refactor!: project updates (#1326)

* refactor!: flux is required again Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: delimiter that chomps Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: bootstrap_cloudflare logic Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update tests Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: remove last quote Signed-off-by: Devin Buhl <devin@buhl.casa> * chore: update readme Signed-off-by: Devin Buhl <devin@buhl.casa> --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-02-15 20:03:24 -05:00
1 parent 04ff4ef994
commit c17d543b21
@@ -24,6 +24,7 @@ for app in \
    "direnv/direnv!!?as=direnv&type=script" \
    "fluxcd/flux2!!?as=flux&type=script" \
    "go-task/task!!?as=task&type=script" \
+    "helmfile/helmfile!!?as=helmfile&type=script" \
    "kubecolor/kubecolor!!?as=kubecolor&type=script" \
    "kubernetes-sigs/krew!!?as=krew&type=script" \
    "kubernetes-sigs/kustomize!!?as=kustomize&type=script" \
@@ -40,7 +41,7 @@ done
 mkdir -p /home/vscode/.config/fish/{completions,conf.d}

 # Setup autocompletions for fish
-for tool in cilium flux helm k9s kubectl kustomize talhelper talosctl; do
+for tool in cilium flux helm helmfile k9s kubectl kustomize talhelper talosctl; do
    $tool completion fish > /home/vscode/.config/fish/completions/$tool.fish
 done
 gh completion --shell fish > /home/vscode/.config/fish/completions/gh.fish
@@ -1,4 +1,3 @@
 * text=auto eol=lf
 *.yaml.j2 linguist-language=YAML
 *.sops.* diff=sopsdiffer
-*.sops.toml linguist-language=JSON
@@ -1,46 +1,32 @@
 ---
 skip_tests: true

-distribution:
-  type: k3s
-
-timezone: Etc/UTC
-
-nodes:
-  host_network: 10.10.10.0/24
-  dns_servers: ["1.1.1.1"]
-  search_domain: "fake"
-  inventory:
+bootstrap_timezone: Etc/UTC
+bootstrap_distribution: k3s
+bootstrap_node_network: 10.10.10.0/24
+bootstrap_node_default_gateway: 10.10.10.1
+bootstrap_node_inventory:
  - name: k8s-controller-0
    address: 10.10.10.100
    controller: true
-      ssh_username: fake
+    ssh_user: fake
  - name: k8s-worker-0
    address: 10.10.10.101
    controller: false
-      ssh_username: fake
-
-
-cluster:
-  pod_network: 10.69.0.0/16
-  service_network: 10.96.0.0/16
-  endpoint_vip: 10.10.10.254
-  tls_sans: ["fake"]
-
-flux:
-  enabled: true
-  github:
-    username: onedr0p
-    address: https://github.com/onedr0p/cluster-template
-    branch: main
-    webhook:
-      enabled: true
-      token: fake
-    private:
+    ssh_user: fake
+bootstrap_dns_servers: ["1.1.1.1"]
+bootstrap_search_domain: "fake"
+bootstrap_pod_network: 10.69.0.0/16
+bootstrap_service_network: 10.96.0.0/16
+bootstrap_controllers_vip: 10.10.10.254
+bootstrap_tls_sans: ["fake"]
+bootstrap_sops_age_pubkey: $BOOTSTRAP_AGE_PUBLIC_KEY
+bootstrap_bgp:
  enabled: false
-  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-
-cloudflare:
+bootstrap_github_address: https://github.com/onedr0p/cluster-template
+bootstrap_github_branch: main
+bootstrap_github_webhook_token: fake
+bootstrap_cloudflare:
  enabled: true
  domain: fake
  token: take
@@ -1,45 +1,32 @@
 ---
 skip_tests: true

-distribution:
-  type: k3s
-
-timezone: Etc/UTC
-
-nodes:
-  host_network: 10.10.10.0/24
-  dns_servers: ["1.1.1.1"]
-  search_domain: "fake"
-  inventory:
+bootstrap_timezone: Etc/UTC
+bootstrap_distribution: k3s
+bootstrap_node_network: 10.10.10.0/24
+bootstrap_node_default_gateway: 10.10.10.1
+bootstrap_node_inventory:
  - name: k8s-controller-0
    address: 10.10.10.100
    controller: true
-      ssh_username: fake
+    ssh_user: fake
  - name: k8s-worker-0
    address: 10.10.10.101
    controller: false
-      ssh_username: fake
-
-cluster:
-  pod_network: 10.42.0.0/16,fd7f:8f5:e87c:a::/64
-  service_network: 10.43.0.0/16,fd7f:8f5:e87c:e::/112
-  endpoint_vip: 10.10.10.254
-  tls_sans: ["fake"]
-
-flux:
-  enabled: true
-  github:
-    username: onedr0p
-    address: https://github.com/onedr0p/cluster-template
-    branch: main
-    webhook:
-      enabled: true
-      token: fake
-    private:
+    ssh_user: fake
+bootstrap_dns_servers: ["1.1.1.1"]
+bootstrap_search_domain: "fake"
+bootstrap_pod_network: 10.42.0.0/16,fd7f:8f5:e87c:a::/64
+bootstrap_service_network: 10.43.0.0/16,fd7f:8f5:e87c:e::/112
+bootstrap_controllers_vip: 10.10.10.254
+bootstrap_tls_sans: ["fake"]
+bootstrap_sops_age_pubkey: $BOOTSTRAP_AGE_PUBLIC_KEY
+bootstrap_bgp:
  enabled: false
-  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-
-cloudflare:
+bootstrap_github_address: https://github.com/onedr0p/cluster-template
+bootstrap_github_branch: main
+bootstrap_github_webhook_token: fake
+bootstrap_cloudflare:
  enabled: true
  domain: fake
  token: take
@@ -53,6 +40,3 @@ cloudflare:
    ingress_vip: 10.10.10.252
  ingress_vip: 10.10.10.251
  gateway_vip: 10.10.10.253
-
-feature_gates:
-  dual_stack_ipv4_first: true
@@ -1,47 +1,34 @@
 ---
 skip_tests: true

-distribution:
-  type: talos
-  talos:
-    schematicID: "df491c50a5acc05b977ef00c32050e1ceb0df746e40b33c643ac8a9bfb7c7263"
-
-timezone: Etc/UTC
-
-nodes:
-  host_network: 10.10.10.0/24
-  dns_servers: ["1.1.1.1"]
-  search_domain: "fake"
-  inventory:
+bootstrap_timezone: Etc/UTC
+bootstrap_distribution: talos
+boostrap_talos:
+  schematic_id: "df491c50a5acc05b977ef00c32050e1ceb0df746e40b33c643ac8a9bfb7c7263"
+bootstrap_node_network: 10.10.10.0/24
+bootstrap_node_default_gateway: 10.10.10.1
+bootstrap_node_inventory:
  - name: k8s-controller-0
    address: 10.10.10.100
    controller: true
-      talos_disk_device: fake
+    talos_disk: fake
  - name: k8s-worker-0
    address: 10.10.10.101
    controller: false
-      talos_disk_device: fake
-
-cluster:
-  pod_network: 10.69.0.0/16
-  service_network: 10.96.0.0/16
-  endpoint_vip: 10.10.10.254
-  tls_sans: ["fake"]
-
-flux:
-  enabled: true
-  github:
-    username: onedr0p
-    address: https://github.com/onedr0p/cluster-template
-    branch: main
-    webhook:
-      enabled: true
-      token: fake
-    private:
+    talos_disk: fake
+bootstrap_dns_servers: ["1.1.1.1"]
+bootstrap_search_domain: "fake"
+bootstrap_pod_network: 10.69.0.0/16
+bootstrap_service_network: 10.96.0.0/16
+bootstrap_controllers_vip: 10.10.10.254
+bootstrap_tls_sans: ["fake"]
+bootstrap_sops_age_pubkey: $BOOTSTRAP_AGE_PUBLIC_KEY
+bootstrap_bgp:
  enabled: false
-  sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
-
-cloudflare:
+bootstrap_github_address: https://github.com/onedr0p/cluster-template
+bootstrap_github_branch: main
+bootstrap_github_webhook_token: fake
+bootstrap_cloudflare:
  enabled: true
  domain: fake
  token: take
@@ -7,7 +7,7 @@ vars:
  PROMETHEUS_OPERATOR_VERSION: v0.71.2
  CLUSTER_SECRET_SOPS_FILE: "{{.KUBERNETES_DIR}}/flux/vars/cluster-secrets.sops.yaml"
  CLUSTER_SETTINGS_FILE: "{{.KUBERNETES_DIR}}/flux/vars/cluster-settings.yaml"
-  GITHUB_DEPLOY_KEY_FILE: "{{.KUBERNETES_DIR}}/bootstrap/github-deploy-key.sops.yaml"
+  GITHUB_DEPLOY_KEY_FILE: "{{.KUBERNETES_DIR}}/bootstrap/flux/github-deploy-key.sops.yaml"

 tasks:

@@ -18,7 +18,7 @@ tasks:
      - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml
      - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_scrapeconfigs.yaml
      - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
-      - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --kustomize {{.KUBERNETES_DIR}}/bootstrap
+      - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --kustomize {{.KUBERNETES_DIR}}/bootstrap/flux
      - cat {{.AGE_FILE}} | kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin
      - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename -
      - kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename {{.CLUSTER_SETTINGS_FILE}}
@@ -26,10 +26,7 @@ tasks:

  kubeconform:
    desc: Validate Kubernetes manifests with kubeconform
-    cmd: |
-      if [ -d "{{.KUBERNETES_DIR}}/flux" ]; then
-          bash {{.KUBECONFORM_SCRIPT}} {{.KUBERNETES_DIR}}
-      fi
+    cmd: bash {{.KUBECONFORM_SCRIPT}} {{.KUBERNETES_DIR}}
    preconditions:
      - { msg: "Missing kubeconform script", sh: "test -f {{.KUBECONFORM_SCRIPT}}" }

@@ -3,7 +3,7 @@
 version: "3"

 vars:
-  TALOS_DIR: "{{.KUBERNETES_DIR}}/talos"
+  TALOS_DIR: "{{.KUBERNETES_DIR}}/bootstrap/talos"
  TALHELPER_SECRET_FILE: "{{.TALOS_DIR}}/talhelper.sops.yaml"
  TALHELPER_CONFIG_FILE: "{{.TALOS_DIR}}/talconfig.yaml"

@@ -21,7 +21,7 @@ tasks:
      - task: bootstrap-apply
      - task: bootstrap-install
      - task: fetch-kubeconfig
-      - task: bootstrap-core-apps
+      - task: bootstrap-apps
      - talosctl health --server=false

  bootstrap-gensecret:
@@ -61,14 +61,13 @@ tasks:
    preconditions:
      - { msg: "Missing talhelper config file", sh: "test -f {{.TALHELPER_CONFIG_FILE}}" }

