feat: replace ansible templating with makejinja (#1156)

bootstrap/tasks/addons/coredns.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: coredns
-    addon_namespace: kube-system
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/csi_driver_nfs.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: csi-driver-nfs
-    addon_namespace: storage
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/discord_template_notifier.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: discord-template-notifier
-    addon_namespace: default
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/grafana.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: grafana
-    addon_namespace: observability
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/homepage.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: homepage
-    addon_namespace: default
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/kube_prometheus_stack.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: kube-prometheus-stack
-    addon_namespace: observability
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/kubernetes_dashboard.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: kubernetes-dashboard
-    addon_namespace: observability
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/main.yaml

@@ -1,43 +0,0 @@
----
-
-- name: Process optional coredns
-  when: bootstrap_distribution == "k3s"
-  ansible.builtin.include_tasks: coredns.yaml
-
-- name: Process addon csi-driver-nfs
-  when: csi_driver_nfs.enabled | default(false)
-  ansible.builtin.include_tasks: csi_driver_nfs.yaml
-
-- name: Process addon homepage
-  when: homepage.enabled | default(false)
-  ansible.builtin.include_tasks: homepage.yaml
-
-- name: Process addon grafana
-  when: grafana.enabled | default(false)
-  ansible.builtin.include_tasks: grafana.yaml
-
-- name: Process addon kubernetes-dashboard
-  when: kubernetes_dashboard.enabled | default(false)
-  ansible.builtin.include_tasks: kubernetes_dashboard.yaml
-
-- name: Process addon kube-prometheus-stack
-  when: kube_prometheus_stack.enabled | default(false)
-  ansible.builtin.include_tasks: kube_prometheus_stack.yaml
-
-- name: Process addon system-upgrade-controller
-  when:
-    - bootstrap_distribution == "k3s"
-    - system_upgrade_controller.enabled | default(false)
-  ansible.builtin.include_tasks: system_upgrade_controller.yaml
-
-- name: Process addon weave-gitops
-  when: weave_gitops.enabled | default(false)
-  ansible.builtin.include_tasks: weave_gitops.yaml
-
-- name: Process addon discord-template-notifier
-  when: discord_template_notifier.enabled | default(false)
-  ansible.builtin.include_tasks: discord_template_notifier.yaml
-
-- name: Process addon volsync
-  when: volsync.enabled | default(false)
-  ansible.builtin.include_tasks: volsync.yaml

bootstrap/tasks/addons/system_upgrade_controller.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: system-upgrade-controller
-    addon_namespace: tools
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/volsync.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: volsync
-    addon_namespace: storage
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/weave_gitops.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: weave-gitops
-    addon_namespace: flux-system
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/ansible/main.yaml

@@ -1,45 +0,0 @@
----
-- name: Ensure Ansible k3s directories exist
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/ansible/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree:
-    - "../templates/ansible/shared/"
-    - "../templates/ansible/{{ bootstrap_distribution }}/"
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template Ansible unencrypted files
-  when:
-    - "item.state == 'file'"
-    - "'sops' not in item.path"
-    - "'.DS_Store' not in item.path"
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/ansible/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree:
-    - "../templates/ansible/shared/"
-    - "../templates/ansible/{{ bootstrap_distribution }}/"
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template Ansible encrypted files
-  when:
-    - "item.state == 'file'"
-    - "'sops' in item.path"
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/ansible/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree:
-    - "../templates/ansible/shared/"
-    - "../templates/ansible/{{ bootstrap_distribution }}/"
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/k0s/main.yaml

@@ -1,7 +0,0 @@
----
-- name: Template k0s configuration file
-  ansible.builtin.template:
-    src: "templates/k0s/k0s-config.yaml.j2"
-    dest: "{{ repository_path }}/k0s-config.yaml"
-    mode: "0644"
-    lstrip_blocks: true

bootstrap/tasks/kubernetes/main.yaml

@@ -1,79 +0,0 @@
----
-- name: Ensure Kubernetes directories exist
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template Kubernetes unencrypted files
-  when:
-    - "item.state == 'file'"
-    - "'.DS_Store' not in item.path"
-    - "'sops' not in item.path"
-    - "'cluster-settings-user.yaml.j2' not in item.path"
-    - "'cluster-secrets-user.yaml.j2' not in item.path"
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Check if the cluster user settings file already exists
-  stat:
-    path: "{{ repository_path }}/kubernetes/flux/vars/cluster-settings-user.yaml"
-  register: cluster_settings_user
-
-- name: Template Kubernetes user cluster settings
-  when:
-    - "item.state == 'file'"
-    - "'cluster-settings-user.yaml' in item.path"
-    - "not cluster_settings_user.stat.exists"
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Check if the cluster user secrets file already exists
-  stat:
-    path: "{{ repository_path }}/kubernetes/flux/vars/cluster-secrets-user.yaml"
-  register: cluster_secrets_user
-
-- name: Template Kubernetes user cluster secrets
-  when:
-    - "item.state == 'file'"
-    - "'cluster-secrets-user.yaml' in item.path"
-    - "not cluster_secrets_user.stat.exists"
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template Kubernetes encrypted files
-  when:
-    - "item.state == 'file'"
-    - "'sops' in item.path"
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/sops/main.yaml

