apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  namespace: icarus-nodes-mngt  
  generateName: tests-ansible-playbook-
  labels:
    workflows.argoproj.io/archive-strategy: "false"
  annotations:
    workflows.argoproj.io/description: |

spec:
  entrypoint: exec
  serviceAccountName: argo-runner
  imagePullSecrets:
  - name: oci-registry-secret
  templates:
    - name: exec
      script:
        image: oci.limbosolutions.com/public/mylimbo.ansible.collections.global:latest 
        source: |
         export PATH="$PATH:/opt/tbot"
         mkdir -p /opt/machine-id
         tbot start --config=/etc/tbot/tbot.yaml --oneshot
         ansible-playbook mylimbo.globals.host_maintenance.os_info

        env:
            - name: ANSIBLE_VAULT_PASSWORD_FILE
              value: /workspace/secrets/vault_password

            - name: ANSIBLE_BECOME_PASS
              valueFrom:
                secretKeyRef:
                  name: "icarus-ansible"
                  key: ansible_become_password

            - name: ANSIBLE_SSH_ARGS
              value: -F /opt/machine-id/ssh_config

            - name: SSH_DOMAIN
              value: teleport.limbosolutions.com
         
        resources:
          limits:
            memory: "512Mi"
            cpu: "500m"
          requests:
            memory: "256Mi"
            cpu: "250m"

        volumeMounts:

          - name: inventory
            mountPath: /workspace/inventory
            subPath: inventory

          - name: tbot
            mountPath: /opt/tbot
            subPath: usr/local/bin

          - name: ansible-secrets
            mountPath: /workspace/secrets


          - name: identity-output
            mountPath: /opt/machine-id  

          - name: icarus-nodes-mngt-tbot-config
            mountPath: /etc/tbot

      volumes:
        - name: inventory
          image:
            reference: "oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest"
            pullPolicy: Always
        - name: tbot
          image:
            reference: public.ecr.aws/gravitational/tbot-distroless:18.11.4
            pullPolicy: Always
        - name: ansible-secrets
          secret:
            secretName: "icarus-ansible"
        - name: identity-output
          emptyDir: {}
        - name: icarus-nodes-mngt-tbot-config
          configMap:
            name: icarus-nodes-mngt-tbot-config