtin.copy: - dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf" + dest: "/etc/modules-load.d/{{ item }}.conf" mode: "0644" - content: "{% raw %}{{ item }}{% endraw %}" + content: "{{ item }}" loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"] register: modules_status - name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler @@ -95,11 +95,11 @@ state: restarted - name: System Configuration | Sysctl ansible.posix.sysctl: - name: "{% raw %}{{ item.key }}{% endraw %}" - value: "{% raw %}{{ item.value }}{% endraw %}" + name: "{{ item.key }}" + value: "{{ item.value }}" sysctl_file: /etc/sysctl.d/99-kubernetes.conf reload: true - with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}" + with_dict: "{{ sysctl_config }}" vars: sysctl_config: fs.inotify.max_queued_events: 65536 diff --git a/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 index a6f91415..acad8fd6 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 @@ -11,9 +11,9 @@ seconds: 5 tasks: - name: Details - ansible.builtin.command: "k3s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json" + ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json" register: kubectl_get_node - delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}" + delegate_to: "{{ groups['controllers'][0] }}" failed_when: false changed_when: false @@ -26,14 +26,14 @@ block: - name: Cordon kubernetes.core.k8s_drain: - name: "{% raw %}{{ inventory_hostname }}{% endraw %}" + name: "{{ inventory_hostname }}" kubeconfig: /etc/rancher/k3s/k3s.yaml state: cordon - delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}" + delegate_to: "{{ groups['controllers'][0] }}" - name: Drain kubernetes.core.k8s_drain: - name: "{% raw %}{{ inventory_hostname }}{% endraw %}" + name: "{{ inventory_hostname }}" kubeconfig: /etc/rancher/k3s/k3s.yaml state: drain delete_options: @@ -43,7 +43,7 @@ wait_timeout: 900 pod_selectors: - app!=rook-ceph-osd # Rook Ceph - delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}" + delegate_to: "{{ groups['controllers'][0] }}" - name: Update ansible.builtin.apt: @@ -64,7 +64,7 @@ - name: Uncordon kubernetes.core.k8s_drain: - name: "{% raw %}{{ inventory_hostname }}{% endraw %}" + name: "{{ inventory_hostname }}" kubeconfig: /etc/rancher/k3s/k3s.yaml state: uncordon - delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}" + delegate_to: "{{ groups['controllers'][0] }}" diff --git a/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 index 18b75750..73697476 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 @@ -3,7 +3,7 @@ block: - name: Cruft | Get list of custom manifests ansible.builtin.find: - paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}" + paths: "{{ k3s_server_manifests_dir }}" file_type: file use_regex: true patterns: ["^custom-.*"] @@ -11,9 +11,9 @@ - name: Cruft | Delete custom manifests ansible.builtin.file: - path: "{% raw %}{{ item.path }}{% endraw %}" + path: "{{ item.path }}" state: absent - loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}" + loop: "{{ custom_manifest.files }}" - name: Cruft | Get list of custom addons kubernetes.core.k8s_info: @@ -24,8 +24,8 @@ - name: Cruft | Delete addons kubernetes.core.k8s: kubeconfig: /etc/rancher/k3s/k3s.yaml - name: "{% raw %}{{ item.metadata.name }}{% endraw %}" + name: "{{ item.metadata.name }}" kind: Addon namespace: kube-system state: absent - loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}" + loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}" diff --git a/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 index a3a0681a..56bf684e 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 @@ -13,7 +13,7 @@ when: k3s_primary_control_node ansible.builtin.fetch: src: /etc/rancher/k3s/k3s.yaml - dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig" + dest: "{{ repository_path.stdout }}/kubeconfig" flat: true - name: Update kubeconfig with the correct load balancer address @@ -21,6 +21,6 @@ become: false run_once: true ansible.builtin.replace: - path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig" + path: "{{ repository_path.stdout }}/kubeconfig" regexp: https://127.0.0.1:6443 - replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443" + replace: "https://{{ k3s_registration_address }}:6443" diff --git a/bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2 index 87ea1335..56e56702 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2 @@ -9,10 +9,9 @@ - name: Extract k3s version ansible.builtin.set_fact: - current_k3s_version: "{% raw %}{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P[a-z0-9\\.\\+]+).*\n.*', '\\g') }}{% endraw %}" + current_k3s_version: "{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P[a-z0-9\\.\\+]+).*\n.*', '\\g') }}" - name: Check if upgrades are allowed ansible.builtin.assert: - that: - - "k3s_release_version is version(current_k3s_version, '>=')" + that: ["k3s_release_version is version(current_k3s_version, '>=')"] fail_msg: "Unable to upgrade k3s because the deployed version is higher than the one specified in the configuration" diff --git a/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2 b/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2 index 42cb3bfd..12aa1010 100644 --- a/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2 @@ -12,6 +12,6 @@ spec: targetNamespace: kube-system bootstrap: true valuesContent: |- - {% filter indent(width=4, first=True) %} - {% include 'partials/cilium-values-init.partial.yaml.j2' %} - {% endfilter %} + #% filter indent(width=4, first=True) %# + #% include 'partials/cilium-values-init.partial.yaml.j2' %# + #% endfilter %# diff --git a/bootstrap/templates/ansible/playbooks/templates/kube-vip-ds.yaml.j2 b/bootstrap/templates/ansible/playbooks/templates/kube-vip-ds.yaml.j2 index 9cc432a2..f62cab4d 100644 --- a/bootstrap/templates/ansible/playbooks/templates/kube-vip-ds.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/kube-vip-ds.yaml.j2 @@ -1,2 +1,2 @@ --- -{% include 'partials/kube-vip-ds.partial.yaml.j2' %} +#% include 'partials/kube-vip-ds.partial.yaml.j2' %# diff --git a/bootstrap/templates/ansible/playbooks/templates/kube-vip-rbac.yaml.j2 b/bootstrap/templates/ansible/playbooks/templates/kube-vip-rbac.yaml.j2 index eadbb999..481c2e82 100644 --- a/bootstrap/templates/ansible/playbooks/templates/kube-vip-rbac.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/kube-vip-rbac.yaml.j2 @@ -1,2 +1,2 @@ --- -{% include 'partials/kube-vip-rbac.partial.yaml.j2' %} +#% include 'partials/kube-vip-rbac.partial.yaml.j2' %# diff --git a/bootstrap/templates/kubernetes/apps/.mjfilter.py b/bootstrap/templates/kubernetes/apps/.mjfilter.py deleted file mode 100644 index a9625e1a..00000000 --- a/bootstrap/templates/kubernetes/apps/.mjfilter.py +++ /dev/null @@ -1 +0,0 @@ -main = lambda data: data.get("flux", {}).get("enabled", False) == True diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py index b3d52646..d9ae82b4 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("cloudflare", {}).get("enabled", False) == True +main = lambda data: data.get("bootstrap_cloudflare", {}).get("enabled", False) == True diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 index f967fe67..f5bf887f 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: cert-manager-secret stringData: - api-token: "{{ cloudflare.token }}" + api-token: "#{ bootstrap_cloudflare.token }#" diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 index 04d30f4e..3efe99d8 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 @@ -18,7 +18,7 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% if cloudflare.enabled %} +#% if bootstrap_cloudflare.enabled %# --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -41,4 +41,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 index 7c03d1c3..10587f8c 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 @@ -3,6 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./namespace.yaml - {% if flux.github.webhook.enabled %} - ./webhooks/ks.yaml - {% endif %} diff --git a/bootstrap/templates/kubernetes/apps/flux-system/webhooks/.mjfilter.py b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/.mjfilter.py deleted file mode 100644 index 7efae3a2..00000000 --- a/bootstrap/templates/kubernetes/apps/flux-system/webhooks/.mjfilter.py +++ /dev/null @@ -1,6 +0,0 @@ -main = lambda data: ( - data.get("flux", {}) - .get("github", {}) - .get("webhook", {}) - .get("enabled", False) == True -) diff --git a/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2 index 37e3d454..e704eed3 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2 @@ -1,4 +1,4 @@ -{% if cloudflare.enabled %} +#% if bootstrap_cloudflare.enabled %# --- apiVersion: networking.k8s.io/v1 kind: Ingress @@ -22,4 +22,4 @@ spec: tls: - hosts: - *host -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2 index 2002134e..75fc5841 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2 @@ -3,7 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./secret.sops.yaml - {% if cloudflare.enabled %} + #% if bootstrap_cloudflare.enabled %# - ./ingress.yaml - {% endif %} + #% endif %# - ./receiver.yaml diff --git a/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2 index a0ede054..34ac7daf 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: github-webhook-token-secret stringData: - token: "{{ flux.github.webhook.token }}" + token: "#{ bootstrap_github_webhook_token }#" diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-bgp.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-bgp.yaml.j2 index ccd6eb75..7e15b6f6 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-bgp.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-bgp.yaml.j2 @@ -9,21 +9,21 @@ spec: matchLabels: kubernetes.io/os: linux virtualRouters: - - localASN: {{ distribution.talos.bgp.local_asn }} + - localASN: #{ bootstrap_bgp.local_asn }# neighbors: - {% if distribution.talos.bgp.peers %} - {% for item in distribution.talos.bgp.peers %} - - peerAddress: "{{ item }}/32" - peerASN: {{ distribution.talos.bgp.peer_asn }} - {% endfor %} - {% else %} - {% if nodes.default_gateway %} - - peerAddress: "{{ nodes.default_gateway }}/32" - {% else %} - - peerAddress: "{{ nodes.host_network | nthhost(1) }}/32" - {% endif %} - peerASN: {{ distribution.talos.bgp.peer_asn }} - {% endif %} + #% if bootstrap_bgp.peers %# + #% for item in bootstrap_bgp.peers %# + - peerAddress: "#{ item }#/32" + peerASN: #{ bootstrap_bgp.peer_asn }# + #% endfor %# + #% else %# + #% if bootstrap_node_default_gateway %# + - peerAddress: "#{ bootstrap_node_default_gateway }#/32" + #% else %# + - peerAddress: "#{ bootstrap_node_network | nthhost(1) }#/32" + #% endif %# + peerASN: #{ bootstrap_bgp.peer_asn }# + #% endif %# serviceSelector: matchExpressions: - {key: somekey, operator: NotIn, values: ['never-used-value']} @@ -34,4 +34,4 @@ metadata: name: pool spec: cidrs: - - cidr: "${LOADBALANCER_CIDR}" + - cidr: "${BGP_ADVERTISED_CIDR}" diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 index 3d27ee05..48450c34 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 @@ -23,6 +23,6 @@ spec: uninstall: keepHistory: false values: - {% filter indent(width=4, first=True) %} - {% include 'partials/cilium-values-full.partial.yaml.j2' %} - {% endfilter %} + #% filter indent(width=4, first=True) %# + #% include 'partials/cilium-values-full.partial.yaml.j2' %# + #% endfilter %# diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 index dc9673c8..7da0fa0d 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 @@ -2,11 +2,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - {% if distribution.talos.bgp.enabled %} + #% if bootstrap_bgp.enabled %# - ./cilium-bgp.yaml - {% endif %} - {% if ( (not distribution.talos.bgp.enabled) and - (not feature_gates.dual_stack_ipv4_first) ) %} + #% endif %# + #% if ((not bootstrap_bgp.enabled) and (not bootstrap_feature_gates.dual_stack_ipv4_first)) %# - ./cilium-l2.yaml - {% endif %} + #% endif %# - ./helmrelease.yaml diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py b/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py index 5af77870..3ace63df 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"] +main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"] diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2 index 21bc72f4..aacef000 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2 @@ -23,9 +23,9 @@ spec: uninstall: keepHistory: false values: - {% filter indent(width=4, first=True) %} - {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %} - {% endfilter %} + #% filter indent(width=4, first=True) %# + #% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %# + #% endfilter %# metrics: enable: true serviceMonitor: diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 index 76b19586..f1547936 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 @@ -4,11 +4,11 @@ kind: Kustomization resources: - ./namespace.yaml - ./cilium/ks.yaml - {% if distribution.type in ["talos"] %} + #% if bootstrap_distribution in ["talos"] %# - ./kubelet-csr-approver/ks.yaml - {% endif %} + #% endif %# - ./metrics-server/ks.yaml - {% if distribution.type in ["talos"] %} + #% if bootstrap_distribution in ["talos"] %# - ./spegel/ks.yaml - {% endif %} + #% endif %# - ./reloader/ks.yaml diff --git a/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 index fd5305df..a02c72ad 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 @@ -28,4 +28,4 @@ spec: readOnlyRootFileSystem: true podMonitor: enabled: true - namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}" + namespace: "{{ .Release.Namespace }}" diff --git a/bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py b/bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py index 5af77870..3ace63df 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"] +main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"] diff --git a/bootstrap/templates/kubernetes/apps/network/.mjfilter.py b/bootstrap/templates/kubernetes/apps/network/.mjfilter.py index b3d52646..d9ae82b4 100644 --- a/bootstrap/templates/kubernetes/apps/network/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/network/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("cloudflare", {}).get("enabled", False) == True +main = lambda data: data.get("bootstrap_cloudflare", {}).get("enabled", False) == True diff --git a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 index 779d0bed..67d169ed 100644 --- a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 @@ -4,10 +4,10 @@ kind: Secret metadata: name: cloudflared-secret stringData: - TUNNEL_ID: "{{ cloudflare.tunnel.id }}" + TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#" credentials.json: | { - "AccountTag": "{{ cloudflare.tunnel.account_id }}", - "TunnelSecret": "{{ cloudflare.tunnel.secret }}", - "TunnelID": "{{ cloudflare.tunnel.id }}" + "AccountTag": "#{ bootstrap_cloudflare.tunnel.account_id }#", + "TunnelSecret": "#{ bootstrap_cloudflare.tunnel.secret }#", + "TunnelID": "#{ bootstrap_cloudflare.tunnel.id }#" } diff --git a/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 index 4b1bd66d..b99d1e8b 100644 --- a/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 @@ -82,7 +82,7 @@ spec: annotations: external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}" hosts: - - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-external.