@@ -1,7 +0,0 @@
----
-- name: Template Sops configuration file
-  ansible.builtin.template:
-    src: "templates/.sops.yaml.j2"
-    dest: "{{ repository_path }}/.sops.yaml"
-    mode: "0644"
-    lstrip_blocks: true

bootstrap/tasks/validation/cli.yaml

@@ -1,8 +1,8 @@
 ---
-- name: Check for required CLI tools
+- name: Check if required CLI tools are present
   ansible.builtin.shell: |
     command -v {{ item }} >/dev/null 2>&1
-  loop: [age, cloudflared, flux, sops, kubeconform, kustomize, jq]
+  loop: [age, cloudflared, flux, sops, jq]
   changed_when: false
   check_mode: false
   register: result

bootstrap/tasks/validation/net.yaml

@@ -6,7 +6,7 @@
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify master node count
+- name: Check that master node count is odd
   ansible.builtin.assert:
     that:
       - bootstrap_nodes.master | length > 0
@@ -14,27 +14,27 @@
     success_msg: Master node count {{ bootstrap_nodes.master | length }} is correct.
     fail_msg: Master node count {{ bootstrap_nodes.master | length }} is not greater than 0 or is not odd.
 
-- name: Verify node CIDR
+- name: Check that node CIDR is ipv4
   ansible.builtin.assert:
     that: bootstrap_node_cidr is ansible.utils.ipv4
     success_msg: Node CIDR {{ bootstrap_node_cidr }} is valid.
     fail_msg: Node CIDR {{ bootstrap_node_cidr }} is invalid.
 
-- name: Verify cluster CIDR is ipv4 OR ipv6
+- name: Check that cluster CIDR is ipv4 OR ipv6
   when: not bootstrap_ipv6_enabled | default(false)
   ansible.builtin.assert:
     that: bootstrap_cluster_cidr is ansible.utils.ipv4 or bootstrap_cluster_cidr is ansible.utils.ipv6
     success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
     fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.
 
-- name: Verify service CIDR is ipv4 OR ipv6
+- name: Check that service CIDR is ipv4 OR ipv6
   when: not bootstrap_ipv6_enabled | default(false)
   ansible.builtin.assert:
     that: bootstrap_service_cidr is ansible.utils.ipv4 or bootstrap_service_cidr is ansible.utils.ipv6
     success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
     fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.
 
-- name: Verify cluster CIDR is ipv4 AND ipv6
+- name: Check that cluster CIDR is ipv4 AND ipv6
   when: bootstrap_ipv6_enabled | default(false)
   ansible.builtin.assert:
     that: >
@@ -48,7 +48,7 @@
     success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
     fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.
 
-- name: Verify service CIDR is ipv4 AND ipv6
+- name: Check that service CIDR is ipv4 AND ipv6
   when: bootstrap_ipv6_enabled | default(false)
   ansible.builtin.assert:
     that: >
@@ -62,67 +62,67 @@
     success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
     fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.
 
-- name: Verify k8s_gateway
+- name: Check that k8s_gateway is ipv4
   ansible.builtin.assert:
     that: bootstrap_k8s_gateway_addr is ansible.utils.ipv4
     success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is valid.
     fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is invalid.
 
-- name: Verify k8s_gateway in node CIDR
+- name: Check that k8s_gateway is in node CIDR
   ansible.builtin.assert:
     that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_k8s_gateway_addr)
     success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is within {{ bootstrap_node_cidr }}.
     fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is not within {{ bootstrap_node_cidr }}.
 
-- name: Verify internal ingress
+- name: Check that internal ingress is ipv4
   ansible.builtin.assert:
     that: bootstrap_internal_ingress_addr is ansible.utils.ipv4
     success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is valid.
     fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is invalid.
 
-- name: Verify internal ingress in node CIDR
+- name: Check that internal ingress is in node CIDR
   ansible.builtin.assert:
     that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_internal_ingress_addr)
     success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is within {{ bootstrap_node_cidr }}.
     fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is not within {{ bootstrap_node_cidr }}.
 
-- name: Verify external ingress
+- name: Check that external ingress is ipv4
   ansible.builtin.assert:
     that: bootstrap_external_ingress_addr is ansible.utils.ipv4
     success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is valid.
     fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is invalid.
 
