apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: mylimbo-ansible-collections-global-tbot
  labels:
    workflows.argoproj.io/archive-strategy: "false"
  annotations:
    workflows.argoproj.io/description: |
      mylimbo ansible collections global
spec:
  entrypoint: raw-source
  templates:
    - name: raw-source
      inputs:
        parameters:
          - name: source
          - name: inventory_image_reference
          - name: ansible_secret_name
          - name: tbot_configmap_name
          - name: ssh_domain
      script:
        image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest 
        source: |
          export PATH="$PATH:/opt/tbot"
          mkdir -p /opt/machine-id
          tbot start --config=/etc/tbot/tbot.yaml --oneshot
          {{ inputs.parameters.source }}
        env:
          - name: ANSIBLE_VAULT_PASSWORD_FILE
            value: /workspace/secrets/vault_password
        
          - name: ANSIBLE_SSH_ARGS
            value: -F /opt/machine-id/ssh_config
          
          - name: ANSIBLE_BECOME_PASS
            valueFrom:
              secretKeyRef:
                name: "{{ inputs.parameters.ansible_secret_name }}"
                key: ansible_become_password
          
          - name: SSH_DOMAIN
            value:  {{ inputs.parameters.ssh_domain }}
            
        resources:
          limits:
            memory: "512Mi"
            cpu: "500m"
          requests:
            memory: "256Mi"
            cpu: "250m"

        volumeMounts:
          - name: inventory
            mountPath: /workspace/inventory
            subPath: inventory
          - name: tbot
            mountPath: /opt/tbot
            subPath: usr/local/bin
          - name: ansible-secrets
            mountPath: /workspace/secrets
          - name: tbot-config
            mountPath: /etc/tbot
          - name: identity-output
            mountPath: /opt/machine-id              
      volumes:
        - name: tbot
          image:
            reference: public.ecr.aws/gravitational/tbot-distroless:18.11.4
            pullPolicy: Always
        - name: inventory
          image:
            reference: "{{ inputs.parameters.inventory_image_reference }}"
            pullPolicy: Always
        - name: ansible-secrets
          secret:
            secretName: "{{ inputs.parameters.ansible_secret_name }}"
        - name: tbot-config
          configMap:
            name: "{{ inputs.parameters.tbot_configmap_name }}"
        - name: identity-output
          emptyDir: {}