feat: replace ansible templating with makejinja (#1156)

.envrc

@@ -6,7 +6,7 @@ PATH_add "$(expand_path ./.venv/bin)"
 export VIRTUAL_ENV="$(expand_path ./.venv)"
 export ANSIBLE_COLLECTIONS_PATH=$(expand_path ./.venv/galaxy)
 export ANSIBLE_ROLES_PATH=$(expand_path ./.venv/galaxy/ansible_roles)
-export ANSIBLE_VARS_ENABLED="host_group_vars,community.sops.sops"
+export ANSIBLE_VARS_ENABLED="host_group_vars"
 export ANSIBLE_LOCALHOST_WARNING="False"
 export ANSIBLE_INVENTORY_UNPARSED_WARNING="False"
 export K8S_AUTH_KUBECONFIG="$(expand_path ./kubeconfig)"

.github/tests/config-k0s.yaml

@@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake
 bootstrap_cloudflare_tunnel_secret: fake
 bootstrap_cloudflare_tunnel_id: fake
 bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kubeapi_addr: 10.10.10.254
+bootstrap_kube_api_addr: 10.10.10.254
 bootstrap_k8s_gateway_addr: 10.10.10.253
 bootstrap_external_ingress_addr: 10.10.10.252
 bootstrap_internal_ingress_addr: 10.10.10.251
@@ -30,7 +30,19 @@ bootstrap_nodes:
     - name: k8s-0
       address: 10.10.10.100
       username: fake
-  worker:
     - name: k8s-1
       address: 10.10.10.101
       username: fake
+    - name: k8s-2
+      address: 10.10.10.102
+      username: fake
+  worker:
+    - name: k8s-3
+      address: 10.10.10.103
+      username: fake
+    - name: k8s-4
+      address: 10.10.10.104
+      username: fake
+    - name: k8s-5
+      address: 10.10.10.105
+      username: fake

.github/tests/config-k3s-ipv4.yaml

@@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake
 bootstrap_cloudflare_tunnel_secret: fake
 bootstrap_cloudflare_tunnel_id: fake
 bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kubeapi_addr: 10.10.10.254
+bootstrap_kube_api_addr: 10.10.10.254
 bootstrap_k8s_gateway_addr: 10.10.10.253
 bootstrap_external_ingress_addr: 10.10.10.252
 bootstrap_internal_ingress_addr: 10.10.10.251
@@ -30,7 +30,19 @@ bootstrap_nodes:
     - name: k8s-0
       address: 10.10.10.100
       username: fake
-  worker:
     - name: k8s-1
       address: 10.10.10.101
       username: fake
+    - name: k8s-2
+      address: 10.10.10.102
+      username: fake
+  worker:
+    - name: k8s-3
+      address: 10.10.10.103
+      username: fake
+    - name: k8s-4
+      address: 10.10.10.104
+      username: fake
+    - name: k8s-5
+      address: 10.10.10.105
+      username: fake

.github/tests/config-k3s-ipv6.yaml

@@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake
 bootstrap_cloudflare_tunnel_secret: fake
 bootstrap_cloudflare_tunnel_id: fake
 bootstrap_node_cidr: 10.10.10.0/24
-bootstrap_kubeapi_addr: 10.10.10.254
+bootstrap_kube_api_addr: 10.10.10.254
 bootstrap_k8s_gateway_addr: 10.10.10.253
 bootstrap_external_ingress_addr: 10.10.10.252
 bootstrap_internal_ingress_addr: 10.10.10.251
@@ -30,7 +30,19 @@ bootstrap_nodes:
     - name: k8s-0
       address: 10.10.10.100
       username: fake
-  worker:
     - name: k8s-1
       address: 10.10.10.101
       username: fake
+    - name: k8s-2
+      address: 10.10.10.102
+      username: fake
+  worker:
+    - name: k8s-3
+      address: 10.10.10.103
+      username: fake
+    - name: k8s-4
+      address: 10.10.10.104
+      username: fake
+    - name: k8s-5
+      address: 10.10.10.105
+      username: fake

.github/tests/config-k3s-no-kube-vip.yaml

@@ -0,0 +1,32 @@
+---
+ci_test: true
+
+bootstrap_distribution: k3s
+bootstrap_github_username: onedr0p
+bootstrap_github_repository_name: flux-cluster-template
+bootstrap_github_repository_branch: main
+bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
+bootstrap_timezone: Etc/UTC
+bootstrap_acme_email: fake
+bootstrap_acme_production_enabled: false
+bootstrap_flux_github_webhook_token: fake
+bootstrap_cloudflare_domain: fake
+bootstrap_cloudflare_token: fake
+bootstrap_cloudflare_account_tag: fake
+bootstrap_cloudflare_tunnel_secret: fake
+bootstrap_cloudflare_tunnel_id: fake
+bootstrap_node_cidr: 10.10.10.0/24
+bootstrap_kube_api_addr: # left blank to not use kube-vip
+bootstrap_k8s_gateway_addr: 10.10.10.253
+bootstrap_external_ingress_addr: 10.10.10.252
+bootstrap_internal_ingress_addr: 10.10.10.251
+bootstrap_cilium_loadbalancer_mode: dsr
+bootstrap_ipv6_enabled: false
+bootstrap_cluster_cidr: 10.42.0.0/16
+bootstrap_service_cidr: 10.43.0.0/16
+bootstrap_local_storage_path: /var/openebs/local
+bootstrap_nodes:
+  master:
+    - name: k8s-0
+      address: 10.10.10.100
+      username: fake

.github/workflows/e2e.yaml

@@ -40,6 +40,7 @@ jobs:
           - k0s
           - k3s-ipv4
           - k3s-ipv6
+          - k3s-no-kube-vip
         addon-files: ["addons"]
     steps:
       - name: Checkout
@@ -109,7 +110,7 @@ jobs:
 
       - name: Run configure
         shell: bash
-        run: task --yes configure
+        run: task configure --yes
 
       - name: Run kubeconform
         shell: bash
@@ -124,4 +125,4 @@ jobs:
         shell: bash
         run: |
           task repo:clean
-          task --yes repo:reset
+          task repo:reset --yes

.gitignore

@@ -1,3 +1,7 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
 # Trash
 .DS_Store
 Thumbs.db