-- name: Verify external ingress in node CIDR
+- name: Check external ingress is in node CIDR
   ansible.builtin.assert:
     that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_external_ingress_addr)
     success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is within {{ bootstrap_node_cidr }}.
     fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is not within {{ bootstrap_node_cidr }}.
 
-- name: Verify kubeapi address
+- name: Check that Kube API address is ipv4
   ansible.builtin.assert:
-    that: bootstrap_kubeapi_addr is ansible.utils.ipv4
-    success_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is valid.
-    fail_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is invalid.
+    that: bootstrap_kube_api_addr is ansible.utils.ipv4
+    success_msg: Kube API address {{ bootstrap_kube_api_addr }} is valid.
+    fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is invalid.
 
-- name: Verify kubeapi address in node CIDR
+- name: Check that Kube API address is in node CIDR
   ansible.builtin.assert:
-    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kubeapi_addr)
-    success_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is within {{ bootstrap_node_cidr }}.
-    fail_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is not within {{ bootstrap_node_cidr }}.
+    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kube_api_addr)
+    success_msg: Kube API address {{ bootstrap_kube_api_addr }} is within {{ bootstrap_node_cidr }}.
+    fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is not within {{ bootstrap_node_cidr }}.
 
-- name: Verify all IP addresses are unique
+- name: Check that all IP addresses are unique
   ansible.builtin.assert:
     that: >
       [
         bootstrap_k8s_gateway_addr,
         bootstrap_external_ingress_addr,
         bootstrap_internal_ingress_addr,
-        bootstrap_kubeapi_addr
+        bootstrap_kube_api_addr
       ] | unique | length == 4
     success_msg: All IP addresses are unique.
     fail_msg: All IP addresses are not unique.
 
-- name: Verify nodes are not the same IPs as k8s_gateway or ingress external/internal
+- name: Check that nodes are not the same IPs as k8s_gateway or ingress external/internal
   when: not bootstrap_kube_vip_enabled | default(true)
   ansible.builtin.assert:
     that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr)
@@ -133,18 +133,18 @@
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify nodes are not the same IPs as k8s_gateway, ingress external/internal or kubeapi address
+- name: Check that nodes are not the same IPs as k8s_gateway, ingress external/internal or Kube API address
   when: (bootstrap_distribution == "k3s") and (bootstrap_kube_vip_enabled | default(true))
   ansible.builtin.assert:
-    that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kubeapi_addr)
-    success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or kubeapi.
-    fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or kubeapi.
+    that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kube_api_addr)
+    success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or Kube API.
+    fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or Kube API.
     quiet: true
   loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify nodes are ipv4
+- name: Check that node addresses are ipv4
   ansible.builtin.assert:
     that: item.address is ansible.utils.ipv4
     success_msg: Node address {{ item.address }} is valid.
@@ -154,7 +154,7 @@
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify nodes are in node CIDR
+- name: Check that node addresses are in node CIDR
   ansible.builtin.assert:
     that: bootstrap_node_cidr | ansible.utils.network_in_usable(item.address)
     success_msg: Node address {{ item.address }} is within {{ bootstrap_node_cidr }}.
@@ -165,7 +165,7 @@
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify node IP addresses are unique
+- name: Check that node IP addresses are unique
   ansible.builtin.assert:
     that: >
       (
@@ -179,7 +179,7 @@
     fail_msg: All node IP addresses are not unique.
     quiet: true
 
-- name: Verify node names are unique
+- name: Check that node names are unique
   ansible.builtin.assert:
     that: >
       (
@@ -193,7 +193,7 @@
     fail_msg: All node names are not unique.
     quiet: true
 
-- name: Verify SSH port is reachable
+- name: Check that nodes SSH ports are reachable
   when: not ci_test | default(false)
   ansible.builtin.wait_for:
     host: "{{ current_address }}"

bootstrap/tasks/validation/vars.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Verify required bootstrap vars are set
+- name: Check that required bootstrap vars are set
   ansible.builtin.assert:
     that:
       - item in vars
@@ -25,13 +25,13 @@
     - bootstrap_internal_ingress_addr
     - bootstrap_ipv6_enabled
     - bootstrap_k8s_gateway_addr
-    - bootstrap_kubeapi_addr
+    - bootstrap_kube_api_addr
     - bootstrap_local_storage_path
     - bootstrap_node_cidr
     - bootstrap_service_cidr
     - bootstrap_timezone
 
-- name: Verify bootstrap node names are valid
+- name: Check that bootstrap node names are valid
   ansible.builtin.assert:
     that: item.name is match('^[a-z0-9-\.]+$')
     success_msg: Node name {{ item.name }} is valid