refactor!: project updates (#1326)

* refactor!: flux is required again

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: delimiter that chomps

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: bootstrap_cloudflare logic

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: update tests

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: remove last quote

Signed-off-by: Devin Buhl <devin@buhl.casa>

* chore: update readme

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/scripts/validation.py

@@ -6,7 +6,7 @@ import netaddr
 import sys
 
 DISTRIBUTIONS = ["k3s", "talos"]
-GLOBAL_CLI_TOOLS = ["age", "cloudflared", "flux", "sops", "jq", "kubeconform", "kustomize"]
+GLOBAL_CLI_TOOLS = ["age", "cloudflared", "flux", "helmfile", "sops", "jq", "kubeconform", "kustomize"]
 TALOS_CLI_TOOLS = ["talosctl", "talhelper"]
 
 def required(*keys: str):
@@ -20,15 +20,6 @@ def required(*keys: str):
         return wrapper
     return wrapper_outter
 
-def _validate_network(network: str, family: int) -> str:
-    try:
-        network = netaddr.IPNetwork(network)
-        if network.version != family:
-            raise ValueError(f"Invalid network family {network.version}")
-    except netaddr.core.AddrFormatError as e:
-        raise ValueError(f"Invalid network {network}") from e
-    return network
-
 
 def validate_python_version() -> None:
     required_version = (3, 11, 0)
@@ -36,11 +27,10 @@ def validate_python_version() -> None:
         raise ValueError(f"Python version is below 3.11. Please upgrade.")
 
 
-@required("distribution")
+@required("bootstrap_distribution")
 def validate_cli_tools(distribution: dict, **_) -> None:
-    distro = distribution.get("type")
-    if distro not in DISTRIBUTIONS:
-        raise ValueError(f"Invalid distribution {distro}")
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")
     for tool in GLOBAL_CLI_TOOLS:
         if not which(tool):
             raise ValueError(f"Missing required CLI tool {tool}")
@@ -49,65 +39,20 @@ def validate_cli_tools(distribution: dict, **_) -> None:
             raise ValueError(f"Missing required CLI tool {tool}")
 
 
-@required("distribution")
+@required("bootstrap_distribution")
 def validate_distribution(distribution: dict, **_) -> None:
-    distro = distribution.get("type")
-    if distro not in DISTRIBUTIONS:
-        raise ValueError(f"Invalid distribution {distro}")
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")
 
 
-@required("timezone")
+@required("bootstrap_timezone")
 def validate_timezone(timezone: str, **_) -> None:
     if timezone not in available_timezones():
         raise ValueError(f"Invalid timezone {timezone}")
 
 
-@required("cluster", "feature_gates")
-def validate_cluster_networks(cluster: dict, feature_gates: dict, **_) -> None:
-    dual_stack_ipv4_first = feature_gates.get("dual_stack_ipv4_first", False)
-    pod_network = cluster.get("pod_network")
-    service_network = cluster.get("service_network")
-
-    if pod_network == service_network:
-        raise ValueError(f"Pod network {pod_network} is the same as service network {service_network}")
-
-    if dual_stack_ipv4_first:
-        if len(pod_network.split(",")) != 2:
-            raise ValueError(f"Invalid pod network {pod_network}")
-        if len(service_network.split(",")) != 2:
-            raise ValueError(f"Invalid service network {service_network}")
-        cluster_ipv4, cluster_ipv6 = pod_network.split(",")
-        _validate_network(cluster_ipv4, 4)
-        _validate_network(cluster_ipv6, 6)
-        service_ipv4, service_ipv6 = service_network.split(",")
-        _validate_network(service_ipv4, 4)
-        _validate_network(service_ipv6, 6)
-        return
-
-    if len(pod_network.split(",")) != 1:
-        raise ValueError(f"Invalid pod network {pod_network}")
-    if len(service_network.split(",")) != 1:
-        raise ValueError(f"Invalid service network {service_network}")
-
-    _validate_network(pod_network, 4)
-    _validate_network(service_network, 4)
-
-
-def massage_config(data: dict) -> dict:
-    data["distribution"] = data.get("distribution", {})
-    data["nodes"] = data.get("nodes", [])
-    data["cluster"] = data.get("cluster", {})
-    data["flux"] = data.get("flux", {})
-    data["cloudflare"] = data.get("cloudflare", {})
-    data["feature_gates"] = data.get("feature_gates", {})
-    return data
-
-
 def validate(data: dict) -> None:
-    user_config = massage_config(data)
-
     validate_python_version()
-    validate_cli_tools(user_config)
-    validate_distribution(user_config)
-    validate_timezone(user_config)
-    validate_cluster_networks(user_config)
+    validate_cli_tools(data)
+    validate_distribution(data)
+    validate_timezone(data)

bootstrap/templates/.sops.yaml.j2

@@ -1,22 +1,20 @@
-{% if flux.enabled %}
 ---
 creation_rules:
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
   - # IMPORTANT: This rule MUST be above the others
     path_regex: talos/.*\.sops\.ya?ml
     key_groups:
       - age:
-          - "{{ flux.sops_age_public_key }}"
-  {% endif %}
+          - "#{ bootstrap_sops_age_pubkey }#"
+  #% endif %#
   - path_regex: kubernetes/.*\.sops\.ya?ml
     encrypted_regex: "^(data|stringData)$"
     key_groups:
       - age:
-          - "{{ flux.sops_age_public_key }}"
-  {% if distribution.type in ["k3s"] %}
+          - "#{ bootstrap_sops_age_pubkey }#"
+  #% if bootstrap_distribution in ["k3s"] %#
   - path_regex: ansible/.*\.sops\.ya?ml
     key_groups:
       - age:
-          - "{{ flux.sops_age_public_key }}"
-  {% endif %}
-{% endif %}
+          - "#{ bootstrap_sops_age_pubkey }#"
+  #% endif %#

bootstrap/templates/ansible/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["k3s"]
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"]