.taskfiles/Ansible/Taskfile.yaml

@@ -11,7 +11,7 @@ env:
   VIRTUAL_ENV: "{{.ROOT_DIR}}/.venv"
   ANSIBLE_COLLECTIONS_PATH: "{{.ROOT_DIR}}/.venv/galaxy"
   ANSIBLE_ROLES_PATH: "{{.ROOT_DIR}}/.venv/galaxy/ansible_roles"
-  ANSIBLE_VARS_ENABLED: "host_group_vars,community.sops.sops"
+  ANSIBLE_VARS_ENABLED: "host_group_vars"
   ANSIBLE_LOCALHOST_WARNING: "False"
   ANSIBLE_INVENTORY_UNPARSED_WARNING: "False"
 

.taskfiles/K0s/Taskfile.yaml

@@ -10,14 +10,14 @@ tasks:
   kubeconfig:
     desc: Gets k0s cluster kubeconfig
     cmds:
-      - k0sctl kubeconfig --config k0s-config.yaml > kubeconfig
+      - k0sctl kubeconfig --config {{.ROOT_DIR}}/k0s-config.yaml > kubeconfig
     preconditions:
       - { msg: "k0s-config.yaml not found", sh: "test -f {{.ROOT_DIR}}/k0s-config.yaml" }
 
   apply:
     desc: Apply k0s cluster k0s-config.yaml
     cmds:
-      - k0sctl apply --config k0s-config.yaml
+      - k0sctl apply --config {{.ROOT_DIR}}/k0s-config.yaml
       - task: kubeconfig
     preconditions:
       - { msg: "k0s-config.yaml not found", sh: "test -f {{.ROOT_DIR}}/k0s-config.yaml" }
@@ -25,7 +25,7 @@ tasks:
   reset:
     desc: Resets the k0s cluster
     cmds:
-      - k0sctl reset --config k0s-config.yaml
+      - k0sctl reset --config {{.ROOT_DIR}}/k0s-config.yaml
       - task: :ansible:run
         vars:
           playbook: cluster-nuke

.taskfiles/Repo/Taskfile.yaml

@@ -12,28 +12,28 @@ tasks:
       - rm -rf {{.ROOT_DIR}}/.github/workflows/e2e.yaml
       # Move bootstrap directory to gitignored directory
       - mkdir -p {{.ROOT_DIR}}/.private
-      - mv {{.ROOT_DIR}}/bootstrap {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}}
+      - mv {{.BOOTSTRAP_DIR}} {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}}
       # Update renovate.json5
       - sed -i {{if eq OS "darwin"}}''{{end}} 's/(..\.j2)\?(..\.j2)\?//g' {{.ROOT_DIR}}/.github/renovate.json5
       - sed -i {{if eq OS "darwin"}}''{{end}} '/addons/d' {{.ROOT_DIR}}/.github/renovate.json5
     preconditions:
-      - { msg: "bootstrap dir not found",  sh: "test -d {{.ROOT_DIR}}/bootstrap" }
+      - { msg: "bootstrap dir not found",  sh: "test -d {{.BOOTSTRAP_DIR}}" }
       - { msg: "renovate.json5 not found", sh: "test -f {{.ROOT_DIR}}/.github/renovate.json5" }
 
   reset:
-    desc: Remove templated configuration files
-    prompt: Remove templated configuration files... continue?
+    desc: Reset templated configuration files
+    prompt: Reset templated configuration files... continue?
     cmds:
       - rm -rf {{.ROOT_DIR}}/.sops.yaml
       - rm -rf {{.ROOT_DIR}}/k0s-config.yaml
-      - rm -rf {{.ROOT_DIR}}/ansible
-      - rm -rf {{.ROOT_DIR}}/kubernetes
+      - rm -rf {{.ANSIBLE_DIR}}
+      - rm -rf {{.KUBERNETES_DIR}}
 
-  reset-repo:
-    desc: Set repo back to HEAD
-    prompt: Set repo back to HEAD... continue?
+  force-reset:
+    desc: Reset repo back to HEAD
+    prompt: Reset repo back to HEAD... continue?
     cmds:
       - task: reset
       - git reset --hard HEAD
       - git clean -f -d
-      - git pull
+      - git pull origin main

.taskfiles/Sops/Taskfile.yaml

@@ -12,7 +12,6 @@ tasks:
 
   encrypt:
     desc: Encrypt a secret
-    aliases: ["e"]
     summary: |
       Args:
         file: Path to file to encrypt (required)
@@ -23,15 +22,13 @@ tasks:
       - { msg: "Sops config not found", sh: "test -f {{.ROOT_DIR}}/.sops.yaml" }
       - { msg: "Age key not found",     sh: "test -f {{.ROOT_DIR}}/age.key" }
 
-  decrypt:
-    desc: Decrypt a secret
-    aliases: ["d"]
-    summary: |
-      Args:
-        file: Path to file to decrypt (required)
-    cmd: sops --decrypt --in-place {{.SECRET}}
+  encrypt:all:
+    desc: Encrypt all Kubernetes SOPS secrets
+    cmds:
+      - for: { var: file }
+        task: encrypt
         vars:
-      claim: '{{ or .file (fail "Argument (file) is required") }}'
-    preconditions:
-      - { msg: "Sops config not found", sh: "test -f {{.ROOT_DIR}}/.sops.yaml" }
-      - { msg: "Age key not found",     sh: "test -f {{.ROOT_DIR}}/age.key" }
+          file: '{{.ITEM}}'
+    vars:
+      file:
+        sh: find {{.KUBERNETES_DIR}} -type f -name "*.sops.*"

.taskfiles/Workstation/ArchPackages

@@ -1,17 +1,15 @@
 age
-cilium-cli
 cloudflared-bin
 direnv
 flux-bin
+go-task
+go-yq
 helm
 jq
 k0sctl-bin
-k9s
 kubeconform
 kubectl-bin
 kustomize
 moreutils
 sops
 stern-bin
-go-task
-go-yq

.taskfiles/Workstation/Brewfile

@@ -1,18 +1,15 @@
 tap "fluxcd/tap"
 tap "go-task/tap"
 tap "k0sproject/tap"
-tap "kubecolor/tap"
 brew "age"
-brew "cilium-cli"
 brew "cloudflared"
 brew "direnv"
 brew "fluxcd/tap/flux"
+brew "go-task/tap/go-task"
 brew "helm"
 brew "jq"
 brew "k0sproject/tap/k0sctl"
-brew "k9s"
 brew "kubeconform"
-brew "kubecolor/tap/kubecolor"
 brew "kubernetes-cli"
 brew "kustomize"
 brew "moreutils"

