#jinja2: trim_blocks: True, lstrip_blocks: True
---
apiVersion: k0sctl.k0sproject.io/v1beta1
kind: Cluster
metadata:
  name: k0s-cluster
spec:
  hosts:
    {% for item in bootstrap_nodes.master %}
    - role: {{ item.role | default('controller+worker') }}
      ssh:
        address: {{ item.address }}
        user: {{ item.username }}
      installFlags:
        - --disable-components=metrics-server
        {% if item.role | default('') == 'controller+worker' %}
        - --no-taints
        {% endif %}
    {% endfor %}
    {% if bootstrap_nodes.worker | default([]) | length > 0 %}
    {% for item in bootstrap_nodes.worker %}
    - role: worker
      ssh:
        address: {{ item.address }}
        user: {{ item.username }}
    {% endfor %}
    {% endif %}
  k0s:
    # renovate: datasource=github-releases depName=k0sproject/k0s
    version: "v1.28.4+k0s.0"
    dynamicConfig: false
    config:
      spec:
        telemetry:
          enabled: false
        controllerManager:
          extraArgs:
            # Required to monitor kube-controller-manager with kube-prometheus-stack
            bind-address: "0.0.0.0"
        scheduler:
          extraArgs:
            # Required to monitor kube-scheduler with kube-prometheus-stack
            bind-address: "0.0.0.0"
        api:
          sans:
            - {{ bootstrap_kubeapi_addr }}
            {% if bootstrap_kubeapi_hostname is defined %}
            - {{ bootstrap_kubeapi_hostname }}
            {% endif %}
            {% for item in bootstrap_nodes.master %}
            {% if item.address != bootstrap_kubeapi_addr %}
            - {{ item.address }}
            {% endif %}
            {% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %}
            - {{ item.name }}
            {% endif %}
            {% endfor %}
        extensions:
          helm:
            repositories:
              - name: cilium
                url: https://helm.cilium.io
            charts:
              - name: cilium
                chartname: cilium/cilium
                # renovate: datasource=github-releases depName=cilium/cilium
                version: "1.14.5"
                namespace: kube-system
                values: |2
                  autoDirectNodeRoutes: true
                  bpf:
                    masquerade: true
                  bgp:
                    enabled: false
                  cluster:
                    name: home-cluster
                    id: 1
                  containerRuntime:
                    integration: containerd
                    socketPath: /var/run/k0s/containerd.sock
                  endpointRoutes:
                    enabled: true
                  hubble:
                    enabled: false
                  ipam:
                    mode: kubernetes
                  ipv4NativeRoutingCIDR: "{{ bootstrap_cluster_cidr }}"
                  {% if bootstrap_ipv6_enabled | default(false) %}
                  ipv6NativeRoutingCIDR: "{{ bootstrap_cluster_cidr_v6 }}"
                  ipv6:
                    enabled: true
                  {% endif %}
                  k8sServiceHost: "{{ bootstrap_kubeapi_addr }}"
                  k8sServicePort: 6443
                  kubeProxyReplacement: true
                  kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
                  l2announcements:
                    {% if bootstrap_ipv6_enabled | default(false) %}
                    enabled: false
                    {% else %}
                    enabled: true
                    # https://github.com/cilium/cilium/issues/26586
                    leaseDuration: 120s
                    leaseRenewDeadline: 60s
                    leaseRetryPeriod: 1s
                    {% endif %}
                  loadBalancer:
                    algorithm: maglev
                    mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
                  localRedirectPolicy: true
                  operator:
                    replicas: 1
                    rollOutPods: true
                  rollOutCiliumPods: true
                  routingMode: native
                  securityContext:
                    privileged: true
        network:
          kubeProxy:
            disabled: true
          {%  if bootstrap_nodes.master | length > 1 %}
          nodeLocalLoadBalancing:
            enabled: true
            type: EnvoyProxy
          {% endif %}
          provider: custom