fix: annotations not rendering correctly and add kubeconform integration

Signed-off-by: Devin Buhl <devin@buhl.casa>

.taskfiles/BrewTasks.yaml

@@ -22,6 +22,7 @@ tasks:
         jq
         k0sproject/tap/k0sctl
         k9s
+        kubeconform
         kubernetes-cli
         kustomize
         sops

.taskfiles/RepoTasks.yaml

@@ -8,23 +8,23 @@ tasks:
     desc: Clean files and directories no longer needed after cluster bootstrap
     cmds:
       # Move bootstrap directory to gitignored directory
-      - mkdir -p {{.ROOT}}/.private
+      - mkdir -p {{.ROOT_DIR}}/.private
-      - mv {{.ROOT}}/bootstrap {{.ROOT}}/.private
+      - mv {{.ROOT_DIR}}/bootstrap {{.ROOT_DIR}}/.private
       # Update renovate.json5
-      - sed -i '' 's/(..\.j2)\?(..\.j2)\?//g' {{.ROOT}}/.github/renovate.json5
+      - sed -i '' 's/(..\.j2)\?(..\.j2)\?//g' {{.ROOT_DIR}}/.github/renovate.json5
-      - sed -i '' 's/addons/d' {{.ROOT}}/.github/renovate.json5
+      - sed -i '' 's/addons/d' {{.ROOT_DIR}}/.github/renovate.json5
     preconditions:
-      - { msg: "bootstrap dir not found",  sh: "test -d {{.ROOT}}/bootstrap" }
+      - { msg: "bootstrap dir not found",  sh: "test -d {{.ROOT_DIR}}/bootstrap" }
       - { msg: "renovate.json5 not found", sh: "test -f {{.ROOT_DIR}}/.github/renovate.json5" }
 
   reset:
     desc: Remove templated configuration files
     prompt: Remove templated configuration files... continue?
     cmds:
-      - rm -rf {{.ROOT}}/.sops.yaml
+      - rm -rf {{.ROOT_DIR}}/.sops.yaml
-      - rm -rf {{.ROOT}}/k0s-config.yaml
+      - rm -rf {{.ROOT_DIR}}/k0s-config.yaml
-      - rm -rf {{.ROOT}}/ansible
+      - rm -rf {{.ROOT_DIR}}/ansible
-      - rm -rf {{.ROOT}}/kubernetes
+      - rm -rf {{.ROOT_DIR}}/kubernetes
 
   reset-repo:
     desc: Set repo back to HEAD

README.md

@@ -164,7 +164,7 @@ Once you have installed Debian on your nodes, there are six stages to getting a
     task ansible:deps
     ```
 
-4. Install the required tools: [age](https://github.com/FiloSottile/age), [flux](https://toolkit.fluxcd.io/), [cloudflared](https://github.com/cloudflare/cloudflared), [kubectl](https://kubernetes.io/docs/tasks/tools/), [sops](https://github.com/getsops/sops)
+4. Install the required tools: [age](https://github.com/FiloSottile/age), [flux](https://toolkit.fluxcd.io/), [cloudflared](https://github.com/cloudflare/cloudflared), [kubectl](https://kubernetes.io/docs/tasks/tools/), [sops](https://github.com/getsops/sops), [kubeconform](https://github.com/yannh/kubeconform)
 
    📍 _Not using brew? Make sure to look up how to install the latest version of each of these CLI tools yourself._
 