bootstrap/templates/ansible/inventory/group_vars/controllers/main.yaml.j2

@@ -1,13 +1,13 @@
 ---
 k3s_control_node: true
 k3s_server:
-  {% if feature_gates.dual_stack_ipv4_first %}
-  cluster-cidr: "{{ cluster.pod_network.split(',')[0] }},{{ cluster.pod_network.split(',')[1] }}"
-  service-cidr: "{{ cluster.service_network.split(',')[0] }},{{ cluster.service_network.split(',')[1] }}"
-  {% else %}
-  cluster-cidr: "{{ cluster.pod_network }}"
-  service-cidr: "{{ cluster.service_network }}"
-  {% endif %}
+  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+  cluster-cidr: "#{ bootstrap_pod_network.split(',')[0] }#,#{ bootstrap_pod_network.split(',')[1] }#"
+  service-cidr: "#{ bootstrap_service_network.split(',')[0] }#,#{ bootstrap_service_network.split(',')[1] }#"
+  #% else %#
+  cluster-cidr: "#{ bootstrap_pod_network }#"
+  service-cidr: "#{ bootstrap_service_network }#"
+  #% endif %#
   disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
   disable-cloud-controller: true
   disable-kube-proxy: true
@@ -25,16 +25,16 @@ k3s_server:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
-  {% if feature_gates.dual_stack_ipv4_first %}
-  node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}"
-  {% else %}
-  node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
-  {% endif %}
+  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
+  #% else %#
+  node-ip: "{{ ansible_host }}"
+  #% endif %#
   pause-image: registry.k8s.io/pause:3.9
   secrets-encryption: true
   tls-san:
-    - "{{ cluster.endpoint_vip }}"
-    {% for item in cluster.tls_sans %}
-    - "{{ item }}"
-    {% endfor %}
+    - "#{ bootstrap_controllers_vip }#"
+    #% for item in bootstrap_tls_sans %#
+    - "#{ item }#"
+    #% endfor %#
   write-kubeconfig-mode: "644"

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -2,7 +2,7 @@
 k3s_become: true
 k3s_etcd_datastore: true
 k3s_install_hard_links: true
-k3s_registration_address: "{{ cluster.endpoint_vip }}"
+k3s_registration_address: "#{ bootstrap_controllers_vip }#"
 k3s_registries:
   mirrors:
     docker.io:

bootstrap/templates/ansible/inventory/group_vars/workers/.mjfilter.py

@@ -1,9 +1,9 @@
 main = lambda data: (
-    data.get("distribution").get("type", "k3s") in ["k3s"] and
+    data.get("bootstrap_distribution", "k3s") in ["k3s"] and
     len(
         list(
             filter(
-                lambda item: "controller" in item and item["controller"] is False, data.get("nodes").get("inventory")
+                lambda item: "controller" in item and item["controller"] is False, data.get("bootstrap_node_inventory")
             )
         )
     ) > 0

bootstrap/templates/ansible/inventory/group_vars/workers/main.yaml.j2

@@ -4,9 +4,9 @@ k3s_agent:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
-  {% if feature_gates.dual_stack_ipv4_first %}
-  node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}"
-  {% else %}
-  node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
-  {% endif %}
+  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
+  #% else %#
+  node-ip: "{{ ansible_host }}"
+  #% endif %#
   pause-image: registry.k8s.io/pause:3.9

bootstrap/templates/ansible/inventory/hosts.yaml.j2

@@ -3,21 +3,21 @@ kubernetes:
   children:
     controllers:
       hosts:
-        {% for item in nodes.inventory %}
-        {% if item.controller %}
-        "{{ item.name }}":
-          ansible_user: "{{ item.ssh_username }}"
-          ansible_host: "{{ item.address }}"
-        {% endif %}
-        {% endfor %}
-    {% if nodes.inventory | selectattr('controller', 'equalto', False) | list | length %}
+        #% for item in bootstrap_node_inventory %#
+        #% if item.controller %#
+        "#{ item.name }#":
+          ansible_user: "#{ item.ssh_user }#"
+          ansible_host: "#{ item.address }#"
+        #% endif %#
+        #% endfor %#
+    #% if bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length %#
     workers:
       hosts:
-        {% for item in nodes.inventory %}
-        {% if not item.controller %}
-        "{{ item.name }}":
-          ansible_user: "{{ item.ssh_username }}"
-          ansible_host: "{{ item.address }}"
-        {% endif %}
-        {% endfor %}
-    {% endif %}
+        #% for item in bootstrap_node_inventory %#
+        #% if not item.controller %#
+        "#{ item.name }#":
+          ansible_user: "#{ item.ssh_user }#"
+          ansible_host: "#{ item.address }#"
+        #% endif %#
+        #% endfor %#
+    #% endif %#

bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2

@@ -42,9 +42,9 @@
             or k3s_server_manifests_urls | length > 0)
       kubernetes.core.k8s_info:
         kubeconfig: /etc/rancher/k3s/k3s.yaml
-        kind: "{% raw %}{{ item.kind }}{% endraw %}"
-        name: "{% raw %}{{ item.name }}{% endraw %}"
-        namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}"
+        kind: "{{ item.kind }}"
+        name: "{{ item.name }}"
+        namespace: "{{ item.namespace | default('') }}"
         wait: true
         wait_sleep: 10
         wait_timeout: 360

bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2

@@ -20,5 +20,5 @@
     - name: Upgrade kube-vip
       ansible.builtin.template:
         src: templates/kube-vip-ds.yaml.j2
-        dest: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}/kube-vip-ds.yaml"
+        dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml"
         mode: preserve

bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2

@@ -36,17 +36,17 @@
       block:
         - name: Networking | Delete Cilium links
           ansible.builtin.command:
-            cmd: "ip link delete {% raw %}{{ item }}{% endraw %}"
-            removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}"
+            cmd: "ip link delete {{ item }}"
+            removes: "/sys/class/net/{{ item }}"
           loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
         - name: Networking | Flush iptables
           ansible.builtin.iptables:
-            table: "{% raw %}{{ item }}{% endraw %}"
+            table: "{{ item }}"
             flush: true
           loop: ["filter", "nat", "mangle", "raw"]
         - name: Networking | Flush ip6tables
           ansible.builtin.iptables:
-            table: "{% raw %}{{ item }}{% endraw %}"
+            table: "{{ item }}"
             flush: true
             ip_version: ipv6
           loop: ["filter", "nat", "mangle", "raw"]
@@ -86,7 +86,7 @@
         - k3s_install_hard_links
         - not ansible_check_mode
       ansible.builtin.file:
-        path: "{% raw %}{{ k3s_install_dir }}{% endraw %}/{% raw %}{{ item }}{% endraw %}"
+        path: "{{ k3s_install_dir }}/{{ item }}"
         state: absent
       loop: ["kubectl", "crictl", "ctr"]
 

bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2

@@ -15,7 +15,7 @@
       block:
         - name: Locale | Set timezone
           community.general.timezone:
-            name: "{{ timezone }}"
+            name: "#{ bootstrap_timezone }#"
 
