feat!: template all ansible dir and rename template to bootstrap (#847)

.github/labeler.yaml

@@ -5,5 +5,5 @@ area/github:
   - ".github/**/*"
 area/kubernetes:
   - "kubernetes/**/*"
-area/templates:
-  - "template/**/*"
+area/bootstrap:
+  - "bootstrap/**/*"

.github/renovate.json5

@@ -20,6 +20,12 @@
   "suppressNotifications": ["prIgnoreNotification"],
   "rebaseWhen": "conflicted",
   "schedule": ["on saturday"],
+  "ansible-galaxy": {
+    "fileMatch": [
+      "(^|/)requirements\\.ya?ml(\\.j2)?$",
+      "(^|/)galaxy\\.ya?ml(\\.j2)?$"
+    ]
+  },
   "flux": {
     "fileMatch": [
       "(^|/)kubernetes/.+\\.ya?ml(\\.j2)?$"
@@ -41,6 +47,11 @@
       "(^|/)kustomization\\.ya?ml(\\.j2)?$"
     ]
   },
+  "pip_requirements": {
+    "fileMatch": [
+      "(^|/)[\\w-]*requirements(-\\w+)?\\.(txt|pip)(\\.j2)?$"
+    ]
+  },
   "regexManagers": [
     {
       "description": "Process various other dependencies",

README.md

@@ -26,7 +26,7 @@ The following components will be installed in your [k3s](https://k3s.io/) cluste
 - [ingress-nginx](https://kubernetes.github.io/ingress-nginx/) - Kubernetes ingress controller used for a HTTP reverse proxy of Kubernetes ingresses
 - [local-path-provisioner](https://github.com/rancher/local-path-provisioner) - provision persistent local storage with Kubernetes
 
-_Additional applications can be enabled in the [addons](./template/vars/addons.sample.yaml) configuration file_
+_Additional applications can be enabled in the [addons](./bootstrap/vars/addons.sample.yaml) configuration file_
 
 ## 📝 Prerequisites
 
@@ -68,7 +68,7 @@ There is a decent guide [here](https://www.linuxtechi.com/how-to-install-debian-
     ```sh
     su -
     sed -i '/deb cdrom/d' /etc/apt/sources.list
-    apt update
+    apt-get update
     exit
     ```
 
@@ -76,7 +76,7 @@ There is a decent guide [here](https://www.linuxtechi.com/how-to-install-debian-
 
     ```sh
     su -
-    apt install sudo
+    apt-get install sudo
     usermod -aG sudo ${username}
     echo "${username}  ALL=(ALL) NOPASSWD:ALL" | tee /etc/sudoers.d/${username}
     exit
@@ -88,7 +88,7 @@ There is a decent guide [here](https://www.linuxtechi.com/how-to-install-debian-
 
     ```sh
     mkdir -m 700 ~/.ssh
-    sudo apt install curl
+    sudo apt-get install curl
     curl https://github.com/${github_username}.keys > ~/.ssh/authorized_keys
     chmod 600 ~/.ssh/authorized_keys
     ```
@@ -203,7 +203,7 @@ In order to expose services to the internet you will need to create a [Cloudflar
 
 ### 📄 Configuration
 
-📍 The `template/vars/config.yaml` file contains necessary configuration that is needed by Ansible and Flux. The `template/vars/addons.yaml` file allows you to customize which additional apps you want deployed in your cluster. These files are added to the `.gitignore` file and will not be tracked by Git.
+📍 The `bootstrap/vars/config.yaml` file contains necessary configuration that is needed by Ansible and Flux. The `bootstrap/vars/addons.yaml` file allows you to customize which additional apps you want deployed in your cluster. These files are added to the `.gitignore` file and will not be tracked by Git.
 
