feat: remove the need for raw jinja blocks (#1158)

Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-15 00:03:41 -05:00
1 parent f9481d6202
commit e6fbc6e128
@@ -28,11 +28,11 @@ spec:
            severity: warning
          annotations:
            description: >
-              The domain that this cert covers will be unavailable after {% raw %}{{ $value | humanizeDuration }}{% endraw %}.
-              Clients using endpoints that this cert protects will start to fail in {% raw %}{{ $value | humanizeDuration }}{% endraw %}.
+              The domain that this cert covers will be unavailable after {{ $value | humanizeDuration }}.
+              Clients using endpoints that this cert protects will start to fail in {{ $value | humanizeDuration }}.
            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
            summary: |
-              The cert {% raw %}{{ $labels.name }}{% endraw %} is {% raw %}{{ $value | humanizeDuration }}{% endraw %} from expiry, it should have renewed over a week ago.
+              The cert {{ $labels.name }} is {{ $value | humanizeDuration }} from expiry, it should have renewed over a week ago.
        - alert: CertManagerCertNotReady
          expr: |
            max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
@@ -45,7 +45,7 @@ spec:
              10m. If the cert is being renewed or there is another valid cert, the ingress
              controller _may_ be able to serve that instead.
            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
-            summary: "The cert {% raw %}{{ $labels.name }}{% endraw %} is not ready to serve traffic."
+            summary: "The cert {{ $labels.name }} is not ready to serve traffic."
        - alert: CertManagerHittingRateLimits
          expr: |
            sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) > 0
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: cert-manager-secret
 stringData:
-  api-token: "{{ bootstrap_cloudflare_token }}"
+  api-token: "<< bootstrap_cloudflare_token >>"
@@ -1,4 +1,4 @@
-{% if discord_template_notifier.enabled | default(false) %}
+<% if discord_template_notifier.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -62,4 +62,4 @@ spec:
          - path: /data/config.toml
            subPath: config.toml
            readOnly: true
-{% endif %}
+<% endif %>
@@ -1,8 +1,8 @@
-{% if discord_template_notifier.enabled | default(false) %}
+<% if discord_template_notifier.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
  - ./helmrelease.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if discord_template_notifier.enabled | default(false) %}
+<% if discord_template_notifier.enabled | default(false) %>
 ---
 apiVersion: v1
 kind: Secret
@@ -12,5 +12,5 @@ stringData:
    interval = "10m"
    retry_limit = 5
    sink.type = "discord"
-    sink.url = "{{ discord_template_notifier.webhook_url }}"
-{% endif %}
+    sink.url = "<< discord_template_notifier.webhook_url >>"
+<% endif %>
@@ -1,4 +1,4 @@
-{% if discord_template_notifier.enabled | default(false) %}
+<% if discord_template_notifier.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +19,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if homepage.enabled | default(false) %}
+<% if homepage.enabled | default(false) %>
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -38,9 +38,9 @@ data:
            description: Cloudflared Tunnel
            widget:
              type: cloudflared
-              accountid: "{% raw %}{{HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID}}{% endraw %}"
-              tunnelid: "{% raw %}{{ HOMEPAGE_VAR_CLOUDFLARED_TUNNELID}}{% endraw %}"
-              key: "{% raw %}{{HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN}}{% endraw %}"
+              accountid: "{{HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID}}"
+              tunnelid: "{{HOMEPAGE_VAR_CLOUDFLARED_TUNNELID}}"
