chore: tidy up 🧹

2026-09-16 23:12:48 +03:00
parent 3d5f56f099
commit 6b1fc54c0d
156 changed files with 0 additions and 6158 deletions
@@ -1,12 +0,0 @@
---
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: e2e-deny-server
-  namespace: default
-spec:
-  endpointSelector:
-    matchLabels:
-      app: e2e-network-server
-  ingress:
-    - {}
@@ -1,291 +0,0 @@
-#!/usr/bin/env bash
-# Full-fidelity bootstrap e2e: takes maintenance-mode Talos VMs, discovers
-# their hardware the same way the README instructs users to, writes a
-# cluster.toml from the discovered facts, and runs the template's real
-# bootstrap flow against them.
-#
-# Two provisioning paths share this test body:
-#   - CI: talosctl-cluster-action boots the nodes (talos-cluster.yaml) and
-#     passes E2E_CONTROLPLANE_IPS / E2E_WORKER_IPS / E2E_CIDR; the action's
-#     post step destroys them.
-#   - Local: run with no env set; the script boots and destroys the cluster
-#     itself. Requires Docker, /dev/kvm, passwordless sudo, qemu-system-x86,
-#     and the repo's mise toolchain on PATH.
-#
-# Renders into the working tree like any configure run.
-set -euo pipefail
-
-NAME="${E2E_NAME:-template-e2e}"
-MODE="${1:-all}"
-E2E_DIR=".github/template-tests/e2e"
-CIDR="${E2E_CIDR:-10.9.0.0/24}"
-PREFIX="${CIDR%/*}"
-PREFIX="${PREFIX%.*}"
-TALOSCTL="$(command -v talosctl)"
-# The Image Factory vanilla schematic, matching the ISO the nodes boot from.
-SCHEMATIC="376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-if [ -n "${E2E_CONTROLPLANE_IPS:-}" ]; then
-    PROVISIONED=true
-    IFS=',' read -r -a CONTROLPLANES <<< "$E2E_CONTROLPLANE_IPS"
-    IFS=',' read -r -a WORKERS <<< "${E2E_WORKER_IPS:-}"
-else
-    PROVISIONED=false
-    CONTROLPLANES=("$PREFIX.2")
-    WORKERS=("$PREFIX.3")
-fi
-NODES=("${CONTROLPLANES[@]}" "${WORKERS[@]}")
-# The VMs reach the host at the gateway address; the rendered workspace is
-# served from there over git smart HTTP so Flux can sync it.
-GIT_HOST="${E2E_GATEWAY:-$PREFIX.1}"
-GIT_PORT=8418
-GIT_SERVER_CONTAINER=""
-
-# The provisioner runs under sudo and writes state relative to its cwd and
-# TALOSCONFIG, so both are pointed at a scratch dir to keep root-owned files
-# out of the repo.
-if [ -n "${E2E_STATE:-}" ]; then
-    STATE="$E2E_STATE"
-    STATE_OWNED=false
-else
-    STATE="$(mktemp -d)"
-    STATE_OWNED=true
-fi
-mkdir -p "$STATE"
-GIT_PUSH_URL="http://127.0.0.1:$GIT_PORT/repo.git"
-
-cleanup() {
-    rc=$?
-    if [ "$rc" -ne 0 ]; then
-        echo "==> e2e failed (rc=$rc), collecting diagnostics"
-        kubectl get pods --all-namespaces 2>/dev/null || true
-        kubectl get gitrepositories,kustomizations,helmreleases --all-namespaces 2>/dev/null || true
-        kubectl get events --all-namespaces --sort-by=.lastTimestamp 2>/dev/null | tail -30 || true
-        [ -n "$GIT_SERVER_CONTAINER" ] && docker logs --tail 5 "$GIT_SERVER_CONTAINER" 2>/dev/null || true
-        for ip in "${NODES[@]}"; do
-            talosctl -n "$ip" dmesg 2>/dev/null | tail -20 || true
-        done
-    fi
-    if [ "$MODE" = all ]; then
-        [ -n "$GIT_SERVER_CONTAINER" ] && docker stop "$GIT_SERVER_CONTAINER" >/dev/null 2>&1 || true
-    fi
-    if [ "$MODE" = all ] && [ "$PROVISIONED" = false ]; then
-        (cd "$STATE" && sudo -E env TALOSCONFIG="$STATE/talosconfig" \
-            "$TALOSCTL" cluster destroy --name "$NAME" --provisioner qemu >/dev/null 2>&1) || true
-    fi
-    if [ "$MODE" = all ] && [ "$STATE_OWNED" = true ]; then
-        sudo rm -rf "$STATE" || true
-    fi
-    exit "$rc"
-}
-trap cleanup EXIT
-
-start_local_git_server() {
-    GIT_SERVER_CONTAINER="$NAME-git"
-    docker run --detach --rm --name "$GIT_SERVER_CONTAINER" \
-        --publish "$GIT_PORT:23232" \
-        --env SOFT_SERVE_GIT_ENABLED=false \
-        --env SOFT_SERVE_LFS_ENABLED=false \
-        --env SOFT_SERVE_SSH_LISTEN_ADDR=127.0.0.1:23231 \
-        --env SOFT_SERVE_STATS_ENABLED=false \
-        --entrypoint /bin/sh \
-        ghcr.io/charmbracelet/soft-serve:v0.11.6 \
-        -c 'set -eu; ssh-keygen -q -t ed25519 -N "" -f /tmp/admin; export SOFT_SERVE_INITIAL_ADMIN_KEYS="$(cat /tmp/admin.pub)"; /usr/local/bin/soft serve & pid=$!; until ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost settings anon-access read-write; do sleep 1; done; ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost repo create repo; wait "$pid"' \
-        >/dev/null
-    deadline=$((SECONDS + 60))
-    until git ls-remote "$GIT_PUSH_URL" >/dev/null 2>&1; do
-        if (( SECONDS >= deadline )); then
-            just log fatal "Soft Serve is not reachable"
-        fi
-        sleep 1
-    done
-}
-
-prepare() {
-# In CI the action itself waits for every node's maintenance API before
-# returning, so the poll here covers only the local path, where cluster
-# create returns as soon as the VMs launch.
-if [ "$PROVISIONED" = false ]; then
-    echo "==> booting maintenance-mode nodes"
-    (cd "$STATE" && sudo -E env TALOSCONFIG="$STATE/talosconfig" \
-        "$TALOSCTL" cluster create qemu --name "$NAME" --presets iso,maintenance \
-        --controlplanes 1 --workers 1 --cidr "$CIDR" \
-        --memory-controlplanes 4GiB --memory-workers 3GiB)
-
-    echo "==> waiting for the maintenance API"
-    for ip in "${NODES[@]}"; do
-        until talosctl -n "$ip" get links --insecure >/dev/null 2>&1; do sleep 5; done
-    done
-fi
-
-echo "==> discovering node hardware"
-declare -A MACS DISKS
-for ip in "${NODES[@]}"; do
-    MACS[$ip]="$(talosctl -n "$ip" get links --insecure -o json \
-        | jq -r 'select(.spec.type == "ether" and .spec.operationalState == "up" and (.metadata.id | startswith("bond") | not)) | .spec.hardwareAddr' | head -1)"
-    DISKS[$ip]="/dev/$(talosctl -n "$ip" get disks --insecure -o json \
-        | jq -r 'select(.spec.readonly == false and (.metadata.id | startswith("loop") | not)) | .metadata.id' | head -1)"
-    echo "    $ip mac=${MACS[$ip]} disk=${DISKS[$ip]}"
-done
-
-echo "==> generating cluster.toml"
-export E2E_CIDR="$CIDR"
-export E2E_GATEWAY="${E2E_GATEWAY:-$PREFIX.1}"
-export E2E_GIT_HOST="$GIT_HOST"
-export E2E_GIT_PORT="$GIT_PORT"
-export E2E_PREFIX="$PREFIX"
-export E2E_SCHEMATIC="$SCHEMATIC"
-envsubst '${E2E_CIDR} ${E2E_GATEWAY} ${E2E_GIT_HOST} ${E2E_GIT_PORT} ${E2E_PREFIX} ${E2E_SCHEMATIC}' \
-    < "$E2E_DIR/cluster.toml.tmpl" > cluster.toml
-index=0
-for ip in "${NODES[@]}"; do
-    controller=false
-    for cp in "${CONTROLPLANES[@]}"; do [ "$ip" = "$cp" ] && controller=true; done
-    export E2E_NODE_NAME="e2e-$index"
-    export E2E_NODE_ADDRESS="$ip"
-    export E2E_NODE_CONTROLLER="$controller"
-    export E2E_NODE_DISK="${DISKS[$ip]}"
-    export E2E_NODE_MAC="${MACS[$ip]}"
-    envsubst '${E2E_NODE_ADDRESS} ${E2E_NODE_CONTROLLER} ${E2E_NODE_DISK} ${E2E_NODE_MAC} ${E2E_NODE_NAME}' \
-        < "$E2E_DIR/node.toml.tmpl" >> cluster.toml
-    index=$((index + 1))
-done
-
-echo "==> configure"
-just init
-just configure
-
-# Flux's FluxInstance only reports Ready once its Git sync succeeds, so the
-# rendered kubernetes/ tree is committed to a bare repo and served to the
-# cluster — the same push-then-bootstrap flow the README walks users through.