 1. Copy the configuration and addons files and start filling out all the variables.
 
@@ -219,7 +219,7 @@ In order to expose services to the internet you will need to create a [Cloudflar
 
 ### 📂 Repository structure
 
-The configure script will have created the following directories under `./kubernetes`.
+The configure script will have created a `./ansible` directory and the following directories under `./kubernetes`.
 
 ```sh
 📁 kubernetes      # Kubernetes cluster defined as code

Taskfile.yaml

@@ -2,7 +2,7 @@
 version: "3"
 
 vars:
-  TEMPLATE_DIR: "{{.ROOT_DIR}}/template"
+  BOOTSTRAP_DIR: "{{.ROOT_DIR}}/bootstrap"
   ANSIBLE_DIR: "{{.ROOT_DIR}}/ansible"
   KUBERNETES_DIR: "{{.ROOT_DIR}}/kubernetes"
 
@@ -21,7 +21,7 @@ tasks:
 
   init:
     desc: Initialize configuration files
-    dir: "{{.TEMPLATE_DIR}}"
+    dir: "{{.BOOTSTRAP_DIR}}"
     cmds:
       - cp -n vars/addons.sample.yaml vars/addons.yaml
       - cp -n vars/config.sample.yaml vars/config.yaml
@@ -29,17 +29,17 @@ tasks:
         silent: true
       - cmd: echo "Proceed with updating the configuration files..."
         silent: true
-      - cmd: echo "{{.TEMPLATE_DIR}}/vars/config.yaml"
+      - cmd: echo "{{.BOOTSTRAP_DIR}}/vars/config.yaml"
         silent: true
-      - cmd: echo "{{.TEMPLATE_DIR}}/vars/addons.yaml"
+      - cmd: echo "{{.BOOTSTRAP_DIR}}/vars/addons.yaml"
         silent: true
     status:
-      - test -f "{{.TEMPLATE_DIR}}/vars/addons.yaml"
-      - test -f "{{.TEMPLATE_DIR}}/vars/config.yaml"
+      - test -f "{{.BOOTSTRAP_DIR}}/vars/addons.yaml"
+      - test -f "{{.BOOTSTRAP_DIR}}/vars/config.yaml"
 
   configure:
     desc: Configure repository from Ansible vars
-    dir: "{{.TEMPLATE_DIR}}"
+    dir: "{{.BOOTSTRAP_DIR}}"
     cmd: ansible-playbook configure.yaml
     env:
       ANSIBLE_DISPLAY_SKIPPED_HOSTS: "false"

bootstrap/tasks/ansible/main.yaml

@@ -0,0 +1,121 @@
+---
+- name: Ensure Kubernetes directories exist
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/ansible/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/ansible/"]
+
+- name: Template Ansible unencrypted files
+  when: item.state == 'file' and 'sops' not in item.path and '.DS_Store' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/ansible/{{ item.path | regex_replace('.j2$', '') }}"
+    mode: "0755"
+  with_community.general.filetree: ["../templates/ansible/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template Ansible encrypted files
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template Ansible encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/ansible/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0755"
+        force: true
+      with_community.general.filetree: ["../templates/ansible/"]
+    - name: Template encrypted node secrets
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', 'templates/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
+        mode: "0755"
+        force: true
+      loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
+      loop_control:
+        label: "{{ item.address }}"
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+
+# - name: Template Ansible configuration
+#   ansible.builtin.template:
+#     src: "{{ item.src }}"
+#     dest: "{{ repository_path }}/{{ item.dest }}"
+#     mode: "0755"
+#   loop:
+#     - src: templates/ansible/supplemental.yaml.j2
+#       dest: ./ansible/inventory/group_vars/kubernetes/supplemental.yaml
+#     - src: templates/ansible/hosts.yaml.j2
+#       dest: ./ansible/inventory/hosts.yaml
+
+# # https://github.com/ansible-collections/community.sops/issues/153
+# - name: Template Ansible encrypted files
+#   block:
+#     - name: Rename Sops configuration file
+#       ansible.builtin.copy:
+#         src: "{{ repository_path }}/.sops.yaml"
+#         dest: "{{ repository_path }}/.sops.yaml.orig"
+#         mode: "0755"
+#     - name: Remove Sops configuration file
+#       ansible.builtin.file:
+#         path: "{{ repository_path }}/.sops.yaml"
+#         state: absent
+#     - name: Template encrypted node secrets
+#       community.sops.sops_encrypt:
+#         path: "{{ repository_path }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