+              key: "{{HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN}}"
  settings.yaml: |
    title: Dashboard
    theme: dark
@@ -76,4 +76,4 @@ data:
          dateStyle: long
          timeStyle: short
          hourCycle: h23
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if homepage.enabled | default(false) %}
+<% if homepage.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -87,4 +87,4 @@ spec:
            path: /app/config/widgets.yaml
    serviceAccount:
      create: true
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if homepage.enabled | default(false) %}
+<% if homepage.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -6,4 +6,4 @@ resources:
  - ./configmap.yaml
  - ./helmrelease.yaml
  - ./secret.sops.yaml
-{% endif %}
+<% endif %>
@@ -1,13 +1,13 @@
-{% if homepage.enabled | default(false) %}
+<% if homepage.enabled | default(false) %>
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  name: homepage-secret
 stringData:
-  HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID: "{{ bootstrap_cloudflare_account_tag }}"
-  HOMEPAGE_VAR_CLOUDFLARED_TUNNELID: "{{ bootstrap_cloudflare_tunnel_id }}"
-  HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "{{ bootstrap_cloudflare_token }}"
+  HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID: "<< bootstrap_cloudflare_account_tag >>"
+  HOMEPAGE_VAR_CLOUDFLARED_TUNNELID: "<< bootstrap_cloudflare_tunnel_id >>"
+  HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "<< bootstrap_cloudflare_token >>"
  HOMEPAGE_VAR_GRAFANA_USERNAME: admin
-  HOMEPAGE_VAR_GRAFANA_PASSWORD: "{{ grafana.password }}"
-{% endif %}
+  HOMEPAGE_VAR_GRAFANA_PASSWORD: "<< grafana.password >>"
+<% endif %>
@@ -1,4 +1,4 @@
-{% if homepage.enabled | default(false) %}
+<% if homepage.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +19,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -3,9 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  {% if homepage.enabled | default(false) %}
+  <% if homepage.enabled | default(false) %>
  - ./homepage/ks.yaml
-  {% endif %}
-  {% if discord_template_notifier.enabled | default(false) %}
+  <% endif %>
+  <% if discord_template_notifier.enabled | default(false) %>
  - ./discord-template-notifier/ks.yaml
-  {% endif %}
+  <% endif %>
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: github-webhook-token-secret
 stringData:
-  token: "{{ bootstrap_flux_github_webhook_token }}"
+  token: "<< bootstrap_flux_github_webhook_token >>"
@@ -4,6 +4,6 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./addons/ks.yaml
-  {% if weave_gitops.enabled | default(false) %}
+  <% if weave_gitops.enabled | default(false) %>
  - ./weave-gitops/ks.yaml
-  {% endif %}
+  <% endif %>
@@ -1,4 +1,4 @@
-{% if weave_gitops.enabled | default(false) %}
+<% if weave_gitops.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -32,13 +32,13 @@ spec:
    ingress:
      enabled: true
      className: internal
-      {% if homepage.enabled | default(false) %}
+      <% if homepage.enabled | default(false) %>
      annotations:
        gethomepage.dev/enabled: "true"
        gethomepage.dev/group: Home
        gethomepage.dev/name: Weave-gitops
        gethomepage.dev/icon: flux-cd.png
-      {% endif %}
+      <% endif %>
      hosts:
        - host: &host "gitops.${SECRET_DOMAIN}"
          paths:
@@ -56,4 +56,4 @@ spec:
      impersonationResourceNames: ["admin"]
    podAnnotations:
      secret.reloader.stakater.com/reload: cluster-user-auth
-{% endif %}
+<% endif %>
@@ -1,8 +1,8 @@
-{% if weave_gitops.enabled | default(false) %}
+<% if weave_gitops.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
  - ./helmrelease.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if weave_gitops.enabled | default(false) %}
+<% if weave_gitops.enabled | default(false) %>
 ---
 apiVersion: v1
 kind: Secret
@@ -7,5 +7,5 @@ metadata:
 type: Opaque
 stringData:
  username: admin
-  password: "{{ weave_gitops.password | encrypt }}"