Taskfile.yaml

@@ -26,10 +26,9 @@ tasks:
 
   init:
     desc: Initialize configuration files
-    dir: "{{.BOOTSTRAP_DIR}}"
     cmds:
-      - cp -n vars/addons.sample.yaml vars/addons.yaml
+      - cp -n {{.BOOTSTRAP_DIR}}vars/addons.sample.yaml {{.BOOTSTRAP_DIR}}/vars/addons.yaml
-      - cp -n vars/config.sample.yaml vars/config.yaml
+      - cp -n {{.BOOTSTRAP_DIR}}/vars/config.sample.yaml {{.BOOTSTRAP_DIR}}/vars/config.yaml
       - cmd: echo "=== Configuration files copied ==="
         silent: true
       - cmd: echo "Proceed with updating the configuration files..."
@@ -47,6 +46,8 @@ tasks:
   configure:
     desc: Configure repository from Ansible vars
     prompt: Any conflicting config in the root kubernetes and ansible directories will be overwritten... continue?
-    cmd: ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/configure.yaml
+    cmds:
+      - ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/configure.yaml
+      - ./scripts/kubeconform.sh {{.KUBERNETES_DIR}}
     env:
       ANSIBLE_DISPLAY_SKIPPED_HOSTS: "false"

bootstrap/templates/addons/coredns/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/coredns/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: v1
 kind: Secret

bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/homepage/app/configmap.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: v1
 kind: ConfigMap

bootstrap/templates/addons/homepage/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/homepage/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/homepage/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: v1
 kind: Secret

bootstrap/templates/addons/homepage/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 # For dashboard sign in token:
 # kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
 ---

bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan

bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan

bootstrap/templates/addons/volsync/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/volsync/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/addons/volsync/snapshot-controller/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/volsync/snapshot-controller/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: v1
 kind: Secret

bootstrap/templates/addons/weave-gitops/ks.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2

@@ -1,4 +1,4 @@
-#jinja2: trim_blocks: True
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

scripts/kubeconform.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -o errexit
+
+KUBERNETES_DIR=$1
+KUBE_VERSION="${2:-1.29.0}"
+
+[[ -z "${KUBERNETES_DIR}" ]] && echo "Kubernetes location not specified" && exit 1
+
+kustomize_args=("--load-restrictor=LoadRestrictionsNone")
+kustomize_config="kustomization.yaml"
+kubeconform_args=(
+    "-strict"
+    "-ignore-missing-schemas"
+    "-kubernetes-version"
+    "${KUBE_VERSION}"
+    "-skip"
+    "Secret"
+    "-schema-location"
+    "default"
+    "-schema-location"
+    "https://kubernetes-schemas.pages.dev/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
+    "-verbose"
+)
+
+echo "=== Validating standalone manifests in ${KUBERNETES_DIR}/flux ==="
+find "${KUBERNETES_DIR}/flux" -maxdepth 1 -type f -name '*.yaml' -print0 | while IFS= read -r -d $'\0' file;
+  do
+    kubeconform "${kubeconform_args[@]}" "${file}"
+    if [[ ${PIPESTATUS[0]} != 0 ]]; then
+      exit 1
+    fi
+done
+
+echo "=== Validating kustomizations in ${KUBERNETES_DIR}/flux ==="
+find "${KUBERNETES_DIR}/flux" -type f -name $kustomize_config -print0 | while IFS= read -r -d $'\0' file;
+  do
+    echo "=== Validating kustomizations in ${file/%$kustomize_config} ==="
+    kustomize build "${file/%$kustomize_config}" "${kustomize_args[@]}" | \
+      kubeconform "${kubeconform_args[@]}"
+    if [[ ${PIPESTATUS[0]} != 0 ]]; then
+      exit 1
+    fi
+done
+
+echo "=== Validating kustomizations in ${KUBERNETES_DIR}/apps ==="
+find "${KUBERNETES_DIR}/apps" -type f -name $kustomize_config -print0 | while IFS= read -r -d $'\0' file;
+  do
+    echo "=== Validating kustomizations in ${file/%$kustomize_config} ==="
+    kustomize build "${file/%$kustomize_config}" "${kustomize_args[@]}" | \
+      kubeconform "${kubeconform_args[@]}"
+    if [[ ${PIPESTATUS[0]} != 0 ]]; then
+      exit 1
+    fi
+done