     - name: Packages
       block:
@@ -32,12 +32,12 @@
       block:
         - name: Network Configuration | Set hostname
           ansible.builtin.hostname:
-            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
+            name: "{{ inventory_hostname }}"
         - name: Network Configuration | Update hosts
           ansible.builtin.copy:
             content: |
               127.0.0.1 localhost
-              127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %}
+              127.0.1.1 {{ inventory_hostname }}
 
               # The following lines are desirable for IPv6 capable hosts
               ::1     localhost ip6-localhost ip6-loopback
@@ -61,10 +61,10 @@
             mode: '0644'
             dest: /etc/resolv.conf
             content: |
-              search {{ nodes.search_domain|default('.', true) }}
-              {% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %}
-              nameserver {{ item }}
-              {% endfor %}
+              search #{ bootstrap_search_domain|default('.', true) }#
+              #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
+              nameserver #{ item }#
+              #% endfor %#
 
     - name: System Configuration
       notify: Reboot
@@ -77,15 +77,15 @@
             masked: true
         - name: System Configuration | Disable swap
           ansible.posix.mount:
-            name: "{% raw %}{{ item }}{% endraw %}"
+            name: "{{ item }}"
             fstype: swap
             state: absent
           loop: ["none", "swap"]
         - name: System Configuration | Create Kernel modules
           ansible.builtin.copy:
-            dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf"
+            dest: "/etc/modules-load.d/{{ item }}.conf"
             mode: "0644"
-            content: "{% raw %}{{ item }}{% endraw %}"
+            content: "{{ item }}"
           loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
           register: modules_status
         - name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler
@@ -95,11 +95,11 @@
             state: restarted
         - name: System Configuration | Sysctl
           ansible.posix.sysctl:
-            name: "{% raw %}{{ item.key }}{% endraw %}"
-            value: "{% raw %}{{ item.value }}{% endraw %}"
+            name: "{{ item.key }}"
+            value: "{{ item.value }}"
             sysctl_file: /etc/sysctl.d/99-kubernetes.conf
             reload: true
-          with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}"
+          with_dict: "{{ sysctl_config }}"
           vars:
             sysctl_config:
               fs.inotify.max_queued_events: 65536

bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2

@@ -11,9 +11,9 @@
         seconds: 5
   tasks:
     - name: Details
-      ansible.builtin.command: "k3s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
+      ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
       register: kubectl_get_node
-      delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}"
+      delegate_to: "{{ groups['controllers'][0] }}"
       failed_when: false
       changed_when: false
 
@@ -26,14 +26,14 @@
       block:
         - name: Cordon
           kubernetes.core.k8s_drain:
-            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
+            name: "{{ inventory_hostname }}"
             kubeconfig: /etc/rancher/k3s/k3s.yaml
             state: cordon
-          delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}"
+          delegate_to: "{{ groups['controllers'][0] }}"
 
         - name: Drain
           kubernetes.core.k8s_drain:
-            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
+            name: "{{ inventory_hostname }}"
             kubeconfig: /etc/rancher/k3s/k3s.yaml
             state: drain
             delete_options:
@@ -43,7 +43,7 @@
               wait_timeout: 900
             pod_selectors:
               - app!=rook-ceph-osd # Rook Ceph
-          delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}"
+          delegate_to: "{{ groups['controllers'][0] }}"
 
         - name: Update
           ansible.builtin.apt:
@@ -64,7 +64,7 @@
 
         - name: Uncordon
           kubernetes.core.k8s_drain:
-            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
+            name: "{{ inventory_hostname }}"
             kubeconfig: /etc/rancher/k3s/k3s.yaml
             state: uncordon
-          delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}"
+          delegate_to: "{{ groups['controllers'][0] }}"

bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2

@@ -3,7 +3,7 @@
   block:
     - name: Cruft | Get list of custom manifests
       ansible.builtin.find:
-        paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}"
+        paths: "{{ k3s_server_manifests_dir }}"
         file_type: file
         use_regex: true
         patterns: ["^custom-.*"]
@@ -11,9 +11,9 @@
 
     - name: Cruft | Delete custom manifests
       ansible.builtin.file:
-        path: "{% raw %}{{ item.path }}{% endraw %}"
+        path: "{{ item.path }}"
         state: absent
-      loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}"
+      loop: "{{ custom_manifest.files }}"
 
     - name: Cruft | Get list of custom addons
       kubernetes.core.k8s_info:
@@ -24,8 +24,8 @@
     - name: Cruft | Delete addons
       kubernetes.core.k8s:
         kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: "{% raw %}{{ item.metadata.name }}{% endraw %}"
+        name: "{{ item.metadata.name }}"
         kind: Addon
         namespace: kube-system
         state: absent
-      loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
+      loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}"

bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2

@@ -13,7 +13,7 @@
   when: k3s_primary_control_node
   ansible.builtin.fetch:
     src: /etc/rancher/k3s/k3s.yaml
-    dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
+    dest: "{{ repository_path.stdout }}/kubeconfig"
     flat: true
 
 - name: Update kubeconfig with the correct load balancer address
@@ -21,6 +21,6 @@
   become: false
   run_once: true
   ansible.builtin.replace:
-    path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
+    path: "{{ repository_path.stdout }}/kubeconfig"
     regexp: https://127.0.0.1:6443
-    replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
+    replace: "https://{{ k3s_registration_address }}:6443"

bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2

@@ -9,10 +9,9 @@
 
     - name: Extract k3s version
       ansible.builtin.set_fact:
-        current_k3s_version: "{% raw %}{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P<version>[a-z0-9\\.\\+]+).*\n.*', '\\g<version>') }}{% endraw %}"
+        current_k3s_version: "{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P<version>[a-z0-9\\.\\+]+).*\n.*', '\\g<version>') }}"
 