-{% endif %}
+  password: "<< weave_gitops.password | encrypt >>"
+<% endif %>
@@ -1,4 +1,4 @@
-{% if weave_gitops.enabled | default(false) %}
+<% if weave_gitops.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +19,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -34,11 +34,11 @@ spec:
      id: 1
    containerRuntime:
      integration: containerd
-      {% if bootstrap_distribution == "k3s" %}
+      <% if bootstrap_distribution == "k3s" %>
      socketPath: /var/run/k3s/containerd/containerd.sock
-      {% else %}
+      <% else %>
      socketPath: /var/run/k0s/containerd.sock
-      {% endif %}
+      <% endif %>
    endpointRoutes:
      enabled: true
    hubble:
@@ -70,13 +70,13 @@ spec:
        ingress:
          enabled: true
          className: internal
-          {% if homepage.enabled | default(false) %}
+          <% if homepage.enabled | default(false) %>
          annotations:
            gethomepage.dev/enabled: "true"
            gethomepage.dev/group: Network
            gethomepage.dev/name: Cilium
            gethomepage.dev/icon: cilium.png
-          {% endif %}
+          <% endif %>
          hosts:
            - "hubble.${SECRET_DOMAIN}"
          tls:
@@ -85,28 +85,28 @@ spec:
    ipam:
      mode: kubernetes
    ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-    {% if bootstrap_ipv6_enabled | default(false) %}
+    <% if bootstrap_ipv6_enabled | default(false) %>
    ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
    ipv6:
      enabled: true
-    {% endif %}
+    <% endif %>
    k8sServiceHost: "${KUBE_API_ADDR}"
    k8sServicePort: 6443
    kubeProxyReplacement: true
    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
    l2announcements:
-      {% if bootstrap_ipv6_enabled | default(false) %}
+      <% if bootstrap_ipv6_enabled | default(false) %>
      enabled: false
-      {% else %}
+      <% else %>
      enabled: true
      # https://github.com/cilium/cilium/issues/26586
      leaseDuration: 120s
      leaseRenewDeadline: 60s
      leaseRetryPeriod: 1s
-      {% endif %}
+      <% endif %>
    loadBalancer:
      algorithm: maglev
-      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
+      mode: << bootstrap_cilium_loadbalancer_mode | default('dsr', true) >>
    localRedirectPolicy: true
    operator:
      replicas: 1
@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  {% if not bootstrap_ipv6_enabled | default(false) %}
+  <% if not bootstrap_ipv6_enabled | default(false) %>
  - ./cilium-l2.yaml
-  {% endif %}
+  <% endif %>
  - ./helmrelease.yaml
@@ -1,4 +1,4 @@
-{% if bootstrap_distribution == "k3s" %}
+<% if bootstrap_distribution == "k3s" %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -87,4 +87,4 @@ spec:
        labelSelector:
          matchLabels:
            app.kubernetes.io/instance: coredns
-{% endif %}
+<% endif %>
@@ -1,7 +1,7 @@
-{% if bootstrap_distribution == "k3s" %}
+<% if bootstrap_distribution == "k3s" %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./helmrelease.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if bootstrap_distribution == "k3s" %}
+<% if bootstrap_distribution == "k3s" %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +19,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -4,7 +4,7 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cilium/ks.yaml
-  {% if bootstrap_distribution == "k3s" %}
+  <% if bootstrap_distribution == "k3s" %>
  - ./coredns/ks.yaml
-  {% endif %}
+  <% endif %>
  - ./metrics-server/ks.yaml
@@ -4,10 +4,10 @@ kind: Secret
 metadata:
  name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}"
+  TUNNEL_ID: "<< bootstrap_cloudflare_tunnel_id >>"
  credentials.json: |
    {
-      "AccountTag": "{{ bootstrap_cloudflare_account_tag }}",
-      "TunnelSecret": "{{ bootstrap_cloudflare_tunnel_secret }}",
-      "TunnelID": "{{ bootstrap_cloudflare_tunnel_id }}"
