infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: replace ansible templating with makejinja (#1156)

Browse Source
This commit is contained in:
Devin Buhl authored and GitHub committed 2024-01-14 23:03:02 -05:00
1 parent a4731906d9
commit f9481d6202
113 files changed
+553 -904
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.envrc
+1 -1
View File
@@ -6,7 +6,7 @@ PATH_add "$(expand_path ./.venv/bin)"
export VIRTUAL_ENV="$(expand_path ./.venv)"
export ANSIBLE_COLLECTIONS_PATH=$(expand_path ./.venv/galaxy)
export ANSIBLE_ROLES_PATH=$(expand_path ./.venv/galaxy/ansible_roles)
export ANSIBLE_VARS_ENABLED="host_group_vars,community.sops.sops"
export ANSIBLE_VARS_ENABLED="host_group_vars"
export ANSIBLE_LOCALHOST_WARNING="False"
export ANSIBLE_INVENTORY_UNPARSED_WARNING="False"
export K8S_AUTH_KUBECONFIG="$(expand_path ./kubeconfig)"
.github/tests/config-k0s.yaml
+14 -2
View File
@@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake
bootstrap_cloudflare_tunnel_secret: fake
bootstrap_cloudflare_tunnel_id: fake
bootstrap_node_cidr: 10.10.10.0/24
bootstrap_kubeapi_addr: 10.10.10.254
bootstrap_kube_api_addr: 10.10.10.254
bootstrap_k8s_gateway_addr: 10.10.10.253
bootstrap_external_ingress_addr: 10.10.10.252
bootstrap_internal_ingress_addr: 10.10.10.251
@@ -30,7 +30,19 @@ bootstrap_nodes:
- name: k8s-0
address: 10.10.10.100
username: fake
worker:
- name: k8s-1
address: 10.10.10.101
username: fake
- name: k8s-2
address: 10.10.10.102
username: fake
worker:
- name: k8s-3
address: 10.10.10.103
username: fake
- name: k8s-4
address: 10.10.10.104
username: fake
- name: k8s-5
address: 10.10.10.105
username: fake
.github/tests/config-k3s-ipv4.yaml
+14 -2
View File
@@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake
bootstrap_cloudflare_tunnel_secret: fake
bootstrap_cloudflare_tunnel_id: fake
bootstrap_node_cidr: 10.10.10.0/24
bootstrap_kubeapi_addr: 10.10.10.254
bootstrap_kube_api_addr: 10.10.10.254
bootstrap_k8s_gateway_addr: 10.10.10.253
bootstrap_external_ingress_addr: 10.10.10.252
bootstrap_internal_ingress_addr: 10.10.10.251
@@ -30,7 +30,19 @@ bootstrap_nodes:
- name: k8s-0
address: 10.10.10.100
username: fake
worker:
- name: k8s-1
address: 10.10.10.101
username: fake
- name: k8s-2
address: 10.10.10.102
username: fake
worker:
- name: k8s-3
address: 10.10.10.103
username: fake
- name: k8s-4
address: 10.10.10.104
username: fake
- name: k8s-5
address: 10.10.10.105
username: fake
.github/tests/config-k3s-ipv6.yaml
+14 -2
View File
@@ -16,7 +16,7 @@ bootstrap_cloudflare_account_tag: fake
bootstrap_cloudflare_tunnel_secret: fake
bootstrap_cloudflare_tunnel_id: fake
bootstrap_node_cidr: 10.10.10.0/24
bootstrap_kubeapi_addr: 10.10.10.254
bootstrap_kube_api_addr: 10.10.10.254
bootstrap_k8s_gateway_addr: 10.10.10.253
bootstrap_external_ingress_addr: 10.10.10.252
bootstrap_internal_ingress_addr: 10.10.10.251
@@ -30,7 +30,19 @@ bootstrap_nodes:
- name: k8s-0
address: 10.10.10.100
username: fake
worker:
- name: k8s-1
address: 10.10.10.101
username: fake
- name: k8s-2
address: 10.10.10.102
username: fake
worker:
- name: k8s-3
address: 10.10.10.103
username: fake
- name: k8s-4
address: 10.10.10.104
username: fake
- name: k8s-5
address: 10.10.10.105
username: fake
.github/tests/config-k3s-no-kube-vip.yaml
+32
View File
@@ -0,0 +1,32 @@
---
ci_test: true
bootstrap_distribution: k3s
bootstrap_github_username: onedr0p
bootstrap_github_repository_name: flux-cluster-template
bootstrap_github_repository_branch: main
bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
bootstrap_timezone: Etc/UTC
bootstrap_acme_email: fake
bootstrap_acme_production_enabled: false
bootstrap_flux_github_webhook_token: fake
bootstrap_cloudflare_domain: fake
bootstrap_cloudflare_token: fake
bootstrap_cloudflare_account_tag: fake
bootstrap_cloudflare_tunnel_secret: fake
bootstrap_cloudflare_tunnel_id: fake
bootstrap_node_cidr: 10.10.10.0/24
bootstrap_kube_api_addr: # left blank to not use kube-vip
bootstrap_k8s_gateway_addr: 10.10.10.253
bootstrap_external_ingress_addr: 10.10.10.252
bootstrap_internal_ingress_addr: 10.10.10.251
bootstrap_cilium_loadbalancer_mode: dsr
bootstrap_ipv6_enabled: false
bootstrap_cluster_cidr: 10.42.0.0/16
bootstrap_service_cidr: 10.43.0.0/16
bootstrap_local_storage_path: /var/openebs/local
bootstrap_nodes:
master:
- name: k8s-0
address: 10.10.10.100
username: fake
.github/workflows/e2e.yaml
+3 -2
View File
@@ -40,6 +40,7 @@ jobs:
- k0s
- k3s-ipv4
- k3s-ipv6
- k3s-no-kube-vip
addon-files: ["addons"]
steps:
- name: Checkout
@@ -109,7 +110,7 @@ jobs:
- name: Run configure
shell: bash
run: task --yes configure
run: task configure --yes
- name: Run kubeconform
shell: bash
@@ -124,4 +125,4 @@ jobs:
shell: bash
run: |
task repo:clean
task --yes repo:reset
task repo:reset --yes
.gitignore
+4
View File
@@ -1,3 +1,7 @@
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class
# Trash
.DS_Store
Thumbs.db
.taskfiles/Ansible/Taskfile.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ env:
VIRTUAL_ENV: "{{.ROOT_DIR}}/.venv"
ANSIBLE_COLLECTIONS_PATH: "{{.ROOT_DIR}}/.venv/galaxy"
ANSIBLE_ROLES_PATH: "{{.ROOT_DIR}}/.venv/galaxy/ansible_roles"
ANSIBLE_VARS_ENABLED: "host_group_vars,community.sops.sops"
