feat: replace ansible templating with makejinja (#1156)

bootstrap/templates/.sops.yaml.j2

@@ -9,8 +9,3 @@ creation_rules:
     key_groups:
       - age:
           - "{{ bootstrap_age_public_key }}"
-  # https://github.com/ansible-collections/community.sops/issues/153
-  - path_regex: /dev/stdin
-    key_groups:
-      - age:
-          - "{{ bootstrap_age_public_key }}"

bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2

@@ -1,35 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta2
-kind: HelmRelease
-metadata:
-  name: kube-prometheus-stack
-spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: kube-prometheus-stack
-      version: 55.8.1
-      sourceRef:
-        kind: HelmRepository
-        name: prometheus-community
-        namespace: flux-system
-  maxHistory: 2
-  install:
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  uninstall:
-    keepHistory: false
-  dependsOn:
-    - name: openebs
-      namespace: storage
-  valuesFrom:
-    - name: kube-prometheus-stack-values
-      kind: ConfigMap
-      valuesKey: values.yaml

bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmvalues.yaml
-  - ./helmrelease.yaml

bootstrap/templates/addons/volsync/snapshot-controller/kustomization.yaml.j2

@@ -1,5 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 #
 # Below vars are for the xanmanning.k3s role
@@ -13,12 +14,12 @@ k3s_etcd_datastore: true
 {% else %}
 k3s_etcd_datastore: false
 {% endif %}
-k3s_registration_address: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
+k3s_registration_address: "{% raw %}{{ kube_api_addr }}{% endraw %}"
 # /var/lib/rancher/k3s/server/manifests
 k3s_server_manifests_templates:
   - custom-cilium-helmchart.yaml.j2
   - custom-coredns-helmchart.yaml.j2
-{% if bootstrap_kube_vip_enabled | default(true) %}
+{% if bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %}
 # /var/lib/rancher/k3s/server/manifests
 k3s_server_manifests_urls:
   - url: https://raw.githubusercontent.com/kube-vip/website/main/content/manifests/rbac.yaml
@@ -27,3 +28,4 @@ k3s_server_manifests_urls:
 k3s_server_pod_manifests_templates:
   - kube-vip-static-pod.yaml.j2
 {% endif %}
+{% endif %}

bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2

@@ -1,8 +1,12 @@
 ---
 timezone: "{{ bootstrap_timezone }}"
 github_username: "{{ bootstrap_github_username }}"
-coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | ansible.utils.nthhost(10) }}"
-kubeapi_addr: "{{ bootstrap_kubeapi_addr }}"
+coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}"
+{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
+kube_api_addr: "{{ bootstrap_nodes.master[0].address }}"
+{% else %}
+kube_api_addr: "{{ bootstrap_kube_api_addr }}"
+{% endif %}
 cluster_cidr: "{{ bootstrap_cluster_cidr.split(',')[0] }}"
 service_cidr: "{{ bootstrap_service_cidr.split(',')[0] }}"
 node_cidr: "{{ bootstrap_node_cidr }}"

bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2

@@ -1,16 +1,17 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
 # https://github.com/PyratLabs/ansible-role-k3s
 
 k3s_control_node: true
 k3s_server:
-{% if bootstrap_ipv6_enabled | default(false) %}
+  {% if bootstrap_ipv6_enabled | default(false) %}
   node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}"
-{% else %}
+  {% else %}
   node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
-{% endif %}
+  {% endif %}
   tls-san:
-    - "{% raw %}{{ kubeapi_addr }}{% endraw %}"
+    - "{% raw %}{{ kube_api_addr }}{% endraw %}"
   docker: false
   flannel-backend: "none"             # This needs to be in quotes
   disable:
@@ -26,13 +27,13 @@ k3s_server:
   write-kubeconfig-mode: "644"
   pause-image: registry.k8s.io/pause:3.9
   secrets-encryption: true
-{% if bootstrap_ipv6_enabled | default(false) %}
+  {% if bootstrap_ipv6_enabled | default(false) %}
   cluster-cidr: "{% raw %}{{ cluster_cidr }},{{ cluster_cidr_v6 }}{% endraw %}"
   service-cidr: "{% raw %}{{ service_cidr }},{{ service_cidr_v6 }}{% endraw %}"
-{% else %}
+  {% else %}
   cluster-cidr: "{% raw %}{{ cluster_cidr }}{% endraw %}"
   service-cidr: "{% raw %}{{ service_cidr }}{% endraw %}"
-{% endif %}
+  {% endif %}
   etcd-expose-metrics: true           # Required to monitor etcd with kube-prometheus-stack
   kube-controller-manager-arg:
     - "bind-address=0.0.0.0"          # Required to monitor kube-controller-manager with kube-prometheus-stack
@@ -44,3 +45,4 @@ k3s_server:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
+{% endif %}

bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2

@@ -1,16 +1,18 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
 # https://github.com/PyratLabs/ansible-role-k3s
 
 k3s_control_node: false
 k3s_agent:
-{% if bootstrap_ipv6_enabled | default(false) %}
+  {% if bootstrap_ipv6_enabled | default(false) %}
   node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}"
-{% else %}
+  {% else %}
   node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
-{% endif %}
+  {% endif %}
   pause-image: registry.k8s.io/pause:3.9
   # TODO: Move these options to a kubelet config file
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
+{% endif %}

bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Cluster Installation
   hosts: kubernetes
@@ -59,3 +60,4 @@
     - name: Cruft
       when: k3s_primary_control_node
       ansible.builtin.include_tasks: tasks/cruft.yaml
+{% endif %}

bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Cluster kube-vip
   hosts: master
@@ -22,3 +23,4 @@
         src: templates/kube-vip-static-pod.yaml.j2
         dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml"
         mode: preserve
+{% endif %}

bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Cilium
   block:
@@ -54,3 +55,4 @@
         definition:
           metadata:
             finalizers: []
+{% endif %}

bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Coredns
   block:
@@ -54,3 +55,4 @@
         definition:
           metadata:
             finalizers: []
+{% endif %}

bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://github.com/k3s-io/k3s/issues/1971
 - name: Cruft
@@ -30,3 +31,4 @@
         namespace: kube-system
         state: absent
       loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
+{% endif %}

bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Get absolute path to this Git repository # noqa: command-instead-of-module
   ansible.builtin.command: git rev-parse --show-toplevel
@@ -24,3 +25,4 @@
     path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
     regexp: https://127.0.0.1:6443
     replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
+{% endif %}

bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://docs.k3s.io/helm
 apiVersion: helm.cattle.io/v1
@@ -36,7 +37,7 @@ spec:
     ipv6:
       enabled: true
     {% endif %}
-    k8sServiceHost: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
+    k8sServiceHost: "{% raw %}{{ kube_api_addr }}{% endraw %}"
     k8sServicePort: 6443
     kubeProxyReplacement: true
     kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
@@ -61,3 +62,4 @@ spec:
     routingMode: native
     securityContext:
       privileged: true
+{% endif %}

bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://docs.k3s.io/helm
 apiVersion: helm.cattle.io/v1
@@ -75,3 +76,4 @@ spec:
         labelSelector:
           matchLabels:
             app.kubernetes.io/instance: coredns
+{% endif %}

bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' and bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %}
 ---
 apiVersion: v1
 kind: Pod
@@ -15,7 +16,7 @@ spec:
       args: ["manager"]
       env:
         - name: address
-          value: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
+          value: "{% raw %}{{ kube_api_addr }}{% endraw %}"
         - name: vip_arp
           value: "true"
         - name: lb_enable
@@ -57,3 +58,4 @@ spec:
     - name: kubeconfig
       hostPath:
         path: /etc/rancher/k3s/k3s.yaml
+{% endif %}

bootstrap/templates/k0s-config.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k0s' %}
 ---
 apiVersion: k0sctl.k0sproject.io/v1beta1
 kind: Cluster
@@ -42,12 +43,12 @@ spec:
             bind-address: "0.0.0.0"
         api:
           sans:
-            - {{ bootstrap_kubeapi_addr }}
+            - {{ bootstrap_kube_api_addr }}
             {% if bootstrap_kubeapi_hostname is defined %}
             - {{ bootstrap_kubeapi_hostname }}
             {% endif %}
             {% for item in bootstrap_nodes.master %}
-            {% if item.address != bootstrap_kubeapi_addr %}
+            {% if item.address != bootstrap_kube_api_addr %}
             - {{ item.address }}
             {% endif %}
             {% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %}
@@ -89,7 +90,11 @@ spec:
                   ipv6:
                     enabled: true
                   {% endif %}
-                  k8sServiceHost: "{{ bootstrap_kubeapi_addr }}"
+                  {% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
+                  k8sServiceHost: {{ bootstrap_nodes.master[0].address }}
+                  {% else %}
+                  k8sServiceHost: {{ bootstrap_kube_api_addr }}
+                  {% endif %}
                   k8sServicePort: 6443
                   kubeProxyReplacement: true
                   kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
@@ -123,3 +128,4 @@ spec:
             type: EnvoyProxy
           {% endif %}
           provider: custom
+{% endif %}