-  bootstrap-core-apps:
-    desc: Bootstrap Helm apps
+  bootstrap-apps:
+    desc: Bootstrap core apps needed for Talos
    dir: "{{.TALOS_DIR}}"
    cmds:
-      - until kubectl wait --for=condition=Ready=False nodes --all --timeout=600s; do sleep 10; done
-      - kubectl --kubeconfig {{.KUBECONFIG_FILE}} kustomize --enable-helm ./cilium | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename -
-      - kubectl --kubeconfig {{.KUBECONFIG_FILE}} kustomize --enable-helm ./kubelet-csr-approver | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename -
-      - until kubectl wait --for=condition=Ready nodes --all --timeout=600s; do sleep 10; done
+      - until kubectl --kubeconfig {{.KUBECONFIG_FILE}} wait --for=condition=Ready=False nodes --all --timeout=600s; do sleep 10; done
+      - helmfile --file ./apps/helmfile.yaml apply
+      - until kubectl --kubeconfig {{.KUBECONFIG_FILE}} wait --for=condition=Ready nodes --all --timeout=600s; do sleep 10; done
    preconditions:
      - { msg: "Missing kubeconfig", sh: "test -f {{.KUBECONFIG_FILE}}" }

@@ -95,13 +94,13 @@ tasks:

  soft-nuke:
    desc: Resets nodes back to maintenance mode so you can re-deploy again straight after
-    prompt: "This will destroy your cluster and reset the nodes back to maintenance mode. Are you sure?"
+    prompt: This will destroy your cluster and reset the nodes back to maintenance mode... continue?
    dir: "{{.TALOS_DIR}}"
    cmd: talhelper gencommand reset --extra-flags "--reboot --system-labels-to-wipe STATE --system-labels-to-wipe EPHEMERAL --graceful=false --wait=false" | bash

  hard-nuke:
    desc: Resets nodes back completely and reboots them
-    prompt: "This will destroy your cluster and reset the nodes. Are you sure?"
+    prompt: This will destroy your cluster and reset the nodes... continue?
    dir: "{{.TALOS_DIR}}"
    cmd: talhelper gencommand reset --extra-flags "--reboot --graceful=false --wait=false" | bash

@@ -5,6 +5,7 @@ flux-bin
 go-task
 go-yq
 helm
+helmfile
 jq
 kubeconform
 kubectl-bin
@@ -7,6 +7,7 @@ brew "direnv"
 brew "fluxcd/tap/flux"
 brew "go-task/tap/go-task"
 brew "helm"
+brew "helmfile"
 brew "jq"
 brew "kubeconform"
 brew "kubernetes-cli"
@@ -56,6 +56,7 @@ tasks:
          - FiloSottile/age?as=age&type=script
          - fluxcd/flux2?as=flux&type=script
          - getsops/sops?as=sops&type=script
+          - helmfile/helmfile?as=helmfile&type=script
          - jqlang/jq?as=jq&type=script
          - kubernetes-sigs/kustomize?as=kustomize&type=script
          - siderolabs/talos?as=talosctl&type=script
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2023 onedr0p
+Copyright (c) 2024 onedr0p

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -6,17 +6,12 @@ At a high level this project makes use of [makejinja](https://github.com/mirkole

 ## ✨ Features

-The features included will depend on the type of configuration you want to use. There are currently **3 different types** of **configurations** available with this template.
+The features included will depend on the type of configuration you want to use. There are currently **2 different types** of **configurations** available with this template.

-1. **"Bare cluster"** - a Kubernetes distribution of your choosing: [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos)
+1. **"Flux cluster"** - a Kubernetes distribution of your choosing: [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos). Deploys an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as the Git provider and [sops](https://github.com/getsops/sops) to manage secrets.

-    - **Required:** Debian 12 or Talos Linux installed on bare metal (or VMs) and some knowledge of [Containers](https://opencontainers.org/) and [YAML](https://yaml.org/).
-    - **Components:** [Cilium](https://github.com/cilium/cilium) and [kube-vip](https://github.com/kube-vip/kube-vip) _(k3s)_
-
-2. **"Flux cluster"** - An addition to "**Bare cluster**" that deploys an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as the Git provider and [sops](https://github.com/getsops/sops) to manage secrets.
-
-    - **Required:** Some knowledge of [Git](https://git-scm.com/) practices & terminology.
-    - **Components:** [flux](https://github.com/fluxcd/flux2), [cert-manager](https://github.com/cert-manager/cert-manager), [spegel](https://github.com/XenitAB/spegel), [reloader](https://github.com/stakater/Reloader), [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), and [openebs](https://github.com/openebs/openebs).
+    - **Required:** Debian 12 or Talos Linux installed on bare metal (or VMs) and some knowledge of [Containers](https://opencontainers.org/) and [YAML](https://yaml.org/). Some knowledge of [Git](https://git-scm.com/) practices & terminology is also required.
+    - **Components:** [Cilium](https://github.com/cilium/cilium) and [kube-vip](https://github.com/kube-vip/kube-vip) _(k3s)_. [flux](https://github.com/fluxcd/flux2), [cert-manager](https://github.com/cert-manager/cert-manager), [spegel](https://github.com/XenitAB/spegel), [reloader](https://github.com/stakater/Reloader), [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), and [openebs](https://github.com/openebs/openebs).

 3. **"Flux cluster with Cloudflare"** - An addition to "**Flux cluster**" that provides DNS and SSL with [Cloudflare](https://www.cloudflare.com/). [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) is also included to provide external access to certain applications deployed in your cluster.

@@ -259,25 +254,20 @@ You have two different options for setting up your local workstation.
    task ansible:deps
    ```

-4. Verify Ansible can view your config
+4. Verify Ansible can view your config and ping your nodes

    ```sh
    task ansible:list
-    ```
-
-5. Verify Ansible can ping your nodes
-
-    ```sh
    task ansible:ping
    ```

-6. Run the Ansible prepare playbook (nodes wil reboot when done)
+5. Run the Ansible prepare playbook (nodes wil reboot when done)

    ```sh
    task ansible:run playbook=cluster-prepare
    ```

-7. Continue on to ⛵ [**Stage 5**](#-stage-5-install-kubernetes)
+6. Continue on to ⛵ [**Stage 5**](#-stage-5-install-kubernetes)

 ### ⛵ Stage 5: Install Kubernetes

@@ -294,7 +284,6 @@ You have two different options for setting up your local workstation.
 1. Install Kubernetes depending on the distribution you chose

    ```sh
-    # Install k3s
    task ansible:run playbook=cluster-installation
    ```

@@ -317,9 +306,6 @@ You have two different options for setting up your local workstation.

 ### 🔹 Stage 6: Install Flux in your cluster

-> [!NOTE]
-> Skip this stage if you have **disabled** Flux in the `config.yaml`
-
 1. Verify Flux can be installed

    ```sh
@@ -332,7 +318,7 @@ You have two different options for setting up your local workstation.

 2. Install Flux and sync the cluster to the Git repository

-  📍 _Run `task flux:github-deploy-key` first if using a private repository_
+  📍 _Run `task flux:github-deploy-key` first if using a private repository._

    ```sh
    task flux:bootstrap
@@ -352,7 +338,7 @@ You have two different options for setting up your local workstation.
    # source-controller-7d6875bcb4-zqw9f         1/1     Running   0          1h
    ```

-### 🎤 Flux w/ Cloudflare verification Steps
+### 🎤 Verification Steps

 _Mic check, 1, 2_ - In a few moments applications should be lighting up like Christmas in July 🎄

@@ -378,17 +364,17 @@ The `external-dns` application created in the `networking` namespace will handle

 #### 🏠 Home DNS

-`k8s_gateway` will provide DNS resolution to external Kubernetes resources (i.e. points of entry to the cluster) from any device that uses your home DNS server. For this to work, your home DNS server must be configured to forward DNS queries for `${bootstrap_cloudflare_domain}` to `${bootstrap_k8s_gateway_addr}` instead of the upstream DNS server(s) it normally uses. This is a form of **split DNS** (aka split-horizon DNS / conditional forwarding).
+`k8s_gateway` will provide DNS resolution to external Kubernetes resources (i.e. points of entry to the cluster) from any device that uses your home DNS server. For this to work, your home DNS server must be configured to forward DNS queries for `${bootstrap_cloudflare.domain}` to `${bootstrap_cloudflare.gateway_vip}` instead of the upstream DNS server(s) it normally uses. This is a form of **split DNS** (aka split-horizon DNS / conditional forwarding).

 > [!TIP]
 > Below is how to configure a Pi-hole for split DNS. Other platforms should be similar.
 > 1. Apply this file on the Pihole server while substituting the variables
 > ```sh
 > # /etc/dnsmasq.d/99-k8s-gateway-forward.conf
-> server=/${bootstrap_cloudflare_domain}/${bootstrap_k8s_gateway_addr}
+> server=/${bootstrap_cloudflare.domain}/${bootstrap_cloudflare.gateway_vip}
 > ```
 > 2. Restart dnsmasq on the server.
-> 3. Query an internal-only subdomain from your workstation (any `internal` class ingresses): `dig @${home-dns-server-ip} echo-server-internal.${bootstrap_cloudflare_domain}`. It should resolve to `${bootstrap_internal_ingress_addr}`.
+> 3. Query an internal-only subdomain from your workstation (any `internal` class ingresses): `dig @${home-dns-server-ip} echo-server-internal.${bootstrap_cloudflare.domain}`. It should resolve to `${bootstrap_cloudflare.ingress_vip}`.

 If you're having trouble with DNS be sure to check out these two GitHub discussions: [Internal DNS](https://github.com/onedr0p/cluster-template/discussions/719) and [Pod DNS resolution broken](https://github.com/onedr0p/cluster-template/discussions/635).

@@ -418,10 +404,10 @@ By default Flux will periodically check your git repository for changes. In orde
 2. Piece together the full URL with the webhook path appended

    ```text
-    https://flux-webhook.${bootstrap_cloudflare_domain}/hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
+    https://flux-webhook.${bootstrap_cloudflare.domain}/hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
    ```

-3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_flux_github_webhook_token` secret and save.
+3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_github_webhook_token` secret and save.