.taskfiles/Workstation/Taskfile.yaml

@@ -14,8 +14,18 @@ tasks:
           Head over to https://brew.sh to get up and running.
       - { msg: "Brewfile not found", sh: "test -f {{.ROOT_DIR}}/.taskfiles/Workstation/Brewfile" }
 
-  yay:
+  paru:
     desc: Install workstation dependencies with Paru
+    cmd: paru -Syu --needed --noconfirm --noprogressbar $(cat {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages | xargs)
+    preconditions:
+      - sh: command -v paru
+        msg: |
+          Paru is not installed. Using ArchLinux?
+          Head over to https://github.com/Morganamilo/paru to get up and running.
+      - { msg: "ArchPackages not found", sh: "test -f {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages" }
+
+  yay:
+    desc: Install workstation dependencies with Yay
     cmd: yay -Syu --needed --noconfirm --noprogressbar $(cat {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages | xargs)
     preconditions:
       - sh: command -v yay

Taskfile.yaml

@@ -47,6 +47,33 @@ tasks:
   configure:
     desc: Configure repository from Ansible vars
     prompt: Any conflicting config in the root kubernetes and ansible directories will be overwritten... continue?
-    cmd: ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/configure.yaml
+    cmds:
+      - task: .validate
+      - task: .template
+      - task: sops:encrypt:all
+
+  .validate:
+    internal: true
+    cmd: ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/validate.yaml
     env:
       ANSIBLE_DISPLAY_SKIPPED_HOSTS: "false"
+    preconditions:
+      - { msg: "addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" }
+      - { msg: "config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" }
+
+  .template:
+    internal: true
+    cmds:
+      - ./.venv/bin/makejinja
+          --input "{{.BOOTSTRAP_DIR}}/templates"
+          --output "{{.ROOT_DIR}}"
+          --data "{{.BOOTSTRAP_DIR}}/vars/config.yaml"
+          --data "{{.BOOTSTRAP_DIR}}/vars/addons.yaml"
+          --import-path "{{.BOOTSTRAP_DIR}}/scripts"
+          --loader "loader:Loader"
+          --jinja-suffix ".j2" --quiet --force
+      - find {{.ANSIBLE_DIR}} {{.KUBERNETES_DIR}} -type d -empty -delete
+    preconditions:
+      - { msg: "addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" }
+      - { msg: "config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" }
+      - { msg: "loader file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/loader.py" }

bootstrap/configure.yaml

@@ -1,45 +0,0 @@
----
-- name: Cluster Installation
-  hosts: localhost
-  connection: local
-  gather_facts: false
-  vars_files:
-    - vars/config.yaml
-    - vars/addons.yaml
-  tasks:
-    - name: Get absolute path to this Git repository # noqa: command-instead-of-module
-      ansible.builtin.command: git rev-parse --show-toplevel
-      changed_when: false
-      check_mode: false
-      register: repository
-      failed_when: repository.rc != 0
-
-    - name: Set facts
-      ansible.builtin.set_fact:
-        repository_path: "{{ repository.stdout }}"
-
-    - name: Override kubeapi address when there is a single master node and no address is defined
-      when: bootstrap_nodes.master | length == 1 and not bootstrap_kubeapi_addr
-      ansible.builtin.set_fact:
-        bootstrap_kube_vip_enabled: false
-        bootstrap_kubeapi_addr: "{{ bootstrap_nodes.master[0].address }}"
-
-    - name: Verify configuration
-      ansible.builtin.include_tasks: tasks/validation/main.yaml
-
-    - name: Template Sops configuration
-      ansible.builtin.include_tasks: tasks/sops/main.yaml
-
-    - name: Template k0s configuration
-      when: bootstrap_distribution == "k0s"
-      ansible.builtin.include_tasks: tasks/k0s/main.yaml
-
-    - name: Template Ansible configuration
-      when: bootstrap_distribution == "k0s" or bootstrap_distribution == "k3s"
-      ansible.builtin.include_tasks: tasks/ansible/main.yaml
-
-    - name: Template Kubernetes configuration
-      ansible.builtin.include_tasks: tasks/kubernetes/main.yaml
-
-    - name: Template Kubernetes addon configuration
-      ansible.builtin.include_tasks: tasks/addons/main.yaml

bootstrap/scripts/loader.py

@@ -0,0 +1,21 @@
+import netaddr, bcrypt
+
+def nthhost(value: str, query: int) -> str:
+    value = netaddr.IPNetwork(value)
+
+    try:
+        nth = int(query)
+        if value.size > nth:
+            return str(value[nth])
+
+    except ValueError:
+        return False
+
+    return value
+
+def encrypt(value: str) -> str:
+    return bcrypt.hashpw(value.encode(), bcrypt.gensalt(rounds=10)).decode("ascii")
+
+class Loader:
+    def filters(self):
+        return [nthhost, encrypt]

bootstrap/tasks/addons/coredns.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: coredns
-    addon_namespace: kube-system
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/csi_driver_nfs.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: csi-driver-nfs
-    addon_namespace: storage
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/discord_template_notifier.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: discord-template-notifier
-    addon_namespace: default
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/grafana.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: grafana
-    addon_namespace: observability
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/homepage.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: homepage
-    addon_namespace: default
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/kube_prometheus_stack.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: kube-prometheus-stack
-    addon_namespace: observability
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/kubernetes_dashboard.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: kubernetes-dashboard
-    addon_namespace: observability
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/main.yaml

