diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index d1ab0e9..0da40a5 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -19,6 +19,12 @@ repos: - id: end-of-file-fixer - id: mixed-line-ending - id: trailing-whitespace + - repo: https://github.com/gitleaks/gitleaks + rev: v8.30.1 + hooks: + - id: gitleaks + entry: gitleaks dir --redact --verbose . + pass_filenames: false - repo: https://github.com/stackrox/kube-linter rev: v0.8.2 hooks: diff --git a/README.md b/README.md index 23539fd..d37a8ed 100644 --- a/README.md +++ b/README.md @@ -42,7 +42,7 @@ Public DNS under `*.makeitwork.cloud` is owned by cloudflare-operator from `Tunn ## Authentication -GitHub OAuth provides SSO for ArgoCD, Grafana, AWX, and kubectl/Headlamp (via OIDC). Cluster-admin RBAC for the maintainer GitHub team is defined in `bootstrap/oidc-rbac.yaml`. CI uses a dedicated `ci-deployer` ServiceAccount whose token is synced to GitHub Actions secrets by a PostSync job. +GitHub OAuth provides SSO for ArgoCD, Grafana, and kubectl/Headlamp (via OIDC). Cluster-admin RBAC for the maintainer GitHub team is defined in `bootstrap/oidc-rbac.yaml`. CI uses a dedicated `ci-deployer` ServiceAccount whose token is synced to GitHub Actions secrets by a PostSync job. ## SOPS / KSOPS diff --git a/bootstrap/wait-for-crds.yaml b/bootstrap/wait-for-crds.yaml index 181f608..c01f03e 100644 --- a/bootstrap/wait-for-crds.yaml +++ b/bootstrap/wait-for-crds.yaml @@ -34,14 +34,6 @@ spec: set -e echo "Waiting for operator CRDs..." - # Wait for AWX CRD - echo "Checking for AWX CRD..." - until kubectl get crd awxs.awx.ansible.com 2>/dev/null; do - echo "Waiting for awxs.awx.ansible.com CRD..." - sleep 10 - done - echo "AWX CRD ready" - # Wait for ARC CRDs echo "Checking for ARC CRDs..." until kubectl get crd runnerdeployments.actions.summerwind.dev 2>/dev/null; do diff --git a/operators/ansible/kustomization.yaml b/operators/ansible/kustomization.yaml deleted file mode 100644 index 3c005f8..0000000 --- a/operators/ansible/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - operator.yaml diff --git a/operators/ansible/operator.yaml b/operators/ansible/operator.yaml deleted file mode 100644 index 4219abd..0000000 --- a/operators/ansible/operator.yaml +++ /dev/null @@ -1,52 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: awx - annotations: - argocd.argoproj.io/sync-wave: "0" ---- -# AWX operator catalog - upstream operator not in community-operators -apiVersion: operators.coreos.com/v1alpha1 -kind: CatalogSource -metadata: - name: awx-operator-catalog - namespace: openshift-marketplace - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - displayName: AWX Operator - publisher: AWX Community - sourceType: grpc - image: quay.io/ansible/awx-operator-catalog:2.19.1 - updateStrategy: - registryPoll: - interval: 10m ---- -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: awx-operator - namespace: awx - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - targetNamespaces: - - awx - upgradeStrategy: Default ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: awx-operator - namespace: awx - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - channel: alpha - installPlanApproval: Automatic - config: - resources: {} - name: awx-operator - source: awx-operator-catalog - sourceNamespace: openshift-marketplace diff --git a/operators/cloudflare/dns-adoption-job.yaml b/operators/cloudflare/dns-adoption-job.yaml index 5532a7a..25b0d05 100644 --- a/operators/cloudflare/dns-adoption-job.yaml +++ b/operators/cloudflare/dns-adoption-job.yaml @@ -54,7 +54,7 @@ spec: token = os.environ["CF_API_TOKEN"] domain = os.environ["CF_DOMAIN"] - hosts = ["argocd", "grafana", "status", "ansible"] + hosts = ["argocd", "grafana", "status"] def cf_request(method, path, params=None): url = "https://api.cloudflare.com/client/v4" + path diff --git a/operators/kustomization.yaml b/operators/kustomization.yaml index aad1395..1e7b01e 100644 --- a/operators/kustomization.yaml +++ b/operators/kustomization.yaml @@ -12,6 +12,3 @@ resources: - headlamp - kube-prometheus-stack - tor-controller - # ansible/ contains an OLM Subscription; AWX is being deprecated. Re-enable - # here only if the operator comes back. - # - ansible diff --git a/workloads/ansible/awx-admin-password-secret.yaml b/workloads/ansible/awx-admin-password-secret.yaml deleted file mode 100644 index b7f6205..0000000 --- a/workloads/ansible/awx-admin-password-secret.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: makeitwork-admin-password - namespace: awx - annotations: - argocd.argoproj.io/sync-wave: "0" -type: Opaque -data: - # Base64 encoded admin password - password: ENC[AES256_GCM,data:DRrmN4973blwK159PG2UK7Hs/JlTENCqASsGK7BWSsGAu1TYStKpDIRcCSU=,iv:md+xVTpk/GVkR9emvy+SrQLbGRuGrurXZgk8NwYl9Io=,tag:cYxe3h/emjxj+MBL4Yu8Fg==,type:str] -sops: - age: - - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpYzJ0VzRpU1FZWVp6bHp4 - MzZQSWRJTFdidWdPYitTZ29nSlNTRS9laUgwClBsaVcwV3dDTHdhelFpYVBhcTla - SkpBci9paFdpc0xnU1BjMERUREdlcHcKLS0tIEc0NVQyNXVuWmJSRnZkYnVmd0s0 - R3JvWWdOSmlzdjhpaTBqTGNCcit5eXMK86MDa+6MBC4cq5ZBUrIROXowDYwszA+Z - U+T/WCWSWDuXX+4+XqSXb/8RtmzvRYlai5hX8BTP8D1EXGQrRNVINg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-03-16T14:38:08Z" - mac: ENC[AES256_GCM,data:1utE7h8GHwRP5LYL3Coz6HVj+i9AM8J24zgo0CA/bDzOWWM/hZlPWpLTiki9TKvRd3S2l2vw5CxD6pBF2GNqClCMh5JmxVADQR6bStwYRur8ucAI8rExElepIx8OGcXfaHnRysqHQq/Y5RFY9cdo7PosTB1wNaBTJvgx1h1EwSk=,iv:hYgBnjj2hitfr8WRvgU0BRQ/VnBdpxMR7aMmmnnkqxM=,tag:0a79LLbhzBNRUABTVG7AZw==,type:str] - encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.github\.clientID|dex\.github\.clientSecret)$ - version: 3.12.1 diff --git a/workloads/ansible/awx-github-oauth-secret.yaml b/workloads/ansible/awx-github-oauth-secret.yaml deleted file mode 100644 index f366918..0000000 --- a/workloads/ansible/awx-github-oauth-secret.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: awx-github-oauth - namespace: awx - annotations: - argocd.argoproj.io/sync-wave: "0" -type: Opaque -stringData: - github_settings.py: | - SOCIAL_AUTH_GITHUB_TEAM_KEY = "Ov23linshmtX4x0ID2XC" - SOCIAL_AUTH_GITHUB_TEAM_SECRET = "97c903d9f0ceb1278897838424278da43084c055" - SOCIAL_AUTH_GITHUB_TEAM_ID = "15594330" - SOCIAL_AUTH_GITHUB_TEAM_ORGANIZATION_MAP = { - "Default": { - "users": True, - "admins": True, - "remove_users": False, - "remove_admins": False, - } - } - # Grant superuser status to all users from the admins team - SOCIAL_AUTH_GITHUB_TEAM_ADMIN_USERS = True - - # Force GitHub OAuth as default login (bypass username/password UI) - LOGIN_REDIRECT_OVERRIDE = "/sso/login/github-team/" - - # Allow local auth for API (admin service account) - # UI login still redirects to GitHub OAuth via LOGIN_REDIRECT_OVERRIDE - DISABLE_LOCAL_AUTH = False -sops: - age: - - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxNWZlTjIzeTlsMzkrVUpJ - THk4bzEzalFJL1RhdmpEaVpWK05TMGx0OEcwCkhkMkhoeGZSSzhNckF4V2lSZ0ZJ - Q3ZMTlpvZWZscFJWTlBJRDVXV1p4K1UKLS0tIGJSUmdkaHdRL0M4cU0vWkJDT3Q5 - UXNHMFlReWFDVFFvNVpMdUJJTSt4QXMK9PfEXMu3PyXd0kGT1gLg2zQpK58zxxAM - RaNEWSkuQ/wKebdZcIkhSa5495nMtZXwc/loEbb5Fgj+TN3DsUmxrw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-03-16T14:38:14Z" - mac: ENC[AES256_GCM,data:EKpKqfLW/NxfwDvtHPe1kUkXPS0M0gwceabahMmMy1foL5yB9ezB2j6cxovso1IspZ4M80DOxZJliULf29Cz33W+qU2HRhWjmp/Q+Wk7OzSIzmYpH1P7KxhGUn091DOCaDZoD1PKw55cq26WEVuyyphFhxO3AZITvuNu8sh7pys=,iv:jn/pgock/jtOo7Mzn0iEXEDITZk+ALKwBPnrxYhVql8=,tag:qE4id7rtLA4rL5OOTGObiA==,type:str] - encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.github\.clientID|dex\.github\.clientSecret)$ - version: 3.12.1 diff --git a/workloads/ansible/awx-logo-configmap.yaml b/workloads/ansible/awx-logo-configmap.yaml deleted file mode 100644 index 9f72a5c..0000000 --- a/workloads/ansible/awx-logo-configmap.yaml +++ /dev/null @@ -1,51 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: awx-logo - namespace: awx - annotations: - argocd.argoproj.io/sync-wave: "0" -data: - logo-login.svg: | - - - - - - - - - - - - - - logo-header.svg: | - - - - - - - - - - - - - - brand-logo.svg: | - - - - - - - - - - - - - diff --git a/workloads/ansible/awx.yaml b/workloads/ansible/awx.yaml deleted file mode 100644 index 4fd1b60..0000000 --- a/workloads/ansible/awx.yaml +++ /dev/null @@ -1,64 +0,0 @@ -apiVersion: awx.ansible.com/v1beta1 -kind: AWX -metadata: - annotations: - argocd.argoproj.io/sync-wave: "2" - name: awx - namespace: awx -spec: - admin_password_secret: makeitwork-admin-password - ingress_type: Route - route_host: ansible.makeitwork.cloud - extra_settings_files: - secrets: - - name: awx-github-oauth - key: github_settings.py - extra_volumes: | - - name: awx-logo-login - configMap: - name: awx-logo - items: - - key: logo-login.svg - path: logo-login.svg - - name: awx-logo-header - configMap: - name: awx-logo - items: - - key: logo-header.svg - path: logo-header.svg - - name: awx-brand-logo - configMap: - name: awx-logo - items: - - key: brand-logo.svg - path: brand-logo.svg - web_extra_volume_mounts: | - - name: awx-logo-login - mountPath: /var/lib/awx/public/static/media/logo-login.svg - subPath: logo-login.svg - - name: awx-logo-header - mountPath: /var/lib/awx/public/static/media/logo-header.svg - subPath: logo-header.svg - - name: awx-brand-logo - mountPath: /var/lib/awx/public/static/media/brand-logo.svg - subPath: brand-logo.svg - postgres_data_volume_init: true - postgres_security_context_settings: - runAsUser: 26 - fsGroup: 26 - security_context_settings: - runAsUser: 26 - fsGroup: 26 - postgres_init_container_commands: |- - mkdir -p /var/lib/pgsql/data/data/userdata - chown -R 26:26 /var/lib/pgsql/data/data - chmod 0770 /var/lib/pgsql/data/data - chmod 0700 /var/lib/pgsql/data/data/userdata - web_resource_requirements: {} - task_resource_requirements: {} - ee_resource_requirements: {} - redis_resource_requirements: {} - rsyslog_resource_requirements: {} - postgres_resource_requirements: {} - init_container_resource_requirements: {} - postgres_init_container_resource_requirements: {} diff --git a/workloads/ansible/ksops-ansible-secrets.yaml b/workloads/ansible/ksops-ansible-secrets.yaml deleted file mode 100644 index 4ec8620..0000000 --- a/workloads/ansible/ksops-ansible-secrets.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: viaduct.ai/v1 -kind: ksops -metadata: - name: ksops-ansible-secrets - annotations: - config.kubernetes.io/function: | - exec: - path: ksops -files: - - awx-admin-password-secret.yaml - - awx-github-oauth-secret.yaml - - tor-proxy-key-secret.yaml diff --git a/workloads/ansible/kustomization.yaml b/workloads/ansible/kustomization.yaml deleted file mode 100644 index 0e0942c..0000000 --- a/workloads/ansible/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - awx-logo-configmap.yaml - - awx.yaml - - onion-service.yaml - - tunnel-binding.yaml -generators: - - ksops-ansible-secrets.yaml diff --git a/workloads/ansible/onion-service.yaml b/workloads/ansible/onion-service.yaml deleted file mode 100644 index f49a608..0000000 --- a/workloads/ansible/onion-service.