diff --git a/clusters/chimera/README.md b/clusters/chimera/README.md new file mode 100644 index 0000000..e5c6fc4 --- /dev/null +++ b/clusters/chimera/README.md @@ -0,0 +1,3 @@ +# Chimera - cluster + +It is not this repo/kustomization’s responsibility to deploy the alloy - Age private key — that responsibility belongs to the Chimera repository. diff --git a/clusters/chimera/kustomization.yaml b/clusters/chimera/kustomization.yaml new file mode 100644 index 0000000..01eb7cc --- /dev/null +++ b/clusters/chimera/kustomization.yaml @@ -0,0 +1,11 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - monitoring + - repos + - nodes-mngt +generatorOptions: + disableNameSuffixHash: true + + + diff --git a/clusters/chimera/monitoring/fluxcd-kustomization.yaml b/clusters/chimera/monitoring/fluxcd-kustomization.yaml new file mode 100644 index 0000000..da1e6f7 --- /dev/null +++ b/clusters/chimera/monitoring/fluxcd-kustomization.yaml @@ -0,0 +1,16 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: myinfra-kubernetes-shared-monitoring +spec: + interval: 1m + sourceRef: + kind: GitRepository + name: myinfra-kubernetes-shared + namespace: chimera-limbosolutions-com + path: monitoring/overlays/chimera + prune: true + decryption: + provider: sops + secretRef: + name: flux-sops-age \ No newline at end of file diff --git a/clusters/chimera/monitoring/kustomization.yaml b/clusters/chimera/monitoring/kustomization.yaml new file mode 100644 index 0000000..cec809d --- /dev/null +++ b/clusters/chimera/monitoring/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: monitoring +resources: + - fluxcd-kustomization.yaml +generatorOptions: + disableNameSuffixHash: true + + + diff --git a/clusters/chimera/repos/kustomization.yaml b/clusters/chimera/repos/kustomization.yaml new file mode 100644 index 0000000..d8e7e9f --- /dev/null +++ b/clusters/chimera/repos/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: chimera-limbosolutions-com +resources: + - repos.yaml +generatorOptions: + disableNameSuffixHash: true + + diff --git a/clusters/chimera/repos/repos.yaml b/clusters/chimera/repos/repos.yaml new file mode 100644 index 0000000..781bc67 --- /dev/null +++ b/clusters/chimera/repos/repos.yaml @@ -0,0 +1,9 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: myinfra-kubernetes-shared +spec: + interval: 1m0s + url: https://git.limbosolutions.com/myLimbo/myinfra.kubernetes.shared.git + ref: + branch: main diff --git a/mylimbo-ansible-collections-global/workflowTemplates/kustomization.yaml b/mylimbo-ansible-collections-global/workflowTemplates/kustomization.yaml index 9051616..d15c644 100644 --- a/mylimbo-ansible-collections-global/workflowTemplates/kustomization.yaml +++ b/mylimbo-ansible-collections-global/workflowTemplates/kustomization.yaml @@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - mylimbo-ansible-collections-global-script.yaml + - mylimbo-ansible-collections-global-tbot-script.yaml generatorOptions: disableNameSuffixHash: true diff --git a/mylimbo-ansible-collections-global/workflowTemplates/mylimbo-ansible-collections-global-tbot-script.yaml b/mylimbo-ansible-collections-global/workflowTemplates/mylimbo-ansible-collections-global-tbot-script.yaml new file mode 100644 index 0000000..ffb2022 --- /dev/null +++ b/mylimbo-ansible-collections-global/workflowTemplates/mylimbo-ansible-collections-global-tbot-script.yaml @@ -0,0 +1,79 @@ +apiVersion: argoproj.io/v1alpha1 +kind: WorkflowTemplate +metadata: + name: mylimbo-ansible-collections-global-tbot + labels: + workflows.argoproj.io/archive-strategy: "false" + annotations: + workflows.argoproj.io/description: | + mylimbo ansible collections global +spec: + entrypoint: raw-source + templates: + - name: raw-source + inputs: + parameters: + - name: source + - name: inventory_image_reference + - name: ansible_secret_name + - name: tbot_configmap_name + script: + image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest + source: | + export PATH="$PATH:/opt/tbot" + mkdir -p /opt/machine-id + tbot start --config=/etc/tbot/tbot.yaml --oneshot + {{ inputs.parameters.source }} + env: + - name: ANSIBLE_VAULT_PASSWORD_FILE + value: /workspace/secrets/vault_password + + - name: ANSIBLE_SSH_ARGS + value: -F /opt/machine-id/ssh_config + + - name: SSH_DOMAIN + value: teleport.limbosolutions.com + + - name: ANSIBLE_BECOME_PASS + valueFrom: + secretKeyRef: + name: "{{ inputs.parameters.ansible_secret_name }}" + key: ansible_become_password + resources: + limits: + memory: "512Mi" + cpu: "500m" + requests: + memory: "256Mi" + cpu: "250m" + + volumeMounts: + - name: inventory + mountPath: /workspace/inventory + subPath: inventory + - name: tbot + mountPath: /opt/tbot + subPath: usr/local/bin + - name: ansible-secrets + mountPath: /workspace/secrets + - name: tbot-config + mountPath: /etc/tbot + - name: identity-output + mountPath: /opt/machine-id + volumes: + - name: tbot + image: + reference: public.ecr.aws/gravitational/tbot-distroless:18.11.4 + pullPolicy: Always + - name: inventory + image: + reference: "{{ inputs.parameters.inventory_image_reference }}" + pullPolicy: Always + - name: ansible-secrets + secret: + secretName: "{{ inputs.parameters.ansible_secret_name }}" + - name: tbot-config + configMap: + name: "{{ inputs.parameters.tbot_configmap_name }}" + - name: identity-output + emptyDir: {} \ No newline at end of file