ANSIBLE_VARS_ENABLED: "host_group_vars"
ANSIBLE_LOCALHOST_WARNING: "False"
ANSIBLE_INVENTORY_UNPARSED_WARNING: "False"
.taskfiles/K0s/Taskfile.yaml
+3 -3
View File
@@ -10,14 +10,14 @@ tasks:
kubeconfig:
desc: Gets k0s cluster kubeconfig
cmds:
- k0sctl kubeconfig --config k0s-config.yaml > kubeconfig
- k0sctl kubeconfig --config {{.ROOT_DIR}}/k0s-config.yaml > kubeconfig
preconditions:
- { msg: "k0s-config.yaml not found", sh: "test -f {{.ROOT_DIR}}/k0s-config.yaml" }
apply:
desc: Apply k0s cluster k0s-config.yaml
cmds:
- k0sctl apply --config k0s-config.yaml
- k0sctl apply --config {{.ROOT_DIR}}/k0s-config.yaml
- task: kubeconfig
preconditions:
- { msg: "k0s-config.yaml not found", sh: "test -f {{.ROOT_DIR}}/k0s-config.yaml" }
@@ -25,7 +25,7 @@ tasks:
reset:
desc: Resets the k0s cluster
cmds:
- k0sctl reset --config k0s-config.yaml
- k0sctl reset --config {{.ROOT_DIR}}/k0s-config.yaml
- task: :ansible:run
vars:
playbook: cluster-nuke
.taskfiles/Repo/Taskfile.yaml
+10 -10
View File
@@ -12,28 +12,28 @@ tasks:
- rm -rf {{.ROOT_DIR}}/.github/workflows/e2e.yaml
# Move bootstrap directory to gitignored directory
- mkdir -p {{.ROOT_DIR}}/.private
- mv {{.ROOT_DIR}}/bootstrap {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}}
- mv {{.BOOTSTRAP_DIR}} {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}}
# Update renovate.json5
- sed -i {{if eq OS "darwin"}}''{{end}} 's/(..\.j2)\?(..\.j2)\?//g' {{.ROOT_DIR}}/.github/renovate.json5
- sed -i {{if eq OS "darwin"}}''{{end}} '/addons/d' {{.ROOT_DIR}}/.github/renovate.json5
preconditions:
- { msg: "bootstrap dir not found", sh: "test -d {{.ROOT_DIR}}/bootstrap" }
- { msg: "bootstrap dir not found", sh: "test -d {{.BOOTSTRAP_DIR}}" }
- { msg: "renovate.json5 not found", sh: "test -f {{.ROOT_DIR}}/.github/renovate.json5" }
reset:
desc: Remove templated configuration files
prompt: Remove templated configuration files... continue?
desc: Reset templated configuration files
prompt: Reset templated configuration files... continue?
cmds:
- rm -rf {{.ROOT_DIR}}/.sops.yaml
- rm -rf {{.ROOT_DIR}}/k0s-config.yaml
- rm -rf {{.ROOT_DIR}}/ansible
- rm -rf {{.ROOT_DIR}}/kubernetes
- rm -rf {{.ANSIBLE_DIR}}
- rm -rf {{.KUBERNETES_DIR}}
reset-repo:
desc: Set repo back to HEAD
prompt: Set repo back to HEAD... continue?
force-reset:
desc: Reset repo back to HEAD
prompt: Reset repo back to HEAD... continue?
cmds:
- task: reset
- git reset --hard HEAD
- git clean -f -d
- git pull
- git pull origin main
.taskfiles/Sops/Taskfile.yaml
+9 -12
View File
@@ -12,7 +12,6 @@ tasks:
encrypt:
desc: Encrypt a secret
aliases: ["e"]
summary: |
Args:
file: Path to file to encrypt (required)
@@ -23,15 +22,13 @@ tasks:
- { msg: "Sops config not found", sh: "test -f {{.ROOT_DIR}}/.sops.yaml" }
- { msg: "Age key not found", sh: "test -f {{.ROOT_DIR}}/age.key" }
decrypt:
desc: Decrypt a secret
aliases: ["d"]
summary: |
Args:
file: Path to file to decrypt (required)
cmd: sops --decrypt --in-place {{.SECRET}}
encrypt:all:
desc: Encrypt all Kubernetes SOPS secrets
cmds:
- for: { var: file }
task: encrypt
vars:
claim: '{{ or .file (fail "Argument (file) is required") }}'
preconditions:
- { msg: "Sops config not found", sh: "test -f {{.ROOT_DIR}}/.sops.yaml" }
- { msg: "Age key not found", sh: "test -f {{.ROOT_DIR}}/age.key" }
file: '{{.ITEM}}'
vars:
file:
sh: find {{.KUBERNETES_DIR}} -type f -name "*.sops.*"
.taskfiles/Workstation/ArchPackages
+2 -4
View File
@@ -1,17 +1,15 @@
age
cilium-cli
cloudflared-bin
direnv
flux-bin
go-task
go-yq
helm
jq
k0sctl-bin
k9s
kubeconform
kubectl-bin
kustomize
moreutils
sops
stern-bin
go-task
go-yq
.taskfiles/Workstation/Brewfile
+1 -4
View File
@@ -1,18 +1,15 @@
tap "fluxcd/tap"
tap "go-task/tap"
tap "k0sproject/tap"
tap "kubecolor/tap"
brew "age"
brew "cilium-cli"
brew "cloudflared"
brew "direnv"
brew "fluxcd/tap/flux"
brew "go-task/tap/go-task"
brew "helm"
brew "jq"
brew "k0sproject/tap/k0sctl"
brew "k9s"
brew "kubeconform"
brew "kubecolor/tap/kubecolor"
brew "kubernetes-cli"
brew "kustomize"
brew "moreutils"
.taskfiles/Workstation/Taskfile.yaml
+11 -1
View File
@@ -14,8 +14,18 @@ tasks:
Head over to https://brew.sh to get up and running.
- { msg: "Brewfile not found", sh: "test -f {{.ROOT_DIR}}/.taskfiles/Workstation/Brewfile" }
yay:
paru:
desc: Install workstation dependencies with Paru
cmd: paru -Syu --needed --noconfirm --noprogressbar $(cat {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages | xargs)
preconditions:
- sh: command -v paru
msg: |
Paru is not installed. Using ArchLinux?
Head over to https://github.com/Morganamilo/paru to get up and running.
- { msg: "ArchPackages not found", sh: "test -f {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages" }
yay:
desc: Install workstation dependencies with Yay
cmd: yay -Syu --needed --noconfirm --noprogressbar $(cat {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages | xargs)
preconditions:
- sh: command -v yay
Taskfile.yaml
+28 -1
View File
@@ -47,6 +47,33 @@ tasks:
configure:
desc: Configure repository from Ansible vars
prompt: Any conflicting config in the root kubernetes and ansible directories will be overwritten... continue?
