diff --git a/.envrc b/.envrc index 6765f5a2..1e4d7b7b 100644 --- a/.envrc +++ b/.envrc @@ -6,7 +6,7 @@ PATH_add "$(expand_path ./.venv/bin)" export VIRTUAL_ENV="$(expand_path ./.venv)" export ANSIBLE_COLLECTIONS_PATH=$(expand_path ./.venv/galaxy) export ANSIBLE_ROLES_PATH=$(expand_path ./.venv/galaxy/ansible_roles) -export ANSIBLE_VARS_ENABLED="host_group_vars,community.sops.sops" +export ANSIBLE_VARS_ENABLED="host_group_vars" export ANSIBLE_LOCALHOST_WARNING="False" export ANSIBLE_INVENTORY_UNPARSED_WARNING="False" export K8S_AUTH_KUBECONFIG="$(expand_path ./kubeconfig)" diff --git a/.github/tests/config-k0s.yaml b/.github/tests/config-k0s.yaml index ff216f84..1b02aa4a 100644 --- a/.github/tests/config-k0s.yaml +++ b/.github/tests/config-k0s.yaml @@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake bootstrap_cloudflare_tunnel_secret: fake bootstrap_cloudflare_tunnel_id: fake bootstrap_node_cidr: 10.10.10.0/24 -bootstrap_kubeapi_addr: 10.10.10.254 +bootstrap_kube_api_addr: 10.10.10.254 bootstrap_k8s_gateway_addr: 10.10.10.253 bootstrap_external_ingress_addr: 10.10.10.252 bootstrap_internal_ingress_addr: 10.10.10.251 @@ -30,7 +30,19 @@ bootstrap_nodes: - name: k8s-0 address: 10.10.10.100 username: fake - worker: - name: k8s-1 address: 10.10.10.101 username: fake + - name: k8s-2 + address: 10.10.10.102 + username: fake + worker: + - name: k8s-3 + address: 10.10.10.103 + username: fake + - name: k8s-4 + address: 10.10.10.104 + username: fake + - name: k8s-5 + address: 10.10.10.105 + username: fake diff --git a/.github/tests/config-k3s-ipv4.yaml b/.github/tests/config-k3s-ipv4.yaml index 25269fe5..9cbfe954 100644 --- a/.github/tests/config-k3s-ipv4.yaml +++ b/.github/tests/config-k3s-ipv4.yaml @@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake bootstrap_cloudflare_tunnel_secret: fake bootstrap_cloudflare_tunnel_id: fake bootstrap_node_cidr: 10.10.10.0/24 -bootstrap_kubeapi_addr: 10.10.10.254 +bootstrap_kube_api_addr: 10.10.10.254 bootstrap_k8s_gateway_addr: 10.10.10.253 bootstrap_external_ingress_addr: 10.10.10.252 bootstrap_internal_ingress_addr: 10.10.10.251 @@ -30,7 +30,19 @@ bootstrap_nodes: - name: k8s-0 address: 10.10.10.100 username: fake - worker: - name: k8s-1 address: 10.10.10.101 username: fake + - name: k8s-2 + address: 10.10.10.102 + username: fake + worker: + - name: k8s-3 + address: 10.10.10.103 + username: fake + - name: k8s-4 + address: 10.10.10.104 + username: fake + - name: k8s-5 + address: 10.10.10.105 + username: fake diff --git a/.github/tests/config-k3s-ipv6.yaml b/.github/tests/config-k3s-ipv6.yaml index e3de32a8..88e6acac 100644 --- a/.github/tests/config-k3s-ipv6.yaml +++ b/.github/tests/config-k3s-ipv6.yaml @@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake bootstrap_cloudflare_tunnel_secret: fake bootstrap_cloudflare_tunnel_id: fake bootstrap_node_cidr: 10.10.10.0/24 -bootstrap_kubeapi_addr: 10.10.10.254 +bootstrap_kube_api_addr: 10.10.10.254 bootstrap_k8s_gateway_addr: 10.10.10.253 bootstrap_external_ingress_addr: 10.10.10.252 bootstrap_internal_ingress_addr: 10.10.10.251 @@ -30,7 +30,19 @@ bootstrap_nodes: - name: k8s-0 address: 10.10.10.100 username: fake - worker: - name: k8s-1 address: 10.10.10.101 username: fake + - name: k8s-2 + address: 10.10.10.102 + username: fake + worker: + - name: k8s-3 + address: 10.10.10.103 + username: fake + - name: k8s-4 + address: 10.10.10.104 + username: fake + - name: k8s-5 + address: 10.10.10.105 + username: fake diff --git a/.github/tests/config-k3s-no-kube-vip.yaml b/.github/tests/config-k3s-no-kube-vip.yaml new file mode 100644 index 00000000..c5b42d1e --- /dev/null +++ b/.github/tests/config-k3s-no-kube-vip.yaml @@ -0,0 +1,32 @@ +--- +ci_test: true + +bootstrap_distribution: k3s +bootstrap_github_username: onedr0p +bootstrap_github_repository_name: flux-cluster-template +bootstrap_github_repository_branch: main +bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY +bootstrap_timezone: Etc/UTC +bootstrap_acme_email: fake +bootstrap_acme_production_enabled: false +bootstrap_flux_github_webhook_token: fake +bootstrap_cloudflare_domain: fake +bootstrap_cloudflare_token: fake +bootstrap_cloudflare_account_tag: fake +bootstrap_cloudflare_tunnel_secret: fake +bootstrap_cloudflare_tunnel_id: fake +bootstrap_node_cidr: 10.10.10.0/24 +bootstrap_kube_api_addr: # left blank to not use kube-vip +bootstrap_k8s_gateway_addr: 10.10.10.253 +bootstrap_external_ingress_addr: 10.10.10.252 +bootstrap_internal_ingress_addr: 10.10.10.251 +bootstrap_cilium_loadbalancer_mode: dsr +bootstrap_ipv6_enabled: false +bootstrap_cluster_cidr: 10.42.0.0/16 +bootstrap_service_cidr: 10.43.0.0/16 +bootstrap_local_storage_path: /var/openebs/local +bootstrap_nodes: + master: + - name: k8s-0 + address: 10.10.10.100 + username: fake diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index c0733d57..7451829a 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -40,6 +40,7 @@ jobs: - k0s - k3s-ipv4 - k3s-ipv6 + - k3s-no-kube-vip addon-files: ["addons"] steps: - name: Checkout @@ -109,7 +110,7 @@ jobs: - name: Run configure shell: bash - run: task --yes configure + run: task configure --yes - name: Run kubeconform shell: bash @@ -124,4 +125,4 @@ jobs: shell: bash run: | task repo:clean - task --yes repo:reset + task repo:reset --yes diff --git a/.gitignore b/.gitignore index c8699cb7..65dd2607 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,7 @@ +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class # Trash .DS_Store Thumbs.db diff --git a/.taskfiles/Ansible/Taskfile.yaml b/.taskfiles/Ansible/Taskfile.yaml index f92eb45d..f66e8148 100644 --- a/.taskfiles/Ansible/Taskfile.yaml +++ b/.taskfiles/Ansible/Taskfile.yaml @@ -11,7 +11,7 @@ env: VIRTUAL_ENV: "{{.ROOT_DIR}}/.venv" ANSIBLE_COLLECTIONS_PATH: "{{.ROOT_DIR}}/.venv/galaxy" ANSIBLE_ROLES_PATH: "{{.ROOT_DIR}}/.venv/galaxy/ansible_roles" - ANSIBLE_VARS_ENABLED: "host_group_vars,community.sops.sops" + ANSIBLE_VARS_ENABLED: "host_group_vars" ANSIBLE_LOCALHOST_WARNING: "False" ANSIBLE_INVENTORY_UNPARSED_WARNING: "False" diff --git a/.taskfiles/K0s/Taskfile.yaml b/.taskfiles/K0s/Taskfile.yaml index d0c9815d..8b467655 100644 --- a/.taskfiles/K0s/Taskfile.yaml +++ b/.taskfiles/K0s/Taskfile.yaml @@ -10,14 +10,14 @@ tasks: kubeconfig: desc: Gets k0s cluster kubeconfig cmds: - - k0sctl kubeconfig --config k0s-config.yaml > kubeconfig + - k0sctl kubeconfig --config {{.ROOT_DIR}}/k0s-config.yaml > kubeconfig preconditions: - { msg: "k0s-config.yaml not found", sh: "test -f {{.ROOT_DIR}}/k0s-config.yaml" } apply: desc: Apply k0s cluster k0s-config.yaml cmds: - - k0sctl apply --config k0s-config.yaml + - k0sctl apply --config {{.ROOT_DIR}}/k0s-config.yaml - task: kubeconfig preconditions: - { msg: "k0s-config.yaml not found", sh: "test -f {{.ROOT_DIR}}/k0s-config.yaml" } @@ -25,7 +25,7 @@ tasks: reset: desc: Resets the k0s cluster cmds: - - k0sctl reset --config k0s-config.yaml + - k0sctl reset --config {{.ROOT_DIR}}/k0s-config.yaml - task: :ansible:run vars: playbook: cluster-nuke diff --git a/.taskfiles/Repo/Taskfile.yaml b/.taskfiles/Repo/Taskfile.yaml index 4c6792e0..53b47411 100644 --- a/.taskfiles/Repo/Taskfile.yaml +++ b/.taskfiles/Repo/Taskfile.yaml @@ -12,28 +12,28 @@ tasks: - rm -rf {{.ROOT_DIR}}/.github/workflows/e2e.yaml # Move bootstrap directory to gitignored directory - mkdir -p {{.ROOT_DIR}}/.private - - mv {{.ROOT_DIR}}/bootstrap {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}} + - mv {{.BOOTSTRAP_DIR}} {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}} # Update renovate.json5 - sed -i {{if eq OS "darwin"}}''{{end}} 's/(..\.j2)\?(..\.j2)\?//g' {{.ROOT_DIR}}/.github/renovate.json5 - sed -i {{if eq OS "darwin"}}''{{end}} '/addons/d' {{.ROOT_DIR}}/.github/renovate.json5 preconditions: - - { msg: "bootstrap dir not found", sh: "test -d {{.ROOT_DIR}}/bootstrap" } + - { msg: "bootstrap dir not found", sh: "test -d {{.BOOTSTRAP_DIR}}" } - { msg: "renovate.json5 not found", sh: "test -f {{.ROOT_DIR}}/.github/renovate.json5" } reset: - desc: Remove templated configuration files - prompt: Remove templated configuration files... continue? + desc: Reset templated configuration files + prompt: Reset templated configuration files... continue? cmds: - rm -rf {{.ROOT_DIR}}/.sops.yaml - rm -rf {{.ROOT_DIR}}/k0s-config.yaml - - rm -rf {{.ROOT_DIR}}/ansible - - rm -rf {{.ROOT_DIR}}/kubernetes + - rm -rf {{.ANSIBLE_DIR}} + - rm -rf {{.KUBERNETES_DIR}} - reset-repo: - desc: Set repo back to HEAD - prompt: Set repo back to HEAD... continue? + force-reset: + desc: Reset repo back to HEAD + prompt: Reset repo back to HEAD... continue? cmds: - task: reset - git reset --hard HEAD - git clean -f -d - - git pull + - git pull origin main diff --git a/.taskfiles/Sops/Taskfile.yaml b/.taskfiles/Sops/Taskfile.yaml index 791be5c1..c3e373a4 100644 --- a/.taskfiles/Sops/Taskfile.yaml +++ b/.taskfiles/Sops/Taskfile.yaml @@ -12,7 +12,6 @@ tasks: encrypt: desc: Encrypt a secret - aliases: ["e"] summary: | Args: file: Path to file to encrypt (required) @@ -23,15 +22,13 @@ tasks: - { msg: "Sops config not found", sh: "test -f {{.ROOT_DIR}}/.sops.yaml" } - { msg: "Age key not found", sh: "test -f {{.ROOT_DIR}}/age.key" } - decrypt: - desc: Decrypt a secret - aliases: ["d"] - summary: | - Args: - file: Path to file to decrypt (required) - cmd: sops --decrypt --in-place {{.SECRET}} + encrypt:all: + desc: Encrypt all Kubernetes SOPS secrets + cmds: + - for: { var: file } + task: encrypt + vars: + file: '{{.ITEM}}' vars: - claim: '{{ or .file (fail "Argument (file) is required") }}' - preconditions: - - { msg: "Sops config not found", sh: "test -f {{.ROOT_DIR}}/.sops.yaml" } - - { msg: "Age key not found", sh: "test -f {{.ROOT_DIR}}/age.key" } + file: + sh: find {{.KUBERNETES_DIR}} -type f -name "*.sops.