@@ -1,43 +0,0 @@
----
-
-- name: Process optional coredns
-  when: bootstrap_distribution == "k3s"
-  ansible.builtin.include_tasks: coredns.yaml
-
-- name: Process addon csi-driver-nfs
-  when: csi_driver_nfs.enabled | default(false)
-  ansible.builtin.include_tasks: csi_driver_nfs.yaml
-
-- name: Process addon homepage
-  when: homepage.enabled | default(false)
-  ansible.builtin.include_tasks: homepage.yaml
-
-- name: Process addon grafana
-  when: grafana.enabled | default(false)
-  ansible.builtin.include_tasks: grafana.yaml
-
-- name: Process addon kubernetes-dashboard
-  when: kubernetes_dashboard.enabled | default(false)
-  ansible.builtin.include_tasks: kubernetes_dashboard.yaml
-
-- name: Process addon kube-prometheus-stack
-  when: kube_prometheus_stack.enabled | default(false)
-  ansible.builtin.include_tasks: kube_prometheus_stack.yaml
-
-- name: Process addon system-upgrade-controller
-  when:
-    - bootstrap_distribution == "k3s"
-    - system_upgrade_controller.enabled | default(false)
-  ansible.builtin.include_tasks: system_upgrade_controller.yaml
-
-- name: Process addon weave-gitops
-  when: weave_gitops.enabled | default(false)
-  ansible.builtin.include_tasks: weave_gitops.yaml
-
-- name: Process addon discord-template-notifier
-  when: discord_template_notifier.enabled | default(false)
-  ansible.builtin.include_tasks: discord_template_notifier.yaml
-
-- name: Process addon volsync
-  when: volsync.enabled | default(false)
-  ansible.builtin.include_tasks: volsync.yaml

bootstrap/tasks/addons/system_upgrade_controller.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: system-upgrade-controller
-    addon_namespace: tools
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/volsync.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: volsync
-    addon_namespace: storage
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/addons/weave_gitops.yaml

@@ -1,39 +0,0 @@
----
-- name: Set addon facts
-  ansible.builtin.set_fact:
-    addon_name: weave-gitops
-    addon_namespace: flux-system
-
-- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
-  when: item.state == 'file' and 'sops' not in item.path
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template encrypted files
-  when: item.state == 'file' and 'sops' in item.path
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/ansible/main.yaml

@@ -1,45 +0,0 @@
----
-- name: Ensure Ansible k3s directories exist
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/ansible/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree:
-    - "../templates/ansible/shared/"
-    - "../templates/ansible/{{ bootstrap_distribution }}/"
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template Ansible unencrypted files
-  when:
-    - "item.state == 'file'"
-    - "'sops' not in item.path"
-    - "'.DS_Store' not in item.path"
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/ansible/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree:
-    - "../templates/ansible/shared/"
-    - "../templates/ansible/{{ bootstrap_distribution }}/"
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template Ansible encrypted files
-  when:
-    - "item.state == 'file'"
-    - "'sops' in item.path"
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/ansible/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree:
-    - "../templates/ansible/shared/"
-    - "../templates/ansible/{{ bootstrap_distribution }}/"
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/k0s/main.yaml

@@ -1,7 +0,0 @@
----
-- name: Template k0s configuration file
-  ansible.builtin.template:
-    src: "templates/k0s/k0s-config.yaml.j2"
-    dest: "{{ repository_path }}/k0s-config.yaml"
-    mode: "0644"
-    lstrip_blocks: true

bootstrap/tasks/kubernetes/main.yaml

@@ -1,79 +0,0 @@
----
-- name: Ensure Kubernetes directories exist
-  when: item.state == 'directory'
-  ansible.builtin.file:
-    path: "{{ repository_path }}/kubernetes/{{ item.path }}"
-    state: directory
-    mode: "0755"
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template Kubernetes unencrypted files
-  when:
-    - "item.state == 'file'"
-    - "'.DS_Store' not in item.path"
-    - "'sops' not in item.path"
-    - "'cluster-settings-user.yaml.j2' not in item.path"
-    - "'cluster-secrets-user.yaml.j2' not in item.path"
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Check if the cluster user settings file already exists
-  stat:
-    path: "{{ repository_path }}/kubernetes/flux/vars/cluster-settings-user.yaml"
-  register: cluster_settings_user
-
-- name: Template Kubernetes user cluster settings
-  when:
-    - "item.state == 'file'"
-    - "'cluster-settings-user.yaml' in item.path"
-    - "not cluster_settings_user.stat.exists"
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Check if the cluster user secrets file already exists
-  stat:
-    path: "{{ repository_path }}/kubernetes/flux/vars/cluster-secrets-user.yaml"
-  register: cluster_secrets_user
-
-- name: Template Kubernetes user cluster secrets
-  when:
-    - "item.state == 'file'"
-    - "'cluster-secrets-user.yaml' in item.path"
-    - "not cluster_secrets_user.stat.exists"
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
-    mode: "0644"
-    lstrip_blocks: true
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"
-
-- name: Template Kubernetes encrypted files
-  when:
-    - "item.state == 'file'"
-    - "'sops' in item.path"
-  community.sops.sops_encrypt:
-    path: "{{ repository_path }}/kubernetes/{{ item.path | replace('.j2', '') }}"
-    encrypted_regex: ^(data|stringData)$
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
-    mode: "0644"
-    force: true
-  with_community.general.filetree: ["../templates/kubernetes/"]
-  loop_control:
-    label: "{{ item.path }}"

bootstrap/tasks/sops/main.yaml

@@ -1,7 +0,0 @@
----
-- name: Template Sops configuration file
-  ansible.builtin.template:
-    src: "templates/.sops.yaml.j2"
-    dest: "{{ repository_path }}/.sops.yaml"
-    mode: "0644"
-    lstrip_blocks: true

bootstrap/tasks/validation/cli.yaml

@@ -1,8 +1,8 @@
 ---
-- name: Check for required CLI tools
+- name: Check if required CLI tools are present
   ansible.builtin.shell: |
     command -v {{ item }} >/dev/null 2>&1
-  loop: [age, cloudflared, flux, sops, kubeconform, kustomize, jq]
+  loop: [age, cloudflared, flux, sops, jq]
   changed_when: false
   check_mode: false
   register: result

bootstrap/tasks/validation/net.yaml

@@ -6,7 +6,7 @@
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify master node count
+- name: Check that master node count is odd
   ansible.builtin.assert:
     that:
       - bootstrap_nodes.master | length > 0
@@ -14,27 +14,27 @@
     success_msg: Master node count {{ bootstrap_nodes.master | length }} is correct.
     fail_msg: Master node count {{ bootstrap_nodes.master | length }} is not greater than 0 or is not odd.
 
-- name: Verify node CIDR
+- name: Check that node CIDR is ipv4
   ansible.builtin.assert:
     that: bootstrap_node_cidr is ansible.utils.ipv4
     success_msg: Node CIDR {{ bootstrap_node_cidr }} is valid.
     fail_msg: Node CIDR {{ bootstrap_node_cidr }} is invalid.
 