cmd: ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/configure.yaml
cmds:
- task: .validate
- task: .template
- task: sops:encrypt:all
.validate:
internal: true
cmd: ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/validate.yaml
env:
ANSIBLE_DISPLAY_SKIPPED_HOSTS: "false"
preconditions:
- { msg: "addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" }
- { msg: "config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" }
.template:
internal: true
cmds:
- ./.venv/bin/makejinja
--input "{{.BOOTSTRAP_DIR}}/templates"
--output "{{.ROOT_DIR}}"
--data "{{.BOOTSTRAP_DIR}}/vars/config.yaml"
--data "{{.BOOTSTRAP_DIR}}/vars/addons.yaml"
--import-path "{{.BOOTSTRAP_DIR}}/scripts"
--loader "loader:Loader"
--jinja-suffix ".j2" --quiet --force
- find {{.ANSIBLE_DIR}} {{.KUBERNETES_DIR}} -type d -empty -delete
preconditions:
- { msg: "addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" }
- { msg: "config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" }
- { msg: "loader file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/loader.py" }
bootstrap/configure.yaml
-45
View File
@@ -1,45 +0,0 @@
---
- name: Cluster Installation
hosts: localhost
connection: local
gather_facts: false
vars_files:
- vars/config.yaml
- vars/addons.yaml
tasks:
- name: Get absolute path to this Git repository # noqa: command-instead-of-module
ansible.builtin.command: git rev-parse --show-toplevel
changed_when: false
check_mode: false
register: repository
failed_when: repository.rc != 0
- name: Set facts
ansible.builtin.set_fact:
repository_path: "{{ repository.stdout }}"
- name: Override kubeapi address when there is a single master node and no address is defined
when: bootstrap_nodes.master | length == 1 and not bootstrap_kubeapi_addr
ansible.builtin.set_fact:
bootstrap_kube_vip_enabled: false
bootstrap_kubeapi_addr: "{{ bootstrap_nodes.master[0].address }}"
- name: Verify configuration
ansible.builtin.include_tasks: tasks/validation/main.yaml
- name: Template Sops configuration
ansible.builtin.include_tasks: tasks/sops/main.yaml
- name: Template k0s configuration
when: bootstrap_distribution == "k0s"
ansible.builtin.include_tasks: tasks/k0s/main.yaml
- name: Template Ansible configuration
when: bootstrap_distribution == "k0s" or bootstrap_distribution == "k3s"
ansible.builtin.include_tasks: tasks/ansible/main.yaml
- name: Template Kubernetes configuration
ansible.builtin.include_tasks: tasks/kubernetes/main.yaml
- name: Template Kubernetes addon configuration
ansible.builtin.include_tasks: tasks/addons/main.yaml
bootstrap/scripts/loader.py
+21
View File
@@ -0,0 +1,21 @@
import netaddr, bcrypt
def nthhost(value: str, query: int) -> str:
value = netaddr.IPNetwork(value)
try:
nth = int(query)
if value.size > nth:
return str(value[nth])
except ValueError:
return False
return value
def encrypt(value: str) -> str:
return bcrypt.hashpw(value.encode(), bcrypt.gensalt(rounds=10)).decode("ascii")
class Loader:
def filters(self):
return [nthhost, encrypt]
bootstrap/tasks/addons/coredns.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: coredns
addon_namespace: kube-system
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/csi_driver_nfs.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: csi-driver-nfs
addon_namespace: storage
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/discord_template_notifier.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: discord-template-notifier
addon_namespace: default
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/grafana.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: grafana
addon_namespace: observability
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/homepage.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: homepage
addon_namespace: default
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/kube_prometheus_stack.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: kube-prometheus-stack
addon_namespace: observability
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/kubernetes_dashboard.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: kubernetes-dashboard
addon_namespace: observability
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/main.yaml
-43
View File
@@ -1,43 +0,0 @@
---
- name: Process optional coredns
when: bootstrap_distribution == "k3s"
ansible.builtin.include_tasks: coredns.yaml
- name: Process addon csi-driver-nfs
when: csi_driver_nfs.enabled | default(false)
ansible.builtin.include_tasks: csi_driver_nfs.yaml
- name: Process addon homepage
when: homepage.enabled | default(false)
ansible.builtin.include_tasks: homepage.yaml
- name: Process addon grafana
when: grafana.enabled | default(false)
ansible.builtin.include_tasks: grafana.yaml
- name: Process addon kubernetes-dashboard
when: kubernetes_dashboard.enabled | default(false)
ansible.builtin.include_tasks: kubernetes_dashboard.yaml
- name: Process addon kube-prometheus-stack
when: kube_prometheus_stack.enabled | default(false)
ansible.builtin.include_tasks: kube_prometheus_stack.yaml
- name: Process addon system-upgrade-controller
when:
- bootstrap_distribution == "k3s"
- system_upgrade_controller.enabled | default(false)
ansible.builtin.include_tasks: system_upgrade_controller.yaml
- name: Process addon weave-gitops
when: weave_gitops.enabled | default(false)
ansible.builtin.include_tasks: weave_gitops.yaml
- name: Process addon discord-template-notifier
when: discord_template_notifier.enabled | default(false)
ansible.builtin.include_tasks: discord_template_notifier.yaml
- name: Process addon volsync
when: volsync.enabled | default(false)
ansible.builtin.include_tasks: volsync.yaml
bootstrap/tasks/addons/system_upgrade_controller.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: system-upgrade-controller
addon_namespace: tools
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/volsync.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: volsync
addon_namespace: storage
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/addons/weave_gitops.yaml
-39
View File
@@ -1,39 +0,0 @@
---
- name: Set addon facts
ansible.builtin.set_fact:
addon_name: weave-gitops
addon_namespace: flux-system
- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
when: item.state == 'file' and 'sops' not in item.path
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
- name: Template encrypted files
when: item.state == 'file' and 'sops' in item.path
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/ansible/main.yaml
-45
View File
@@ -1,45 +0,0 @@
---
- name: Ensure Ansible k3s directories exist
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/ansible/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree:
- "../templates/ansible/shared/"
- "../templates/ansible/{{ bootstrap_distribution }}/"
loop_control:
label: "{{ item.path }}"
- name: Template Ansible unencrypted files
when:
- "item.state == 'file'"
- "'sops' not in item.path"
- "'.DS_Store' not in item.path"
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/ansible/{{ item.path | regex_replace('.j2$', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree:
- "../templates/ansible/shared/"
- "../templates/ansible/{{ bootstrap_distribution }}/"
loop_control:
label: "{{ item.path }}"
- name: Template Ansible encrypted files
when:
- "item.state == 'file'"
- "'sops' in item.path"
community.sops.sops_encrypt:
path: "{{ repository_path }}/ansible/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree:
- "../templates/ansible/shared/"
- "../templates/ansible/{{ bootstrap_distribution }}/"
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/k0s/main.yaml
-7
View File
@@ -1,7 +0,0 @@
---
- name: Template k0s configuration file
ansible.builtin.template:
src: "templates/k0s/k0s-config.yaml.j2"
dest: "{{ repository_path }}/k0s-config.yaml"
mode: "0644"
lstrip_blocks: true
bootstrap/tasks/kubernetes/main.yaml