${SECRET_DOMAIN}" + - host: &host "{{ .Release.Name }}-external.${SECRET_DOMAIN}" paths: - path: / service: @@ -95,7 +95,7 @@ spec: enabled: true className: internal hosts: - - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-internal.${SECRET_DOMAIN}" + - host: &host "{{ .Release.Name }}-internal.${SECRET_DOMAIN}" paths: - path: / service: diff --git a/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 index ac7d97d6..c067b329 100644 --- a/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: external-dns-secret stringData: - api-token: "{{ cloudflare.token }}" + api-token: "#{ bootstrap_cloudflare.token }#" diff --git a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2 index 8f9c7613..94d1afbf 100644 --- a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2 @@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./staging.yaml - {% if cloudflare.acme.production %} + #% if bootstrap_cloudflare.acme.production %# - ./production.yaml - {% endif %} + #% endif %# diff --git a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 index edf9b4fe..7fbdb805 100644 --- a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 @@ -32,7 +32,7 @@ spec: service: annotations: external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}" - io.cilium/lb-ipam-ips: "{{ cloudflare.tunnel.ingress_vip }}" + io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.tunnel.ingress_vip }#" externalTrafficPolicy: Cluster ingressClassResource: name: external @@ -70,11 +70,11 @@ spec: namespaceSelector: any: true extraArgs: - {% if cloudflare.acme.production %} + #% if bootstrap_cloudflare.acme.production %# default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" - {% else %} + #% else %# default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls" - {% endif %} + #% endif %# topologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname diff --git a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 index a0f3e09b..21d86390 100644 --- a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 @@ -29,7 +29,7 @@ spec: replicaCount: 1 service: annotations: - io.cilium/lb-ipam-ips: "{{ cloudflare.ingress_vip }}" + io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.ingress_vip }#" externalTrafficPolicy: Cluster ingressClassResource: name: internal @@ -67,11 +67,11 @@ spec: namespaceSelector: any: true extraArgs: - {% if cloudflare.acme.production %} + #% if bootstrap_cloudflare.acme.production %# default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" - {% else %} + #% else %# default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls" - {% endif %} + #% endif %# topologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname diff --git a/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 index f8fa00c6..4349ac30 100644 --- a/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 @@ -30,5 +30,5 @@ spec: type: LoadBalancer port: 53 annotations: - io.cilium/lb-ipam-ips: "{{ cloudflare.gateway_vip }}" + io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.gateway_vip }#" externalTrafficPolicy: Cluster diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/k3s/.mjfilter.py b/bootstrap/templates/kubernetes/apps/system-upgrade/k3s/.mjfilter.py index c6bb3e8b..0979f9a6 100644 --- a/bootstrap/templates/kubernetes/apps/system-upgrade/k3s/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/system-upgrade/k3s/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["k3s"] +main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"] diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 index 88ad5b6e..7800ccb0 100644 --- a/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 @@ -3,12 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./namespace.yaml - {% if distribution.type in ['k3s', 'talos'] %} + #% if bootstrap_distribution in ['k3s', 'talos'] %# - ./system-upgrade-controller/ks.yaml - {% endif %} - {% if distribution.type in ["k3s"] %} + #% endif %# + #% if bootstrap_distribution in ["k3s"] %# - ./k3s/ks.yaml - {% endif %} - {% if distribution.type in ["talos"] and distribution.talos.schematicID %} + #% endif %# + #% if bootstrap_distribution in ["talos"] and bootstrap_talos.schematic_id %# - ./talos/ks.yaml - {% endif %} + #% endif %# diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/.mjfilter.py b/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/.mjfilter.py index ef1254e5..394f9d1e 100644 --- a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("distribution", {}).get("type", "k3s") in ['k3s', 'talos'] +main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s", "talos"] diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/rbac.yaml.j2 b/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/rbac.yaml.j2 index b6c65535..ddc6127f 100644 --- a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/rbac.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/rbac.yaml.j2 @@ -11,7 +11,7 @@ subjects: - kind: ServiceAccount name: system-upgrade namespace: system-upgrade -{% if distribution.type in ["talos"] %} +#% if bootstrap_distribution in ["talos"] %# --- apiVersion: talos.dev/v1alpha1 kind: ServiceAccount @@ -20,4 +20,4 @@ metadata: spec: roles: - os:admin -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/talos/.mjfilter.py b/bootstrap/templates/kubernetes/apps/system-upgrade/talos/.mjfilter.py index 45d7879a..82712ee6 100644 --- a/bootstrap/templates/kubernetes/apps/system-upgrade/talos/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/system-upgrade/talos/.mjfilter.py @@ -1,6 +1,4 @@ main = lambda data: ( - data.get("distribution", {}).get("type", "k3s") in ["talos"] and - data.get("distribution", {}) - .get("talos", {}) - .get("schematicID", {}) + data.get("bootstrap_distribution", "k3s") in ["talos"] and + data.get("talos", {}).get("schematic_id", {}) ) diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/talos/app/plan.yaml.j2 b/bootstrap/templates/kubernetes/apps/system-upgrade/talos/app/plan.yaml.j2 index 4e54ecd6..88228c88 100644 --- a/bootstrap/templates/kubernetes/apps/system-upgrade/talos/app/plan.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/system-upgrade/talos/app/plan.yaml.j2 @@ -88,6 +88,6 @@ spec: args: - --nodes=$(NODE_IP) - upgrade - - --image=factory.talos.dev/installer/{{ distribution.talos.schematicID }}:$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION) + - --image=factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#:$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION) - --preserve=true - --wait=false diff --git a/bootstrap/templates/kubernetes/bootstrap/.mjfilter.py b/bootstrap/templates/kubernetes/bootstrap/.mjfilter.py deleted file mode 100644 index a9625e1a..00000000 --- a/bootstrap/templates/kubernetes/bootstrap/.mjfilter.py +++ /dev/null @@ -1 +0,0 @@ -main = lambda data: data.get("flux", {}).get("enabled", False) == True diff --git a/bootstrap/templates/kubernetes/bootstrap/github-deploy-key.sops.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/flux/github-deploy-key.sops.yaml.j2 similarity index 86% rename from bootstrap/templates/kubernetes/bootstrap/github-deploy-key.sops.yaml.j2 rename to bootstrap/templates/kubernetes/bootstrap/flux/github-deploy-key.sops.yaml.j2 index cd9ce289..0ef1f6e8 100644 --- a/bootstrap/templates/kubernetes/bootstrap/github-deploy-key.