-- name: Verify cluster CIDR is ipv4 OR ipv6
+- name: Check that cluster CIDR is ipv4 OR ipv6
   when: not bootstrap_ipv6_enabled | default(false)
   ansible.builtin.assert:
     that: bootstrap_cluster_cidr is ansible.utils.ipv4 or bootstrap_cluster_cidr is ansible.utils.ipv6
     success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
     fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.
 
-- name: Verify service CIDR is ipv4 OR ipv6
+- name: Check that service CIDR is ipv4 OR ipv6
   when: not bootstrap_ipv6_enabled | default(false)
   ansible.builtin.assert:
     that: bootstrap_service_cidr is ansible.utils.ipv4 or bootstrap_service_cidr is ansible.utils.ipv6
     success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
     fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.
 
-- name: Verify cluster CIDR is ipv4 AND ipv6
+- name: Check that cluster CIDR is ipv4 AND ipv6
   when: bootstrap_ipv6_enabled | default(false)
   ansible.builtin.assert:
     that: >
@@ -48,7 +48,7 @@
     success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
     fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.
 
-- name: Verify service CIDR is ipv4 AND ipv6
+- name: Check that service CIDR is ipv4 AND ipv6
   when: bootstrap_ipv6_enabled | default(false)
   ansible.builtin.assert:
     that: >
@@ -62,67 +62,67 @@
     success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
     fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.
 
-- name: Verify k8s_gateway
+- name: Check that k8s_gateway is ipv4
   ansible.builtin.assert:
     that: bootstrap_k8s_gateway_addr is ansible.utils.ipv4
     success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is valid.
     fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is invalid.
 
-- name: Verify k8s_gateway in node CIDR
+- name: Check that k8s_gateway is in node CIDR
   ansible.builtin.assert:
     that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_k8s_gateway_addr)
     success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is within {{ bootstrap_node_cidr }}.
     fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is not within {{ bootstrap_node_cidr }}.
 
-- name: Verify internal ingress
+- name: Check that internal ingress is ipv4
   ansible.builtin.assert:
     that: bootstrap_internal_ingress_addr is ansible.utils.ipv4
     success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is valid.
     fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is invalid.
 
-- name: Verify internal ingress in node CIDR
+- name: Check that internal ingress is in node CIDR
   ansible.builtin.assert:
     that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_internal_ingress_addr)
     success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is within {{ bootstrap_node_cidr }}.
     fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is not within {{ bootstrap_node_cidr }}.
 
-- name: Verify external ingress
+- name: Check that external ingress is ipv4
   ansible.builtin.assert:
     that: bootstrap_external_ingress_addr is ansible.utils.ipv4
     success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is valid.
     fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is invalid.
 
-- name: Verify external ingress in node CIDR
+- name: Check external ingress is in node CIDR
   ansible.builtin.assert:
     that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_external_ingress_addr)
     success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is within {{ bootstrap_node_cidr }}.
     fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is not within {{ bootstrap_node_cidr }}.
 
-- name: Verify kubeapi address
+- name: Check that Kube API address is ipv4
   ansible.builtin.assert:
-    that: bootstrap_kubeapi_addr is ansible.utils.ipv4
-    success_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is valid.
-    fail_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is invalid.
+    that: bootstrap_kube_api_addr is ansible.utils.ipv4
+    success_msg: Kube API address {{ bootstrap_kube_api_addr }} is valid.
+    fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is invalid.
 
-- name: Verify kubeapi address in node CIDR
+- name: Check that Kube API address is in node CIDR
   ansible.builtin.assert:
-    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kubeapi_addr)
-    success_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is within {{ bootstrap_node_cidr }}.
-    fail_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is not within {{ bootstrap_node_cidr }}.
+    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kube_api_addr)
+    success_msg: Kube API address {{ bootstrap_kube_api_addr }} is within {{ bootstrap_node_cidr }}.
+    fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is not within {{ bootstrap_node_cidr }}.
 
-- name: Verify all IP addresses are unique
+- name: Check that all IP addresses are unique
   ansible.builtin.assert:
     that: >
       [
         bootstrap_k8s_gateway_addr,
         bootstrap_external_ingress_addr,
         bootstrap_internal_ingress_addr,
-        bootstrap_kubeapi_addr
+        bootstrap_kube_api_addr
       ] | unique | length == 4
     success_msg: All IP addresses are unique.
     fail_msg: All IP addresses are not unique.
 
-- name: Verify nodes are not the same IPs as k8s_gateway or ingress external/internal
+- name: Check that nodes are not the same IPs as k8s_gateway or ingress external/internal
   when: not bootstrap_kube_vip_enabled | default(true)
   ansible.builtin.assert:
     that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr)
@@ -133,18 +133,18 @@
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify nodes are not the same IPs as k8s_gateway, ingress external/internal or kubeapi address
+- name: Check that nodes are not the same IPs as k8s_gateway, ingress external/internal or Kube API address
   when: (bootstrap_distribution == "k3s") and (bootstrap_kube_vip_enabled | default(true))
   ansible.builtin.assert:
-    that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kubeapi_addr)
-    success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or kubeapi.
-    fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or kubeapi.
+    that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kube_api_addr)
+    success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or Kube API.
+    fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or Kube API.
     quiet: true
   loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify nodes are ipv4
+- name: Check that node addresses are ipv4
   ansible.builtin.assert:
     that: item.address is ansible.utils.ipv4
     success_msg: Node address {{ item.address }} is valid.
@@ -154,7 +154,7 @@
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify nodes are in node CIDR
+- name: Check that node addresses are in node CIDR
   ansible.builtin.assert:
     that: bootstrap_node_cidr | ansible.utils.network_in_usable(item.address)
     success_msg: Node address {{ item.address }} is within {{ bootstrap_node_cidr }}.
@@ -165,7 +165,7 @@
   loop_control:
     label: "{{ item.address }}"
 
-- name: Verify node IP addresses are unique
+- name: Check that node IP addresses are unique
   ansible.builtin.assert:
     that: >
       (
@@ -179,7 +179,7 @@
     fail_msg: All node IP addresses are not unique.
     quiet: true
 
-- name: Verify node names are unique
+- name: Check that node names are unique
   ansible.builtin.assert:
     that: >
       (
@@ -193,7 +193,7 @@
     fail_msg: All node names are not unique.
     quiet: true
 