     - name: Check if upgrades are allowed
       ansible.builtin.assert:
-        that:
-          - "k3s_release_version is version(current_k3s_version, '>=')"
+        that: ["k3s_release_version is version(current_k3s_version, '>=')"]
         fail_msg: "Unable to upgrade k3s because the deployed version is higher than the one specified in the configuration"

bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2

@@ -12,6 +12,6 @@ spec:
   targetNamespace: kube-system
   bootstrap: true
   valuesContent: |-
-    {% filter indent(width=4, first=True) %}
-    {% include 'partials/cilium-values-init.partial.yaml.j2' %}
-    {% endfilter %}
+    #% filter indent(width=4, first=True) %#
+    #% include 'partials/cilium-values-init.partial.yaml.j2' %#
+    #% endfilter %#

bootstrap/templates/ansible/playbooks/templates/kube-vip-ds.yaml.j2

@@ -1,2 +1,2 @@
 ---
-{% include 'partials/kube-vip-ds.partial.yaml.j2' %}
+#% include 'partials/kube-vip-ds.partial.yaml.j2' %#

bootstrap/templates/ansible/playbooks/templates/kube-vip-rbac.yaml.j2

@@ -1,2 +1,2 @@
 ---
-{% include 'partials/kube-vip-rbac.partial.yaml.j2' %}
+#% include 'partials/kube-vip-rbac.partial.yaml.j2' %#

bootstrap/templates/kubernetes/apps/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("flux", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("cloudflare", {}).get("enabled", False) == True
+main = lambda data: data.get("bootstrap_cloudflare", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2

@@ -4,4 +4,4 @@ kind: Secret
 metadata:
   name: cert-manager-secret
 stringData:
-  api-token: "{{ cloudflare.token }}"
+  api-token: "#{ bootstrap_cloudflare.token }#"

bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2

@@ -18,7 +18,7 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -41,4 +41,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2

@@ -3,6 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  {% if flux.github.webhook.enabled %}
   - ./webhooks/ks.yaml
-  {% endif %}

bootstrap/templates/kubernetes/apps/flux-system/webhooks/.mjfilter.py

@@ -1,6 +0,0 @@
-main = lambda data: (
-    data.get("flux", {})
-        .get("github", {})
-        .get("webhook", {})
-        .get("enabled", False) == True
-)

bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2

@@ -1,4 +1,4 @@
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -22,4 +22,4 @@ spec:
   tls:
     - hosts:
         - *host
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2

@@ -3,7 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
-  {% if cloudflare.enabled %}
+  #% if bootstrap_cloudflare.enabled %#
   - ./ingress.yaml
-  {% endif %}
+  #% endif %#
   - ./receiver.yaml

bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2

@@ -4,4 +4,4 @@ kind: Secret
 metadata:
   name: github-webhook-token-secret
 stringData:
-  token: "{{ flux.github.webhook.token }}"
+  token: "#{ bootstrap_github_webhook_token }#"

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-bgp.yaml.j2

@@ -9,21 +9,21 @@ spec:
     matchLabels:
       kubernetes.io/os: linux
   virtualRouters:
-    - localASN: {{ distribution.talos.bgp.local_asn }}
+    - localASN: #{ bootstrap_bgp.local_asn }#
       neighbors:
-        {% if distribution.talos.bgp.peers %}
-        {% for item in distribution.talos.bgp.peers %}
-        - peerAddress: "{{ item }}/32"
-          peerASN: {{ distribution.talos.bgp.peer_asn }}
-        {% endfor %}
-        {% else %}
-        {% if nodes.default_gateway %}
-        - peerAddress: "{{ nodes.default_gateway }}/32"
-        {% else %}
-        - peerAddress: "{{ nodes.host_network | nthhost(1) }}/32"
-        {% endif %}
-          peerASN: {{ distribution.talos.bgp.peer_asn }}
-        {% endif %}
+        #% if bootstrap_bgp.peers %#
+        #% for item in bootstrap_bgp.peers %#
+        - peerAddress: "#{ item }#/32"
+          peerASN: #{ bootstrap_bgp.peer_asn }#
+        #% endfor %#
+        #% else %#
+        #% if bootstrap_node_default_gateway %#
+        - peerAddress: "#{ bootstrap_node_default_gateway }#/32"
+        #% else %#
+        - peerAddress: "#{ bootstrap_node_network | nthhost(1) }#/32"
+        #% endif %#
+          peerASN: #{ bootstrap_bgp.peer_asn }#
+        #% endif %#
       serviceSelector:
         matchExpressions:
           - {key: somekey, operator: NotIn, values: ['never-used-value']}
@@ -34,4 +34,4 @@ metadata:
   name: pool
 spec:
   cidrs:
-    - cidr: "${LOADBALANCER_CIDR}"
+    - cidr: "${BGP_ADVERTISED_CIDR}"

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2

@@ -23,6 +23,6 @@ spec:
   uninstall:
     keepHistory: false
   values:
-    {% filter indent(width=4, first=True) %}
-    {% include 'partials/cilium-values-full.partial.yaml.j2' %}
-    {% endfilter %}
+    #% filter indent(width=4, first=True) %#
+    #% include 'partials/cilium-values-full.partial.yaml.j2' %#
+    #% endfilter %#

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2

@@ -2,11 +2,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  {% if distribution.talos.bgp.enabled %}
+  #% if bootstrap_bgp.enabled %#
   - ./cilium-bgp.yaml
-  {% endif %}
-  {% if ( (not distribution.talos.bgp.enabled) and
-          (not feature_gates.dual_stack_ipv4_first) ) %}
+  #% endif %#
+  #% if ((not bootstrap_bgp.enabled) and (not bootstrap_feature_gates.dual_stack_ipv4_first)) %#
   - ./cilium-l2.yaml
-  {% endif %}
+  #% endif %#
   - ./helmrelease.yaml

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]

bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2

@@ -23,9 +23,9 @@ spec:
   uninstall:
     keepHistory: false
   values:
-    {% filter indent(width=4, first=True) %}
-    {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
-    {% endfilter %}
+    #% filter indent(width=4, first=True) %#
+    #% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
+    #% endfilter %#
     metrics:
       enable: true
       serviceMonitor:

bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2

@@ -4,11 +4,11 @@ kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./cilium/ks.yaml
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
   - ./kubelet-csr-approver/ks.yaml
-  {% endif %}
+  #% endif %#
   - ./metrics-server/ks.yaml
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
   - ./spegel/ks.yaml
-  {% endif %}
+  #% endif %#
   - ./reloader/ks.yaml

bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2

@@ -28,4 +28,4 @@ spec:
       readOnlyRootFileSystem: true
       podMonitor:
         enabled: true
-        namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}"
+        namespace: "{{ .Release.Namespace }}"

bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]

bootstrap/templates/kubernetes/apps/network/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("cloudflare", {}).get("enabled", False) == True
+main = lambda data: data.get("bootstrap_cloudflare", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2