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/bootstrap/flux/github-deploy-key.sops.yaml.j2 @@ -1,4 +1,4 @@ -{% if flux.github.private.enabled %} +#% if bootstrap_github_private_key %# --- apiVersion: v1 kind: Secret @@ -7,11 +7,11 @@ metadata: namespace: flux-system stringData: identity: | - {% filter indent(width=4, first=False) %} - {{ flux.github.private.key }} - {%- endfilter %} + #% filter indent(width=4, first=False) %# + #{ bootstrap_github_private_key }# + #%- endfilter %# known_hosts: | github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/bootstrap/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/flux/kustomization.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/bootstrap/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/bootstrap/flux/kustomization.yaml.j2 diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/.mjfilter.py b/bootstrap/templates/kubernetes/bootstrap/talos/.mjfilter.py new file mode 100644 index 00000000..3ace63df --- /dev/null +++ b/bootstrap/templates/kubernetes/bootstrap/talos/.mjfilter.py @@ -0,0 +1 @@ +main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"] diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/apps/cilium-values.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/apps/cilium-values.yaml.j2 new file mode 100644 index 00000000..ecaa0917 --- /dev/null +++ b/bootstrap/templates/kubernetes/bootstrap/talos/apps/cilium-values.yaml.j2 @@ -0,0 +1,4 @@ +--- +#% filter indent(width=0, first=True) %# +#% include 'partials/cilium-values-init.partial.yaml.j2' %# +#% endfilter %# diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/apps/helmfile.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/apps/helmfile.yaml.j2 new file mode 100644 index 00000000..bea96763 --- /dev/null +++ b/bootstrap/templates/kubernetes/bootstrap/talos/apps/helmfile.yaml.j2 @@ -0,0 +1,22 @@ +--- +repositories: + - name: cilium + url: https://helm.cilium.io + - name: postfinance + url: https://postfinance.github.io/kubelet-csr-approver + +releases: + - name: cilium + namespace: kube-system + chart: cilium/cilium + version: 1.15.1 + wait: true + values: + - ./cilium-values.yaml + - name: kubelet-csr-approver + namespace: kube-system + chart: postfinance/kubelet-csr-approver + version: 1.0.7 + wait: true + values: + - ./kubelet-csr-approver-values.yaml diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/apps/kubelet-csr-approver-values.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/apps/kubelet-csr-approver-values.yaml.j2 new file mode 100644 index 00000000..d63b9845 --- /dev/null +++ b/bootstrap/templates/kubernetes/bootstrap/talos/apps/kubelet-csr-approver-values.yaml.j2 @@ -0,0 +1,4 @@ +--- +#% filter indent(width=0, first=True) %# +#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %# +#% endfilter %# diff --git a/bootstrap/templates/kubernetes/talos/talconfig.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2 similarity index 62% rename from bootstrap/templates/kubernetes/talos/talconfig.yaml.j2 rename to bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2 index 01a44dfe..cff1fa10 100644 --- a/bootstrap/templates/kubernetes/talos/talconfig.yaml.j2 +++ b/bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2 @@ -6,80 +6,80 @@ talosVersion: v1.6.4 kubernetesVersion: v1.29.1 clusterName: &cluster home-kubernetes -endpoint: https://{{ cluster.endpoint_vip }}:6443 +endpoint: https://#{ bootstrap_controllers_vip }#:6443 clusterPodNets: - - "{{ cluster.pod_network.split(',')[0] }}" + - "#{ bootstrap_pod_network.split(',')[0] }#" clusterSvcNets: - - "{{ cluster.service_network.split(',')[0] }}" + - "#{ bootstrap_service_network.split(',')[0] }#" additionalApiServerCertSans: &sans - - "{{ cluster.endpoint_vip }}" + - "#{ bootstrap_controllers_vip }#" - 127.0.0.1 # KubePrism - {% for item in cluster.tls_sans %} - - "{{ item }}" - {% endfor %} + #% for item in bootstrap_tls_sans %# + - "#{ item }#" + #% endfor %# additionalMachineCertSans: *sans cniConfig: name: none nodes: - {% for item in nodes.inventory %} - - hostname: "{{ item.name }}" - ipAddress: "{{ item.address }}" - {% if item.talos_disk_device.startswith('/') %} - installDisk: "{{ item.talos_disk_device }}" - {% else %} + #% for item in bootstrap_node_inventory %# + - hostname: "#{ item.name }#" + ipAddress: "#{ item.address }#" + #% if item.talos_disk.startswith('/') %# + installDisk: "#{ item.talos_disk }#" + #% else %# installDiskSelector: - serial: "{{ item.talos_disk_device }}" - {% endif %} - {% if distribution.talos.secureboot.enabled %} + serial: "#{ item.talos_disk }#" + #% endif %# + #% if bootstrap_talos.secureboot.enabled %# machineSpec: secureboot: true - talosImageURL: factory.talos.dev/installer-secureboot/{{ distribution.talos.schematicID }} - {% else %} - talosImageURL: factory.talos.dev/installer/{{ distribution.talos.schematicID }} - {% endif %} - controlPlane: {{ (item.controller) | string | lower }} + talosImageURL: factory.talos.dev/installer-secureboot/#{ bootstrap_talos.schematic_id }# + #% else %# + talosImageURL: factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }# + #% endif %# + controlPlane: #{ (item.controller) | string | lower }# networkInterfaces: - interface: eth0 dhcp: false - {% if distribution.talos.vlan %} + #% if bootstrap_talos.vlan %# vlans: - - vlanId: {{ distribution.talos.vlan }} + - vlanId: #{ bootstrap_talos.vlan }# addresses: - - "{{ item.address }}/{{ nodes.host_network.split('/') | last }}" + - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#" mtu: 1500 routes: - network: 0.0.0.0/0 - {% if nodes.default_gateway %} - gateway: "{{ nodes.default_gateway }}" - {% else %} - gateway: "{{ nodes.host_network | nthhost(1) }}" - {% endif %} - {% if item.controller %} + #% if bootstrap_node_default_gateway %# + gateway: "#{ bootstrap_node_default_gateway }#" + #% else %# + gateway: "#{ bootstrap_node_network | nthhost(1) }#" + #% endif %# + #% if item.controller %# vip: - ip: "{{ cluster.endpoint_vip }}" - {% endif %} - {% else %} + ip: "#{ bootstrap_controllers_vip }#" + #% endif %# + #% else %# addresses: - - "{{ item.address }}/{{ nodes.host_network.split('/') | last }}" + - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#" mtu: 1500 routes: - network: 0.0.0.0/0 - {% if nodes.default_gateway %} - gateway: "{{ nodes.default_gateway }}" - {% else %} - gateway: "{{ nodes.host_network | nthhost(1) }}" - {% endif %} - {% if item.controller %} + #% if bootstrap_node_default_gateway %# + gateway: "#{ bootstrap_node_default_gateway }#" + #% else %# + gateway: "#{ bootstrap_node_network | nthhost(1) }#" + #% endif %# + #% if item.controller %# vip: - ip: "{{ cluster.endpoint_vip }}" - {% endif %} - {% endif %} - {% if distribution.talos.user_patches %} + ip: "#{ bootstrap_controllers_vip }#" + #% endif %# + #% endif %# + #% if bootstrap_talos.user_patches %# patches: - - "@./patches/node_{{ item.name }}.yaml" - {% endif %} - {% endfor %} + - "@./patches/node_#{ item.name }#.yaml" + #% endif %# + #% endfor %# patches: # Configure containerd @@ -123,16 +123,16 @@ patches: rotate-server-certificates: true nodeIP: validSubnets: - - "{{ nodes.host_network }}" + - "#{ bootstrap_node_network }#" # Force nameserver - |- machine: network: nameservers: - {% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %} - - {{ item }} - {% endfor %} + #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %# + - #{ item }# + #% endfor %# # Configure NTP - |- @@ -170,8 +170,7 @@ patches: extraKernelArgs: - net.ifnames=0 - {% if distribution.talos.secureboot.enabled and - distribution.talos.secureboot.encrypt_disk_with_tpm %} + #% if bootstrap_talos.secureboot.enabled and bootstrap_talos.secureboot.encrypt_disk_with_tpm %# # Encrypt system disk with TPM - |- machine: @@ -186,11 +185,11 @@ patches: keys: - slot: 0 tpm: {} - {% endif %} - {% if distribution.talos.user_patches %} + #% endif %# + #% if bootstrap_talos.user_patches %# # User specified global patches - "@./patches/global.yaml" - {% endif %} + #% endif %# controlPlane: patches: @@ -214,7 +213,7 @@ controlPlane: extraArgs: listen-metrics-urls: http://0.0.0.0:2381 advertisedSubnets: - - "{{ nodes.host_network }}" + - "#{ bootstrap_node_network }#" # Disable default API server admission plugins. - |- @@ -232,15 +231,14 @@ controlPlane: allowedKubernetesNamespaces: - system-upgrade - {% if distribution.talos.user_patches %} + #% if bootstrap_talos.user_patches %# # User specified controlPlane patches - "@./patches/controlPlane.yaml" - {% endif %} + #% endif %# -{% if ( (distribution.talos.user_patches) and - (nodes.inventory | selectattr('controller', 'equalto', False) | list | length) ) %} +#% if ((bootstrap_talos.user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %# worker: patches: # User specified worker patches - "@./patches/worker.yaml" -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/.mjfilter.py b/bootstrap/templates/kubernetes/flux/.mjfilter.py deleted file mode 100644 index a9625e1a..00000000 --- a/bootstrap/templates/kubernetes/flux/.mjfilter.py +++ /dev/null @@ -1 +0,0 @@ -main = lambda data: data.get("flux", {}).get("enabled", False) == True diff --git a/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 b/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 index 3b24aae4..bae21e83 100644 --- a/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 @@ -6,13 +6,13 @@ metadata: namespace: flux-system spec: interval: 30m - url: "{{ flux.github.address }}" - {% if flux.github.private.enabled %} + url: "#{ bootstrap_github_address }#" + #% if bootstrap_github_private_key %# secretRef: name: github-deploy-key - {% endif %} + #% endif %# ref: - branch: "{{ flux.github.branch|default('main', true) }}" + branch: "#{ bootstrap_github_branch|default('main', true) }#" ignore: | # exclude all /* diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2 index 92649af5..78812e54 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2 @@ -1,4 +1,4 @@ -{% if cloudflare.enabled %} +#% if bootstrap_cloudflare.enabled %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -8,4 +8,4 @@ metadata: spec: interval: 1h url: https://kubernetes-sigs.github.io/external-dns -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2 index 47c1e9a0..2a991f9e 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2 @@ -1,4 +1,4 @@ -{% if cloudflare.enabled %} +#% if bootstrap_cloudflare.enabled %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -8,4 +8,4 @@ metadata: spec: interval: 1h url: https://kubernetes.github.io/ingress-nginx -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2 index cf8db060..d55abf4d 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2 @@ -1,4 +1,4 @@ -{% if cloudflare.enabled %} +#% if bootstrap_cloudflare.enabled %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -8,4 +8,4 @@ metadata: spec: interval: 1h url: https://ori-edge.github.io/k8s_gateway -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 index 84143819..706bc8cd 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 @@ -4,18 +4,18 @@ kind: Kustomization resources: - ./bjw-s.yaml - ./cilium.yaml - {% if cloudflare.enabled %} + #% if bootstrap_cloudflare.enabled %# - ./external-dns.yaml - ./ingress-nginx.yaml - ./k8s-gateway.yaml - {% endif %} + #% endif %# - ./jetstack.yaml - ./metrics-server.yaml - ./openebs.yaml - {% if distribution.type in ["talos"] %} + #% if bootstrap_distribution in ["talos"] %# - ./postfinance.yaml - {% endif %} + #% endif %# - ./stakater.yaml - {% if distribution.type in ["talos"] %} + #% if bootstrap_distribution in ["talos"] %# - ./xenitab.yaml - {% endif %} + #% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2 index 5e4c596b..bb917225 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2 @@ -1,4 +1,4 @@ -{% if distribution.type in ["talos"] %} +#% if bootstrap_distribution in ["talos"] %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -8,4 +8,4 @@ metadata: spec: interval: 1h url: https://postfinance.github.io/kubelet-csr-approver -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2 index e945ab42..83f7ddac 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2 @@ -1,4 +1,4 @@ -{% if distribution.type in ["talos"] %} +#% if bootstrap_distribution in ["talos"] %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -9,4 +9,4 @@ spec: type: oci interval: 5m url: oci://ghcr.io/xenitab/helm-charts -{% endif %} +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 b/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 index cf5904f5..71a496d7 100644 --- a/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 @@ -6,8 +6,8 @@ metadata: namespace: flux-system stringData: SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit... - {% if cloudflare.enabled %} - SECRET_DOMAIN: "{{ cloudflare.domain }}" - SECRET_ACME_EMAIL: "{{ cloudflare.acme.email }}" - SECRET_CLOUDFLARE_TUNNEL_ID: "{{ cloudflare.tunnel.id }}" - {% endif %} + #% if bootstrap_cloudflare.enabled %# + SECRET_DOMAIN: "#{ bootstrap_cloudflare.domain }#" + SECRET_ACME_EMAIL: "#{ bootstrap_cloudflare.acme.email }#" + SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#" + #% endif %# diff --git a/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 b/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 index 035792fb..f176c7f5 100644 --- a/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 @@ -5,12 +5,12 @@ metadata: name: cluster-settings namespace: flux-system data: - TIMEZONE: "{{ timezone }}" - CLUSTER_CIDR: "{{ cluster.pod_network.split(',')[0] }}" - NODE_CIDR: "{{ nodes.host_network }}" - {% if feature_gates.dual_stack_ipv4_first %} - CLUSTER_CIDR_V6: "{{ cluster.pod_network.split(',')[1] }}" - {% endif %} - {% if distribution.talos.bgp.enabled %} - LOADBALANCER_CIDR: "{{ distribution.talos.bgp.loadbalancer_network }}" - {% endif %} + TIMEZONE: "#{ bootstrap_timezone }#" + CLUSTER_CIDR: "#{ bootstrap_pod_network.split(',')[0] }#" + NODE_CIDR: "#{ bootstrap_node_network }#" + #% if bootstrap_feature_gates.dual_stack_ipv4_first %# + CLUSTER_CIDR_V6: "#{ bootstrap_pod_network.split(',')[1] }#" + #% endif %# + #% if bootstrap_bgp.enabled %# + BGP_ADVERTISED_CIDR: "#{ bootstrap_bgp.advertised_network }#" + #% endif %# diff --git a/bootstrap/templates/kubernetes/talos/.mjfilter.py b/bootstrap/templates/kubernetes/talos/.mjfilter.py deleted file mode 100644 index 5af77870..00000000 --- a/bootstrap/templates/kubernetes/talos/.mjfilter.py +++ /dev/null @@ -1 +0,0 @@ -main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"] diff --git a/bootstrap/templates/kubernetes/talos/cilium/.gitignore.j2 b/bootstrap/templates/kubernetes/talos/cilium/.gitignore.j2 deleted file mode 100644 index ee3892e8..00000000 --- a/bootstrap/templates/kubernetes/talos/cilium/.gitignore.j2 +++ /dev/null @@ -1 +0,0 @@ -charts/ diff --git a/bootstrap/templates/kubernetes/talos/cilium/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/talos/cilium/kustomization.yaml.j2 