-- name: Verify SSH port is reachable
+- name: Check that nodes SSH ports are reachable
   when: not ci_test | default(false)
   ansible.builtin.wait_for:
     host: "{{ current_address }}"

bootstrap/tasks/validation/vars.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Verify required bootstrap vars are set
+- name: Check that required bootstrap vars are set
   ansible.builtin.assert:
     that:
       - item in vars
@@ -25,13 +25,13 @@
     - bootstrap_internal_ingress_addr
     - bootstrap_ipv6_enabled
     - bootstrap_k8s_gateway_addr
-    - bootstrap_kubeapi_addr
+    - bootstrap_kube_api_addr
     - bootstrap_local_storage_path
     - bootstrap_node_cidr
     - bootstrap_service_cidr
     - bootstrap_timezone
 
-- name: Verify bootstrap node names are valid
+- name: Check that bootstrap node names are valid
   ansible.builtin.assert:
     that: item.name is match('^[a-z0-9-\.]+$')
     success_msg: Node name {{ item.name }} is valid

bootstrap/templates/.sops.yaml.j2

@@ -9,8 +9,3 @@ creation_rules:
     key_groups:
       - age:
           - "{{ bootstrap_age_public_key }}"
-  # https://github.com/ansible-collections/community.sops/issues/153
-  - path_regex: /dev/stdin
-    key_groups:
-      - age:
-          - "{{ bootstrap_age_public_key }}"

bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2

@@ -1,35 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta2
-kind: HelmRelease
-metadata:
-  name: kube-prometheus-stack
-spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: kube-prometheus-stack
-      version: 55.8.1
-      sourceRef:
-        kind: HelmRepository
-        name: prometheus-community
-        namespace: flux-system
-  maxHistory: 2
-  install:
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  uninstall:
-    keepHistory: false
-  dependsOn:
-    - name: openebs
-      namespace: storage
-  valuesFrom:
-    - name: kube-prometheus-stack-values
-      kind: ConfigMap
-      valuesKey: values.yaml

bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmvalues.yaml
-  - ./helmrelease.yaml

bootstrap/templates/addons/volsync/snapshot-controller/kustomization.yaml.j2

@@ -1,5 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 #
 # Below vars are for the xanmanning.k3s role
@@ -13,12 +14,12 @@ k3s_etcd_datastore: true
 {% else %}
 k3s_etcd_datastore: false
 {% endif %}
-k3s_registration_address: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
+k3s_registration_address: "{% raw %}{{ kube_api_addr }}{% endraw %}"
 # /var/lib/rancher/k3s/server/manifests
 k3s_server_manifests_templates:
   - custom-cilium-helmchart.yaml.j2
   - custom-coredns-helmchart.yaml.j2
-{% if bootstrap_kube_vip_enabled | default(true) %}
+{% if bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %}
 # /var/lib/rancher/k3s/server/manifests
 k3s_server_manifests_urls:
   - url: https://raw.githubusercontent.com/kube-vip/website/main/content/manifests/rbac.yaml
@@ -27,3 +28,4 @@ k3s_server_manifests_urls:
 k3s_server_pod_manifests_templates:
   - kube-vip-static-pod.yaml.j2
 {% endif %}
+{% endif %}

bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2

@@ -1,8 +1,12 @@
 ---
 timezone: "{{ bootstrap_timezone }}"
 github_username: "{{ bootstrap_github_username }}"
-coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | ansible.utils.nthhost(10) }}"
-kubeapi_addr: "{{ bootstrap_kubeapi_addr }}"
+coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}"
+{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
+kube_api_addr: "{{ bootstrap_nodes.master[0].address }}"
+{% else %}
+kube_api_addr: "{{ bootstrap_kube_api_addr }}"
+{% endif %}
 cluster_cidr: "{{ bootstrap_cluster_cidr.split(',')[0] }}"
 service_cidr: "{{ bootstrap_service_cidr.split(',')[0] }}"
 node_cidr: "{{ bootstrap_node_cidr }}"

bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
 # https://github.com/PyratLabs/ansible-role-k3s
@@ -10,7 +11,7 @@ k3s_server:
   node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
   {% endif %}
   tls-san:
-    - "{% raw %}{{ kubeapi_addr }}{% endraw %}"
+    - "{% raw %}{{ kube_api_addr }}{% endraw %}"
   docker: false
   flannel-backend: "none"             # This needs to be in quotes
   disable:
@@ -44,3 +45,4 @@ k3s_server:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
+{% endif %}

bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
 # https://github.com/PyratLabs/ansible-role-k3s
@@ -14,3 +15,4 @@ k3s_agent:
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
+{% endif %}

bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Cluster Installation
   hosts: kubernetes
@@ -59,3 +60,4 @@
     - name: Cruft
       when: k3s_primary_control_node
       ansible.builtin.include_tasks: tasks/cruft.yaml
+{% endif %}

bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Cluster kube-vip
   hosts: master
@@ -22,3 +23,4 @@
         src: templates/kube-vip-static-pod.yaml.j2
         dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml"
         mode: preserve
+{% endif %}

bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Cilium
   block:
@@ -54,3 +55,4 @@
         definition:
           metadata:
             finalizers: []
+{% endif %}

bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Coredns
   block:
@@ -54,3 +55,4 @@
         definition:
           metadata:
             finalizers: []
+{% endif %}

bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://github.com/k3s-io/k3s/issues/1971
 - name: Cruft
@@ -30,3 +31,4 @@
         namespace: kube-system
         state: absent
       loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
+{% endif %}

bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 - name: Get absolute path to this Git repository # noqa: command-instead-of-module
   ansible.builtin.command: git rev-parse --show-toplevel
@@ -24,3 +25,4 @@
     path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
     regexp: https://127.0.0.1:6443
     replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
+{% endif %}

bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://docs.k3s.io/helm
 apiVersion: helm.cattle.io/v1
@@ -36,7 +37,7 @@ spec:
     ipv6:
       enabled: true
     {% endif %}
-    k8sServiceHost: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
+    k8sServiceHost: "{% raw %}{{ kube_api_addr }}{% endraw %}"
     k8sServicePort: 6443
     kubeProxyReplacement: true
     kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
@@ -61,3 +62,4 @@ spec:
     routingMode: native
     securityContext:
       privileged: true
+{% endif %}

bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' %}
 ---
 # https://docs.k3s.io/helm
 apiVersion: helm.cattle.io/v1
@@ -75,3 +76,4 @@ spec:
         labelSelector:
           matchLabels:
             app.kubernetes.io/instance: coredns
+{% endif %}

bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k3s' and bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %}
 ---
 apiVersion: v1
 kind: Pod
@@ -15,7 +16,7 @@ spec:
       args: ["manager"]
       env:
         - name: address
-          value: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
+          value: "{% raw %}{{ kube_api_addr }}{% endraw %}"
         - name: vip_arp
           value: "true"
         - name: lb_enable
@@ -57,3 +58,4 @@ spec:
     - name: kubeconfig
       hostPath:
         path: /etc/rancher/k3s/k3s.yaml
+{% endif %}

bootstrap/templates/k0s-config.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == 'k0s' %}
 ---
 apiVersion: k0sctl.k0sproject.io/v1beta1
 kind: Cluster
@@ -42,12 +43,12 @@ spec:
             bind-address: "0.0.0.0"
         api:
           sans:
-            - {{ bootstrap_kubeapi_addr }}
+            - {{ bootstrap_kube_api_addr }}
             {% if bootstrap_kubeapi_hostname is defined %}
             - {{ bootstrap_kubeapi_hostname }}
             {% endif %}
             {% for item in bootstrap_nodes.master %}
-            {% if item.address != bootstrap_kubeapi_addr %}
+            {% if item.address != bootstrap_kube_api_addr %}
             - {{ item.address }}
             {% endif %}
             {% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %}
@@ -89,7 +90,11 @@ spec:
                   ipv6:
                     enabled: true
                   {% endif %}
-                  k8sServiceHost: "{{ bootstrap_kubeapi_addr }}"
+                  {% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
+                  k8sServiceHost: {{ bootstrap_nodes.master[0].address }}
+                  {% else %}
+                  k8sServiceHost: {{ bootstrap_kube_api_addr }}
+                  {% endif %}
                   k8sServicePort: 6443
                   kubeProxyReplacement: true
                   kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
@@ -123,3 +128,4 @@ spec:
             type: EnvoyProxy
           {% endif %}
           provider: custom
+{% endif %}

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if discord_template_notifier.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -61,3 +62,4 @@ spec:
           - path: /data/config.toml
             subPath: config.toml
             readOnly: true
+{% endif %}

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if discord_template_notifier.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+{% if discord_template_notifier.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: Secret
@@ -12,3 +13,4 @@ stringData:
     retry_limit = 5
     sink.type = "discord"
     sink.url = "{{ discord_template_notifier.webhook_url }}"
+{% endif %}

bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if discord_template_notifier.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -75,3 +76,4 @@ data:
           dateStyle: long
           timeStyle: short
           hourCycle: h23
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -86,3 +87,4 @@ spec:
             path: /app/config/widgets.yaml
     serviceAccount:
       create: true
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -5,3 +6,4 @@ resources:
   - ./configmap.yaml
   - ./helmrelease.yaml
   - ./secret.sops.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: Secret
@@ -9,3 +10,4 @@ stringData:
   HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "{{ bootstrap_cloudflare_token }}"
   HOMEPAGE_VAR_GRAFANA_USERNAME: admin
   HOMEPAGE_VAR_GRAFANA_PASSWORD: "{{ grafana.password }}"
+{% endif %}

bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if homepage.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if weave_gitops.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -55,3 +56,4 @@ spec:
       impersonationResourceNames: ["admin"]
     podAnnotations:
       secret.reloader.stakater.com/reload: cluster-user-auth
+{% endif %}

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if weave_gitops.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+{% if weave_gitops.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: Secret
@@ -6,4 +7,5 @@ metadata:
 type: Opaque
 stringData:
   username: admin
-  password: "{{ weave_gitops.password | password_hash('bcrypt', rounds=10) }}"
+  password: "{{ weave_gitops.password | encrypt }}"
+{% endif %}

bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if weave_gitops.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2

@@ -23,7 +23,112 @@ spec:
       retries: 3
   uninstall:
     keepHistory: false
-  valuesFrom:
-    - name: cilium-values
-      kind: ConfigMap
-      valuesKey: values.yaml
+  values:
+    autoDirectNodeRoutes: true
+    bpf:
+      masquerade: true
+    bgp:
+      enabled: false
+    cluster:
+      name: home-cluster
+      id: 1
+    containerRuntime:
+      integration: containerd
+      {% if bootstrap_distribution == "k3s" %}
+      socketPath: /var/run/k3s/containerd/containerd.sock
+      {% else %}
+      socketPath: /var/run/k0s/containerd.sock
+      {% endif %}
+    endpointRoutes:
+      enabled: true
+    hubble:
+      enabled: true
+      metrics:
+        enabled:
+          - dns:query
+          - drop
+          - tcp
+          - flow
+          - port-distribution
+          - icmp
+          - http
+        serviceMonitor:
+          enabled: true
+        dashboards:
+          enabled: true
+          annotations:
+            grafana_folder: Cilium
+      relay:
+        enabled: true
+        rollOutPods: true
+        prometheus:
+          serviceMonitor:
+            enabled: true
+      ui:
+        enabled: true
+        rollOutPods: true
+        ingress:
+          enabled: true
+          className: internal
+          {% if homepage.enabled | default(false) %}
+          annotations:
+            gethomepage.dev/enabled: "true"
+            gethomepage.dev/group: Network
+            gethomepage.dev/name: Cilium
+            gethomepage.dev/icon: cilium.png
+          {% endif %}
+          hosts:
+            - "hubble.${SECRET_DOMAIN}"
+          tls:
+            - hosts:
+                - "hubble.${SECRET_DOMAIN}"
+    ipam:
+      mode: kubernetes
+    ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
+    {% if bootstrap_ipv6_enabled | default(false) %}
+    ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
+    ipv6:
+      enabled: true
+    {% endif %}
+    k8sServiceHost: "${KUBE_API_ADDR}"
+    k8sServicePort: 6443
+    kubeProxyReplacement: true
+    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
+    l2announcements:
+      {% if bootstrap_ipv6_enabled | default(false) %}
+      enabled: false
+      {% else %}
+      enabled: true
+      # https://github.com/cilium/cilium/issues/26586
+      leaseDuration: 120s
+      leaseRenewDeadline: 60s
+      leaseRetryPeriod: 1s
+      {% endif %}
+    loadBalancer:
+      algorithm: maglev
+      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
+    localRedirectPolicy: true
+    operator:
+      replicas: 1
+      rollOutPods: true
+      prometheus:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+      dashboards:
+        enabled: true
+        annotations:
+          grafana_folder: Cilium
+    prometheus:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+        trustCRDsExist: true
+    dashboards:
+      enabled: true
+      annotations:
+        grafana_folder: Cilium
+    rollOutCiliumPods: true
+    routingMode: native
+    securityContext:
+      privileged: true