@@ -4,10 +4,10 @@ kind: Secret
 metadata:
   name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
+  TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#"
   credentials.json: |
     {
-      "AccountTag": "{{ cloudflare.tunnel.account_id }}",
-      "TunnelSecret": "{{ cloudflare.tunnel.secret }}",
-      "TunnelID": "{{ cloudflare.tunnel.id }}"
+      "AccountTag": "#{ bootstrap_cloudflare.tunnel.account_id }#",
+      "TunnelSecret": "#{ bootstrap_cloudflare.tunnel.secret }#",
+      "TunnelID": "#{ bootstrap_cloudflare.tunnel.id }#"
     }

bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2

@@ -82,7 +82,7 @@ spec:
         annotations:
           external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
         hosts:
-          - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-external.${SECRET_DOMAIN}"
+          - host: &host "{{ .Release.Name }}-external.${SECRET_DOMAIN}"
             paths:
               - path: /
                 service:
@@ -95,7 +95,7 @@ spec:
         enabled: true
         className: internal
         hosts:
-          - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-internal.${SECRET_DOMAIN}"
+          - host: &host "{{ .Release.Name }}-internal.${SECRET_DOMAIN}"
             paths:
               - path: /
                 service:

bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2

@@ -4,4 +4,4 @@ kind: Secret
 metadata:
   name: external-dns-secret
 stringData:
-  api-token: "{{ cloudflare.token }}"
+  api-token: "#{ bootstrap_cloudflare.token }#"

bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2

@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./staging.yaml
-  {% if cloudflare.acme.production %}
+  #% if bootstrap_cloudflare.acme.production %#
   - ./production.yaml
-  {% endif %}
+  #% endif %#

bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2

@@ -32,7 +32,7 @@ spec:
       service:
         annotations:
           external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "{{ cloudflare.tunnel.ingress_vip }}"
+          io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.tunnel.ingress_vip }#"
         externalTrafficPolicy: Cluster
       ingressClassResource:
         name: external
@@ -70,11 +70,11 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
-        {% if cloudflare.acme.production %}
+        #% if bootstrap_cloudflare.acme.production %#
         default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
-        {% else %}
+        #% else %#
         default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
-        {% endif %}
+        #% endif %#
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname

bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2

@@ -29,7 +29,7 @@ spec:
       replicaCount: 1
       service:
         annotations:
-          io.cilium/lb-ipam-ips: "{{ cloudflare.ingress_vip }}"
+          io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.ingress_vip }#"
         externalTrafficPolicy: Cluster
       ingressClassResource:
         name: internal
@@ -67,11 +67,11 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
-        {% if cloudflare.acme.production %}
+        #% if bootstrap_cloudflare.acme.production %#
         default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
-        {% else %}
+        #% else %#
         default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
-        {% endif %}
+        #% endif %#
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname

bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2

@@ -30,5 +30,5 @@ spec:
       type: LoadBalancer
       port: 53
       annotations:
-        io.cilium/lb-ipam-ips: "{{ cloudflare.gateway_vip }}"
+        io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.gateway_vip }#"
       externalTrafficPolicy: Cluster

bootstrap/templates/kubernetes/apps/system-upgrade/k3s/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["k3s"]
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"]

bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2

@@ -3,12 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  {% if distribution.type in ['k3s', 'talos'] %}
+  #% if bootstrap_distribution in ['k3s', 'talos'] %#
   - ./system-upgrade-controller/ks.yaml
-  {% endif %}
-  {% if distribution.type in ["k3s"] %}
+  #% endif %#
+  #% if bootstrap_distribution in ["k3s"] %#
   - ./k3s/ks.yaml
-  {% endif %}
-  {% if distribution.type in ["talos"] and distribution.talos.schematicID %}
+  #% endif %#
+  #% if bootstrap_distribution in ["talos"] and bootstrap_talos.schematic_id %#
   - ./talos/ks.yaml
-  {% endif %}
+  #% endif %#

bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/.mjfilter.py

@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ['k3s', 'talos']
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s", "talos"]

bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/rbac.yaml.j2

@@ -11,7 +11,7 @@ subjects:
   - kind: ServiceAccount
     name: system-upgrade
     namespace: system-upgrade
-{% if distribution.type in ["talos"] %}
+#% if bootstrap_distribution in ["talos"] %#
 ---
 apiVersion: talos.dev/v1alpha1
 kind: ServiceAccount
@@ -20,4 +20,4 @@ metadata:
 spec:
   roles:
     - os:admin
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/apps/system-upgrade/talos/.mjfilter.py

@@ -1,6 +1,4 @@
 main = lambda data: (
-    data.get("distribution", {}).get("type", "k3s") in ["talos"] and
-        data.get("distribution", {})
-            .get("talos", {})
-            .get("schematicID", {})
+    data.get("bootstrap_distribution", "k3s") in ["talos"] and
+        data.get("talos", {}).get("schematic_id", {})
 )

bootstrap/templates/kubernetes/apps/system-upgrade/talos/app/plan.yaml.j2

@@ -88,6 +88,6 @@ spec:
     args:
       - --nodes=$(NODE_IP)
       - upgrade
-      - --image=factory.talos.dev/installer/{{ distribution.talos.schematicID }}:$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
+      - --image=factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#:$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
       - --preserve=true
       - --wait=false

bootstrap/templates/kubernetes/bootstrap/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("flux", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/bootstrap/flux/github-deploy-key.sops.yaml.j2

@@ -1,4 +1,4 @@
-{% if flux.github.private.enabled %}
+#% if bootstrap_github_private_key %#
 ---
 apiVersion: v1
 kind: Secret
@@ -7,11 +7,11 @@ metadata:
   namespace: flux-system
 stringData:
   identity: |
-    {% filter indent(width=4, first=False) %}
-    {{ flux.github.private.key }}
-    {%- endfilter %}
+    #% filter indent(width=4, first=False) %#
+    #{ bootstrap_github_private_key }#
+    #%- endfilter %#
   known_hosts: |
     github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
     github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
     github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/bootstrap/talos/.mjfilter.py

