working icarus tbot example

deploy/flux/icarus-mngt/secrets/kustomization.yaml

@@ -9,7 +9,7 @@ secretGenerator:
       - id_rsa.pub=.env.d/icarus-ssh-ansible-id_rsa.pub
   - name: icarus-ansible
     files:
-      - vault-pass.txt=.env.d/ansible-vault-pass.txt
+      - vault_password=.env.d/ansible_vault_password
       - ansible_become_password=.env.d/ansible_become_password
   - name: oci-registry-secret
     type: kubernetes.io/dockerconfigjson

deploy/icarus-mngt/infra/kustomization.yaml

@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: icarus-nodes-mngt
 resources:
   - argo-runner-sa.yaml
   - icarus-nodes-mngt-tbot-config.yaml

icarus-mngt/workflows/tests-ansible-playbook.yaml

@@ -0,0 +1,86 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  namespace: icarus-nodes-mngt  
+  generateName: tests-ansible-playbook-
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  imagePullSecrets:
+  - name: oci-registry-secret
+  templates:
+    - name: exec
+      script:
+        image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest 
+        source: |
+         export PATH="$PATH:/opt/tbot"
+         mkdir -p /opt/machine-id
+         tbot start --config=/etc/tbot/tbot.yaml --oneshot
+         ansible-playbook mylimbo.globals.host_maintenance.os_info
+
+        env:
+            - name: ANSIBLE_VAULT_PASSWORD_FILE
+              value: /workspace/secrets/vault_password
+
+            - name: ANSIBLE_BECOME_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: "icarus-ansible"
+                  key: ansible_become_password
+
+            - name: ANSIBLE_SSH_ARGS
+              value: -F /opt/machine-id/ssh_config
+
+            - name: SSH_DOMAIN
+              value: teleport.limbosolutions.com
+         
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+
+        volumeMounts:
+
+          - name: inventory
+            mountPath: /workspace/inventory
+            subPath: inventory
+
+          - name: tbot
+            mountPath: /opt/tbot
+            subPath: usr/local/bin
+
+          - name: ansible-secrets
+            mountPath: /workspace/secrets
+
+
+          - name: identity-output
+            mountPath: /opt/machine-id  
+
+          - name: icarus-nodes-mngt-tbot-config
+            mountPath: /etc/tbot
+
+      volumes:
+        - name: inventory
+          image:
+            reference: "oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest"
+            pullPolicy: Always
+        - name: tbot
+          image:
+            reference: public.ecr.aws/gravitational/tbot-distroless:18.11.4
+            pullPolicy: Always
+        - name: ansible-secrets
+          secret:
+            secretName: "icarus-ansible"
+        - name: identity-output
+          emptyDir: {}
+        - name: icarus-nodes-mngt-tbot-config
+          configMap:
+            name: icarus-nodes-mngt-tbot-config