+      "AccountTag": "<< bootstrap_cloudflare_account_tag >>",
+      "TunnelSecret": "<< bootstrap_cloudflare_tunnel_secret >>",
+      "TunnelID": "<< bootstrap_cloudflare_tunnel_id >>"
    }
@@ -71,14 +71,14 @@ spec:
        className: external
        annotations:
          external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
-          {% if homepage.enabled | default(false) %}
+          <% if homepage.enabled | default(false) %>
          gethomepage.dev/enabled: "true"
          gethomepage.dev/group: Network
          gethomepage.dev/name: Echo Server
          gethomepage.dev/icon: mdi-video-input-antenna
-          {% endif %}
+          <% endif %>
        hosts:
-          - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}.${SECRET_DOMAIN}"
+          - host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}"
            paths:
              - path: /
                service:
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: external-dns-secret
 stringData:
-  api-token: "{{ bootstrap_cloudflare_token }}"
+  api-token: "<< bootstrap_cloudflare_token >>"
@@ -31,5 +31,5 @@ spec:
      type: LoadBalancer
      port: 53
      annotations:
-        io.cilium/lb-ipam-ips: "{{ bootstrap_k8s_gateway_addr }}"
+        io.cilium/lb-ipam-ips: "<< bootstrap_k8s_gateway_addr >>"
      externalTrafficPolicy: Cluster
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./staging.yaml
-  {% if bootstrap_acme_production_enabled | default(false) %}
+  <% if bootstrap_acme_production_enabled | default(false) %>
  - ./production.yaml
-  {% endif %}
+  <% endif %>
@@ -33,7 +33,7 @@ spec:
      service:
        annotations:
          external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "{{ bootstrap_external_ingress_addr }}"
+          io.cilium/lb-ipam-ips: "<< bootstrap_external_ingress_addr >>"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: external
@@ -71,11 +71,11 @@ spec:
          namespaceSelector:
            any: true
      extraArgs:
-        {% if bootstrap_acme_production_enabled | default(false) %}
+        <% if bootstrap_acme_production_enabled | default(false) %>
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
-        {% else %}
+        <% else %>
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
-        {% endif %}
+        <% endif %>
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
@@ -31,7 +31,7 @@ spec:
      service:
        annotations:
          external-dns.alpha.kubernetes.io/hostname: "internal.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "{{ bootstrap_internal_ingress_addr }}"
+          io.cilium/lb-ipam-ips: "<< bootstrap_internal_ingress_addr >>"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: internal
@@ -69,11 +69,11 @@ spec:
          namespaceSelector:
            any: true
      extraArgs:
-        {% if bootstrap_acme_production_enabled | default(false) %}
+        <% if bootstrap_acme_production_enabled | default(false) %>
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
-        {% else %}
+        <% else %>
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
-        {% endif %}
+        <% endif %>
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
@@ -1,4 +1,4 @@
-{% if grafana.enabled | default(false) %}
+<% if grafana.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -160,7 +160,7 @@ spec:
    ingress:
      enabled: true
      ingressClassName: internal
-      {% if homepage.enabled | default(false) %}
+      <% if homepage.enabled | default(false) %>
      annotations:
        gethomepage.dev/enabled: "true"
        gethomepage.dev/icon: grafana.png
@@ -168,9 +168,9 @@ spec:
        gethomepage.dev/group: Observability
        gethomepage.dev/widget.type: grafana
        gethomepage.dev/widget.url: http://grafana.observability
-        gethomepage.dev/widget.username: "{% raw %}{{`{{HOMEPAGE_VAR_GRAFANA_USERNAME}}`}}{% endraw %}"
