repo created

.devcontainer/nodes-mngt/devcontainer.json

@@ -0,0 +1,36 @@
+{
+	"name": "nodes-mngt",
+	"image": "oci.limbosolutions.com/public/devcontainers/argo-workflows:latest",
+	"runArgs": [
+		"--hostname=nodes-mngt"
+	],
+	"mounts": [
+		"source=${localEnv:HOME}/.gitconfig,target=/home/code/.gitconfig,type=bind,consistency=cached",
+		"source=${localEnv:HOME}/.ssh,target=/home/code/.ssh,type=bind,consistency=cached",
+		"source=${localWorkspaceFolder}/../kb,target=/workspaces/kb,type=bind",
+	    "source=${localWorkspaceFolder}/../myinfra.kubernetes.shared,target=/workspaces/myinfra.kubernetes.shared,type=bind"
+	],
+	"containerEnv": {
+		"KUBECONFIG":"/workspaces/myLimbo.nodes.mngt/.env.d/kube.config"
+	},
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"ms-kubernetes-tools.vscode-kubernetes-tools",
+				"yzhang.markdown-all-in-one",
+				"davidanson.vscode-markdownlint",
+				"eamodio.gitlens",
+				"m4ns0ur.base64",
+				"rogalmic.bash-debug",
+				"streetsidesoftware.code-spell-checker",
+				"eamodio.gitlens",
+				"shd101wyy.markdown-preview-enhanced",
+				"bierner.markdown-mermaid",
+				"bierner.markdown-preview-github-styles",
+				"sycl.markdown-command-runner",
+				"jeepshen.vscode-markdown-code-runner",
+				"batyan-soft.fast-tasks"
+			]
+		}
+	}
+}

.env.d/.gitignore

@@ -0,0 +1,2 @@
+**
+!.gitignore

.vscode/tasks.json

@@ -0,0 +1,53 @@
+{
+    "version": "2.0.0",
+    "inputs": [
+    {
+      "id": "host",
+      "type": "pickString",
+      "description": "select host",
+      "options": [
+        "chimera",
+        "chimera-deepstate",
+        "chimera-gluten",
+        "chimera-minion-01"
+      ]
+    }
+  ],
+    "tasks": [
+    {
+      "label": "Run current file with Bash",
+      "type": "shell",
+      "command": "bash",
+      "args": [
+        "${file}"
+      ],
+      "group": {
+        "kind": "build",
+        "isDefault": true
+      },
+      "presentation": {
+        "echo": true,
+        "reveal": "always",
+        "focus": false,
+        "panel": "shared",
+        "showReuseMessage": true,
+        "clear": false
+      },
+      "problemMatcher": []
+    },
+    {
+      "label": "Kustomize - Apply Selected",
+      "type": "shell",
+      "command": "kubectl apply -k ${fileDirname}",
+      "problemMatcher": [],
+      "group": "build"
+    },
+    {
+      "label": "ssh: Connect to Node",
+      "type": "shell",
+      "command": "ssh mf@${input:host}",
+      "problemMatcher": [],
+      "group": "build"
+    }
+  ]
+}

README.md

@@ -1,2 +1,20 @@
 # nodes.mngt
 
+## icarus - cluster nodes - mngt
+
+Requirements:
+
+- <https://git.limbosolutions.com/myLimbo/myinfra.kubernetes.shared>
+
+### nodes - get info
+
+``` bash
+argo submit ./icarus-mngt/workflows/nodes-get-info.yml -n icarus-nodes-mngt --log
+```
+
+### nodes - update os
+
+``` bash
+argo submit ./icarus-mngt/workflows/nodes-update-os.yml -n icarus-nodes-mngt --log
+```
+

deploy/flux/.env.d/.gitignore

@@ -0,0 +1,2 @@
+**
+!.gitignore

deploy/flux/git-repo.yaml

@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: nodes-mngt
+spec:
+  interval: 1m0s
+  url: ssh://git@git.limbosolutions.com:2222/myLimbo/nodes.mngt.git
+  ref:
+    branch: main
+  secretRef:
+    name: flux-repo-ssh-credentials

deploy/flux/icarus-mngt/fluxcd-kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: icarus-nodes-mngt
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: myinfra-kubernetes-shared
+    namespace: chimera-limbosolutions-com
+  path: deploy/icarus-mngt
+  prune: true

deploy/flux/icarus-mngt/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - fluxcd-kustomization.yaml
+  - secrets
+
+

deploy/flux/icarus-mngt/secrets/.env.d/.gitignore

@@ -0,0 +1,2 @@
+**
+!.gitignore

deploy/flux/icarus-mngt/secrets/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+secretGenerator:
+  - name: icarus-ssh
+    files:
+      - known_hosts=.env.d/icarus-known_hosts
+      - id_rsa=.env.d/icarus-ssh-ansible-id_rsa
+      - id_rsa.pub=.env.d/icarus-ssh-ansible-id_rsa.pub
+  - name: icarus-ansible
+    files:
+      - vault-pass.txt=.env.d/ansible-vault-pass.txt
+      - ansible_become_password=.env.d/ansible_become_password
+generatorOptions:
+  disableNameSuffixHash: true
+
+
+