deleted file mode 100644 index a4970c7d..00000000 --- a/bootstrap/templates/kubernetes/talos/cilium/kustomization.yaml.j2 +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -helmCharts: - - name: cilium - repo: https://helm.cilium.io - version: 1.15.1 - releaseName: cilium - namespace: kube-system - valuesFile: values.yaml -commonAnnotations: - meta.helm.sh/release-name: cilium - meta.helm.sh/release-namespace: kube-system -commonLabels: - app.kubernetes.io/managed-by: Helm diff --git a/bootstrap/templates/kubernetes/talos/cilium/values.yaml.j2 b/bootstrap/templates/kubernetes/talos/cilium/values.yaml.j2 deleted file mode 100644 index 53ff2ca8..00000000 --- a/bootstrap/templates/kubernetes/talos/cilium/values.yaml.j2 +++ /dev/null @@ -1,4 +0,0 @@ ---- -{% filter indent(width=0, first=True) %} -{% include 'partials/cilium-values-init.partial.yaml.j2' %} -{% endfilter %} diff --git a/bootstrap/templates/kubernetes/talos/kubelet-csr-approver/.gitignore.j2 b/bootstrap/templates/kubernetes/talos/kubelet-csr-approver/.gitignore.j2 deleted file mode 100644 index ee3892e8..00000000 --- a/bootstrap/templates/kubernetes/talos/kubelet-csr-approver/.gitignore.j2 +++ /dev/null @@ -1 +0,0 @@ -charts/ diff --git a/bootstrap/templates/kubernetes/talos/kubelet-csr-approver/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/talos/kubelet-csr-approver/kustomization.yaml.j2 deleted file mode 100644 index f4e7334b..00000000 --- a/bootstrap/templates/kubernetes/talos/kubelet-csr-approver/kustomization.yaml.j2 +++ /dev/null @@ -1,19 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: kube-system -helmCharts: - - name: kubelet-csr-approver - repo: https://postfinance.github.io/kubelet-csr-approver - version: 1.0.6 - releaseName: kubelet-csr-approver - namespace: kube-system - valuesInline: - {% filter indent(width=6, first=True) %} - {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %} - {% endfilter %} -commonAnnotations: - meta.helm.sh/release-name: kubelet-csr-approver - meta.helm.sh/release-namespace: kube-system -commonLabels: - app.kubernetes.io/managed-by: Helm diff --git a/bootstrap/templates/partials/cilium-values-full.partial.yaml.j2 b/bootstrap/templates/partials/cilium-values-full.partial.yaml.j2 index 32a55b72..968cf638 100644 --- a/bootstrap/templates/partials/cilium-values-full.partial.yaml.j2 +++ b/bootstrap/templates/partials/cilium-values-full.partial.yaml.j2 @@ -1,8 +1,6 @@ autoDirectNodeRoutes: true -{% if distribution.talos.bgp.enabled %} bgpControlPlane: enabled: true -{% endif %} bpf: masquerade: true cgroup: @@ -10,19 +8,19 @@ cgroup: enabled: false hostRoot: /sys/fs/cgroup cluster: - name: home-kubernetes id: 1 + name: home-kubernetes containerRuntime: integration: containerd - {% if distribution.type in ["k3s"] %} + #% if bootstrap_distribution in ["k3s"] %# socketPath: /var/run/k3s/containerd/containerd.sock - {% endif %} + #% endif %# # NOTE: This might need to be set if you have more than one active NIC on your hosts # devices: # - eno0 endpointRoutes: enabled: true -{% if cloudflare.enabled %} +#% if bootstrap_cloudflare.enabled %# hubble: enabled: true metrics: @@ -57,35 +55,33 @@ hubble: tls: - hosts: - "hubble.${SECRET_DOMAIN}" -{% else %} +#% else %# hubble: enabled: false -{% endif %} +#% endif %# ipam: mode: kubernetes ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}" -{% if feature_gates.dual_stack_ipv4_first %} +#% if bootstrap_feature_gates.dual_stack_ipv4_first %# ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}" ipv6: enabled: true -{% endif %} -{% if distribution.type in ["k3s"] %} +#% endif %# +#% if bootstrap_distribution in ["k3s"] %# k8sServiceHost: 127.0.0.1 k8sServicePort: 6444 -{% elif distribution.type in ["talos"] %} +#% elif bootstrap_distribution in ["talos"] %# k8sServiceHost: 127.0.0.1 k8sServicePort: 7445 -{% endif %} +#% endif %# kubeProxyReplacement: true kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 l2announcements: - {% if ( (distribution.talos.bgp.enabled) or - (feature_gates.dual_stack_ipv4_first) ) %} - # https://github.com/cilium/cilium/issues/28985 - enabled: false - {% else %} + #% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %# + enabled: false # https://github.com/cilium/cilium/issues/28985 + #% else %# enabled: true - {% endif %} + #% endif %# loadBalancer: algorithm: maglev mode: dsr diff --git a/bootstrap/templates/partials/cilium-values-init.partial.yaml.j2 b/bootstrap/templates/partials/cilium-values-init.partial.yaml.j2 index 8a304112..cb785f9e 100644 --- a/bootstrap/templates/partials/cilium-values-init.partial.yaml.j2 +++ b/bootstrap/templates/partials/cilium-values-init.partial.yaml.j2 @@ -1,8 +1,6 @@ autoDirectNodeRoutes: true -{% if distribution.talos.bgp.enabled %} bgpControlPlane: enabled: true -{% endif %} bpf: masquerade: true cgroup: @@ -10,13 +8,13 @@ cgroup: enabled: false hostRoot: /sys/fs/cgroup cluster: - name: home-kubernetes id: 1 + name: home-kubernetes containerRuntime: integration: containerd - {% if distribution.type in ["k3s"] %} + #% if bootstrap_distribution in ["k3s"] %# socketPath: /var/run/k3s/containerd/containerd.sock - {% endif %} + #% endif %# # NOTE: This might need to be set if you have more than one active NIC on your hosts # devices: # - eno0 @@ -26,29 +24,27 @@ hubble: enabled: false ipam: mode: kubernetes -ipv4NativeRoutingCIDR: "{{ cluster.pod_network }}" -{% if feature_gates.dual_stack_ipv4_first %} -ipv6NativeRoutingCIDR: "{{ cluster.pod_network_v6 }}" +ipv4NativeRoutingCIDR: "#{ bootstrap_pod_network }#" +#% if bootstrap_feature_gates.dual_stack_ipv4_first %# +ipv6NativeRoutingCIDR: "#{ bootstrap_pod_network_v6 }#" ipv6: enabled: true -{% endif %} -{% if distribution.type in ["k3s"] %} +#% endif %# +#% if bootstrap_distribution in ["k3s"] %# k8sServiceHost: 127.0.0.1 k8sServicePort: 6444 -{% elif distribution.type in ["talos"] %} +#% elif bootstrap_distribution in ["talos"] %# k8sServiceHost: 127.0.0.1 k8sServicePort: 7445 -{% endif %} +#% endif %# kubeProxyReplacement: true kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 l2announcements: - {% if ( (distribution.talos.bgp.enabled) or - (feature_gates.dual_stack_ipv4_first) ) %} - # https://github.com/cilium/cilium/issues/28985 - enabled: false - {% else %} + #% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %# + enabled: false # https://github.com/cilium/cilium/issues/28985 + #% else %# enabled: true - {% endif %} + #% endif %# loadBalancer: algorithm: maglev mode: dsr diff --git a/bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2 b/bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2 index bb650549..6c9475be 100644 --- a/bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2 +++ b/bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2 @@ -21,7 +21,7 @@ spec: args: ["manager"] env: - name: address - value: "{{ cluster.endpoint_vip }}" + value: "#{ bootstrap_controllers_vip }#" - name: vip_arp value: "true" - name: port diff --git a/bootstrap/templates/partials/kubelet-csr-approver-values.partial.yaml.j2 b/bootstrap/templates/partials/kubelet-csr-approver-values.partial.yaml.j2 index 51b5ec6c..0bf92493 100644 --- a/bootstrap/templates/partials/kubelet-csr-approver-values.partial.yaml.j2 +++ b/bootstrap/templates/partials/kubelet-csr-approver-values.partial.yaml.j2 @@ -1,2 +1,2 @@ -providerRegex: ^({{ (nodes.inventory | map(attribute='name') | join('|')) }})$ +providerRegex: ^(#{ (bootstrap_node_inventory | map(attribute='name') | join('|')) }#)$ bypassDnsResolution: true diff --git a/config.sample.yaml b/config.sample.yaml index bf5cafd8..2ee68ad0 100644 --- a/config.sample.yaml +++ b/config.sample.yaml @@ -1,161 +1,149 @@ --- # -# (Required) Distribution represents the Kubernetes distribution layer and any additional customizations +# 1. (Required) Cluster details - Cluster represents the Kubernetes cluster layer and any additional customizations # -distribution: - # (Required) Distribution can either be k3s, or talos - type: k3s - # (Optional) Talos Specific Options - talos: {} - # # (Required) If you need any additional System Extensions and/or kernel arguments generate a schematic ID. - # # Go to https://factory.talos.dev/ and choose the System Extensions you need and/or add extra kernel arguments. - # # Otherwise use below default. - # schematicID: "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba" - # # (Optional) Add vlan tag to network master device - # # See: https://www.talos.dev/latest/advanced/advanced-networking/#vlans - # vlan: 1 - # # (Optional) Use cilium BGP control plane when L2 announcements won't traverse VLAN network segments. - # # Needs a BGP capable router setup with the node IPs as peers. - # # See: https://docs.cilium.io/en/latest/network/bgp-control-plane/ - # bgp: - # enabled: true - # # (Optional) If using multiple BGP peers add them here. - # # Default is .1 derrived from host_network: ['x.x.x.1'] - # peers: [] - # # (Required) Set the BGP Autonomous System Number for the router(s) and nodes. - # # If these match, iBGP will be used. If not, eBGP will be used. - # peer_asn: 64512 # Router(s) AS - # local_asn: 64512 # Node(s) AS - # # (Required) The loadbalancer CIDR for the cluster, this must NOT overlap with any - # # existing networks and is usually a /16 (64K IPs). - # # If you want to use IPv6 check the advanced flags below - # loadbalancer_network: 10.123.0.0/16 - # secureboot: - # # (Optional) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode. - # # If you want to use this. Please make sure to boot from secureboot ISO and enroll keys first. - # # See: https://www.talos.dev/latest/talos-guides/install/bare-metal-platforms/secureboot - # enabled: true - # # (Optional) Enable TPM-based disk encryption. Requires TPM 2.0 - # # See: https://www.talos.dev/v1.6/talos-guides/install/bare-metal-platforms/secureboot/#disk-encryption-with-tpm - # encrypt_disk_with_tpm: true - # user_patches: true - # # (Optional) Add includes for user provided patches to generated talconfig.yaml. - # # See: https://github.com/budimanjojo/talhelper/blob/179ba9ed42f70069c7842109bea24f769f7af6eb/example/extraKernelArgs-patch.yaml - # # Patches are applied in this order. (global overrides cp/worker which overrides node-specific). - # # Create these files to allow talos:bootstrap-genconfig to complete (empty files are ok). - # # kubernetes/talos/patches/node_.yaml # Patches for individual nodes - # # kubernetes/talos/patches/controlPlane.yaml # Patches for controlplane nodes - # # kubernetes/talos/patches/worker.yaml # Patches for worker nodes - # # kubernetes/talos/patches/global.yaml # Patches for ALL nodes - -# # (Required) Timezone is your IANA formatted timezone (e.g. America/New_York) -# +bootstrap_timezone: "" -timezone: "" +# (Required) Distribution can either be k3s or talos +bootstrap_distribution: k3s -# -# (Required) Nodes represents the physical or virtual machines layer and any additional customizations -# +# (Required: Talos) Talos Specific Options +bootstrap_talos: + # (Required: Talos) If you need any additional System Extensions, and/or add kernel arguments generate a schematic ID. + # Go to https://factory.talos.dev/ and choose the System Extensions, and/or add kernel arguments. + schematic_id: "" + # (Optional: Talos) Add vlan tag to network master device + # See: https://www.talos.dev/latest/advanced/advanced-networking/#vlans + vlan: "" + # (Optional: Talos) Secureboot and TPM-based disk encryption + secureboot: + # (Optional) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode. + # See: https://www.talos.dev/latest/talos-guides/install/bare-metal-platforms/secureboot + enabled: false + # (Optional) Enable TPM-based disk encryption. Requires TPM 2.0 + # See: https://www.talos.dev/v1.6/talos-guides/install/bare-metal-platforms/secureboot/#disk-encryption-with-tpm + encrypt_disk_with_tpm: false + # (Optional) Add includes for user provided patches to generated talconfig.yaml. + # See: https://github.com/budimanjojo/talhelper/blob/179ba9ed42f70069c7842109bea24f769f7af6eb/example/extraKernelArgs-patch.yaml + # Patches are applied in this order. (global overrides cp/worker which overrides node-specific). + # Create these files to allow talos:bootstrap-genconfig to complete (empty files are ok). + # kubernetes/talos/patches/node_.yaml # Patches for individual nodes + # kubernetes/talos/patches/controlPlane.yaml # Patches for controlplane nodes + # kubernetes/talos/patches/worker.yaml # Patches for worker nodes + # kubernetes/talos/patches/global.yaml # Patches for ALL nodes + user_patches: false -nodes: - # (Required) CIDR your nodes are on (e.g. 192.168.1.0/24) - host_network: "" - # (Optional) Talos only: If your gateway is not on the .1 address of above CIDR you can set it here (e.g. 192.168.1.254) - # default_gateway: "" - # (Optional) The DNS server to use for the cluster, this can be an existing - # local DNS server or a public one. - # Default is ["1.1.1.1", "1.0.0.1"] - # If using a local DNS server make sure it meets the following requirements: - # 1. your nodes can reach it - # 2. it is configured to forward requests to a public DNS server - # 3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01 - # If using multiple DNS servers make sure they are setup the same way, there is no - # guarantee that the first DNS server will always be used for every lookup. - dns_servers: [] - # (Optional) The DNS search domain to use for the nodes. - # Default is "." - # Use the default or leave empty to avoid possible DNS issues inside the cluster. - search_domain: "" - # (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3 - # Worker nodes are optional - inventory: [] - # - name: "" # Name of the node (must match [a-z0-9-\.]+) - # address: "" # IP address of the node - # controller: true # (Required) Set to true if this is a controller node - # ssh_username: "" # (Required: k3s) SSH username of the node - # talos_disk_device: "" # (Required: Talos) Device path or serial number of the disk for this node +# (Required) The CIDR your nodes are on (e.g. 192.168.1.0/24) +bootstrap_node_network: "" + +# (Optional) The default gateway for the nodes +# Default is .1 derrived from bootstrap_node_network: 'x.x.x.1' +bootstrap_node_default_gateway: "" + +# (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3 +# Worker nodes are optional +bootstrap_node_inventory: [] + # - name: "" # Name of the node (must match [a-z0-9-\.]