home-cluster/bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2

#% if bootstrap_distribution == 'k0s' %#
---
apiVersion: k0sctl.k0sproject.io/v1beta1
kind: Cluster
metadata:
  name: k0s-cluster
spec:
  hosts:
    #% for item in bootstrap_nodes.master %#
    - role: "#{ item.role | default('controller+worker') }#"
      ssh:
        address: "#{ item.address }#"
        user: "#{ item.username }#"
      installFlags:
        - --disable-components=metrics-server
        #% if item.role | default('controller+worker') == 'controller+worker' %#
        - --no-taints
        #% endif %#
      #% if item.role | default('') != 'controller' %#
      files:
        - name: containerd-config
          src: resources/containerd/
          dstDir: /home/#{ item.username }#/
          perm: 0644
          user: root
          group: root
      #% endif %#
      hooks:
        #% if loop.first %#
        #% if item.role | default('') != 'controller' %#
        apply:
          before:
            - sudo mv ~/unprivileged-ports.toml /etc/k0s/containerd.d/unprivileged-ports.toml
            #% if spegel.enabled | default(false) %#
            - sudo mv ~/spegel.toml /etc/k0s/containerd.d/spegel.toml
            #% endif %#
        #% endif %#
        reset: &reset
          before:
            - sudo ip link delete cilium_host > /dev/null 2>&1 || true
            - sudo ip link delete cilium_net > /dev/null 2>&1 || true
            - sudo ip link delete cilium_vxlan > /dev/null 2>&1 || true
            - sudo iptables -t nat -F
            - sudo iptables -t mangle -F
            - sudo iptables -t filter -F
            - sudo iptables -t raw -F
            - sudo iptables -X
            - sudo ip6tables -t nat -F
            - sudo ip6tables -t mangle -F
            - sudo ip6tables -t filter -F
            - sudo ip6tables -t raw -F
            - sudo ip6tables -X
            - sudo rm -rf /etc/cni/net.d
          after:
            - sudo rm -rf #{ bootstrap_local_storage_path }#
            - nohup sudo -b bash -c 'sleep 5; reboot' &>/dev/null
        #% else %#
        #% if item.role | default('') != 'controller' %#
        apply:
          before:
            - sudo mv ~/unprivileged-ports.toml /etc/k0s/containerd.d/unprivileged-ports.toml
            #% if spegel.enabled | default(false) %#
            - sudo mv ~/spegel.toml /etc/k0s/containerd.d/spegel.toml
            #% endif %#
        #% endif %#
        reset: *reset
      #% endif %#
    #% endfor %#
    #% if bootstrap_nodes.worker | default([]) | length > 0 %#
    #% for item in bootstrap_nodes.worker %#
    - role: worker
      ssh:
        address: "#{ item.address }#"
        user: "#{ item.username }#"
      #% if loop.first %#
      files: &files
        - name: containerd-config
          src: resources/containerd/
          dstDir: /home/#{ item.username }#/
          perm: 0644
          user: root
          group: root
      #% else %#
      files: *files
      #% endif %#
      hooks:
        #% if loop.first %#
        apply: &apply
          before:
            - sudo mv ~/unprivileged-ports.toml /etc/k0s/containerd.d/unprivileged-ports.toml
            #% if spegel.enabled | default(false) %#
            - sudo mv ~/spegel.toml /etc/k0s/containerd.d/spegel.toml
            #% endif %#
        reset: *reset
        #% else %#
        apply: *apply
        reset: *reset
        #% endif %#
    #% endfor %#
    #% endif %#
  k0s:
    # renovate: datasource=github-releases depName=k0sproject/k0s
    version: "v1.28.5+k0s.0"
    dynamicConfig: false
    config:
      spec:
        telemetry:
          enabled: false
        controllerManager:
          extraArgs:
            # Required to monitor kube-controller-manager with kube-prometheus-stack
            bind-address: "0.0.0.0"
        scheduler:
          extraArgs:
            # Required to monitor kube-scheduler with kube-prometheus-stack
            bind-address: "0.0.0.0"
        storage:
          etcd:
            extraArgs:
              listen-metrics-urls: http://0.0.0.0:2381 # Required to monitor etcd with kube-prometheus-stack
        api:
          sans:
            - "#{ bootstrap_kube_api_addr }#"
            #% if bootstrap_kube_api_hostname | default('') %#
            - "#{ bootstrap_kube_api_hostname }#"
            #% endif %#
            #% for item in bootstrap_nodes.master %#
            #% if item.address != bootstrap_kube_api_addr %#
            - "#{ item.address }#"
            #% endif %#
            #% if (not bootstrap_kube_api_hostname | default('')) or (item.name != bootstrap_kube_api_hostname | default('')) %#
            - "#{ item.name }#"
            #% endif %#
            #% endfor %#
        network:
          podCIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
          serviceCIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
          provider: custom
          kubeProxy:
            disabled: true
          nodeLocalLoadBalancing:
            enabled: true
            type: EnvoyProxy
        extensions:
          helm:
            repositories:
              - name: cilium
                url: https://helm.cilium.io
            charts:
              - name: cilium
                chartname: cilium/cilium
                # renovate: datasource=github-releases depName=cilium/cilium
                version: "1.14.5"
                namespace: kube-system
                values: |2
                  #% filter indent(width=18, first=True) %#
                  #% include 'partials/cilium-values-init.partial.yaml.j2' %#
                  #% endfilter %#
#% endif %#