deploy/flux/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: icarus-nodes-mngt
+resources:
+  - git-repo.yaml
+  - mylimbo-ansible-collections-global
+#  - icarus-mngt
+secretGenerator:
+  - name: flux-repo-ssh-credentials
+    files:
+      - "identity=./.env.d/flux-repo-ssh-key"
+      - "known_hosts=./.env.d/flux-repo-ssh-known_hosts"
+      - "pubkey=./.env.d/flux-repo-ssh-key.pub"
+  - name: flux-sops-age
+
+

deploy/flux/mylimbo-ansible-collections-global/fluxcd-kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: mylimbo-ansible-collections-global
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: myinfra-kubernetes-shared
+    namespace: chimera-limbosolutions-com
+  path: mylimbo-ansible-collections-global
+  prune: true

deploy/flux/mylimbo-ansible-collections-global/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - fluxcd-kustomization.yaml
+
+
+

deploy/icarus-mngt/cronWorkflows/crictl-prune.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: crictl-prune
+  namespace: icarus-nodes-mngt
+spec:
+  schedules:
+    -  "0 0 * * *"
+  concurrencyPolicy: "Forbid" 
+  successfulJobsHistoryLimit: 3 
+  failedJobsHistoryLimit: 5  
+  workflowSpec:
+    entrypoint: exec
+    serviceAccountName: argo-runner
+    imagePullSecrets:
+      - name: oci-mylimbo-infra-icarus-credentials
+    
+    templates:
+      - name: exec
+        steps:
+          - - name: script-exec
+              templateRef:
+                name: icarus-ansible-script
+                template: raw-source
+              arguments:
+                parameters:
+                  - name: source
+                    value: |
+                      ansible-playbook mylimbo.globals.k3s.crictl_prune

deploy/icarus-mngt/cronWorkflows/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - crictl-prune.yaml
+generatorOptions:
+  disableNameSuffixHash: true

deploy/icarus-mngt/infra/argo-runner-sa.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argo-runner
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: argo-runner-role
+rules:
+  - apiGroups: ["argoproj.io"]
+    resources: ["workflows", "workflowtasksets", "workflowtaskresults"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: argo-runner-rb
+subjects:
+  - kind: ServiceAccount
+    name: argo-runner
+roleRef:
+  kind: Role
+  name: argo-runner-role
+  apiGroup: rbac.authorization.k8s.io

deploy/icarus-mngt/infra/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - argo-runner-sa.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+

deploy/icarus-mngt/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: icarus-nodes-mngt
+resources:
+  - infra
+  - cronWorkflows
+  - workflowTemplates
+generatorOptions:
+  disableNameSuffixHash: true
+
+

deploy/icarus-mngt/workflowTemplates/icarus-ansible-script.yaml

@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: icarus-ansible-script
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+      icarus ansible script
+spec:
+  serviceAccountName: argo-runner
+  imagePullSecrets:
+    - name: oci-mylimbo-infra-icarus-credentials
+  entrypoint: raw-source
+
+  templates:
+    - name: raw-source
+      inputs:
+        parameters:
+          - name: source
+      steps:
+        - - name: invoke-limbo-ansible-collections-global
+            templateRef:
+              name: mylimbo-ansible-collections-global
+              template: raw-source
+            arguments:
+              parameters:
+                - name: source
+                  value: "{{ inputs.parameters.source }}"
+                - name: inventory_image_reference
+                  value: "oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest"
+                - name: ansible_secret_name
+                  value: "icarus-ansible"
+                - name: ssh_secret_name
+                  value: "icarus-ssh"

deploy/icarus-mngt/workflowTemplates/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - icarus-ansible-script.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+

icarus-mngt/workflows/nodes-get-info.yml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: node-get-info-
+  namespace: icarus-nodes-mngt
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  templates:
+    - name: exec
+      steps:
+        - - name: script-exec
+            templateRef:
+              # https://git.limbosolutions.com/myLimbo/myinfra.kubernetes.shared
+              name: icarus-ansible-script
+              template: raw-source
+            arguments:
+              parameters:
+                - name: source
+                  value: |
+                    ansible-playbook mylimbo.globals.host_maintenance.os_info

icarus-mngt/workflows/nodes-update-os.yml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: nodes-update-os-
+  namespace: icarus-nodes-mngt
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  templates:
+    - name: exec
+      steps:
+        - - name: script-exec
+            templateRef:
+              # https://git.limbosolutions.com/myLimbo/myinfra.kubernetes.shared
+              name: icarus-ansible-script
+              template: raw-source
+            arguments:
+              parameters:
+                - name: source
+                  value: |
+                    ansible-playbook mylimbo.globals.host_maintenance.os_update

nodes-mngt.code-workspace

@@ -0,0 +1,24 @@
+{
+	"folders": [
+	    {
+			"name": "nodes-mngt",
+			"path": "."
+		},	
+		{
+			"name": "myinfra.kubernetes.shared",
+			"path": "../myinfra.kubernetes.shared"
+		},	
+		{
+			"name": "kb",
+			"path": "/workspaces/kb"
+		},
+	
+	],
+	"settings": {
+		"cSpell.words": [
+			"jobservice",
+			"seaweedfs"
+		]
+	}
+
+}