 ## 💥 Nuke

@@ -430,10 +416,8 @@ There might be a situation where you want to destroy your Kubernetes cluster. Th
 ```sh
 # k3s: Remove all traces of k3s from the nodes
 task ansible:run playbook=cluster-nuke
-
 # Talos: Reset your nodes back to maintenance mode and reboot
 task talos:soft-nuke
-
 # Talos: Comletely format your the Talos installation and reboot
 task talos:hard-nuke
 ```
@@ -6,7 +6,7 @@ import netaddr
 import sys

 DISTRIBUTIONS = ["k3s", "talos"]
-GLOBAL_CLI_TOOLS = ["age", "cloudflared", "flux", "sops", "jq", "kubeconform", "kustomize"]
+GLOBAL_CLI_TOOLS = ["age", "cloudflared", "flux", "helmfile", "sops", "jq", "kubeconform", "kustomize"]
 TALOS_CLI_TOOLS = ["talosctl", "talhelper"]

 def required(*keys: str):
@@ -20,15 +20,6 @@ def required(*keys: str):
        return wrapper
    return wrapper_outter

-def _validate_network(network: str, family: int) -> str:
-    try:
-        network = netaddr.IPNetwork(network)
-        if network.version != family:
-            raise ValueError(f"Invalid network family {network.version}")
-    except netaddr.core.AddrFormatError as e:
-        raise ValueError(f"Invalid network {network}") from e
-    return network
-

 def validate_python_version() -> None:
    required_version = (3, 11, 0)
@@ -36,11 +27,10 @@ def validate_python_version() -> None:
        raise ValueError(f"Python version is below 3.11. Please upgrade.")


-@required("distribution")
+@required("bootstrap_distribution")
 def validate_cli_tools(distribution: dict, **_) -> None:
-    distro = distribution.get("type")
-    if distro not in DISTRIBUTIONS:
-        raise ValueError(f"Invalid distribution {distro}")
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")
    for tool in GLOBAL_CLI_TOOLS:
        if not which(tool):
            raise ValueError(f"Missing required CLI tool {tool}")
@@ -49,65 +39,20 @@ def validate_cli_tools(distribution: dict, **_) -> None:
            raise ValueError(f"Missing required CLI tool {tool}")


-@required("distribution")
+@required("bootstrap_distribution")
 def validate_distribution(distribution: dict, **_) -> None:
-    distro = distribution.get("type")
-    if distro not in DISTRIBUTIONS:
-        raise ValueError(f"Invalid distribution {distro}")
+    if distribution not in DISTRIBUTIONS:
+        raise ValueError(f"Invalid distribution {distribution}")


-@required("timezone")
+@required("bootstrap_timezone")
 def validate_timezone(timezone: str, **_) -> None:
    if timezone not in available_timezones():
        raise ValueError(f"Invalid timezone {timezone}")


-@required("cluster", "feature_gates")
-def validate_cluster_networks(cluster: dict, feature_gates: dict, **_) -> None:
-    dual_stack_ipv4_first = feature_gates.get("dual_stack_ipv4_first", False)
-    pod_network = cluster.get("pod_network")
-    service_network = cluster.get("service_network")
-
-    if pod_network == service_network:
-        raise ValueError(f"Pod network {pod_network} is the same as service network {service_network}")
-
-    if dual_stack_ipv4_first:
-        if len(pod_network.split(",")) != 2:
-            raise ValueError(f"Invalid pod network {pod_network}")
-        if len(service_network.split(",")) != 2:
-            raise ValueError(f"Invalid service network {service_network}")
-        cluster_ipv4, cluster_ipv6 = pod_network.split(",")
-        _validate_network(cluster_ipv4, 4)
-        _validate_network(cluster_ipv6, 6)
-        service_ipv4, service_ipv6 = service_network.split(",")
-        _validate_network(service_ipv4, 4)
-        _validate_network(service_ipv6, 6)
-        return
-
-    if len(pod_network.split(",")) != 1:
-        raise ValueError(f"Invalid pod network {pod_network}")
-    if len(service_network.split(",")) != 1:
-        raise ValueError(f"Invalid service network {service_network}")
-
-    _validate_network(pod_network, 4)
-    _validate_network(service_network, 4)
-
-
-def massage_config(data: dict) -> dict:
-    data["distribution"] = data.get("distribution", {})
-    data["nodes"] = data.get("nodes", [])
-    data["cluster"] = data.get("cluster", {})
-    data["flux"] = data.get("flux", {})
-    data["cloudflare"] = data.get("cloudflare", {})
-    data["feature_gates"] = data.get("feature_gates", {})
-    return data
-
-
 def validate(data: dict) -> None:
-    user_config = massage_config(data)
-
    validate_python_version()
-    validate_cli_tools(user_config)
-    validate_distribution(user_config)
-    validate_timezone(user_config)
-    validate_cluster_networks(user_config)
+    validate_cli_tools(data)
+    validate_distribution(data)
+    validate_timezone(data)
@@ -1,22 +1,20 @@
-{% if flux.enabled %}
 ---
 creation_rules:
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
  - # IMPORTANT: This rule MUST be above the others
    path_regex: talos/.*\.sops\.ya?ml
    key_groups:
      - age:
-          - "{{ flux.sops_age_public_key }}"
-  {% endif %}
+          - "#{ bootstrap_sops_age_pubkey }#"
+  #% endif %#
  - path_regex: kubernetes/.*\.sops\.ya?ml
    encrypted_regex: "^(data|stringData)$"
    key_groups:
      - age:
-          - "{{ flux.sops_age_public_key }}"
-  {% if distribution.type in ["k3s"] %}
+          - "#{ bootstrap_sops_age_pubkey }#"
+  #% if bootstrap_distribution in ["k3s"] %#
  - path_regex: ansible/.*\.sops\.ya?ml
    key_groups:
      - age:
-          - "{{ flux.sops_age_public_key }}"
-  {% endif %}
-{% endif %}
+          - "#{ bootstrap_sops_age_pubkey }#"
+  #% endif %#
@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["k3s"]
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"]
@@ -1,13 +1,13 @@
 ---
 k3s_control_node: true
 k3s_server:
-  {% if feature_gates.dual_stack_ipv4_first %}
-  cluster-cidr: "{{ cluster.pod_network.split(',')[0] }},{{ cluster.pod_network.split(',')[1] }}"
-  service-cidr: "{{ cluster.service_network.split(',')[0] }},{{ cluster.service_network.split(',')[1] }}"
-  {% else %}
-  cluster-cidr: "{{ cluster.pod_network }}"
-  service-cidr: "{{ cluster.service_network }}"
-  {% endif %}
+  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+  cluster-cidr: "#{ bootstrap_pod_network.split(',')[0] }#,#{ bootstrap_pod_network.split(',')[1] }#"
+  service-cidr: "#{ bootstrap_service_network.split(',')[0] }#,#{ bootstrap_service_network.split(',')[1] }#"
+  #% else %#
+  cluster-cidr: "#{ bootstrap_pod_network }#"
+  service-cidr: "#{ bootstrap_service_network }#"
+  #% endif %#
  disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
  disable-cloud-controller: true
  disable-kube-proxy: true
@@ -25,16 +25,16 @@ k3s_server:
  kubelet-arg:
    - "image-gc-high-threshold=55"
    - "image-gc-low-threshold=50"
-  {% if feature_gates.dual_stack_ipv4_first %}
-  node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}"
-  {% else %}
-  node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
-  {% endif %}
+  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
+  #% else %#
+  node-ip: "{{ ansible_host }}"
+  #% endif %#
  pause-image: registry.k8s.io/pause:3.9
  secrets-encryption: true
  tls-san:
-    - "{{ cluster.endpoint_vip }}"
-    {% for item in cluster.tls_sans %}
-    - "{{ item }}"
-    {% endfor %}
+    - "#{ bootstrap_controllers_vip }#"
+    #% for item in bootstrap_tls_sans %#
+    - "#{ item }#"
+    #% endfor %#
  write-kubeconfig-mode: "644"
@@ -2,7 +2,7 @@
 k3s_become: true
 k3s_etcd_datastore: true
 k3s_install_hard_links: true
-k3s_registration_address: "{{ cluster.endpoint_vip }}"
+k3s_registration_address: "#{ bootstrap_controllers_vip }#"
 k3s_registries:
  mirrors:
    docker.io:
@@ -1,9 +1,9 @@
 main = lambda data: (
-    data.get("distribution").get("type", "k3s") in ["k3s"] and
+    data.get("bootstrap_distribution", "k3s") in ["k3s"] and
    len(
        list(
            filter(
-                lambda item: "controller" in item and item["controller"] is False, data.get("nodes").get("inventory")
+                lambda item: "controller" in item and item["controller"] is False, data.get("bootstrap_node_inventory")
            )
        )
    ) > 0
@@ -4,9 +4,9 @@ k3s_agent:
  kubelet-arg:
    - "image-gc-high-threshold=55"
    - "image-gc-low-threshold=50"
-  {% if feature_gates.dual_stack_ipv4_first %}
-  node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}"
-  {% else %}
-  node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
-  {% endif %}
+  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
+  #% else %#
+  node-ip: "{{ ansible_host }}"
+  #% endif %#
  pause-image: registry.k8s.io/pause:3.9
@@ -3,21 +3,21 @@ kubernetes:
  children:
    controllers:
      hosts:
-        {% for item in nodes.inventory %}
-        {% if item.controller %}
-        "{{ item.name }}":
-          ansible_user: "{{ item.ssh_username }}"
-          ansible_host: "{{ item.address }}"
-        {% endif %}
-        {% endfor %}
-    {% if nodes.inventory | selectattr('controller', 'equalto', False) | list | length %}
+        #% for item in bootstrap_node_inventory %#
+        #% if item.controller %#
+        "#{ item.name }#":
+          ansible_user: "#{ item.ssh_user }#"
+          ansible_host: "#{ item.address }#"
+        #% endif %#
+        #% endfor %#
+    #% if bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length %#
    workers:
      hosts:
-        {% for item in nodes.inventory %}
-        {% if not item.controller %}
-        "{{ item.name }}":
-          ansible_user: "{{ item.ssh_username }}"
-          ansible_host: "{{ item.address }}"
-        {% endif %}
-        {% endfor %}
-    {% endif %}
+        #% for item in bootstrap_node_inventory %#
+        #% if not item.controller %#
+        "#{ item.name }#":
+          ansible_user: "#{ item.ssh_user }#"
+          ansible_host: "#{ item.address }#"
+        #% endif %#
+        #% endfor %#
+    #% endif %#
@@ -42,9 +42,9 @@
            or k3s_server_manifests_urls | length > 0)
      kubernetes.core.k8s_info:
        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        kind: "{% raw %}{{ item.kind }}{% endraw %}"
-        name: "{% raw %}{{ item.name }}{% endraw %}"
-        namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}"
+        kind: "{{ item.kind }}"
+        name: "{{ item.name }}"
+        namespace: "{{ item.namespace | default('') }}"
        wait: true
        wait_sleep: 10
        wait_timeout: 360
@@ -20,5 +20,5 @@
    - name: Upgrade kube-vip
      ansible.builtin.template:
        src: templates/kube-vip-ds.yaml.j2
-        dest: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}/kube-vip-ds.yaml"
+        dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml"
        mode: preserve
@@ -36,17 +36,17 @@
      block:
        - name: Networking | Delete Cilium links
          ansible.builtin.command:
-            cmd: "ip link delete {% raw %}{{ item }}{% endraw %}"
-            removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}"
+            cmd: "ip link delete {{ item }}"
+            removes: "/sys/class/net/{{ item }}"
          loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
        - name: Networking | Flush iptables
          ansible.builtin.iptables:
-            table: "{% raw %}{{ item }}{% endraw %}"
+            table: "{{ item }}"
            flush: true
          loop: ["filter", "nat", "mangle", "raw"]
        - name: Networking | Flush ip6tables
          ansible.builtin.iptables:
-            table: "{% raw %}{{ item }}{% endraw %}"
+            table: "{{ item }}"
            flush: true
            ip_version: ipv6
          loop: ["filter", "nat", "mangle", "raw"]
@@ -86,7 +86,7 @@
        - k3s_install_hard_links
        - not ansible_check_mode
      ansible.builtin.file:
-        path: "{% raw %}{{ k3s_install_dir }}{% endraw %}/{% raw %}{{ item }}{% endraw %}"
+        path: "{{ k3s_install_dir }}/{{ item }}"
        state: absent
      loop: ["kubectl", "crictl", "ctr"]

