fix: Remove redundant dictionary key

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/git.yml

@@ -110,8 +110,8 @@
             - organization: mc
               body:
                 name: GitOps.ClusterAPI
-                # auto_init: true
+                auto_init: true
-                # default_branch: main
+                default_branch: main
                 description: ClusterAPI manifests
             - organization: mc
               body:
@@ -125,12 +125,6 @@
                 # auto_init: true
                 # default_branch: main
                 description: GitOps manifests
-            - organization: wl
-              body:
-                name: GitOps.HelmCharts
-                # auto_init: true
-                # default_branch: main
-                description: Helm charts
           loop_control:
             label: "{{ item.organization ~ '/' ~ item.body.name }}"
 

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/init.yml

@@ -63,6 +63,14 @@
   ansible.builtin.command:
     cmd: update-ca-certificates
 
+- name: Extract container images (for idempotency purposes)
+  ansible.builtin.unarchive:
+    src: /opt/metacluster/container-images/image-tarballs.tgz
+    dest: /opt/metacluster/container-images
+    remote_src: no
+  when:
+    - lookup('ansible.builtin.fileglob', 'opt/metacluster/container-images/*.tgz') is match('.*image-tarballs.tgz')
+    
 - name: Get all stored fully qualified container image names
   ansible.builtin.shell:
     cmd: >-

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/clusterapi.yml

@@ -129,6 +129,12 @@
     state: directory
   register: capi_clustermanifest
 
+- name: Pull existing repository
+  ansible.builtin.git:
+    repo: https://git.{{ vapp['metacluster.fqdn'] }}/mc/GitOps.ClusterAPI.git
+    dest: "{{ capi_clustermanifest.path }}"
+    version: main
+
 - name: Save workload cluster manifest
   ansible.builtin.copy:
     dest: "{{ capi_clustermanifest.path }}/new-cluster.yaml"
@@ -173,24 +179,46 @@
           prefix: "{{ vapp['guestinfo.prefixlength'] }}"
           gateway: "{{ vapp['guestinfo.gateway'] }}"
 
-- name: Initialize/Push git repository
+- name: Remove working files
-  ansible.builtin.shell:
-    cmd: |
-      git init
-      git config --global user.email "administrator@{{ vapp['metacluster.fqdn'] }}"
-      git config --global user.name "administrator"
-      git checkout -b main
-      git add ./manifests
-      git commit -m "Upload manifests"
-      git remote add origin https://git.{{ vapp['metacluster.fqdn'] }}/mc/GitOps.ClusterAPI.git
-      git push https://administrator:{{ vapp['metacluster.password'] | urlencode }}@git.{{ vapp['metacluster.fqdn'] }}/mc/GitOps.ClusterAPI.git --all
-    chdir: "{{ capi_clustermanifest.path }}"
-
-- name: Cleanup tempfolder
   ansible.builtin.file:
-    path: "{{ capi_clustermanifest.path }}"
+    path: "{{ item }}"
     state: absent
-  when: capi_clustermanifest.path is defined
+  loop: "{{ query('ansible.builtin.fileglob', capi_clustermanifest.path ~ '/*.yaml') }}"
+  loop_control:
+    label: "{{ item | basename }}"
+
+- name: Push git repository
+  lvrfrc87.git_acp.git_acp:
+    path: "{{ capi_clustermanifest.path }}"
+    branch: main
+    comment: "Upload manifests"
+    add:
+      - ./manifests
+    url: https://administrator:{{ vapp['metacluster.password'] | urlencode }}@git.{{ vapp['metacluster.fqdn'] }}/mc/GitOps.ClusterAPI.git
+  environment:
+    GIT_AUTHOR_NAME: administrator
+    GIT_AUTHOR_NAME: administrator@{{ vapp['metacluster.fqdn'] }}
+    GIT_COMMITTER_NAME: administrator
+    GIT_COMMITTER_NAME: administrator@{{ vapp['metacluster.fqdn'] }}
+
+# - name: Initialize/Push git repository
+#   ansible.builtin.shell:
+#     cmd: |
+#       git init
+#       git config --global user.email "administrator@{{ vapp['metacluster.fqdn'] }}"
+#       git config --global user.name "administrator"
+#       git checkout -b main
+#       git add ./manifests
+#       git commit -m "Upload manifests"
+#       git remote add origin https://git.{{ vapp['metacluster.fqdn'] }}/mc/GitOps.ClusterAPI.git
+#       git push https://administrator:{{ vapp['metacluster.password'] | urlencode }}@git.{{ vapp['metacluster.fqdn'] }}/mc/GitOps.ClusterAPI.git --all
+#     chdir: "{{ capi_clustermanifest.path }}"
+
+# - name: Cleanup tempfolder
+#   ansible.builtin.file:
+#     path: "{{ capi_clustermanifest.path }}"
+#     state: absent
+#   when: capi_clustermanifest.path is defined
 
 - name: Configure Cluster API repository
   ansible.builtin.template:

ansible/vars/metacluster.yml

@@ -274,6 +274,7 @@ dependencies:
     - community.general
     - community.vmware
     - kubernetes.core
+    - lvrfrc87.git_acp
 
   container_images:
     # This should match the image tag referenced at `platform.packaged_components[.name==traefik].config`

ansible/vars/workloadcluster.yml

@@ -21,23 +21,22 @@ downstream:
           defaultDataPath: /mnt/blockstorage
 
     pinniped:
-      helm:
+      version: 1.2.11  # (= Pinniped v0.25.0)
-        version: 1.2.11  # (= Pinniped v0.25.0)
+      chart: bitnami/pinniped
-        chart: bitnami/pinniped
+      namespace: pinniped-concierge
-        namespace: pinniped-concierge
+      parse_logic: helm template . | yq --no-doc eval '.. | .image? | select(.)' | sort -u | awk '!/ /'
-        parse_logic: helm template . | yq --no-doc eval '.. | .image? | select(.)' | sort -u | awk '!/ /'
+      chart_values: !unsafe |
-        chart_values: !unsafe |
+        supervisor:
-          supervisor:
+          enabled: false
-            enabled: false
+      extra_manifests: !unsafe
-        extra_manifests: !unsafe
+        - src: jwtauthenticator.j2
-          - src: jwtauthenticator.j2
+          _template:
-            _template:
+            name: metacluster-sso
-              name: metacluster-sso
+            spec: |2
-              spec: |2
+                issuer: https://auth.{{ vapp['metacluster.fqdn'] }}/sso
-                  issuer: https://auth.{{ vapp['metacluster.fqdn'] }}/sso
+                audience: {{ vapp['workloadcluster.name'] | lower }}
-                  audience: {{ vapp['workloadcluster.name'] | lower }}
+                tls:
-                  tls:
+                  certificateAuthorityData: "{{ (stepca_cm_certs.resources[0].data['intermediate_ca.crt'] ~ '\n' ~ stepca_cm_certs.resources[0].data['root_ca.crt']) | b64encode }}"
-                    certificateAuthorityData: "{{ (stepca_cm_certs.resources[0].data['intermediate_ca.crt'] ~ '\n' ~ stepca_cm_certs.resources[0].data['root_ca.crt']) | b64encode }}"
 
     sealed-secrets:
       version: 2.8.1  # (= Sealed Secrets v0.20.2)