*" diff --git a/.taskfiles/Workstation/ArchPackages b/.taskfiles/Workstation/ArchPackages index 11e5d5d5..b15f79ff 100644 --- a/.taskfiles/Workstation/ArchPackages +++ b/.taskfiles/Workstation/ArchPackages @@ -1,17 +1,15 @@ age -cilium-cli cloudflared-bin direnv flux-bin +go-task +go-yq helm jq k0sctl-bin -k9s kubeconform kubectl-bin kustomize moreutils sops stern-bin -go-task -go-yq diff --git a/.taskfiles/Workstation/Brewfile b/.taskfiles/Workstation/Brewfile index 1a3cdaf3..8e037a46 100644 --- a/.taskfiles/Workstation/Brewfile +++ b/.taskfiles/Workstation/Brewfile @@ -1,18 +1,15 @@ tap "fluxcd/tap" tap "go-task/tap" tap "k0sproject/tap" -tap "kubecolor/tap" brew "age" -brew "cilium-cli" brew "cloudflared" brew "direnv" brew "fluxcd/tap/flux" +brew "go-task/tap/go-task" brew "helm" brew "jq" brew "k0sproject/tap/k0sctl" -brew "k9s" brew "kubeconform" -brew "kubecolor/tap/kubecolor" brew "kubernetes-cli" brew "kustomize" brew "moreutils" diff --git a/.taskfiles/Workstation/Taskfile.yaml b/.taskfiles/Workstation/Taskfile.yaml index 751605c6..d92105f1 100644 --- a/.taskfiles/Workstation/Taskfile.yaml +++ b/.taskfiles/Workstation/Taskfile.yaml @@ -14,8 +14,18 @@ tasks: Head over to https://brew.sh to get up and running. - { msg: "Brewfile not found", sh: "test -f {{.ROOT_DIR}}/.taskfiles/Workstation/Brewfile" } - yay: + paru: desc: Install workstation dependencies with Paru + cmd: paru -Syu --needed --noconfirm --noprogressbar $(cat {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages | xargs) + preconditions: + - sh: command -v paru + msg: | + Paru is not installed. Using ArchLinux? + Head over to https://github.com/Morganamilo/paru to get up and running. + - { msg: "ArchPackages not found", sh: "test -f {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages" } + + yay: + desc: Install workstation dependencies with Yay cmd: yay -Syu --needed --noconfirm --noprogressbar $(cat {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages | xargs) preconditions: - sh: command -v yay diff --git a/Taskfile.yaml b/Taskfile.yaml index 6f4c468e..f9fbe138 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -47,6 +47,33 @@ tasks: configure: desc: Configure repository from Ansible vars prompt: Any conflicting config in the root kubernetes and ansible directories will be overwritten... continue? - cmd: ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/configure.yaml + cmds: + - task: .validate + - task: .template + - task: sops:encrypt:all + + .validate: + internal: true + cmd: ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/validate.yaml env: ANSIBLE_DISPLAY_SKIPPED_HOSTS: "false" + preconditions: + - { msg: "addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" } + - { msg: "config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" } + + .template: + internal: true + cmds: + - ./.venv/bin/makejinja + --input "{{.BOOTSTRAP_DIR}}/templates" + --output "{{.ROOT_DIR}}" + --data "{{.BOOTSTRAP_DIR}}/vars/config.yaml" + --data "{{.BOOTSTRAP_DIR}}/vars/addons.yaml" + --import-path "{{.BOOTSTRAP_DIR}}/scripts" + --loader "loader:Loader" + --jinja-suffix ".j2" --quiet --force + - find {{.ANSIBLE_DIR}} {{.KUBERNETES_DIR}} -type d -empty -delete + preconditions: + - { msg: "addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" } + - { msg: "config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" } + - { msg: "loader file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/loader.py" } diff --git a/bootstrap/configure.yaml b/bootstrap/configure.yaml deleted file mode 100644 index 8a5c3699..00000000 --- a/bootstrap/configure.yaml +++ /dev/null @@ -1,45 +0,0 @@ ---- -- name: Cluster Installation - hosts: localhost - connection: local - gather_facts: false - vars_files: - - vars/config.yaml - - vars/addons.yaml - tasks: - - name: Get absolute path to this Git repository # noqa: command-instead-of-module - ansible.builtin.command: git rev-parse --show-toplevel - changed_when: false - check_mode: false - register: repository - failed_when: repository.rc != 0 - - - name: Set facts - ansible.builtin.set_fact: - repository_path: "{{ repository.stdout }}" - - - name: Override kubeapi address when there is a single master node and no address is defined - when: bootstrap_nodes.master | length == 1 and not bootstrap_kubeapi_addr - ansible.builtin.set_fact: - bootstrap_kube_vip_enabled: false - bootstrap_kubeapi_addr: "{{ bootstrap_nodes.master[0].address }}" - - - name: Verify configuration - ansible.builtin.include_tasks: tasks/validation/main.yaml - - - name: Template Sops configuration - ansible.builtin.include_tasks: tasks/sops/main.yaml - - - name: Template k0s configuration - when: bootstrap_distribution == "k0s" - ansible.builtin.include_tasks: tasks/k0s/main.yaml - - - name: Template Ansible configuration - when: bootstrap_distribution == "k0s" or bootstrap_distribution == "k3s" - ansible.builtin.include_tasks: tasks/ansible/main.yaml - - - name: Template Kubernetes configuration - ansible.builtin.include_tasks: tasks/kubernetes/main.yaml - - - name: Template Kubernetes addon configuration - ansible.builtin.include_tasks: tasks/addons/main.yaml diff --git a/bootstrap/scripts/loader.py b/bootstrap/scripts/loader.py new file mode 100644 index 00000000..7509bbe3 --- /dev/null +++ b/bootstrap/scripts/loader.py @@ -0,0 +1,21 @@ +import netaddr, bcrypt + +def nthhost(value: str, query: int) -> str: + value = netaddr.IPNetwork(value) + + try: + nth = int(query) + if value.size > nth: + return str(value[nth]) + + except ValueError: + return False + + return value + +def encrypt(value: str) -> str: + return bcrypt.hashpw(value.encode(), bcrypt.gensalt(rounds=10)).decode("ascii") + +class Loader: + def filters(self): + return [nthhost, encrypt] diff --git a/bootstrap/tasks/addons/coredns.yaml b/bootstrap/tasks/addons/coredns.yaml deleted file mode 100644 index 3eda3eba..00000000 --- a/bootstrap/tasks/addons/coredns.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: coredns - addon_namespace: kube-system - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/csi_driver_nfs.yaml b/bootstrap/tasks/addons/csi_driver_nfs.yaml deleted file mode 100644 index 21eac93c..00000000 --- a/bootstrap/tasks/addons/csi_driver_nfs.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: csi-driver-nfs - addon_namespace: storage - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/discord_template_notifier.yaml b/bootstrap/tasks/addons/discord_template_notifier.yaml deleted file mode 100644 index 67d20784..00000000 --- a/bootstrap/tasks/addons/discord_template_notifier.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: discord-template-notifier - addon_namespace: default - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/grafana.yaml b/bootstrap/tasks/addons/grafana.yaml deleted file mode 100644 index b7464c4b..00000000 --- a/bootstrap/tasks/addons/grafana.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: grafana - addon_namespace: observability - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/homepage.yaml b/bootstrap/tasks/addons/homepage.yaml deleted file mode 100644 index c4e8903e..00000000 --- a/bootstrap/tasks/addons/homepage.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: homepage - addon_namespace: default - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/kube_prometheus_stack.yaml b/bootstrap/tasks/addons/kube_prometheus_stack.yaml deleted file mode 100644 index 210a2dad..00000000 --- a/bootstrap/tasks/addons/kube_prometheus_stack.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: kube-prometheus-stack - addon_namespace: observability - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/kubernetes_dashboard.yaml b/bootstrap/tasks/addons/kubernetes_dashboard.yaml deleted file mode 100644 index 4886e28d..00000000 --- a/bootstrap/tasks/addons/kubernetes_dashboard.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: kubernetes-dashboard - addon_namespace: observability - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/main.yaml b/bootstrap/tasks/addons/main.yaml deleted file mode 100644 index d7811576..00000000 --- a/bootstrap/tasks/addons/main.yaml +++ /dev/null @@ -1,43 +0,0 @@ ---- - -- name: Process optional coredns - when: bootstrap_distribution == "k3s" - ansible.builtin.include_tasks: coredns.yaml - -- name: Process addon csi-driver-nfs - when: csi_driver_nfs.enabled | default(false) - ansible.builtin.include_tasks: csi_driver_nfs.yaml - -- name: Process addon homepage - when: homepage.enabled | default(false) - ansible.builtin.include_tasks: homepage.yaml - -- name: Process addon grafana - when: grafana.enabled | default(false) - ansible.builtin.include_tasks: grafana.yaml - -- name: Process addon kubernetes-dashboard - when: kubernetes_dashboard.enabled | default(false) - ansible.builtin.include_tasks: kubernetes_dashboard.yaml - -- name: Process addon kube-prometheus-stack - when: kube_prometheus_stack.enabled | default(false) - ansible.builtin.include_tasks: kube_prometheus_stack.yaml - -- name: Process addon system-upgrade-controller - when: - - bootstrap_distribution == "k3s" - - system_upgrade_controller.enabled | default(false) - ansible.builtin.include_tasks: system_upgrade_controller.yaml - -- name: Process addon weave-gitops - when: weave_gitops.enabled | default(false) - ansible.builtin.include_tasks: weave_gitops.yaml - -- name: Process addon discord-template-notifier - when: discord_template_notifier.enabled | default(false) - ansible.builtin.include_tasks: discord_template_notifier.yaml - -- name: Process addon volsync - when: volsync.enabled | default(false) - ansible.builtin.include_tasks: volsync.yaml diff --git a/bootstrap/tasks/addons/system_upgrade_controller.yaml b/bootstrap/tasks/addons/system_upgrade_controller.yaml deleted file mode 100644 index 376f95d8..00000000 --- a/bootstrap/tasks/addons/system_upgrade_controller.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: system-upgrade-controller - addon_namespace: tools - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/volsync.yaml b/bootstrap/tasks/addons/volsync.yaml deleted file mode 100644 index afb2c2ab..00000000 --- a/bootstrap/tasks/addons/volsync.