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if discord_template_notifier.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -61,3 +62,4 @@ spec:
           - path: /data/config.toml
             subPath: config.toml
             readOnly: true
+{% endif %}

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2

@@ -0,0 +1,8 @@
+{% if discord_template_notifier.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+{% if discord_template_notifier.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: Secret
@@ -12,3 +13,4 @@ stringData:
     retry_limit = 5
     sink.type = "discord"
     sink.url = "{{ discord_template_notifier.webhook_url }}"
+{% endif %}

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if discord_template_notifier.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -75,3 +76,4 @@ data:
           dateStyle: long
           timeStyle: short
           hourCycle: h23
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -86,3 +87,4 @@ spec:
             path: /app/config/widgets.yaml
     serviceAccount:
       create: true
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -5,3 +6,4 @@ resources:
   - ./configmap.yaml
   - ./helmrelease.yaml
   - ./secret.sops.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: Secret
@@ -9,3 +10,4 @@ stringData:
   HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "{{ bootstrap_cloudflare_token }}"
   HOMEPAGE_VAR_GRAFANA_USERNAME: admin
   HOMEPAGE_VAR_GRAFANA_PASSWORD: "{{ grafana.password }}"
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if weave_gitops.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -55,3 +56,4 @@ spec:
       impersonationResourceNames: ["admin"]
     podAnnotations:
       secret.reloader.stakater.com/reload: cluster-user-auth
+{% endif %}

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if weave_gitops.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+{% if weave_gitops.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: Secret
@@ -6,4 +7,5 @@ metadata:
 type: Opaque
 stringData:
   username: admin
-  password: "{{ weave_gitops.password | password_hash('bcrypt', rounds=10) }}"
+  password: "{{ weave_gitops.password | encrypt }}"
+{% endif %}

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if weave_gitops.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2

@@ -23,7 +23,112 @@ spec:
       retries: 3
   uninstall:
     keepHistory: false
-  valuesFrom:
-    - name: cilium-values
-      kind: ConfigMap
-      valuesKey: values.yaml
+  values:
+    autoDirectNodeRoutes: true
+    bpf:
+      masquerade: true
+    bgp:
+      enabled: false
+    cluster:
+      name: home-cluster
+      id: 1
+    containerRuntime:
+      integration: containerd
+      {% if bootstrap_distribution == "k3s" %}
+      socketPath: /var/run/k3s/containerd/containerd.sock
+      {% else %}
+      socketPath: /var/run/k0s/containerd.sock
+      {% endif %}
+    endpointRoutes:
+      enabled: true
+    hubble:
+      enabled: true
+      metrics:
+        enabled:
+          - dns:query
+          - drop
+          - tcp
+          - flow
+          - port-distribution
+          - icmp
+          - http
+        serviceMonitor:
+          enabled: true
+        dashboards:
+          enabled: true
+          annotations:
+            grafana_folder: Cilium
+      relay:
+        enabled: true
+        rollOutPods: true
+        prometheus:
+          serviceMonitor:
+            enabled: true
+      ui:
+        enabled: true
+        rollOutPods: true
+        ingress:
+          enabled: true
+          className: internal
+          {% if homepage.enabled | default(false) %}
+          annotations:
+            gethomepage.dev/enabled: "true"
+            gethomepage.dev/group: Network
+            gethomepage.dev/name: Cilium
+            gethomepage.dev/icon: cilium.png
+          {% endif %}
+          hosts:
+            - "hubble.${SECRET_DOMAIN}"
+          tls:
+            - hosts:
+                - "hubble.${SECRET_DOMAIN}"
+    ipam:
+      mode: kubernetes
+    ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
+    {% if bootstrap_ipv6_enabled | default(false) %}
+    ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
+    ipv6:
+      enabled: true
+    {% endif %}
+    k8sServiceHost: "${KUBE_API_ADDR}"
+    k8sServicePort: 6443
+    kubeProxyReplacement: true
+    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
+    l2announcements:
+      {% if bootstrap_ipv6_enabled | default(false) %}
+      enabled: false
+      {% else %}
+      enabled: true
+      # https://github.com/cilium/cilium/issues/26586
+      leaseDuration: 120s
+      leaseRenewDeadline: 60s
+      leaseRetryPeriod: 1s
+      {% endif %}
+    loadBalancer:
+      algorithm: maglev
+      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
+    localRedirectPolicy: true
+    operator:
+      replicas: 1
+      rollOutPods: true
+      prometheus:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+      dashboards:
+        enabled: true
+        annotations:
+          grafana_folder: Cilium
+    prometheus:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+        trustCRDsExist: true
+    dashboards:
+      enabled: true
+      annotations:
+        grafana_folder: Cilium
+    rollOutCiliumPods: true
+    routingMode: native
+    securityContext:
+      privileged: true