@@ -15,7 +15,7 @@
      block:
        - name: Locale | Set timezone
          community.general.timezone:
-            name: "{{ timezone }}"
+            name: "#{ bootstrap_timezone }#"

    - name: Packages
      block:
@@ -32,12 +32,12 @@
      block:
        - name: Network Configuration | Set hostname
          ansible.builtin.hostname:
-            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
+            name: "{{ inventory_hostname }}"
        - name: Network Configuration | Update hosts
          ansible.builtin.copy:
            content: |
              127.0.0.1 localhost
-              127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %}
+              127.0.1.1 {{ inventory_hostname }}

              # The following lines are desirable for IPv6 capable hosts
              ::1     localhost ip6-localhost ip6-loopback
@@ -61,10 +61,10 @@
            mode: '0644'
            dest: /etc/resolv.conf
            content: |
-              search {{ nodes.search_domain|default('.', true) }}
-              {% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %}
-              nameserver {{ item }}
-              {% endfor %}
+              search #{ bootstrap_search_domain|default('.', true) }#
+              #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
+              nameserver #{ item }#
+              #% endfor %#

    - name: System Configuration
      notify: Reboot
@@ -77,15 +77,15 @@
            masked: true
        - name: System Configuration | Disable swap
          ansible.posix.mount:
-            name: "{% raw %}{{ item }}{% endraw %}"
+            name: "{{ item }}"
            fstype: swap
            state: absent
          loop: ["none", "swap"]
        - name: System Configuration | Create Kernel modules
          ansible.builtin.copy:
-            dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf"
+            dest: "/etc/modules-load.d/{{ item }}.conf"
            mode: "0644"
-            content: "{% raw %}{{ item }}{% endraw %}"
+            content: "{{ item }}"
          loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
          register: modules_status
        - name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler
@@ -95,11 +95,11 @@
            state: restarted
        - name: System Configuration | Sysctl
          ansible.posix.sysctl:
-            name: "{% raw %}{{ item.key }}{% endraw %}"
-            value: "{% raw %}{{ item.value }}{% endraw %}"
+            name: "{{ item.key }}"
+            value: "{{ item.value }}"
            sysctl_file: /etc/sysctl.d/99-kubernetes.conf
            reload: true
-          with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}"
+          with_dict: "{{ sysctl_config }}"
          vars:
            sysctl_config:
              fs.inotify.max_queued_events: 65536
@@ -11,9 +11,9 @@
        seconds: 5
  tasks:
    - name: Details
-      ansible.builtin.command: "k3s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
+      ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
      register: kubectl_get_node
-      delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}"
+      delegate_to: "{{ groups['controllers'][0] }}"
      failed_when: false
      changed_when: false

@@ -26,14 +26,14 @@
      block:
        - name: Cordon
          kubernetes.core.k8s_drain:
-            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
+            name: "{{ inventory_hostname }}"
            kubeconfig: /etc/rancher/k3s/k3s.yaml
            state: cordon
-          delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}"
+          delegate_to: "{{ groups['controllers'][0] }}"

        - name: Drain
          kubernetes.core.k8s_drain:
-            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
+            name: "{{ inventory_hostname }}"
            kubeconfig: /etc/rancher/k3s/k3s.yaml
            state: drain
            delete_options:
@@ -43,7 +43,7 @@
              wait_timeout: 900
            pod_selectors:
              - app!=rook-ceph-osd # Rook Ceph
-          delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}"
+          delegate_to: "{{ groups['controllers'][0] }}"

        - name: Update
          ansible.builtin.apt:
@@ -64,7 +64,7 @@

        - name: Uncordon
          kubernetes.core.k8s_drain:
-            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
+            name: "{{ inventory_hostname }}"
            kubeconfig: /etc/rancher/k3s/k3s.yaml
            state: uncordon
-          delegate_to: "{% raw %}{{ groups['controllers'][0] }}{% endraw %}"
+          delegate_to: "{{ groups['controllers'][0] }}"
@@ -3,7 +3,7 @@
  block:
    - name: Cruft | Get list of custom manifests
      ansible.builtin.find:
-        paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}"
+        paths: "{{ k3s_server_manifests_dir }}"
        file_type: file
        use_regex: true
        patterns: ["^custom-.*"]
@@ -11,9 +11,9 @@

    - name: Cruft | Delete custom manifests
      ansible.builtin.file:
-        path: "{% raw %}{{ item.path }}{% endraw %}"
+        path: "{{ item.path }}"
        state: absent
-      loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}"
+      loop: "{{ custom_manifest.files }}"

    - name: Cruft | Get list of custom addons
      kubernetes.core.k8s_info:
@@ -24,8 +24,8 @@
    - name: Cruft | Delete addons
      kubernetes.core.k8s:
        kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: "{% raw %}{{ item.metadata.name }}{% endraw %}"
+        name: "{{ item.metadata.name }}"
        kind: Addon
        namespace: kube-system
        state: absent
-      loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
+      loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}"
@@ -13,7 +13,7 @@
  when: k3s_primary_control_node
  ansible.builtin.fetch:
    src: /etc/rancher/k3s/k3s.yaml
-    dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
+    dest: "{{ repository_path.stdout }}/kubeconfig"
    flat: true

 - name: Update kubeconfig with the correct load balancer address
@@ -21,6 +21,6 @@
  become: false
  run_once: true
  ansible.builtin.replace:
-    path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
+    path: "{{ repository_path.stdout }}/kubeconfig"
    regexp: https://127.0.0.1:6443
-    replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
+    replace: "https://{{ k3s_registration_address }}:6443"
@@ -9,10 +9,9 @@

    - name: Extract k3s version
      ansible.builtin.set_fact:
-        current_k3s_version: "{% raw %}{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P<version>[a-z0-9\\.\\+]+).*\n.*', '\\g<version>') }}{% endraw %}"
+        current_k3s_version: "{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P<version>[a-z0-9\\.\\+]+).*\n.*', '\\g<version>') }}"