-echo "==> publishing rendered repo"
-mkdir -p "$STATE/gitwork"
-cp -r kubernetes "$STATE/gitwork/"
-git -C "$STATE/gitwork" init --quiet --initial-branch main
-git -C "$STATE/gitwork" add --all
-git -C "$STATE/gitwork" -c user.name=e2e -c user.email=e2e@cluster.local \
-    commit --quiet --message "rendered workspace"
-git -C "$STATE/gitwork" push --quiet "$GIT_PUSH_URL" main
-}
-
-assert_cluster_health() {
-echo "==> asserting cluster health"
-kubectl wait nodes --all --for=condition=Ready --timeout=10m
-for ns in kube-system cert-manager flux-system; do
-    kubectl wait pods --namespace "$ns" --all --for=condition=Ready --timeout=10m
-done
-
-echo "==> asserting flux reconciliation"
-kubectl wait fluxinstance/flux --namespace flux-system --for=condition=Ready --timeout=10m
-kubectl wait gitrepositories --all --all-namespaces --for=condition=Ready --timeout=5m
-kubectl wait kustomizations --all --all-namespaces --for=condition=Ready --timeout=10m
-kubectl wait helmreleases --all --all-namespaces --for=condition=Ready --timeout=10m
-}
-
-foundation() {
-deadline=$((SECONDS + 60))
-until git ls-remote "http://$GIT_HOST:$GIT_PORT/repo.git" >/dev/null 2>&1; do
-    if (( SECONDS >= deadline )); then
-        just log fatal "Rendered repository server is not reachable"
-    fi
-    sleep 1
-done
-echo "==> bootstrap talos"
-just bootstrap talos
-
-echo "==> bootstrap apps"
-just bootstrap apps
-assert_cluster_health
-
-echo "==> asserting bootstrap idempotency"
-just configure
-just bootstrap talos
-just bootstrap apps
-assert_cluster_health
-}
-
-flux_sops() {
-echo "==> asserting Flux SOPS decryption"
-SOPS_SECRET="$STATE/gitwork/kubernetes/apps/default/e2e-sops.sops.yaml"
-export E2E_SOPS_VALUE=flux-decrypted
-envsubst '${E2E_SOPS_VALUE}' < "$E2E_DIR/sops-secret.yaml.tmpl" > "$SOPS_SECRET"
-sops encrypt --filename-override kubernetes/apps/default/e2e-sops.sops.yaml \
-    --in-place "$SOPS_SECRET"
-yq --inplace '.resources += ["./e2e-sops.sops.yaml"]' \
-    "$STATE/gitwork/kubernetes/apps/default/kustomization.yaml"
-git -C "$STATE/gitwork" add --all
-git -C "$STATE/gitwork" -c user.name=e2e -c user.email=e2e@cluster.local \
-    commit --quiet --message "test Flux SOPS decryption"
-git -C "$STATE/gitwork" push --quiet "$GIT_PUSH_URL" main
-flux reconcile kustomization cluster-apps --with-source --timeout=10m
-test "$(kubectl get secret e2e-sops --namespace default \
-    --output jsonpath='{.data.value}' | base64 --decode)" = "flux-decrypted"
-}
-
-networking() {
-echo "==> asserting pod networking and DNS"
-export E2E_CONTROLPLANE_NODE="$(kubectl get nodes \
-    --selector=node-role.kubernetes.io/control-plane \
-    --output jsonpath='{.items[0].metadata.name}')"
-export E2E_WORKER_NODE="$(kubectl get nodes \
-    --selector='!node-role.kubernetes.io/control-plane' \
-    --output jsonpath='{.items[0].metadata.name}')"
-NETWORK_CONFIG="$STATE/network.yaml"
-envsubst '${E2E_CONTROLPLANE_NODE} ${E2E_WORKER_NODE}' \
-    < "$E2E_DIR/network.yaml.tmpl" > "$NETWORK_CONFIG"
-kubectl apply --filename "$NETWORK_CONFIG"
-kubectl wait pods/e2e-network-server pods/e2e-network-client \
-    --namespace default --for=condition=Ready --timeout=5m
-SERVER_IP="$(kubectl get pod e2e-network-server --namespace default \
-    --output jsonpath='{.status.podIP}')"
-kubectl exec --namespace default e2e-network-client -- \
-    /agnhost connect --timeout=10s "$SERVER_IP:8080"
-kubectl exec --namespace default e2e-network-client -- \
-    /agnhost connect --timeout=10s e2e-network-server.default.svc.cluster.local:8080
-kubectl exec --namespace default e2e-network-client -- \
-    /agnhost connect --timeout=10s github.com:443
-kubectl apply --filename "$E2E_DIR/cilium-network-policy.yaml"
-deadline=$((SECONDS + 60))
-while kubectl exec --namespace default e2e-network-client -- \
-    /agnhost connect --timeout=2s "$SERVER_IP:8080" &>/dev/null; do
-    if (( SECONDS >= deadline )); then
-        just log fatal "CiliumNetworkPolicy did not block pod traffic"
-    fi
-    sleep 2
-done
-kubectl delete ciliumnetworkpolicy e2e-deny-server --namespace default
-deadline=$((SECONDS + 60))
-until kubectl exec --namespace default e2e-network-client -- \
-    /agnhost connect --timeout=2s "$SERVER_IP:8080" &>/dev/null; do
-    if (( SECONDS >= deadline )); then
-        just log fatal "Pod traffic did not recover after removing CiliumNetworkPolicy"
-    fi
-    sleep 2
-done
-}
-
-summary() {
-kubectl get nodes --output wide
-kubectl get kustomizations,helmreleases --all-namespaces
-echo "==> e2e bootstrap succeeded"
-}
-
-case "$MODE" in
-    prepare)    prepare ;;
-    foundation) foundation ;;
-    flux-sops)  flux_sops ;;
-    networking) networking ;;
-    summary)    summary ;;
-    all)
-        start_local_git_server
-        prepare
-        foundation
-        flux_sops
-        networking
-        summary
-        ;;
-    *)
-        echo "usage: $0 {prepare|foundation|flux-sops|networking|summary|all}" >&2
-        exit 2
-        ;;
-esac
@@ -1,22 +0,0 @@
-[network]
-node_cidr       = "${E2E_CIDR}"
-default_gateway = "${E2E_GATEWAY}"
-
-[kubernetes.api]
-addr = "${E2E_PREFIX}.100"
-
-[gateways]
-internal = "${E2E_PREFIX}.101"
-dns      = "${E2E_PREFIX}.102"
-
-[domain]
-name = "e2e.example.com"
-
-[dns]
-provider = "none"
-
-[repository]
-url = "http://${E2E_GIT_HOST}:${E2E_GIT_PORT}/repo.git"
-
-[talos]
-schematic_id = "${E2E_SCHEMATIC}"
@@ -1,42 +0,0 @@
---
-apiVersion: v1
-kind: Pod
-metadata:
-  name: e2e-network-server
-  namespace: default
-  labels:
-    app: e2e-network-server
-spec:
-  nodeName: "${E2E_WORKER_NODE}"
-  containers:
-    - name: server
-      image: registry.k8s.io/e2e-test-images/agnhost:2.66.0
-      args: ["netexec", "--http-port=8080"]
-      ports:
-        - name: http
-          containerPort: 8080
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: e2e-network-server
-  namespace: default
-spec:
-  selector:
-    app: e2e-network-server
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
---
-apiVersion: v1
-kind: Pod
-metadata:
-  name: e2e-network-client
-  namespace: default
-spec:
-  nodeName: "${E2E_CONTROLPLANE_NODE}"
-  containers:
-    - name: client
-      image: registry.k8s.io/e2e-test-images/agnhost:2.66.0
-      args: ["pause"]
@@ -1,7 +0,0 @@
-
-[[nodes]]
-name       = "${E2E_NODE_NAME}"
-address    = "${E2E_NODE_ADDRESS}"
-controller = ${E2E_NODE_CONTROLLER}
-disk       = "${E2E_NODE_DISK}"
-mac_addr   = "${E2E_NODE_MAC}"
@@ -1,8 +0,0 @@
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: e2e-sops
-  namespace: default
-stringData:
-  value: "${E2E_SOPS_VALUE}"
@@ -1,21 +0,0 @@
---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/home-operations/talosctl-cluster-action/main/schema/talos-cluster.json
-# Maintenance-mode nodes for the bootstrap e2e: the action boots and destroys
-# them, and cluster.sh exercises the template's real bootstrap flow against
-# the unconfigured nodes.
-apiVersion: v1alpha1
-kind: TalosCluster
-metadata:
-  name: template-e2e
-spec:
-  controlplanes:
-    count: 1
-    memory: 4GiB
-  workers:
-    count: 1
-    memory: 3GiB
-  network:
-    cidr: 10.9.0.0/24
-  qemu:
-    presets: [iso, maintenance]
-    disks: [virtio:10GiB]
@@ -1,34 +0,0 @@
-# Negative fixture: BGP router ASN above the 32-bit ASN range.
-# Expected to be rejected by _router_asn_in_range.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[cilium.bgp]
-router_addr = "10.10.1.1"
-router_asn  = "4294967296"
-node_asn    = "64514"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,29 +0,0 @@
-# Negative fixture: malformed MAC address (uppercase + missing colons).
-# Expected to be rejected by the #Node.mac_addr regex constraint.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "AABBCCDDEEFF"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,30 +0,0 @@
-# Negative fixture: scp-style git URL ("git@host:owner/repo.git") instead of
-# the canonical https:// or ssh://git@ form.
-# Expected to be rejected by the repository.url pattern.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "git@github.com:onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,30 +0,0 @@
-# Negative fixture: vlan_tag outside the valid 1-4094 range.
-# Expected to be rejected by _vlan_tag_in_range.
-[network]
-node_cidr = "10.10.10.0/24"
-vlan_tag  = "5000"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,29 +0,0 @@
-# Negative fixture: gateways.internal == gateways.dns.
-# Expected to be rejected by `_addrs_check` (list.UniqueItems).
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.252"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,37 +0,0 @@
-# Negative fixture: two nodes with the same name.
-# Expected to be rejected by `_node_name_check` (list.UniqueItems).
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.101"
-controller   = false
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:01"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,29 +0,0 @@
-# Negative fixture: a node reuses the internal gateway VIP.
-# Expected to be rejected by _addr_uniqueness_check.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.252"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,29 +0,0 @@
-# Negative fixture: dns.provider "cloudflare" (the default) without a token.
-# Expected to be rejected by the Dns validator.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[domain]
-name = "example.com"
-
-[dns]
-provider = "cloudflare"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,28 +0,0 @@
-# Negative fixture: cloudflare-tunnel ingress without gateways.external.
-# Expected to be rejected by the Config cross-check.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,30 +0,0 @@
-# Negative fixture: ssh:// URL to a host without bundled SSH host keys
-# (github.com/gitlab.com/codeberg.org) and no repository.known_hosts set.
-# Expected to be rejected by the conditional known_hosts constraint.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "ssh://git@git.example.com/k8s/home-ops.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,28 +0,0 @@
-# Negative fixture: a node without schematic_id and no [talos] default.
-# Expected to be rejected by the schematic resolution in Config.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[[nodes]]
-name       = "k8s-0"
-address    = "10.10.10.100"
-controller = true
-disk       = "/dev/sdfake"
-mac_addr   = "00:00:00:00:00:00"
@@ -1,30 +0,0 @@
-# Negative fixture: node_cidr is nested inside the default pod_cidr
-# (10.42.0.0/16) without being string-equal to it.
-# Expected to be rejected by _cidr_overlap_check.
-[network]
-node_cidr = "10.42.128.0/17"
-
-[kubernetes.api]
-addr = "10.42.128.254"
-
-[gateways]
-internal = "10.42.128.252"
-dns      = "10.42.128.253"
-external = "10.42.128.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.42.128.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,29 +0,0 @@
-# Negative fixture: node address is not inside network.node_cidr.
-# Expected to be rejected by _node_addrs_in_node_cidr.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "192.168.1.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,30 +0,0 @@
-# Negative fixture: a node claims the default gateway address (defaults to
-# the first IP in node_cidr).
-# Expected to be rejected by _addr_uniqueness_check.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.1"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,30 +0,0 @@
-# Negative fixture: node_cidr written with host bits set instead of the
-# network address.
-# Expected to be rejected by _cidr_canonical_check.
-[network]
-node_cidr = "10.10.10.5/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,29 +0,0 @@
-# Negative fixture: network.node_cidr overlaps the default kubernetes.pod_cidr (10.42.0.0/16).
-# Expected to be rejected by `_cidrs_check` (list.UniqueItems).
-[network]
-node_cidr = "10.42.0.0/16"
-
-[kubernetes.api]
-addr = "10.42.0.254"
-
-[gateways]
-internal = "10.42.0.252"
-dns      = "10.42.0.253"
-external = "10.42.0.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.42.0.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,34 +0,0 @@
-# Negative fixture: two of the three BGP fields set; previously this
-# silently left BGP disabled.
-# Expected to be rejected by the Bgp all-or-nothing check.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[cilium.bgp]
-router_addr = "10.10.1.1"
-router_asn  = "64513"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,29 +0,0 @@
-# Negative fixture: a node name uses the reserved word "controller".
-# Expected to be rejected by the #Node.name regex constraint.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "controller"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,33 +0,0 @@
-# Negative fixture: svc_cidr too small to contain the derived CoreDNS
-# address (10th IP).
-# Expected to be rejected by _coredns_addr_in_svc_cidr.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes]
-svc_cidr = "10.43.0.0/29"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,32 +0,0 @@
-# Negative fixture: cloudflare-tunnel ingress with dns.provider "none".