@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]

bootstrap/templates/kubernetes/bootstrap/talos/apps/cilium-values.yaml.j2

@@ -0,0 +1,4 @@
+---
+#% filter indent(width=0, first=True) %#
+#% include 'partials/cilium-values-init.partial.yaml.j2' %#
+#% endfilter %#

bootstrap/templates/kubernetes/bootstrap/talos/apps/helmfile.yaml.j2

@@ -0,0 +1,22 @@
+---
+repositories:
+  - name: cilium
+    url: https://helm.cilium.io
+  - name: postfinance
+    url: https://postfinance.github.io/kubelet-csr-approver
+
+releases:
+  - name: cilium
+    namespace: kube-system
+    chart: cilium/cilium
+    version: 1.15.1
+    wait: true
+    values:
+      - ./cilium-values.yaml
+  - name: kubelet-csr-approver
+    namespace: kube-system
+    chart: postfinance/kubelet-csr-approver
+    version: 1.0.7
+    wait: true
+    values:
+      - ./kubelet-csr-approver-values.yaml

bootstrap/templates/kubernetes/bootstrap/talos/apps/kubelet-csr-approver-values.yaml.j2

@@ -0,0 +1,4 @@
+---
+#% filter indent(width=0, first=True) %#
+#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
+#% endfilter %#

bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2

@@ -6,80 +6,80 @@ talosVersion: v1.6.4
 kubernetesVersion: v1.29.1
 
 clusterName: &cluster home-kubernetes
-endpoint: https://{{ cluster.endpoint_vip }}:6443
+endpoint: https://#{ bootstrap_controllers_vip }#:6443
 clusterPodNets:
-  - "{{ cluster.pod_network.split(',')[0] }}"
+  - "#{ bootstrap_pod_network.split(',')[0] }#"
 clusterSvcNets:
-  - "{{ cluster.service_network.split(',')[0] }}"
+  - "#{ bootstrap_service_network.split(',')[0] }#"
 additionalApiServerCertSans: &sans
-  - "{{ cluster.endpoint_vip }}"
+  - "#{ bootstrap_controllers_vip }#"
   - 127.0.0.1 # KubePrism
-  {% for item in cluster.tls_sans %}
-  - "{{ item }}"
-  {% endfor %}
+  #% for item in bootstrap_tls_sans %#
+  - "#{ item }#"
+  #% endfor %#
 additionalMachineCertSans: *sans
 cniConfig:
   name: none
 
 nodes:
-  {% for item in nodes.inventory %}
-  - hostname: "{{ item.name }}"
-    ipAddress: "{{ item.address }}"
-    {% if item.talos_disk_device.startswith('/') %}
-    installDisk: "{{ item.talos_disk_device }}"
-    {% else %}
+  #% for item in bootstrap_node_inventory %#
+  - hostname: "#{ item.name }#"
+    ipAddress: "#{ item.address }#"
+    #% if item.talos_disk.startswith('/') %#
+    installDisk: "#{ item.talos_disk }#"
+    #% else %#
     installDiskSelector:
-      serial: "{{ item.talos_disk_device }}"
-    {% endif %}
-    {% if distribution.talos.secureboot.enabled %}
+      serial: "#{ item.talos_disk }#"
+    #% endif %#
+    #% if bootstrap_talos.secureboot.enabled %#
     machineSpec:
       secureboot: true
-    talosImageURL: factory.talos.dev/installer-secureboot/{{ distribution.talos.schematicID }}
-    {% else %}
-    talosImageURL: factory.talos.dev/installer/{{ distribution.talos.schematicID }}
-    {% endif %}
-    controlPlane: {{ (item.controller) | string | lower }}
+    talosImageURL: factory.talos.dev/installer-secureboot/#{ bootstrap_talos.schematic_id }#
+    #% else %#
+    talosImageURL: factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#
+    #% endif %#
+    controlPlane: #{ (item.controller) | string | lower }#
     networkInterfaces:
       - interface: eth0
         dhcp: false
-        {% if distribution.talos.vlan %}
+        #% if bootstrap_talos.vlan %#
         vlans:
-          - vlanId: {{ distribution.talos.vlan }}
+          - vlanId: #{ bootstrap_talos.vlan }#
             addresses:
-              - "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
+              - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
             mtu: 1500
             routes:
               - network: 0.0.0.0/0
-                {% if nodes.default_gateway %}
-                gateway: "{{ nodes.default_gateway }}"
-                {% else %}
-                gateway: "{{ nodes.host_network | nthhost(1) }}"
-                {% endif %}
-            {% if item.controller %}
+                #% if bootstrap_node_default_gateway %#
+                gateway: "#{ bootstrap_node_default_gateway }#"
+                #% else %#
+                gateway: "#{ bootstrap_node_network | nthhost(1) }#"
+                #% endif %#
+            #% if item.controller %#
             vip:
-              ip: "{{ cluster.endpoint_vip }}"
-            {% endif %}
-        {% else %}
+              ip: "#{ bootstrap_controllers_vip }#"
+            #% endif %#
+        #% else %#
         addresses:
-          - "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
+          - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
         mtu: 1500
         routes:
           - network: 0.0.0.0/0
-            {% if nodes.default_gateway %}
-            gateway: "{{ nodes.default_gateway }}"
-            {% else %}
-            gateway: "{{ nodes.host_network | nthhost(1) }}"
-            {% endif %}
-        {% if item.controller %}
+            #% if bootstrap_node_default_gateway %#
+            gateway: "#{ bootstrap_node_default_gateway }#"
+            #% else %#
+            gateway: "#{ bootstrap_node_network | nthhost(1) }#"
+            #% endif %#
+        #% if item.controller %#
         vip:
-          ip: "{{ cluster.endpoint_vip }}"
-        {% endif %}
-        {% endif %}
-    {% if distribution.talos.user_patches %}
+          ip: "#{ bootstrap_controllers_vip }#"
+        #% endif %#
+        #% endif %#
+    #% if bootstrap_talos.user_patches %#
     patches:
-      - "@./patches/node_{{ item.name }}.yaml"
-    {% endif %}
-  {% endfor %}
+      - "@./patches/node_#{ item.name }#.yaml"
+    #% endif %#
+  #% endfor %#
 
 patches:
   # Configure containerd
@@ -123,16 +123,16 @@ patches:
           rotate-server-certificates: true
         nodeIP:
           validSubnets:
-            - "{{ nodes.host_network }}"
+            - "#{ bootstrap_node_network }#"
 
   # Force nameserver
   - |-
     machine:
       network:
         nameservers:
-          {% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %}
-          - {{ item }}
-          {% endfor %}
+          #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
+          - #{ item }#
+          #% endfor %#
 