+#         age: ["{{ bootstrap_age_public_key }}"]
+#         content_yaml: "{{ lookup('ansible.builtin.template', 'templates/ansible/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
+#         mode: "0755"
+#         force: true
+#       loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
+#       loop_control:
+#         label: "{{ item.address }}"
+#     - name: Restore Sops configuration file
+#       ansible.builtin.copy:
+#         src: "{{ repository_path }}/.sops.yaml.orig"
+#         dest: "{{ repository_path }}/.sops.yaml"
+#         mode: "0755"
+#     - name: Remove backed up Sops configuration file
+#       ansible.builtin.file:
+#         path: "{{ repository_path }}/.sops.yaml.orig"
+#         state: absent
+#   rescue:
+#     - name: Restore Sops configuration file
+#       ansible.builtin.copy:
+#         src: "{{ repository_path }}/.sops.yaml.orig"
+#         dest: "{{ repository_path }}/.sops.yaml"
+#         mode: "0755"
+#     - name: Remove backed up Sops configuration file
+#       ansible.builtin.file:
+#         path: "{{ repository_path }}/.sops.yaml.orig"
+#         state: absent

bootstrap/tasks/kubernetes/main.yaml

@@ -8,10 +8,10 @@
   with_community.general.filetree: ["../templates/kubernetes/"]
 
 - name: Template Kubernetes unencrypted files
-  when: item.state == 'file' and 'sops' not in item.path
+  when: item.state == 'file' and 'sops' not in item.path and '.DS_Store' not in item.path
   ansible.builtin.template:
     src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/{{ item.path | replace('.j2', '') }}"
+    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
     mode: "0755"
   with_community.general.filetree: ["../templates/kubernetes/"]
 

bootstrap/tasks/validation/main.yaml

@@ -1,6 +1,6 @@
 ---
 - name: Verify configuration
   ansible.builtin.include_tasks: "{{ task }}.yaml"
-  loop: [age, cli, net, cloudflare, github]
+  loop: [vars, age, cli, net, cloudflare, github]
   loop_control:
     loop_var: task

bootstrap/tasks/validation/vars.yaml

@@ -0,0 +1,36 @@
+---
+
+- name: Verify required bootstrap vars are set
+  ansible.builtin.assert:
+    that:
+      - "{{ item }} | default('', true) | trim != ''"
+    success_msg: "Required bootstrap var {{ item }} exists and is defined"
+    fail_msg: "Required bootstrap var {{ item }} does not exists or is not defined"
+  loop:
+    - bootstrap_github_username
+    - bootstrap_github_repository_name
+    - bootstrap_age_public_key
+    - bootstrap_timezone
+    - bootstrap_acme_email
+    - bootstrap_flux_github_webhook_token
+    - bootstrap_cloudflare_domain
+    - bootstrap_cloudflare_token
+    - bootstrap_cloudflare_account_tag
+    - bootstrap_cloudflare_tunnel_secret
+    - bootstrap_cloudflare_tunnel_id
+    - bootstrap_node_cidr
+    - bootstrap_k8s_gateway_addr
+    - bootstrap_ingress_nginx_addr
+    - bootstrap_kube_vip_addr
+    - bootstrap_cluster_cidr
+    - bootstrap_service_cidr
+
+- name: Verify bootstrap node names are valid
+  ansible.builtin.assert:
+    that:
+      - "item.name is match('^[a-z0-9-]+$')"
+    success_msg: "Node name {{ item.name }} is valid"
+    fail_msg: "Node name {{ item.name }} is not valid"
+  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
+  loop_control:
+     label: "{{ item.name }}"

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -10,7 +10,7 @@ k3s_install_hard_links: true
 k3s_become: true
 k3s_etcd_datastore: true
 k3s_use_unsupported_config: true
-k3s_registration_address: "{{ kube_vip_addr }}"
+k3s_registration_address: "{% raw %}{{ kube_vip_addr }}{% endraw %}"
 k3s_server_manifests_urls:
   # Kube-vip RBAC
   - url: https://raw.githubusercontent.com/kube-vip/kube-vip/main/docs/manifests/rbac.yaml

bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2

@@ -4,9 +4,9 @@
 
 k3s_control_node: true
 k3s_server:
-  node-ip: "{{ ansible_host }}"
+  node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
   tls-san:
-    - "{{ kube_vip_addr }}"
+    - "{% raw %}{{ kube_vip_addr }}{% endraw %}"
   docker: false
   flannel-backend: "none"             # This needs to be in quotes