-79
View File
@@ -1,79 +0,0 @@
---
- name: Ensure Kubernetes directories exist
when: item.state == 'directory'
ansible.builtin.file:
path: "{{ repository_path }}/kubernetes/{{ item.path }}"
state: directory
mode: "0755"
with_community.general.filetree: ["../templates/kubernetes/"]
loop_control:
label: "{{ item.path }}"
- name: Template Kubernetes unencrypted files
when:
- "item.state == 'file'"
- "'.DS_Store' not in item.path"
- "'sops' not in item.path"
- "'cluster-settings-user.yaml.j2' not in item.path"
- "'cluster-secrets-user.yaml.j2' not in item.path"
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/kubernetes/"]
loop_control:
label: "{{ item.path }}"
- name: Check if the cluster user settings file already exists
stat:
path: "{{ repository_path }}/kubernetes/flux/vars/cluster-settings-user.yaml"
register: cluster_settings_user
- name: Template Kubernetes user cluster settings
when:
- "item.state == 'file'"
- "'cluster-settings-user.yaml' in item.path"
- "not cluster_settings_user.stat.exists"
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/kubernetes/"]
loop_control:
label: "{{ item.path }}"
- name: Check if the cluster user secrets file already exists
stat:
path: "{{ repository_path }}/kubernetes/flux/vars/cluster-secrets-user.yaml"
register: cluster_secrets_user
- name: Template Kubernetes user cluster secrets
when:
- "item.state == 'file'"
- "'cluster-secrets-user.yaml' in item.path"
- "not cluster_secrets_user.stat.exists"
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
mode: "0644"
lstrip_blocks: true
with_community.general.filetree: ["../templates/kubernetes/"]
loop_control:
label: "{{ item.path }}"
- name: Template Kubernetes encrypted files
when:
- "item.state == 'file'"
- "'sops' in item.path"
community.sops.sops_encrypt:
path: "{{ repository_path }}/kubernetes/{{ item.path | replace('.j2', '') }}"
encrypted_regex: ^(data|stringData)$
age: ["{{ bootstrap_age_public_key }}"]
content_yaml: "{{ lookup('ansible.builtin.template', item.src, lstrip_blocks=true) | from_yaml }}"
mode: "0644"
force: true
with_community.general.filetree: ["../templates/kubernetes/"]
loop_control:
label: "{{ item.path }}"
bootstrap/tasks/sops/main.yaml
-7
View File
@@ -1,7 +0,0 @@
---
- name: Template Sops configuration file
ansible.builtin.template:
src: "templates/.sops.yaml.j2"
dest: "{{ repository_path }}/.sops.yaml"
mode: "0644"
lstrip_blocks: true
bootstrap/tasks/validation/cli.yaml
+2 -2
View File
@@ -1,8 +1,8 @@
---
- name: Check for required CLI tools
- name: Check if required CLI tools are present
ansible.builtin.shell: |
command -v {{ item }} >/dev/null 2>&1
loop: [age, cloudflared, flux, sops, kubeconform, kustomize, jq]
loop: [age, cloudflared, flux, sops, jq]
changed_when: false
check_mode: false
register: result
bootstrap/tasks/validation/net.yaml
+32 -32
View File
@@ -6,7 +6,7 @@
loop_control:
label: "{{ item.address }}"
- name: Verify master node count
- name: Check that master node count is odd
ansible.builtin.assert:
that:
- bootstrap_nodes.master | length > 0
@@ -14,27 +14,27 @@
success_msg: Master node count {{ bootstrap_nodes.master | length }} is correct.
fail_msg: Master node count {{ bootstrap_nodes.master | length }} is not greater than 0 or is not odd.
- name: Verify node CIDR
- name: Check that node CIDR is ipv4
ansible.builtin.assert:
that: bootstrap_node_cidr is ansible.utils.ipv4
success_msg: Node CIDR {{ bootstrap_node_cidr }} is valid.
fail_msg: Node CIDR {{ bootstrap_node_cidr }} is invalid.
- name: Verify cluster CIDR is ipv4 OR ipv6
- name: Check that cluster CIDR is ipv4 OR ipv6
when: not bootstrap_ipv6_enabled | default(false)
ansible.builtin.assert:
that: bootstrap_cluster_cidr is ansible.utils.ipv4 or bootstrap_cluster_cidr is ansible.utils.ipv6
success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.
- name: Verify service CIDR is ipv4 OR ipv6
- name: Check that service CIDR is ipv4 OR ipv6
when: not bootstrap_ipv6_enabled | default(false)
ansible.builtin.assert:
that: bootstrap_service_cidr is ansible.utils.ipv4 or bootstrap_service_cidr is ansible.utils.ipv6
success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.
- name: Verify cluster CIDR is ipv4 AND ipv6
- name: Check that cluster CIDR is ipv4 AND ipv6
when: bootstrap_ipv6_enabled | default(false)
ansible.builtin.assert:
that: >
@@ -48,7 +48,7 @@
success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.
- name: Verify service CIDR is ipv4 AND ipv6
- name: Check that service CIDR is ipv4 AND ipv6
when: bootstrap_ipv6_enabled | default(false)
ansible.builtin.assert:
that: >
@@ -62,67 +62,67 @@
success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.
- name: Verify k8s_gateway
- name: Check that k8s_gateway is ipv4
ansible.builtin.assert:
that: bootstrap_k8s_gateway_addr is ansible.utils.ipv4
success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is valid.
fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is invalid.
- name: Verify k8s_gateway in node CIDR
- name: Check that k8s_gateway is in node CIDR
ansible.builtin.assert:
that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_k8s_gateway_addr)
success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is within {{ bootstrap_node_cidr }}.
fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is not within {{ bootstrap_node_cidr }}.
- name: Verify internal ingress
- name: Check that internal ingress is ipv4
ansible.builtin.assert:
that: bootstrap_internal_ingress_addr is ansible.utils.ipv4
success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is valid.
fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is invalid.
- name: Verify internal ingress in node CIDR
- name: Check that internal ingress is in node CIDR
ansible.builtin.assert:
that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_internal_ingress_addr)
success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is within {{ bootstrap_node_cidr }}.
fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is not within {{ bootstrap_node_cidr }}.
- name: Verify external ingress
- name: Check that external ingress is ipv4
ansible.builtin.assert:
that: bootstrap_external_ingress_addr is ansible.utils.ipv4
success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is valid.
fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is invalid.
- name: Verify external ingress in node CIDR
- name: Check external ingress is in node CIDR
ansible.builtin.assert:
that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_external_ingress_addr)
success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is within {{ bootstrap_node_cidr }}.
fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is not within {{ bootstrap_node_cidr }}.
- name: Verify kubeapi address
- name: Check that Kube API address is ipv4
ansible.builtin.assert:
that: bootstrap_kubeapi_addr is ansible.utils.ipv4
success_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is valid.
fail_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is invalid.
that: bootstrap_kube_api_addr is ansible.utils.ipv4
success_msg: Kube API address {{ bootstrap_kube_api_addr }} is valid.
fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is invalid.
- name: Verify kubeapi address in node CIDR
- name: Check that Kube API address is in node CIDR
ansible.builtin.assert:
that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kubeapi_addr)
success_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is within {{ bootstrap_node_cidr }}.
fail_msg: kubeapi address {{ bootstrap_kubeapi_addr }} is not within {{ bootstrap_node_cidr }}.
that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kube_api_addr)
success_msg: Kube API address {{ bootstrap_kube_api_addr }} is within {{ bootstrap_node_cidr }}.
fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is not within {{ bootstrap_node_cidr }}.