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: volsync - addon_namespace: storage - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/addons/weave_gitops.yaml b/bootstrap/tasks/addons/weave_gitops.yaml deleted file mode 100644 index 819117ca..00000000 --- a/bootstrap/tasks/addons/weave_gitops.yaml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Set addon facts - ansible.builtin.set_fact: - addon_name: weave-gitops - addon_namespace: flux-system - -- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} - when: item.state == 'file' and 'sops' not in item.path - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" - -- name: Template encrypted files - when: item.state == 'file' and 'sops' in item.path - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/ansible/main.yaml b/bootstrap/tasks/ansible/main.yaml deleted file mode 100644 index e4fc5796..00000000 --- a/bootstrap/tasks/ansible/main.yaml +++ /dev/null @@ -1,45 +0,0 @@ ---- -- name: Ensure Ansible k3s directories exist - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/ansible/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: - - "../templates/ansible/shared/" - - "../templates/ansible/{{ bootstrap_distribution }}/" - loop_control: - label: "{{ item.path }}" - -- name: Template Ansible unencrypted files - when: - - "item.state == 'file'" - - "'sops' not in item.path" - - "'.DS_Store' not in item.path" - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/ansible/{{ item.path | regex_replace('.j2$', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: - - "../templates/ansible/shared/" - - "../templates/ansible/{{ bootstrap_distribution }}/" - loop_control: - label: "{{ item.path }}" - -- name: Template Ansible encrypted files - when: - - "item.state == 'file'" - - "'sops' in item.path" - community.sops.sops_encrypt: - path: "{{ repository_path }}/ansible/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: - - "../templates/ansible/shared/" - - "../templates/ansible/{{ bootstrap_distribution }}/" - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/k0s/main.yaml b/bootstrap/tasks/k0s/main.yaml deleted file mode 100644 index af1d4ac0..00000000 --- a/bootstrap/tasks/k0s/main.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Template k0s configuration file - ansible.builtin.template: - src: "templates/k0s/k0s-config.yaml.j2" - dest: "{{ repository_path }}/k0s-config.yaml" - mode: "0644" - lstrip_blocks: true diff --git a/bootstrap/tasks/kubernetes/main.yaml b/bootstrap/tasks/kubernetes/main.yaml deleted file mode 100644 index 2e239bf0..00000000 --- a/bootstrap/tasks/kubernetes/main.yaml +++ /dev/null @@ -1,79 +0,0 @@ ---- -- name: Ensure Kubernetes directories exist - when: item.state == 'directory' - ansible.builtin.file: - path: "{{ repository_path }}/kubernetes/{{ item.path }}" - state: directory - mode: "0755" - with_community.general.filetree: ["../templates/kubernetes/"] - loop_control: - label: "{{ item.path }}" - -- name: Template Kubernetes unencrypted files - when: - - "item.state == 'file'" - - "'.DS_Store' not in item.path" - - "'sops' not in item.path" - - "'cluster-settings-user.yaml.j2' not in item.path" - - "'cluster-secrets-user.yaml.j2' not in item.path" - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/kubernetes/"] - loop_control: - label: "{{ item.path }}" - -- name: Check if the cluster user settings file already exists - stat: - path: "{{ repository_path }}/kubernetes/flux/vars/cluster-settings-user.yaml" - register: cluster_settings_user - -- name: Template Kubernetes user cluster settings - when: - - "item.state == 'file'" - - "'cluster-settings-user.yaml' in item.path" - - "not cluster_settings_user.stat.exists" - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/kubernetes/"] - loop_control: - label: "{{ item.path }}" - -- name: Check if the cluster user secrets file already exists - stat: - path: "{{ repository_path }}/kubernetes/flux/vars/cluster-secrets-user.yaml" - register: cluster_secrets_user - -- name: Template Kubernetes user cluster secrets - when: - - "item.state == 'file'" - - "'cluster-secrets-user.yaml' in item.path" - - "not cluster_secrets_user.stat.exists" - ansible.builtin.template: - src: "{{ item.src }}" - dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}" - mode: "0644" - lstrip_blocks: true - with_community.general.filetree: ["../templates/kubernetes/"] - loop_control: - label: "{{ item.path }}" - -- name: Template Kubernetes encrypted files - when: - - "item.state == 'file'" - - "'sops' in item.path" - community.sops.sops_encrypt: - path: "{{ repository_path }}/kubernetes/{{ item.path | replace('.j2', '') }}" - encrypted_regex: ^(data|stringData)$ - age: ["{{ bootstrap_age_public_key }}"] - content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}" - mode: "0644" - force: true - with_community.general.filetree: ["../templates/kubernetes/"] - loop_control: - label: "{{ item.path }}" diff --git a/bootstrap/tasks/sops/main.yaml b/bootstrap/tasks/sops/main.yaml deleted file mode 100644 index 28a7b0b1..00000000 --- a/bootstrap/tasks/sops/main.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Template Sops configuration file - ansible.builtin.template: - src: "templates/.sops.yaml.j2" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - lstrip_blocks: true diff --git a/bootstrap/tasks/validation/cli.yaml b/bootstrap/tasks/validation/cli.yaml index 8c3ea04c..a1e53295 100644 --- a/bootstrap/tasks/validation/cli.yaml +++ b/bootstrap/tasks/validation/cli.yaml @@ -1,8 +1,8 @@ --- -- name: Check for required CLI tools +- name: Check if required CLI tools are present ansible.builtin.shell: | command -v {{ item }} >/dev/null 2>&1 - loop: [age, cloudflared, flux, sops, kubeconform, kustomize, jq] + loop: [age, cloudflared, flux, sops, jq] changed_when: false check_mode: false register: result diff --git a/bootstrap/tasks/validation/net.yaml b/bootstrap/tasks/validation/net.yaml index f65b862e..ea185afb 100644 --- a/bootstrap/tasks/validation/net.yaml +++ b/bootstrap/tasks/validation/net.yaml @@ -6,7 +6,7 @@ loop_control: label: "{{ item.address }}" -- name: Verify master node count +- name: Check that master node count is odd ansible.builtin.assert: that: - bootstrap_nodes.master | length > 0 @@ -14,27 +14,27 @@ success_msg: Master node count {{ bootstrap_nodes.master | length }} is correct. fail_msg: Master node count {{ bootstrap_nodes.master | length }} is not greater than 0 or is not odd. -- name: Verify node CIDR +- name: Check that node CIDR is ipv4 ansible.builtin.assert: that: bootstrap_node_cidr is ansible.utils.ipv4 success_msg: Node CIDR {{ bootstrap_node_cidr }} is valid. fail_msg: Node CIDR {{ bootstrap_node_cidr }} is invalid. -- name: Verify cluster CIDR is ipv4 OR ipv6 +- name: Check that cluster CIDR is ipv4 OR ipv6 when: not bootstrap_ipv6_enabled | default(false) ansible.builtin.assert: that: bootstrap_cluster_cidr is ansible.utils.ipv4 or bootstrap_cluster_cidr is ansible.utils.ipv6 success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid. fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid. -- name: Verify service CIDR is ipv4 OR ipv6 +- name: Check that service CIDR is ipv4 OR ipv6 when: not bootstrap_ipv6_enabled | default(false) ansible.builtin.assert: that: bootstrap_service_cidr is ansible.utils.ipv4 or bootstrap_service_cidr is ansible.utils.ipv6 success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid. fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid. -- name: Verify cluster CIDR is ipv4 AND ipv6 +- name: Check that cluster CIDR is ipv4 AND ipv6 when: bootstrap_ipv6_enabled | default(false) ansible.builtin.assert: that: > @@ -48,7 +48,7 @@ success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid. fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid. -- name: Verify service CIDR is ipv4 AND ipv6 +- name: Check that service CIDR is ipv4 AND ipv6 when: bootstrap_ipv6_enabled | default(false) ansible.builtin.assert: that: > @@ -62,67 +62,67 @@ success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid. fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid. -- name: Verify k8s_gateway +- name: Check that k8s_gateway is ipv4 ansible.builtin.assert: that: bootstrap_k8s_gateway_addr is ansible.utils.ipv4 success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is valid. fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is invalid. -- name: Verify k8s_gateway in node CIDR +- name: Check that k8s_gateway is in node CIDR ansible.builtin.assert: that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_k8s_gateway_addr) success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is within {{ bootstrap_node_cidr }}. fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is not within {{ bootstrap_node_cidr }}. -- name: Verify internal ingress +- name: Check that internal ingress is ipv4 ansible.builtin.assert: that: bootstrap_internal_ingress_addr is ansible.utils.ipv4 success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is valid. fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is invalid. -- name: Verify internal ingress in node CIDR +- name: Check that internal ingress is in node CIDR ansible.builtin.assert: that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_internal_ingress_addr) success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is within {{ bootstrap_node_cidr }}. fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is not within {{ bootstrap_node_cidr }}. -- name: Verify external ingress +- name: Check that external ingress is ipv4 ansible.builtin.assert: that: bootstrap_external_ingress_addr is ansible.utils.ipv4 success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is valid. fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is invalid. -- name: Verify external ingress in node CIDR +- name: Check external ingress is in node CIDR ansible.builtin.assert: that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_external_ingress_addr) success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is within {{ bootstrap_node_cidr }}. fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is not within {{ bootstrap_node_cidr }}. -- name: Verify kubeapi address +- name: Check that Kube API address is ipv4 ansible.builtin.assert: - that: bootstrap_kubeapi_addr is ansible.utils.ipv4 - success_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is valid. - fail_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is invalid. + that: bootstrap_kube_api_addr is ansible.utils.ipv4 + success_msg: Kube API address {{ bootstrap_kube_api_addr }} is valid. + fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is invalid. -- name: Verify kubeapi address in node CIDR +- name: Check that Kube API address is in node CIDR ansible.builtin.assert: - that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kubeapi_addr) - success_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is within {{ bootstrap_node_cidr }}. - fail_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is not within {{ bootstrap_node_cidr }}. + that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kube_api_addr) + success_msg: Kube API address {{ bootstrap_kube_api_addr }} is within {{ bootstrap_node_cidr }}. + fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is not within {{ bootstrap_node_cidr }}. -- name: Verify all IP addresses are unique +- name: Check that all IP addresses are unique ansible.builtin.assert: that: > [ bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, - bootstrap_kubeapi_addr + bootstrap_kube_api_addr ] | unique | length == 4 success_msg: All IP addresses are unique. fail_msg: All IP addresses are not unique. -- name: Verify nodes are not the same IPs as k8s_gateway or ingress external/internal +- name: Check that nodes are not the same IPs as k8s_gateway or ingress external/internal when: not bootstrap_kube_vip_enabled | default(true) ansible.builtin.assert: that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr) @@ -133,18 +133,18 @@ loop_control: label: "{{ item.address }}" -- name: Verify nodes are not the same IPs as k8s_gateway, ingress external/internal or kubeapi address +- name: Check that nodes are not the same IPs as k8s_gateway, ingress external/internal or Kube API address when: (bootstrap_distribution == "k3s") and (bootstrap_kube_vip_enabled | default(true)) ansible.builtin.assert: - that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kubeapi_addr) - success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or kubeapi. - fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or kubeapi. + that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kube_api_addr) + success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or Kube API. + fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or Kube API. quiet: true loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}" loop_control: label: "{{ item.address }}" -- name: Verify nodes are ipv4 +- name: Check that node addresses are ipv4 ansible.builtin.assert: that: item.address is ansible.utils.ipv4 success_msg: Node address {{ item.address }} is valid. @@ -154,7 +154,7 @@ loop_control: label: "{{ item.address }}" -- name: Verify nodes are in node CIDR +- name: Check that node addresses are in node CIDR ansible.builtin.assert: that: bootstrap_node_cidr | ansible.utils.network_in_usable(item.address) success_msg: Node address {{ item.address }} is within {{ bootstrap_node_cidr }}. @@ -165,7 +165,7 @@ loop_control: label: "{{ item.address }}" -- name: Verify node IP addresses are unique +- name: Check that node IP addresses are unique ansible.builtin.assert: that: > ( @@ -179,7 +179,7 @@ fail_msg: All node IP addresses are not unique. quiet: true -- name: Verify node names are unique +- name: Check that node names are unique ansible.builtin.assert: that: > ( @@ -193,7 +193,7 @@ fail_msg: All node names are not unique. quiet: true -- name: Verify SSH port is reachable +- name: Check that nodes SSH ports are reachable when: not ci_test | default(false) ansible.builtin.wait_for: host: "{{ current_address }}" diff --git a/bootstrap/tasks/validation/vars.yaml b/bootstrap/tasks/validation/vars.yaml index a8936bbd..e1cc9f16 100644 --- a/bootstrap/tasks/validation/vars.yaml +++ b/bootstrap/tasks/validation/vars.yaml @@ -1,5 +1,5 @@ --- -- name: Verify required bootstrap vars are set +- name: Check that required bootstrap vars are set ansible.builtin.assert: that: - item in vars @@ -25,13 +25,13 @@ - bootstrap_internal_ingress_addr - bootstrap_ipv6_enabled - bootstrap_k8s_gateway_addr - - bootstrap_kubeapi_addr + - bootstrap_kube_api_addr - bootstrap_local_storage_path - bootstrap_node_cidr - bootstrap_service_cidr - bootstrap_timezone -- name: Verify bootstrap node names are valid +- name: Check that bootstrap node names are valid ansible.builtin.assert: that: item.name is match('^[a-z0-9-\.]+$') success_msg: Node name {{ item.name }} is valid diff --git a/bootstrap/templates/.sops.yaml.j2 b/bootstrap/templates/.sops.yaml.j2 index 8a86fb3b..16a3a247 100644 --- a/bootstrap/templates/.sops.yaml.j2 +++ b/bootstrap/templates/.sops.yaml.j2 @@ -9,8 +9,3 @@ creation_rules: key_groups: - age: - "{{ bootstrap_age_public_key }}" - # https://github.com/ansible-collections/community.sops/issues/153 - - path_regex: /dev/stdin - key_groups: - - age: - - "{{ bootstrap_age_public_key }}" diff --git a/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2 deleted file mode 100644 index 73b61967..00000000 --- a/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2 +++ /dev/null @@ -1,35 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: kube-prometheus-stack -spec: - interval: 30m - timeout: 15m - chart: - spec: - chart: kube-prometheus-stack - version: 55.8.1 - sourceRef: - kind: HelmRepository - name: prometheus-community - namespace: flux-system - maxHistory: 2 - install: - crds: CreateReplace - remediation: - retries: 3 - upgrade: - cleanupOnFail: true - crds: CreateReplace - remediation: - retries: 3 - uninstall: - keepHistory: false - dependsOn: - - name: openebs - namespace: storage - valuesFrom: - - name: kube-prometheus-stack-values - kind: ConfigMap - valuesKey: values.yaml diff --git a/bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2 b/bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2 deleted file mode 100644 index dc39651b..00000000 --- a/bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2 +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmvalues.yaml - - ./helmrelease.yaml diff --git a/bootstrap/templates/addons/volsync/snapshot-controller/kustomization.yaml.j2 b/bootstrap/templates/addons/volsync/snapshot-controller/kustomization.yaml.j2 deleted file mode 100644 index 5dd7baca..00000000 --- a/bootstrap/templates/addons/volsync/snapshot-controller/kustomization.yaml.j2 +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helmrelease.yaml diff --git a/bootstrap/templates/ansible/shared/.ansible-lint.j2 b/bootstrap/templates/ansible/.ansible-lint.j2 similarity index 100% rename from bootstrap/templates/ansible/shared/.ansible-lint.j2 rename to bootstrap/templates/ansible/.ansible-lint.j2 diff --git a/bootstrap/templates/ansible/k3s/inventory/group_vars/kubernetes/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 similarity index 80% rename from bootstrap/templates/ansible/k3s/inventory/group_vars/kubernetes/main.yaml.j2 rename to bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 index 2275546c..0970907c 100644 --- a/bootstrap/templates/ansible/k3s/inventory/group_vars/kubernetes/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- # # Below vars are for the xanmanning.k3s role @@ -13,12 +14,12 @@ k3s_etcd_datastore: true {% else %} k3s_etcd_datastore: false {% endif %} -k3s_registration_address: "{% raw %}{{ kubeapi_addr }}{% endraw %}" +k3s_registration_address: "{% raw %}{{ kube_api_addr }}{% endraw %}" # /var/lib/rancher/k3s/server/manifests k3s_server_manifests_templates: - custom-cilium-helmchart.yaml.j2 - custom-coredns-helmchart.yaml.j2 -{% if bootstrap_kube_vip_enabled | default(true) %} +{% if bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %} # /var/lib/rancher/k3s/server/manifests k3s_server_manifests_urls: - url: https://raw.githubusercontent.com/kube-vip/website/main/content/manifests/rbac.yaml @@ -27,3 +28,4 @@ k3s_server_manifests_urls: k3s_server_pod_manifests_templates: - kube-vip-static-pod.yaml.j2 {% endif %} +{% endif %} diff --git a/bootstrap/templates/ansible/shared/inventory/group_vars/kubernetes/supplemental.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2 similarity index 60% rename from bootstrap/templates/ansible/shared/inventory/group_vars/kubernetes/supplemental.yaml.j2 rename to bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2 index d50ad3b5..e793b75d 100644 --- a/bootstrap/templates/ansible/shared/inventory/group_vars/kubernetes/supplemental.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2 @@ -1,8 +1,12 @@ --- timezone: "{{ bootstrap_timezone }}" github_username: "{{ bootstrap_github_username }}" -coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | ansible.utils.nthhost(10) }}" -kubeapi_addr: "{{ bootstrap_kubeapi_addr }}" +coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}" +{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %} +kube_api_addr: "{{ bootstrap_nodes.master[0].address }}" +{% else %} +kube_api_addr: "{{ bootstrap_kube_api_addr }}" +{% endif %} cluster_cidr: "{{ bootstrap_cluster_cidr.split(',')[0] }}" service_cidr: "{{ bootstrap_service_cidr.split(',')[0] }}" node_cidr: "{{ bootstrap_node_cidr }}" diff --git a/bootstrap/templates/ansible/k3s/inventory/group_vars/master/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 similarity index 89% rename from bootstrap/templates/ansible/k3s/inventory/group_vars/master/main.yaml.j2 rename to bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 index c428f1f2..051427c2 100644 --- a/bootstrap/templates/ansible/k3s/inventory/group_vars/master/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 @@ -1,16 +1,17 @@ +{% if bootstrap_distribution == 'k3s' %} --- # https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/ # https://github.com/PyratLabs/ansible-role-k3s k3s_control_node: true k3s_server: -{% if bootstrap_ipv6_enabled | default(false) %} + {% if bootstrap_ipv6_enabled | default(false) %} node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}" -{% else %} + {% else %} node-ip: "{% raw %}{{ ansible_host }}{% endraw %}" -{% endif %} + {% endif %} tls-san: - - "{% raw %}{{ kubeapi_addr }}{% endraw %}" + - "{% raw %}{{ kube_api_addr }}{% endraw %}" docker: false flannel-backend: "none" # This needs to be in quotes disable: @@ -26,13 +27,13 @@ k3s_server: write-kubeconfig-mode: "644" pause-image: registry.k8s.io/pause:3.9 secrets-encryption: true -{% if bootstrap_ipv6_enabled | default(false) %} + {% if bootstrap_ipv6_enabled | default(false) %} cluster-cidr: "{% raw %}{{ cluster_cidr }},{{ cluster_cidr_v6 }}{% endraw %}" service-cidr: "{% raw %}{{ service_cidr }},{{ service_cidr_v6 }}{% endraw %}" -{% else %} + {% else %} cluster-cidr: "{% raw %}{{ cluster_cidr }}{% endraw %}" service-cidr: "{% raw %}{{ service_cidr }}{% endraw %}" -{% endif %} + {% endif %} etcd-expose-metrics: true # Required to monitor etcd with kube-prometheus-stack kube-controller-manager-arg: - "bind-address=0.0.0.0" # Required to monitor kube-controller-manager with kube-prometheus-stack @@ -44,3 +45,4 @@ k3s_server: kubelet-arg: - "image-gc-high-threshold=55" - "image-gc-low-threshold=50" +{% endif %} diff --git a/bootstrap/templates/ansible/k3s/inventory/group_vars/worker/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 similarity index 80% rename from bootstrap/templates/ansible/k3s/inventory/group_vars/worker/main.yaml.j2 rename to bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 index 596203aa..6b3381a0 100644 --- a/bootstrap/templates/ansible/k3s/inventory/group_vars/worker/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 @@ -1,16 +1,18 @@ +{% if bootstrap_distribution == 'k3s' %} --- # https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/ # https://github.com/PyratLabs/ansible-role-k3s k3s_control_node: false k3s_agent: -{% if bootstrap_ipv6_enabled | default(false) %} + {% if bootstrap_ipv6_enabled | default(false) %} node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}" -{% else %} + {% else %} node-ip: "{% raw %}{{ ansible_host }}{% endraw %}" -{% endif %} + {% endif %} pause-image: registry.k8s.io/pause:3.9 # TODO: Move these options to a kubelet config file kubelet-arg: - "image-gc-high-threshold=55" - "image-gc-low-threshold=50" +{% endif %} diff --git a/bootstrap/templates/ansible/shared/inventory/hosts.yaml.j2 b/bootstrap/templates/ansible/inventory/hosts.yaml.j2 similarity index 100% rename from bootstrap/templates/ansible/shared/inventory/hosts.yaml.j2 rename to bootstrap/templates/ansible/inventory/hosts.yaml.j2 diff --git a/bootstrap/templates/ansible/k0s/.gitkeep.j2 b/bootstrap/templates/ansible/k0s/.gitkeep.j2 deleted file mode 100644 index e69de29b..00000000 diff --git a/bootstrap/templates/ansible/k3s/playbooks/cluster-installation.