renamed: deploy/hosting-mngt/teleport-manifests/manifest.yaml -> deploy/hosting-mngt/manual/teleport-manifests/manifest.yaml

deploy/flux/hosting-mngt/fluxcd-kustomization.yaml

@@ -1,12 +1,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: icarus-nodes-mngt
+  name: hosting-mngt
 spec:
   interval: 1m
   sourceRef:
     kind: GitRepository
     name: nodes-mngt
     namespace: chimera-limbosolutions-com
-  path: deploy/icarus-mngt
+  path: deploy/hosting-mngt
   prune: true

deploy/flux/hosting-mngt/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: icarus-nodes-mngt
+namespace: hosting-mngt
 resources:
   - fluxcd-kustomization.yaml
   - secrets

deploy/flux/hosting-mngt/secrets/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: hosting-mngt
+secretGenerator:
+  - name: ansible-secret
+    files:
+      - ansible_vault_password=.env.d/ansible_vault_password
+      - ansible_become_password=.env.d/ansible_become_password
+  - name: oci-registry-secret
+    type: kubernetes.io/dockerconfigjson
+    files:
+      - .dockerconfigjson=.env.d/oci_registry_secret.json
+generatorOptions:
+  disableNameSuffixHash: true
+
+
+

deploy/flux/icarus-mngt/secrets/kustomization.yaml

@@ -1,21 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-secretGenerator:
-  - name: icarus-ssh
-    files:
-      - known_hosts=.env.d/icarus-known_hosts
-      - id_rsa=.env.d/icarus-ssh-ansible-id_rsa
-      - id_rsa.pub=.env.d/icarus-ssh-ansible-id_rsa.pub
-  - name: icarus-ansible
-    files:
-      - vault-pass.txt=.env.d/ansible-vault-pass.txt
-      - ansible_become_password=.env.d/ansible_become_password
-  - name: oci-registry-secret
-    files:
-      - .dockerconfigjson=.env.d/oci-registry-secret.json
-generatorOptions:
-  disableNameSuffixHash: true
-
-
-

deploy/hosting-mngt/cronWorkflows/crictl-prune.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: CronWorkflow
 metadata:
   name: crictl-prune
-  namespace: icarus-nodes-mngt
 spec:
   schedules:
     -  "0 0 * * *"
@@ -10,17 +9,16 @@ spec:
   successfulJobsHistoryLimit: 3 
   failedJobsHistoryLimit: 5  
   workflowSpec:
-    entrypoint: exec
-    serviceAccountName: argo-runner
     imagePullSecrets:
-      - name: oci-mylimbo-infra-icarus-credentials
+      - name: oci-registry-secret
-    
+    serviceAccountName: argo-runner
+    entrypoint: exec    
     templates:
       - name: exec
         steps:
           - - name: script-exec
               templateRef:
-                name: icarus-ansible-script
+                name: hosting-mngt-ansible-script
                 template: raw-source
               arguments:
                 parameters:

deploy/hosting-mngt/cronWorkflows/kustomization.yaml

@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: hosting-mngt
 resources:
   - crictl-prune.yaml
 generatorOptions:

deploy/hosting-mngt/infra/kustomization.yaml

@@ -1,7 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: hosting-mngt
 resources:
-  - icarus-ansible-script.yaml
+  - argo-runner-sa.yaml
+  - tbot-config.yaml
 generatorOptions:
   disableNameSuffixHash: true
 

deploy/hosting-mngt/infra/tbot-config.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hosting-mngt-tbot-config
+data:
+  tbot.yaml: |
+    version: v2
+    auth_server: "teleport.limbosolutions.com:443"
+    on_one_shot: "exit"
+    onboarding:
+      join_method: "kubernetes"
+      token: "hosting-mngt"
+    storage:
+      type: "memory"
+    services:
+      - type: "identity"
+        ssh_config: on
+        destination:
+          type: "directory"
+          path: /opt/machine-id

deploy/hosting-mngt/kustomization.yaml

@@ -1,10 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: icarus-nodes-mngt
+namespace: hosting-mngt
 resources:
   - infra
   - cronWorkflows
   - workflowTemplates
+  - mylimbo-ansible-collections-global
 generatorOptions:
   disableNameSuffixHash: true
 

deploy/hosting-mngt/manual/README.md

@@ -0,0 +1,6 @@
+# teleport
+
+``` bash
+tctl create -f deploy/hosting-mngt/manual/teleport-manifests/manifest.yaml
+tctl bots update hosting-mngt --add-roles hosting-mngt
+```

