repo created

2026-09-26 23:31:07 +00:00
1 parent 2c6ff3ebee
commit 6758263c7f
@@ -0,0 +1,2 @@
+**
+!.gitignore
@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: nodes-mngt
+spec:
+  interval: 1m0s
+  url: ssh://git@git.limbosolutions.com:2222/myLimbo/nodes.mngt.git
+  ref:
+    branch: main
+  secretRef:
+    name: flux-repo-ssh-credentials
@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: icarus-nodes-mngt
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: myinfra-kubernetes-shared
+    namespace: chimera-limbosolutions-com
+  path: deploy/icarus-mngt
+  prune: true
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - fluxcd-kustomization.yaml
+  - secrets
+
+
@@ -0,0 +1,2 @@
+**
+!.gitignore
@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+secretGenerator:
+  - name: icarus-ssh
+    files:
+      - known_hosts=.env.d/icarus-known_hosts
+      - id_rsa=.env.d/icarus-ssh-ansible-id_rsa
+      - id_rsa.pub=.env.d/icarus-ssh-ansible-id_rsa.pub
+  - name: icarus-ansible
+    files:
+      - vault-pass.txt=.env.d/ansible-vault-pass.txt
+      - ansible_become_password=.env.d/ansible_become_password
+generatorOptions:
+  disableNameSuffixHash: true
+
+
+
@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: icarus-nodes-mngt
+resources:
+  - git-repo.yaml
+  - mylimbo-ansible-collections-global
+#  - icarus-mngt
+secretGenerator:
+  - name: flux-repo-ssh-credentials
+    files:
+      - "identity=./.env.d/flux-repo-ssh-key"
+      - "known_hosts=./.env.d/flux-repo-ssh-known_hosts"
+      - "pubkey=./.env.d/flux-repo-ssh-key.pub"
+  - name: flux-sops-age
+
+
@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: mylimbo-ansible-collections-global
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: myinfra-kubernetes-shared
+    namespace: chimera-limbosolutions-com
+  path: mylimbo-ansible-collections-global
+  prune: true
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - fluxcd-kustomization.yaml
+
+
+
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: crictl-prune
+  namespace: icarus-nodes-mngt
+spec:
+  schedules:
+    -  "0 0 * * *"
+  concurrencyPolicy: "Forbid" 
+  successfulJobsHistoryLimit: 3 
+  failedJobsHistoryLimit: 5  
+  workflowSpec:
+    entrypoint: exec
+    serviceAccountName: argo-runner
+    imagePullSecrets:
+      - name: oci-mylimbo-infra-icarus-credentials
+    
+    templates:
+      - name: exec
+        steps:
+          - - name: script-exec
+              templateRef:
+                name: icarus-ansible-script
+                template: raw-source
+              arguments:
+                parameters:
+                  - name: source
+                    value: |
+                      ansible-playbook mylimbo.globals.k3s.crictl_prune
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - crictl-prune.yaml
+generatorOptions:
+  disableNameSuffixHash: true
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argo-runner
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: argo-runner-role
+rules:
+  - apiGroups: ["argoproj.io"]
+    resources: ["workflows", "workflowtasksets", "workflowtaskresults"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: argo-runner-rb
+subjects:
+  - kind: ServiceAccount
+    name: argo-runner
+roleRef:
+  kind: Role
+  name: argo-runner-role
+  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - argo-runner-sa.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: icarus-nodes-mngt
+resources:
+  - infra
+  - cronWorkflows
+  - workflowTemplates
+generatorOptions:
+  disableNameSuffixHash: true
+
+
@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: icarus-ansible-script
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+      icarus ansible script
+spec:
+  serviceAccountName: argo-runner
+  imagePullSecrets:
+    - name: oci-mylimbo-infra-icarus-credentials
+  entrypoint: raw-source
+
+  templates:
+    - name: raw-source
+      inputs:
+        parameters:
+          - name: source
+      steps:
+        - - name: invoke-limbo-ansible-collections-global
+            templateRef:
+              name: mylimbo-ansible-collections-global
+              template: raw-source
+            arguments:
+              parameters:
+                - name: source
+                  value: "{{ inputs.parameters.source }}"
+                - name: inventory_image_reference
+                  value: "oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest"
+                - name: ansible_secret_name
+                  value: "icarus-ansible"
+                - name: ssh_secret_name
+                  value: "icarus-ssh"
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - icarus-ansible-script.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+