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2

@@ -1,115 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cilium-values
-data:
-  values.yaml: |
-    autoDirectNodeRoutes: true
-    bpf:
-      masquerade: true
-    bgp:
-      enabled: false
-    cluster:
-      name: home-cluster
-      id: 1
-    containerRuntime:
-      integration: containerd
-      {% if bootstrap_distribution == "k3s" %}
-      socketPath: /var/run/k3s/containerd/containerd.sock
-      {% else %}
-      socketPath: /var/run/k0s/containerd.sock
-      {% endif %}
-    endpointRoutes:
-      enabled: true
-    hubble:
-      enabled: true
-      metrics:
-        enabled:
-          - dns:query
-          - drop
-          - tcp
-          - flow
-          - port-distribution
-          - icmp
-          - http
-        serviceMonitor:
-          enabled: true
-        dashboards:
-          enabled: true
-          annotations:
-            grafana_folder: Cilium
-      relay:
-        enabled: true
-        rollOutPods: true
-        prometheus:
-          serviceMonitor:
-            enabled: true
-      ui:
-        enabled: true
-        rollOutPods: true
-        ingress:
-          enabled: true
-          className: internal
-          {% if homepage.enabled | default(false) %}
-          annotations:
-            gethomepage.dev/enabled: "true"
-            gethomepage.dev/group: Network
-            gethomepage.dev/name: Cilium
-            gethomepage.dev/icon: cilium.png
-          {% endif %}
-          hosts:
-            - "hubble.${SECRET_DOMAIN}"
-          tls:
-            - hosts:
-                - "hubble.${SECRET_DOMAIN}"
-    ipam:
-      mode: kubernetes
-    ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
-    {% if bootstrap_ipv6_enabled | default(false) %}
-    ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
-    ipv6:
-      enabled: true
-    {% endif %}
-    k8sServiceHost: "${KUBEAPI_ADDR}"
-    k8sServicePort: 6443
-    kubeProxyReplacement: true
-    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
-    l2announcements:
-      {% if bootstrap_ipv6_enabled | default(false) %}
-      enabled: false
-      {% else %}
-      enabled: true
-      # https://github.com/cilium/cilium/issues/26586
-      leaseDuration: 120s
-      leaseRenewDeadline: 60s
-      leaseRetryPeriod: 1s
-      {% endif %}
-    loadBalancer:
-      algorithm: maglev
-      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
-    localRedirectPolicy: true
-    operator:
-      replicas: 1
-      rollOutPods: true
-      prometheus:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-      dashboards:
-        enabled: true
-        annotations:
-          grafana_folder: Cilium
-    prometheus:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-        trustCRDsExist: true
-    dashboards:
-      enabled: true
-      annotations:
-        grafana_folder: Cilium
-    rollOutCiliumPods: true
-    routingMode: native
-    securityContext:
-      privileged: true

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2

@@ -5,5 +5,4 @@ resources:
   {% if not bootstrap_ipv6_enabled | default(false) %}
   - ./cilium-l2.yaml
   {% endif %}
-  - ./helmvalues.yaml
   - ./helmrelease.yaml

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -86,3 +87,4 @@ spec:
         labelSelector:
           matchLabels:
             app.kubernetes.io/instance: coredns
+{% endif %}

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2

@@ -1,5 +1,7 @@
+{% if bootstrap_distribution == "k3s" %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if bootstrap_distribution == "k3s" %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if grafana.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -180,3 +181,4 @@ spec:
       storageClassName: openebs-hostpath
     testFramework:
       enabled: false
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if grafana.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./secret.sops.yaml
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2

@@ -1,3 +1,4 @@
+{% if grafana.enabled | default(false) %}
 ---
 apiVersion: v1
 kind: Secret
@@ -6,3 +7,4 @@ metadata:
 stringData:
   admin-user: admin
   admin-password: "{{ grafana.password }}"
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if grafana.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2

@@ -1,10 +1,36 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
 ---
-apiVersion: v1
-kind: ConfigMap
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
 metadata:
-  name: kube-prometheus-stack-values
-data:
-  values.yaml: |
+  name: kube-prometheus-stack
+spec:
+  interval: 30m
+  timeout: 15m
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: 55.8.1
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  dependsOn:
+    - name: openebs
+      namespace: storage
+  values:
     crds:
       enabled: true
     cleanPrometheusOperatorObjectNames: true
@@ -138,3 +164,4 @@ data:
           multicluster:
             etcd:
               enabled: true
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2

@@ -0,0 +1,7 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if kube_prometheus_stack.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -45,3 +46,4 @@ spec:
             - *host
     metricsScraper:
       enabled: true
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./rbac.yaml
   - ./helmrelease.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2

@@ -1,3 +1,4 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
 # For dashboard sign in token:
 # kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
 ---
@@ -37,3 +38,4 @@ subjects:
   - kind: ServiceAccount
     name: kubernetes-dashboard
     namespace: observability
+{% endif %}

bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if kubernetes_dashboard.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -21,3 +22,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if csi_driver_nfs.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -26,3 +27,4 @@ spec:
   values:
     externalSnapshotter:
       enabled: false
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if csi_driver_nfs.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
   - ./storageclass.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2

@@ -1,3 +1,4 @@
+{% if csi_driver_nfs.enabled | default(false) %}
 {% for item in csi_driver_nfs.storage_class %}
 ---
 apiVersion: storage.k8s.io/v1
@@ -12,3 +13,4 @@ reclaimPolicy: Delete
 volumeBindingMode: Immediate
 mountOptions: ["hard", "noatime"]
 {% endfor %}
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if csi_driver_nfs.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -18,3 +19,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -40,3 +41,4 @@ spec:
       tag: *tag
     metrics:
       disableAuth: true
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2

@@ -1,6 +1,8 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./helmrelease.yaml
   - ./prometheusrule.yaml
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2

@@ -1,3 +1,4 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
@@ -21,3 +22,4 @@ spec:
           for: 15m
           labels:
             severity: critical
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2

@@ -1,3 +1,4 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -38,3 +39,4 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+{% endif %}

bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+{% if volsync.enabled | default(false) %}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -31,3 +32,4 @@ spec:
         create: true
     webhook:
       enabled: false
+{% endif %}