-# Expected to be rejected by the Config cross-check.
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[domain]
-name = "example.com"
-
-[dns]
-provider = "none"
-
-[ingress]
-mode = "cloudflare-tunnel"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,38 +0,0 @@
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[ingress]
-mode = "direct"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name         = "k8s-1"
-address      = "10.10.10.101"
-controller   = false
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:01"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,34 +0,0 @@
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-
-[domain]
-name = "example.com"
-
-[dns]
-provider = "none"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name         = "k8s-1"
-address      = "10.10.10.101"
-controller   = false
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:01"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,42 +0,0 @@
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-
-[repository]
-url = "ssh://git@github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-provider = "none"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name         = "k8s-1"
-address      = "10.10.10.101"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:01"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name         = "k8s-2"
-address      = "10.10.10.102"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:02"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,36 +0,0 @@
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url              = "https://github.com/onedr0p/cluster-template.git"
-webhook_provider = "none"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name         = "k8s-1"
-address      = "10.10.10.101"
-controller   = false
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:01"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,39 +0,0 @@
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url = "ssh://git@github.com/onedr0p/cluster-template.git"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name           = "k8s-1"
-address        = "10.10.10.101"
-controller     = false
-disk           = "/dev/sdfake"
-mac_addr       = "00:00:00:00:00:01"
-schematic_id   = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-mtu            = 1500
-secureboot     = true
-encrypt_disk   = true
-kernel_modules = ["nvidia", "nvidia_uvm"]
@@ -1,59 +0,0 @@
-[network]
-node_cidr       = "10.10.10.0/24"
-default_gateway = "10.10.10.1"
-vlan_tag        = "100"
-dns_servers     = ["1.1.1.1"]
-ntp_servers     = ["162.159.200.123"]
-
-[kubernetes]
-pod_cidr = "10.42.0.0/16"
-svc_cidr = "10.43.0.0/16"
-
-[kubernetes.api]
-addr     = "10.10.10.254"
-tls_sans = ["example.com"]
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url    = "https://github.com/onedr0p/cluster-template.git"
-branch = "main"
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[cilium]
-loadbalancer_mode = "dsr"
-
-[cilium.bgp]
-router_addr = "10.10.1.1"
-router_asn  = "64513"
-node_asn    = "64514"
-
-[talos]
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-
-[[nodes]]
-name           = "k8s-1"
-address        = "10.10.10.101"
-controller     = false
-disk           = "/dev/sdfake"
-mac_addr       = "00:00:00:00:00:01"
-schematic_id   = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-mtu            = 1500
-secureboot     = true
-encrypt_disk   = true
-kernel_modules = ["nvidia", "nvidia_uvm"]
@@ -1,39 +0,0 @@
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-external = "10.10.10.251"
-
-[repository]
-url              = "ssh://git@git.example.com/k8s/home-ops.git"
-webhook_provider = "generic-hmac"
-known_hosts      = """
-git.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
-"""
-
-[domain]
-name = "example.com"
-
-[dns]
-token = "fake"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
-
-[[nodes]]
-name         = "k8s-1"
-address      = "10.10.10.101"
-controller   = false
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:01"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,26 +0,0 @@
-[network]
-node_cidr = "10.10.10.0/24"
-
-[kubernetes.api]
-addr = "10.10.10.254"
-
-[gateways]
-internal = "10.10.10.252"
-dns      = "10.10.10.253"
-
-[domain]
-name = "example.com"
-
-[dns]
-provider = "none"
-
-[repository]
-url = "https://github.com/onedr0p/cluster-template.git"
-
-[[nodes]]
-name         = "k8s-0"
-address      = "10.10.10.100"
-controller   = true
-disk         = "/dev/sdfake"
-mac_addr     = "00:00:00:00:00:00"
-schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
@@ -1,103 +0,0 @@
---
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: "E2E Cluster"
-
-on:
-  workflow_dispatch:
-  pull_request:
-    branches: ["main"]
-  schedule:
-    - cron: "30 5 * * *"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  bootstrap:
-    if: ${{ github.repository == 'onedr0p/cluster-template' }}
-    name: bootstrap (qemu)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    services:
-      git:
-        image: ghcr.io/charmbracelet/soft-serve:v0.12.2
-        env:
-          SOFT_SERVE_GIT_ENABLED: "false"
-          SOFT_SERVE_LFS_ENABLED: "false"
-          SOFT_SERVE_SSH_LISTEN_ADDR: "127.0.0.1:23231"
-          SOFT_SERVE_STATS_ENABLED: "false"
-        ports:
-          - 8418:23232
-        entrypoint: /bin/sh
-        command: >-
-          -c "set -eu; ssh-keygen -q -t ed25519 -N '' -f /tmp/admin;
-          export SOFT_SERVE_INITIAL_ADMIN_KEYS=$(cat /tmp/admin.pub);
-          /usr/local/bin/soft serve & pid=$!;
-          until ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost settings anon-access read-write; do sleep 1; done;
-          ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost repo create repo;
-          wait $pid"
-        options: >-
-          --health-cmd "git ls-remote http://localhost:23232/repo.git"
-          --health-interval 2s
-          --health-timeout 2s
-          --health-retries 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Install QEMU
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends gettext-base qemu-system-x86 qemu-utils ovmf
-
-      - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Boot maintenance-mode nodes
-        id: cluster
-        uses: home-operations/talosctl-cluster-action@fb6a31bf5de43218acc80d2e23958a16eee7380c # v0.2.2
-        with:
-          config: ./.github/template-tests/e2e/talos-cluster.yaml
-          cache: true
-
-      - name: Export cluster environment
-        env:
-          CONTROLPLANE_IPS: "${{ steps.cluster.outputs.controlplane-ips }}"
-          GATEWAY: "${{ steps.cluster.outputs.gateway }}"
-          WORKER_IPS: "${{ steps.cluster.outputs.worker-ips }}"
-        run: |
-          echo "E2E_CONTROLPLANE_IPS=$CONTROLPLANE_IPS" >> "$GITHUB_ENV"
-          echo "E2E_WORKER_IPS=$WORKER_IPS" >> "$GITHUB_ENV"
-          echo "E2E_GATEWAY=$GATEWAY" >> "$GITHUB_ENV"
-          echo "E2E_CIDR=10.9.0.0/24" >> "$GITHUB_ENV"
-          echo "E2E_STATE=$RUNNER_TEMP/template-e2e" >> "$GITHUB_ENV"
-
-      - name: Prepare cluster
-        run: bash ./.github/template-tests/e2e/cluster.sh prepare
-
-      - name: Build healthy cluster foundation
-        run: bash ./.github/template-tests/e2e/cluster.sh foundation
-
-      - name: Test Flux SOPS
-        id: flux-sops
-        run: bash ./.github/template-tests/e2e/cluster.sh flux-sops
-        background: true
-
-      - name: Test networking
-        id: networking
-        run: bash ./.github/template-tests/e2e/cluster.sh networking
-        background: true
-
-      - name: Wait for E2E tests
-        wait: [flux-sops, networking]
-
-      - name: Summarize cluster
-        run: bash ./.github/template-tests/e2e/cluster.sh summary
@@ -1,176 +0,0 @@
---
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: "E2E"
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  validate-invalid:
-    if: ${{ github.repository == 'onedr0p/cluster-template' }}
-    name: reject-invalid (${{ matrix.fixture }})
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        fixture:
-          - overlapping-cidrs
-          - nested-cidr-overlap
-          - non-canonical-cidr
-          - tiny-svc-cidr
-          - duplicate-gateway-addrs
-          - duplicate-node-names
-          - reserved-node-name
-          - bad-mac-address
-          - bad-repo-url
-          - missing-known-hosts
-          - node-addr-outside-cidr
-          - node-uses-gateway-addr
-          - gateway-node-collision
-          - bad-vlan-tag
-          - bad-bgp-asn
-          - missing-dns-token
-          - tunnel-without-dns
-          - missing-external-gateway
-          - missing-schematic
-          - partial-bgp
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Assert schema rejects ${{ matrix.fixture }}.toml
-        run: |
-          fixture=./.github/template-tests/invalid/${{ matrix.fixture }}.toml
-          if uv run --quiet --locked --no-dev ./template/scripts/validate.py "$fixture" >/dev/null 2>&1; then
-            echo "::error::schema accepted invalid fixture ${{ matrix.fixture }} (expected rejection)"
-            exit 1
-          fi
-          echo "schema correctly rejected ${{ matrix.fixture }}"
-          # Also surface the actual error message in the log for debuggability.
-          uv run --quiet --locked --no-dev ./template/scripts/validate.py "$fixture" || true
-
-  validator-tests:
-    if: ${{ github.repository == 'onedr0p/cluster-template' }}
-    name: validator-tests
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Run validator tests
-        run: uv run --quiet --locked pytest ./template/scripts/test_validate.py
-
-  validate-valid:
-    if: ${{ github.repository == 'onedr0p/cluster-template' }}
-    name: accept-valid (${{ matrix.fixture }})
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        fixture:
-          - public
-          - private
-          - selfhosted
-          - no-webhook
-          - internal
-          - direct
-          - single-node
-          - multi-controller
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-        with:
-          experimental: true
-          install_args: --locked
-
-      - name: Run init recipe
-        run: just init
-
-      - name: Prepare files
-        run: |
-          cp ./.github/template-tests/valid/${{ matrix.fixture }}.toml cluster.toml
-          echo '{"AccountTag":"fake","TunnelSecret":"fake","TunnelID":"fake"}' > cloudflare-tunnel.json
-          touch kubeconfig
-
-      - name: Assert cluster.toml passes the JSON Schema
-        run: taplo check --schema "file://$PWD/cluster.schema.json" ./cluster.toml
-
-      - name: Run configure recipe
-        run: just configure
-
-      # Rendered output must already match the format-yaml pre-commit hook,
-      # otherwise every `just configure` shows up as formatting churn.
-      - name: Assert rendered output is formatted
-        run: oxfmt --check ./.sops.yaml ./bootstrap ./kubernetes ./talos
-
-      - name: Install flate
-        uses: home-operations/flate/action@631b76b69c4e58c6f4d1cb01e23616fa61aebafa # v0.6.5
-        with:
-          base: ""
-
-      - name: Run flate test
-        run: flate test all -p ./kubernetes/flux/cluster
-
-      - name: Render bootstrap helmfile charts
-        run: just template test-helmfile
-
-      - name: Dry run bootstrap talos recipe
-        run: just --dry-run bootstrap talos
-
-      - name: Create talos secret
-        run: just bootstrap talos-secret
-
-      - name: Render talos configs
-        run: just talos render
-
-      - name: Validate talos configs
-        run: |
-          for config in ./talos/rendered/*.yaml; do
-            talosctl validate --config "$config" --mode metal
-          done
-
-      - name: Dry run bootstrap apps recipe
-        run: just --dry-run bootstrap apps
-
-      - name: Run reset recipe
-        run: yes | just template reset
-
-      - name: Run tidy recipe
-        run: yes | just template tidy
@@ -1,58 +0,0 @@
---
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: "Release"
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: 0 0 1 * *
-
-permissions: {}
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Get Previous Release Tag and Determine Next Tag
-        id: determine-next-tag
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          result-encoding: string
-          script: |
-            const { data: releases } = await github.rest.repos.listReleases({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              per_page: 1,
-            });
-
-            let previousTag = "0.0.0"; // Default if no previous release exists
-            if (releases.length > 0) {
-              previousTag = releases[0].tag_name;
-            }
-
-            const [previousMajor, previousMinor, previousPatch] = previousTag.split('.').map(Number);
-            const currentYear = new Date().getFullYear();
-            const currentMonth = new Date().getMonth() + 1; // Months are 0-indexed in JavaScript
-
-            const nextMajorMinor = `${currentYear}.${currentMonth}`;
-            let nextPatch;
-
-            if (`${previousMajor}.${previousMinor}` === nextMajorMinor) {
-              console.log("Month release already exists for the year. Incrementing patch number by 1.");
-              nextPatch = previousPatch + 1;
-            } else {
-              console.log("Month release does not exist for the year. Starting with patch number 0.");
-              nextPatch = 0;
-            }
-
-            return `${nextMajorMinor}.${nextPatch}`;
-
-      - name: Create Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ steps.determine-next-tag.outputs.result }}
-        run: gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --generate-notes
@@ -1,5 +0,0 @@
-# Tools only the template step needs; `just template tidy` archives this file.