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 similarity index 97% rename from bootstrap/templates/ansible/k3s/playbooks/cluster-installation.yaml.j2 rename to bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 index 7df60846..fadf43d1 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/cluster-installation.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- - name: Cluster Installation hosts: kubernetes @@ -59,3 +60,4 @@ - name: Cruft when: k3s_primary_control_node ansible.builtin.include_tasks: tasks/cruft.yaml +{% endif %} diff --git a/bootstrap/templates/ansible/k3s/playbooks/cluster-kube-vip.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 similarity index 92% rename from bootstrap/templates/ansible/k3s/playbooks/cluster-kube-vip.yaml.j2 rename to bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 index 0b207262..d32d67ec 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/cluster-kube-vip.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- - name: Cluster kube-vip hosts: master @@ -22,3 +23,4 @@ src: templates/kube-vip-static-pod.yaml.j2 dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml" mode: preserve +{% endif %} diff --git a/bootstrap/templates/ansible/shared/playbooks/cluster-nuke.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 similarity index 100% rename from bootstrap/templates/ansible/shared/playbooks/cluster-nuke.yaml.j2 rename to bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 diff --git a/bootstrap/templates/ansible/shared/playbooks/cluster-prepare.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 similarity index 100% rename from bootstrap/templates/ansible/shared/playbooks/cluster-prepare.yaml.j2 rename to bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 diff --git a/bootstrap/templates/ansible/shared/playbooks/cluster-reboot.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2 similarity index 100% rename from bootstrap/templates/ansible/shared/playbooks/cluster-reboot.yaml.j2 rename to bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2 diff --git a/bootstrap/templates/ansible/shared/playbooks/cluster-rollout-update.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 similarity index 100% rename from bootstrap/templates/ansible/shared/playbooks/cluster-rollout-update.yaml.j2 rename to bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 diff --git a/bootstrap/templates/ansible/k3s/playbooks/tasks/cilium.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2 similarity index 96% rename from bootstrap/templates/ansible/k3s/playbooks/tasks/cilium.yaml.j2 rename to bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2 index ca242bb0..8aab1f2a 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/tasks/cilium.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- - name: Cilium block: @@ -54,3 +55,4 @@ definition: metadata: finalizers: [] +{% endif %} diff --git a/bootstrap/templates/ansible/k3s/playbooks/tasks/coredns.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2 similarity index 96% rename from bootstrap/templates/ansible/k3s/playbooks/tasks/coredns.yaml.j2 rename to bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2 index d18383a7..1ea755c2 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/tasks/coredns.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- - name: Coredns block: @@ -54,3 +55,4 @@ definition: metadata: finalizers: [] +{% endif %} diff --git a/bootstrap/templates/ansible/k3s/playbooks/tasks/cruft.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 similarity index 95% rename from bootstrap/templates/ansible/k3s/playbooks/tasks/cruft.yaml.j2 rename to bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 index 3a37c1a0..139c3728 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/tasks/cruft.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- # https://github.com/k3s-io/k3s/issues/1971 - name: Cruft @@ -30,3 +31,4 @@ namespace: kube-system state: absent loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}" +{% endif %} diff --git a/bootstrap/templates/ansible/k3s/playbooks/tasks/kubeconfig.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 similarity index 94% rename from bootstrap/templates/ansible/k3s/playbooks/tasks/kubeconfig.yaml.j2 rename to bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 index a3a0681a..f3671dc6 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/tasks/kubeconfig.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- - name: Get absolute path to this Git repository # noqa: command-instead-of-module ansible.builtin.command: git rev-parse --show-toplevel @@ -24,3 +25,4 @@ path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig" regexp: https://127.0.0.1:6443 replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443" +{% endif %} diff --git a/bootstrap/templates/ansible/k3s/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 b/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 similarity index 93% rename from bootstrap/templates/ansible/k3s/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 rename to bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 index 9f2f7f06..dab332e1 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- # https://docs.k3s.io/helm apiVersion: helm.cattle.io/v1 @@ -36,7 +37,7 @@ spec: ipv6: enabled: true {% endif %} - k8sServiceHost: "{% raw %}{{ kubeapi_addr }}{% endraw %}" + k8sServiceHost: "{% raw %}{{ kube_api_addr }}{% endraw %}" k8sServicePort: 6443 kubeProxyReplacement: true kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 @@ -61,3 +62,4 @@ spec: routingMode: native securityContext: privileged: true +{% endif %} diff --git a/bootstrap/templates/ansible/k3s/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 b/bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 similarity index 97% rename from bootstrap/templates/ansible/k3s/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 rename to bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 index cc04a63a..b39e7473 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' %} --- # https://docs.k3s.io/helm apiVersion: helm.cattle.io/v1 @@ -75,3 +76,4 @@ spec: labelSelector: matchLabels: app.kubernetes.io/instance: coredns +{% endif %} diff --git a/bootstrap/templates/ansible/k3s/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 b/bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 similarity index 88% rename from bootstrap/templates/ansible/k3s/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 rename to bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 index b7a5841e..c009009d 100644 --- a/bootstrap/templates/ansible/k3s/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 +++ b/bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k3s' and bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %} --- apiVersion: v1 kind: Pod @@ -15,7 +16,7 @@ spec: args: ["manager"] env: - name: address - value: "{% raw %}{{ kubeapi_addr }}{% endraw %}" + value: "{% raw %}{{ kube_api_addr }}{% endraw %}" - name: vip_arp value: "true" - name: lb_enable @@ -57,3 +58,4 @@ spec: - name: kubeconfig hostPath: path: /etc/rancher/k3s/k3s.yaml +{% endif %} diff --git a/bootstrap/templates/ansible/shared/inventory/host_vars/.gitkeep.j2 b/bootstrap/templates/ansible/shared/inventory/host_vars/.gitkeep.j2 deleted file mode 100644 index e69de29b..00000000 diff --git a/bootstrap/templates/k0s/k0s-config.yaml.j2 b/bootstrap/templates/k0s-config.yaml.j2 similarity index 90% rename from bootstrap/templates/k0s/k0s-config.yaml.j2 rename to bootstrap/templates/k0s-config.yaml.j2 index 152af7d9..17cf44bf 100644 --- a/bootstrap/templates/k0s/k0s-config.yaml.j2 +++ b/bootstrap/templates/k0s-config.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == 'k0s' %} --- apiVersion: k0sctl.k0sproject.io/v1beta1 kind: Cluster @@ -42,12 +43,12 @@ spec: bind-address: "0.0.0.0" api: sans: - - {{ bootstrap_kubeapi_addr }} + - {{ bootstrap_kube_api_addr }} {% if bootstrap_kubeapi_hostname is defined %} - {{ bootstrap_kubeapi_hostname }} {% endif %} {% for item in bootstrap_nodes.master %} - {% if item.address != bootstrap_kubeapi_addr %} + {% if item.address != bootstrap_kube_api_addr %} - {{ item.address }} {% endif %} {% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %} @@ -89,7 +90,11 @@ spec: ipv6: enabled: true {% endif %} - k8sServiceHost: "{{ bootstrap_kubeapi_addr }}" + {% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %} + k8sServiceHost: {{ bootstrap_nodes.master[0].address }} + {% else %} + k8sServiceHost: {{ bootstrap_kube_api_addr }} + {% endif %} k8sServicePort: 6443 kubeProxyReplacement: true kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 @@ -123,3 +128,4 @@ spec: type: EnvoyProxy {% endif %} provider: custom +{% endif %} diff --git a/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2 similarity index 95% rename from bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2 index ec1426be..08307551 100644 --- a/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if discord_template_notifier.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -61,3 +62,4 @@ spec: - path: /data/config.toml subPath: config.toml readOnly: true +{% endif %} diff --git a/bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2 similarity index 63% rename from bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2 index 95bf4747..f348cf59 100644 --- a/bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2 @@ -1,6 +1,8 @@ +{% if discord_template_notifier.