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2

@@ -1,115 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cilium-values
-data:
-  values.yaml: |
-    autoDirectNodeRoutes: true
-    bpf:
-      masquerade: true
-    bgp:
-      enabled: false
-    cluster:
-      name: home-cluster
-      id: 1
-    containerRuntime:
-      integration: containerd
-      {% if bootstrap_distribution == "k3s" %}
-      socketPath: /var/run/k3s/containerd/containerd.sock
-      {% else %}
-      socketPath: /var/run/k0s/containerd.sock
-      {% endif %}
-    endpointRoutes:
-      enabled: true
-    hubble:
-      enabled: true
-      metrics:
-        enabled:
-          - dns:query
-          - drop
-          - tcp
-          - flow
-          - port-distribution
-          - icmp
-          - http
-        serviceMonitor:
-          enabled: true
-        dashboards:
-          enabled: true
-          annotations:
-            grafana_folder: Cilium
-      relay:
-        enabled: true
-        rollOutPods: true
-        prometheus:
-          serviceMonitor:
-            enabled: true
-      ui:
-        enabled: true
-        rollOutPods: true
-        ingress:
-          enabled: true
-          className: internal
-          {% if homepage.enabled | default(false) %}
-          annotations:
-            gethomepage.dev/enabled: "true"
-            gethomepage.dev/group: Network
-            gethomepage.dev/name: Cilium
-            gethomepage.dev/icon: cilium.png
-          {% endif %}
-          hosts:
-            - "hubble.${SECRET_DOMAIN}"
-          tls:
-            - hosts:
-                - "hubble.${SECRET_DOMAIN}"
-    ipam:
-      mode: kubernetes
-    ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-    {% if bootstrap_ipv6_enabled | default(false) %}
-    ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
-    ipv6:
-      enabled: true
-    {% endif %}
-    k8sServiceHost: "${KUBEAPI_ADDR}"
-    k8sServicePort: 6443
-    kubeProxyReplacement: true
-    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
-    l2announcements:
-      {% if bootstrap_ipv6_enabled | default(false) %}
-      enabled: false
-      {% else %}
-      enabled: true
-      # https://github.com/cilium/cilium/issues/26586
-      leaseDuration: 120s
-      leaseRenewDeadline: 60s
-      leaseRetryPeriod: 1s
-      {% endif %}
-    loadBalancer:
-      algorithm: maglev
-      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
-    localRedirectPolicy: true
-    operator:
-      replicas: 1
-      rollOutPods: true
-      prometheus:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-      dashboards:
-        enabled: true
-        annotations:
-          grafana_folder: Cilium
-    prometheus:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-        trustCRDsExist: true
-    dashboards:
-      enabled: true
-      annotations:
-        grafana_folder: Cilium
-    rollOutCiliumPods: true
-    routingMode: native
-    securityContext:
-      privileged: true

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2

@@ -5,5 +5,4 @@ resources:
   {% if not bootstrap_ipv6_enabled | default(false) %}
   - ./cilium-l2.yaml
   {% endif %}
-  - ./helmvalues.yaml
   - ./helmrelease.yaml

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -86,3 +87,4 @@ spec:
         labelSelector:
           matchLabels:
             app.kubernetes.io/instance: coredns
+{% endif %}

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2

@@ -1,5 +1,7 @@
+{% if bootstrap_distribution == "k3s" %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if grafana.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -180,3 +181,4 @@ spec:
       storageClassName: openebs-hostpath
     testFramework:
       enabled: false
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if grafana.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+{% if grafana.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: Secret
@@ -6,3 +7,4 @@ metadata:
 stringData:
   admin-user: admin
   admin-password: "{{ grafana.password }}"
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if grafana.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2