-[tools]
-uv = "0.12.13"
-sd = "1.1.0"
-taplo = "0.10.0"
@@ -384,30 +384,6 @@ url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-x64.tar.gz"
 version = "0.67.0"
 backend = "npm:oxfmt"

-[[tools.sd]]
-version = "1.1.0"
-backend = "aqua:chmln/sd"
-
-[tools.sd."platforms.linux-arm64"]
-checksum = "sha256:ec8c93c0533ff21f4851d11566808d4082544baf063d9b96ea77c27e98b7cd99"
-url = "https://github.com/chmln/sd/releases/download/v1.1.0/sd-v1.1.0-aarch64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/chmln/sd/releases/assets/362325535"
-
-[tools.sd."platforms.linux-x64"]
-checksum = "sha256:3613eca74cd686739bb5a6d68319aa56c747e7315274d02323a2ca2b1c5d82d2"
-url = "https://github.com/chmln/sd/releases/download/v1.1.0/sd-v1.1.0-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/chmln/sd/releases/assets/362325296"
-
-[tools.sd."platforms.macos-arm64"]
-checksum = "sha256:4bd3c09226376ca0a1d69589c91e86276fae36c5fbaaee669afce583f6682030"
-url = "https://github.com/chmln/sd/releases/download/v1.1.0/sd-v1.1.0-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/chmln/sd/releases/assets/362325451"
-
-[tools.sd."platforms.macos-x64"]
-checksum = "sha256:1fca1e9c91813a8aac6821063c923107ba0f66a83309e095edcd3b202f67f97e"
-url = "https://github.com/chmln/sd/releases/download/v1.1.0/sd-v1.1.0-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/chmln/sd/releases/assets/362325430"
-
 [[tools.sops]]
 version = "3.13.3"
 backend = "aqua:getsops/sops"
@@ -472,55 +448,6 @@ url = "https://github.com/siderolabs/talos/releases/download/v1.14.0/talosctl-da
 url_api = "https://api.github.com/repos/siderolabs/talos/releases/assets/542359004"
 provenance = "cosign"

-[[tools.taplo]]
-version = "0.10.0"
-backend = "aqua:tamasfe/taplo"
-
-[tools.taplo."platforms.linux-arm64"]
-url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-aarch64.gz"
-url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322597"
-
-[tools.taplo."platforms.linux-x64"]
-checksum = "blake3:4871fab0e60275a1eb46e7190726e144f56c9a9527f59b0d1da5a042baead8e2"
-url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gz"
-url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322600"
-
-[tools.taplo."platforms.macos-arm64"]
-url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-aarch64.gz"
-url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323110"
-
-[tools.taplo."platforms.macos-x64"]
-url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-x86_64.gz"
-url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323116"
-
-[[tools.uv]]
-version = "0.12.13"
-backend = "aqua:astral-sh/uv"
-
-[tools.uv."platforms.linux-arm64"]
-checksum = "sha256:2eaa5d94f5db7b3a1a092156b9420459e42ab0217d917fe74a876309cef9b5e9"
-url = "https://github.com/astral-sh/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/555670186"
-provenance = "github-attestations"
-
-[tools.uv."platforms.linux-x64"]
-checksum = "sha256:745765a3b6e360ad76743599ae5c42e9278c7edf8bbff9fc76d05bf2623a04dd"
-url = "https://github.com/astral-sh/uv/releases/download/0.12.13/uv-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/555670375"
-provenance = "github-attestations"
-
-[tools.uv."platforms.macos-arm64"]
-checksum = "sha256:7e6ddb9316acc00f2296c82ff4d99977870ee34b2f0ddcae9444d714db9364ed"
-url = "https://github.com/astral-sh/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/555670160"
-provenance = "github-attestations"
-
-[tools.uv."platforms.macos-x64"]
-checksum = "sha256:5e287ef61cb6a9b61b3a83fef124fd143e400468a7dac794230147a810e17119"
-url = "https://github.com/astral-sh/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/555670348"
-provenance = "github-attestations"
-
 [[tools.yq]]
 version = "4.53.6"
 backend = "aqua:mikefarah/yq"
@@ -1,292 +0,0 @@
-#:schema ./cluster.schema.json
-# =============================================================================
-#    Physical LAN that your Talos nodes live on. Defines the address space
-#    used for node IPs, the gateway/DNS/NTP servers nodes will use, and an
-#    optional VLAN tag for switch ports that aren't natively tagged.
-# =============================================================================
-[network]
-
-# The CIDR block your nodes' IPs come from. Every node's `address`, the Kube
-# API VIP, and the gateway VIPs (internal/dns/external) must all sit inside
-# this range.
-# REQUIRED. Example: "192.168.1.0/24"
-node_cidr = ""
-
-# Upstream DNS servers Talos nodes use for name resolution. Defaults to
-# Cloudflare (1.1.1.1 / 1.0.0.1). Override if you run an internal resolver
-# (Pi-hole, Unbound, AdGuard) or want a different public provider.
-# OPTIONAL. Default: ["1.1.1.1", "1.0.0.1"]
-
-# dns_servers = ["1.1.1.1", "1.0.0.1"]
-
-# Upstream NTP servers. Defaults to Cloudflare's anycast NTP. Most homelabs
-# don't need to change this.
-# OPTIONAL. Default: ["162.159.200.1", "162.159.200.123"]
-
-# ntp_servers = ["162.159.200.1", "162.159.200.123"]
-
-# Default gateway IP that nodes use to reach the rest of your LAN/WAN.
-# Defaults to the first usable host in node_cidr (e.g. 192.168.1.1 for
-# 192.168.1.0/24), which is correct for most home routers. Override if your
-# router lives at a non-standard address inside the subnet.
-# OPTIONAL. Default: first IP in node_cidr
-
-# default_gateway = ""
-
-# 802.1Q VLAN tag to apply to the Talos node interface. Only set this if
-# your switch ports are configured as trunks (passing tagged traffic to the
-# nodes); access ports already untag VLAN traffic. Must be 1-4094.
-# REF: https://www.talos.dev/latest/advanced/advanced-networking/#vlans
-# OPTIONAL.
-
-# vlan_tag = ""
-
-
-# =============================================================================
-#    Cluster-internal control plane and overlay networks. The pod and service
-#    CIDRs are in-cluster only — they don't have to be routable on your LAN
-#    and never appear on the wire outside the nodes.
-# =============================================================================
-[kubernetes]
-
-# CIDR Cilium hands out to pods. /16 gives ~64K pod IPs, which is well beyond
-# what a homelab needs but matches the upstream default. Must NOT overlap
-# with node_cidr or svc_cidr.
-# OPTIONAL. Default: "10.42.0.0/16"
-
-# pod_cidr = "10.42.0.0/16"
-
-# CIDR for ClusterIP services (the virtual IPs `kubectl get svc` shows).
-# Same /16 reasoning as pod_cidr. Must NOT overlap with node_cidr or
-# pod_cidr.
-# OPTIONAL. Default: "10.43.0.0/16"
-
-# svc_cidr = "10.43.0.0/16"
-
-# ClusterIP for the CoreDNS Service. Must be inside svc_cidr.
-# OPTIONAL. Default: the 10th IP in svc_cidr
-
-# coredns_addr = ""
-
-[kubernetes.api]
-
-# Virtual IP for the Kubernetes API server. kubectl, flux, and every other
-# client connect here on port 6443. Must be an unused IP inside
-# network.node_cidr — kube-vip floats it across controller nodes.
-# REQUIRED.
-addr = ""
-
-# Additional Subject Alternative Names to put on the Kube API cert. Useful
-# if you want to call the API by hostname (e.g. via a CNAME or local
-# /etc/hosts entry) instead of the raw IP.
-# OPTIONAL. Example: ["mycluster.example.com"]
-
-# tls_sans = ["mycluster.example.com"]
-
-
-# =============================================================================
-#    LoadBalancer IPs that Cilium hands out to the cluster's edge gateways.
-#    Each must be an unused address inside network.node_cidr, and all four
-#    (these three plus kubernetes.api.addr) must be distinct.
-# =============================================================================
-[gateways]
-
-# IP for the `envoy-internal` gateway — used by HTTPRoutes intended for
-# private/in-network access only. Most apps use this gateway by default.
-# REQUIRED.
-internal = ""
-
-# IP for `k8s_gateway`, which serves DNS for cluster-managed hostnames.
-# Point your home DNS server's conditional forwarder for domain.name
-# at this IP to enable split-DNS resolution from your LAN.
-# REQUIRED.
-dns = ""
-
-# IP for the `envoy-external` gateway — sits behind the ingress path (e.g.
-# the cloudflared tunnel) and handles traffic exposed to the public
-# internet. HTTPRoutes that reference this gateway become reachable via
-# your public domain.
-# REQUIRED unless ingress.mode is "none" (internal-only cluster).
-external = ""
-
-
-# =============================================================================
-#    The Git repo Flux will sync from. This is the single source of truth
-#    for everything in your cluster — once bootstrapped, changes are made by
-#    pushing to this repo. Any Git host works: GitHub, GitLab, Gitea,
-#    Forgejo, Codeberg or self-hosted.
-# =============================================================================
-[repository]
-
-# Full clone URL of the repository this cluster will pull from.
-# Must be the repo you cloned this template into.
-# Use `https://` if the repo is publicly readable (or `http://` for a
-# LAN-local git server). Use `ssh://git@` if it is
-# private: the template then wires up a deploy key (`deploy.key.pub`) so
-# Flux can clone over SSH; see the README for the extra setup step.
-# REQUIRED. Examples:
-#   "https://github.com/onedr0p/home-ops.git"
-#   "ssh://git@gitlab.com/onedr0p/home-ops.git"
-#   "ssh://git@git.example.com/k8s/home-ops.git"
-url = ""
-
-# Branch Flux watches. Changes pushed to this branch get reconciled into the
-# cluster.
-# OPTIONAL. Default: "main"
-
-# branch = "main"
-
-# Webhook payload format the Flux webhook Receiver verifies, so pushes are
-# reconciled instantly. Gitea and Forgejo emulate GitHub webhooks, so keep
-# "github" for them. Use "generic-hmac" for anything else that signs with
-# HMAC; see https://fluxcd.io/flux/components/notification/receivers/
-# Use "none" to skip the webhook entirely (e.g. your Git host cannot reach
-# the cluster); Flux then only polls on an interval.
-# OPTIONAL. Default: "github".