-        gethomepage.dev/widget.password: "{% raw %}{{`{{HOMEPAGE_VAR_GRAFANA_PASSWORD}}`}}{% endraw %}"
-      {% endif %}
+        gethomepage.dev/widget.username: "{{`{{HOMEPAGE_VAR_GRAFANA_USERNAME}}`}}"
+        gethomepage.dev/widget.password: "{{`{{HOMEPAGE_VAR_GRAFANA_PASSWORD}}`}}"
+      <% endif %>
      hosts:
        - &host "grafana.${SECRET_DOMAIN}"
      tls:
@@ -181,4 +181,4 @@ spec:
      storageClassName: openebs-hostpath
    testFramework:
      enabled: false
-{% endif %}
+<% endif %>
@@ -1,8 +1,8 @@
-{% if grafana.enabled | default(false) %}
+<% if grafana.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
  - ./helmrelease.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if grafana.enabled | default(false) %}
+<% if grafana.enabled | default(false) %>
 ---
 apiVersion: v1
 kind: Secret
@@ -6,5 +6,5 @@ metadata:
  name: grafana-admin-secret
 stringData:
  admin-user: admin
-  admin-password: "{{ grafana.password }}"
-{% endif %}
+  admin-password: "<< grafana.password >>"
+<% endif %>
@@ -1,4 +1,4 @@
-{% if grafana.enabled | default(false) %}
+<% if grafana.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +19,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if kube_prometheus_stack.enabled | default(false) %}
+<% if kube_prometheus_stack.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -54,7 +54,7 @@ spec:
      enabled: true
      serviceMonitor:
        metricRelabelings:
-          {% if bootstrap_distribution == 'k3s' %}
+          <% if bootstrap_distribution == 'k3s' %>
          # Remove duplicate labels provided by k3s
          - action: keep
            sourceLabels: ["__name__"]
@@ -62,7 +62,7 @@ spec:
          - action: replace
            sourceLabels: ["node"]
            targetLabel: instance
-          {% endif %}
+          <% endif %>
          # Drop high cardinality labels
          - action: labeldrop
            regex: (uid)
@@ -75,12 +75,12 @@ spec:
      enabled: true
      serviceMonitor:
        metricRelabelings:
-          {% if bootstrap_distribution == 'k3s' %}
+          <% if bootstrap_distribution == 'k3s' %>
          # Remove duplicate labels provided by k3s
          - action: keep
            sourceLabels: ["__name__"]
            regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)
-          {% endif %}
+          <% endif %>
          # Drop high cardinality labels
          - action: drop
            sourceLabels: ["__name__"]
@@ -91,49 +91,49 @@ spec:
    kubeControllerManager:
      enabled: true
      endpoints: &endpoints
-      {% for item in bootstrap_nodes.master %}
-        - {{ item.address }}
-      {% endfor %}
-      {% if bootstrap_distribution == 'k3s' %}
+      <% for item in bootstrap_nodes.master %>
+        - << item.address >>
+      <% endfor %>
+      <% if bootstrap_distribution == 'k3s' %>
      serviceMonitor:
        metricRelabelings:
          # Remove duplicate labels provided by k3s
          - action: keep
            sourceLabels: ["__name__"]
            regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|attachdetach_controller|authenticated_user|authentication|cronjob_controller|disabled_metric|endpoint_slice|ephemeral_volume|garbagecollector_controller|get_token|go|hidden_metric|job_controller|kubernetes_build|kubernetes_feature|leader_election|node_collector|node_ipam|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|pv_collector|registered_metric|replicaset_controller|rest_client|retroactive_storageclass|root_ca|running_managed|scrape_duration|scrape_samples|scrape_series|service_controller|storage_count|storage_operation|ttl_after|volume_operation|workqueue)_(.+)"
-      {% endif %}
+      <% endif %>
    kubeEtcd:
-      {% if bootstrap_nodes.master | length > 1 %}
+      <% if bootstrap_nodes.master | length > 1 %>
      enabled: true
-      {% else %}
+      <% else %>
      enabled: false
-      {% endif %}
+      <% endif %>
      endpoints: *endpoints
    kubeScheduler:
      enabled: true
      endpoints: *endpoints
-      {% if bootstrap_distribution == 'k3s' %}
+      <% if bootstrap_distribution == 'k3s' %>
      serviceMonitor:
        metricRelabelings:
          # Remove duplicate labels provided by k3s
          - action: keep
            sourceLabels: ["__name__"]
            regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authenticated_user|authentication|disabled_metric|go|hidden_metric|kubernetes_build|kubernetes_feature|leader_election|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scheduler|scrape_duration|scrape_samples|scrape_series|workqueue)_(.+)"
-      {% endif %}
+      <% endif %>
    kubeProxy:
      enabled: false # Disabled due to eBPF
    prometheus:
      ingress:
        enabled: true
        ingressClassName: internal
-        {% if homepage.enabled | default(false) %}
+        <% if homepage.enabled | default(false) %>
        annotations:
          gethomepage.dev/enabled: "true"
          gethomepage.dev/icon: prometheus.png
          gethomepage.dev/name: Prometheus
          gethomepage.dev/group: Observability
          gethomepage.dev/widget.type: prometheus
-        {% endif %}
+        <% endif %>
        pathType: Prefix
        hosts:
          - "prometheus.${SECRET_DOMAIN}"
@@ -164,4 +164,4 @@ spec:
          multicluster:
            etcd:
              enabled: true
-{% endif %}
+<% endif %>
@@ -1,7 +1,7 @@
-{% if kube_prometheus_stack.enabled | default(false) %}
+<% if kube_prometheus_stack.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./helmrelease.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if kube_prometheus_stack.enabled | default(false) %}
+<% if kube_prometheus_stack.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +19,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if kubernetes_dashboard.enabled | default(false) %}
+<% if kubernetes_dashboard.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -32,13 +32,13 @@ spec:
    ingress:
      enabled: true
      className: internal
-      {% if homepage.enabled | default(false) %}
+      <% if homepage.enabled | default(false) %>
      annotations:
        gethomepage.dev/enabled: "true"
        gethomepage.dev/icon: kubernetes-dashboard.png
        gethomepage.dev/name: Kubernetes Dashboard
        gethomepage.dev/group: Observability
-      {% endif %}
+      <% endif %>
      hosts:
        - &host "kubernetes.${SECRET_DOMAIN}"
      tls:
@@ -46,4 +46,4 @@ spec:
            - *host
    metricsScraper:
      enabled: true
-{% endif %}
+<% endif %>
@@ -1,8 +1,8 @@
-{% if kubernetes_dashboard.enabled | default(false) %}
+<% if kubernetes_dashboard.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./rbac.yaml
  - ./helmrelease.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if kubernetes_dashboard.enabled | default(false) %}
+<% if kubernetes_dashboard.enabled | default(false) %>
 # For dashboard sign in token:
 # kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
 ---
@@ -38,4 +38,4 @@ subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: observability
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if kubernetes_dashboard.enabled | default(false) %}
+<% if kubernetes_dashboard.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -22,4 +22,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -3,12 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  {% if grafana.enabled | default(false) %}
+  <% if grafana.enabled | default(false) %>
  - ./grafana/ks.yaml
-  {% endif %}
-  {% if kube_prometheus_stack.enabled | default(false) %}
+  <% endif %>
+  <% if kube_prometheus_stack.enabled | default(false) %>
  - ./kube-prometheus-stack/ks.yaml
-  {% endif %}
-  {% if kubernetes_dashboard.enabled | default(false) %}
+  <% endif %>
+  <% if kubernetes_dashboard.enabled | default(false) %>
  - ./kubernetes-dashboard/ks.yaml
-  {% endif %}
+  <% endif %>
@@ -1,4 +1,4 @@
