feat: move kubernetes dir into templates to support jinja2 across all files (#831)

template/tasks/validation/age.yaml

@@ -0,0 +1,22 @@
+---
+- name: Query age key file
+  ansible.builtin.stat:
+    path: ~/.config/sops/age/keys.txt
+  register: result
+
+- name: Check if age key file exists
+  ansible.builtin.assert:
+    that: [result.stat.exists]
+    success_msg: Age file ~/.config/sops/age/keys.txt exists
+    fail_msg: Age file ~/.config/sops/age/keys.txt does not exist
+
+- name: Query age key file contents
+  ansible.builtin.set_fact:
+    age_contents: "{{ lookup('file', '~/.config/sops/age/keys.txt') }}"
+
+- name: Check if age public keys match
+  ansible.builtin.assert:
+    that:
+      - "'{{ bootstrap_age_public_key }}' in age_contents"
+    success_msg: Age public key {{ bootstrap_age_public_key }} exists
+    fail_msg: Age public key {{ bootstrap_age_public_key }} does not exist

template/tasks/validation/cli.yaml

@@ -0,0 +1,9 @@
+---
+- name: Check for required CLI tools
+  ansible.builtin.shell: |
+    command -v {{ item }} >/dev/null 2>&1
+  loop: [age, cloudflared, flux, git, pip3, sops, task]
+  changed_when: false
+  check_mode: false
+  register: result
+  failed_when: result.rc != 0 and result.rc != 127

template/tasks/validation/cloudflare.yaml

@@ -0,0 +1,34 @@
+---
+- name: Query Cloudflare zone
+  ansible.builtin.uri:
+    url: "https://api.cloudflare.com/client/v4/zones?name={{ bootstrap_cloudflare_domain }}&status=active"
+    headers:
+      Authorization: "Bearer {{ bootstrap_cloudflare_token }}"
+      Content-Type: application/json
+    timeout: 5
+    return_content: true
+    body_format: json
+  register: result
+
+- name: Check if Cloudflare zone exists
+  ansible.builtin.assert:
+    that: ["result.json.success == true"]
+    success_msg: "Cloudflare zone {{ bootstrap_cloudflare_domain }} exists"
+    fail_msg: "Cloudflare zone {{ bootstrap_cloudflare_domain }} does not exist"
+
+- name: Query Cloudflared tunnel
+  ansible.builtin.uri:
+    url: "https://api.cloudflare.com/client/v4/accounts/{{ bootstrap_cloudflare_account_tag }}/cfd_tunnel/{{ bootstrap_cloudflare_tunnel_id }}"
+    headers:
+      Authorization: "Bearer {{ bootstrap_cloudflare_token }}"
+      Content-Type: application/json
+    timeout: 5
+    return_content: true
+    body_format: json
+  register: result
+
+- name: Check if Cloudflared tunnel exists
+  ansible.builtin.assert:
+    that: ["result.json.success == true"]
+    success_msg: "Cloudflared tunnel {{ bootstrap_cloudflare_tunnel_id }} exists"
+    fail_msg: "Cloudflared tunnel {{ bootstrap_cloudflare_tunnel_id }} does not exist"

template/tasks/validation/github.yaml

@@ -0,0 +1,30 @@
+---
+- name: Query Github username
+  ansible.builtin.uri:
+    url: "https://api.github.com/users/{{ bootstrap_github_username }}"
+    timeout: 5
+    return_content: true
+    body_format: json
+  register: result
+
+- name: Check if username exists
+  ansible.builtin.assert:
+    that:
+      - "result.json.login == '{{ bootstrap_github_username }}'"
+    success_msg: "Github user {{ bootstrap_github_username }} exists"
+    fail_msg: "Github user {{ bootstrap_github_username }} does not exist"
+
+- name: Query Github repo
+  ansible.builtin.uri:
+    url: "https://api.github.com/repos/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}"
+    timeout: 5
+    return_content: true
+    body_format: json
+  register: result
+
+- name: Check if repo exists
+  ansible.builtin.assert:
+    that:
+      - "result.json.full_name == '{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}'"
+    success_msg: "Github repo {{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }} exists"
+    fail_msg: "Github repo {{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }} does not exist"

template/tasks/validation/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: Verify configuration
+  ansible.builtin.include_tasks: "{{ task }}.yaml"
+  loop: [age, cli, net, cloudflare, github]
+  loop_control:
+    loop_var: task