-# Allowed: "github" | "gitlab" | "generic-hmac" | "none"
-
-# webhook_provider = "github"
-
-# SSH host keys for your Git host (`ssh-keyscan -t ed25519,ecdsa,rsa <host>`
-# output). Only used with `ssh://` URLs. Keys for github.com, gitlab.com and
-# codeberg.org are bundled; REQUIRED for any other host.
-# OPTIONAL. Example:
-#   known_hosts = """
-#   git.example.com ssh-ed25519 AAAA...
-#   """
-
-# known_hosts = ""
-
-
-# =============================================================================
-#    The domain your cluster's hostnames live under. Used for every rendered
-#    hostname (echo, flux-webhook, internal split DNS) and the wildcard
-#    certificate, regardless of DNS provider.
-# =============================================================================
-[domain]
-
-# REQUIRED. Example: "example.com"
-name = ""
-
-
-# =============================================================================
-#    Public DNS authority and certificate issuance. With "cloudflare",
-#    external-dns publishes records automatically and cert-manager issues a
-#    Let's Encrypt wildcard via ACME DNS-01. With "none", nothing is
-#    published and the wildcard certificate is issued by an in-cluster
-#    self-signed CA instead (internal-only cluster).
-# =============================================================================
-[dns]
-
-# OPTIONAL. Default: "cloudflare". Allowed: "cloudflare" | "none"
-
-# provider = "cloudflare"
-
-# Cloudflare API token (NOT the global API key) with `Zone - DNS - Edit` and
-# `Account - Cloudflare Tunnel - Read` permissions, scoped to the zone
-# above. See the README for token creation steps.
-# REQUIRED when provider is "cloudflare"; must be empty otherwise.
-token = ""
-
-
-# =============================================================================
-#    How the public internet reaches the cluster's external gateway. With
-#    "cloudflare-tunnel", cloudflared connects outbound so no ports are
-#    forwarded (requires dns.provider = "cloudflare" and
-#    cloudflare-tunnel.json). With "direct", you forward TCP 443 (and
-#    optionally 80) on your router to gateways.external and point an
-#    `external.<domain>` DNS record at your WAN address (A record or DDNS
-#    CNAME) yourself; per-app records are still published automatically.
-#    With "none", nothing is exposed and apps are only reachable on your
-#    LAN via the internal gateway.
-# =============================================================================
-[ingress]
-
-# OPTIONAL. Default: "cloudflare-tunnel" when dns.provider is "cloudflare",
-# otherwise "none". Allowed: "cloudflare-tunnel" | "direct" | "none"
-
-# mode = "cloudflare-tunnel"
-
-
-# =============================================================================
-#    CNI configuration. Defaults are sane for most homelab setups; touch
-#    this section only if you need BGP peering or a different LB mode.
-# =============================================================================
-[cilium]
-
-# How Cilium's load balancer handles return traffic. `dsr` (Direct Server
-# Return) preserves the client IP and is faster, but requires a switch
-# fabric that won't drop asymmetric flows. `snat` masquerades the client
-# and is the safe default for unknown topologies.
-# REF: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/
-# OPTIONAL. Default: "dsr". Allowed: "dsr" | "snat"
-
-# loadbalancer_mode = "dsr"
-
-# Cilium BGP peering — advertises Service IPs to your upstream router so
-# LoadBalancer addresses become reachable from anywhere on your LAN
-# (rather than only via L2 ARP). Set ALL THREE fields below to enable;
-# leaving any blank disables BGP entirely.
-# REF: https://docs.cilium.io/en/latest/network/bgp-control-plane/bgp-control-plane/
-[cilium.bgp]
-
-# IP of your BGP-speaking router. The cluster peers with it from each node.
-# OPTIONAL. Example: "192.168.1.1"
-
-# router_addr = ""
-
-# ASN your router uses for BGP. Anything in the private range (64512-65534)
-# is fine if you're not peering with the public internet.
-# OPTIONAL. Example: "64513"
-
-# router_asn = ""
-
-# ASN the cluster's nodes use for BGP. Pick a different value than
-# router_asn so peering is eBGP rather than iBGP.
-# OPTIONAL. Example: "64514"
-
-# node_asn = ""
-
-
-# =============================================================================
-#    Talos Image Factory settings shared by all nodes.
-# =============================================================================
-[talos]
-
-# Default schematic for every node that doesn't set its own schematic_id.
-# The 64-character hex string from your build at https://factory.talos.dev/
-# OPTIONAL if every node sets schematic_id itself.
-schematic_id = ""
-
-
-# =============================================================================
-#    One [[nodes]] table per physical machine or VM in the cluster. At least
-#    one controller (controller=true) is required; worker nodes are optional.
-#    For HA, use 3 controllers.
-#
-#    Discover hardware details from a node already booted into Talos
-#    maintenance mode:
-#      talosctl get disks -n <node-ip> --insecure
-#      talosctl get links -n <node-ip> --insecure
-#    Schematic ID is the 64-character hex string from your build at:
-#      https://factory.talos.dev/
-#
-#    The block below is a template — copy it once per node, uncomment, and
-#    fill in the values.
-# =============================================================================
-
-# [[nodes]]
-# name         = "k8s-0"        # Hostname; must match [a-z0-9-]+ (not "global"/"controller"/"worker").
-# address      = "192.168.1.10" # Static IP; must be inside network.node_cidr.
-# controller   = true           # true = control-plane (etcd + API server), false = worker.
-# disk         = "/dev/nvme0n1" # Block device or /dev/disk/by-id/... symlink to install Talos onto.
-# mac_addr     = "aa:bb:cc:dd:ee:ff"  # Primary NIC MAC.
-#
-# # Optional when [talos] sets a cluster-wide default:
-# schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"  # 64-hex from factory.talos.dev.
-#
-# # Optional advanced fields (each independently uncommentable):
-# mtu            = 1500                       # Set only for jumbo frames / non-1500 MTUs (1450-9000).
-# secureboot     = false                      # UEFI SecureBoot — requires a SecureBoot-enabled schematic.
-# encrypt_disk   = false                      # TPM-bound full-disk encryption.
-# kernel_modules = ["nvidia", "nvidia_uvm"]   # Only for schematics shipping matching extensions.
@@ -1,433 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$defs": {
-    "Api": {
-      "additionalProperties": false,
-      "properties": {
-        "addr": {
-          "format": "ipv4",
-          "title": "Addr",
-          "type": "string"
-        },
-        "tls_sans": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/Fqdn"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "default": null,
-          "title": "Tls Sans"
-        }
-      },
-      "required": ["addr"],
-      "title": "Api",
-      "type": "object"
-    },
-    "Asn": {
-      "type": "string"
-    },
-    "Bgp": {
-      "additionalProperties": false,
-      "properties": {
-        "router_addr": {
-          "anyOf": [
-            {
-              "format": "ipv4",
-              "type": "string"
-            },
-            {
-              "const": "",
-              "type": "string"
-            }
-          ],
-          "default": "",
-          "title": "Router Addr"
-        },
-        "router_asn": {
-          "$ref": "#/$defs/Asn",
-          "default": ""
-        },
-        "node_asn": {
-          "$ref": "#/$defs/Asn",
-          "default": ""
-        }
-      },
-      "title": "Bgp",
-      "type": "object"
-    },
-    "Cidr": {
-      "format": "ipv4network",
-      "type": "string"
-    },
-    "Cilium": {
-      "additionalProperties": false,
-      "properties": {
-        "loadbalancer_mode": {
-          "default": "dsr",
-          "enum": ["dsr", "snat"],
-          "title": "Loadbalancer Mode",
-          "type": "string"
-        },
-        "bgp": {
-          "$ref": "#/$defs/Bgp",
-          "default": {
-            "router_addr": "",
-            "router_asn": "",
-            "node_asn": ""
-          }
-        }
-      },
-      "title": "Cilium",
-      "type": "object"
-    },
-    "Dns": {
-      "additionalProperties": false,
-      "properties": {
-        "provider": {
-          "default": "cloudflare",
-          "enum": ["cloudflare", "none"],
-          "title": "Provider",
-          "type": "string"
-        },
-        "token": {
-          "default": "",
-          "title": "Token",
-          "type": "string"
-        }
-      },
-      "title": "Dns",
-      "type": "object"
-    },
-    "Domain": {
-      "additionalProperties": false,
-      "properties": {
-        "name": {
-          "$ref": "#/$defs/Fqdn"
-        }
-      },
-      "required": ["name"],
-      "title": "Domain",
-      "type": "object"
-    },
-    "Fqdn": {
-      "pattern": "^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
-      "type": "string"
-    },
-    "Gateways": {
-      "additionalProperties": false,
-      "properties": {
-        "internal": {
-          "format": "ipv4",
-          "title": "Internal",
-          "type": "string"
-        },
-        "dns": {
-          "format": "ipv4",
-          "title": "Dns",
-          "type": "string"
-        },
-        "external": {
-          "anyOf": [
-            {
-              "format": "ipv4",
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "default": null,
-          "title": "External"
-        }
-      },
-      "required": ["internal", "dns"],
-      "title": "Gateways",
-      "type": "object"
-    },
-    "Ingress": {
-      "additionalProperties": false,
-      "properties": {
-        "mode": {
-          "default": "cloudflare-tunnel",
-          "enum": ["cloudflare-tunnel", "direct", "none"],
-          "title": "Mode",
-          "type": "string"
-        }
-      },
-      "title": "Ingress",
-      "type": "object"
-    },
-    "Kubernetes": {
-      "additionalProperties": false,
-      "properties": {
-        "pod_cidr": {
-          "$ref": "#/$defs/Cidr",
-          "default": "10.42.0.0/16"
-        },
-        "svc_cidr": {
-          "$ref": "#/$defs/Cidr",
-          "default": "10.43.0.0/16"
-        },
-        "coredns_addr": {
-          "format": "ipv4",
-          "title": "Coredns Addr",
-          "type": "string"
-        },
-        "api": {
-          "$ref": "#/$defs/Api"
-        }
-      },
-      "required": ["api"],
-      "title": "Kubernetes",
-      "type": "object"
-    },
-    "Network": {
-      "additionalProperties": false,
-      "properties": {
-        "node_cidr": {
-          "$ref": "#/$defs/Cidr"
-        },
-        "dns_servers": {
-          "default": ["1.1.1.1", "1.0.0.1"],
-          "items": {
-            "format": "ipv4",
-            "type": "string"
-          },
-          "title": "Dns Servers",
-          "type": "array"
-        },
-        "ntp_servers": {
-          "default": ["162.159.200.1", "162.159.200.123"],
-          "items": {
-            "format": "ipv4",
-            "type": "string"
-          },
-          "title": "Ntp Servers",
-          "type": "array"