-{% if csi_driver_nfs.enabled | default(false) %}
+<% if csi_driver_nfs.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -27,4 +27,4 @@ spec:
  values:
    externalSnapshotter:
      enabled: false
-{% endif %}
+<% endif %>
@@ -1,8 +1,8 @@
-{% if csi_driver_nfs.enabled | default(false) %}
+<% if csi_driver_nfs.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./helmrelease.yaml
  - ./storageclass.yaml
-{% endif %}
+<% endif %>
@@ -1,16 +1,16 @@
-{% if csi_driver_nfs.enabled | default(false) %}
-{% for item in csi_driver_nfs.storage_class %}
+<% if csi_driver_nfs.enabled | default(false) %>
+<% for item in csi_driver_nfs.storage_class %>
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
-  name: {{ item.name }}
+  name: << item.name >>
 provisioner: nfs.csi.k8s.io
 parameters:
-  server: {{ item.server }}
-  share: {{ item.share }}
+  server: << item.server >>
+  share: << item.share >>
 reclaimPolicy: Delete
 volumeBindingMode: Immediate
 mountOptions: ["hard", "noatime"]
-{% endfor %}
-{% endif %}
+<% endfor %>
+<% endif %>
@@ -1,4 +1,4 @@
-{% if csi_driver_nfs.enabled | default(false) %}
+<% if csi_driver_nfs.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -19,4 +19,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -4,9 +4,9 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./openebs/ks.yaml
-  {% if volsync.enabled | default(false) %}
+  <% if volsync.enabled | default(false) %>
  - ./volsync/ks.yaml
-  {% endif %}
-  {% if csi_driver_nfs.enabled | default(false) %}
+  <% endif %>
+  <% if csi_driver_nfs.enabled | default(false) %>
  - ./csi-driver-nfs/ks.yaml
-  {% endif %}
+  <% endif %>
@@ -29,5 +29,5 @@ spec:
        enabled: true
        name: openebs-hostpath
        isDefaultClass: false
-        basePath: "{{ bootstrap_local_storage_path }}"
+        basePath: "<< bootstrap_local_storage_path >>"

@@ -1,4 +1,4 @@
-{% if volsync.enabled | default(false) %}
+<% if volsync.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -41,4 +41,4 @@ spec:
      tag: *tag
    metrics:
      disableAuth: true
-{% endif %}
+<% endif %>
@@ -1,8 +1,8 @@
-{% if volsync.enabled | default(false) %}
+<% if volsync.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./helmrelease.yaml
  - ./prometheusrule.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if volsync.enabled | default(false) %}
+<% if volsync.enabled | default(false) %>
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
@@ -17,9 +17,9 @@ spec:
            severity: critical
        - alert: VolSyncVolumeOutOfSync
          annotations:
-            summary: "{% raw %}{{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume is out of sync.{% endraw %}"
+            summary: "{{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume is out of sync."
          expr: volsync_volume_out_of_sync == 1
          for: 15m
          labels:
            severity: critical
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if volsync.enabled | default(false) %}
+<% if volsync.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -39,4 +39,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if volsync.enabled | default(false) %}
+<% if volsync.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -32,4 +32,4 @@ spec:
        create: true
    webhook:
      enabled: false
-{% endif %}
+<% endif %>
@@ -1,7 +1,7 @@
-{% if volsync.enabled | default(false) %}
+<% if volsync.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./helmrelease.yaml
-{% endif %}
+<% endif %>
@@ -5,6 +5,6 @@ resources:
  - ./namespace.yaml
  - ./descheduler/ks.yaml
  - ./reloader/ks.yaml
-  {% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+  <% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
  - ./system-upgrade-controller/ks.yaml
-  {% endif %}
+  <% endif %>
@@ -29,4 +29,4 @@ spec:
      readOnlyRootFileSystem: true
      podMonitor:
        enabled: true
-        namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}"