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -apiVersion: tor.k8s.torproject.org/v1alpha2 -kind: OnionService -metadata: - name: awx - namespace: awx -spec: - version: 3 - privateKeySecret: - name: tor-proxy-key - key: AWX_TOR_SERVICE_KEY - rules: - - port: - number: 80 - backend: - service: - name: awx-service - port: - number: 80 diff --git a/workloads/ansible/tor-proxy-key-secret.yaml b/workloads/ansible/tor-proxy-key-secret.yaml deleted file mode 100644 index fb6415b..0000000 --- a/workloads/ansible/tor-proxy-key-secret.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: tor-proxy-key - namespace: awx -type: Opaque -data: - # Tor key for AWX .onion service - base64 encoded raw binary - AWX_TOR_SERVICE_KEY: ENC[AES256_GCM,data:lWNpqlB07oOEAbfyuYg2HvvlHg3WCkDAUsBZDdZlKf3QtMFV5NmQHY3NU/VVQm1SLqGwUOhtZTQJL9SQhH8xj57/tVSLKmCrQx77X0WomUZv1ID3N7SDnaqCGHO4Q0lCZ8FOU9A1mpjGjtJjWV1VC/kG+ARbiD2JbfFDyAX8w3M=,iv:bQ1tXpCDOZKa7FVBijMKl/iz6KduPlqwb8bviJNJL5o=,tag:tYim0VIXYhq535H852H0gA==,type:str] -sops: - age: - - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQkh5cTFqYmtPSzFUV29s - UVJYaERNZ1RrSXJzTGV4d29RdFFNemIwNG1rCmIwUjhsellyZkRTTVU0WlpGeWU4 - VHZ4Tkg4dml0ZVA5M2pscVdneHF0R3MKLS0tIHBUNmdzMnR1cXBpVk1aemdLZ1B5 - a1hKRno1cXlkcUM5SWlrMjRlWmFBSE0K4D00A7OD+OBsusa1+gxsNcMQDgcTgIxs - CEv9bhPLGD0uRaxdJGf5vKvZ7ioghJZ/GsFfomkyzyqiHB7GQe9LTw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-03-16T14:38:08Z" - mac: ENC[AES256_GCM,data:lNWby9JjRHJnBE9/qAqFJuc0zg/ieqt2IJb2ILXfa60h3hn5WeGBlLsFxIyC9psMwvWo1PpYia0zrmS0rZBcSGX5dZMqAIRo2EtrP6GpDwTRiT0Ap12We59CugiJa9dTaObbnWAlSUXoiIPkfAn1VbvaQEgkGRa17DnEEDD0xDY=,iv:cQtCH1FxwysfGs7swbOl1uuo6BU4fXHuSHW/dv5qJNE=,tag:9gCCh4oZGrQv3xDFq5UZpQ==,type:str] - encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.github\.clientID|dex\.github\.clientSecret)$ - version: 3.12.1 diff --git a/workloads/ansible/tunnel-binding.yaml b/workloads/ansible/tunnel-binding.yaml deleted file mode 100644 index 8831602..0000000 --- a/workloads/ansible/tunnel-binding.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: networking.cfargotunnel.com/v1alpha1 -kind: TunnelBinding -metadata: - name: ansible - namespace: awx - annotations: - argocd.argoproj.io/sync-wave: "1" -subjects: - - name: awx-service - spec: - fqdn: ansible.makeitwork.cloud - target: http://awx-service.awx.svc:80 -tunnelRef: - kind: ClusterTunnel - name: cluster-apps diff --git a/workloads/apps/ansible-app.yaml b/workloads/apps/ansible-app.yaml deleted file mode 100644 index a0d0961..0000000 --- a/workloads/apps/ansible-app.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: ansible - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - project: default - source: - repoURL: https://github.com/makeitworkcloud/kustomize-cluster.git - path: workloads/ansible - targetRevision: main - destination: - server: https://kubernetes.default.svc - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - SkipDryRunOnMissingResource=true - retry: - limit: 5 - backoff: - duration: 30s - maxDuration: 5m - factor: 2 diff --git a/workloads/apps/kustomization.yaml b/workloads/apps/kustomization.yaml index f4af4df..d0dc1a7 100644 --- a/workloads/apps/kustomization.yaml +++ b/workloads/apps/kustomization.yaml @@ -15,6 +15,3 @@ resources: # Note: Headlamp is installed by gitops-operators (operators/headlamp/) since # the chart's Application CR + namespace/Secret/TunnelBinding all live together # there. No separate workloads-app entry needed. - # ansible-app is paired with the AWX operator, which is being deprecated; - # re-enable here only if the operator comes back. - # - ansible-app.yaml