- name: Verify all IP addresses are unique
- name: Check that all IP addresses are unique
ansible.builtin.assert:
that: >
[
bootstrap_k8s_gateway_addr,
bootstrap_external_ingress_addr,
bootstrap_internal_ingress_addr,
bootstrap_kubeapi_addr
bootstrap_kube_api_addr
] | unique | length == 4
success_msg: All IP addresses are unique.
fail_msg: All IP addresses are not unique.
- name: Verify nodes are not the same IPs as k8s_gateway or ingress external/internal
- name: Check that nodes are not the same IPs as k8s_gateway or ingress external/internal
when: not bootstrap_kube_vip_enabled | default(true)
ansible.builtin.assert:
that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr)
@@ -133,18 +133,18 @@
loop_control:
label: "{{ item.address }}"
- name: Verify nodes are not the same IPs as k8s_gateway, ingress external/internal or kubeapi address
- name: Check that nodes are not the same IPs as k8s_gateway, ingress external/internal or Kube API address
when: (bootstrap_distribution == "k3s") and (bootstrap_kube_vip_enabled | default(true))
ansible.builtin.assert:
that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kubeapi_addr)
success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or kubeapi.
fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or kubeapi.
that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kube_api_addr)
success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or Kube API.
fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or Kube API.
quiet: true
loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
loop_control:
label: "{{ item.address }}"
- name: Verify nodes are ipv4
- name: Check that node addresses are ipv4
ansible.builtin.assert:
that: item.address is ansible.utils.ipv4
success_msg: Node address {{ item.address }} is valid.
@@ -154,7 +154,7 @@
loop_control:
label: "{{ item.address }}"
- name: Verify nodes are in node CIDR
- name: Check that node addresses are in node CIDR
ansible.builtin.assert:
that: bootstrap_node_cidr | ansible.utils.network_in_usable(item.address)
success_msg: Node address {{ item.address }} is within {{ bootstrap_node_cidr }}.
@@ -165,7 +165,7 @@
loop_control:
label: "{{ item.address }}"
- name: Verify node IP addresses are unique
- name: Check that node IP addresses are unique
ansible.builtin.assert:
that: >
(
@@ -179,7 +179,7 @@
fail_msg: All node IP addresses are not unique.
quiet: true
- name: Verify node names are unique
- name: Check that node names are unique
ansible.builtin.assert:
that: >
(
@@ -193,7 +193,7 @@
fail_msg: All node names are not unique.
quiet: true
- name: Verify SSH port is reachable
- name: Check that nodes SSH ports are reachable
when: not ci_test | default(false)
ansible.builtin.wait_for:
host: "{{ current_address }}"
bootstrap/tasks/validation/vars.yaml
+3 -3
View File
@@ -1,5 +1,5 @@
---
- name: Verify required bootstrap vars are set
- name: Check that required bootstrap vars are set
ansible.builtin.assert:
that:
- item in vars
@@ -25,13 +25,13 @@
- bootstrap_internal_ingress_addr
- bootstrap_ipv6_enabled
- bootstrap_k8s_gateway_addr
- bootstrap_kubeapi_addr
- bootstrap_kube_api_addr
- bootstrap_local_storage_path
- bootstrap_node_cidr
- bootstrap_service_cidr
- bootstrap_timezone
- name: Verify bootstrap node names are valid
- name: Check that bootstrap node names are valid
ansible.builtin.assert:
that: item.name is match('^[a-z0-9-\.]+$')
success_msg: Node name {{ item.name }} is valid
bootstrap/templates/.sops.yaml.j2
-5
View File
@@ -9,8 +9,3 @@ creation_rules:
key_groups:
- age:
- "{{ bootstrap_age_public_key }}"
# https://github.com/ansible-collections/community.sops/issues/153
- path_regex: /dev/stdin
key_groups:
- age:
- "{{ bootstrap_age_public_key }}"
bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2
-35
View File
@@ -1,35 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
name: kube-prometheus-stack
spec:
interval: 30m
timeout: 15m
chart:
spec:
chart: kube-prometheus-stack
version: 55.8.1
sourceRef:
kind: HelmRepository
name: prometheus-community
namespace: flux-system
maxHistory: 2
install:
crds: CreateReplace
remediation:
retries: 3
upgrade:
cleanupOnFail: true
crds: CreateReplace
remediation:
retries: 3
uninstall:
keepHistory: false
dependsOn:
- name: openebs
namespace: storage
valuesFrom:
- name: kube-prometheus-stack-values
kind: ConfigMap
valuesKey: values.yaml
bootstrap/templates/addons/kube-prometheus-stack/app/kustomization.yaml.j2
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmvalues.yaml
- ./helmrelease.yaml
bootstrap/templates/addons/volsync/snapshot-controller/kustomization.yaml.j2
-5
View File
@@ -1,5 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
bootstrap/templates/ansible/shared/.ansible-lint.j2 → bootstrap/templates/ansible/.ansible-lint.j2
View File
File renamed without changes.
bootstrap/templates/ansible/k3s/inventory/group_vars/kubernetes/main.yaml.j2 → bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2
+4 -2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
#
# Below vars are for the xanmanning.k3s role
@@ -13,12 +14,12 @@ k3s_etcd_datastore: true
{% else %}
k3s_etcd_datastore: false
{% endif %}
k3s_registration_address: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
k3s_registration_address: "{% raw %}{{ kube_api_addr }}{% endraw %}"
# /var/lib/rancher/k3s/server/manifests
k3s_server_manifests_templates:
- custom-cilium-helmchart.yaml.j2
- custom-coredns-helmchart.yaml.j2
{% if bootstrap_kube_vip_enabled | default(true) %}
{% if bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %}
# /var/lib/rancher/k3s/server/manifests
k3s_server_manifests_urls:
- url: https://raw.githubusercontent.com/kube-vip/website/main/content/manifests/rbac.yaml
@@ -27,3 +28,4 @@ k3s_server_manifests_urls:
k3s_server_pod_manifests_templates:
- kube-vip-static-pod.yaml.j2
{% endif %}
{% endif %}
bootstrap/templates/ansible/shared/inventory/group_vars/kubernetes/supplemental.yaml.j2 → bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2
+6 -2
View File
@@ -1,8 +1,12 @@
---
timezone: "{{ bootstrap_timezone }}"
github_username: "{{ bootstrap_github_username }}"
coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | ansible.utils.nthhost(10) }}"
kubeapi_addr: "{{ bootstrap_kubeapi_addr }}"
coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}"
{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
kube_api_addr: "{{ bootstrap_nodes.master[0].address }}"
{% else %}
kube_api_addr: "{{ bootstrap_kube_api_addr }}"
{% endif %}
cluster_cidr: "{{ bootstrap_cluster_cidr.split(',')[0] }}"
service_cidr: "{{ bootstrap_service_cidr.split(',')[0] }}"
node_cidr: "{{ bootstrap_node_cidr }}"