    - name: Check if upgrades are allowed
      ansible.builtin.assert:
-        that:
-          - "k3s_release_version is version(current_k3s_version, '>=')"
+        that: ["k3s_release_version is version(current_k3s_version, '>=')"]
        fail_msg: "Unable to upgrade k3s because the deployed version is higher than the one specified in the configuration"
@@ -12,6 +12,6 @@ spec:
  targetNamespace: kube-system
  bootstrap: true
  valuesContent: |-
-    {% filter indent(width=4, first=True) %}
-    {% include 'partials/cilium-values-init.partial.yaml.j2' %}
-    {% endfilter %}
+    #% filter indent(width=4, first=True) %#
+    #% include 'partials/cilium-values-init.partial.yaml.j2' %#
+    #% endfilter %#
@@ -1,2 +1,2 @@
 ---
-{% include 'partials/kube-vip-ds.partial.yaml.j2' %}
+#% include 'partials/kube-vip-ds.partial.yaml.j2' %#
@@ -1,2 +1,2 @@
 ---
-{% include 'partials/kube-vip-rbac.partial.yaml.j2' %}
+#% include 'partials/kube-vip-rbac.partial.yaml.j2' %#
@@ -1 +0,0 @@
-main = lambda data: data.get("flux", {}).get("enabled", False) == True
@@ -1 +1 @@
-main = lambda data: data.get("cloudflare", {}).get("enabled", False) == True
+main = lambda data: data.get("bootstrap_cloudflare", {}).get("enabled", False) == True
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: cert-manager-secret
 stringData:
-  api-token: "{{ cloudflare.token }}"
+  api-token: "#{ bootstrap_cloudflare.token }#"
@@ -18,7 +18,7 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -41,4 +41,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+#% endif %#
@@ -3,6 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  {% if flux.github.webhook.enabled %}
  - ./webhooks/ks.yaml
-  {% endif %}
@@ -1,6 +0,0 @@
-main = lambda data: (
-    data.get("flux", {})
-        .get("github", {})
-        .get("webhook", {})
-        .get("enabled", False) == True
-)
@@ -1,4 +1,4 @@
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -22,4 +22,4 @@ spec:
  tls:
    - hosts:
        - *host
-{% endif %}
+#% endif %#
@@ -3,7 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
-  {% if cloudflare.enabled %}
+  #% if bootstrap_cloudflare.enabled %#
  - ./ingress.yaml
-  {% endif %}
+  #% endif %#
  - ./receiver.yaml
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: github-webhook-token-secret
 stringData:
-  token: "{{ flux.github.webhook.token }}"
+  token: "#{ bootstrap_github_webhook_token }#"
@@ -9,21 +9,21 @@ spec:
    matchLabels:
      kubernetes.io/os: linux
  virtualRouters:
-    - localASN: {{ distribution.talos.bgp.local_asn }}
+    - localASN: #{ bootstrap_bgp.local_asn }#
      neighbors:
-        {% if distribution.talos.bgp.peers %}
-        {% for item in distribution.talos.bgp.peers %}
-        - peerAddress: "{{ item }}/32"
-          peerASN: {{ distribution.talos.bgp.peer_asn }}
-        {% endfor %}
-        {% else %}
-        {% if nodes.default_gateway %}
-        - peerAddress: "{{ nodes.default_gateway }}/32"
-        {% else %}
-        - peerAddress: "{{ nodes.host_network | nthhost(1) }}/32"
-        {% endif %}
-          peerASN: {{ distribution.talos.bgp.peer_asn }}
-        {% endif %}
+        #% if bootstrap_bgp.peers %#
+        #% for item in bootstrap_bgp.peers %#
+        - peerAddress: "#{ item }#/32"
+          peerASN: #{ bootstrap_bgp.peer_asn }#
+        #% endfor %#
+        #% else %#
+        #% if bootstrap_node_default_gateway %#
+        - peerAddress: "#{ bootstrap_node_default_gateway }#/32"
+        #% else %#
+        - peerAddress: "#{ bootstrap_node_network | nthhost(1) }#/32"
+        #% endif %#
+          peerASN: #{ bootstrap_bgp.peer_asn }#
+        #% endif %#
      serviceSelector:
        matchExpressions:
          - {key: somekey, operator: NotIn, values: ['never-used-value']}
@@ -34,4 +34,4 @@ metadata:
  name: pool
 spec:
  cidrs:
-    - cidr: "${LOADBALANCER_CIDR}"
+    - cidr: "${BGP_ADVERTISED_CIDR}"
@@ -23,6 +23,6 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    {% filter indent(width=4, first=True) %}
-    {% include 'partials/cilium-values-full.partial.yaml.j2' %}
-    {% endfilter %}
+    #% filter indent(width=4, first=True) %#
+    #% include 'partials/cilium-values-full.partial.yaml.j2' %#
+    #% endfilter %#
@@ -2,11 +2,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  {% if distribution.talos.bgp.enabled %}
+  #% if bootstrap_bgp.enabled %#
  - ./cilium-bgp.yaml
-  {% endif %}
-  {% if ( (not distribution.talos.bgp.enabled) and
-          (not feature_gates.dual_stack_ipv4_first) ) %}
+  #% endif %#
+  #% if ((not bootstrap_bgp.enabled) and (not bootstrap_feature_gates.dual_stack_ipv4_first)) %#
  - ./cilium-l2.yaml
-  {% endif %}
+  #% endif %#
  - ./helmrelease.yaml
@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]
@@ -23,9 +23,9 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    {% filter indent(width=4, first=True) %}
-    {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
-    {% endfilter %}
+    #% filter indent(width=4, first=True) %#
+    #% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
+    #% endfilter %#
    metrics:
      enable: true
      serviceMonitor:
@@ -4,11 +4,11 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cilium/ks.yaml
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
  - ./kubelet-csr-approver/ks.yaml
-  {% endif %}
+  #% endif %#
  - ./metrics-server/ks.yaml
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
  - ./spegel/ks.yaml
-  {% endif %}
+  #% endif %#
  - ./reloader/ks.yaml
@@ -28,4 +28,4 @@ spec:
      readOnlyRootFileSystem: true
      podMonitor:
        enabled: true
-        namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}"
+        namespace: "{{ .Release.Namespace }}"
@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]
@@ -1 +1 @@
-main = lambda data: data.get("cloudflare", {}).get("enabled", False) == True
+main = lambda data: data.get("bootstrap_cloudflare", {}).get("enabled", False) == True
@@ -4,10 +4,10 @@ kind: Secret
 metadata:
  name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
+  TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#"
  credentials.json: |
    {
-      "AccountTag": "{{ cloudflare.tunnel.account_id }}",
-      "TunnelSecret": "{{ cloudflare.tunnel.secret }}",
-      "TunnelID": "{{ cloudflare.tunnel.id }}"
+      "AccountTag": "#{ bootstrap_cloudflare.tunnel.account_id }#",
+      "TunnelSecret": "#{ bootstrap_cloudflare.tunnel.secret }#",
+      "TunnelID": "#{ bootstrap_cloudflare.tunnel.id }#"
    }
@@ -82,7 +82,7 @@ spec:
        annotations:
          external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
        hosts:
-          - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-external.${SECRET_DOMAIN}"
+          - host: &host "{{ .Release.Name }}-external.${SECRET_DOMAIN}"
            paths:
              - path: /
                service:
@@ -95,7 +95,7 @@ spec:
        enabled: true
        className: internal
        hosts:
-          - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-internal.${SECRET_DOMAIN}"
+          - host: &host "{{ .Release.Name }}-internal.${SECRET_DOMAIN}"
            paths:
              - path: /
                service:
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: external-dns-secret
 stringData:
-  api-token: "{{ cloudflare.token }}"
+  api-token: "#{ bootstrap_cloudflare.token }#"
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./staging.yaml
-  {% if cloudflare.acme.production %}
+  #% if bootstrap_cloudflare.acme.production %#
  - ./production.yaml
-  {% endif %}
+  #% endif %#
@@ -32,7 +32,7 @@ spec:
      service:
        annotations:
          external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "{{ cloudflare.tunnel.ingress_vip }}"
+          io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.tunnel.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: external
@@ -70,11 +70,11 @@ spec:
          namespaceSelector:
            any: true
      extraArgs:
-        {% if cloudflare.acme.production %}
+        #% if bootstrap_cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
-        {% else %}
+        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
-        {% endif %}
+        #% endif %#
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
@@ -29,7 +29,7 @@ spec:
      replicaCount: 1
      service:
        annotations:
-          io.cilium/lb-ipam-ips: "{{ cloudflare.ingress_vip }}"
+          io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: internal
@@ -67,11 +67,11 @@ spec:
          namespaceSelector:
            any: true
      extraArgs:
-        {% if cloudflare.acme.production %}
+        #% if bootstrap_cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
-        {% else %}
+        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
-        {% endif %}
+        #% endif %#
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
@@ -30,5 +30,5 @@ spec:
      type: LoadBalancer
      port: 53
      annotations:
-        io.cilium/lb-ipam-ips: "{{ cloudflare.gateway_vip }}"
+        io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.gateway_vip }#"
      externalTrafficPolicy: Cluster
@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["k3s"]
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"]
@@ -3,12 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  {% if distribution.type in ['k3s', 'talos'] %}
+  #% if bootstrap_distribution in ['k3s', 'talos'] %#
  - ./system-upgrade-controller/ks.yaml
-  {% endif %}
-  {% if distribution.type in ["k3s"] %}
+  #% endif %#
+  #% if bootstrap_distribution in ["k3s"] %#
  - ./k3s/ks.yaml
-  {% endif %}
-  {% if distribution.type in ["talos"] and distribution.talos.schematicID %}
+  #% endif %#
+  #% if bootstrap_distribution in ["talos"] and bootstrap_talos.schematic_id %#
  - ./talos/ks.yaml
-  {% endif %}
+  #% endif %#
@@ -1 +1 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ['k3s', 'talos']
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s", "talos"]
@@ -11,7 +11,7 @@ subjects:
  - kind: ServiceAccount
    name: system-upgrade
    namespace: system-upgrade
-{% if distribution.type in ["talos"] %}
+#% if bootstrap_distribution in ["talos"] %#
 ---
 apiVersion: talos.dev/v1alpha1
 kind: ServiceAccount
@@ -20,4 +20,4 @@ metadata:
 spec:
  roles:
    - os:admin
-{% endif %}
+#% endif %#
@@ -1,6 +1,4 @@
 main = lambda data: (
-    data.get("distribution", {}).get("type", "k3s") in ["talos"] and
-        data.get("distribution", {})
-            .get("talos", {})
-            .get("schematicID", {})
+    data.get("bootstrap_distribution", "k3s") in ["talos"] and
+        data.get("talos", {}).get("schematic_id", {})
 )
@@ -88,6 +88,6 @@ spec:
    args:
      - --nodes=$(NODE_IP)
      - upgrade
-      - --image=factory.talos.dev/installer/{{ distribution.talos.schematicID }}:$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
+      - --image=factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#:$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
      - --preserve=true
      - --wait=false
@@ -1 +0,0 @@
-main = lambda data: data.get("flux", {}).get("enabled", False) == True
@@ -1,4 +1,4 @@
-{% if flux.github.private.enabled %}
+#% if bootstrap_github_private_key %#
 ---
 apiVersion: v1
 kind: Secret
@@ -7,11 +7,11 @@ metadata:
  namespace: flux-system
 stringData:
  identity: |
-    {% filter indent(width=4, first=False) %}
-    {{ flux.github.private.key }}
-    {%- endfilter %}
+    #% filter indent(width=4, first=False) %#
+    #{ bootstrap_github_private_key }#
+    #%- endfilter %#
  known_hosts: |
    github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
    github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
    github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
-{% endif %}
+#% endif %#
@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]
@@ -0,0 +1,4 @@
+---
+#% filter indent(width=0, first=True) %#
+#% include 'partials/cilium-values-init.partial.yaml.j2' %#
+#% endfilter %#
@@ -0,0 +1,22 @@
+---
+repositories:
+  - name: cilium
+    url: https://helm.cilium.io
+  - name: postfinance
+    url: https://postfinance.github.io/kubelet-csr-approver
+
+releases:
+  - name: cilium
+    namespace: kube-system
+    chart: cilium/cilium
+    version: 1.15.1
+    wait: true
+    values:
+      - ./cilium-values.yaml
+  - name: kubelet-csr-approver
+    namespace: kube-system
+    chart: postfinance/kubelet-csr-approver
+    version: 1.0.7
+    wait: true
+    values:
+      - ./kubelet-csr-approver-values.yaml
@@ -0,0 +1,4 @@
+---
+#% filter indent(width=0, first=True) %#
+#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
+#% endfilter %#
@@ -6,80 +6,80 @@ talosVersion: v1.6.4
 kubernetesVersion: v1.29.1

 clusterName: &cluster home-kubernetes
-endpoint: https://{{ cluster.endpoint_vip }}:6443
+endpoint: https://#{ bootstrap_controllers_vip }#:6443
 clusterPodNets:
-  - "{{ cluster.pod_network.split(',')[0] }}"
+  - "#{ bootstrap_pod_network.split(',')[0] }#"
 clusterSvcNets:
-  - "{{ cluster.service_network.split(',')[0] }}"
+  - "#{ bootstrap_service_network.split(',')[0] }#"
 additionalApiServerCertSans: &sans
-  - "{{ cluster.endpoint_vip }}"
+  - "#{ bootstrap_controllers_vip }#"
  - 127.0.0.1 # KubePrism
-  {% for item in cluster.tls_sans %}
-  - "{{ item }}"
-  {% endfor %}
+  #% for item in bootstrap_tls_sans %#
+  - "#{ item }#"
+  #% endfor %#
 additionalMachineCertSans: *sans
 cniConfig:
  name: none