-        },
-        "default_gateway": {
-          "format": "ipv4",
-          "title": "Default Gateway",
-          "type": "string"
-        },
-        "vlan_tag": {
-          "anyOf": [
-            {
-              "pattern": "^[0-9]+$",
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "default": null,
-          "title": "Vlan Tag"
-        }
-      },
-      "required": ["node_cidr"],
-      "title": "Network",
-      "type": "object"
-    },
-    "Node": {
-      "additionalProperties": false,
-      "properties": {
-        "name": {
-          "pattern": "^[a-z0-9][a-z0-9\\-]{0,61}[a-z0-9]$|^[a-z0-9]$",
-          "title": "Name",
-          "type": "string"
-        },
-        "address": {
-          "format": "ipv4",
-          "title": "Address",
-          "type": "string"
-        },
-        "controller": {
-          "title": "Controller",
-          "type": "boolean"
-        },
-        "disk": {
-          "title": "Disk",
-          "type": "string"
-        },
-        "mac_addr": {
-          "pattern": "^([0-9a-f]{2}:){5}[0-9a-f]{2}$",
-          "title": "Mac Addr",
-          "type": "string"
-        },
-        "schematic_id": {
-          "anyOf": [
-            {
-              "pattern": "^[a-z0-9]{64}$",
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "default": null,
-          "title": "Schematic Id"
-        },
-        "mtu": {
-          "default": 1500,
-          "maximum": 9000,
-          "minimum": 1450,
-          "title": "Mtu",
-          "type": "integer"
-        },
-        "secureboot": {
-          "default": false,
-          "title": "Secureboot",
-          "type": "boolean"
-        },
-        "encrypt_disk": {
-          "default": false,
-          "title": "Encrypt Disk",
-          "type": "boolean"
-        },
-        "kernel_modules": {
-          "default": [],
-          "items": {
-            "type": "string"
-          },
-          "title": "Kernel Modules",
-          "type": "array"
-        }
-      },
-      "required": ["name", "address", "controller", "disk", "mac_addr"],
-      "title": "Node",
-      "type": "object"
-    },
-    "Repository": {
-      "additionalProperties": false,
-      "properties": {
-        "url": {
-          "pattern": "^(https?://|ssh://git@)[^/]+/.+$",
-          "title": "Url",
-          "type": "string"
-        },
-        "branch": {
-          "default": "main",
-          "minLength": 1,
-          "title": "Branch",
-          "type": "string"
-        },
-        "webhook_provider": {
-          "default": "github",
-          "enum": ["github", "gitlab", "generic-hmac", "none"],
-          "title": "Webhook Provider",
-          "type": "string"
-        },
-        "known_hosts": {
-          "default": "",
-          "title": "Known Hosts",
-          "type": "string"
-        }
-      },
-      "required": ["url"],
-      "title": "Repository",
-      "type": "object"
-    },
-    "Spegel": {
-      "additionalProperties": false,
-      "properties": {
-        "enabled": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "default": null,
-          "title": "Enabled"
-        }
-      },
-      "title": "Spegel",
-      "type": "object"
-    },
-    "Talos": {
-      "additionalProperties": false,
-      "properties": {
-        "schematic_id": {
-          "anyOf": [
-            {
-              "pattern": "^[a-z0-9]{64}$",
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "default": null,
-          "title": "Schematic Id"
-        }
-      },
-      "title": "Talos",
-      "type": "object"
-    }
-  },
-  "additionalProperties": false,
-  "properties": {
-    "network": {
-      "$ref": "#/$defs/Network"
-    },
-    "kubernetes": {
-      "$ref": "#/$defs/Kubernetes"
-    },
-    "gateways": {
-      "$ref": "#/$defs/Gateways"
-    },
-    "repository": {
-      "$ref": "#/$defs/Repository"
-    },
-    "domain": {
-      "$ref": "#/$defs/Domain"
-    },
-    "dns": {
-      "$ref": "#/$defs/Dns"
-    },
-    "ingress": {
-      "$ref": "#/$defs/Ingress"
-    },
-    "cilium": {
-      "$ref": "#/$defs/Cilium",
-      "default": {
-        "loadbalancer_mode": "dsr",
-        "bgp": {
-          "node_asn": "",
-          "router_addr": "",
-          "router_asn": ""
-        }
-      }
-    },
-    "talos": {
-      "$ref": "#/$defs/Talos",
-      "default": {
-        "schematic_id": null
-      }
-    },
-    "spegel": {
-      "$ref": "#/$defs/Spegel",
-      "default": {
-        "enabled": null
-      }
-    },
-    "nodes": {
-      "items": {
-        "$ref": "#/$defs/Node"
-      },
-      "title": "Nodes",
-      "type": "array"
-    }
-  },
-  "required": ["network", "kubernetes", "gateways", "repository", "domain", "dns", "nodes"],
-  "title": "cluster.toml",
-  "type": "object"
-}
@@ -17,18 +17,3 @@ mod? talos 'talos'
 [private]
 log lvl msg *args:
    gum log -t rfc3339 -s -l "{{ lvl }}" "{{ msg }}" {{ args }}
-
-# === template ===
-
-[group('template')]
-mod template 'template'
-
-[doc('Render and validate configuration files')]
-[group('template')]
-configure:
-    just template configure
-
-[doc('Initialize configuration files (cluster.toml, age key, deploy key, webhook token)')]
-[group('template')]
-init:
-    just template init
@@ -1,19 +0,0 @@
-[makejinja]
-inputs = ["./template/overrides","./template/config"]
-output = "./"
-exclude_patterns = ["*.partial.yaml.j2"]
-data = ["./cluster.toml"]
-import_paths = ["./template/scripts"]
-loaders = ["plugin:Plugin"]
-jinja_suffix = ".j2"
-copy_metadata = true
-force = true
-undefined = "strict"
-
-[makejinja.delimiter]
-block_start = "#%"
-block_end = "%#"
-comment_start = "#|"
-comment_end = "#|"
-variable_start = "#{"
-variable_end = "}#"
@@ -1,16 +0,0 @@
-[project]
-name = "cluster-template"
-version = "0.0.0"
-requires-python = ">=3.14"
-dependencies = [
-  "makejinja==2.8.3",
-  "pydantic==2.13.5",
-]
-
-[dependency-groups]
-dev = [
-  "pytest>=8",
-]
-
-[tool.uv]
-package = false
@@ -1,12 +0,0 @@
---
-creation_rules:
-  - path_regex: talos/.*\.sops\.ya?ml
-    mac_only_encrypted: true
-    age: "#{ age_key('public') }#"
-  - path_regex: (bootstrap|kubernetes)/.*\.sops\.ya?ml
-    encrypted_regex: "^(data|stringData)$"
-    mac_only_encrypted: true
-    age: "#{ age_key('public') }#"
-stores:
-  yaml:
-    indent: 2
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: deploy-key
-  namespace: flux-system
-stringData:
-  identity: |
-    #% filter indent(width=4, first=False) %#
-    #{ deploy_key() }#
-    #% endfilter %#
-  known_hosts: |
-    #% filter indent(width=4, first=False) %#
-    #{ repository.known_hosts }#
-    #% endfilter %#
@@ -1,60 +0,0 @@
---
-# yaml-language-server: $schema=https://json.schemastore.org/helmfile
-
-# Bootstraps core applications that provide a minimal runtime base for the
-# cluster. These releases are installed first so the cluster has the resources
-# Flux needs before its own reconciliation begins.
-#
-# After this bootstrap phase, Flux is ready to take over management of the
-# application stack and continue reconciling downstream state.
-
-helmDefaults:
-  cleanupOnFail: true
-  forceConflicts: true
-  wait: true
-  waitForJobs: true
-
-bases:
-  - default.yaml
-
-releases:
-  - name: cilium
-    namespace: kube-system
-    inherit:
-      - template: default
-
-  - name: coredns
-    namespace: kube-system
-    inherit:
-      - template: default
-    needs: ["kube-system/cilium"]
-  #% if spegel.enabled %#
-
-  - name: spegel
-    namespace: kube-system
-    inherit:
-      - template: default
-    needs: ["kube-system/coredns"]
-  #% endif %#
-
-  - name: cert-manager
-    namespace: cert-manager
-    inherit:
-      - template: default
-    #% if spegel.enabled %#
-    needs: ["kube-system/spegel"]
-    #% else %#
-    needs: ["kube-system/coredns"]
-    #% endif %#
-
-  - name: flux-operator
-    namespace: flux-system
-    inherit:
-      - template: default
-    needs: ["cert-manager/cert-manager"]
-
-  - name: flux-instance
-    namespace: flux-system
-    inherit:
-      - template: default
-    needs: ["flux-system/flux-operator"]
@@ -1,37 +0,0 @@
---
-# yaml-language-server: $schema=https://json.schemastore.org/helmfile
-
-# Bootstraps cluster-wide Custom Resource Definitions (CRDs) by extracting them
-# from upstream Helm charts and applying them directly with kubectl. The releases
-# below are never reconciled with helmfile apply or helmfile sync — only their
-# CRDs are rendered (via --include-crds) and piped to the cluster.
-#
-# Installing CRDs out-of-band ensures they exist before Flux begins reconciling
-# workloads that reference them, avoiding the need for dependsOn chains on nearly
-# every Kustomization that consumes a CRD-backed resource.
-
-helmDefaults:
-  args:
-    - --include-crds
-    - --no-hooks
-
-bases:
-  - default.yaml
-
-releases:
-  #% if dns.provider == 'cloudflare' and ingress.mode != 'none' %#
-  - name: cloudflare-dns
-    namespace: network
-    inherit:
-      - template: default
-
-  #% endif %#
-  - name: envoy-gateway
-    namespace: network
-    inherit:
-      - template: default
-
-  - name: prometheus-operator-crds
-    namespace: observability
-    chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
-    version: 29.0.0
@@ -1,8 +0,0 @@
---
-# yaml-language-server: $schema=https://json.schemastore.org/helmfile
-templates:
-  default:
-    chart: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).chart }}'
-    version: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).version }}'
-    values:
-      - ./templates/values.yaml.gotmpl
@@ -1,3 +0,0 @@
-{{- $oci := fromYaml (readFile (printf "../../kubernetes/apps/%s/%s/app/ocirepository.yaml" .Release.Namespace .Release.Name)) -}}
-chart: {{ $oci.spec.url }}
-version: {{ $oci.spec.ref.tag }}
@@ -1 +0,0 @@
-{{ (fromYaml (readFile (printf "../../../kubernetes/apps/%s/%s/app/helmrelease.yaml" .Release.Namespace .Release.Name))).spec.values | toYaml }}
@@ -1,105 +0,0 @@
-set no-exit-message
-set quiet
-set shell := ['bash', '-euo', 'pipefail', '-c']
-set script-interpreter := ['bash', '-euo', 'pipefail']
-set default-list
-set default-script
-
-kubernetes_dir := justfile_dir() + '/kubernetes'
-
-[doc('Bootstrap the Talos cluster')]
-[group('bootstrap')]
-talos: talos-secret talos-apply talos-talosconfig talos-kubeconfig
-
-[doc('Bootstrap apps into the Talos cluster')]
-[group('bootstrap')]
-apps: apps-ready apps-namespaces apps-secrets apps-crds apps-helm
-    just log info "Cluster is bootstrapped — Flux will start syncing the Git repository"
-
-# No sops call or existence guard is needed: the bundle is stored already
-# encrypted with the repo's age recipient, and existing bundles are left
-# untouched.
-[private]
-[working-directory('../talos')]
-talos-secret:
-    just log info "Generating secrets" stage "{{ recipe_name() }}"
-    topf secrets --confirm=false > /dev/null
-
-[private]
-[working-directory('../talos')]
-talos-apply:
-    just log info "Applying talos config and bootstrapping" stage "{{ recipe_name() }}"
-    topf apply --auto-bootstrap --confirm=false
-
-[private]
-[working-directory('../talos')]
-talos-talosconfig:
-    just log info "Generating talosconfig" stage "{{ recipe_name() }}"
-    topf talosconfig > talosconfig
-
-# topf issues short-lived admin certs by default; 8760h keeps the
-# kubeconfig usable long-term.
-[private]
-[working-directory('../talos')]
-talos-kubeconfig:
-    just log info "Fetching kubeconfig" stage "{{ recipe_name() }}"
-    topf kubeconfig --validity 8760h > "{{ justfile_dir() }}/kubeconfig"
-
-[private]
-apps-crds:
-    just log info "Applying CRDs" stage "{{ recipe_name() }}"
-    if ! helmfile --file "{{ source_directory() }}/helmfile/crds.yaml" template --quiet | yq eval-all --exit-status 'select(.kind == "CustomResourceDefinition")' | kubectl apply --server-side --force-conflicts --filename -; then
-        just log fatal "Failed to apply crds"
-    fi
-
-[private]
-apps-helm:
-    just log info "Syncing helmfile" stage "{{ recipe_name() }}"
-    if ! helmfile --file "{{ source_directory() }}/helmfile/apps.yaml" sync --hide-notes; then
-        just log fatal "Failed to sync helmfile"
-    fi
-
-[private]
-apps-namespaces:
-    just log info "Applying namespaces for apps" stage "{{ recipe_name() }}"
-    for app in "{{ kubernetes_dir }}/apps"/*/; do
-        ns="$(basename "$app")"
-        if kubectl create namespace "$ns" --dry-run=client -o yaml \
-                | kubectl apply --server-side --filename - &>/dev/null; then
-            just log info "Namespace applied" namespace "$ns"
-        else
-            just log fatal "Failed to apply namespace" namespace "$ns"
-        fi
-    done
-
-[private]
-apps-secrets:
-    just log info "Applying secrets for apps" stage "{{ recipe_name() }}"
-    for secret in \
-        "{{ source_directory() }}/deploy-key.sops.yaml" \
-        "{{ source_directory() }}/sops-age.sops.yaml" \
-        "{{ kubernetes_dir }}/components/sops/cluster-secrets.sops.yaml"
-    do
-        name="$(basename "$secret" .sops.yaml)"
-        if sops decrypt "$secret" \
-                | kubectl --namespace flux-system apply --server-side --filename - &>/dev/null; then
-            just log info "Secret applied" resource "$name"
-        else
-            just log fatal "Failed to apply secret" resource "$name"
-        fi
-    done
-
-# Wait until nodes register as Ready=False. They only become Ready=True once the CNI is healthy.
-[private]
-apps-ready:
-    just log info "Waiting for nodes to register as Ready=False" stage "{{ recipe_name() }}"
-    if ! kubectl wait nodes --for=condition=Ready=True --all --timeout=10s &>/dev/null; then
-        deadline=$((SECONDS + 600))
-        until kubectl wait nodes --for=condition=Ready=False --all --timeout=10s &>/dev/null; do
-            if (( SECONDS >= deadline )); then
-                just log fatal "Timed out waiting for nodes to register"
-            fi
-            just log info "Nodes not available, waiting for nodes to be available. Retrying in 5 seconds..."
-            sleep 5
-        done
-    fi
@@ -1,8 +0,0 @@
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: sops-age
-  namespace: flux-system
-stringData:
-  age.agekey: "#{ age_key('private') }#"
@@ -1,52 +0,0 @@
-#% if dns.provider == 'cloudflare' %#
---
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-production
-spec:
-  acme:
-    privateKeySecretRef:
-      name: letsencrypt-production
-    profile: shortlived
-    server: https://acme-v02.api.letsencrypt.org/directory
-    solvers:
-      - dns01:
-          cloudflare:
-            apiTokenSecretRef:
-              name: cert-manager-secret
-              key: api-token
-        selector:
-          dnsZones: ["${SECRET_DOMAIN}"]
-#% else %#
---
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: selfsigned
-spec:
-  selfSigned: {}
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-ca
-spec:
-  isCA: true
-  commonName: internal-ca
-  secretName: internal-ca
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  issuerRef:
-    name: selfsigned
-    kind: ClusterIssuer
---
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: internal-ca
-spec:
-  ca:
-    secretName: internal-ca
-#% endif %#
@@ -1,20 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager
-spec:
-  chartRef:
-    kind: OCIRepository
-    name: cert-manager
-  interval: 1h
-  values:
-    crds:
-      enabled: true
-    replicaCount: #{ 2 if nodes | length > 1 else 1 }#
-    dns01RecursiveNameservers: https://1.1.1.1:443/dns-query,https://1.0.0.1:443/dns-query
-    dns01RecursiveNameserversOnly: true
-    prometheus:
-      enabled: true
-      servicemonitor:
-        enabled: true
@@ -1,10 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./clusterissuer.yaml
-  - ./helmrelease.yaml
-  - ./ocirepository.yaml
-  #% if dns.provider == 'cloudflare' %#
-  - ./secret.sops.yaml
-  #% endif %#
@@ -1,13 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: cert-manager
-spec:
-  interval: 15m
-  layerSelector:
-    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
-    operation: copy
-  ref:
-    tag: v1.21.2
-  url: oci://quay.io/jetstack/charts/cert-manager
@@ -1,9 +0,0 @@
-#% if dns.provider == 'cloudflare' %#
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cert-manager-secret
-stringData:
-  api-token: "#{ dns.token }#"
-#% endif %#
@@ -1,30 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cert-manager
-spec:
-  healthChecks:
-    - apiVersion: helm.toolkit.fluxcd.io/v2
-      kind: HelmRelease
-      name: cert-manager
-      namespace: cert-manager
-    - apiVersion: cert-manager.io/v1
-      kind: ClusterIssuer
-      name: #{ cluster_issuer }#
-  healthCheckExprs:
-    - apiVersion: cert-manager.io/v1
-      kind: ClusterIssuer
-      current: status.conditions.exists(e, e.type == 'Ready' && e.status == 'True')
-  interval: 1h
-  path: ./kubernetes/apps/cert-manager/cert-manager/app
-  postBuild:
-    substituteFrom:
-      - name: cluster-secrets
-        kind: Secret
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: cert-manager
@@ -1,11 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-
-components:
-  - ../../components/sops
-
-resources:
-  - ./namespace.yaml
-  - ./cert-manager/ks.yaml
@@ -1,7 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -1,31 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: echo
-spec:
-  chartRef:
-    kind: OCIRepository
-    name: echo
-  interval: 1h
-  values:
-    replicaCount: #{ 2 if nodes | length > 1 else 1 }#
-    config:
-      kubernetes: true
-      trustedProxies:
-        - "#{ kubernetes.pod_cidr }#"
-    httpRoute:
-      enabled: true
-      hostnames:
-        - "{{ .Release.Name }}.${SECRET_DOMAIN}"
-      parentRefs:
-        - name: envoy-#{ 'external' if ingress.mode != 'none' else 'internal' }#
-          namespace: network
-    monitoring:
-      serviceMonitor:
-        enabled: true
-    resources:
-      requests:
-        cpu: 10m
-      limits:
-        memory: 64Mi
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-  - ./ocirepository.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: echo
-spec:
-  interval: 15m
-  layerSelector:
-    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
-    operation: copy
-  ref:
-    tag: 0.2.5
-  url: oci://ghcr.io/home-operations/charts/echo
@@ -1,19 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: echo
-spec:
-  interval: 1h
-  path: ./kubernetes/apps/default/echo/app
-  postBuild:
-    substituteFrom:
-      - name: cluster-secrets
-        kind: Secret
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: default
-  wait: false
@@ -1,11 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: default
-
-components:
-  - ../../components/sops
-
-resources:
-  - ./namespace.yaml
-  - ./echo/ks.yaml
@@ -1,7 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: default
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -1,136 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: flux-instance
-spec:
-  chartRef:
-    kind: OCIRepository
-    name: flux-instance
-  interval: 1h
-  values:
-    commonAnnotations:
-      fluxcd.controlplane.io/reconcileArtifactEvery: 1h
-    instance:
-      cluster:
-        networkPolicy: false
-      components:
-        - source-controller
-        - kustomize-controller
-        - helm-controller
-        - notification-controller
-      sync:
-        kind: GitRepository
-        url: "#{ repository.url }#"
-        #% if repository.url.startswith('ssh://') %#
-        pullSecret: deploy-key
-        #% endif %#
-        ref: "refs/heads/#{ repository.branch }#"
-        path: kubernetes/flux/cluster
-      commonMetadata:
-        labels:
-          app.kubernetes.io/name: flux
-      kustomize:
-        patches:
-          - # Increase the number of workers
-            patch: |
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --concurrent=10
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --requeue-dependency=5s
-            target:
-              kind: Deployment
-              name: (kustomize-controller|helm-controller|source-controller)
-          - # Increase the memory limits
-            patch: |
-              apiVersion: apps/v1
-              kind: Deployment
-              metadata:
-                name: all
-              spec:
-                template:
-                  spec:
-                    containers:
-                      - name: manager
-                        resources:
-                          limits:
-                            memory: 1Gi
-            target:
-              kind: Deployment
-              name: (kustomize-controller|helm-controller|source-controller)
-          - # Enable in-memory kustomize builds
-            patch: |
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --concurrent=20
-              - op: replace
-                path: /spec/template/spec/volumes/0
-                value:
-                  name: temp
-                  emptyDir:
-                    medium: Memory
-            target:
-              kind: Deployment
-              name: kustomize-controller
-          - # Enable Helm repositories caching
-            patch: |
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --helm-cache-max-size=10
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --helm-cache-ttl=60m
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --helm-cache-purge-interval=5m
-            target:
-              kind: Deployment
-              name: source-controller
-          - # Flux near OOM detection for Helm
-            patch: |
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --feature-gates=OOMWatch=true
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --oom-watch-memory-threshold=95
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --oom-watch-interval=500ms
-            target:
-              kind: Deployment
-              name: helm-controller
-          - # Disable chart digest tracking
-            patch: |
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --feature-gates=DisableChartDigestTracking=true
-            target:
-              kind: Deployment
-              name: helm-controller
-          - # Controller-level SOPS decryption
-            patch: |
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --sops-age-secret=sops-age
-            target:
-              kind: Deployment
-              name: kustomize-controller
-          - # Watch configmaps and secrets attached to HelmReleases and Kustomizations
-            patch: |-
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --watch-configs-label-selector=owner!=helm
-            target:
-              kind: Deployment
-              name: (helm-controller|kustomize-controller)
-          - # Cancel health checks on new Kustomizations revisions
-            patch: |-
-              - op: add
-                path: /spec/template/spec/containers/0/args/-
-                value: --feature-gates=CancelHealthCheckOnNewRevision=true
-            target:
-              kind: Deployment
-              name: kustomize-controller
@@ -1,22 +0,0 @@
-#% if repository.webhook_provider != 'none' %#
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: flux-webhook
-spec:
-  hostnames: ["flux-webhook.${SECRET_DOMAIN}"]
-  parentRefs:
-    - name: envoy-#{ 'external' if ingress.mode != 'none' else 'internal' }#
-      namespace: network
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: webhook-receiver
-          namespace: flux-system
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /hook/
-#% endif %#
@@ -1,11 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-  - ./ocirepository.yaml
-  #% if repository.webhook_provider != 'none' %#
-  - ./secret.sops.yaml
