node-mngt: icarus, CronWorkflow crictl-prune, WorkflowTemplate icarus-ansible-script

cluster/chimera/nodes-mngt/icarus-nodes-mngt/secrets/kustomization.yaml

@@ -2,23 +2,15 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 secretGenerator:
-
   - name: icarus-ssh
     files:
       - known_hosts=.env.d/icarus-known_hosts
       - id_rsa=.env.d/icarus-ssh-ansible-id_rsa
       - id_rsa.pub=.env.d/icarus-ssh-ansible-id_rsa.pub
-  - name: ansible-icarus-host-vars
+  - name: icarus-ansible
     files:
-      - main.yaml=.env.d/ansible-icarus-host-vars.yaml
-  - name: ansible-all-group-vars
-    files:
-      - main.yaml=.env.d/ansible-all-group-vars.yaml
-
-  - name: ansible-inventory
-    files:
-      - inventory=.env.d/ansible-inventory
-
+      - vault-pass.txt=.env.d/ansible-vault-pass.txt
+      - ansible_become_password=.env.d/ansible_become_password
 generatorOptions:
   disableNameSuffixHash: true
 

nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/icarus-ansible-script.yaml

@@ -0,0 +1,67 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: icarus-ansible-script
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+      icarus ansible script
+spec:
+  serviceAccountName: argo-runner
+  imagePullSecrets:
+    - name: oci-mylimbo-infra-icarus-credentials
+  entrypoint: raw-source
+  templates:
+    - name: raw-source
+      inputs:
+        parameters:
+          - name: source
+      script:
+        image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest 
+        source: "{{ inputs.parameters.source }}"
+  
+        imagePullPolicy: Always
+        
+        env:
+          - name: ANSIBLE_VAULT_PASSWORD_FILE
+            value: /workspace/secrets/vault-pass.txt
+
+          - name: ANSIBLE_BECOME_PASS
+            valueFrom:
+              secretKeyRef:
+                name: icarus-ansible
+                key: ansible_become_password
+
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+
+        volumeMounts:
+
+          - name: inventory
+            mountPath: /workspace/inventory
+            subPath: inventory
+          - name: icarus-ansible-secrets
+            mountPath: /workspace/secrets/vault-pass.txt
+            subPath: vault-pass.txt
+          - name: icarus-ssh-secrets
+            mountPath: /home/ansible/.ssh
+
+      volumes:
+        - name: inventory
+          image:
+            reference: oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest
+            pullPolicy: Always
+
+        - name: icarus-ansible-secrets
+          secret:
+            secretName: icarus-ansible
+
+        - name: icarus-ssh-secrets
+          secret:
+            secretName: icarus-ssh

nodes-mngt/icarus-nodes-mngt/WorkflowTemplates/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - icarus-ansible-script.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+

nodes-mngt/icarus-nodes-mngt/cronWorkflows/crictl-prune.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: crictl-prune
+  namespace: icarus-nodes-mngt
+spec:
+  schedules:
+    -  "0 0 * * *"
+  concurrencyPolicy: "Forbid" 
+  successfulJobsHistoryLimit: 3 
+  failedJobsHistoryLimit: 5  
+  workflowSpec:
+    entrypoint: exec
+    serviceAccountName: argo-runner
+    imagePullSecrets:
+      - name: oci-mylimbo-infra-icarus-credentials
+    
+    templates:
+      - name: exec
+        steps:
+          - - name: script-exec
+              templateRef:
+                name: icarus-ansible-script
+                template: raw-source
+              arguments:
+                parameters:
+                  - name: source
+                    value: |
+                      ansible-playbook mylimbo.globals.k3s.crictl_prune

nodes-mngt/icarus-nodes-mngt/cronWorkflows/kustomization.yaml

@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: monitoring
 resources:
-  - cri-prune.yaml
+  - crictl-prune.yaml
 generatorOptions:
   disableNameSuffixHash: true