deploy/hosting-mngt/manual/teleport-manifests/manifest.yaml

@@ -0,0 +1,37 @@
+kind: bot
+version: v1
+metadata:
+  # name is a unique identifier for the Bot in the cluster.
+  name: hosting-mngt
+spec:
+  roles: []
+
+---
+
+
+kind: role
+version: v6
+metadata:
+  name: hosting-mngt
+spec:
+  allow:
+    # Allow login to the user 'ansible'.
+    logins: ['ansible']
+    # Allow connection to any node. Adjust these labels to match only nodes
+    # that Ansible needs to access.
+    node_labels:
+      '*': '*'
+
+---
+
+kind: token
+version: v2
+metadata:
+    name: hosting-mngt
+spec:
+    roles: [Bot]
+    bot_name: hosting-mngt
+    join_method: kubernetes
+    kubernetes:
+        allow:
+          - service_account: hosting-mngt:argo-runner

deploy/hosting-mngt/mylimbo-ansible-collections-global/fluxcd-kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: mylimbo-ansible-collections-global
-  namespace: icarus-nodes-mngt
+  namespace: hosting-mngt
 spec:
   interval: 1m
   sourceRef:
@@ -11,4 +11,4 @@ spec:
     namespace: chimera-limbosolutions-com
   path: mylimbo-ansible-collections-global
   prune: true
-  targetNamespace: icarus-nodes-mngt
+  targetNamespace: hosting-mngt

deploy/hosting-mngt/mylimbo-ansible-collections-global/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: icarus-nodes-mngt
+namespace: hosting-mngt
 resources:
   - fluxcd-kustomization.yaml
 

deploy/hosting-mngt/workflowTemplates/hosting-mngt-ansible-script.yaml

@@ -1,16 +1,13 @@
 apiVersion: argoproj.io/v1alpha1
 kind: WorkflowTemplate
 metadata:
-  name: icarus-ansible-script
+  name: hosting-mngt-ansible-script
   labels:
     workflows.argoproj.io/archive-strategy: "false"
   annotations:
     workflows.argoproj.io/description: |
-      icarus ansible script
+      hosting ansible script
 spec:
-  serviceAccountName: argo-runner
-  imagePullSecrets:
-    - name: oci-registry-secret
   entrypoint: raw-source
   templates:
     - name: raw-source
@@ -20,15 +17,17 @@ spec:
       steps:
         - - name: invoke-limbo-ansible-collections-global
             templateRef:
-              name: mylimbo-ansible-collections-global
+              name: mylimbo-ansible-collections-global-tbot
               template: raw-source
             arguments:
               parameters:
                 - name: source
                   value: "{{ inputs.parameters.source }}"
+                - name: tbot_configmap_name
+                  value: hosting-mngt-tbot-config
                 - name: inventory_image_reference
-                  value: "oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest"
+                  value: oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest
                 - name: ansible_secret_name
-                  value: "icarus-ansible"
+                  value: ansible-secret
-                - name: ssh_secret_name
+                - name: ssh_domain
-                  value: "icarus-ssh"
+                  value: teleport.limbosolutions.com

deploy/hosting-mngt/workflowTemplates/kustomization.yaml

@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - argo-runner-sa.yaml
+  - hosting-mngt-ansible-script.yaml
 generatorOptions:
   disableNameSuffixHash: true
 

hosting-mngt/workflows/nodes-get-info.yml

@@ -2,17 +2,19 @@ apiVersion: argoproj.io/v1alpha1
 kind: Workflow
 metadata:
   generateName: node-get-info-
-  namespace: icarus-nodes-mngt
+  namespace: hosting-mngt
 spec:
-  entrypoint: exec
+  imagePullSecrets:
+    - name: oci-registry-secret
   serviceAccountName: argo-runner
+
+  entrypoint: exec
   templates:
     - name: exec
       steps:
         - - name: script-exec
             templateRef:
-              # https://git.limbosolutions.com/myLimbo/myinfra.kubernetes.shared
+              name:  hosting-mngt-ansible-script
-              name: icarus-ansible-script
               template: raw-source
             arguments:
               parameters:

hosting-mngt/workflows/nodes-update-os.yml

@@ -2,17 +2,19 @@ apiVersion: argoproj.io/v1alpha1
 kind: Workflow
 metadata:
   generateName: nodes-update-os-
-  namespace: icarus-nodes-mngt
+  namespace: hosting-mngt
 spec:
-  entrypoint: exec
+  imagePullSecrets:
+    - name: oci-registry-secret
   serviceAccountName: argo-runner
+  entrypoint: exec
   templates:
     - name: exec
       steps:
         - - name: script-exec
             templateRef:
               # /deploy/icarus-mngt
-              name: icarus-ansible-script
+              name:  hosting-mngt-ansible-script
               template: raw-source
             arguments:
               parameters:

hosting-mngt/workflows/tests-ansible-playbook.yaml

@@ -0,0 +1,86 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  namespace: hosting-mngt
+  generateName: tests-ansible-playbook-
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  imagePullSecrets:
+  - name: oci-registry-secret
+  templates:
+    - name: exec
+      script:
+        image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest 
+        source: |
+         export PATH="$PATH:/opt/tbot"
+         mkdir -p /opt/machine-id
+         tbot start --config=/etc/tbot/tbot.yaml --oneshot
+         ansible-playbook mylimbo.globals.host_maintenance.os_info
+
+        env:
+            - name: ANSIBLE_VAULT_PASSWORD_FILE
+              value: /workspace/secrets/ansible_vault_password
+
+            - name: ANSIBLE_BECOME_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: "ansible-secret"
+                  key: ansible_become_password
+
+            - name: ANSIBLE_SSH_ARGS
+              value: -F /opt/machine-id/ssh_config
+
+            - name: SSH_DOMAIN
+              value: teleport.limbosolutions.com
+         
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+
+        volumeMounts:
+
+          - name: inventory
+            mountPath: /workspace/inventory
+            subPath: inventory
+
+          - name: tbot
+            mountPath: /opt/tbot
+            subPath: usr/local/bin
+
+          - name: ansible-secrets
+            mountPath: /workspace/secrets
+
+
+          - name: identity-output
+            mountPath: /opt/machine-id  
+
+          - name: hosting-mngt-tbot-config
+            mountPath: /etc/tbot
+
+      volumes:
+        - name: inventory
+          image:
+            reference: "oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest"
+            pullPolicy: Always
+        - name: tbot
+          image:
+            reference: public.ecr.aws/gravitational/tbot-distroless:18.11.4
+            pullPolicy: Always
+        - name: ansible-secrets
+          secret:
+            secretName: "ansible-secret"
+        - name: identity-output
+          emptyDir: {}
+        - name: hosting-mngt-tbot-config
+          configMap:
+            name: hosting-mngt-tbot-config

hosting-mngt/workflows/tests-download-private-oci.yaml

@@ -2,7 +2,7 @@ apiVersion: argoproj.io/v1alpha1
 kind: Workflow
 metadata:
   generateName: tests-download-private-oci-
-  namespace: icarus-nodes-mngt  
+  namespace: hosting-mngt  
   labels:
     workflows.argoproj.io/archive-strategy: "false"
   annotations:

hosting-mngt/workflows/tests-mylimbo-ansible-collections-global-tbot-script.yaml

@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  namespace: hosting-mngt  
+  generateName: tests-mylimbo-ansible-collections-global-tbot-script-
+spec:
+  imagePullSecrets:
+    - name: oci-registry-secret
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  templates:
+    - name: exec
+      steps:
+        - - name: script-exec
+            templateRef:
+              name: mylimbo-ansible-collections-global-tbot
+              template: raw-source
+            arguments:
+              parameters:
+                - name: tbot_configmap_name
+                  value: hosting-mngt-tbot-config
+                - name: inventory_image_reference
+                  value: oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest
+                - name: ansible_secret_name
+                  value: ansible-secret
+                - name: source
+                  value: |
+                    ansible-playbook mylimbo.globals.host_maintenance.os_info
+
+

hosting-mngt/workflows/tests-teleport-tbot.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: tests-teleport-tbot-
+  namespace: hosting-mngt  
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  templates:
+    - name: exec
+      volumes:
+        - name: identity-output
+          emptyDir: {}
+        - name: hosting-mngt-tbot-config
+          configMap:
+            name: hosting-mngt-tbot-config
+            
+      container:
+        image: alpine
+        command: [sh, -c]
+        args: 
+          - |
+              ls -lah /opt/machine-id
+        volumeMounts:
+          - name: identity-output
+            mountPath: /opt/machine-id
+
+      initContainers:
+        - name: get-identity
+          image: public.ecr.aws/gravitational/teleport-distroless:18.11.4
+          command: ["tbot"]
+          args: 
+            - "start"
+            - "--config=/config/tbot.yaml"
+            - "--oneshot"
+          volumeMounts:
+            - name: identity-output
+              mountPath: /opt/machine-id
+            - name: hosting-mngt-tbot-config
+              mountPath: /config