 nodes:
-  {% for item in nodes.inventory %}
-  - hostname: "{{ item.name }}"
-    ipAddress: "{{ item.address }}"
-    {% if item.talos_disk_device.startswith('/') %}
-    installDisk: "{{ item.talos_disk_device }}"
-    {% else %}
+  #% for item in bootstrap_node_inventory %#
+  - hostname: "#{ item.name }#"
+    ipAddress: "#{ item.address }#"
+    #% if item.talos_disk.startswith('/') %#
+    installDisk: "#{ item.talos_disk }#"
+    #% else %#
    installDiskSelector:
-      serial: "{{ item.talos_disk_device }}"
-    {% endif %}
-    {% if distribution.talos.secureboot.enabled %}
+      serial: "#{ item.talos_disk }#"
+    #% endif %#
+    #% if bootstrap_talos.secureboot.enabled %#
    machineSpec:
      secureboot: true
-    talosImageURL: factory.talos.dev/installer-secureboot/{{ distribution.talos.schematicID }}
-    {% else %}
-    talosImageURL: factory.talos.dev/installer/{{ distribution.talos.schematicID }}
-    {% endif %}
-    controlPlane: {{ (item.controller) | string | lower }}
+    talosImageURL: factory.talos.dev/installer-secureboot/#{ bootstrap_talos.schematic_id }#
+    #% else %#
+    talosImageURL: factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#
+    #% endif %#
+    controlPlane: #{ (item.controller) | string | lower }#
    networkInterfaces:
      - interface: eth0
        dhcp: false
-        {% if distribution.talos.vlan %}
+        #% if bootstrap_talos.vlan %#
        vlans:
-          - vlanId: {{ distribution.talos.vlan }}
+          - vlanId: #{ bootstrap_talos.vlan }#
            addresses:
-              - "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
+              - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
            mtu: 1500
            routes:
              - network: 0.0.0.0/0
-                {% if nodes.default_gateway %}
-                gateway: "{{ nodes.default_gateway }}"
-                {% else %}
-                gateway: "{{ nodes.host_network | nthhost(1) }}"
-                {% endif %}
-            {% if item.controller %}
+                #% if bootstrap_node_default_gateway %#
+                gateway: "#{ bootstrap_node_default_gateway }#"
+                #% else %#
+                gateway: "#{ bootstrap_node_network | nthhost(1) }#"
+                #% endif %#
+            #% if item.controller %#
            vip:
-              ip: "{{ cluster.endpoint_vip }}"
-            {% endif %}
-        {% else %}
+              ip: "#{ bootstrap_controllers_vip }#"
+            #% endif %#
+        #% else %#
        addresses:
-          - "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
+          - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
        mtu: 1500
        routes:
          - network: 0.0.0.0/0
-            {% if nodes.default_gateway %}
-            gateway: "{{ nodes.default_gateway }}"
-            {% else %}
-            gateway: "{{ nodes.host_network | nthhost(1) }}"
-            {% endif %}
-        {% if item.controller %}
+            #% if bootstrap_node_default_gateway %#
+            gateway: "#{ bootstrap_node_default_gateway }#"
+            #% else %#
+            gateway: "#{ bootstrap_node_network | nthhost(1) }#"
+            #% endif %#
+        #% if item.controller %#
        vip:
-          ip: "{{ cluster.endpoint_vip }}"
-        {% endif %}
-        {% endif %}
-    {% if distribution.talos.user_patches %}
+          ip: "#{ bootstrap_controllers_vip }#"
+        #% endif %#
+        #% endif %#
+    #% if bootstrap_talos.user_patches %#
    patches:
-      - "@./patches/node_{{ item.name }}.yaml"
-    {% endif %}
-  {% endfor %}
+      - "@./patches/node_#{ item.name }#.yaml"
+    #% endif %#
+  #% endfor %#

 patches:
  # Configure containerd
@@ -123,16 +123,16 @@ patches:
          rotate-server-certificates: true
        nodeIP:
          validSubnets:
-            - "{{ nodes.host_network }}"
+            - "#{ bootstrap_node_network }#"

  # Force nameserver
  - |-
    machine:
      network:
        nameservers:
-          {% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %}
-          - {{ item }}
-          {% endfor %}
+          #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
+          - #{ item }#
+          #% endfor %#

  # Configure NTP
  - |-
@@ -170,8 +170,7 @@ patches:
        extraKernelArgs:
          - net.ifnames=0

-  {% if distribution.talos.secureboot.enabled and
-        distribution.talos.secureboot.encrypt_disk_with_tpm %}
+  #% if bootstrap_talos.secureboot.enabled and bootstrap_talos.secureboot.encrypt_disk_with_tpm %#
  # Encrypt system disk with TPM
  - |-
    machine:
@@ -186,11 +185,11 @@ patches:
          keys:
            - slot: 0
              tpm: {}
-  {% endif %}
-  {% if distribution.talos.user_patches %}
+  #% endif %#
+  #% if bootstrap_talos.user_patches %#
  # User specified global patches
  - "@./patches/global.yaml"
-  {% endif %}
+  #% endif %#

 controlPlane:
  patches:
@@ -214,7 +213,7 @@ controlPlane:
          extraArgs:
            listen-metrics-urls: http://0.0.0.0:2381
          advertisedSubnets:
-            - "{{ nodes.host_network }}"
+            - "#{ bootstrap_node_network }#"

    # Disable default API server admission plugins.
    - |-
@@ -232,15 +231,14 @@ controlPlane:
            allowedKubernetesNamespaces:
              - system-upgrade

-    {% if distribution.talos.user_patches %}
+    #% if bootstrap_talos.user_patches %#
    # User specified controlPlane patches
    - "@./patches/controlPlane.yaml"
-    {% endif %}
+    #% endif %#