   # Configure NTP
   - |-
@@ -170,8 +170,7 @@ patches:
         extraKernelArgs:
           - net.ifnames=0
 
-  {% if distribution.talos.secureboot.enabled and
-        distribution.talos.secureboot.encrypt_disk_with_tpm %}
+  #% if bootstrap_talos.secureboot.enabled and bootstrap_talos.secureboot.encrypt_disk_with_tpm %#
   # Encrypt system disk with TPM
   - |-
     machine:
@@ -186,11 +185,11 @@ patches:
           keys:
             - slot: 0
               tpm: {}
-  {% endif %}
-  {% if distribution.talos.user_patches %}
+  #% endif %#
+  #% if bootstrap_talos.user_patches %#
   # User specified global patches
   - "@./patches/global.yaml"
-  {% endif %}
+  #% endif %#
 
 controlPlane:
   patches:
@@ -214,7 +213,7 @@ controlPlane:
           extraArgs:
             listen-metrics-urls: http://0.0.0.0:2381
           advertisedSubnets:
-            - "{{ nodes.host_network }}"
+            - "#{ bootstrap_node_network }#"
 
     # Disable default API server admission plugins.
     - |-
@@ -232,15 +231,14 @@ controlPlane:
             allowedKubernetesNamespaces:
               - system-upgrade
 
-    {% if distribution.talos.user_patches %}
+    #% if bootstrap_talos.user_patches %#
     # User specified controlPlane patches
     - "@./patches/controlPlane.yaml"
-    {% endif %}
+    #% endif %#
 
-{% if ( (distribution.talos.user_patches) and
-        (nodes.inventory | selectattr('controller', 'equalto', False) | list | length) ) %}
+#% if ((bootstrap_talos.user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %#
 worker:
   patches:
     # User specified worker patches
     - "@./patches/worker.yaml"
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/flux/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("flux", {}).get("enabled", False) == True

bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2

@@ -6,13 +6,13 @@ metadata:
   namespace: flux-system
 spec:
   interval: 30m
-  url: "{{ flux.github.address }}"
-  {% if flux.github.private.enabled %}
+  url: "#{ bootstrap_github_address }#"
+  #% if bootstrap_github_private_key %#
   secretRef:
     name: github-deploy-key
-  {% endif %}
+  #% endif %#
   ref:
-    branch: "{{ flux.github.branch|default('main', true) }}"
+    branch: "#{ bootstrap_github_branch|default('main', true) }#"
   ignore: |
     # exclude all
     /*

bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2

@@ -1,4 +1,4 @@
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
 spec:
   interval: 1h
   url: https://kubernetes-sigs.github.io/external-dns
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2

@@ -1,4 +1,4 @@
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
 spec:
   interval: 1h
   url: https://kubernetes.github.io/ingress-nginx
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2

@@ -1,4 +1,4 @@
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
 spec:
   interval: 1h
   url: https://ori-edge.github.io/k8s_gateway
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2

@@ -4,18 +4,18 @@ kind: Kustomization
 resources:
   - ./bjw-s.yaml
   - ./cilium.yaml
-  {% if cloudflare.enabled %}
+  #% if bootstrap_cloudflare.enabled %#
   - ./external-dns.yaml
   - ./ingress-nginx.yaml
   - ./k8s-gateway.yaml
-  {% endif %}
+  #% endif %#
   - ./jetstack.yaml
   - ./metrics-server.yaml
   - ./openebs.yaml
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
   - ./postfinance.yaml
-  {% endif %}
+  #% endif %#
   - ./stakater.yaml
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
   - ./xenitab.yaml
-  {% endif %}
+  #% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2

@@ -1,4 +1,4 @@
-{% if distribution.type in ["talos"] %}
+#% if bootstrap_distribution in ["talos"] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
 spec:
   interval: 1h
   url: https://postfinance.github.io/kubelet-csr-approver
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2

@@ -1,4 +1,4 @@
-{% if distribution.type in ["talos"] %}
+#% if bootstrap_distribution in ["talos"] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -9,4 +9,4 @@ spec:
   type: oci
   interval: 5m
   url: oci://ghcr.io/xenitab/helm-charts
-{% endif %}
+#% endif %#

bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2

@@ -6,8 +6,8 @@ metadata:
   namespace: flux-system
 stringData:
   SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
-  {% if cloudflare.enabled %}
-  SECRET_DOMAIN: "{{ cloudflare.domain }}"
-  SECRET_ACME_EMAIL: "{{ cloudflare.acme.email }}"
-  SECRET_CLOUDFLARE_TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
-  {% endif %}
+  #% if bootstrap_cloudflare.enabled %#
+  SECRET_DOMAIN: "#{ bootstrap_cloudflare.domain }#"
+  SECRET_ACME_EMAIL: "#{ bootstrap_cloudflare.acme.email }#"
+  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#"
+  #% endif %#

bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2

@@ -5,12 +5,12 @@ metadata:
   name: cluster-settings
   namespace: flux-system
 data:
-  TIMEZONE: "{{ timezone }}"
-  CLUSTER_CIDR: "{{ cluster.pod_network.split(',')[0] }}"
-  NODE_CIDR: "{{ nodes.host_network }}"
-  {% if feature_gates.dual_stack_ipv4_first %}
-  CLUSTER_CIDR_V6: "{{ cluster.pod_network.split(',')[1] }}"
-  {% endif %}
-  {% if distribution.talos.bgp.enabled %}
-  LOADBALANCER_CIDR: "{{ distribution.talos.bgp.loadbalancer_network }}"
-  {% endif %}
+  TIMEZONE: "#{ bootstrap_timezone }#"
+  CLUSTER_CIDR: "#{ bootstrap_pod_network.split(',')[0] }#"
+  NODE_CIDR: "#{ bootstrap_node_network }#"
+  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+  CLUSTER_CIDR_V6: "#{ bootstrap_pod_network.split(',')[1] }#"
+  #% endif %#
+  #% if bootstrap_bgp.enabled %#
+  BGP_ADVERTISED_CIDR: "#{ bootstrap_bgp.advertised_network }#"
+  #% endif %#

bootstrap/templates/kubernetes/talos/.mjfilter.py

@@ -1 +0,0 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]

bootstrap/templates/kubernetes/talos/cilium/.gitignore.j2

@@ -1 +0,0 @@
-charts/

bootstrap/templates/kubernetes/talos/cilium/kustomization.yaml.j2

@@ -1,15 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-helmCharts:
-  - name: cilium
-    repo: https://helm.cilium.io
-    version: 1.15.1
-    releaseName: cilium
-    namespace: kube-system
-    valuesFile: values.yaml
-commonAnnotations:
-  meta.helm.sh/release-name: cilium
-  meta.helm.sh/release-namespace: kube-system
-commonLabels:
-  app.kubernetes.io/managed-by: Helm