bootstrap/templates/ansible/k3s/inventory/group_vars/master/main.yaml.j2 → bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2
+9 -7
View File
@@ -1,16 +1,17 @@
{% if bootstrap_distribution == 'k3s' %}
---
# https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
# https://github.com/PyratLabs/ansible-role-k3s
k3s_control_node: true
k3s_server:
{% if bootstrap_ipv6_enabled | default(false) %}
{% if bootstrap_ipv6_enabled | default(false) %}
node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}"
{% else %}
{% else %}
node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
{% endif %}
{% endif %}
tls-san:
- "{% raw %}{{ kubeapi_addr }}{% endraw %}"
- "{% raw %}{{ kube_api_addr }}{% endraw %}"
docker: false
flannel-backend: "none" # This needs to be in quotes
disable:
@@ -26,13 +27,13 @@ k3s_server:
write-kubeconfig-mode: "644"
pause-image: registry.k8s.io/pause:3.9
secrets-encryption: true
{% if bootstrap_ipv6_enabled | default(false) %}
{% if bootstrap_ipv6_enabled | default(false) %}
cluster-cidr: "{% raw %}{{ cluster_cidr }},{{ cluster_cidr_v6 }}{% endraw %}"
service-cidr: "{% raw %}{{ service_cidr }},{{ service_cidr_v6 }}{% endraw %}"
{% else %}
{% else %}
cluster-cidr: "{% raw %}{{ cluster_cidr }}{% endraw %}"
service-cidr: "{% raw %}{{ service_cidr }}{% endraw %}"
{% endif %}
{% endif %}
etcd-expose-metrics: true # Required to monitor etcd with kube-prometheus-stack
kube-controller-manager-arg:
- "bind-address=0.0.0.0" # Required to monitor kube-controller-manager with kube-prometheus-stack
@@ -44,3 +45,4 @@ k3s_server:
kubelet-arg:
- "image-gc-high-threshold=55"
- "image-gc-low-threshold=50"
{% endif %}
bootstrap/templates/ansible/k3s/inventory/group_vars/worker/main.yaml.j2 → bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2
+5 -3
View File
@@ -1,16 +1,18 @@
{% if bootstrap_distribution == 'k3s' %}
---
# https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
# https://github.com/PyratLabs/ansible-role-k3s
k3s_control_node: false
k3s_agent:
{% if bootstrap_ipv6_enabled | default(false) %}
{% if bootstrap_ipv6_enabled | default(false) %}
node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}"
{% else %}
{% else %}
node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
{% endif %}
{% endif %}
pause-image: registry.k8s.io/pause:3.9
# TODO: Move these options to a kubelet config file
kubelet-arg:
- "image-gc-high-threshold=55"
- "image-gc-low-threshold=50"
{% endif %}
bootstrap/templates/ansible/shared/inventory/hosts.yaml.j2 → bootstrap/templates/ansible/inventory/hosts.yaml.j2
View File
File renamed without changes.
bootstrap/templates/ansible/k0s/.gitkeep.j2
View File
Whitespace-only changes.
bootstrap/templates/ansible/k3s/playbooks/cluster-installation.yaml.j2 → bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
- name: Cluster Installation
hosts: kubernetes
@@ -59,3 +60,4 @@
- name: Cruft
when: k3s_primary_control_node
ansible.builtin.include_tasks: tasks/cruft.yaml
{% endif %}
bootstrap/templates/ansible/k3s/playbooks/cluster-kube-vip.yaml.j2 → bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
- name: Cluster kube-vip
hosts: master
@@ -22,3 +23,4 @@
src: templates/kube-vip-static-pod.yaml.j2
dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml"
mode: preserve
{% endif %}
bootstrap/templates/ansible/shared/playbooks/cluster-nuke.yaml.j2 → bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2
View File
File renamed without changes.
bootstrap/templates/ansible/shared/playbooks/cluster-prepare.yaml.j2 → bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2
View File
File renamed without changes.
bootstrap/templates/ansible/shared/playbooks/cluster-reboot.yaml.j2 → bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2
View File
File renamed without changes.
bootstrap/templates/ansible/shared/playbooks/cluster-rollout-update.yaml.j2 → bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2
View File
File renamed without changes.
bootstrap/templates/ansible/k3s/playbooks/tasks/cilium.yaml.j2 → bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
- name: Cilium
block:
@@ -54,3 +55,4 @@
definition:
metadata:
finalizers: []
{% endif %}
bootstrap/templates/ansible/k3s/playbooks/tasks/coredns.yaml.j2 → bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
- name: Coredns
block:
@@ -54,3 +55,4 @@
definition:
metadata:
finalizers: []
{% endif %}
bootstrap/templates/ansible/k3s/playbooks/tasks/cruft.yaml.j2 → bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
# https://github.com/k3s-io/k3s/issues/1971
- name: Cruft
@@ -30,3 +31,4 @@
namespace: kube-system
state: absent
loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
{% endif %}
bootstrap/templates/ansible/k3s/playbooks/tasks/kubeconfig.yaml.j2 → bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
- name: Get absolute path to this Git repository # noqa: command-instead-of-module
ansible.builtin.command: git rev-parse --show-toplevel
@@ -24,3 +25,4 @@
path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
regexp: https://127.0.0.1:6443
replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
{% endif %}
bootstrap/templates/ansible/k3s/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 → bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2
+3 -1
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
# https://docs.k3s.io/helm
apiVersion: helm.cattle.io/v1
@@ -36,7 +37,7 @@ spec:
ipv6:
enabled: true
{% endif %}
k8sServiceHost: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
k8sServiceHost: "{% raw %}{{ kube_api_addr }}{% endraw %}"
k8sServicePort: 6443
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
@@ -61,3 +62,4 @@ spec:
routingMode: native
securityContext:
privileged: true
{% endif %}
bootstrap/templates/ansible/k3s/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2 → bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
---
# https://docs.k3s.io/helm
apiVersion: helm.cattle.io/v1
@@ -75,3 +76,4 @@ spec:
labelSelector:
matchLabels:
app.kubernetes.io/instance: coredns
{% endif %}
bootstrap/templates/ansible/k3s/playbooks/templates/kube-vip-static-pod.yaml.j2.j2 → bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2
+3 -1
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k3s' and bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %}
---
apiVersion: v1
kind: Pod
@@ -15,7 +16,7 @@ spec:
args: ["manager"]
env:
- name: address
value: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
value: "{% raw %}{{ kube_api_addr }}{% endraw %}"
- name: vip_arp
value: "true"
- name: lb_enable
@@ -57,3 +58,4 @@ spec:
- name: kubeconfig
hostPath:
path: /etc/rancher/k3s/k3s.yaml
{% endif %}
bootstrap/templates/ansible/shared/inventory/host_vars/.gitkeep.j2
View File
Whitespace-only changes.