   disable:
@@ -20,8 +20,8 @@ k3s_server:
   disable-cloud-controller: true
   disable-kube-proxy: true            # Cilium uses eBPF
   write-kubeconfig-mode: "644"
-  cluster-cidr: "{{ cluster_cidr }}"
-  service-cidr: "{{ service_cidr }}"
+  cluster-cidr: "{% raw %}{{ cluster_cidr }}{% endraw %}"
+  service-cidr: "{% raw %}{{ service_cidr }}{% endraw %}"
   etcd-expose-metrics: true           # Required to monitor etcd with kube-prometheus-stack
   kube-controller-manager-arg:
     - "bind-address=0.0.0.0"          # Required to monitor kube-controller-manager with kube-prometheus-stack

bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2

@@ -4,4 +4,4 @@
 
 k3s_control_node: false
 k3s_agent:
-  node-ip: "{{ ansible_host }}"
+  node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"

bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2

@@ -38,9 +38,9 @@
             or k3s_server_manifests_urls | length > 0)
       kubernetes.core.k8s_info:
         kubeconfig: /etc/rancher/k3s/k3s.yaml
-        kind: "{{ item.kind }}"
-        name: "{{ item.name }}"
-        namespace: "{{ item.namespace | default('') }}"
+        kind: "{% raw %}{{ item.kind }}{% endraw %}"
+        name: "{% raw %}{{ item.name }}{% endraw %}"
+        namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}"
         wait: true
         wait_sleep: 10
         wait_timeout: 360

bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2

@@ -19,5 +19,5 @@
     - name: Upgrade kube-vip
       ansible.builtin.template:
         src: templates/kube-vip-static-pod.yaml.j2
-        dest: "{{ k3s_server_pod_manifests_dir }}/kube-vip-static-pod.yaml"
+        dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml"
         mode: preserve

bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2

@@ -36,17 +36,17 @@
       block:
         - name: Networking | Delete Cilium links
           ansible.builtin.command:
-            cmd: "ip link delete {{ item }}"
-            removes: "/sys/class/net/{{ item }}"
+            cmd: "ip link delete {% raw %}{{ item }}{% endraw %}"
+            removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}"
           loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
         - name: Networking | Flush iptables
           ansible.builtin.iptables:
-            table: "{{ item }}"
+            table: "{% raw %}{{ item }}{% endraw %}"
             flush: true
           loop: ["filter", "nat", "mangle", "raw"]
         - name: Networking | Flush ip6tables
           ansible.builtin.iptables:
-            table: "{{ item }}"
+            table: "{% raw %}{{ item }}{% endraw %}"
             flush: true
             ip_version: ipv6
           loop: ["filter", "nat", "mangle", "raw"]

bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2

@@ -13,7 +13,7 @@
       block:
         - name: Locale | Set timezone
           community.general.timezone:
-            name: "{{ timezone | default('Etc/UTC') }}"
+            name: "{% raw %}{{ timezone | default('Etc/UTC') }}{% endraw %}"
 
     - name: Packages
       block:
@@ -29,13 +29,13 @@
       block:
         - name: User Configuration | SSH keys
           ansible.posix.authorized_key:
-            user: "{{ ansible_user }}"
-            key: "https://github.com/{{ github_username }}.keys"
+            user: "{% raw %}{{ ansible_user }}{% endraw %}"
+            key: "https://github.com/{% raw %}{{ github_username }}{% endraw %}.keys"
         - name: User Configuration | Silence login
           ansible.builtin.file:
             dest: /root/.hushlogin
             state: touch
-            owner: "{{ ansible_user }}"
+            owner: "{% raw %}{{ ansible_user }}{% endraw %}"
             mode: "0644"
             modification_time: preserve
             access_time: preserve
@@ -45,12 +45,12 @@
       block:
         - name: Network Configuration | Set hostname
           ansible.builtin.hostname:
-            name: "{{ inventory_hostname }}"
+            name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
         - name: Network Configuration | Update hosts
           ansible.builtin.copy:
             content: |
