modified: mylimbo-ansible-collections-global/workflowTemplates/mylimbo-ansible-collections-global-tbot-script.yaml

new file:   clusters/chimera/kustomization.yaml
new file:   clusters/chimera/monitoring/fluxcd-kustomization.yaml
new file:   clusters/chimera/monitoring/kustomization.yaml
new file:   clusters/chimera/repos/kustomization.yaml
new file:   clusters/chimera/repos/repos.yaml
modified:   mylimbo-ansible-collections-global/workflowTemplates/kustomization.yaml
new file:   mylimbo-ansible-collections-global/workflowTemplates/mylimbo-ansible-collections-global-tbot-script.yaml

clusters/chimera/README.md

@@ -0,0 +1,3 @@
+# Chimera - cluster
+
+It is not this repo/kustomization’s responsibility to deploy the alloy - Age private key — that responsibility belongs to the Chimera repository.

clusters/chimera/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - monitoring
+  - repos
+  - nodes-mngt
+generatorOptions:
+  disableNameSuffixHash: true
+
+
+

clusters/chimera/monitoring/fluxcd-kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: myinfra-kubernetes-shared-monitoring
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: myinfra-kubernetes-shared
+    namespace: chimera-limbosolutions-com
+  path: monitoring/overlays/chimera
+  prune: true
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops-age

clusters/chimera/monitoring/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+  - fluxcd-kustomization.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+
+
+

clusters/chimera/repos/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: chimera-limbosolutions-com
+resources:
+  - repos.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+
+

clusters/chimera/repos/repos.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: myinfra-kubernetes-shared
+spec:
+  interval: 1m0s
+  url: https://git.limbosolutions.com/myLimbo/myinfra.kubernetes.shared.git
+  ref:
+    branch: main

mylimbo-ansible-collections-global/workflowTemplates/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - mylimbo-ansible-collections-global-script.yaml
+  - mylimbo-ansible-collections-global-tbot-script.yaml
 generatorOptions:
   disableNameSuffixHash: true
 

mylimbo-ansible-collections-global/workflowTemplates/mylimbo-ansible-collections-global-tbot-script.yaml

@@ -0,0 +1,81 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: mylimbo-ansible-collections-global-tbot
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+      mylimbo ansible collections global
+spec:
+  entrypoint: raw-source
+  templates:
+    - name: raw-source
+      inputs:
+        parameters:
+          - name: source
+          - name: inventory_image_reference
+          - name: ansible_secret_name
+          - name: tbot_configmap_name
+          - name: ssh_domain
+      script:
+        image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest 
+        source: |
+          export PATH="$PATH:/opt/tbot"
+          mkdir -p /opt/machine-id
+          tbot start --config=/etc/tbot/tbot.yaml --oneshot
+          {{ inputs.parameters.source }}
+        env:
+          - name: ANSIBLE_VAULT_PASSWORD_FILE
+            value: /workspace/secrets/vault_password
+        
+          - name: ANSIBLE_SSH_ARGS
+            value: -F /opt/machine-id/ssh_config
+          
+          - name: ANSIBLE_BECOME_PASS
+            valueFrom:
+              secretKeyRef:
+                name: "{{ inputs.parameters.ansible_secret_name }}"
+                key: ansible_become_password
+          
+          - name: SSH_DOMAIN
+            value:  {{ inputs.parameters.ssh_domain }}
+            
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+
+        volumeMounts:
+          - name: inventory
+            mountPath: /workspace/inventory
+            subPath: inventory
+          - name: tbot
+            mountPath: /opt/tbot
+            subPath: usr/local/bin
+          - name: ansible-secrets
+            mountPath: /workspace/secrets
+          - name: tbot-config
+            mountPath: /etc/tbot
+          - name: identity-output
+            mountPath: /opt/machine-id              
+      volumes:
+        - name: tbot
+          image:
+            reference: public.ecr.aws/gravitational/tbot-distroless:18.11.4
+            pullPolicy: Always
+        - name: inventory
+          image:
+            reference: "{{ inputs.parameters.inventory_image_reference }}"
+            pullPolicy: Always
+        - name: ansible-secrets
+          secret:
+            secretName: "{{ inputs.parameters.ansible_secret_name }}"
+        - name: tbot-config
+          configMap:
+            name: "{{ inputs.parameters.tbot_configmap_name }}"
+        - name: identity-output
+          emptyDir: {}