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./secret.sops.yaml - ./helmrelease.yaml +{% endif %} diff --git a/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2 similarity index 83% rename from bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2 index 12759d18..a00d9968 100644 --- a/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2 @@ -1,3 +1,4 @@ +{% if discord_template_notifier.enabled | default(false) %} --- apiVersion: v1 kind: Secret @@ -12,3 +13,4 @@ stringData: retry_limit = 5 sink.type = "discord" sink.url = "{{ discord_template_notifier.webhook_url }}" +{% endif %} diff --git a/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2 similarity index 86% rename from bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2 index 0b333f3c..bf850a48 100644 --- a/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if discord_template_notifier.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -18,3 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/addons/homepage/app/configmap.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2 similarity index 97% rename from bootstrap/templates/addons/homepage/app/configmap.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2 index b58b2ca9..f6d813ee 100644 --- a/bootstrap/templates/addons/homepage/app/configmap.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2 @@ -1,3 +1,4 @@ +{% if homepage.enabled | default(false) %} --- apiVersion: v1 kind: ConfigMap @@ -75,3 +76,4 @@ data: dateStyle: long timeStyle: short hourCycle: h23 +{% endif %} diff --git a/bootstrap/templates/addons/homepage/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2 similarity index 97% rename from bootstrap/templates/addons/homepage/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2 index 70f6ac65..9a4c75fe 100644 --- a/bootstrap/templates/addons/homepage/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if homepage.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -86,3 +87,4 @@ spec: path: /app/config/widgets.yaml serviceAccount: create: true +{% endif %} diff --git a/bootstrap/templates/addons/homepage/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2 similarity index 72% rename from bootstrap/templates/addons/homepage/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2 index c1a01c52..1c79d4b3 100644 --- a/bootstrap/templates/addons/homepage/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2 @@ -1,3 +1,4 @@ +{% if homepage.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization @@ -5,3 +6,4 @@ resources: - ./configmap.yaml - ./helmrelease.yaml - ./secret.sops.yaml +{% endif %} diff --git a/bootstrap/templates/addons/homepage/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2 similarity index 87% rename from bootstrap/templates/addons/homepage/app/secret.sops.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2 index 609cb953..51a388fe 100644 --- a/bootstrap/templates/addons/homepage/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2 @@ -1,3 +1,4 @@ +{% if homepage.enabled | default(false) %} --- apiVersion: v1 kind: Secret @@ -9,3 +10,4 @@ stringData: HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "{{ bootstrap_cloudflare_token }}" HOMEPAGE_VAR_GRAFANA_USERNAME: admin HOMEPAGE_VAR_GRAFANA_PASSWORD: "{{ grafana.password }}" +{% endif %} diff --git a/bootstrap/templates/addons/homepage/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2 similarity index 88% rename from bootstrap/templates/addons/homepage/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2 index 6466cb56..c6639208 100644 --- a/bootstrap/templates/addons/homepage/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if homepage.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -18,3 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2 similarity index 95% rename from bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2 index 04ecff6c..ccbd0665 100644 --- a/bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if weave_gitops.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -55,3 +56,4 @@ spec: impersonationResourceNames: ["admin"] podAnnotations: secret.reloader.stakater.com/reload: cluster-user-auth +{% endif %} diff --git a/bootstrap/templates/addons/grafana/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2 similarity index 67% rename from bootstrap/templates/addons/grafana/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2 index 95bf4747..9ea8bd8f 100644 --- a/bootstrap/templates/addons/grafana/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2 @@ -1,6 +1,8 @@ +{% if weave_gitops.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./secret.sops.yaml - ./helmrelease.yaml +{% endif %} diff --git a/bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2 similarity index 50% rename from bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2 index 22486957..8205ebcc 100644 --- a/bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2 @@ -1,3 +1,4 @@ +{% if weave_gitops.enabled | default(false) %} --- apiVersion: v1 kind: Secret @@ -6,4 +7,5 @@ metadata: type: Opaque stringData: username: admin - password: "{{ weave_gitops.password | password_hash('bcrypt', rounds=10) }}" + password: "{{ weave_gitops.password | encrypt }}" +{% endif %} diff --git a/bootstrap/templates/addons/weave-gitops/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2 similarity index 87% rename from bootstrap/templates/addons/weave-gitops/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2 index 9a2bd272..1709f1c4 100644 --- a/bootstrap/templates/addons/weave-gitops/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if weave_gitops.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -18,3 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 index c1346bea..eb89e3ab 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 @@ -23,7 +23,112 @@ spec: retries: 3 uninstall: keepHistory: false - valuesFrom: - - name: cilium-values - kind: ConfigMap - valuesKey: values.yaml + values: + autoDirectNodeRoutes: true + bpf: + masquerade: true + bgp: + enabled: false + cluster: + name: home-cluster + id: 1 + containerRuntime: + integration: containerd + {% if bootstrap_distribution == "k3s" %} + socketPath: /var/run/k3s/containerd/containerd.sock + {% else %} + socketPath: /var/run/k0s/containerd.sock + {% endif %} + endpointRoutes: + enabled: true + hubble: + enabled: true + metrics: + enabled: + - dns:query + - drop + - tcp + - flow + - port-distribution + - icmp + - http + serviceMonitor: + enabled: true + dashboards: + enabled: true + annotations: + grafana_folder: Cilium + relay: + enabled: true + rollOutPods: true + prometheus: + serviceMonitor: + enabled: true + ui: + enabled: true + rollOutPods: true + ingress: + enabled: true + className: internal + {% if homepage.enabled | default(false) %} + annotations: + gethomepage.dev/enabled: "true" + gethomepage.dev/group: Network + gethomepage.dev/name: Cilium + gethomepage.dev/icon: cilium.png + {% endif %} + hosts: + - "hubble.${SECRET_DOMAIN}" + tls: + - hosts: + - "hubble.${SECRET_DOMAIN}" + ipam: + mode: kubernetes + ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}" + {% if bootstrap_ipv6_enabled | default(false) %} + ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}" + ipv6: + enabled: true + {% endif %} + k8sServiceHost: "${KUBE_API_ADDR}" + k8sServicePort: 6443 + kubeProxyReplacement: true + kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 + l2announcements: + {% if bootstrap_ipv6_enabled | default(false) %} + enabled: false + {% else %} + enabled: true + # https://github.com/cilium/cilium/issues/26586 + leaseDuration: 120s + leaseRenewDeadline: 60s + leaseRetryPeriod: 1s + {% endif %} + loadBalancer: + algorithm: maglev + mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }} + localRedirectPolicy: true + operator: + replicas: 1 + rollOutPods: true + prometheus: + enabled: true + serviceMonitor: + enabled: true + dashboards: + enabled: true + annotations: + grafana_folder: Cilium + prometheus: + enabled: true + serviceMonitor: + enabled: true + trustCRDsExist: true + dashboards: + enabled: true + annotations: + grafana_folder: Cilium + rollOutCiliumPods: true + routingMode: native + securityContext: + privileged: true diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2 deleted file mode 100644 index 713b0a9c..00000000 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2 +++ /dev/null @@ -1,115 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: cilium-values -data: - values.yaml: | - autoDirectNodeRoutes: true - bpf: - masquerade: true - bgp: - enabled: false - cluster: - name: home-cluster - id: 1 - containerRuntime: - integration: containerd - {% if bootstrap_distribution == "k3s" %} - socketPath: /var/run/k3s/containerd/containerd.sock - {% else %} - socketPath: /var/run/k0s/containerd.sock - {% endif %} - endpointRoutes: - enabled: true - hubble: - enabled: true - metrics: - enabled: - - dns:query - - drop - - tcp - - flow - - port-distribution - - icmp - - http - serviceMonitor: - enabled: true - dashboards: - enabled: true - annotations: - grafana_folder: Cilium - relay: - enabled: true - rollOutPods: true - prometheus: - serviceMonitor: - enabled: true - ui: - enabled: true - rollOutPods: true - ingress: - enabled: true - className: internal - {% if homepage.enabled | default(false) %} - annotations: - gethomepage.dev/enabled: "true" - gethomepage.dev/group: Network - gethomepage.dev/name: Cilium - gethomepage.dev/icon: cilium.png - {% endif %} - hosts: - - "hubble.${SECRET_DOMAIN}" - tls: - - hosts: - - "hubble.