bootstrap/templates/k0s/k0s-config.yaml.j2 → bootstrap/templates/k0s-config.yaml.j2
+9 -3
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == 'k0s' %}
---
apiVersion: k0sctl.k0sproject.io/v1beta1
kind: Cluster
@@ -42,12 +43,12 @@ spec:
bind-address: "0.0.0.0"
api:
sans:
- {{ bootstrap_kubeapi_addr }}
- {{ bootstrap_kube_api_addr }}
{% if bootstrap_kubeapi_hostname is defined %}
- {{ bootstrap_kubeapi_hostname }}
{% endif %}
{% for item in bootstrap_nodes.master %}
{% if item.address != bootstrap_kubeapi_addr %}
{% if item.address != bootstrap_kube_api_addr %}
- {{ item.address }}
{% endif %}
{% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %}
@@ -89,7 +90,11 @@ spec:
ipv6:
enabled: true
{% endif %}
k8sServiceHost: "{{ bootstrap_kubeapi_addr }}"
{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
k8sServiceHost: {{ bootstrap_nodes.master[0].address }}
{% else %}
k8sServiceHost: {{ bootstrap_kube_api_addr }}
{% endif %}
k8sServicePort: 6443
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
@@ -123,3 +128,4 @@ spec:
type: EnvoyProxy
{% endif %}
provider: custom
{% endif %}
bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if discord_template_notifier.enabled | default(false) %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -61,3 +62,4 @@ spec:
- path: /data/config.toml
subPath: config.toml
readOnly: true
{% endif %}
bootstrap/templates/addons/weave-gitops/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2
+2
View File
@@ -1,6 +1,8 @@
{% if discord_template_notifier.enabled | default(false) %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
{% endif %}
bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2 → bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if discord_template_notifier.enabled | default(false) %}
---
apiVersion: v1
kind: Secret
@@ -12,3 +13,4 @@ stringData:
retry_limit = 5
sink.type = "discord"
sink.url = "{{ discord_template_notifier.webhook_url }}"
{% endif %}
bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if discord_template_notifier.enabled | default(false) %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -18,3 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/addons/homepage/app/configmap.yaml.j2 → bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if homepage.enabled | default(false) %}
---
apiVersion: v1
kind: ConfigMap
@@ -75,3 +76,4 @@ data:
dateStyle: long
timeStyle: short
hourCycle: h23
{% endif %}
bootstrap/templates/addons/homepage/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if homepage.enabled | default(false) %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -86,3 +87,4 @@ spec:
path: /app/config/widgets.yaml
serviceAccount:
create: true
{% endif %}
bootstrap/templates/addons/homepage/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if homepage.enabled | default(false) %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
@@ -5,3 +6,4 @@ resources:
- ./configmap.yaml
- ./helmrelease.yaml
- ./secret.sops.yaml
{% endif %}
bootstrap/templates/addons/homepage/app/secret.sops.yaml.j2 → bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if homepage.enabled | default(false) %}
---
apiVersion: v1
kind: Secret
@@ -9,3 +10,4 @@ stringData:
HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "{{ bootstrap_cloudflare_token }}"
HOMEPAGE_VAR_GRAFANA_USERNAME: admin
HOMEPAGE_VAR_GRAFANA_PASSWORD: "{{ grafana.password }}"
{% endif %}
bootstrap/templates/addons/homepage/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if homepage.enabled | default(false) %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -18,3 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/addons/weave-gitops/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if weave_gitops.enabled | default(false) %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -55,3 +56,4 @@ spec:
impersonationResourceNames: ["admin"]
podAnnotations:
secret.reloader.stakater.com/reload: cluster-user-auth
{% endif %}
bootstrap/templates/addons/grafana/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2
+2
View File
@@ -1,6 +1,8 @@
{% if weave_gitops.enabled | default(false) %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
{% endif %}
bootstrap/templates/addons/weave-gitops/app/secret.sops.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2
+3 -1
View File
@@ -1,3 +1,4 @@
{% if weave_gitops.enabled | default(false) %}
---
apiVersion: v1
kind: Secret
@@ -6,4 +7,5 @@ metadata:
type: Opaque
stringData:
username: admin
password: "{{ weave_gitops.password | password_hash('bcrypt', rounds=10) }}"
password: "{{ weave_gitops.password | encrypt }}"
{% endif %}
bootstrap/templates/addons/weave-gitops/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if weave_gitops.enabled | default(false) %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -18,3 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2
+109 -4
View File
@@ -23,7 +23,112 @@ spec:
retries: 3
uninstall:
keepHistory: false
valuesFrom:
- name: cilium-values
kind: ConfigMap
valuesKey: values.yaml
values:
autoDirectNodeRoutes: true
bpf:
masquerade: true
bgp:
enabled: false
cluster:
name: home-cluster
id: 1
containerRuntime:
integration: containerd
{% if bootstrap_distribution == "k3s" %}
socketPath: /var/run/k3s/containerd/containerd.sock
{% else %}
socketPath: /var/run/k0s/containerd.sock
{% endif %}
endpointRoutes:
enabled: true
hubble:
enabled: true
metrics:
enabled:
- dns:query
- drop
- tcp
- flow
- port-distribution
- icmp
- http
serviceMonitor:
enabled: true
dashboards:
enabled: true
annotations:
grafana_folder: Cilium
relay:
enabled: true
rollOutPods: true
prometheus:
serviceMonitor:
enabled: true
ui:
enabled: true
rollOutPods: true
ingress:
enabled: true
className: internal
{% if homepage.enabled | default(false) %}
annotations:
gethomepage.dev/enabled: "true"
gethomepage.dev/group: Network
gethomepage.dev/name: Cilium
gethomepage.dev/icon: cilium.png
{% endif %}
hosts:
- "hubble.${SECRET_DOMAIN}"
tls:
- hosts:
- "hubble.${SECRET_DOMAIN}"
ipam:
mode: kubernetes
ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
{% if bootstrap_ipv6_enabled | default(false) %}
ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
ipv6:
enabled: true
{% endif %}
k8sServiceHost: "${KUBE_API_ADDR}"
k8sServicePort: 6443
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
{% if bootstrap_ipv6_enabled | default(false) %}
enabled: false
{% else %}
enabled: true
# https://github.com/cilium/cilium/issues/26586
leaseDuration: 120s
leaseRenewDeadline: 60s
leaseRetryPeriod: 1s
{% endif %}
loadBalancer:
algorithm: maglev
mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
localRedirectPolicy: true
operator:
replicas: 1
rollOutPods: true
prometheus:
enabled: true
serviceMonitor:
enabled: true
dashboards:
enabled: true
annotations:
grafana_folder: Cilium
prometheus:
enabled: true
serviceMonitor:
enabled: true
trustCRDsExist: true
dashboards:
enabled: true
annotations:
grafana_folder: Cilium
rollOutCiliumPods: true
routingMode: native
securityContext:
privileged: true
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2
-115
View File
@@ -1,115 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: cilium-values
data:
values.yaml: |
autoDirectNodeRoutes: true
bpf:
masquerade: true
bgp:
enabled: false
cluster:
name: home-cluster
id: 1
containerRuntime:
integration: containerd
{% if bootstrap_distribution == "k3s" %}
socketPath: /var/run/k3s/containerd/containerd.sock
{% else %}
socketPath: /var/run/k0s/containerd.sock
{% endif %}
endpointRoutes:
enabled: true
hubble:
enabled: true
metrics:
enabled:
- dns:query
- drop
- tcp
- flow
- port-distribution
- icmp
- http
serviceMonitor:
enabled: true
dashboards:
enabled: true
annotations:
grafana_folder: Cilium
relay:
enabled: true
rollOutPods: true
prometheus:
serviceMonitor:
enabled: true
ui:
enabled: true
rollOutPods: true
ingress:
enabled: true
className: internal
{% if homepage.enabled | default(false) %}
annotations:
gethomepage.dev/enabled: "true"
gethomepage.dev/group: Network
