feat: move kubernetes dir into templates to support jinja2 across all files (#831)

template/tasks/ansible/main.yaml

@@ -0,0 +1,51 @@
+---
+- name: Get absolute path to this Git repository # noqa: command-instead-of-module
+  ansible.builtin.command: git rev-parse --show-toplevel
+  changed_when: false
+  check_mode: false
+  register: repository_path
+  failed_when: repository_path.rc != 0
+
+- name: Template Ansible configuration
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path.stdout }}/{{ item.dest }}"
+    mode: "0755"
+  loop:
+    - src: templates/ansible/supplemental.yaml.j2
+      dest: ./ansible/inventory/group_vars/kubernetes/supplemental.yaml
+    - src: templates/ansible/hosts.yaml.j2
+      dest: ./ansible/inventory/hosts.yaml
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Backup sops configuration file
+  ansible.builtin.copy:
+    src: "{{ repository_path.stdout }}/.sops.yaml"
+    dest: "{{ repository_path.stdout }}/.sops.yaml.orig"
+    mode: "0755"
+- name: Remove sops configuration file
+  ansible.builtin.file:
+    path: "{{ repository_path.stdout }}/.sops.yaml"
+    state: absent
+
+- name: Template out node secrets
+  community.sops.sops_encrypt:
+    path: "{{ repository_path.stdout }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
+    age: ["{{ bootstrap_age_public_key }}"]
+    content_yaml: "{{ lookup('ansible.builtin.template', 'templates/ansible/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
+    mode: "0755"
+    force: true
+  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
+  loop_control:
+    label: "{{ item.address }}"
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Restore sops configuration file
+  ansible.builtin.copy:
+    src: "{{ repository_path.stdout }}/.sops.yaml.orig"
+    dest: "{{ repository_path.stdout }}/.sops.yaml"
+    mode: "0755"
+- name: Remove backup sops configuration file
+  ansible.builtin.file:
+    path: "{{ repository_path.stdout }}/.sops.yaml.orig"
+    state: absent

template/tasks/kubernetes/main.yaml

@@ -0,0 +1,58 @@
+---
+- name: Get absolute path to this Git repository # noqa: command-instead-of-module
+  ansible.builtin.command: git rev-parse --show-toplevel
+  changed_when: false
+  check_mode: false
+  register: repository_path
+  failed_when: repository_path.rc != 0
+
+- name: Ensure Kubernetes directories exist
+  ansible.builtin.file:
+    path: "{{ repository_path.stdout }}/kubernetes/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree:
+    - ../templates/kubernetes/
+  when: item.state == 'directory'
+
+- name: Template Kubernetes unencrypted files
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path.stdout }}/kubernetes/{{ item.path | replace('.j2', '') }}"
+  with_community.general.filetree:
+    - ../templates/kubernetes/
+  when: item.state == 'file' and 'sops' not in item.path
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Backup sops configuration file
+  ansible.builtin.copy:
+    src: "{{ repository_path.stdout }}/.sops.yaml"
+    dest: "{{ repository_path.stdout }}/.sops.yaml.orig"
+    mode: "0755"
+- name: Remove sops configuration file
+  ansible.builtin.file:
+    path: "{{ repository_path.stdout }}/.sops.yaml"
+    state: absent
+
+- name: Template Kubernetes unencrypted files
+  community.sops.sops_encrypt:
+    path: "{{ repository_path.stdout }}/kubernetes/{{ item.path | replace('.j2', '') }}"
+    encrypted_regex: ^(data|stringData)$
+    age: ["{{ bootstrap_age_public_key }}"]
+    content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+    mode: "0755"
+    force: true
+  with_community.general.filetree:
+    - ../templates/kubernetes/
+  when: item.state == 'file' and 'sops' in item.path
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Restore sops configuration file
+  ansible.builtin.copy:
+    src: "{{ repository_path.stdout }}/.sops.yaml.orig"
+    dest: "{{ repository_path.stdout }}/.sops.yaml"
+    mode: "0755"
+- name: Remove backup sops configuration file
+  ansible.builtin.file:
+    path: "{{ repository_path.stdout }}/.sops.yaml.orig"
+    state: absent

template/tasks/sops/main.yaml

@@ -0,0 +1,13 @@
+---
+- name: Get absolute path to this Git repository # noqa: command-instead-of-module
+  ansible.builtin.command: git rev-parse --show-toplevel
+  changed_when: false
+  check_mode: false
+  register: repository_path
+  failed_when: repository_path.rc != 0
+
+- name: Template out sops configuration file
+  ansible.builtin.template:
+    src: "templates/.sops.yaml.j2"
+    dest: "{{ repository_path.stdout }}/.sops.yaml"
+    mode: "0755"

template/tasks/validation/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: Verify configuration
+  ansible.builtin.include_tasks: "{{ task }}.yaml"
+  loop: [age, cli, net, cloudflare, github]
+  loop_control:
+    loop_var: task