${SECRET_DOMAIN}" - ipam: - mode: kubernetes - ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}" - {% if bootstrap_ipv6_enabled | default(false) %} - ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}" - ipv6: - enabled: true - {% endif %} - k8sServiceHost: "${KUBEAPI_ADDR}" - k8sServicePort: 6443 - kubeProxyReplacement: true - kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 - l2announcements: - {% if bootstrap_ipv6_enabled | default(false) %} - enabled: false - {% else %} - enabled: true - # https://github.com/cilium/cilium/issues/26586 - leaseDuration: 120s - leaseRenewDeadline: 60s - leaseRetryPeriod: 1s - {% endif %} - loadBalancer: - algorithm: maglev - mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }} - localRedirectPolicy: true - operator: - replicas: 1 - rollOutPods: true - prometheus: - enabled: true - serviceMonitor: - enabled: true - dashboards: - enabled: true - annotations: - grafana_folder: Cilium - prometheus: - enabled: true - serviceMonitor: - enabled: true - trustCRDsExist: true - dashboards: - enabled: true - annotations: - grafana_folder: Cilium - rollOutCiliumPods: true - routingMode: native - securityContext: - privileged: true diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 index 5507b29b..66720237 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 @@ -5,5 +5,4 @@ resources: {% if not bootstrap_ipv6_enabled | default(false) %} - ./cilium-l2.yaml {% endif %} - - ./helmvalues.yaml - ./helmrelease.yaml diff --git a/bootstrap/templates/addons/coredns/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 similarity index 97% rename from bootstrap/templates/addons/coredns/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 index c3ec35c4..c91a6580 100644 --- a/bootstrap/templates/addons/coredns/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == "k3s" %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -86,3 +87,4 @@ spec: labelSelector: matchLabels: app.kubernetes.io/instance: coredns +{% endif %} diff --git a/bootstrap/templates/addons/coredns/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 similarity index 65% rename from bootstrap/templates/addons/coredns/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 index 5dd7baca..56987a5f 100644 --- a/bootstrap/templates/addons/coredns/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 @@ -1,5 +1,7 @@ +{% if bootstrap_distribution == "k3s" %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./helmrelease.yaml +{% endif %} diff --git a/bootstrap/templates/addons/coredns/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2 similarity index 89% rename from bootstrap/templates/addons/coredns/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2 index bf2a537e..52c45fda 100644 --- a/bootstrap/templates/addons/coredns/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == "k3s" %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -18,3 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2 similarity index 99% rename from bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2 index 0c5f1f7e..36378f52 100644 --- a/bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if grafana.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -180,3 +181,4 @@ spec: storageClassName: openebs-hostpath testFramework: enabled: false +{% endif %} diff --git a/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2 similarity index 69% rename from bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2 index 95bf4747..5bfd1ad9 100644 --- a/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2 @@ -1,6 +1,8 @@ +{% if grafana.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./secret.sops.yaml - ./helmrelease.yaml +{% endif %} diff --git a/bootstrap/templates/addons/grafana/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2 similarity index 73% rename from bootstrap/templates/addons/grafana/app/secret.sops.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2 index c776a17c..166df58f 100644 --- a/bootstrap/templates/addons/grafana/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2 @@ -1,3 +1,4 @@ +{% if grafana.enabled | default(false) %} --- apiVersion: v1 kind: Secret @@ -6,3 +7,4 @@ metadata: stringData: admin-user: admin admin-password: "{{ grafana.password }}" +{% endif %} diff --git a/bootstrap/templates/addons/grafana/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2 similarity index 88% rename from bootstrap/templates/addons/grafana/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2 index 26408f2b..1be75cc0 100644 --- a/bootstrap/templates/addons/grafana/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if grafana.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -18,3 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/addons/kube-prometheus-stack/app/helmvalues.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2 similarity index 91% rename from bootstrap/templates/addons/kube-prometheus-stack/app/helmvalues.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2 index 92f02399..6fc9af8d 100644 --- a/bootstrap/templates/addons/kube-prometheus-stack/app/helmvalues.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2 @@ -1,10 +1,36 @@ +{% if kube_prometheus_stack.enabled | default(false) %} --- -apiVersion: v1 -kind: ConfigMap +apiVersion: helm.toolkit.fluxcd.io/v2beta2 +kind: HelmRelease metadata: - name: kube-prometheus-stack-values -data: - values.yaml: | + name: kube-prometheus-stack +spec: + interval: 30m + timeout: 15m + chart: + spec: + chart: kube-prometheus-stack + version: 55.8.1 + sourceRef: + kind: HelmRepository + name: prometheus-community + namespace: flux-system + maxHistory: 2 + install: + crds: CreateReplace + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + crds: CreateReplace + remediation: + retries: 3 + uninstall: + keepHistory: false + dependsOn: + - name: openebs + namespace: storage + values: crds: enabled: true cleanPrometheusOperatorObjectNames: true @@ -138,3 +164,4 @@ data: multicluster: etcd: enabled: true +{% endif %} diff --git a/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2 new file mode 100644 index 00000000..b39665b5 --- /dev/null +++ b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2 @@ -0,0 +1,7 @@ +{% if kube_prometheus_stack.enabled | default(false) %} +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./helmrelease.yaml +{% endif %} diff --git a/bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2 similarity index 86% rename from bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2 index f84c6a34..1115147f 100644 --- a/bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if kube_prometheus_stack.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -18,3 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2 similarity index 94% rename from bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2 index c783875f..64852bd6 100644 --- a/bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if kubernetes_dashboard.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -45,3 +46,4 @@ spec: - *host metricsScraper: enabled: true +{% endif %} diff --git a/bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2 similarity index 63% rename from bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2 index b5b97586..d3f65a09 100644 --- a/bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2 @@ -1,6 +1,8 @@ +{% if kubernetes_dashboard.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./rbac.yaml - ./helmrelease.yaml +{% endif %} diff --git a/bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2 similarity index 94% rename from bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2 index 831de090..61b2370c 100644 --- a/bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2 @@ -1,3 +1,4 @@ +{% if kubernetes_dashboard.enabled | default(false) %} # For dashboard sign in token: # kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d --- @@ -37,3 +38,4 @@ subjects: - kind: ServiceAccount name: kubernetes-dashboard namespace: observability +{% endif %} diff --git a/bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2 similarity index 88% rename from bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2 index ca65d7c2..fba05fc7 100644 --- a/bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if kubernetes_dashboard.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -21,3 +22,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2 similarity index 89% rename from bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2 index 110011a7..07ef8a41 100644 --- a/bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if csi_driver_nfs.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -26,3 +27,4 @@ spec: values: externalSnapshotter: enabled: false +{% endif %} diff --git a/bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2 similarity index 67% rename from bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2 index 70fd2032..cfd3c552 100644 --- a/bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2 @@ -1,6 +1,8 @@ +{% if csi_driver_nfs.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./helmrelease.yaml - ./storageclass.yaml +{% endif %} diff --git a/bootstrap/templates/addons/csi-driver-nfs/app/storageclass.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2 similarity index 84% rename from bootstrap/templates/addons/csi-driver-nfs/app/storageclass.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2 index aed4d0ca..ffa9b1ab 100644 --- a/bootstrap/templates/addons/csi-driver-nfs/app/storageclass.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2 @@ -1,3 +1,4 @@ +{% if csi_driver_nfs.enabled | default(false) %} {% for item in csi_driver_nfs.storage_class %} --- apiVersion: storage.k8s.io/v1 @@ -12,3 +13,4 @@ reclaimPolicy: Delete volumeBindingMode: Immediate mountOptions: ["hard", "noatime"] {% endfor %} +{% endif %} diff --git a/bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2 similarity index 87% rename from bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2 index 13b49712..521ff4bb 100644 --- a/bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if csi_driver_nfs.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -18,3 +19,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2 index 70ccf364..821b1a39 100644 --- a/bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2 @@ -4,7 +4,7 @@ kind: Kustomization resources: - ./namespace.yaml - ./openebs/ks.yaml - {% if volsync.enabled | default(false) %} + {% if volsync.enabled | default(false) %} - ./volsync/ks.yaml {% endif %} {% if csi_driver_nfs.enabled | default(false) %} diff --git a/bootstrap/templates/addons/volsync/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2 similarity index 93% rename from bootstrap/templates/addons/volsync/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2 index 0ba4ca82..43f47c33 100644 --- a/bootstrap/templates/addons/volsync/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if volsync.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -40,3 +41,4 @@ spec: tag: *tag metrics: disableAuth: true +{% endif %} diff --git a/bootstrap/templates/addons/volsync/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2 similarity index 70% rename from bootstrap/templates/addons/volsync/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2 index 8ae52667..a707abb9 100644 --- a/bootstrap/templates/addons/volsync/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2 @@ -1,6 +1,8 @@ +{% if volsync.