+        namespace: "{{ .Release.Namespace }}"
@@ -1,4 +1,4 @@
-{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -103,4 +103,4 @@ spec:
        globalMounts:
          - path: /etc/ca-certificates
            readOnly: true
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -7,4 +7,4 @@ resources:
  - https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.2/crd.yaml
  - helmrelease.yaml
  - rbac.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -12,4 +12,4 @@ subjects:
  - kind: ServiceAccount
    name: system-upgrade
    namespace: tools
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -41,4 +41,4 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
@@ -17,4 +17,4 @@ spec:
    args: ["prepare", "server"]
  upgrade:
    image: rancher/k3s-upgrade
-{% endif %}
+<% endif %>
@@ -1,8 +1,8 @@
-{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./server.yaml
  - ./agent.yaml
-{% endif %}
+<% endif %>
@@ -1,4 +1,4 @@
-{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
+<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
@@ -22,4 +22,4 @@ spec:
    - {key: CriticalAddonsOnly, operator: Exists}
  upgrade:
    image: rancher/k3s-upgrade
-{% endif %}
+<% endif %>
@@ -7,14 +7,14 @@ metadata:
 spec:
  interval: 30m
  ref:
-    branch: {{ bootstrap_github_repository_branch | default('main', true) }}
-  {% if bootstrap_private_github_repo | default(false) %}
+    branch: << bootstrap_github_repository_branch | default('main', true) >>
+  <% if bootstrap_private_github_repo | default(false) %>
  secretRef:
    name: github-deploy-key
-  url: "ssh://github.com/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}"
-  {% else %}
-  url: "https://github.com/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}.git"
-  {% endif %}
+  url: "ssh://github.com/<< bootstrap_github_username >>/<< bootstrap_github_repository_name >>"
+  <% else %>
+  url: "https://github.com/<< bootstrap_github_username >>/<< bootstrap_github_repository_name >>.git"
+  <% endif %>
  ignore: |
    # exclude all
    /*
@@ -5,6 +5,6 @@ metadata:
  name: cluster-secrets
  namespace: flux-system
 stringData:
-  SECRET_DOMAIN: "{{ bootstrap_cloudflare_domain }}"
-  SECRET_ACME_EMAIL: "{{ bootstrap_acme_email }}"
-  SECRET_CLOUDFLARE_TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}"
+  SECRET_DOMAIN: "<< bootstrap_cloudflare_domain >>"
+  SECRET_ACME_EMAIL: "<< bootstrap_acme_email >>"
+  SECRET_CLOUDFLARE_TUNNEL_ID: "<< bootstrap_cloudflare_tunnel_id >>"
@@ -5,17 +5,17 @@ metadata:
  name: cluster-settings
  namespace: flux-system
 data:
-  TIMEZONE: "{{ bootstrap_timezone }}"
-  COREDNS_ADDR: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}"
-  {% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
-  KUBE_API_ADDR: "{{ bootstrap_nodes.master[0].address }}"
-  {% else %}
-  KUBE_API_ADDR: "{{ bootstrap_kube_api_addr }}"
-  {% endif %}
-  CLUSTER_CIDR: "{{ bootstrap_cluster_cidr.split(',')[0] }}"
-  SERVICE_CIDR: "{{ bootstrap_service_cidr.split(',')[0] }}"
-  NODE_CIDR: "{{ bootstrap_node_cidr }}"
-  {% if bootstrap_ipv6_enabled | default(false) %}
-  CLUSTER_CIDR_V6: "{{ bootstrap_cluster_cidr.split(',')[1] }}"
-  SERVICE_CIDR_V6: "{{ bootstrap_service_cidr.split(',')[1] }}"
-  {% endif %}
+  TIMEZONE: "<< bootstrap_timezone >>"
+  COREDNS_ADDR: "<< bootstrap_service_cidr.split(',')[0] | nthhost(10) >>"
+  <% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %>
+  KUBE_API_ADDR: "<< bootstrap_nodes.master[0].address >>"
+  <% else %>
+  KUBE_API_ADDR: "<< bootstrap_kube_api_addr >>"
+  <% endif %>
+  CLUSTER_CIDR: "<< bootstrap_cluster_cidr.split(',')[0] >>"
+  SERVICE_CIDR: "<< bootstrap_service_cidr.split(',')[0] >>"
+  NODE_CIDR: "<< bootstrap_node_cidr >>"
+  <% if bootstrap_ipv6_enabled | default(false) %>
+  CLUSTER_CIDR_V6: "<< bootstrap_cluster_cidr.split(',')[1] >>"
+  SERVICE_CIDR_V6: "<< bootstrap_service_cidr.split(',')[1] >>"
+  <% endif %>