template/tasks/validation/net.yaml

@@ -0,0 +1,94 @@
+---
+- name: Verify master node count
+  ansible.builtin.assert:
+    that:
+      - "{{ bootstrap_hosts.master | length > 0 }}"
+      - "{{ bootstrap_hosts.master | length is odd }}"
+    success_msg: "Master node count {{ bootstrap_hosts.master | length }} is correct."
+    fail_msg: "Master node count {{ bootstrap_hosts.master | length }} is not greater than 0 or is not odd."
+
+- name: Verify node CIDR
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_node_cidr is ansible.utils.ipv4 }}"]
+    success_msg: "Node CIDR {{ bootstrap_node_cidr }} is valid."
+    fail_msg: "Node CIDR {{ bootstrap_node_cidr }} is invalid."
+
+- name: Verify cluster CIDR
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_cluster_cidr is ansible.utils.ipv4 }}"]
+    success_msg: "Cluster CIDR {{ bootstrap_cluster_cidr }} is valid."
+    fail_msg: "Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid."
+
+- name: Verify service CIDR
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_service_cidr is ansible.utils.ipv4 }}"]
+    success_msg: "Service CIDR {{ bootstrap_service_cidr }} is valid."
+    fail_msg: "Service CIDR {{ bootstrap_service_cidr }} is invalid."
+
+- name: Verify k8s_gateway
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_k8s_gateway_addr is ansible.utils.ipv4 }}"]
+    success_msg: "k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is valid."
+    fail_msg: "k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is invalid."
+
+- name: Verify k8s_gateway in node CIDR
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_k8s_gateway_addr) }}"]
+    success_msg: "k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is within {{ bootstrap_node_cidr }}."
+    fail_msg: "k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is not within {{ bootstrap_node_cidr }}."
+
+- name: Verify ingress-nginx
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_ingress_nginx_addr is ansible.utils.ipv4 }}"]
+    success_msg: "ingress-nginx address {{ bootstrap_ingress_nginx_addr }} is valid."
+    fail_msg: "ingress-nginx address {{ bootstrap_ingress_nginx_addr }} is invalid."
+
+- name: Verify ingress-nginx in node CIDR
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_ingress_nginx_addr) }}"]
+    success_msg: "ingress-nginx address {{ bootstrap_ingress_nginx_addr }} is within {{ bootstrap_node_cidr }}."
+    fail_msg: "ingress-nginx address {{ bootstrap_ingress_nginx_addr }} is not within {{ bootstrap_node_cidr }}."
+
+- name: Verify kube-vip
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_kube_vip_addr is ansible.utils.ipv4 }}"]
+    success_msg: "kube-vip address {{ bootstrap_kube_vip_addr }} is valid."
+    fail_msg: "kube-vip address {{ bootstrap_kube_vip_addr }} is invalid."
+
+- name: Verify kube-vip in node CIDR
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kube_vip_addr) }}"]
+    success_msg: "kube-vip address {{ bootstrap_kube_vip_addr }} is within {{ bootstrap_node_cidr }}."
+    fail_msg: "kube-vip address {{ bootstrap_kube_vip_addr }} is not within {{ bootstrap_node_cidr }}."
+
+- name: Verify nodes are not the same IPs as k8s_gateway, ingress-nginx or kube-vip
+  ansible.builtin.assert:
+    that:
+      - "{{ item.address not in (bootstrap_k8s_gateway_addr, bootstrap_ingress_nginx_addr, bootstrap_kube_vip_addr) }}"
+    success_msg: "Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or kube-vip."
+    fail_msg: "Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or kube-vip."
+    quiet: true
+  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
+  loop_control:
+     label: "{{ item.address }}"
+
+- name: Verify nodes are in node CIDR
+  ansible.builtin.assert:
+    that: ["{{ bootstrap_node_cidr | ansible.utils.network_in_usable(item.address) }}"]
+    success_msg: "Node address {{ item.address }} is within {{ bootstrap_node_cidr }}."
+    fail_msg: "Node address {{ item.address }} is not within {{ bootstrap_node_cidr }}."
+    quiet: true
+  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
+  loop_control:
+     label: "{{ item.address }}"
+
+- name: Verify SSH port is reachable
+  ansible.builtin.wait_for:
+    host: "{{ item.address }}"
+    port: 22
+    search_regex: OpenSSH
+    timeout: 10
+  connection: local
+  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
+  loop_control:
+     label: "{{ item.address }}"