-{% if ( (distribution.talos.user_patches) and
-        (nodes.inventory | selectattr('controller', 'equalto', False) | list | length) ) %}
+#% if ((bootstrap_talos.user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %#
 worker:
  patches:
    # User specified worker patches
    - "@./patches/worker.yaml"
-{% endif %}
+#% endif %#
@@ -1 +0,0 @@
-main = lambda data: data.get("flux", {}).get("enabled", False) == True
@@ -6,13 +6,13 @@ metadata:
  namespace: flux-system
 spec:
  interval: 30m
-  url: "{{ flux.github.address }}"
-  {% if flux.github.private.enabled %}
+  url: "#{ bootstrap_github_address }#"
+  #% if bootstrap_github_private_key %#
  secretRef:
    name: github-deploy-key
-  {% endif %}
+  #% endif %#
  ref:
-    branch: "{{ flux.github.branch|default('main', true) }}"
+    branch: "#{ bootstrap_github_branch|default('main', true) }#"
  ignore: |
    # exclude all
    /*
@@ -1,4 +1,4 @@
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://kubernetes-sigs.github.io/external-dns
-{% endif %}
+#% endif %#
@@ -1,4 +1,4 @@
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://kubernetes.github.io/ingress-nginx
-{% endif %}
+#% endif %#
@@ -1,4 +1,4 @@
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://ori-edge.github.io/k8s_gateway
-{% endif %}
+#% endif %#
@@ -4,18 +4,18 @@ kind: Kustomization
 resources:
  - ./bjw-s.yaml
  - ./cilium.yaml
-  {% if cloudflare.enabled %}
+  #% if bootstrap_cloudflare.enabled %#
  - ./external-dns.yaml
  - ./ingress-nginx.yaml
  - ./k8s-gateway.yaml
-  {% endif %}
+  #% endif %#
  - ./jetstack.yaml
  - ./metrics-server.yaml
  - ./openebs.yaml
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
  - ./postfinance.yaml
-  {% endif %}
+  #% endif %#
  - ./stakater.yaml
-  {% if distribution.type in ["talos"] %}
+  #% if bootstrap_distribution in ["talos"] %#
  - ./xenitab.yaml
-  {% endif %}
+  #% endif %#
@@ -1,4 +1,4 @@
-{% if distribution.type in ["talos"] %}
+#% if bootstrap_distribution in ["talos"] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
 spec:
  interval: 1h
  url: https://postfinance.github.io/kubelet-csr-approver
-{% endif %}
+#% endif %#
@@ -1,4 +1,4 @@
-{% if distribution.type in ["talos"] %}
+#% if bootstrap_distribution in ["talos"] %#
 ---
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
@@ -9,4 +9,4 @@ spec:
  type: oci
  interval: 5m
  url: oci://ghcr.io/xenitab/helm-charts
-{% endif %}
+#% endif %#
@@ -6,8 +6,8 @@ metadata:
  namespace: flux-system
 stringData:
  SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
-  {% if cloudflare.enabled %}
-  SECRET_DOMAIN: "{{ cloudflare.domain }}"
-  SECRET_ACME_EMAIL: "{{ cloudflare.acme.email }}"
-  SECRET_CLOUDFLARE_TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
-  {% endif %}
+  #% if bootstrap_cloudflare.enabled %#
+  SECRET_DOMAIN: "#{ bootstrap_cloudflare.domain }#"
+  SECRET_ACME_EMAIL: "#{ bootstrap_cloudflare.acme.email }#"
+  SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#"
+  #% endif %#
@@ -5,12 +5,12 @@ metadata:
  name: cluster-settings
  namespace: flux-system
 data:
-  TIMEZONE: "{{ timezone }}"
-  CLUSTER_CIDR: "{{ cluster.pod_network.split(',')[0] }}"
-  NODE_CIDR: "{{ nodes.host_network }}"
-  {% if feature_gates.dual_stack_ipv4_first %}
-  CLUSTER_CIDR_V6: "{{ cluster.pod_network.split(',')[1] }}"
-  {% endif %}
-  {% if distribution.talos.bgp.enabled %}
-  LOADBALANCER_CIDR: "{{ distribution.talos.bgp.loadbalancer_network }}"
-  {% endif %}
+  TIMEZONE: "#{ bootstrap_timezone }#"
+  CLUSTER_CIDR: "#{ bootstrap_pod_network.split(',')[0] }#"
+  NODE_CIDR: "#{ bootstrap_node_network }#"
+  #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+  CLUSTER_CIDR_V6: "#{ bootstrap_pod_network.split(',')[1] }#"
+  #% endif %#
+  #% if bootstrap_bgp.enabled %#
+  BGP_ADVERTISED_CIDR: "#{ bootstrap_bgp.advertised_network }#"
+  #% endif %#
@@ -1 +0,0 @@
-main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]
@@ -1 +0,0 @@
-charts/
@@ -1,15 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-helmCharts:
-  - name: cilium
-    repo: https://helm.cilium.io
-    version: 1.15.1
-    releaseName: cilium
-    namespace: kube-system
-    valuesFile: values.yaml
-commonAnnotations:
-  meta.helm.sh/release-name: cilium
-  meta.helm.sh/release-namespace: kube-system
-commonLabels:
-  app.kubernetes.io/managed-by: Helm
@@ -1,4 +0,0 @@
---
-{% filter indent(width=0, first=True) %}
-{% include 'partials/cilium-values-init.partial.yaml.j2' %}
-{% endfilter %}
@@ -1 +0,0 @@
-charts/
@@ -1,19 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: kube-system
-helmCharts:
-  - name: kubelet-csr-approver
-    repo: https://postfinance.github.io/kubelet-csr-approver
-    version: 1.0.6
-    releaseName: kubelet-csr-approver
-    namespace: kube-system
-    valuesInline:
-      {% filter indent(width=6, first=True) %}
-      {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
-      {% endfilter %}
-commonAnnotations:
-  meta.helm.sh/release-name: kubelet-csr-approver
-  meta.helm.sh/release-namespace: kube-system
-commonLabels:
-  app.kubernetes.io/managed-by: Helm
@@ -1,8 +1,6 @@
 autoDirectNodeRoutes: true
-{% if distribution.talos.bgp.enabled %}
 bgpControlPlane:
  enabled: true
-{% endif %}
 bpf:
  masquerade: true
 cgroup:
@@ -10,19 +8,19 @@ cgroup:
    enabled: false
  hostRoot: /sys/fs/cgroup
 cluster:
-  name: home-kubernetes
  id: 1
+  name: home-kubernetes
 containerRuntime:
  integration: containerd
-  {% if distribution.type in ["k3s"] %}
+  #% if bootstrap_distribution in ["k3s"] %#
  socketPath: /var/run/k3s/containerd/containerd.sock
-  {% endif %}
+  #% endif %#
 # NOTE: This might need to be set if you have more than one active NIC on your hosts
 # devices:
 #   - eno0
 endpointRoutes:
  enabled: true
-{% if cloudflare.enabled %}
+#% if bootstrap_cloudflare.enabled %#
 hubble:
  enabled: true
  metrics:
@@ -57,35 +55,33 @@ hubble:
      tls:
        - hosts:
            - "hubble.${SECRET_DOMAIN}"
-{% else %}
+#% else %#
 hubble:
  enabled: false
-{% endif %}
+#% endif %#
 ipam:
  mode: kubernetes
 ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-{% if feature_gates.dual_stack_ipv4_first %}
+#% if bootstrap_feature_gates.dual_stack_ipv4_first %#
 ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
 ipv6:
  enabled: true
-{% endif %}
-{% if distribution.type in ["k3s"] %}
+#% endif %#
+#% if bootstrap_distribution in ["k3s"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 6444
-{% elif distribution.type in ["talos"] %}
+#% elif bootstrap_distribution in ["talos"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 7445
-{% endif %}
+#% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
-  {% if ( (distribution.talos.bgp.enabled) or
-          (feature_gates.dual_stack_ipv4_first) ) %}
-  # https://github.com/cilium/cilium/issues/28985
-  enabled: false
-  {% else %}
+  #% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %#
+  enabled: false # https://github.com/cilium/cilium/issues/28985
+  #% else %#
  enabled: true
-  {% endif %}
+  #% endif %#
 loadBalancer:
  algorithm: maglev
  mode: dsr
@@ -1,8 +1,6 @@
 autoDirectNodeRoutes: true
-{% if distribution.talos.bgp.enabled %}
 bgpControlPlane:
  enabled: true
-{% endif %}
 bpf:
  masquerade: true
 cgroup:
@@ -10,13 +8,13 @@ cgroup:
    enabled: false
  hostRoot: /sys/fs/cgroup
 cluster:
-  name: home-kubernetes
  id: 1
+  name: home-kubernetes
 containerRuntime:
  integration: containerd
-  {% if distribution.type in ["k3s"] %}
+  #% if bootstrap_distribution in ["k3s"] %#
  socketPath: /var/run/k3s/containerd/containerd.sock
-  {% endif %}
+  #% endif %#
 # NOTE: This might need to be set if you have more than one active NIC on your hosts
 # devices:
 #   - eno0
@@ -26,29 +24,27 @@ hubble:
  enabled: false
 ipam:
  mode: kubernetes
-ipv4NativeRoutingCIDR: "{{ cluster.pod_network }}"
-{% if feature_gates.dual_stack_ipv4_first %}
-ipv6NativeRoutingCIDR: "{{ cluster.pod_network_v6 }}"
+ipv4NativeRoutingCIDR: "#{ bootstrap_pod_network }#"
+#% if bootstrap_feature_gates.dual_stack_ipv4_first %#
+ipv6NativeRoutingCIDR: "#{ bootstrap_pod_network_v6 }#"
 ipv6:
  enabled: true
-{% endif %}
-{% if distribution.type in ["k3s"] %}
+#% endif %#
+#% if bootstrap_distribution in ["k3s"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 6444
-{% elif distribution.type in ["talos"] %}
+#% elif bootstrap_distribution in ["talos"] %#
 k8sServiceHost: 127.0.0.1
 k8sServicePort: 7445
-{% endif %}
+#% endif %#
 kubeProxyReplacement: true
 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
-  {% if ( (distribution.talos.bgp.enabled) or
-          (feature_gates.dual_stack_ipv4_first) ) %}
-  # https://github.com/cilium/cilium/issues/28985
-  enabled: false
-  {% else %}
+  #% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %#
+  enabled: false # https://github.com/cilium/cilium/issues/28985
+  #% else %#
  enabled: true
-  {% endif %}
+  #% endif %#
 loadBalancer:
  algorithm: maglev
  mode: dsr
@@ -21,7 +21,7 @@ spec:
          args: ["manager"]
          env:
            - name: address
-              value: "{{ cluster.endpoint_vip }}"
+              value: "#{ bootstrap_controllers_vip }#"
            - name: vip_arp
              value: "true"
            - name: port
@@ -1,2 +1,2 @@
-providerRegex: ^({{ (nodes.inventory | map(attribute='name') | join('|')) }})$
+providerRegex: ^(#{ (bootstrap_node_inventory | map(attribute='name') | join('|')) }#)$
 bypassDnsResolution: true
@@ -1,161 +1,149 @@
 ---

 #
-# (Required) Distribution represents the Kubernetes distribution layer and any additional customizations
+# 1. (Required) Cluster details - Cluster represents the Kubernetes cluster layer and any additional customizations
 #

-distribution:
-  # (Required) Distribution can either be k3s, or talos
-  type: k3s
-  # (Optional) Talos Specific Options
-  talos: {}
-    # # (Required) If you need any additional System Extensions and/or kernel arguments generate a schematic ID.
-    # # Go to https://factory.talos.dev/ and choose the System Extensions you need and/or add extra kernel arguments.
-    # # Otherwise use below default.
-    # schematicID: "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-    # # (Optional) Add vlan tag to network master device
-    # #   See: https://www.talos.dev/latest/advanced/advanced-networking/#vlans
-    # vlan: 1
-    # # (Optional) Use cilium BGP control plane when L2 announcements won't traverse VLAN network segments.
-    # #   Needs a BGP capable router setup with the node IPs as peers.
-    # #   See: https://docs.cilium.io/en/latest/network/bgp-control-plane/
-    # bgp:
-    #   enabled: true
-    #   # (Optional) If using multiple BGP peers add them here.
-    #   #   Default is .1 derrived from host_network: ['x.x.x.1']
-    #   peers: []
-    #   # (Required) Set the BGP Autonomous System Number for the router(s) and nodes.
-    #   #  If these match, iBGP will be used. If not, eBGP will be used.
-    #   peer_asn: 64512   # Router(s) AS
-    #   local_asn: 64512  # Node(s) AS
-    #   # (Required) The loadbalancer CIDR for the cluster, this must NOT overlap with any
-    #   #   existing networks and is usually a /16 (64K IPs).
-    #   # If you want to use IPv6 check the advanced flags below
-    #   loadbalancer_network: 10.123.0.0/16
-    # secureboot:
-    #   # (Optional) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode.
-    #   # If you want to use this. Please make sure to boot from secureboot ISO and enroll keys first.
-    #   #   See: https://www.talos.dev/latest/talos-guides/install/bare-metal-platforms/secureboot
-    #   enabled: true
-    #   # (Optional) Enable TPM-based disk encryption. Requires TPM 2.0
-    #   #   See: https://www.talos.dev/v1.6/talos-guides/install/bare-metal-platforms/secureboot/#disk-encryption-with-tpm
-    #   encrypt_disk_with_tpm: true
-    # user_patches: true
-    # # (Optional) Add includes for user provided patches to generated talconfig.yaml.
-    # #   See: https://github.com/budimanjojo/talhelper/blob/179ba9ed42f70069c7842109bea24f769f7af6eb/example/extraKernelArgs-patch.yaml
-    # #   Patches are applied in this order. (global overrides cp/worker which overrides node-specific).
-    # #   Create these files to allow talos:bootstrap-genconfig to complete (empty files are ok).
-    # #     kubernetes/talos/patches/node_<name>.yaml  # Patches for individual nodes
-    # #     kubernetes/talos/patches/controlPlane.yaml # Patches for controlplane nodes
-    # #     kubernetes/talos/patches/worker.yaml       # Patches for worker nodes
-    # #     kubernetes/talos/patches/global.yaml       # Patches for ALL nodes
-
-#
 # (Required) Timezone is your IANA formatted timezone (e.g. America/New_York)
-#
+bootstrap_timezone: ""

-timezone: ""
+# (Required) Distribution can either be k3s or talos
+bootstrap_distribution: k3s

-#
-# (Required) Nodes represents the physical or virtual machines layer and any additional customizations
-#
+# (Required: Talos) Talos Specific Options
+bootstrap_talos:
+  # (Required: Talos) If you need any additional System Extensions, and/or add kernel arguments generate a schematic ID.
+  #   Go to https://factory.talos.dev/ and choose the System Extensions, and/or add kernel arguments.
+  schematic_id: ""
+  # (Optional: Talos) Add vlan tag to network master device
+  #   See: https://www.talos.dev/latest/advanced/advanced-networking/#vlans
+  vlan: ""
+  # (Optional: Talos) Secureboot and TPM-based disk encryption
+  secureboot:
+    # (Optional) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode.
+    #   See: https://www.talos.dev/latest/talos-guides/install/bare-metal-platforms/secureboot
+    enabled: false
+    # (Optional) Enable TPM-based disk encryption. Requires TPM 2.0
+    #   See: https://www.talos.dev/v1.6/talos-guides/install/bare-metal-platforms/secureboot/#disk-encryption-with-tpm
+    encrypt_disk_with_tpm: false
+  # (Optional) Add includes for user provided patches to generated talconfig.yaml.
+  #   See: https://github.com/budimanjojo/talhelper/blob/179ba9ed42f70069c7842109bea24f769f7af6eb/example/extraKernelArgs-patch.yaml
+  #   Patches are applied in this order. (global overrides cp/worker which overrides node-specific).
+  #   Create these files to allow talos:bootstrap-genconfig to complete (empty files are ok).
+  #     kubernetes/talos/patches/node_<name>.yaml  # Patches for individual nodes
+  #     kubernetes/talos/patches/controlPlane.yaml # Patches for controlplane nodes
+  #     kubernetes/talos/patches/worker.yaml       # Patches for worker nodes
+  #     kubernetes/talos/patches/global.yaml       # Patches for ALL nodes
+  user_patches: false