               127.0.0.1 localhost
-              127.0.1.1 {{ inventory_hostname }}
+              127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %}
 
               # The following lines are desirable for IPv6 capable hosts
               ::1     localhost ip6-localhost ip6-loopback
@@ -85,28 +85,28 @@
             masked: true
         - name: System Configuration | Disable swap
           ansible.posix.mount:
-            name: "{{ item }}"
+            name: "{% raw %}{{ item }}{% endraw %}"
             fstype: swap
             state: absent
           loop: ["none", "swap"]
         - name: System Configuration | Kernel modules (1)
           community.general.modprobe:
-            name: "{{ item }}"
+            name: "{% raw %}{{ item }}{% endraw %}"
             state: present
           loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
         - name: System Configuration | Kernel modules (2)
           ansible.builtin.copy:
-            dest: "/etc/modules-load.d/{{ item }}.conf"
+            dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf"
             mode: "0644"
-            content: "{{ item }}"
+            content: "{% raw %}{{ item }}{% endraw %}"
           loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
         - name: System Configuration | Sysctl
           ansible.posix.sysctl:
-            name: "{{ item.key }}"
-            value: "{{ item.value }}"
+            name: "{% raw %}{{ item.key }}{% endraw %}"
+            value: "{% raw %}{{ item.value }}{% endraw %}"
             sysctl_file: /etc/sysctl.d/99-kubernetes.conf
             reload: true
-          with_dict: "{{ sysctl_config }}"
+          with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}"
           vars:
             sysctl_config:
               fs.inotify.max_queued_events: 65536

bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2

@@ -12,10 +12,9 @@
         seconds: 5
   tasks:
     - name: Get the node's details
-      ansible.builtin.command: |
-        kubectl get node {{ inventory_hostname }} -o json
+      ansible.builtin.command: "kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
       register: kubectl_get_node
-      delegate_to: "{{ groups['master'][0] }}"
+      delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
       failed_when: false
       changed_when: false
 
@@ -27,25 +26,22 @@
         - not (kubectl_get_node['stdout'] | from_json).spec.unschedulable is defined
       block:
         - name: Cordon node
-          ansible.builtin.command: |
-            kubectl cordon {{ inventory_hostname }}
-          delegate_to: "{{ groups['master'][0] }}"
+          ansible.builtin.command: "kubectl cordon {% raw %}{{ inventory_hostname }}{% endraw %}"
+          delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
           changed_when: false
 
         - name: Wait for node to cordon
-          ansible.builtin.command: |
-            kubectl get node {{ inventory_hostname }} -o json
+          ansible.builtin.command: "kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
           register: wait_for_cordon
           retries: 10
           delay: 10
-          delegate_to: "{{ groups['master'][0] }}"
+          delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
           changed_when: false
           until: (wait_for_cordon['stdout'] | from_json).spec.unschedulable
 
         - name: Cordon & drain node
-          ansible.builtin.command: |
-            kubectl drain --ignore-daemonsets --delete-emptydir-data --force {{ inventory_hostname }}
-          delegate_to: "{{ groups['master'][0] }}"
+          ansible.builtin.command: "kubectl drain --ignore-daemonsets --delete-emptydir-data --force {% raw %}{{ inventory_hostname }}{% endraw %}"
+          delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
           changed_when: false
 
         - name: Update all packages
@@ -60,17 +56,15 @@
             reboot_timeout: 3600
 
         - name: Uncordon node
-          ansible.builtin.command: |
-            kubectl uncordon {{ inventory_hostname }}
-          delegate_to: "{{ groups['master'][0] }}"
