icarus mngt - tbot

deploy/flux/icarus-mngt/secrets/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-
+namespace: icarus-nodes-mngt
 secretGenerator:
   - name: icarus-ssh
     files:
@@ -12,6 +12,7 @@ secretGenerator:
       - vault-pass.txt=.env.d/ansible-vault-pass.txt
       - ansible_become_password=.env.d/ansible_become_password
   - name: oci-registry-secret
+    type: kubernetes.io/dockerconfigjson
     files:
       - .dockerconfigjson=.env.d/oci-registry-secret.json
 generatorOptions:

deploy/icarus-mngt/infra/icarus-nodes-mngt-tbot-config.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: icarus-nodes-mngt-tbot-config
+  namespace: icarus-nodes-mngt
+data:
+  tbot.yaml: |
+    version: v2
+    auth_server: "teleport.limbosolutions.com:443"
+    on_one_shot: "exit"
+    onboarding:
+      join_method: "kubernetes"
+      token: "icarus-nodes-mngt"
+    storage:
+      type: "memory"
+    services:
+      - type: "identity"
+        ssh_config: on
+        destination:
+          type: "directory"
+          path: /opt/machine-id

deploy/icarus-mngt/infra/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - argo-runner-sa.yaml
+  - icarus-nodes-mngt-tbot-config.yaml
 generatorOptions:
   disableNameSuffixHash: true
 

deploy/icarus-mngt/teleport-manifests/README.md

@@ -0,0 +1,6 @@
+# teleport
+
+``` bash
+tctl create -f deploy/icarus-mngt/teleport-manifests/manifest.yaml
+tctl bots update icarus-nodes-mngt --add-roles icarus-nodes-mngt
+```

deploy/icarus-mngt/teleport-manifests/manifest.yaml

@@ -0,0 +1,37 @@
+kind: bot
+version: v1
+metadata:
+  # name is a unique identifier for the Bot in the cluster.
+  name: icarus-nodes-mngt
+spec:
+  roles: []
+
+---
+
+
+kind: role
+version: v6
+metadata:
+  name: icarus-nodes-mngt # use the auto created bot role (created by bot yaml)
+spec:
+  allow:
+    # Allow login to the user 'ansible'.
+    logins: ['ansible']
+    # Allow connection to any node. Adjust these labels to match only nodes
+    # that Ansible needs to access.
+    node_labels:
+      '*': '*'
+
+---
+
+kind: token
+version: v2
+metadata:
+    name: icarus-nodes-mngt
+spec:
+    roles: [Bot]
+    bot_name: icarus-nodes-mngt
+    join_method: kubernetes
+    kubernetes:
+        allow:
+          - service_account: icarus-nodes-mngt:argo-runner

icarus-mngt/workflows/tests-teleport-tbot.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: tests-teleport-tbot-
+  namespace: icarus-nodes-mngt  
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  templates:
+    - name: exec
+      volumes:
+        - name: identity-output
+          emptyDir: {}
+        - name: icarus-nodes-mngt-tbot-config
+          configMap:
+            name: icarus-nodes-mngt-tbot-config
+            
+      container:
+        image: alpine
+        command: [sh, -c]
+        args: 
+          - |
+              ls -lah /opt/machine-id
+        volumeMounts:
+          - name: identity-output
+            mountPath: /opt/machine-id
+
+      initContainers:
+        - name: get-identity
+          image: public.ecr.aws/gravitational/teleport-distroless:18.11.4
+          command: ["tbot"]
+          args: 
+            - "start"
+            - "--config=/config/tbot.yaml"
+            - "--oneshot"
+          volumeMounts:
+            - name: identity-output
+              mountPath: /opt/machine-id
+            - name: icarus-nodes-mngt-tbot-config
+              mountPath: /config