From e6fbc6e128164a78f82e0ef2ceb098ba7132474f Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Mon, 15 Jan 2024 00:03:41 -0500 Subject: [PATCH] feat: remove the need for raw jinja blocks (#1158) Signed-off-by: Devin Buhl --- .github/renovate.json5 | 3 - .github/workflows/e2e.yaml | 8 +- .taskfiles/Repo/Taskfile.yaml | 2 +- Taskfile.yaml | 14 +--- bootstrap/templates/.sops.yaml.j2 | 4 +- .../group_vars/kubernetes/main.yaml.j2 | 16 ++-- .../kubernetes/supplemental.yaml.j2 | 30 +++---- .../inventory/group_vars/master/main.yaml.j2 | 30 +++---- .../inventory/group_vars/worker/main.yaml.j2 | 14 ++-- .../templates/ansible/inventory/hosts.yaml.j2 | 40 ++++----- .../playbooks/cluster-installation.yaml.j2 | 10 +-- .../playbooks/cluster-kube-vip.yaml.j2 | 6 +- .../ansible/playbooks/cluster-nuke.yaml.j2 | 20 ++--- .../ansible/playbooks/cluster-prepare.yaml.j2 | 28 +++---- .../playbooks/cluster-rollout-update.yaml.j2 | 42 +++++----- .../ansible/playbooks/tasks/cilium.yaml.j2 | 4 +- .../ansible/playbooks/tasks/coredns.yaml.j2 | 4 +- .../ansible/playbooks/tasks/cruft.yaml.j2 | 14 ++-- .../playbooks/tasks/kubeconfig.yaml.j2 | 10 +-- .../custom-cilium-helmchart.yaml.j2.j2 | 22 ++--- .../custom-coredns-helmchart.yaml.j2.j2 | 6 +- .../templates/kube-vip-static-pod.yaml.j2.j2 | 6 +- bootstrap/templates/k0s-config.yaml.j2 | 84 +++++++++---------- .../cert-manager/app/prometheusrule.yaml.j2 | 8 +- .../cert-manager/issuers/secret.sops.yaml.j2 | 2 +- .../app/helmrelease.yaml.j2 | 4 +- .../app/kustomization.yaml.j2 | 4 +- .../app/secret.sops.yaml.j2 | 6 +- .../discord-template-notifier/ks.yaml.j2 | 4 +- .../default/homepage/app/configmap.yaml.j2 | 10 +-- .../default/homepage/app/helmrelease.yaml.j2 | 4 +- .../homepage/app/kustomization.yaml.j2 | 4 +- .../default/homepage/app/secret.sops.yaml.j2 | 12 +-- .../apps/default/homepage/ks.yaml.j2 | 4 +- .../apps/default/kustomization.yaml.j2 | 8 +- .../webhooks/github/secret.sops.yaml.j2 | 2 +- .../apps/flux-system/kustomization.yaml.j2 | 4 +- .../weave-gitops/app/helmrelease.yaml.j2 | 8 +- .../weave-gitops/app/kustomization.yaml.j2 | 4 +- .../weave-gitops/app/secret.sops.yaml.j2 | 6 +- .../apps/flux-system/weave-gitops/ks.yaml.j2 | 4 +- .../cilium/app/helmrelease.yaml.j2 | 22 ++--- .../cilium/app/kustomization.yaml.j2 | 4 +- .../coredns/app/helmrelease.yaml.j2 | 4 +- .../coredns/app/kustomization.yaml.j2 | 4 +- .../apps/kube-system/coredns/ks.yaml.j2 | 4 +- .../apps/kube-system/kustomization.yaml.j2 | 4 +- .../cloudflared/app/secret.sops.yaml.j2 | 8 +- .../echo-server/app/helmrelease.yaml.j2 | 6 +- .../external-dns/app/secret.sops.yaml.j2 | 2 +- .../k8s-gateway/app/helmrelease.yaml.j2 | 2 +- .../nginx/certificates/kustomization.yaml.j2 | 4 +- .../nginx/external/helmrelease.yaml.j2 | 8 +- .../nginx/internal/helmrelease.yaml.j2 | 8 +- .../grafana/app/helmrelease.yaml.j2 | 12 +-- .../grafana/app/kustomization.yaml.j2 | 4 +- .../grafana/app/secret.sops.yaml.j2 | 6 +- .../apps/observability/grafana/ks.yaml.j2 | 4 +- .../app/helmrelease.yaml.j2 | 36 ++++---- .../app/kustomization.yaml.j2 | 4 +- .../kube-prometheus-stack/ks.yaml.j2 | 4 +- .../app/helmrelease.yaml.j2 | 8 +- .../app/kustomization.yaml.j2 | 4 +- .../kubernetes-dashboard/app/rbac.yaml.j2 | 4 +- .../kubernetes-dashboard/ks.yaml.j2 | 4 +- .../apps/observability/kustomization.yaml.j2 | 12 +-- .../csi-driver-nfs/app/helmrelease.yaml.j2 | 4 +- .../csi-driver-nfs/app/kustomization.yaml.j2 | 4 +- .../csi-driver-nfs/app/storageclass.yaml.j2 | 14 ++-- .../apps/storage/csi-driver-nfs/ks.yaml.j2 | 4 +- .../apps/storage/kustomization.yaml.j2 | 8 +- .../storage/openebs/app/helmrelease.yaml.j2 | 2 +- .../storage/volsync/app/helmrelease.yaml.j2 | 4 +- .../storage/volsync/app/kustomization.yaml.j2 | 4 +- .../volsync/app/prometheusrule.yaml.j2 | 6 +- .../apps/storage/volsync/ks.yaml.j2 | 4 +- .../snapshot-controller/helmrelease.yaml.j2 | 4 +- .../snapshot-controller/kustomization.yaml.j2 | 4 +- .../apps/tools/kustomization.yaml.j2 | 4 +- .../tools/reloader/app/helmrelease.yaml.j2 | 2 +- .../app/helmrelease.yaml.j2 | 4 +- .../app/kustomization.yaml.j2 | 4 +- .../app/rbac.yaml.j2 | 4 +- .../system-upgrade-controller/ks.yaml.j2 | 4 +- .../plans/agent.yaml.j2 | 4 +- .../plans/kustomization.yaml.j2 | 4 +- .../plans/server.yaml.j2 | 4 +- .../kubernetes/flux/config/cluster.yaml.j2 | 12 +-- .../flux/vars/cluster-secrets.sops.yaml.j2 | 6 +- .../flux/vars/cluster-settings.yaml.j2 | 28 +++---- bootstrap/validate.yaml | 17 ---- makejinja.toml | 15 ++++ 92 files changed, 430 insertions(+), 441 deletions(-) create mode 100644 makejinja.toml diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 913c0f47..fb07c70c 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -22,14 +22,12 @@ }, "helm-values": { "fileMatch": [ - "(^|/)addons/.+\\.ya?ml(\\.j2)?(\\.j2)?$", "(^|/)ansible/.+\\.ya?ml(\\.j2)?(\\.j2)?$", "(^|/)kubernetes/.+\\.ya?ml(\\.j2)?(\\.j2)?$" ] }, "kubernetes": { "fileMatch": [ - "(^|/)addons/.+\\.ya?ml(\\.j2)?(\\.j2)?$", "(^|/)ansible/.+\\.ya?ml(\\.j2)?(\\.j2)?$", "(^|/)kubernetes/.+\\.ya?ml(\\.j2)?(\\.j2)?$" ] @@ -225,7 +223,6 @@ "description": "Process various other dependencies", "fileMatch": [ "(^|/).taskfiles/.+\\.ya?ml$", - "(^|/)addons/.+\\.ya?ml(\\.j2)?(\\.j2)?$", "(^|/)ansible/.+\\.ya?ml(\\.j2)?(\\.j2)?$", "(^|/)kubernetes/.+\\.ya?ml(\\.j2)?(\\.j2)?$", "(^|/)k0s-config.ya?ml(\\.j2)?(\\.j2)?$" diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 7451829a..e8bd93cb 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -11,8 +11,8 @@ concurrency: cancel-in-progress: true jobs: - e2e-yay: - name: e2e-yay + yay: + name: yay runs-on: ubuntu-latest container: image: greyltc/archlinux-aur:yay @@ -30,8 +30,8 @@ jobs: go-task workstation:yay ' - e2e-configure: - name: e2e-configure + configure: + name: configure runs-on: ubuntu-latest strategy: fail-fast: false diff --git a/.taskfiles/Repo/Taskfile.yaml b/.taskfiles/Repo/Taskfile.yaml index 53b47411..03777618 100644 --- a/.taskfiles/Repo/Taskfile.yaml +++ b/.taskfiles/Repo/Taskfile.yaml @@ -13,9 +13,9 @@ tasks: # Move bootstrap directory to gitignored directory - mkdir -p {{.ROOT_DIR}}/.private - mv {{.BOOTSTRAP_DIR}} {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}} + - mv {{.ROOT_DIR}}/makejinja.toml {{.ROOT_DIR}}/.private/makejinja-{{now | date "150405"}}.toml # Update renovate.json5 - sed -i {{if eq OS "darwin"}}''{{end}} 's/(..\.j2)\?(..\.j2)\?//g' {{.ROOT_DIR}}/.github/renovate.json5 - - sed -i {{if eq OS "darwin"}}''{{end}} '/addons/d' {{.ROOT_DIR}}/.github/renovate.json5 preconditions: - { msg: "bootstrap dir not found", sh: "test -d {{.BOOTSTRAP_DIR}}" } - { msg: "renovate.json5 not found", sh: "test -f {{.ROOT_DIR}}/.github/renovate.json5" } diff --git a/Taskfile.yaml b/Taskfile.yaml index f9fbe138..8b13e1d3 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -65,15 +65,9 @@ tasks: internal: true cmds: - ./.venv/bin/makejinja - --input "{{.BOOTSTRAP_DIR}}/templates" - --output "{{.ROOT_DIR}}" - --data "{{.BOOTSTRAP_DIR}}/vars/config.yaml" - --data "{{.BOOTSTRAP_DIR}}/vars/addons.yaml" - --import-path "{{.BOOTSTRAP_DIR}}/scripts" - --loader "loader:Loader" - --jinja-suffix ".j2" --quiet --force - find {{.ANSIBLE_DIR}} {{.KUBERNETES_DIR}} -type d -empty -delete preconditions: - - { msg: "addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" } - - { msg: "config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" } - - { msg: "loader file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/loader.py" } + - { msg: "bootstrap addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" } + - { msg: "bootstrap config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" } + - { msg: "makejinja loader file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/loader.py" } + - { msg: "makejinja config file not found", sh: "test -f {{.ROOT_DIR}}/makejinja.toml" } diff --git a/bootstrap/templates/.sops.yaml.j2 b/bootstrap/templates/.sops.yaml.j2 index 16a3a247..768c4b85 100644 --- a/bootstrap/templates/.sops.yaml.j2 +++ b/bootstrap/templates/.sops.yaml.j2 @@ -4,8 +4,8 @@ creation_rules: encrypted_regex: "^(data|stringData)$" key_groups: - age: - - "{{ bootstrap_age_public_key }}" + - "<< bootstrap_age_public_key >>" - path_regex: ansible/.