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./helmrelease.yaml - ./prometheusrule.yaml +{% endif %} diff --git a/bootstrap/templates/addons/volsync/app/prometheusrule.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2 similarity index 92% rename from bootstrap/templates/addons/volsync/app/prometheusrule.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2 index 9d677c5f..f3821a78 100644 --- a/bootstrap/templates/addons/volsync/app/prometheusrule.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2 @@ -1,3 +1,4 @@ +{% if volsync.enabled | default(false) %} --- apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule @@ -21,3 +22,4 @@ spec: for: 15m labels: severity: critical +{% endif %} diff --git a/bootstrap/templates/addons/volsync/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2 similarity index 93% rename from bootstrap/templates/addons/volsync/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2 index 7e4bfd1e..e6f5cce6 100644 --- a/bootstrap/templates/addons/volsync/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if volsync.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -38,3 +39,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/addons/volsync/snapshot-controller/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2 similarity index 91% rename from bootstrap/templates/addons/volsync/snapshot-controller/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2 index 5207dd5a..f5ee82db 100644 --- a/bootstrap/templates/addons/volsync/snapshot-controller/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if volsync.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -31,3 +32,4 @@ spec: create: true webhook: enabled: false +{% endif %} diff --git a/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2 new file mode 100644 index 00000000..b98d2ab2 --- /dev/null +++ b/bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2 @@ -0,0 +1,7 @@ +{% if volsync.enabled | default(false) %} +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./helmrelease.yaml +{% endif %} diff --git a/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2 similarity index 96% rename from bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2 index aae67a2e..151ed1e5 100644 --- a/bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} --- apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease @@ -102,3 +103,4 @@ spec: globalMounts: - path: /etc/ca-certificates readOnly: true +{% endif %} diff --git a/bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2 similarity index 72% rename from bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2 index 74d66703..fb64b7fa 100644 --- a/bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization @@ -6,3 +7,4 @@ resources: - https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.2/crd.yaml - helmrelease.yaml - rbac.yaml +{% endif %} diff --git a/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2 similarity index 71% rename from bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2 rename to bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2 index 17fee325..c3cc284f 100644 --- a/bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -11,3 +12,4 @@ subjects: - kind: ServiceAccount name: system-upgrade namespace: tools +{% endif %} diff --git a/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2 similarity index 89% rename from bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2 index 3d05ac51..c6887d83 100644 --- a/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} --- apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization @@ -40,3 +41,4 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +{% endif %} diff --git a/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2 similarity index 80% rename from bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2 rename to bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2 index dcbd38db..22ba86b9 100644 --- a/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} --- apiVersion: upgrade.cattle.io/v1 kind: Plan @@ -16,3 +17,4 @@ spec: args: ["prepare", "server"] upgrade: image: rancher/k3s-upgrade +{% endif %} diff --git a/bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2 similarity index 51% rename from bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2 index 2a658c35..6a9bfce9 100644 --- a/bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2 @@ -1,6 +1,8 @@ +{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./server.yaml - ./agent.yaml +{% endif %} diff --git a/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2 b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2 similarity index 87% rename from bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2 rename to bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2 index 773883ce..8963956f 100644 --- a/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2 @@ -1,3 +1,4 @@ +{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %} --- apiVersion: upgrade.cattle.io/v1 kind: Plan @@ -21,3 +22,4 @@ spec: - {key: CriticalAddonsOnly, operator: Exists} upgrade: image: rancher/k3s-upgrade +{% endif %} diff --git a/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 b/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 index b7632dad..d9f26da9 100644 --- a/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 @@ -6,8 +6,12 @@ metadata: namespace: flux-system data: TIMEZONE: "{{ bootstrap_timezone }}" - COREDNS_ADDR: "{{ bootstrap_service_cidr.split(',')[0] | ansible.utils.nthhost(10) }}" - KUBEAPI_ADDR: "{{ bootstrap_kubeapi_addr }}" + COREDNS_ADDR: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}" + {% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %} + KUBE_API_ADDR: "{{ bootstrap_nodes.master[0].address }}" + {% else %} + KUBE_API_ADDR: "{{ bootstrap_kube_api_addr }}" + {% endif %} CLUSTER_CIDR: "{{ bootstrap_cluster_cidr.split(',')[0] }}" SERVICE_CIDR: "{{ bootstrap_service_cidr.split(',')[0] }}" NODE_CIDR: "{{ bootstrap_node_cidr }}" diff --git a/bootstrap/validate.yaml b/bootstrap/validate.yaml new file mode 100644 index 00000000..f0627c9d --- /dev/null +++ b/bootstrap/validate.yaml @@ -0,0 +1,45 @@ +--- +- name: Cluster Installation + hosts: localhost + connection: local + gather_facts: false + vars_files: + - vars/config.yaml + - vars/addons.yaml + tasks: + - name: Get absolute path to this Git repository # noqa: command-instead-of-module + ansible.builtin.command: git rev-parse --show-toplevel + changed_when: false + check_mode: false + register: repository + failed_when: repository.rc != 0 + + - name: Set facts + ansible.builtin.set_fact: + repository_path: "{{ repository.stdout }}" + + - name: Override Kube API address when there is a single master node and no address is defined + when: bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr + ansible.builtin.set_fact: + bootstrap_kube_vip_enabled: false + bootstrap_kube_api_addr: "{{ bootstrap_nodes.master[0].address }}" + + - name: Verify configuration + ansible.builtin.include_tasks: tasks/validation/main.yaml + + # - name: Template Sops configuration + # ansible.builtin.include_tasks: tasks/sops/main.yaml + + # - name: Template k0s configuration + # when: bootstrap_distribution == "k0s" + # ansible.builtin.include_tasks: tasks/k0s/main.yaml + + # - name: Template Ansible configuration + # when: bootstrap_distribution == "k0s" or bootstrap_distribution == "k3s" + # ansible.builtin.include_tasks: tasks/ansible/main.yaml + + # - name: Template Kubernetes configuration + # ansible.builtin.include_tasks: tasks/kubernetes/main.yaml + + # - name: Template Kubernetes addon configuration + # ansible.builtin.include_tasks: tasks/addons/main.yaml diff --git a/bootstrap/vars/config.sample.yaml b/bootstrap/vars/config.sample.yaml index 57187651..19d63bb7 100644 --- a/bootstrap/vars/config.sample.yaml +++ b/bootstrap/vars/config.sample.yaml @@ -42,13 +42,13 @@ bootstrap_cloudflare_tunnel_id: # CIDR your nodes are on (e.g. 192.168.1.0/24) bootstrap_node_cidr: -# The IP address of the kubeapi, choose an available IP in your nodes network that is not being used +# The IP address of the Kube API, choose an available IP in your nodes network that is not being used # (Optional) Leave this blank if you are deploying a single master node, this will disable kube-vip in k3s # or keepalived in k0s and use the master node IP instead -bootstrap_kubeapi_addr: -# The hostname of the kubeapi, set this if you intend to call the kubeapi by hostname rather than IP -# (Optional) This is currently only utilized in k0s and is added to the kubeapi cert sans -#bootstrap_kubeapi_hostname: +bootstrap_kube_api_addr: +# The hostname of the Kube API, set this if you intend to call the Kube API by hostname rather than IP +# (Optional) This is currently only utilized in k0s and is added to the Kube API cert sans +# bootstrap_kubeapi_hostname: # The Load balancer IP for k8s_gateway, choose an available IP in your nodes network that is not being used bootstrap_k8s_gateway_addr: # The Load balancer IP for external ingress, choose an available IP in your nodes network that is not being used @@ -81,7 +81,7 @@ bootstrap_nodes: # - name: # name or hostname of the master node (must match [a-z0-9-\.]+) # address: # ip address of the master node # username: # ssh username of the master node - # role: # (Optional) k0s only: can be controller+worker (default) or controller + # role: # (Optional) k0s only: can be controller+worker (default) or controller # # external_address: # (Optional) k3s only: Only use when SSH is not reachable on the IP specified in 'address' field # ... worker: # set to [] or omit if no workers are needed @@ -90,4 +90,3 @@ bootstrap_nodes: # username: # ssh username of the worker node # # external_address: # (Optional) k3s only: Only use when SSH is not reachable on the IP specified in 'address' field # ... - diff --git a/requirements.txt b/requirements.txt index cc984b40..24fa362e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,6 +3,7 @@ ansible-lint==6.22.1 # https://github.com/pyca/bcrypt/issues/684 bcrypt==4.1.2 jmespath==1.0.1 +makejinja==2.3.3 netaddr==0.10.1 openshift==0.13.2 passlib==1.7.4 diff --git a/requirements.yaml b/requirements.yaml index 637b1ec3..50ef6d72 100644 --- a/requirements.yaml +++ b/requirements.yaml @@ -6,8 +6,6 @@ collections: version: 3.0.0 - name: community.general version: 8.2.0 - - name: community.sops - version: 1.6.7 - name: kubernetes.core version: 3.0.0 roles: