From 8d517c62cd83900f6e36c28cee0d411b3f4d502c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rcio=20Fernandes?= Date: Sat, 26 Sep 2026 08:52:07 +0000 Subject: [PATCH] node-mngt: icarus, CronWorkflow crictl-prune, WorkflowTemplate icarus-ansible-script --- .../secrets/kustomization.yaml | 14 +-- nodes-mngt/README.md | 0 .../icarus-ansible-script.yaml | 67 ++++++++++++++ .../WorkflowTemplates/kustomization.yaml | 7 ++ .../cronWorkflows/crictl-prune.yaml | 29 +++++++ .../kustomization.yaml | 3 +- .../icarus-nodes-mngt/cronjobs/cri-prune.yaml | 87 ------------------- .../infra/argo-runner-sa.yaml | 31 +++++++ .../infra/kustomization.yaml | 7 ++ .../icarus-nodes-mngt/kustomization.yaml | 6 +- .../workflows/get-nodes-info.yml | 20 +++++ 11 files changed, 169 insertions(+), 102 deletions(-) create mode 100644 nodes-mngt/README.md create mode 100644 nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/icarus-ansible-script.yaml create mode 100644 nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/kustomization.yaml create mode 100644 nodes-mngt/icarus-nodes-mngt/cronWorkflows/crictl-prune.yaml rename nodes-mngt/icarus-nodes-mngt/{cronjobs => cronWorkflows}/kustomization.yaml (74%) delete mode 100644 nodes-mngt/icarus-nodes-mngt/cronjobs/cri-prune.yaml create mode 100644 nodes-mngt/icarus-nodes-mngt/infra/argo-runner-sa.yaml create mode 100644 nodes-mngt/icarus-nodes-mngt/infra/kustomization.yaml create mode 100644 nodes-mngt/icarus-nodes-mngt/workflows/get-nodes-info.yml diff --git a/cluster/chimera/nodes-mngt/icarus-nodes-mngt/secrets/kustomization.yaml b/cluster/chimera/nodes-mngt/icarus-nodes-mngt/secrets/kustomization.yaml index 153726c..201f480 100644 --- a/cluster/chimera/nodes-mngt/icarus-nodes-mngt/secrets/kustomization.yaml +++ b/cluster/chimera/nodes-mngt/icarus-nodes-mngt/secrets/kustomization.yaml @@ -2,23 +2,15 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization secretGenerator: - - name: icarus-ssh files: - known_hosts=.env.d/icarus-known_hosts - id_rsa=.env.d/icarus-ssh-ansible-id_rsa - id_rsa.pub=.env.d/icarus-ssh-ansible-id_rsa.pub - - name: ansible-icarus-host-vars + - name: icarus-ansible files: - - main.yaml=.env.d/ansible-icarus-host-vars.yaml - - name: ansible-all-group-vars - files: - - main.yaml=.env.d/ansible-all-group-vars.yaml - - - name: ansible-inventory - files: - - inventory=.env.d/ansible-inventory - + - vault-pass.txt=.env.d/ansible-vault-pass.txt + - ansible_become_password=.env.d/ansible_become_password generatorOptions: disableNameSuffixHash: true diff --git a/nodes-mngt/README.md b/nodes-mngt/README.md new file mode 100644 index 0000000..e69de29 diff --git a/nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/icarus-ansible-script.yaml b/nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/icarus-ansible-script.yaml new file mode 100644 index 0000000..962ba35 --- /dev/null +++ b/nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/icarus-ansible-script.yaml @@ -0,0 +1,67 @@ +apiVersion: argoproj.io/v1alpha1 +kind: WorkflowTemplate +metadata: + name: icarus-ansible-script + labels: + workflows.argoproj.io/archive-strategy: "false" + annotations: + workflows.argoproj.io/description: | + icarus ansible script +spec: + serviceAccountName: argo-runner + imagePullSecrets: + - name: oci-mylimbo-infra-icarus-credentials + entrypoint: raw-source + templates: + - name: raw-source + inputs: + parameters: + - name: source + script: + image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest + source: "{{ inputs.parameters.source }}" + + imagePullPolicy: Always + + env: + - name: ANSIBLE_VAULT_PASSWORD_FILE + value: /workspace/secrets/vault-pass.txt + + - name: ANSIBLE_BECOME_PASS + valueFrom: + secretKeyRef: + name: icarus-ansible + key: ansible_become_password + + resources: + limits: + memory: "512Mi" + cpu: "500m" + requests: + memory: "256Mi" + cpu: "250m" + + volumeMounts: + + - name: inventory + mountPath: /workspace/inventory + subPath: inventory + - name: icarus-ansible-secrets + mountPath: /workspace/secrets/vault-pass.txt + subPath: vault-pass.txt + - name: icarus-ssh-secrets + mountPath: /home/ansible/.ssh + + volumes: + - name: inventory + image: + reference: oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest + pullPolicy: Always + + - name: icarus-ansible-secrets + secret: + secretName: icarus-ansible + + - name: icarus-ssh-secrets + secret: + secretName: icarus-ssh diff --git a/nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/kustomization.yaml b/nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/kustomization.yaml new file mode 100644 index 0000000..15f02fc --- /dev/null +++ b/nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - icarus-ansible-script.yaml +generatorOptions: + disableNameSuffixHash: true + diff --git a/nodes-mngt/icarus-nodes-mngt/cronWorkflows/crictl-prune.yaml b/nodes-mngt/icarus-nodes-mngt/cronWorkflows/crictl-prune.yaml new file mode 100644 index 0000000..7aac02e --- /dev/null +++ b/nodes-mngt/icarus-nodes-mngt/cronWorkflows/crictl-prune.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: CronWorkflow +metadata: + name: crictl-prune + namespace: icarus-nodes-mngt +spec: + schedules: + - "0 0 * * *" + concurrencyPolicy: "Forbid" + successfulJobsHistoryLimit: 3 + failedJobsHistoryLimit: 5 + workflowSpec: + entrypoint: exec + serviceAccountName: argo-runner + imagePullSecrets: + - name: oci-mylimbo-infra-icarus-credentials + + templates: + - name: exec + steps: + - - name: script-exec + templateRef: + name: icarus-ansible-script + template: raw-source + arguments: + parameters: + - name: source + value: | + ansible-playbook mylimbo.globals.k3s.crictl_prune diff --git a/nodes-mngt/icarus-nodes-mngt/cronjobs/kustomization.yaml b/nodes-mngt/icarus-nodes-mngt/cronWorkflows/kustomization.yaml similarity index 74% rename from nodes-mngt/icarus-nodes-mngt/cronjobs/kustomization.yaml rename to nodes-mngt/icarus-nodes-mngt/cronWorkflows/kustomization.yaml index ec65773..8c66997 100644 --- a/nodes-mngt/icarus-nodes-mngt/cronjobs/kustomization.yaml +++ b/nodes-mngt/icarus-nodes-mngt/cronWorkflows/kustomization.yaml @@ -1,7 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: monitoring resources: - - cri-prune.yaml + - crictl-prune.yaml generatorOptions: disableNameSuffixHash: true \ No newline at end of file diff --git a/nodes-mngt/icarus-nodes-mngt/cronjobs/cri-prune.yaml b/nodes-mngt/icarus-nodes-mngt/cronjobs/cri-prune.yaml deleted file mode 100644 index 3418e29..0000000 --- a/nodes-mngt/icarus-nodes-mngt/cronjobs/cri-prune.yaml +++ /dev/null @@ -1,87 +0,0 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: cri-prune -spec: - schedule: "0 16 * * 0" #every sunday at 4pm - jobTemplate: - spec: - backoffLimit: 1 - template: - spec: - restartPolicy: Never - - initContainers: - - name: fix-ssh - image: alpine - command: - - sh - - -c - - | - mkdir -p /home/ansible/.ssh - cp /tmp/ssh/* /home/ansible/.ssh/ - chown 1000:1000 /home/ansible/.ssh/* - chmod 600 /home/ansible/.ssh/id_rsa - chmod 644 /home/ansible/.ssh/id_rsa.pub - chmod 644 /home/ansible/.ssh/known_hosts - - volumeMounts: - - name: icarus-ssh - mountPath: /tmp/ssh - - name: home - mountPath: /home/ansible - - containers: - - name: cri-prune - image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest - imagePullPolicy: IfNotPresent - resources: - limits: - memory: "512Mi" - cpu: "500m" - requests: - memory: "256Mi" - cpu: "250m" - - - # command: ["tail", "-f", "/dev/null"] - - args: - - - ansible-playbook mylimbo.globals.k3s.crictl_prune - - volumeMounts: - - - name: home - mountPath: /home/ansible - - - name: ansible-inventory - mountPath: /workspace/inventory - subPath: inventory - - - name: ansible-all-group-vars - mountPath: /workspace/group_vars/all - - - name: ansible-icarus-host-vars - mountPath: /workspace/host_vars/icarus - - volumes: - - name: home - emptyDir: {} - - - name: icarus-ssh - secret: - secretName: icarus-ssh - defaultMode: 0400 - - - name: ansible-inventory - secret: - secretName: ansible-inventory - - - name: ansible-all-group-vars - secret: - secretName: ansible-group-vars - - - name: ansible-icarus-host-vars - secret: - secretName: ansible-icarus-host-vars \ No newline at end of file diff --git a/nodes-mngt/icarus-nodes-mngt/infra/argo-runner-sa.yaml b/nodes-mngt/icarus-nodes-mngt/infra/argo-runner-sa.yaml new file mode 100644 index 0000000..5436fca --- /dev/null +++ b/nodes-mngt/icarus-nodes-mngt/infra/argo-runner-sa.yaml @@ -0,0 +1,31 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argo-runner +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: argo-runner-role +rules: + - apiGroups: ["argoproj.io"] + resources: ["workflows", "workflowtasksets", "workflowtaskresults"] + verbs: ["*"] + - apiGroups: [""] + resources: ["pods", "pods/log"] + verbs: ["get", "list", "watch", "create", "update", "patch"] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: argo-runner-rb +subjects: + - kind: ServiceAccount + name: argo-runner +roleRef: + kind: Role + name: argo-runner-role + apiGroup: rbac.authorization.k8s.io \ No newline at end of file diff --git a/nodes-mngt/icarus-nodes-mngt/infra/kustomization.yaml b/nodes-mngt/icarus-nodes-mngt/infra/kustomization.yaml new file mode 100644 index 0000000..66d6028 --- /dev/null +++ b/nodes-mngt/icarus-nodes-mngt/infra/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - argo-runner-sa.yaml +generatorOptions: + disableNameSuffixHash: true + diff --git a/nodes-mngt/icarus-nodes-mngt/kustomization.yaml b/nodes-mngt/icarus-nodes-mngt/kustomization.yaml index 67e5977..35dcdff 100644 --- a/nodes-mngt/icarus-nodes-mngt/kustomization.yaml +++ b/nodes-mngt/icarus-nodes-mngt/kustomization.yaml @@ -1,13 +1,15 @@ ### # Hosted on chimera # check directory /cluster/chimera/nodes-mngt/icarus-nodes-mngt -# for requirements and deploy +# for flux requirements and deploy ## apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: icarus-nodes-mngt resources: - - cronjobs + - infra + - cronWorkflows + - WorkflowTemplates generatorOptions: disableNameSuffixHash: true diff --git a/nodes-mngt/icarus-nodes-mngt/workflows/get-nodes-info.yml b/nodes-mngt/icarus-nodes-mngt/workflows/get-nodes-info.yml new file mode 100644 index 0000000..30b0698 --- /dev/null +++ b/nodes-mngt/icarus-nodes-mngt/workflows/get-nodes-info.yml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Workflow +metadata: + generateName: get-node-info- + namespace: icarus-nodes-mngt +spec: + entrypoint: exec + serviceAccountName: argo-runner + templates: + - name: exec + steps: + - - name: script-exec + templateRef: + name: icarus-ansible-script + template: raw-source + arguments: + parameters: + - name: source + value: | + ansible-playbook mylimbo.globals.host_maintenance.os_info