renamed icarus mngt to hosting mngt

2026-10-20 21:23:20 +00:00
1 parent 6e644f374e
commit 855ec39491
@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: CronWorkflow
+metadata:
+  name: crictl-prune
+spec:
+  schedules:
+    -  "0 0 * * *"
+  concurrencyPolicy: "Forbid" 
+  successfulJobsHistoryLimit: 3 
+  failedJobsHistoryLimit: 5  
+  workflowSpec:
+    imagePullSecrets:
+      - name: oci-registry-secret
+    serviceAccountName: argo-runner
+    entrypoint: exec    
+    templates:
+      - name: exec
+        steps:
+          - - name: script-exec
+              templateRef:
+                name: hosting-mngt-ansible-script
+                template: raw-source
+              arguments:
+                parameters:
+                  - name: source
+                    value: |
+                      ansible-playbook mylimbo.globals.k3s.crictl_prune
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: hosting-mngt
+resources:
+  - crictl-prune.yaml
+generatorOptions:
+  disableNameSuffixHash: true
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argo-runner
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: argo-runner-role
+rules:
+  - apiGroups: ["argoproj.io"]
+    resources: ["workflows", "workflowtasksets", "workflowtaskresults"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: argo-runner-rb
+subjects:
+  - kind: ServiceAccount
+    name: argo-runner
+roleRef:
+  kind: Role
+  name: argo-runner-role
+  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: hosting-mngt
+resources:
+  - argo-runner-sa.yaml
+  - tbot-config.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hosting-mngt-tbot-config
+data:
+  tbot.yaml: |
+    version: v2
+    auth_server: "teleport.limbosolutions.com:443"
+    on_one_shot: "exit"
+    onboarding:
+      join_method: "kubernetes"
+      token: "hosting-mngt"
+    storage:
+      type: "memory"
+    services:
+      - type: "identity"
+        ssh_config: on
+        destination:
+          type: "directory"
+          path: /opt/machine-id
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: hosting-mngt
+resources:
+  - infra
+  - cronWorkflows
+  - workflowTemplates
+  - mylimbo-ansible-collections-global
+generatorOptions:
+  disableNameSuffixHash: true
+
+
@@ -0,0 +1,14 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: mylimbo-ansible-collections-global
+  namespace: hosting-mngt
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: myinfra-kubernetes-shared
+    namespace: chimera-limbosolutions-com
+  path: mylimbo-ansible-collections-global
+  prune: true
+  targetNamespace: hosting-mngt
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: hosting-mngt
+resources:
+  - fluxcd-kustomization.yaml
+
+
+
@@ -0,0 +1,6 @@
+# teleport
+
+``` bash
+tctl create -f deploy/hosting-mngt/teleport-manifests/manifest.yaml
+tctl bots update hosting-mngt --add-roles hosting-mngt
+```
@@ -0,0 +1,37 @@
+kind: bot
+version: v1
+metadata:
+  # name is a unique identifier for the Bot in the cluster.
+  name: hosting-mngt
+spec:
+  roles: []
+
+---
+
+
+kind: role
+version: v6
+metadata:
+  name: hosting-mngt
+spec:
+  allow:
+    # Allow login to the user 'ansible'.
+    logins: ['ansible']
+    # Allow connection to any node. Adjust these labels to match only nodes
+    # that Ansible needs to access.
+    node_labels:
+      '*': '*'
+
+---
+
+kind: token
+version: v2
+metadata:
+    name: hosting-mngt
+spec:
+    roles: [Bot]
+    bot_name: hosting-mngt
+    join_method: kubernetes
+    kubernetes:
+        allow:
+          - service_account: hosting-mngt:argo-runner
@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: hosting-mngt-ansible-script
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+      hosting ansible script
+spec:
+  entrypoint: raw-source
+  templates:
+    - name: raw-source
+      inputs:
+        parameters:
+          - name: source
+      steps:
+        - - name: invoke-limbo-ansible-collections-global
+            templateRef:
+              name: mylimbo-ansible-collections-global-tbot
+              template: raw-source
+            arguments:
+              parameters:
+                - name: source
+                  value: "{{ inputs.parameters.source }}"
+                - name: tbot_configmap_name
+                  value: hosting-mngt-tbot-config
+                - name: inventory_image_reference
+                  value: oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest
+                - name: ansible_secret_name
+                  value: ansible-secret
+                - name: ssh_domain
+                  value: teleport.limbosolutions.com
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - hosting-mngt-ansible-script.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+