-  - ./httproute.yaml
-  - ./receiver.yaml
-  #% endif %#
@@ -1,13 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: flux-instance
-spec:
-  interval: 15m
-  layerSelector:
-    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
-    operation: copy
-  ref:
-    tag: 0.60.0
-  url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-instance
@@ -1,21 +0,0 @@
-#% if repository.webhook_provider != 'none' %#
---
-apiVersion: notification.toolkit.fluxcd.io/v1
-kind: Receiver
-metadata:
-  name: flux-webhook
-spec:
-  type: #{ repository.webhook_provider }#
-  events: ["ping", "push"]
-  secretRef:
-    name: flux-webhook-token
-  resources:
-    - apiVersion: source.toolkit.fluxcd.io/v1
-      kind: GitRepository
-      name: flux-system
-      namespace: flux-system
-    - apiVersion: kustomize.toolkit.fluxcd.io/v1
-      kind: Kustomization
-      name: flux-system
-      namespace: flux-system
-#% endif %#
@@ -1,9 +0,0 @@
-#% if repository.webhook_provider != 'none' %#
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: flux-webhook-token
-stringData:
-  token: "#{ webhook_token() }#"
-#% endif %#
@@ -1,21 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-instance
-spec:
-  dependsOn:
-    - name: flux-operator
-  interval: 1h
-  path: ./kubernetes/apps/flux-system/flux-instance/app
-  postBuild:
-    substituteFrom:
-      - name: cluster-secrets
-        kind: Secret
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: flux-system
-  wait: false
@@ -1,13 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: flux-operator
-spec:
-  chartRef:
-    kind: OCIRepository
-    name: flux-operator
-  interval: 1h
-  values:
-    serviceMonitor:
-      create: true
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-  - ./ocirepository.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: flux-operator
-spec:
-  interval: 15m
-  layerSelector:
-    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
-    operation: copy
-  ref:
-    tag: 0.60.0
-  url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
@@ -1,19 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-operator
-spec:
-  interval: 1h
-  path: ./kubernetes/apps/flux-system/flux-operator/app
-  postBuild:
-    substituteFrom:
-      - name: cluster-secrets
-        kind: Secret
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: flux-system
-  wait: true
@@ -1,12 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: flux-system
-
-components:
-  - ../../components/sops
-
-resources:
-  - ./namespace.yaml
-  - ./flux-instance/ks.yaml
-  - ./flux-operator/ks.yaml
@@ -1,7 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -1,91 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cilium
-spec:
-  chartRef:
-    kind: OCIRepository
-    name: cilium
-  interval: 1h
-  values:
-    autoDirectNodeRoutes: true
-    bpf:
-      masquerade: true
-      # Ref: https://github.com/siderolabs/talos/issues/10002
-      hostLegacyRouting: true
-    #% if cilium_bgp_enabled %#
-    bgpControlPlane:
-      enabled: true
-    #% endif %#
-    cni:
-      # Required for pairing with Multus CNI
-      exclusive: false
-    cgroup:
-      automount:
-        enabled: false
-      hostRoot: /sys/fs/cgroup
-    # The stable bond name is defined in talos/all/20-network-links.yaml.tpl
-    devices: bond0+
-    dashboards:
-      enabled: true
-    endpointRoutes:
-      enabled: true
-    envoy:
-      enabled: false
-    gatewayAPI:
-      enabled: false
-    hubble:
-      enabled: false
-    ipam:
-      mode: kubernetes
-    ipv4NativeRoutingCIDR: "#{ kubernetes.pod_cidr }#"
-    k8sServiceHost: 127.0.0.1
-    k8sServicePort: 7445
-    kubeProxyReplacement: true
-    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
-    l2announcements:
-      enabled: true
-    loadBalancer:
-      algorithm: maglev
-      mode: "#{ cilium.loadbalancer_mode }#"
-    localRedirectPolicies:
-      enabled: true
-    operator:
-      dashboards:
-        enabled: true
-      prometheus:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-      replicas: #{ 2 if nodes | length > 1 else 1 }#
-      rollOutPods: true
-    prometheus:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-        trustCRDsExist: true
-    rollOutCiliumPods: true
-    routingMode: native
-    securityContext:
-      capabilities:
-        ciliumAgent:
-          - CHOWN
-          - KILL
-          - NET_ADMIN
-          - NET_RAW
-          - IPC_LOCK
-          - SYS_ADMIN
-          - SYS_RESOURCE
-          - PERFMON
-          - BPF
-          - DAC_OVERRIDE
-          - FOWNER
-          - SETGID
-          - SETUID
-        cleanCiliumState:
-          - NET_ADMIN
-          - SYS_ADMIN
-          - SYS_RESOURCE
-    socketLB:
-      enabled: true
@@ -1,7 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-  - ./ocirepository.yaml
-  - ./networks.yaml
@@ -1,71 +0,0 @@
---
-apiVersion: cilium.io/v2alpha1
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: pool
-spec:
-  allowFirstLastIPs: "No"
-  blocks:
-    - cidr: "#{ network.node_cidr }#"
---
-apiVersion: cilium.io/v2alpha1
-kind: CiliumL2AnnouncementPolicy
-metadata:
-  name: l2-policy
-spec:
-  loadBalancerIPs: true
-  # NOTE: interfaces might need to be set if you have more than one active NIC on your hosts
-  # interfaces:
-  #   - ^eno[0-9]+
-  #   - ^eth[0-9]+
-  nodeSelector:
-    matchLabels:
-      kubernetes.io/os: linux
-#% if cilium_bgp_enabled %#
---
-apiVersion: cilium.io/v2alpha1
-kind: CiliumBGPAdvertisement
-metadata:
-  name: bgp-advertisement-config
-  labels:
-    advertise: bgp
-spec:
-  advertisements:
-    - advertisementType: Service
-      service:
-        addresses:
-          - LoadBalancerIP
-      selector:
-        matchExpressions:
-          - { key: somekey, operator: NotIn, values: ["never-used-value"] }
---
-apiVersion: cilium.io/v2alpha1
-kind: CiliumBGPPeerConfig
-metadata:
-  name: bgp-peer-config-v4
-spec:
-  families:
-    - afi: ipv4
-      safi: unicast
-      advertisements:
-        matchLabels:
-          advertise: bgp
---
-apiVersion: cilium.io/v2alpha1
-kind: CiliumBGPClusterConfig
-metadata:
-  name: bgp-cluster-config
-spec:
-  nodeSelector:
-    matchLabels:
-      kubernetes.io/os: linux
-  bgpInstances:
-    - name: instance-#{ cilium.bgp.node_asn }#
-      localASN: #{ cilium.bgp.node_asn }#
-      peers:
-        - name: peer-#{ cilium.bgp.router_asn }#-v4
-          peerASN: #{ cilium.bgp.router_asn }#
-          peerAddress: #{ cilium.bgp.router_addr }#
-          peerConfigRef:
-            name: bgp-peer-config-v4
-#% endif %#
@@ -1,13 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: cilium
-spec:
-  interval: 15m
-  layerSelector:
-    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
-    operation: copy
-  ref:
-    tag: 1.20.1
-  url: oci://quay.io/cilium/charts/cilium
@@ -1,19 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cilium
-spec:
-  interval: 1h
-  path: ./kubernetes/apps/kube-system/cilium/app
-  postBuild:
-    substituteFrom:
-      - name: cluster-secrets
-        kind: Secret
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: kube-system
-  wait: false
@@ -1,69 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: coredns
-spec:
-  chartRef:
-    kind: OCIRepository
-    name: coredns
-  interval: 1h
-  values:
-    fullnameOverride: coredns
-    image:
-      repository: mirror.gcr.io/coredns/coredns
-    k8sAppLabelOverride: kube-dns
-    serviceAccount:
-      create: true
-    service:
-      name: kube-dns
-      clusterIP: "#{ kubernetes.coredns_addr }#"
-    replicaCount: #{ 2 if controller_count > 1 else 1 }#
-    priorityClassName: system-cluster-critical
-    servers:
-      - zones:
-          - zone: .
-            scheme: dns://
-            use_tcp: true
-        port: 53
-        plugins:
-          - name: errors
-          - name: health
-            configBlock: |-
-              lameduck 5s
-          - name: ready
-          - name: kubernetes
-            parameters: cluster.local in-addr.arpa ip6.arpa
-            configBlock: |-
-              pods verified
-              fallthrough in-addr.arpa ip6.arpa
-          - name: autopath
-            parameters: "@kubernetes"
-          - name: forward
-            parameters: . /etc/resolv.conf
-          - name: cache
-            configBlock: |-
-              prefetch 20
-              serve_stale
-              servfail 0
-          - name: loop
-          - name: reload
-          - name: loadbalance
-          - name: prometheus
-            parameters: 0.0.0.0:9153
-          - name: log
-            configBlock: |-
-              class error
-    affinity:
-      nodeAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-          nodeSelectorTerms:
-            - matchExpressions:
-                - key: node-role.kubernetes.io/control-plane
-                  operator: Exists
-    tolerations:
-      - key: CriticalAddonsOnly
-        operator: Exists
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-  - ./ocirepository.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: coredns
-spec:
-  interval: 15m
-  layerSelector:
-    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
-    operation: copy
-  url: oci://ghcr.io/coredns/charts/coredns
-  ref:
-    tag: 1.47.1
@@ -1,19 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: coredns
-spec:
-  interval: 1h
-  path: ./kubernetes/apps/kube-system/coredns/app
-  postBuild:
-    substituteFrom:
-      - name: cluster-secrets
-        kind: Secret
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: kube-system
-  wait: false
@@ -1,17 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: kube-system
-
-components:
-  - ../../components/sops
-
-resources:
-  - ./namespace.yaml
-  - ./cilium/ks.yaml
-  - ./coredns/ks.yaml
-  - ./metrics-server/ks.yaml
-  - ./reloader/ks.yaml
-  #% if spegel.enabled %#
-  - ./spegel/ks.yaml
-  #% endif %#
@@ -1,21 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: metrics-server
-spec:
-  chartRef:
-    kind: OCIRepository
-    name: metrics-server
-  interval: 1h
-  values:
-    args:
-      - --kubelet-insecure-tls
-      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
-      - --kubelet-use-node-status-port
-      - --metric-resolution=10s
-      - --kubelet-request-timeout=2s
-    metrics:
-      enabled: true
-    serviceMonitor:
-      enabled: true
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-  - ./ocirepository.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: metrics-server
-spec:
-  interval: 15m
-  layerSelector:
-    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
-    operation: copy
-  ref:
-    tag: 3.14.0
-  url: oci://ghcr.io/home-operations/charts-mirror/metrics-server
@@ -1,19 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: metrics-server
-spec:
-  interval: 1h
-  path: ./kubernetes/apps/kube-system/metrics-server/app
-  postBuild:
-    substituteFrom:
-      - name: cluster-secrets
-        kind: Secret
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: kube-system
-  wait: false
@@ -1,7 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kube-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -1,17 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: reloader
-spec:
-  chartRef:
-    kind: OCIRepository
-    name: reloader
-  interval: 1h
-  values:
-    fullnameOverride: reloader
-    reloader:
-      readOnlyRootFileSystem: true
-      podMonitor:
-        enabled: true
-        namespace: "{{ .Release.Namespace }}"
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helmrelease.yaml
-  - ./ocirepository.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: reloader
-spec:
-  interval: 15m
-  layerSelector:
-    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
-    operation: copy
-  ref:
-    tag: 2.2.17
-  url: oci://ghcr.io/stakater/charts/reloader
@@ -1,19 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: reloader
-spec:
-  interval: 1h
-  path: ./kubernetes/apps/kube-system/reloader/app
-  postBuild:
-    substituteFrom:
-      - name: cluster-secrets
-        kind: Secret
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: kube-system
-  wait: false
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`{{ (fromYaml (readFile (printf "../../../kubernetes/apps/%s/%s/app/helmrelease.yaml" .Release.Namespace .Release.Name))).spec.values \| toYaml }}`