*\.sops\.ya?ml key_groups: - age: - - "{{ bootstrap_age_public_key }}" + - "<< bootstrap_age_public_key >>" diff --git a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 index 0970907c..3ad4385b 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- # # Below vars are for the xanmanning.k3s role @@ -9,17 +9,17 @@ k3s_release_version: "v1.29.0+k3s1" k3s_install_hard_links: true k3s_become: true -{% if bootstrap_nodes.master | length > 1 %} +<% if bootstrap_nodes.master | length > 1 %> k3s_etcd_datastore: true -{% else %} +<% else %> k3s_etcd_datastore: false -{% endif %} -k3s_registration_address: "{% raw %}{{ kube_api_addr }}{% endraw %}" +<% endif %> +k3s_registration_address: "{{ kube_api_addr }}" # /var/lib/rancher/k3s/server/manifests k3s_server_manifests_templates: - custom-cilium-helmchart.yaml.j2 - custom-coredns-helmchart.yaml.j2 -{% if bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %} +<% if bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %> # /var/lib/rancher/k3s/server/manifests k3s_server_manifests_urls: - url: https://raw.githubusercontent.com/kube-vip/website/main/content/manifests/rbac.yaml @@ -27,5 +27,5 @@ k3s_server_manifests_urls: # /var/lib/rancher/k3s/agent/pod-manifests k3s_server_pod_manifests_templates: - kube-vip-static-pod.yaml.j2 -{% endif %} -{% endif %} +<% endif %> +<% endif %> diff --git a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2 index e793b75d..e5fc2134 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2 @@ -1,16 +1,16 @@ --- -timezone: "{{ bootstrap_timezone }}" -github_username: "{{ bootstrap_github_username }}" -coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}" -{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %} -kube_api_addr: "{{ bootstrap_nodes.master[0].address }}" -{% else %} -kube_api_addr: "{{ bootstrap_kube_api_addr }}" -{% endif %} -cluster_cidr: "{{ bootstrap_cluster_cidr.split(',')[0] }}" -service_cidr: "{{ bootstrap_service_cidr.split(',')[0] }}" -node_cidr: "{{ bootstrap_node_cidr }}" -{% if bootstrap_ipv6_enabled | default(false) %} -cluster_cidr_v6: "{{ bootstrap_cluster_cidr.split(',')[1] }}" -service_cidr_v6: "{{ bootstrap_service_cidr.split(',')[1] }}" -{% endif %} +timezone: "<< bootstrap_timezone >>" +github_username: "<< bootstrap_github_username >>" +coredns_addr: "<< bootstrap_service_cidr.split(',')[0] | nthhost(10) >>" +<% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %> +kube_api_addr: "<< bootstrap_nodes.master[0].address >>" +<% else %> +kube_api_addr: "<< bootstrap_kube_api_addr >>" +<% endif %> +cluster_cidr: "<< bootstrap_cluster_cidr.split(',')[0] >>" +service_cidr: "<< bootstrap_service_cidr.split(',')[0] >>" +node_cidr: "<< bootstrap_node_cidr >>" +<% if bootstrap_ipv6_enabled | default(false) %> +cluster_cidr_v6: "<< bootstrap_cluster_cidr.split(',')[1] >>" +service_cidr_v6: "<< bootstrap_service_cidr.split(',')[1] >>" +<% endif %> diff --git a/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 index 051427c2..2c067489 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 @@ -1,17 +1,17 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- # https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/ # https://github.com/PyratLabs/ansible-role-k3s k3s_control_node: true k3s_server: - {% if bootstrap_ipv6_enabled | default(false) %} - node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}" - {% else %} - node-ip: "{% raw %}{{ ansible_host }}{% endraw %}" - {% endif %} + <% if bootstrap_ipv6_enabled | default(false) %> + node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}" + <% else %> + node-ip: "{{ ansible_host }}" + <% endif %> tls-san: - - "{% raw %}{{ kube_api_addr }}{% endraw %}" + - "{{ kube_api_addr }}" docker: false flannel-backend: "none" # This needs to be in quotes disable: @@ -27,13 +27,13 @@ k3s_server: write-kubeconfig-mode: "644" pause-image: registry.k8s.io/pause:3.9 secrets-encryption: true - {% if bootstrap_ipv6_enabled | default(false) %} - cluster-cidr: "{% raw %}{{ cluster_cidr }},{{ cluster_cidr_v6 }}{% endraw %}" - service-cidr: "{% raw %}{{ service_cidr }},{{ service_cidr_v6 }}{% endraw %}" - {% else %} - cluster-cidr: "{% raw %}{{ cluster_cidr }}{% endraw %}" - service-cidr: "{% raw %}{{ service_cidr }}{% endraw %}" - {% endif %} + <% if bootstrap_ipv6_enabled | default(false) %> + cluster-cidr: "{{ cluster_cidr }},{{ cluster_cidr_v6 }}" + service-cidr: "{{ service_cidr }},{{ service_cidr_v6 }}" + <% else %> + cluster-cidr: "{{ cluster_cidr }}" + service-cidr: "{{ service_cidr }}" + <% endif %> etcd-expose-metrics: true # Required to monitor etcd with kube-prometheus-stack kube-controller-manager-arg: - "bind-address=0.0.0.0" # Required to monitor kube-controller-manager with kube-prometheus-stack @@ -45,4 +45,4 @@ k3s_server: kubelet-arg: - "image-gc-high-threshold=55" - "image-gc-low-threshold=50" -{% endif %} +<% endif %> diff --git a/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 index 6b3381a0..ea0a8b9c 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 @@ -1,18 +1,18 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- # https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/ # https://github.com/PyratLabs/ansible-role-k3s k3s_control_node: false k3s_agent: - {% if bootstrap_ipv6_enabled | default(false) %} - node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}" - {% else %} - node-ip: "{% raw %}{{ ansible_host }}{% endraw %}" - {% endif %} + <% if bootstrap_ipv6_enabled | default(false) %> + node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}" + <% else %> + node-ip: "{{ ansible_host }}" + <% endif %> pause-image: registry.k8s.io/pause:3.9 # TODO: Move these options to a kubelet config file kubelet-arg: - "image-gc-high-threshold=55" - "image-gc-low-threshold=50" -{% endif %} +<% endif %> diff --git a/bootstrap/templates/ansible/inventory/hosts.yaml.j2 b/bootstrap/templates/ansible/inventory/hosts.yaml.j2 index 2dec9f3e..db9b2e63 100644 --- a/bootstrap/templates/ansible/inventory/hosts.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/hosts.yaml.j2 @@ -3,25 +3,25 @@ kubernetes: children: master: hosts: - {% for item in bootstrap_nodes.master %} - {{ item.name }}: - ansible_user: {{ item.username }} - {% if item.external_address is defined %} - ansible_host: {{ item.external_address }} - {% else %} - ansible_host: {{ item.address }} - {% endif %} - {% endfor %} - {% if bootstrap_nodes.worker | default([]) | length > 0 %} + <% for item in bootstrap_nodes.master %> + << item.name >>: + ansible_user: << item.username >> + <% if item.external_address is defined %> + ansible_host: << item.external_address >> + <% else %> + ansible_host: << item.address >> + <% endif %> + <% endfor %> + <% if bootstrap_nodes.worker | default([]) | length > 0 %> worker: hosts: - {% for item in bootstrap_nodes.worker %} - {{ item.name }}: - ansible_user: {{ item.username }} - {% if item.external_address is defined %} - ansible_host: {{ item.external_address }} - {% else %} - ansible_host: {{ item.address }} - {% endif %} - {% endfor %} - {% endif %} + <% for item in bootstrap_nodes.worker %> + << item.name >>: + ansible_user: << item.username >> + <% if item.external_address is defined %> + ansible_host: << item.external_address >> + <% else %> + ansible_host: << item.address >> + <% endif %> + <% endfor %> + <% endif %> diff --git a/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 index fadf43d1..baeaf993 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- - name: Cluster Installation hosts: kubernetes @@ -39,9 +39,9 @@ or k3s_server_manifests_urls | length > 0) kubernetes.core.k8s_info: kubeconfig: /etc/rancher/k3s/k3s.yaml - kind: "{% raw %}{{ item.kind }}{% endraw %}" - name: "{% raw %}{{ item.name }}{% endraw %}" - namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}" + kind: "{{ item.kind }}" + name: "{{ item.name }}" + namespace: "{{ item.namespace | default('') }}" wait: true wait_sleep: 10 wait_timeout: 360 @@ -60,4 +60,4 @@ - name: Cruft when: k3s_primary_control_node ansible.builtin.include_tasks: tasks/cruft.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 index d32d67ec..cea5e4fc 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- - name: Cluster kube-vip hosts: master @@ -21,6 +21,6 @@ - name: Upgrade kube-vip ansible.builtin.template: src: templates/kube-vip-static-pod.yaml.j2 - dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml" + dest: "{{ k3s_server_pod_manifests_dir }}/kube-vip-static-pod.yaml" mode: preserve -{% endif %} +<% endif %> diff --git a/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 index 41ae74f6..cbabd4db 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 @@ -21,7 +21,7 @@ ansible.builtin.pause: seconds: 5 tasks: - {% if bootstrap_distribution == "k3s" %} + <% if bootstrap_distribution == "k3s" %> - name: Stop Kubernetes # noqa: ignore-errors ignore_errors: true block: @@ -31,24 +31,24 @@ public: true vars: k3s_state: stopped - {% endif %} + <% endif %> # https://github.com/k3s-io/docs/blob/main/docs/installation/network-options.md - name: Networking block: - name: Networking | Delete Cilium links ansible.builtin.command: - cmd: "ip link delete {% raw %}{{ item }}{% endraw %}" - removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}" + cmd: "ip link delete {{ item }}" + removes: "/sys/class/net/{{ item }}" loop: ["cilium_host", "cilium_net", "cilium_vxlan"] - name: Networking | Flush iptables ansible.builtin.iptables: - table: "{% raw %}{{ item }}{% endraw %}" + table: "{{ item }}" flush: true loop: ["filter", "nat", "mangle", "raw"] - name: Networking | Flush ip6tables ansible.builtin.iptables: - table: "{% raw %}{{ item }}{% endraw %}" + table: "{{ item }}" flush: true ip_version: ipv6 loop: ["filter", "nat", "mangle", "raw"] @@ -57,7 +57,7 @@ path: /etc/cni/net.d state: absent - {% if bootstrap_distribution == "k3s" %} + <% if bootstrap_distribution == "k3s" %> - name: Check to see if k3s-killall.sh exits ansible.builtin.stat: path: /usr/local/bin/k3s-killall.sh @@ -89,14 +89,14 @@ - k3s_install_hard_links - not ansible_check_mode ansible.builtin.file: - path: "{% raw %}{{ k3s_install_dir }}/{{ item }}{% endraw %}" + path: "{{ k3s_install_dir }}/{{ item }}" state: absent loop: ["kubectl", "crictl", "ctr"] - {% endif %} + <% endif %> - name: Remove local storage path ansible.builtin.file: - path: "{{ bootstrap_local_storage_path }}" + path: "<< bootstrap_local_storage_path >>" state: absent - name: Reboot diff --git a/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 index d221fc1d..a076d696 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 @@ -15,7 +15,7 @@ block: - name: Locale | Set timezone community.general.timezone: - name: "{% raw %}{{ timezone | default('Etc/UTC') }}{% endraw %}" + name: "{{ timezone | default('Etc/UTC') }}" - name: Packages block: @@ -31,14 +31,14 @@ block: - name: User Configuration | SSH keys ansible.posix.authorized_key: - user: "{% raw %}{{ ansible_user }}{% endraw %}" - key: "https://github.com/{% raw %}{{ github_username }}{% endraw %}.keys" + user: "{{ ansible_user }}" + key: "https://github.com/{{ github_username }}.keys" - name: User Configuration | Silence login ansible.builtin.file: - dest: "{% raw %}{{ '/home/' + ansible_user if ansible_user != 'root' else '/root' }}{% endraw %}/.hushlogin" + dest: "{{ '/home/' + ansible_user if ansible_user != 'root' else '/root' }}/.hushlogin" state: touch - owner: "{% raw %}{{ ansible_user }}{% endraw %}" - group: "{% raw %}{{ ansible_user }}{% endraw %}" + owner: "{{ ansible_user }}" + group: "{{ ansible_user }}" mode: "0644" modification_time: preserve access_time: preserve @@ -48,12 +48,12 @@ block: - name: Network Configuration | Set hostname ansible.builtin.hostname: - name: "{% raw %}{{ inventory_hostname }}{% endraw %}" + name: "{{ inventory_hostname }}" - name: Network Configuration | Update hosts ansible.builtin.copy: content: | 127.0.0.1 localhost - 127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %} + 127.0.1.1 {{ inventory_hostname }} # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback @@ -96,15 +96,15 @@ masked: true - name: System Configuration | Disable swap ansible.posix.mount: - name: "{% raw %}{{ item }}{% endraw %}" + name: "{{ item }}" fstype: swap state: absent loop: ["none", "swap"] - name: System Configuration | Create Kernel modules ansible.builtin.copy: - dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf" + dest: "/etc/modules-load.d/{{ item }}.conf" mode: "0644" - content: "{% raw %}{{ item }}{% endraw %}" + content: "{{ item }}" loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"] register: modules_status - name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler @@ -114,11 +114,11 @@ state: restarted - name: System Configuration | Sysctl ansible.posix.sysctl: - name: "{% raw %}{{ item.key }}{% endraw %}" - value: "{% raw %}{{ item.value }}{% endraw %}" + name: "{{ item.key }}" + value: "{{ item.value }}" sysctl_file: /etc/sysctl.d/99-kubernetes.conf reload: true - with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}" + with_dict: "{{ sysctl_config }}" vars: sysctl_config: fs.inotify.max_queued_events: 65536 diff --git a/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 index 727a5ed7..55818aea 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 @@ -12,13 +12,13 @@ seconds: 5 tasks: - name: Details - {% if bootstrap_distribution == 'k3s' %} - ansible.builtin.command: "k3s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json" - {% elif bootstrap_distribution == 'k0s' %} - ansible.builtin.command: "k0s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json" - {% endif %} + <% if bootstrap_distribution == 'k3s' %> + ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json" + <% elif bootstrap_distribution == 'k0s' %> + ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json" + <% endif %> register: kubectl_get_node - delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}" + delegate_to: "{{ groups['master'][0] }}" failed_when: false changed_when: false @@ -31,23 +31,23 @@ block: - name: Cordon kubernetes.core.k8s_drain: - name: "{% raw %}{{ inventory_hostname }}{% endraw %}" - {% if bootstrap_distribution == 'k3s' %} + name: "{{ inventory_hostname }}" + <% if bootstrap_distribution == 'k3s' %> kubeconfig: /etc/rancher/k3s/k3s.yaml - {% elif bootstrap_distribution == 'k0s' %} + <% elif bootstrap_distribution == 'k0s' %> kubeconfig: /var/lib/k0s/pki/admin.conf - {% endif %} + <% endif %> state: cordon - delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}" + delegate_to: "{{ groups['master'][0] }}" - name: Drain kubernetes.core.k8s_drain: - name: "{% raw %}{{ inventory_hostname }}{% endraw %}" - {% if bootstrap_distribution == 'k3s' %} + name: "{{ inventory_hostname }}" + <% if bootstrap_distribution == 'k3s' %> kubeconfig: /etc/rancher/k3s/k3s.yaml - {% elif bootstrap_distribution == 'k0s' %} + <% elif bootstrap_distribution == 'k0s' %> kubeconfig: /var/lib/k0s/pki/admin.conf - {% endif %} + <% endif %> state: drain delete_options: delete_emptydir_data: true @@ -57,7 +57,7 @@ pod_selectors: # Rook Ceph - app!=rook-ceph-osd - delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}" + delegate_to: "{{ groups['master'][0] }}" - name: Update ansible.builtin.apt: @@ -78,11 +78,11 @@ - name: Uncordon kubernetes.core.k8s_drain: - name: "{% raw %}{{ inventory_hostname }}{% endraw %}" - {% if bootstrap_distribution == 'k3s' %} + name: "{{ inventory_hostname }}" + <% if bootstrap_distribution == 'k3s' %> kubeconfig: /etc/rancher/k3s/k3s.yaml - {% elif bootstrap_distribution == 'k0s' %} + <% elif bootstrap_distribution == 'k0s' %> kubeconfig: /var/lib/k0s/pki/admin.conf - {% endif %} + <% endif %> state: uncordon - delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}" + delegate_to: "{{ groups['master'][0] }}" diff --git a/bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2 index 8aab1f2a..45273d2d 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- - name: Cilium block: @@ -55,4 +55,4 @@ definition: metadata: finalizers: [] -{% endif %} +<% endif %> diff --git a/bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2 index 1ea755c2..34e65530 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- - name: Coredns block: @@ -55,4 +55,4 @@ definition: metadata: finalizers: [] -{% endif %} +<% endif %> diff --git a/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 index 139c3728..2a3d9553 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 @@ -1,11 +1,11 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- # https://github.com/k3s-io/k3s/issues/1971 - name: Cruft block: - name: Cruft | Get list of custom manifests ansible.builtin.find: - paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}" + paths: "{{ k3s_server_manifests_dir }}" file_type: file use_regex: true patterns: ["^custom-.*"] @@ -13,9 +13,9 @@ - name: Cruft | Delete custom manifests ansible.builtin.file: - path: "{% raw %}{{ item.path }}{% endraw %}" + path: "{{ item.path }}" state: absent - loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}" + loop: "{{ custom_manifest.files }}" - name: Cruft | Get list of custom addons kubernetes.core.k8s_info: @@ -26,9 +26,9 @@ - name: Cruft | Delete addons kubernetes.core.k8s: kubeconfig: /etc/rancher/k3s/k3s.yaml - name: "{% raw %}{{ item.metadata.name }}{% endraw %}" + name: "{{ item.metadata.name }}" kind: Addon namespace: kube-system state: absent - loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}" -{% endif %} + loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}" +<% endif %> diff --git a/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 index f3671dc6..b5b98f46 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- - name: Get absolute path to this Git repository # noqa: command-instead-of-module ansible.builtin.command: git rev-parse --show-toplevel @@ -14,7 +14,7 @@ when: k3s_primary_control_node ansible.builtin.fetch: src: /etc/rancher/k3s/k3s.yaml - dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig" + dest: "{{ repository_path.stdout }}/kubeconfig" flat: true - name: Update kubeconfig with the correct load balancer address @@ -22,7 +22,7 @@ become: false run_once: true ansible.builtin.replace: - path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig" + path: "{{ repository_path.stdout }}/kubeconfig" regexp: https://127.0.0.1:6443 - replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443" -{% endif %} + replace: "https://{{ k3s_registration_address }}:6443" +<% endif %> diff --git a/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 b/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 index dab332e1..9457c61a 100644 --- a/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- # https://docs.k3s.io/helm apiVersion: helm.cattle.io/v1 @@ -31,29 +31,29 @@ spec: enabled: false ipam: mode: kubernetes - ipv4NativeRoutingCIDR: "{% raw %}{{ cluster_cidr }}{% endraw %}" - {% if bootstrap_ipv6_enabled | default(false) %} - ipv6NativeRoutingCIDR: "{% raw %}{{ cluster_cidr_v6 }}{% endraw %}" + ipv4NativeRoutingCIDR: "{{ cluster_cidr }}" + <% if bootstrap_ipv6_enabled | default(false) %> + ipv6NativeRoutingCIDR: "{{ cluster_cidr_v6 }}" ipv6: enabled: true - {% endif %} - k8sServiceHost: "{% raw %}{{ kube_api_addr }}{% endraw %}" + <% endif %> + k8sServiceHost: "{{ kube_api_addr }}" k8sServicePort: 6443 kubeProxyReplacement: true kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 l2announcements: - {% if bootstrap_ipv6_enabled | default(false) %} + <% if bootstrap_ipv6_enabled | default(false) %> enabled: false - {% else %} + <% else %> enabled: true # https://github.com/cilium/cilium/issues/26586 leaseDuration: 120s leaseRenewDeadline: 60s leaseRetryPeriod: 1s - {% endif %} + <% endif %> loadBalancer: algorithm: maglev - mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }} + mode: << bootstrap_cilium_loadbalancer_mode | default('dsr', true) >> localRedirectPolicy: true operator: replicas: 1 @@ -62,4 +62,4 @@ spec: routingMode: native securityContext: privileged: true -{% endif %} +<% endif %> diff --git a/bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 b/bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 index b39e7473..2a0d6ee4 100644 --- a/bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' %} +<% if bootstrap_distribution == 'k3s' %> --- # https://docs.k3s.io/helm apiVersion: helm.cattle.io/v1 @@ -19,7 +19,7 @@ spec: k8sAppLabelOverride: kube-dns service: name: kube-dns - clusterIP: "{% raw %}{{ coredns_addr }}{% endraw %}" + clusterIP: "{{ coredns_addr }}" serviceAccount: create: true deployment: @@ -76,4 +76,4 @@ spec: labelSelector: matchLabels: app.kubernetes.io/instance: coredns -{% endif %} +<% endif %> diff --git a/bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 b/bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 index c009009d..d283db44 100644 --- a/bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k3s' and bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %} +<% if bootstrap_distribution == 'k3s' and bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %> --- apiVersion: v1 kind: Pod @@ -16,7 +16,7 @@ spec: args: ["manager"] env: - name: address - value: "{% raw %}{{ kube_api_addr }}{% endraw %}" + value: "{{ kube_api_addr }}" - name: vip_arp value: "true" - name: lb_enable @@ -58,4 +58,4 @@ spec: - name: kubeconfig hostPath: path: /etc/rancher/k3s/k3s.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/k0s-config.yaml.j2 b/bootstrap/templates/k0s-config.yaml.j2 index 17cf44bf..69219c9a 100644 --- a/bootstrap/templates/k0s-config.yaml.j2 +++ b/bootstrap/templates/k0s-config.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == 'k0s' %} +<% if bootstrap_distribution == 'k0s' %> --- apiVersion: k0sctl.k0sproject.io/v1beta1 kind: Cluster @@ -6,25 +6,25 @@ metadata: name: k0s-cluster spec: hosts: - {% for item in bootstrap_nodes.master %} - - role: {{ item.role | default('controller+worker') }} + <% for item in bootstrap_nodes.master %> + - role: << item.role | default('controller+worker') >> ssh: - address: {{ item.address }} - user: {{ item.username }} + address: << item.address >> + user: << item.username >> installFlags: - --disable-components=metrics-server - {% if item.role | default('') == 'controller+worker' %} + <% if item.role | default('') == 'controller+worker' %> - --no-taints - {% endif %} - {% endfor %} - {% if bootstrap_nodes.worker | default([]) | length > 0 %} - {% for item in bootstrap_nodes.worker %} + <% endif %> + <% endfor %> + <% if bootstrap_nodes.worker | default([]) | length > 0 %> + <% for item in bootstrap_nodes.worker %> - role: worker ssh: - address: {{ item.address }} - user: {{ item.username }} - {% endfor %} - {% endif %} + address: << item.address >> + user: << item.username >> + <% endfor %> + <% endif %> k0s: # renovate: datasource=github-releases depName=k0sproject/k0s version: "v1.28.5+k0s.0" @@ -43,18 +43,18 @@ spec: bind-address: "0.0.0.0" api: sans: - - {{ bootstrap_kube_api_addr }} - {% if bootstrap_kubeapi_hostname is defined %} - - {{ bootstrap_kubeapi_hostname }} - {% endif %} - {% for item in bootstrap_nodes.master %} - {% if item.address != bootstrap_kube_api_addr %} - - {{ item.address }} - {% endif %} - {% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %} - - {{ item.name }} - {% endif %} - {% endfor %} + - << bootstrap_kube_api_addr >> + <% if bootstrap_kubeapi_hostname is defined %> + - << bootstrap_kubeapi_hostname >> + <% endif %> + <% for item in bootstrap_nodes.master %> + <% if item.address != bootstrap_kube_api_addr %> + - << item.address >> + <% endif %> + <% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %> + - << item.name >> + <% endif %> + <% endfor %> extensions: helm: repositories: @@ -84,33 +84,33 @@ spec: enabled: false ipam: mode: kubernetes - ipv4NativeRoutingCIDR: "{{ bootstrap_cluster_cidr }}" - {% if bootstrap_ipv6_enabled | default(false) %} - ipv6NativeRoutingCIDR: "{{ bootstrap_cluster_cidr_v6 }}" + ipv4NativeRoutingCIDR: "<< bootstrap_cluster_cidr >>" + <% if bootstrap_ipv6_enabled | default(false) %> + ipv6NativeRoutingCIDR: "<< bootstrap_cluster_cidr_v6 >>" ipv6: enabled: true - {% endif %} - {% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %} - k8sServiceHost: {{ bootstrap_nodes.master[0].address }} - {% else %} - k8sServiceHost: {{ bootstrap_kube_api_addr }} - {% endif %} + <% endif %> + <% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %> + k8sServiceHost: << bootstrap_nodes.master[0].address >> + <% else %> + k8sServiceHost: << bootstrap_kube_api_addr >> + <% endif %> k8sServicePort: 6443 kubeProxyReplacement: true kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 l2announcements: - {% if bootstrap_ipv6_enabled | default(false) %} + <% if bootstrap_ipv6_enabled | default(false) %> enabled: false - {% else %} + <% else %> enabled: true # https://github.com/cilium/cilium/issues/26586 leaseDuration: 120s leaseRenewDeadline: 60s leaseRetryPeriod: 1s - {% endif %} + <% endif %> loadBalancer: algorithm: maglev - mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }} + mode: << bootstrap_cilium_loadbalancer_mode | default('dsr', true) >> localRedirectPolicy: true operator: replicas: 1 @@ -122,10 +122,10 @@ spec: network: kubeProxy: disabled: true - {% if bootstrap_nodes.master | length > 1 %} + <% if bootstrap_nodes.master | length > 1 %> nodeLocalLoadBalancing: enabled: true type: EnvoyProxy - {% endif %} + <% endif %> provider: custom -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2 index b96bf13f..d236526f 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2 @@ -28,11 +28,11 @@ spec: severity: warning annotations: description: > - The domain that this cert covers will be unavailable after {% raw %}{{ $value | humanizeDuration }}{% endraw %}. - Clients using endpoints that this cert protects will start to fail in {% raw %}{{ $value | humanizeDuration }}{% endraw %}. + The domain that this cert covers will be unavailable after {{ $value | humanizeDuration }}. + Clients using endpoints that this cert protects will start to fail in {{ $value | humanizeDuration }}. runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon summary: | - The cert {% raw %}{{ $labels.name }}{% endraw %} is {% raw %}{{ $value | humanizeDuration }}{% endraw %} from expiry, it should have renewed over a week ago. + The cert {{ $labels.name }} is {{ $value | humanizeDuration }} from expiry, it should have renewed over a week ago. - alert: CertManagerCertNotReady expr: | max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1) @@ -45,7 +45,7 @@ spec: 10m. If the cert is being renewed or there is another valid cert, the ingress controller _may_ be able to serve that instead. runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready - summary: "The cert {% raw %}{{ $labels.name }}{% endraw %} is not ready to serve traffic." + summary: "The cert {{ $labels.name }} is not ready to serve traffic." - alert: CertManagerHittingRateLimits expr: | sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) > 0 diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 index d1f6e1bf..d96a533a 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: cert-manager-secret stringData: - api-token: "{{ bootstrap_cloudflare_token }}" + api-token: "<< bootstrap_cloudflare_token >>" diff --git a/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2 index 08307551..73e914c7 100644 --- a/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if discord_template_notifier.enabled | default(false) %} +<% if discord_template_notifier.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -62,4 +62,4 @@ spec: - path: /data/config.toml subPath: config.toml readOnly: true -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2 index f348cf59..e4efe0b5 100644 --- a/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2 @@ -1,8 +1,8 @@ -{% if discord_template_notifier.enabled | default(false) %} +<% if discord_template_notifier.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./secret.sops.yaml - ./helmrelease.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2 index a00d9968..0783e9d1 100644 --- a/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2 @@ -1,4 +1,4 @@ -{% if discord_template_notifier.enabled | default(false) %} +<% if discord_template_notifier.enabled | default(false) %> --- apiVersion: v1 kind: Secret @@ -12,5 +12,5 @@ stringData: interval = "10m" retry_limit = 5 sink.type = "discord" - sink.url = "{{ discord_template_notifier.webhook_url }}" -{% endif %} + sink.url = "<< discord_template_notifier.webhook_url >>" +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2 index bf850a48..8441a5fe 100644 --- a/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if discord_template_notifier.enabled | default(false) %} +<% if discord_template_notifier.