From e655f7b7feb49247f704bf7919239ae0c717b335 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rcio=20Fernandes?= <marcio.fernandes@outlook.pt>
Date: Sun, 18 Oct 2026 21:57:48 +0000
Subject: [PATCH] icarus mngt - tbot

---
 .../infra/icarus-nodes-mngt-tbot-config.yaml  | 21 ++++++++++
 deploy/icarus-mngt/infra/kustomization.yaml   |  1 +
 .../icarus-mngt/teleport-manifests/README.md  |  6 +++
 .../teleport-manifests/manifest.yaml          | 37 +++++++++++++++++
 .../workflows/tests-teleport-tbot.yaml        | 40 +++++++++++++++++++
 5 files changed, 105 insertions(+)
 create mode 100644 deploy/icarus-mngt/infra/icarus-nodes-mngt-tbot-config.yaml
 create mode 100644 deploy/icarus-mngt/teleport-manifests/README.md
 create mode 100644 deploy/icarus-mngt/teleport-manifests/manifest.yaml
 create mode 100644 icarus-mngt/workflows/tests-teleport-tbot.yaml

diff --git a/deploy/icarus-mngt/infra/icarus-nodes-mngt-tbot-config.yaml b/deploy/icarus-mngt/infra/icarus-nodes-mngt-tbot-config.yaml
new file mode 100644
index 0000000..aee8e37
--- /dev/null
+++ b/deploy/icarus-mngt/infra/icarus-nodes-mngt-tbot-config.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: icarus-nodes-mngt-tbot-config
+  namespace: icarus-nodes-mngt
+data:
+  tbot.yaml: |
+    version: v2
+    auth_server: "teleport.limbosolutions.com:443"
+    on_one_shot: "exit"
+    onboarding:
+      join_method: "kubernetes"
+      token: "icarus-nodes-mngt"
+    storage:
+      type: "memory"
+    services:
+      - type: "identity"
+        ssh_config: on
+        destination:
+          type: "directory"
+          path: /opt/machine-id
diff --git a/deploy/icarus-mngt/infra/kustomization.yaml b/deploy/icarus-mngt/infra/kustomization.yaml
index 66d6028..6b0821e 100644
--- a/deploy/icarus-mngt/infra/kustomization.yaml
+++ b/deploy/icarus-mngt/infra/kustomization.yaml
@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - argo-runner-sa.yaml
+  - icarus-nodes-mngt-tbot-config.yaml
 generatorOptions:
   disableNameSuffixHash: true
 
diff --git a/deploy/icarus-mngt/teleport-manifests/README.md b/deploy/icarus-mngt/teleport-manifests/README.md
new file mode 100644
index 0000000..3c1d04b
--- /dev/null
+++ b/deploy/icarus-mngt/teleport-manifests/README.md
@@ -0,0 +1,6 @@
+# teleport
+
+``` bash
+tctl create -f deploy/icarus-mngt/teleport-manifests/manifest.yaml
+tctl bots update icarus-nodes-mngt --add-roles icarus-nodes-mngt
+```
diff --git a/deploy/icarus-mngt/teleport-manifests/manifest.yaml b/deploy/icarus-mngt/teleport-manifests/manifest.yaml
new file mode 100644
index 0000000..eea09e0
--- /dev/null
+++ b/deploy/icarus-mngt/teleport-manifests/manifest.yaml
@@ -0,0 +1,37 @@
+kind: bot
+version: v1
+metadata:
+  # name is a unique identifier for the Bot in the cluster.
+  name: icarus-nodes-mngt
+spec:
+  roles: []
+
+---
+
+
+kind: role
+version: v6
+metadata:
+  name: icarus-nodes-mngt # use the auto created bot role (created by bot yaml)
+spec:
+  allow:
+    # Allow login to the user 'ansible'.
+    logins: ['ansible']
+    # Allow connection to any node. Adjust these labels to match only nodes
+    # that Ansible needs to access.
+    node_labels:
+      '*': '*'
+
+---
+
+kind: token
+version: v2
+metadata:
+    name: icarus-nodes-mngt
+spec:
+    roles: [Bot]
+    bot_name: icarus-nodes-mngt
+    join_method: kubernetes
+    kubernetes:
+        allow:
+          - service_account: icarus-nodes-mngt:argo-runner
\ No newline at end of file
diff --git a/icarus-mngt/workflows/tests-teleport-tbot.yaml b/icarus-mngt/workflows/tests-teleport-tbot.yaml
new file mode 100644
index 0000000..3f5046d
--- /dev/null
+++ b/icarus-mngt/workflows/tests-teleport-tbot.yaml
@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: tests-teleport-tbot-
+  namespace: icarus-nodes-mngt  
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  templates:
+    - name: exec
+      volumes:
+        - name: identity-output
+          emptyDir: {}
+        - name: icarus-nodes-mngt-tbot-config
+          configMap:
+            name: icarus-nodes-mngt-tbot-config
+            
+      container:
+        image: alpine
+        command: [sh, -c]
+        args: 
+          - |
+              ls -lah /opt/machine-id
+        volumeMounts:
+          - name: identity-output
+            mountPath: /opt/machine-id
+
+      initContainers:
+        - name: get-identity
+          image: public.ecr.aws/gravitational/teleport-distroless:18.11.4
+          command: ["tbot"]
+          args: 
+            - "start"
+            - "--config=/config/tbot.yaml"
+            - "--oneshot"
+          volumeMounts:
+            - name: identity-output
+              mountPath: /opt/machine-id
+            - name: icarus-nodes-mngt-tbot-config
+              mountPath: /config