+) + # address: "" # IP address of the node + # controller: true # (Required) Set to true if this is a controller node + # ssh_user: "" # (Required: k3s) SSH username of the node + # talos_disk: "" # (Required: Talos) Device path or serial number of the disk for this node # ... -# -# (Required) Cluster represents the Kubernetes cluster layer and any additional customizations -# +# (Optional) The DNS server to use for the cluster, this can be an existing +# local DNS server or a public one. +# Default is ["1.1.1.1", "1.0.0.1"] +# If using a local DNS server make sure it meets the following requirements: +# 1. your nodes can reach it +# 2. it is configured to forward requests to a public DNS server +# 3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01 +# If using multiple DNS servers make sure they are setup the same way, there is no +# guarantee that the first DNS server will always be used for every lookup. +bootstrap_dns_servers: [] -cluster: - # (Required) The pod CIDR for the cluster, this must NOT overlap with any - # existing networks and is usually a /16 (64K IPs). - # If you want to use IPv6 check the advanced flags below - pod_network: 10.69.0.0/16 - # (Required) The service CIDR for the cluster, this must NOT overlap with any - # existing networks and is usually a /16 (64K IPs). - # If you want to use IPv6 check the advanced flags below - service_network: 10.96.0.0/16 - # (Required) The IP address of the Kube API, choose an available IP in - # your nodes host network that is NOT being used. This is announced over L2. - endpoint_vip: "" - # (Optional) Add additional SANs to the Kube API cert, this is useful - # if you want to call the Kube API by hostname rather than IP - tls_sans: [] +# (Optional) The DNS search domain to use for the nodes. +# Default is "." +# Use the default or leave empty to avoid possible DNS issues inside the cluster. +bootstrap_search_domain: "" -# -# (Optional) Flux details - Flux is used to manage the cluster configuration. -# +# (Required) The pod CIDR for the cluster, this must NOT overlap with any +# existing networks and is usually a /16 (64K IPs). +# If you want to use IPv6 check the advanced flags below +bootstrap_pod_network: "10.69.0.0/16" -flux: - # (Required) Disable to use a different tool (e.g. kubectl, Argo, Kluctl) +# (Required) The service CIDR for the cluster, this must NOT overlap with any +# existing networks and is usually a /16 (64K IPs). +# If you want to use IPv6 check the advanced flags below +bootstrap_service_network: "10.96.0.0/16" + +# (Required) The IP address of the Kube API, choose an available IP in +# your nodes host network that is NOT being used. This is announced over L2. +# For k3s kube-vip is used, built-in functionality is used with Talos +bootstrap_controllers_vip: "" + +# (Optional) Add additional SANs to the Kube API cert, this is useful +# if you want to call the Kube API by hostname rather than IP +bootstrap_tls_sans: [] + +# (Required) Age Public Key (e.g. age1...) +# 1. Generate a new key with the following command: +# > task sops:age-keygen +# 2. Copy the public key and paste it below +bootstrap_sops_age_pubkey: "" + +# (Optional) Use cilium BGP control plane when L2 announcements won't traverse VLAN network segments. +# Needs a BGP capable router setup with the node IPs as peers. +# See: https://docs.cilium.io/en/latest/network/bgp-control-plane/ +bootstrap_bgp: enabled: false - # (Required) Age Public Key (e.g. age1...) - # 1. Generate a new key with the following command: - # > task sops:age-keygen - # 2. Copy the public key and paste it below - sops_age_public_key: "" - # (Required) Options for GitHub - github: - # (Required) GitHub repository URL (for private repos use the ssh:// URL) - address: "" - # (Required) GitHub repository branch - branch: main - # (Required) Options for Flux GitHub webhook - webhook: - # (Required) Enable to setup GitHub push-based sync after cluster creation - enabled: true - # Token for GitHub push-based sync - # 1. Generate a new token with the following command: - # > openssl rand -hex 16 - # 2. Copy the token and paste it below - token: "" - # (Required) Private key for Flux to access the GitHub repository - private: - # (Required) Enable to use a private GitHub repository - enabled: false - # Private key for Flux to access the GitHub repository - # 1. Generate a new key with the following command: - # > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P "" - # 2. Make sure to paste public key from "github-deploy.key.pub" into - # the deploy keys section of your repository settings. - # 3. Uncomment and paste the private key below - # key: | - # -----BEGIN OPENSSH PRIVATE KEY----- - # ... - # -----END OPENSSH PRIVATE KEY----- + # (Optional) If using multiple BGP peers add them here. + # Default is .1 derrived from host_network: ['x.x.x.1'] + peers: [] + # (Required) Set the BGP Autonomous System Number for the router(s) and nodes. + # If these match, iBGP will be used. If not, eBGP will be used. + peer_asn: "" # Router(s) AS + local_asn: "" # Node(s) AS + # (Required) The advertised CIDR for the cluster, this must NOT overlap with any + # existing networks and is usually a /16 (64K IPs). + # If you want to use IPv6 check the advanced flags below + advertised_network: "" # -# (Optional) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling. +# 2. (Required) Flux details - Flux is used to manage the cluster configuration. # -cloudflare: +# (Required) GitHub repository URL (for private repos use the ssh:// URL) +bootstrap_github_address: "" + +# (Required) GitHub repository branch +bootstrap_github_branch: "main" + +# (Required) Token for GitHub push-based sync +# 1. Generate a new token with the following command: +# > openssl rand -hex 16 +# 2. Copy the token and paste it below +bootstrap_github_webhook_token: "" + +# (Optional) Private key for Flux to access the GitHub repository +# 1. Generate a new key with the following command: +# > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P "" +# 2. Make sure to paste public key from "github-deploy.key.pub" into +# the deploy keys section of your repository settings. +# 3. Uncomment and paste the private key below +# 4. Optionally set your repository on GitHub to private +# bootstrap_github_private_key: | +# -----BEGIN OPENSSH PRIVATE KEY----- +# ... +# -----END OPENSSH PRIVATE KEY----- + +# +# 3. (Optional) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling. +# + +bootstrap_cloudflare: # (Required) Disable to use a different DNS provider enabled: false # (Required) Cloudflare Domain @@ -209,11 +197,11 @@ cloudflare: ingress_vip: "" # (Optional) Feature gates are used to enable experimental features -feature_gates: - # Enable Dual Stack IPv4 first - # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it. - # Ref: https://github.com/onedr0p/cluster-template/issues/1148 - # Keep in mind that Cilium does not currently support IPv6 L2 announcements. - # Make sure you set cluster.pod_cidr and cluster.service_cidr - # to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64" - dual_stack_ipv4_first: false +# bootstrap_feature_gates: +# # Enable Dual Stack IPv4 first +# # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it. +# # Ref: https://github.com/onedr0p/cluster-template/issues/1148 +# # Keep in mind that Cilium does not currently support IPv6 L2 announcements. +# # Make sure you set cluster.pod_cidr and cluster.service_cidr +# # to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64" +# dual_stack_ipv4_first: false diff --git a/makejinja.toml b/makejinja.toml index efedf0a9..0d6281a1 100644 --- a/makejinja.toml +++ b/makejinja.toml @@ -10,9 +10,9 @@ force = true undefined = "chainable" [makejinja.delimiter] -block_start = "{%" -block_end = "%}" -comment_start = "{#" -comment_end = "#}" -variable_start = "{{" -variable_end = "}}" +block_start = "#%" +block_end = "%#" +comment_start = "#|" +comment_end = "#|" +variable_start = "#{" +variable_end = "}#"