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -19,4 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2 index f6d813ee..ae1e29f8 100644 --- a/bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2 @@ -1,4 +1,4 @@ -{% if homepage.enabled | default(false) %} +<% if homepage.enabled | default(false) %> --- apiVersion: v1 kind: ConfigMap @@ -38,9 +38,9 @@ data: description: Cloudflared Tunnel widget: type: cloudflared - accountid: "{% raw %}{{HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID}}{% endraw %}" - tunnelid: "{% raw %}{{ HOMEPAGE_VAR_CLOUDFLARED_TUNNELID}}{% endraw %}" - key: "{% raw %}{{HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN}}{% endraw %}" + accountid: "{{HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID}}" + tunnelid: "{{HOMEPAGE_VAR_CLOUDFLARED_TUNNELID}}" + key: "{{HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN}}" settings.yaml: | title: Dashboard theme: dark @@ -76,4 +76,4 @@ data: dateStyle: long timeStyle: short hourCycle: h23 -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2 index 9a4c75fe..65ffdeeb 100644 --- a/bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if homepage.enabled | default(false) %} +<% if homepage.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -87,4 +87,4 @@ spec: path: /app/config/widgets.yaml serviceAccount: create: true -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2 index 1c79d4b3..3180438a 100644 --- a/bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2 @@ -1,4 +1,4 @@ -{% if homepage.enabled | default(false) %} +<% if homepage.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization @@ -6,4 +6,4 @@ resources: - ./configmap.yaml - ./helmrelease.yaml - ./secret.sops.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2 index 51a388fe..b8f3cb99 100644 --- a/bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2 @@ -1,13 +1,13 @@ -{% if homepage.enabled | default(false) %} +<% if homepage.enabled | default(false) %> --- apiVersion: v1 kind: Secret metadata: name: homepage-secret stringData: - HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID: "{{ bootstrap_cloudflare_account_tag }}" - HOMEPAGE_VAR_CLOUDFLARED_TUNNELID: "{{ bootstrap_cloudflare_tunnel_id }}" - HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "{{ bootstrap_cloudflare_token }}" + HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID: "<< bootstrap_cloudflare_account_tag >>" + HOMEPAGE_VAR_CLOUDFLARED_TUNNELID: "<< bootstrap_cloudflare_tunnel_id >>" + HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "<< bootstrap_cloudflare_token >>" HOMEPAGE_VAR_GRAFANA_USERNAME: admin - HOMEPAGE_VAR_GRAFANA_PASSWORD: "{{ grafana.password }}" -{% endif %} + HOMEPAGE_VAR_GRAFANA_PASSWORD: "<< grafana.password >>" +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2 index c6639208..7ca57641 100644 --- a/bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if homepage.enabled | default(false) %} +<% if homepage.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -19,4 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2 index aee3cfd6..60ddecae 100644 --- a/bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2 @@ -3,9 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./namespace.yaml - {% if homepage.enabled | default(false) %} + <% if homepage.enabled | default(false) %> - ./homepage/ks.yaml - {% endif %} - {% if discord_template_notifier.enabled | default(false) %} + <% endif %> + <% if discord_template_notifier.enabled | default(false) %> - ./discord-template-notifier/ks.yaml - {% endif %} + <% endif %> diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 index b4bb682c..5e4ff38e 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: github-webhook-token-secret stringData: - token: "{{ bootstrap_flux_github_webhook_token }}" + token: "<< bootstrap_flux_github_webhook_token >>" diff --git a/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 index 018b8887..ca027c72 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 @@ -4,6 +4,6 @@ kind: Kustomization resources: - ./namespace.yaml - ./addons/ks.yaml - {% if weave_gitops.enabled | default(false) %} + <% if weave_gitops.enabled | default(false) %> - ./weave-gitops/ks.yaml - {% endif %} + <% endif %> diff --git a/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2 index ccbd0665..817a9225 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if weave_gitops.enabled | default(false) %} +<% if weave_gitops.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -32,13 +32,13 @@ spec: ingress: enabled: true className: internal - {% if homepage.enabled | default(false) %} + <% if homepage.enabled | default(false) %> annotations: gethomepage.dev/enabled: "true" gethomepage.dev/group: Home gethomepage.dev/name: Weave-gitops gethomepage.dev/icon: flux-cd.png - {% endif %} + <% endif %> hosts: - host: &host "gitops.${SECRET_DOMAIN}" paths: @@ -56,4 +56,4 @@ spec: impersonationResourceNames: ["admin"] podAnnotations: secret.reloader.stakater.com/reload: cluster-user-auth -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2 index 9ea8bd8f..1ae0294e 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2 @@ -1,8 +1,8 @@ -{% if weave_gitops.enabled | default(false) %} +<% if weave_gitops.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./secret.sops.yaml - ./helmrelease.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2 index 8205ebcc..af38b4d8 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2 @@ -1,4 +1,4 @@ -{% if weave_gitops.enabled | default(false) %} +<% if weave_gitops.enabled | default(false) %> --- apiVersion: v1 kind: Secret @@ -7,5 +7,5 @@ metadata: type: Opaque stringData: username: admin - password: "{{ weave_gitops.password | encrypt }}" -{% endif %} + password: "<< weave_gitops.password | encrypt >>" +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2 index 1709f1c4..46432e24 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if weave_gitops.enabled | default(false) %} +<% if weave_gitops.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -19,4 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 index eb89e3ab..9cc9af16 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 @@ -34,11 +34,11 @@ spec: id: 1 containerRuntime: integration: containerd - {% if bootstrap_distribution == "k3s" %} + <% if bootstrap_distribution == "k3s" %> socketPath: /var/run/k3s/containerd/containerd.sock - {% else %} + <% else %> socketPath: /var/run/k0s/containerd.sock - {% endif %} + <% endif %> endpointRoutes: enabled: true hubble: @@ -70,13 +70,13 @@ spec: ingress: enabled: true className: internal - {% if homepage.enabled | default(false) %} + <% if homepage.enabled | default(false) %> annotations: gethomepage.dev/enabled: "true" gethomepage.dev/group: Network gethomepage.dev/name: Cilium gethomepage.dev/icon: cilium.png - {% endif %} + <% endif %> hosts: - "hubble.${SECRET_DOMAIN}" tls: @@ -85,28 +85,28 @@ spec: ipam: mode: kubernetes ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}" - {% if bootstrap_ipv6_enabled | default(false) %} + <% if bootstrap_ipv6_enabled | default(false) %> ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}" ipv6: enabled: true - {% endif %} + <% endif %> k8sServiceHost: "${KUBE_API_ADDR}" k8sServicePort: 6443 kubeProxyReplacement: true kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 l2announcements: - {% if bootstrap_ipv6_enabled | default(false) %} + <% if bootstrap_ipv6_enabled | default(false) %> enabled: false - {% else %} + <% else %> enabled: true # https://github.com/cilium/cilium/issues/26586 leaseDuration: 120s leaseRenewDeadline: 60s leaseRetryPeriod: 1s - {% endif %} + <% endif %> loadBalancer: algorithm: maglev - mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }} + mode: << bootstrap_cilium_loadbalancer_mode | default('dsr', true) >> localRedirectPolicy: true operator: replicas: 1 diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 index 66720237..f82da126 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - {% if not bootstrap_ipv6_enabled | default(false) %} + <% if not bootstrap_ipv6_enabled | default(false) %> - ./cilium-l2.yaml - {% endif %} + <% endif %> - ./helmrelease.yaml diff --git a/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 index c91a6580..3b80d306 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == "k3s" %} +<% if bootstrap_distribution == "k3s" %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -87,4 +87,4 @@ spec: labelSelector: matchLabels: app.kubernetes.io/instance: coredns -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 index 56987a5f..d394ad6e 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 @@ -1,7 +1,7 @@ -{% if bootstrap_distribution == "k3s" %} +<% if bootstrap_distribution == "k3s" %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./helmrelease.