bootstrap/templates/kubernetes/talos/cilium/values.yaml.j2

@@ -1,4 +0,0 @@
----
-{% filter indent(width=0, first=True) %}
-{% include 'partials/cilium-values-init.partial.yaml.j2' %}
-{% endfilter %}

bootstrap/templates/kubernetes/talos/kubelet-csr-approver/.gitignore.j2

@@ -1 +0,0 @@
-charts/

bootstrap/templates/kubernetes/talos/kubelet-csr-approver/kustomization.yaml.j2

@@ -1,19 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: kube-system
-helmCharts:
-  - name: kubelet-csr-approver
-    repo: https://postfinance.github.io/kubelet-csr-approver
-    version: 1.0.6
-    releaseName: kubelet-csr-approver
-    namespace: kube-system
-    valuesInline:
-      {% filter indent(width=6, first=True) %}
-      {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
-      {% endfilter %}
-commonAnnotations:
-  meta.helm.sh/release-name: kubelet-csr-approver
-  meta.helm.sh/release-namespace: kube-system
-commonLabels:
-  app.kubernetes.io/managed-by: Helm

bootstrap/templates/partials/cilium-values-full.partial.yaml.j2

@@ -1,8 +1,6 @@
 autoDirectNodeRoutes: true
-{% if distribution.talos.bgp.enabled %}
 bgpControlPlane:
   enabled: true
-{% endif %}
 bpf:
   masquerade: true
 cgroup:
@@ -10,19 +8,19 @@ cgroup:
     enabled: false
   hostRoot: /sys/fs/cgroup
 cluster:
-  name: home-kubernetes
   id: 1
+  name: home-kubernetes
 containerRuntime:
   integration: containerd
-  {% if distribution.type in ["k3s"] %}
+  #% if bootstrap_distribution in ["k3s"] %#
   socketPath: /var/run/k3s/containerd/containerd.sock
-  {% endif %}
+  #% endif %#
 # NOTE: This might need to be set if you have more than one active NIC on your hosts
 # devices:
 #   - eno0
 endpointRoutes:
   enabled: true
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 hubble:
   enabled: true
   metrics:
@@ -57,35 +55,33 @@ hubble:
       tls:
         - hosts:
             - "hubble.${SECRET_DOMAIN}"
-{% else %}
+#% else %#
 hubble:
   enabled: false
-{% endif %}
+#% endif %#
 ipam:
   mode: kubernetes
 ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-{% if feature_gates.dual_stack_ipv4_first %}
+#% if bootstrap_feature_gates.dual_stack_ipv4_first %#
 ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
 ipv6:
   enabled: true
-{% endif %}
-{% if distribution.type in ["k3s"] %}
+#% endif %#
+#% if bootstrap_distribution in ["k3s"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 6444
-{% elif distribution.type in ["talos"] %}
+#% elif bootstrap_distribution in ["talos"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 7445
-{% endif %}
+#% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
-  {% if ( (distribution.talos.bgp.enabled) or
-          (feature_gates.dual_stack_ipv4_first) ) %}
-  # https://github.com/cilium/cilium/issues/28985
-  enabled: false
-  {% else %}
+  #% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %#
+  enabled: false # https://github.com/cilium/cilium/issues/28985
+  #% else %#
   enabled: true
-  {% endif %}
+  #% endif %#
 loadBalancer:
   algorithm: maglev
   mode: dsr

bootstrap/templates/partials/cilium-values-init.partial.yaml.j2

@@ -1,8 +1,6 @@
 autoDirectNodeRoutes: true
-{% if distribution.talos.bgp.enabled %}
 bgpControlPlane:
   enabled: true
-{% endif %}
 bpf:
   masquerade: true
 cgroup:
@@ -10,13 +8,13 @@ cgroup:
     enabled: false
   hostRoot: /sys/fs/cgroup
 cluster:
-  name: home-kubernetes
   id: 1
+  name: home-kubernetes
 containerRuntime:
   integration: containerd
-  {% if distribution.type in ["k3s"] %}
+  #% if bootstrap_distribution in ["k3s"] %#
   socketPath: /var/run/k3s/containerd/containerd.sock
-  {% endif %}
+  #% endif %#
 # NOTE: This might need to be set if you have more than one active NIC on your hosts
 # devices:
 #   - eno0
@@ -26,29 +24,27 @@ hubble:
   enabled: false
 ipam:
   mode: kubernetes
-ipv4NativeRoutingCIDR: "{{ cluster.pod_network }}"
-{% if feature_gates.dual_stack_ipv4_first %}
-ipv6NativeRoutingCIDR: "{{ cluster.pod_network_v6 }}"
+ipv4NativeRoutingCIDR: "#{ bootstrap_pod_network }#"
+#% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+ipv6NativeRoutingCIDR: "#{ bootstrap_pod_network_v6 }#"
 ipv6:
   enabled: true
-{% endif %}
-{% if distribution.type in ["k3s"] %}
+#% endif %#
+#% if bootstrap_distribution in ["k3s"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 6444
-{% elif distribution.type in ["talos"] %}
+#% elif bootstrap_distribution in ["talos"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 7445
-{% endif %}
+#% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
-  {% if ( (distribution.talos.bgp.enabled) or
-          (feature_gates.dual_stack_ipv4_first) ) %}
-  # https://github.com/cilium/cilium/issues/28985
-  enabled: false
-  {% else %}
+  #% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %#
+  enabled: false # https://github.com/cilium/cilium/issues/28985
+  #% else %#
   enabled: true
-  {% endif %}
+  #% endif %#
 loadBalancer:
   algorithm: maglev
   mode: dsr

bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2

@@ -21,7 +21,7 @@ spec:
           args: ["manager"]
           env:
             - name: address
-              value: "{{ cluster.endpoint_vip }}"
+              value: "#{ bootstrap_controllers_vip }#"
             - name: vip_arp
               value: "true"
             - name: port

bootstrap/templates/partials/kubelet-csr-approver-values.partial.yaml.j2

@@ -1,2 +1,2 @@
-providerRegex: ^({{ (nodes.inventory | map(attribute='name') | join('|')) }})$
+providerRegex: ^(#{ (bootstrap_node_inventory | map(attribute='name') | join('|')) }#)$
 bypassDnsResolution: true