nodes-mngt/icarus-nodes-mngt/cronjobs/cri-prune.yaml

@@ -1,87 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: cri-prune
-spec:
-  schedule: "0 16 * * 0" #every sunday at 4pm
-  jobTemplate:
-    spec:
-      backoffLimit: 1
-      template:
-        spec:
-          restartPolicy: Never
-
-          initContainers:
-            - name: fix-ssh
-              image: alpine
-              command:
-                - sh
-                - -c
-                - |
-                  mkdir -p /home/ansible/.ssh
-                  cp /tmp/ssh/* /home/ansible/.ssh/
-                  chown 1000:1000 /home/ansible/.ssh/*
-                  chmod 600 /home/ansible/.ssh/id_rsa
-                  chmod 644 /home/ansible/.ssh/id_rsa.pub
-                  chmod 644 /home/ansible/.ssh/known_hosts
-                  
-              volumeMounts:
-                - name: icarus-ssh
-                  mountPath: /tmp/ssh
-                - name: home
-                  mountPath: /home/ansible
-
-          containers:
-            - name: cri-prune
-              image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest
-              imagePullPolicy: IfNotPresent
-              resources:
-                limits:
-                  memory: "512Mi"
-                  cpu: "500m"
-                requests:
-                  memory: "256Mi"
-                  cpu: "250m"
-               
-               
-                # command: ["tail", "-f", "/dev/null"]
-              
-              args: 
-                
-                - ansible-playbook mylimbo.globals.k3s.crictl_prune
-              
-              volumeMounts:
-
-                - name: home
-                  mountPath: /home/ansible
-      
-                - name: ansible-inventory
-                  mountPath: /workspace/inventory
-                  subPath: inventory
-                
-                - name: ansible-all-group-vars
-                  mountPath: /workspace/group_vars/all
-
-                - name: ansible-icarus-host-vars
-                  mountPath: /workspace/host_vars/icarus
-
-          volumes:
-            - name: home
-              emptyDir: {}
-
-            - name: icarus-ssh
-              secret:
-                secretName: icarus-ssh
-                defaultMode: 0400
-
-            - name: ansible-inventory
-              secret:
-                secretName: ansible-inventory
-                
-            - name: ansible-all-group-vars
-              secret:
-                secretName: ansible-group-vars
-
-            - name: ansible-icarus-host-vars
-              secret:
-                secretName: ansible-icarus-host-vars

nodes-mngt/icarus-nodes-mngt/infra/argo-runner-sa.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argo-runner
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: argo-runner-role
+rules:
+  - apiGroups: ["argoproj.io"]
+    resources: ["workflows", "workflowtasksets", "workflowtaskresults"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: argo-runner-rb
+subjects:
+  - kind: ServiceAccount
+    name: argo-runner
+roleRef:
+  kind: Role
+  name: argo-runner-role
+  apiGroup: rbac.authorization.k8s.io

nodes-mngt/icarus-nodes-mngt/infra/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - argo-runner-sa.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+

nodes-mngt/icarus-nodes-mngt/kustomization.yaml

@@ -1,13 +1,15 @@
 ###
 # Hosted on chimera
 # check directory /cluster/chimera/nodes-mngt/icarus-nodes-mngt
-# for requirements and deploy
+# for flux requirements and deploy
 ##
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: icarus-nodes-mngt
 resources:
-  - cronjobs
+  - infra
+  - cronWorkflows
+  - WorkflowTemplates
 generatorOptions:
   disableNameSuffixHash: true
 

nodes-mngt/icarus-nodes-mngt/workflows/get-nodes-info.yml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: get-node-info-
+  namespace: icarus-nodes-mngt
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  templates:
+    - name: exec
+      steps:
+        - - name: script-exec
+            templateRef:
+              name: icarus-ansible-script
+              template: raw-source
+            arguments:
+              parameters:
+                - name: source
+                  value: |
+                    ansible-playbook mylimbo.globals.host_maintenance.os_info