feat: update jinja delimiters back to default (#1269)

* feat: update jinja delimiters back to default Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: remove cert-manager promrules Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update talos csr approver Signed-off-by: Devin Buhl <devin@buhl.casa> --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-29 17:11:37 -05:00
1 parent 5fa8b9685a
commit df642e5425
@@ -3,4 +3,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./helmrelease.yaml
-  - ./prometheusrule.yaml
@@ -1,59 +0,0 @@
---
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: cert-manager.rules
-spec:
-  groups:
-    - name: cert-manager
-      rules:
-        - alert: CertManagerAbsent
-          expr: |
-            absent(up{job="cert-manager"})
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            description: >
-              New certificates will not be able to be minted, and existing ones can't be renewed until cert-manager is back.
-            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent
-            summary: "Cert Manager has dissapeared from Prometheus service discovery."
-    - name: certificates
-      rules:
-        - alert: CertManagerCertExpirySoon
-          expr: |
-            avg by (exported_namespace, namespace, name) (certmanager_certificate_expiration_timestamp_seconds - time()) < (21 * 24 * 3600)
-          for: 15m
-          labels:
-            severity: warning
-          annotations:
-            description: >
-              The domain that this cert covers will be unavailable after {{ $value | humanizeDuration }}.
-              Clients using endpoints that this cert protects will start to fail in {{ $value | humanizeDuration }}.
-            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
-            summary: |
-              The cert {{ $labels.name }} is {{ $value | humanizeDuration }} from expiry, it should have renewed over a week ago.
-        - alert: CertManagerCertNotReady
-          expr: |
-            max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            description: >
-              This certificate has not been ready to serve traffic for at least
-              10m. If the cert is being renewed or there is another valid cert, the ingress
-              controller _may_ be able to serve that instead.
-            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
-            summary: "The cert {{ $labels.name }} is not ready to serve traffic."
-        - alert: CertManagerHittingRateLimits
-          expr: |
-            sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) > 0
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            description: >
-              Depending on the rate limit, cert-manager may be unable to generate certificates for up to a week.
-            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits
-            summary: "Cert manager hitting LetsEncrypt rate limits."
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: cert-manager-secret
 stringData:
-  api-token: "#{ cloudflare.token }#"
+  api-token: "{{ cloudflare.token }}"
@@ -18,7 +18,7 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-#% if cloudflare.enabled %#
+{% if cloudflare.enabled %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -41,4 +41,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-#% endif %#
+{% endif %}
@@ -1,4 +1,4 @@
-#% if cloudflare.enabled %#
+{% if cloudflare.enabled %}
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -22,4 +22,4 @@ spec:
  tls:
    - hosts:
        - *host
-#% endif %#
+{% endif %}
@@ -3,7 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
-  #% if cloudflare.enabled %#
+  {% if cloudflare.enabled %}
  - ./ingress.yaml
-  #% endif %#
+  {% endif %}
  - ./receiver.yaml
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: github-webhook-token-secret
 stringData:
-  token: "#{ flux.github.webhook.token }#"
+  token: "{{ flux.github.webhook.token }}"
@@ -23,6 +23,6 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    #% filter indent(width=4, first=True) %#
-    #% include 'partials/cilium-values-full.partial.yaml.j2' %#
-    #% endfilter %#
+    {% filter indent(width=4, first=True) %}
+    {% include 'partials/cilium-values-full.partial.yaml.j2' %}
+    {% endfilter %}
@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  #% if not feature_gates.dual_stack_ipv4_first %#
+  {% if not feature_gates.dual_stack_ipv4_first %}
  - ./cilium-l2.yaml
-  #% endif %#
+  {% endif %}
  - ./helmrelease.yaml
@@ -23,6 +23,6 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    #% filter indent(width=4, first=True) %#
-    #% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
-    #% endfilter %#
+    {% filter indent(width=4, first=True) %}
+    {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
+    {% endfilter %}
@@ -4,11 +4,11 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cilium/ks.yaml
-  #% if distribution in ['talos'] %#
+  {% if distribution in ['talos'] %}
  - ./kubelet-csr-approver/ks.yaml
-  #% endif %#
+  {% endif %}
  - ./metrics-server/ks.yaml
-  #% if distribution in ['k0s', 'talos'] %#
+  {% if distribution in ['k0s', 'talos'] %}
  - ./spegel/ks.yaml
-  #% endif %#
+  {% endif %}
  - ./reloader/ks.yaml
@@ -24,13 +24,13 @@ spec:
    keepHistory: false
  values:
    spegel:
-      #% if distribution in ['k0s'] %#
+      {% if distribution in ['k0s'] %}
      containerdSock: /run/k0s/containerd.sock
      containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
-      #% elif distribution in ['talos'] %#
+      {% elif distribution in ['talos'] %}
      containerdSock: /run/containerd/containerd.sock
      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
-      #% endif %#
+      {% endif %}
    service:
      registry:
        hostPort: 29999
@@ -4,10 +4,10 @@ kind: Secret
 metadata:
  name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
+  TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
  credentials.json: |
    {
-      "AccountTag": "#{ cloudflare.tunnel.account_id }#",
-      "TunnelSecret": "#{ cloudflare.tunnel.secret }#",
-      "TunnelID": "#{ cloudflare.tunnel.id }#"
+      "AccountTag": "{{ cloudflare.tunnel.account_id }}",
+      "TunnelSecret": "{{ cloudflare.tunnel.secret }}",
+      "TunnelID": "{{ cloudflare.tunnel.id }}"
    }
@@ -70,7 +70,7 @@ spec:
        annotations:
          external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
        hosts:
-          - host: &host "{{ .Release.Name }}-external.${SECRET_DOMAIN}"
+          - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-external.${SECRET_DOMAIN}"
            paths:
              - path: /
                service:
@@ -83,7 +83,7 @@ spec:
        enabled: true
        className: internal
        hosts:
-          - host: &host "{{ .Release.Name }}-internal.${SECRET_DOMAIN}"
+          - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-internal.${SECRET_DOMAIN}"
            paths:
              - path: /
                service:
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: external-dns-secret
 stringData:
-  api-token: "#{ cloudflare.token }#"
+  api-token: "{{ cloudflare.token }}"
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./staging.yaml
-  #% if cloudflare.acme.production %#
+  {% if cloudflare.acme.production %}
  - ./production.yaml
-  #% endif %#
+  {% endif %}
@@ -32,7 +32,7 @@ spec:
      service:
        annotations:
          external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#"
+          io.cilium/lb-ipam-ips: "{{ cloudflare.tunnel.ingress_vip }}"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: external
@@ -64,11 +64,11 @@ spec:
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
      extraArgs:
-        #% if cloudflare.acme.production %#
+        {% if cloudflare.acme.production %}
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
-        #% else %#
+        {% else %}
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
-        #% endif %#
+        {% endif %}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
@@ -29,7 +29,7 @@ spec:
      replicaCount: 1
      service:
        annotations:
-          io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#"
+          io.cilium/lb-ipam-ips: "{{ cloudflare.ingress_vip }}"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: internal
@@ -61,11 +61,11 @@ spec:
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
      extraArgs:
-        #% if cloudflare.acme.production %#
+        {% if cloudflare.acme.production %}
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
-        #% else %#
+        {% else %}
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
-        #% endif %#
+        {% endif %}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
@@ -30,5 +30,5 @@ spec:
      type: LoadBalancer
      port: 53
      annotations:
-        io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#"
+        io.cilium/lb-ipam-ips: "{{ cloudflare.gateway_vip }}"
      externalTrafficPolicy: Cluster