@@ -1,10 +1,36 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
 ---
-apiVersion: v1
-kind: ConfigMap
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
 metadata:
-  name: kube-prometheus-stack-values
-data:
-  values.yaml: |
+  name: kube-prometheus-stack
+spec:
+  interval: 30m
+  timeout: 15m
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: 55.8.1
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  dependsOn:
+    - name: openebs
+      namespace: storage
+  values:
     crds:
       enabled: true
     cleanPrometheusOperatorObjectNames: true
@@ -138,3 +164,4 @@ data:
           multicluster:
             etcd:
               enabled: true
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2

@@ -0,0 +1,7 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -45,3 +46,4 @@ spec:
             - *host
     metricsScraper:
       enabled: true
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./rbac.yaml
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2

@@ -1,3 +1,4 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
 # For dashboard sign in token:
 # kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
 ---
@@ -37,3 +38,4 @@ subjects:
   - kind: ServiceAccount
     name: kubernetes-dashboard
     namespace: observability
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -21,3 +22,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if csi_driver_nfs.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -26,3 +27,4 @@ spec:
   values:
     externalSnapshotter:
       enabled: false
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if csi_driver_nfs.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
   - ./storageclass.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2

@@ -1,3 +1,4 @@
+{% if csi_driver_nfs.enabled | default(false) %}
 {% for item in csi_driver_nfs.storage_class %}
 ---
 apiVersion: storage.k8s.io/v1
@@ -12,3 +13,4 @@ reclaimPolicy: Delete
 volumeBindingMode: Immediate
 mountOptions: ["hard", "noatime"]
 {% endfor %}
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if csi_driver_nfs.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2

@@ -4,7 +4,7 @@ kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./openebs/ks.yaml
-    {% if volsync.enabled | default(false) %}
+  {% if volsync.enabled | default(false) %}
   - ./volsync/ks.yaml
   {% endif %}
   {% if csi_driver_nfs.enabled | default(false) %}

bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -40,3 +41,4 @@ spec:
       tag: *tag
     metrics:
       disableAuth: true
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
   - ./prometheusrule.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2

@@ -1,3 +1,4 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
@@ -21,3 +22,4 @@ spec:
           for: 15m
           labels:
             severity: critical
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -38,3 +39,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -31,3 +32,4 @@ spec:
         create: true
     webhook:
       enabled: false
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2

@@ -1,6 +1,7 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./secret.sops.yaml
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -102,3 +103,4 @@ spec:
         globalMounts:
           - path: /etc/ca-certificates
             readOnly: true
+{% endif %}

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -6,3 +7,4 @@ resources:
   - https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.2/crd.yaml
   - helmrelease.yaml
   - rbac.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -11,3 +12,4 @@ subjects:
   - kind: ServiceAccount
     name: system-upgrade
     namespace: tools
+{% endif %}

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -40,3 +41,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
@@ -16,3 +17,4 @@ spec:
     args: ["prepare", "server"]
   upgrade:
     image: rancher/k3s-upgrade
+{% endif %}

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./server.yaml
   - ./agent.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
@@ -21,3 +22,4 @@ spec:
     - {key: CriticalAddonsOnly, operator: Exists}
   upgrade:
     image: rancher/k3s-upgrade
+{% endif %}

bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2

@@ -6,8 +6,12 @@ metadata:
   namespace: flux-system
 data:
   TIMEZONE: "{{ bootstrap_timezone }}"
-  COREDNS_ADDR: "{{ bootstrap_service_cidr.split(',')[0] | ansible.utils.nthhost(10) }}"
-  KUBEAPI_ADDR: "{{ bootstrap_kubeapi_addr }}"
+  COREDNS_ADDR: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}"
+  {% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
+  KUBE_API_ADDR: "{{ bootstrap_nodes.master[0].address }}"
+  {% else %}
+  KUBE_API_ADDR: "{{ bootstrap_kube_api_addr }}"
+  {% endif %}
   CLUSTER_CIDR: "{{ bootstrap_cluster_cidr.split(',')[0] }}"
   SERVICE_CIDR: "{{ bootstrap_service_cidr.split(',')[0] }}"
   NODE_CIDR: "{{ bootstrap_node_cidr }}"