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2 index 52c45fda..0250a8d4 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == "k3s" %} +<% if bootstrap_distribution == "k3s" %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -19,4 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 index d62c0335..fafc6762 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 @@ -4,7 +4,7 @@ kind: Kustomization resources: - ./namespace.yaml - ./cilium/ks.yaml - {% if bootstrap_distribution == "k3s" %} + <% if bootstrap_distribution == "k3s" %> - ./coredns/ks.yaml - {% endif %} + <% endif %> - ./metrics-server/ks.yaml diff --git a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 index 3e7dc1ac..b9e3bb37 100644 --- a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 @@ -4,10 +4,10 @@ kind: Secret metadata: name: cloudflared-secret stringData: - TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}" + TUNNEL_ID: "<< bootstrap_cloudflare_tunnel_id >>" credentials.json: | { - "AccountTag": "{{ bootstrap_cloudflare_account_tag }}", - "TunnelSecret": "{{ bootstrap_cloudflare_tunnel_secret }}", - "TunnelID": "{{ bootstrap_cloudflare_tunnel_id }}" + "AccountTag": "<< bootstrap_cloudflare_account_tag >>", + "TunnelSecret": "<< bootstrap_cloudflare_tunnel_secret >>", + "TunnelID": "<< bootstrap_cloudflare_tunnel_id >>" } diff --git a/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 index 97d77e9b..d7086dda 100644 --- a/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 @@ -71,14 +71,14 @@ spec: className: external annotations: external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}" - {% if homepage.enabled | default(false) %} + <% if homepage.enabled | default(false) %> gethomepage.dev/enabled: "true" gethomepage.dev/group: Network gethomepage.dev/name: Echo Server gethomepage.dev/icon: mdi-video-input-antenna - {% endif %} + <% endif %> hosts: - - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}.${SECRET_DOMAIN}" + - host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}" paths: - path: / service: diff --git a/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 index 075967d4..c514d38a 100644 --- a/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: external-dns-secret stringData: - api-token: "{{ bootstrap_cloudflare_token }}" + api-token: "<< bootstrap_cloudflare_token >>" diff --git a/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 index 7373b409..c51c2b9f 100644 --- a/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 @@ -31,5 +31,5 @@ spec: type: LoadBalancer port: 53 annotations: - io.cilium/lb-ipam-ips: "{{ bootstrap_k8s_gateway_addr }}" + io.cilium/lb-ipam-ips: "<< bootstrap_k8s_gateway_addr >>" externalTrafficPolicy: Cluster diff --git a/bootstrap/templates/kubernetes/apps/network/nginx/certificates/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/nginx/certificates/kustomization.yaml.j2 index 59b9fa80..932e9d53 100644 --- a/bootstrap/templates/kubernetes/apps/network/nginx/certificates/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/nginx/certificates/kustomization.yaml.j2 @@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./staging.yaml - {% if bootstrap_acme_production_enabled | default(false) %} + <% if bootstrap_acme_production_enabled | default(false) %> - ./production.yaml - {% endif %} + <% endif %> diff --git a/bootstrap/templates/kubernetes/apps/network/nginx/external/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/nginx/external/helmrelease.yaml.j2 index 479bfb61..3ce74f77 100644 --- a/bootstrap/templates/kubernetes/apps/network/nginx/external/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/nginx/external/helmrelease.yaml.j2 @@ -33,7 +33,7 @@ spec: service: annotations: external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}" - io.cilium/lb-ipam-ips: "{{ bootstrap_external_ingress_addr }}" + io.cilium/lb-ipam-ips: "<< bootstrap_external_ingress_addr >>" externalTrafficPolicy: Cluster ingressClassResource: name: external @@ -71,11 +71,11 @@ spec: namespaceSelector: any: true extraArgs: - {% if bootstrap_acme_production_enabled | default(false) %} + <% if bootstrap_acme_production_enabled | default(false) %> default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" - {% else %} + <% else %> default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls" - {% endif %} + <% endif %> topologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname diff --git a/bootstrap/templates/kubernetes/apps/network/nginx/internal/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/nginx/internal/helmrelease.yaml.j2 index 79d5d1fe..a5806fd1 100644 --- a/bootstrap/templates/kubernetes/apps/network/nginx/internal/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/nginx/internal/helmrelease.yaml.j2 @@ -31,7 +31,7 @@ spec: service: annotations: external-dns.alpha.kubernetes.io/hostname: "internal.${SECRET_DOMAIN}" - io.cilium/lb-ipam-ips: "{{ bootstrap_internal_ingress_addr }}" + io.cilium/lb-ipam-ips: "<< bootstrap_internal_ingress_addr >>" externalTrafficPolicy: Cluster ingressClassResource: name: internal @@ -69,11 +69,11 @@ spec: namespaceSelector: any: true extraArgs: - {% if bootstrap_acme_production_enabled | default(false) %} + <% if bootstrap_acme_production_enabled | default(false) %> default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" - {% else %} + <% else %> default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls" - {% endif %} + <% endif %> topologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname diff --git a/bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2 index 36378f52..2571663c 100644 --- a/bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if grafana.enabled | default(false) %} +<% if grafana.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -160,7 +160,7 @@ spec: ingress: enabled: true ingressClassName: internal - {% if homepage.enabled | default(false) %} + <% if homepage.enabled | default(false) %> annotations: gethomepage.dev/enabled: "true" gethomepage.dev/icon: grafana.png @@ -168,9 +168,9 @@ spec: gethomepage.dev/group: Observability gethomepage.dev/widget.type: grafana gethomepage.dev/widget.url: http://grafana.observability - gethomepage.dev/widget.username: "{% raw %}{{`{{HOMEPAGE_VAR_GRAFANA_USERNAME}}`}}{% endraw %}" - gethomepage.dev/widget.password: "{% raw %}{{`{{HOMEPAGE_VAR_GRAFANA_PASSWORD}}`}}{% endraw %}" - {% endif %} + gethomepage.dev/widget.username: "{{`{{HOMEPAGE_VAR_GRAFANA_USERNAME}}`}}" + gethomepage.dev/widget.password: "{{`{{HOMEPAGE_VAR_GRAFANA_PASSWORD}}`}}" + <% endif %> hosts: - &host "grafana.${SECRET_DOMAIN}" tls: @@ -181,4 +181,4 @@ spec: storageClassName: openebs-hostpath testFramework: enabled: false -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2 index 5bfd1ad9..6451dee5 100644 --- a/bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2 @@ -1,8 +1,8 @@ -{% if grafana.enabled | default(false) %} +<% if grafana.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./secret.sops.yaml - ./helmrelease.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2 index 166df58f..1db1467e 100644 --- a/bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2 @@ -1,4 +1,4 @@ -{% if grafana.enabled | default(false) %} +<% if grafana.enabled | default(false) %> --- apiVersion: v1 kind: Secret @@ -6,5 +6,5 @@ metadata: name: grafana-admin-secret stringData: admin-user: admin - admin-password: "{{ grafana.password }}" -{% endif %} + admin-password: "<< grafana.password >>" +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2 index 1be75cc0..543b5a0a 100644 --- a/bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if grafana.enabled | default(false) %} +<% if grafana.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -19,4 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2 index 6fc9af8d..d1c3fcd2 100644 --- a/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if kube_prometheus_stack.enabled | default(false) %} +<% if kube_prometheus_stack.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -54,7 +54,7 @@ spec: enabled: true serviceMonitor: metricRelabelings: - {% if bootstrap_distribution == 'k3s' %} + <% if bootstrap_distribution == 'k3s' %> # Remove duplicate labels provided by k3s - action: keep sourceLabels: ["__name__"] @@ -62,7 +62,7 @@ spec: - action: replace sourceLabels: ["node"] targetLabel: instance - {% endif %} + <% endif %> # Drop high cardinality labels - action: labeldrop regex: (uid) @@ -75,12 +75,12 @@ spec: enabled: true serviceMonitor: metricRelabelings: - {% if bootstrap_distribution == 'k3s' %} + <% if bootstrap_distribution == 'k3s' %> # Remove duplicate labels provided by k3s - action: keep sourceLabels: ["__name__"] regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+) - {% endif %} + <% endif %> # Drop high cardinality labels - action: drop sourceLabels: ["__name__"] @@ -91,49 +91,49 @@ spec: kubeControllerManager: enabled: true endpoints: &endpoints - {% for item in bootstrap_nodes.master %} - - {{ item.address }} - {% endfor %} - {% if bootstrap_distribution == 'k3s' %} + <% for item in bootstrap_nodes.master %> + - << item.address >> + <% endfor %> + <% if bootstrap_distribution == 'k3s' %> serviceMonitor: metricRelabelings: # Remove duplicate labels provided by k3s - action: keep sourceLabels: ["__name__"] regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|attachdetach_controller|authenticated_user|authentication|cronjob_controller|disabled_metric|endpoint_slice|ephemeral_volume|garbagecollector_controller|get_token|go|hidden_metric|job_controller|kubernetes_build|kubernetes_feature|leader_election|node_collector|node_ipam|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|pv_collector|registered_metric|replicaset_controller|rest_client|retroactive_storageclass|root_ca|running_managed|scrape_duration|scrape_samples|scrape_series|service_controller|storage_count|storage_operation|ttl_after|volume_operation|workqueue)_(.+)" - {% endif %} + <% endif %> kubeEtcd: - {% if bootstrap_nodes.master | length > 1 %} + <% if bootstrap_nodes.master | length > 1 %> enabled: true - {% else %} + <% else %> enabled: false - {% endif %} + <% endif %> endpoints: *endpoints kubeScheduler: enabled: true endpoints: *endpoints - {% if bootstrap_distribution == 'k3s' %} + <% if bootstrap_distribution == 'k3s' %> serviceMonitor: metricRelabelings: # Remove duplicate labels provided by k3s - action: keep sourceLabels: ["__name__"] regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authenticated_user|authentication|disabled_metric|go|hidden_metric|kubernetes_build|kubernetes_feature|leader_election|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scheduler|scrape_duration|scrape_samples|scrape_series|workqueue)_(.+)" - {% endif %} + <% endif %> kubeProxy: enabled: false # Disabled due to eBPF prometheus: ingress: enabled: true ingressClassName: internal - {% if homepage.enabled | default(false) %} + <% if homepage.enabled | default(false) %> annotations: gethomepage.dev/enabled: "true" gethomepage.dev/icon: prometheus.png gethomepage.dev/name: Prometheus gethomepage.dev/group: Observability gethomepage.dev/widget.type: prometheus - {% endif %} + <% endif %> pathType: Prefix hosts: - "prometheus.${SECRET_DOMAIN}" @@ -164,4 +164,4 @@ spec: multicluster: etcd: enabled: true -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2 index b39665b5..c7d3ee50 100644 --- a/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2 @@ -1,7 +1,7 @@ -{% if kube_prometheus_stack.enabled | default(false) %} +<% if kube_prometheus_stack.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./helmrelease.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2 index 1115147f..c40a2171 100644 --- a/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if kube_prometheus_stack.enabled | default(false) %} +<% if kube_prometheus_stack.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -19,4 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2 index 64852bd6..a890ac3f 100644 --- a/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if kubernetes_dashboard.enabled | default(false) %} +<% if kubernetes_dashboard.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -32,13 +32,13 @@ spec: ingress: enabled: true className: internal - {% if homepage.enabled | default(false) %} + <% if homepage.enabled | default(false) %> annotations: gethomepage.dev/enabled: "true" gethomepage.dev/icon: kubernetes-dashboard.png gethomepage.dev/name: Kubernetes Dashboard gethomepage.dev/group: Observability - {% endif %} + <% endif %> hosts: - &host "kubernetes.${SECRET_DOMAIN}" tls: @@ -46,4 +46,4 @@ spec: - *host metricsScraper: enabled: true -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2 index d3f65a09..57770e6b 100644 --- a/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2 @@ -1,8 +1,8 @@ -{% if kubernetes_dashboard.enabled | default(false) %} +<% if kubernetes_dashboard.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./rbac.yaml - ./helmrelease.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2 index 61b2370c..ab40b77c 100644 --- a/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2 @@ -1,4 +1,4 @@ -{% if kubernetes_dashboard.enabled | default(false) %} +<% if kubernetes_dashboard.enabled | default(false) %> # For dashboard sign in token: # kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d --- @@ -38,4 +38,4 @@ subjects: - kind: ServiceAccount name: kubernetes-dashboard namespace: observability -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2 index fba05fc7..f1ea2606 100644 --- a/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if kubernetes_dashboard.enabled | default(false) %} +<% if kubernetes_dashboard.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -22,4 +22,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/observability/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kustomization.yaml.j2 index 23600267..272fbcaa 100644 --- a/bootstrap/templates/kubernetes/apps/observability/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kustomization.yaml.j2 @@ -3,12 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./namespace.yaml - {% if grafana.enabled | default(false) %} + <% if grafana.enabled | default(false) %> - ./grafana/ks.yaml - {% endif %} - {% if kube_prometheus_stack.enabled | default(false) %} + <% endif %> + <% if kube_prometheus_stack.enabled | default(false) %> - ./kube-prometheus-stack/ks.yaml - {% endif %} - {% if kubernetes_dashboard.enabled | default(false) %} + <% endif %> + <% if kubernetes_dashboard.enabled | default(false) %> - ./kubernetes-dashboard/ks.yaml - {% endif %} + <% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2 index 07ef8a41..9d718a2a 100644 --- a/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if csi_driver_nfs.enabled | default(false) %} +<% if csi_driver_nfs.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -27,4 +27,4 @@ spec: values: externalSnapshotter: enabled: false -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2 index cfd3c552..b8fa4341 100644 --- a/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2 @@ -1,8 +1,8 @@ -{% if csi_driver_nfs.enabled | default(false) %} +<% if csi_driver_nfs.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./helmrelease.yaml - ./storageclass.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2 index ffa9b1ab..1db3c468 100644 --- a/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2 @@ -1,16 +1,16 @@ -{% if csi_driver_nfs.enabled | default(false) %} -{% for item in csi_driver_nfs.storage_class %} +<% if csi_driver_nfs.enabled | default(false) %> +<% for item in csi_driver_nfs.storage_class %> --- apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: {{ item.name }} + name: << item.name >> provisioner: nfs.csi.k8s.io parameters: - server: {{ item.server }} - share: {{ item.share }} + server: << item.server >> + share: << item.share >> reclaimPolicy: Delete volumeBindingMode: Immediate mountOptions: ["hard", "noatime"] -{% endfor %} -{% endif %} +<% endfor %> +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2 index 521ff4bb..f4993f4c 100644 --- a/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if csi_driver_nfs.enabled | default(false) %} +<% if csi_driver_nfs.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -19,4 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2 index 821b1a39..59ba900f 100644 --- a/bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2 @@ -4,9 +4,9 @@ kind: Kustomization resources: - ./namespace.yaml - ./openebs/ks.yaml - {% if volsync.enabled | default(false) %} + <% if volsync.enabled | default(false) %> - ./volsync/ks.yaml - {% endif %} - {% if csi_driver_nfs.enabled | default(false) %} + <% endif %> + <% if csi_driver_nfs.enabled | default(false) %> - ./csi-driver-nfs/ks.yaml - {% endif %} + <% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/openebs/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/openebs/app/helmrelease.yaml.j2 index a0406137..36db44ea 100644 --- a/bootstrap/templates/kubernetes/apps/storage/openebs/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/openebs/app/helmrelease.yaml.j2 @@ -29,5 +29,5 @@ spec: enabled: true name: openebs-hostpath isDefaultClass: false - basePath: "{{ bootstrap_local_storage_path }}" + basePath: "<< bootstrap_local_storage_path >>" diff --git a/bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2 index 43f47c33..88630c36 100644 --- a/bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if volsync.enabled | default(false) %} +<% if volsync.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -41,4 +41,4 @@ spec: tag: *tag metrics: disableAuth: true -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2 index a707abb9..f1930109 100644 --- a/bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2 @@ -1,8 +1,8 @@ -{% if volsync.enabled | default(false) %} +<% if volsync.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./helmrelease.yaml - ./prometheusrule.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2 index f3821a78..e91aac0c 100644 --- a/bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2 @@ -1,4 +1,4 @@ -{% if volsync.enabled | default(false) %} +<% if volsync.enabled | default(false) %> --- apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule @@ -17,9 +17,9 @@ spec: severity: critical - alert: VolSyncVolumeOutOfSync annotations: - summary: "{% raw %}{{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume is out of sync.