-nodes:
-  # (Required) CIDR your nodes are on (e.g. 192.168.1.0/24)
-  host_network: ""
-  # (Optional) Talos only: If your gateway is not on the .1 address of above CIDR you can set it here (e.g. 192.168.1.254)
-  # default_gateway: ""
-  # (Optional) The DNS server to use for the cluster, this can be an existing
-  #   local DNS server or a public one.
-  #   Default is ["1.1.1.1", "1.0.0.1"]
-  # If using a local DNS server make sure it meets the following requirements:
-  #   1. your nodes can reach it
-  #   2. it is configured to forward requests to a public DNS server
-  #   3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
-  # If using multiple DNS servers make sure they are setup the same way, there is no
-  #   guarantee that the first DNS server will always be used for every lookup.
-  dns_servers: []
-  # (Optional) The DNS search domain to use for the nodes.
-  #   Default is "."
-  # Use the default or leave empty to avoid possible DNS issues inside the cluster.
-  search_domain: ""
-  # (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3
-  #   Worker nodes are optional
-  inventory: []
+# (Required) The CIDR your nodes are on (e.g. 192.168.1.0/24)
+bootstrap_node_network: ""
+
+# (Optional) The default gateway for the nodes
+#   Default is .1 derrived from bootstrap_node_network: 'x.x.x.1'
+bootstrap_node_default_gateway: ""
+
+# (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3
+#   Worker nodes are optional
+bootstrap_node_inventory: []
    # - name: ""          # Name of the node (must match [a-z0-9-\.]+)
    #   address: ""       # IP address of the node
    #   controller: true  # (Required) Set to true if this is a controller node
-    #   ssh_username: ""       # (Required: k3s) SSH username of the node
-    #   talos_disk_device: ""  # (Required: Talos) Device path or serial number of the disk for this node
+    #   ssh_user: ""      # (Required: k3s) SSH username of the node
+    #   talos_disk: ""    # (Required: Talos) Device path or serial number of the disk for this node
    # ...

-#
-# (Required) Cluster represents the Kubernetes cluster layer and any additional customizations
-#
+# (Optional) The DNS server to use for the cluster, this can be an existing
+#   local DNS server or a public one.
+#   Default is ["1.1.1.1", "1.0.0.1"]
+# If using a local DNS server make sure it meets the following requirements:
+#   1. your nodes can reach it
+#   2. it is configured to forward requests to a public DNS server
+#   3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
+# If using multiple DNS servers make sure they are setup the same way, there is no
+#   guarantee that the first DNS server will always be used for every lookup.
+bootstrap_dns_servers: []

-cluster:
-  # (Required) The pod CIDR for the cluster, this must NOT overlap with any
+# (Optional) The DNS search domain to use for the nodes.
+#   Default is "."
+# Use the default or leave empty to avoid possible DNS issues inside the cluster.
+bootstrap_search_domain: ""
+
+# (Required) The pod CIDR for the cluster, this must NOT overlap with any
+#   existing networks and is usually a /16 (64K IPs).
+# If you want to use IPv6 check the advanced flags below
+bootstrap_pod_network: "10.69.0.0/16"
+
+# (Required) The service CIDR for the cluster, this must NOT overlap with any
+#   existing networks and is usually a /16 (64K IPs).
+# If you want to use IPv6 check the advanced flags below
+bootstrap_service_network: "10.96.0.0/16"
+
+# (Required) The IP address of the Kube API, choose an available IP in
+#   your nodes host network that is NOT being used. This is announced over L2.
+# For k3s kube-vip is used, built-in functionality is used with Talos
+bootstrap_controllers_vip: ""
+
+# (Optional) Add additional SANs to the Kube API cert, this is useful
+#   if you want to call the Kube API by hostname rather than IP
+bootstrap_tls_sans: []
+
+# (Required) Age Public Key (e.g. age1...)
+# 1. Generate a new key with the following command:
+#    > task sops:age-keygen
+# 2. Copy the public key and paste it below
+bootstrap_sops_age_pubkey: ""
+
+# (Optional) Use cilium BGP control plane when L2 announcements won't traverse VLAN network segments.
+#   Needs a BGP capable router setup with the node IPs as peers.
+#   See: https://docs.cilium.io/en/latest/network/bgp-control-plane/
+bootstrap_bgp:
+  enabled: false
+  # (Optional) If using multiple BGP peers add them here.
+  #   Default is .1 derrived from host_network: ['x.x.x.1']
+  peers: []
+  # (Required) Set the BGP Autonomous System Number for the router(s) and nodes.
+  #  If these match, iBGP will be used. If not, eBGP will be used.
+  peer_asn: ""  # Router(s) AS
+  local_asn: "" # Node(s) AS
+  # (Required) The advertised CIDR for the cluster, this must NOT overlap with any
  #   existing networks and is usually a /16 (64K IPs).
  # If you want to use IPv6 check the advanced flags below
-  pod_network: 10.69.0.0/16
-  # (Required) The service CIDR for the cluster, this must NOT overlap with any
-  #   existing networks and is usually a /16 (64K IPs).
-  # If you want to use IPv6 check the advanced flags below
-  service_network: 10.96.0.0/16
-  # (Required) The IP address of the Kube API, choose an available IP in
-  #   your nodes host network that is NOT being used. This is announced over L2.
-  endpoint_vip: ""
-  # (Optional) Add additional SANs to the Kube API cert, this is useful
-  #   if you want to call the Kube API by hostname rather than IP
-  tls_sans: []
+  advertised_network: ""

 #
-# (Optional) Flux details - Flux is used to manage the cluster configuration.
+# 2. (Required) Flux details - Flux is used to manage the cluster configuration.
 #

-flux:
-  # (Required) Disable to use a different tool (e.g. kubectl, Argo, Kluctl)
-  enabled: false
-  # (Required) Age Public Key (e.g. age1...)
-  # 1. Generate a new key with the following command:
-  #    > task sops:age-keygen
-  # 2. Copy the public key and paste it below
-  sops_age_public_key: ""
-  # (Required) Options for GitHub
-  github:
-    # (Required) GitHub repository URL (for private repos use the ssh:// URL)
-    address: ""
-    # (Required) GitHub repository branch
-    branch: main
-    # (Required) Options for Flux GitHub webhook
-    webhook:
-      # (Required) Enable to setup GitHub push-based sync after cluster creation
-      enabled: true
-      # Token for GitHub push-based sync
-      # 1. Generate a new token with the following command:
-      #    > openssl rand -hex 16
-      # 2. Copy the token and paste it below
-      token: ""
-    # (Required) Private key for Flux to access the GitHub repository
-    private:
-      # (Required) Enable to use a private GitHub repository
-      enabled: false
-      # Private key for Flux to access the GitHub repository
-      #   1. Generate a new key with the following command:
-      #      > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P ""
-      #   2. Make sure to paste public key from "github-deploy.key.pub" into
-      #      the deploy keys section of your repository settings.
-      #   3. Uncomment and paste the private key below
-      # key: |
-      #   -----BEGIN OPENSSH PRIVATE KEY-----
-      #   ...
-      #   -----END OPENSSH PRIVATE KEY-----
+# (Required) GitHub repository URL (for private repos use the ssh:// URL)
+bootstrap_github_address: ""
+
+# (Required) GitHub repository branch
+bootstrap_github_branch: "main"
+
+# (Required) Token for GitHub push-based sync
+# 1. Generate a new token with the following command:
+#    > openssl rand -hex 16
+# 2. Copy the token and paste it below
+bootstrap_github_webhook_token: ""
+
+# (Optional) Private key for Flux to access the GitHub repository
+#   1. Generate a new key with the following command:
+#      > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P ""
+#   2. Make sure to paste public key from "github-deploy.key.pub" into
+#      the deploy keys section of your repository settings.
+#   3. Uncomment and paste the private key below
+#   4. Optionally set your repository on GitHub to private
+# bootstrap_github_private_key: |
+#   -----BEGIN OPENSSH PRIVATE KEY-----
+#   ...
+#   -----END OPENSSH PRIVATE KEY-----

 #
-# (Optional) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling.
+# 3. (Optional) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling.
 #

-cloudflare:
+bootstrap_cloudflare:
  # (Required) Disable to use a different DNS provider
  enabled: false
  # (Required) Cloudflare Domain
@@ -209,11 +197,11 @@ cloudflare:
    ingress_vip: ""

 # (Optional) Feature gates are used to enable experimental features
-feature_gates:
-  # Enable Dual Stack IPv4 first
-  # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it.
-  #   Ref: https://github.com/onedr0p/cluster-template/issues/1148
-  # Keep in mind that Cilium does not currently support IPv6 L2 announcements.
-  # Make sure you set cluster.pod_cidr and cluster.service_cidr
-  #   to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64"
-  dual_stack_ipv4_first: false
+# bootstrap_feature_gates:
+#   # Enable Dual Stack IPv4 first
+#   # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it.
+#   #   Ref: https://github.com/onedr0p/cluster-template/issues/1148
+#   # Keep in mind that Cilium does not currently support IPv6 L2 announcements.
+#   # Make sure you set cluster.pod_cidr and cluster.service_cidr
+#   #   to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64"
+#   dual_stack_ipv4_first: false
@@ -10,9 +10,9 @@ force = true
 undefined = "chainable"

 [makejinja.delimiter]
-block_start = "{%"
-block_end = "%}"
-comment_start = "{#"
-comment_end = "#}"
-variable_start = "{{"
-variable_end = "}}"
+block_start = "#%"
+block_end = "%#"
+comment_start = "#|"
+comment_end = "#|"
+variable_start = "#{"
+variable_end = "}#"
				`@@ -1 +0,0 @@`
				`main = lambda data: data.get("flux", {}).get("enabled", False) == True`
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]`
				`@@ -1 +0,0 @@`
				`main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]`