+          ansible.builtin.command: "kubectl uncordon {% raw %}{{ inventory_hostname }}{% endraw %}"
+          delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
           changed_when: false
 
         - name: Wait for node to uncordon
-          ansible.builtin.command: |
-            kubectl get node {{ inventory_hostname }} -o json
+          ansible.builtin.command: "kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
           register: wait_for_uncordon
           retries: 10
           delay: 10
-          delegate_to: "{{ groups['master'][0] }}"
+          delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
           changed_when: false
           until: not (kubectl_get_node['stdout'] | from_json).spec.unschedulable is defined

bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2

@@ -4,7 +4,7 @@
   block:
     - name: Cruft | Get list of custom mantifests
       ansible.builtin.find:
-        paths: "{{ k3s_server_manifests_dir }}"
+        paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}"
         file_type: file
         use_regex: true
         patterns: ["^custom-.*"]
@@ -12,9 +12,9 @@
 
     - name: Cruft | Delete custom mantifests
       ansible.builtin.file:
-        path: "{{ item.path }}"
+        path: "{% raw %}{{ item.path }}{% endraw %}"
         state: absent
-      loop: "{{ custom_manifest.files }}"
+      loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}"
 
     - name: Cruft | Get list of custom addons
       kubernetes.core.k8s_info:
@@ -25,8 +25,8 @@
     - name: Cruft | Delete addons
       kubernetes.core.k8s:
         kubeconfig: /etc/rancher/k3s/k3s.yaml
-        name: "{{ item.metadata.name }}"
+        name: "{% raw %}{{ item.metadata.name }}{% endraw %}"
         kind: Addon
         namespace: kube-system
         state: absent
-      loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}"
+      loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"

bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2

@@ -13,7 +13,7 @@
   when: k3s_primary_control_node
   ansible.builtin.fetch:
     src: /etc/rancher/k3s/k3s.yaml
-    dest: "{{ repository_path.stdout }}/kubeconfig"
+    dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
     flat: true
 
 - name: Update kubeconfig with the correct load balancer address
@@ -21,6 +21,6 @@
   become: false
   run_once: true
   ansible.builtin.replace:
-    path: "{{ repository_path.stdout }}/kubeconfig"
+    path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
     regexp: https://127.0.0.1:6443
-    replace: "https://{{ k3s_registration_address }}:6443"
+    replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"

bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2

@@ -30,8 +30,8 @@ spec:
       enabled: false
     ipam:
       mode: kubernetes
-    ipv4NativeRoutingCIDR: "{{ k3s_server['cluster-cidr'] }}"
-    k8sServiceHost: "{{ kube_vip_addr }}"
+    ipv4NativeRoutingCIDR: "{% raw %}{{ k3s_server['cluster-cidr'] }}{% endraw %}"
+    k8sServiceHost: "{% raw %}{{ kube_vip_addr }}{% endraw %}"
     k8sServicePort: 6443
     kubeProxyReplacement: strict
     kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256

bootstrap/templates/ansible/playbooks/templates/custom-cilium-l2.yaml.j2.j2

@@ -19,4 +19,4 @@ metadata:
   name: pool
 spec:
   cidrs:
-    - cidr: "{{ node_cidr }}"
+    - cidr: "{% raw %}{{ node_cidr }}{% endraw %}"

bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2

@@ -19,7 +19,7 @@ spec:
     service:
       name: kube-dns
       # Choose the 10th IP address from the start of the service-cidr
-      clusterIP: {{ k3s_server['service-cidr'] | ansible.utils.nthhost(10) }}
+      clusterIP: "{% raw %}{{ k3s_server['service-cidr'] | ansible.utils.nthhost(10) }}{% endraw %}"
     serviceAccount:
       create: true
     deployment:

bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2

@@ -15,7 +15,7 @@ spec:
       args: ["manager"]
       env:
         - name: address
-          value: "{{ kube_vip_addr }}"
+          value: "{% raw %}{{ kube_vip_addr }}{% endraw %}"
         - name: vip_arp
           value: "true"
         - name: port