{% endraw %}" + summary: "{{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume is out of sync." expr: volsync_volume_out_of_sync == 1 for: 15m labels: severity: critical -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2 index e6f5cce6..87c89fc8 100644 --- a/bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if volsync.enabled | default(false) %} +<% if volsync.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -39,4 +39,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2 index f5ee82db..7895f9ba 100644 --- a/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if volsync.enabled | default(false) %} +<% if volsync.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -32,4 +32,4 @@ spec: create: true webhook: enabled: false -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2 index b98d2ab2..50701642 100644 --- a/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2 @@ -1,7 +1,7 @@ -{% if volsync.enabled | default(false) %} +<% if volsync.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./helmrelease.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/tools/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/kustomization.yaml.j2 index ac84e0b3..a1ae5e49 100644 --- a/bootstrap/templates/kubernetes/apps/tools/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/kustomization.yaml.j2 @@ -5,6 +5,6 @@ resources: - ./namespace.yaml - ./descheduler/ks.yaml - ./reloader/ks.yaml - {% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} + <% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %> - ./system-upgrade-controller/ks.yaml - {% endif %} + <% endif %> diff --git a/bootstrap/templates/kubernetes/apps/tools/reloader/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/reloader/app/helmrelease.yaml.j2 index 76e9433a..8f2b7d60 100644 --- a/bootstrap/templates/kubernetes/apps/tools/reloader/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/reloader/app/helmrelease.yaml.j2 @@ -29,4 +29,4 @@ spec: readOnlyRootFileSystem: true podMonitor: enabled: true - namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}" + namespace: "{{ .Release.Namespace }}" diff --git a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2 index 151ed1e5..6b34a820 100644 --- a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} +<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %> --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -103,4 +103,4 @@ spec: globalMounts: - path: /etc/ca-certificates readOnly: true -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2 index fb64b7fa..69cd3d3c 100644 --- a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} +<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization @@ -7,4 +7,4 @@ resources: - https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.2/crd.yaml - helmrelease.yaml - rbac.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2 index c3cc284f..7db2bca3 100644 --- a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} +<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %> --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -12,4 +12,4 @@ subjects: - kind: ServiceAccount name: system-upgrade namespace: tools -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2 index c6887d83..27c05c96 100644 --- a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} +<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %> --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -41,4 +41,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2 index 22ba86b9..f916dcc7 100644 --- a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} +<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %> --- apiVersion: upgrade.cattle.io/v1 kind: Plan @@ -17,4 +17,4 @@ spec: args: ["prepare", "server"] upgrade: image: rancher/k3s-upgrade -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2 index 6a9bfce9..82cc78d2 100644 --- a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2 @@ -1,8 +1,8 @@ -{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} +<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %> --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./server.yaml - ./agent.yaml -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2 index 8963956f..4c788a31 100644 --- a/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2 @@ -1,4 +1,4 @@ -{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} +<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %> --- apiVersion: upgrade.cattle.io/v1 kind: Plan @@ -22,4 +22,4 @@ spec: - {key: CriticalAddonsOnly, operator: Exists} upgrade: image: rancher/k3s-upgrade -{% endif %} +<% endif %> diff --git a/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 b/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 index 7b299b48..dd54cb4b 100644 --- a/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 @@ -7,14 +7,14 @@ metadata: spec: interval: 30m ref: - branch: {{ bootstrap_github_repository_branch | default('main', true) }} - {% if bootstrap_private_github_repo | default(false) %} + branch: << bootstrap_github_repository_branch | default('main', true) >> + <% if bootstrap_private_github_repo | default(false) %> secretRef: name: github-deploy-key - url: "ssh://github.com/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}" - {% else %} - url: "https://github.com/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}.git" - {% endif %} + url: "ssh://github.com/<< bootstrap_github_username >>/<< bootstrap_github_repository_name >>" + <% else %> + url: "https://github.com/<< bootstrap_github_username >>/<< bootstrap_github_repository_name >>.git" + <% endif %> ignore: | # exclude all /* diff --git a/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 b/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 index 54f10d93..aed2b963 100644 --- a/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 @@ -5,6 +5,6 @@ metadata: name: cluster-secrets namespace: flux-system stringData: - SECRET_DOMAIN: "{{ bootstrap_cloudflare_domain }}" - SECRET_ACME_EMAIL: "{{ bootstrap_acme_email }}" - SECRET_CLOUDFLARE_TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}" + SECRET_DOMAIN: "<< bootstrap_cloudflare_domain >>" + SECRET_ACME_EMAIL: "<< bootstrap_acme_email >>" + SECRET_CLOUDFLARE_TUNNEL_ID: "<< bootstrap_cloudflare_tunnel_id >>" diff --git a/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 b/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 index d9f26da9..03663693 100644 --- a/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 @@ -5,17 +5,17 @@ metadata: name: cluster-settings namespace: flux-system data: - TIMEZONE: "{{ bootstrap_timezone }}" - COREDNS_ADDR: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}" - {% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %} - KUBE_API_ADDR: "{{ bootstrap_nodes.master[0].address }}" - {% else %} - KUBE_API_ADDR: "{{ bootstrap_kube_api_addr }}" - {% endif %} - CLUSTER_CIDR: "{{ bootstrap_cluster_cidr.split(',')[0] }}" - SERVICE_CIDR: "{{ bootstrap_service_cidr.split(',')[0] }}" - NODE_CIDR: "{{ bootstrap_node_cidr }}" - {% if bootstrap_ipv6_enabled | default(false) %} - CLUSTER_CIDR_V6: "{{ bootstrap_cluster_cidr.split(',')[1] }}" - SERVICE_CIDR_V6: "{{ bootstrap_service_cidr.split(',')[1] }}" - {% endif %} + TIMEZONE: "<< bootstrap_timezone >>" + COREDNS_ADDR: "<< bootstrap_service_cidr.split(',')[0] | nthhost(10) >>" + <% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %> + KUBE_API_ADDR: "<< bootstrap_nodes.master[0].address >>" + <% else %> + KUBE_API_ADDR: "<< bootstrap_kube_api_addr >>" + <% endif %> + CLUSTER_CIDR: "<< bootstrap_cluster_cidr.split(',')[0] >>" + SERVICE_CIDR: "<< bootstrap_service_cidr.split(',')[0] >>" + NODE_CIDR: "<< bootstrap_node_cidr >>" + <% if bootstrap_ipv6_enabled | default(false) %> + CLUSTER_CIDR_V6: "<< bootstrap_cluster_cidr.split(',')[1] >>" + SERVICE_CIDR_V6: "<< bootstrap_service_cidr.split(',')[1] >>" + <% endif %> diff --git a/bootstrap/validate.yaml b/bootstrap/validate.yaml index f0627c9d..c5929524 100644 --- a/bootstrap/validate.yaml +++ b/bootstrap/validate.yaml @@ -26,20 +26,3 @@ - name: Verify configuration ansible.builtin.include_tasks: tasks/validation/main.yaml - - # - name: Template Sops configuration - # ansible.builtin.include_tasks: tasks/sops/main.yaml - - # - name: Template k0s configuration - # when: bootstrap_distribution == "k0s" - # ansible.builtin.include_tasks: tasks/k0s/main.yaml - - # - name: Template Ansible configuration - # when: bootstrap_distribution == "k0s" or bootstrap_distribution == "k3s" - # ansible.builtin.include_tasks: tasks/ansible/main.yaml - - # - name: Template Kubernetes configuration - # ansible.builtin.include_tasks: tasks/kubernetes/main.yaml - - # - name: Template Kubernetes addon configuration - # ansible.builtin.include_tasks: tasks/addons/main.yaml diff --git a/makejinja.toml b/makejinja.toml new file mode 100644 index 00000000..ee69165e --- /dev/null +++ b/makejinja.toml @@ -0,0 +1,15 @@ +[makejinja] +inputs = ["./bootstrap/templates"] +output = "./" +data = ["./bootstrap/vars/addons.yaml", "./bootstrap/vars/config.yaml"] +import_paths = ["./bootstrap/scripts"] +loaders = ["loader:Loader"] +jinja_suffix = ".j2" + +[makejinja.delimiter] +block_start = "<%" +block_end = "%>" +comment_start = "<#" +comment_end = "#>" +variable_start = "<<" +variable_end = ">>"