gethomepage.dev/name: Cilium
gethomepage.dev/icon: cilium.png
{% endif %}
hosts:
- "hubble.${SECRET_DOMAIN}"
tls:
- hosts:
- "hubble.${SECRET_DOMAIN}"
ipam:
mode: kubernetes
ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
{% if bootstrap_ipv6_enabled | default(false) %}
ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
ipv6:
enabled: true
{% endif %}
k8sServiceHost: "${KUBEAPI_ADDR}"
k8sServicePort: 6443
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
{% if bootstrap_ipv6_enabled | default(false) %}
enabled: false
{% else %}
enabled: true
# https://github.com/cilium/cilium/issues/26586
leaseDuration: 120s
leaseRenewDeadline: 60s
leaseRetryPeriod: 1s
{% endif %}
loadBalancer:
algorithm: maglev
mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
localRedirectPolicy: true
operator:
replicas: 1
rollOutPods: true
prometheus:
enabled: true
serviceMonitor:
enabled: true
dashboards:
enabled: true
annotations:
grafana_folder: Cilium
prometheus:
enabled: true
serviceMonitor:
enabled: true
trustCRDsExist: true
dashboards:
enabled: true
annotations:
grafana_folder: Cilium
rollOutCiliumPods: true
routingMode: native
securityContext:
privileged: true
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
-1
View File
@@ -5,5 +5,4 @@ resources:
{% if not bootstrap_ipv6_enabled | default(false) %}
- ./cilium-l2.yaml
{% endif %}
- ./helmvalues.yaml
- ./helmrelease.yaml
bootstrap/templates/addons/coredns/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == "k3s" %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -86,3 +87,4 @@ spec:
labelSelector:
matchLabels:
app.kubernetes.io/instance: coredns
{% endif %}
bootstrap/templates/addons/coredns/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2
+2
View File
@@ -1,5 +1,7 @@
{% if bootstrap_distribution == "k3s" %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
{% endif %}
bootstrap/templates/addons/coredns/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if bootstrap_distribution == "k3s" %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -18,3 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/addons/grafana/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if grafana.enabled | default(false) %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -180,3 +181,4 @@ spec:
storageClassName: openebs-hostpath
testFramework:
enabled: false
{% endif %}
bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2
+2
View File
@@ -1,6 +1,8 @@
{% if grafana.enabled | default(false) %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
{% endif %}
bootstrap/templates/addons/grafana/app/secret.sops.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if grafana.enabled | default(false) %}
---
apiVersion: v1
kind: Secret
@@ -6,3 +7,4 @@ metadata:
stringData:
admin-user: admin
admin-password: "{{ grafana.password }}"
{% endif %}
bootstrap/templates/addons/grafana/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if grafana.enabled | default(false) %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -18,3 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/addons/kube-prometheus-stack/app/helmvalues.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2
+32 -5
View File
@@ -1,10 +1,36 @@
{% if kube_prometheus_stack.enabled | default(false) %}
---
apiVersion: v1
kind: ConfigMap
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
name: kube-prometheus-stack-values
data:
values.yaml: |
name: kube-prometheus-stack
spec:
interval: 30m
timeout: 15m
chart:
spec:
chart: kube-prometheus-stack
version: 55.8.1
sourceRef:
kind: HelmRepository
name: prometheus-community
namespace: flux-system
maxHistory: 2
install:
crds: CreateReplace
remediation:
retries: 3
upgrade:
cleanupOnFail: true
crds: CreateReplace
remediation:
retries: 3
uninstall:
keepHistory: false
dependsOn:
- name: openebs
namespace: storage
values:
crds:
enabled: true
cleanPrometheusOperatorObjectNames: true
@@ -138,3 +164,4 @@ data:
multicluster:
etcd:
enabled: true
{% endif %}
bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2
+7
View File
@@ -0,0 +1,7 @@
{% if kube_prometheus_stack.enabled | default(false) %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
{% endif %}
bootstrap/templates/addons/kube-prometheus-stack/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if kube_prometheus_stack.enabled | default(false) %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -18,3 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/addons/kubernetes-dashboard/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if kubernetes_dashboard.enabled | default(false) %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -45,3 +46,4 @@ spec:
- *host
metricsScraper:
enabled: true
{% endif %}
bootstrap/templates/addons/kubernetes-dashboard/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2
+2
View File
@@ -1,6 +1,8 @@
{% if kubernetes_dashboard.enabled | default(false) %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./rbac.yaml
- ./helmrelease.yaml
{% endif %}
bootstrap/templates/addons/kubernetes-dashboard/app/rbac.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if kubernetes_dashboard.enabled | default(false) %}
# For dashboard sign in token:
# kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
---
@@ -37,3 +38,4 @@ subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: observability
{% endif %}
bootstrap/templates/addons/kubernetes-dashboard/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if kubernetes_dashboard.enabled | default(false) %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -21,3 +22,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if csi_driver_nfs.enabled | default(false) %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -26,3 +27,4 @@ spec:
values:
externalSnapshotter:
enabled: false
{% endif %}
bootstrap/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2
+2
View File
@@ -1,6 +1,8 @@
{% if csi_driver_nfs.enabled | default(false) %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./storageclass.yaml
{% endif %}
bootstrap/templates/addons/csi-driver-nfs/app/storageclass.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if csi_driver_nfs.enabled | default(false) %}
{% for item in csi_driver_nfs.storage_class %}
---
apiVersion: storage.k8s.io/v1
@@ -12,3 +13,4 @@ reclaimPolicy: Delete
volumeBindingMode: Immediate
mountOptions: ["hard", "noatime"]
{% endfor %}
{% endif %}
bootstrap/templates/addons/csi-driver-nfs/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if csi_driver_nfs.enabled | default(false) %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -18,3 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/addons/volsync/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if volsync.enabled | default(false) %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -40,3 +41,4 @@ spec:
tag: *tag
metrics:
disableAuth: true
{% endif %}
bootstrap/templates/addons/volsync/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2
+2
View File
@@ -1,6 +1,8 @@
{% if volsync.enabled | default(false) %}
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./prometheusrule.yaml
{% endif %}
bootstrap/templates/addons/volsync/app/prometheusrule.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if volsync.enabled | default(false) %}
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
@@ -21,3 +22,4 @@ spec:
for: 15m
labels:
severity: critical
{% endif %}
bootstrap/templates/addons/volsync/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if volsync.enabled | default(false) %}
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -38,3 +39,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
bootstrap/templates/addons/volsync/snapshot-controller/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
{% if volsync.enabled | default(false) %}
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -31,3 +32,4 @@ spec:
create: true
webhook:
enabled: false
{% endif %}
Loaded 100 of 113 files, more files were not shown because too many files have changed in this diff. Show more