chore: remove AWX and add secret scanning

.pre-commit-config.yaml

@@ -19,6 +19,12 @@ repos:
       - id: end-of-file-fixer
       - id: mixed-line-ending
       - id: trailing-whitespace
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+        entry: gitleaks dir --redact --verbose .
+        pass_filenames: false
   - repo: https://github.com/stackrox/kube-linter
     rev: v0.8.2
     hooks:

README.md

@@ -42,7 +42,7 @@ Public DNS under `*.makeitwork.cloud` is owned by cloudflare-operator from `Tunn
 
 ## Authentication
 
-GitHub OAuth provides SSO for ArgoCD, Grafana, AWX, and kubectl/Headlamp (via OIDC). Cluster-admin RBAC for the maintainer GitHub team is defined in `bootstrap/oidc-rbac.yaml`. CI uses a dedicated `ci-deployer` ServiceAccount whose token is synced to GitHub Actions secrets by a PostSync job.
+GitHub OAuth provides SSO for ArgoCD, Grafana, and kubectl/Headlamp (via OIDC). Cluster-admin RBAC for the maintainer GitHub team is defined in `bootstrap/oidc-rbac.yaml`. CI uses a dedicated `ci-deployer` ServiceAccount whose token is synced to GitHub Actions secrets by a PostSync job.
 
 ## SOPS / KSOPS
 

bootstrap/wait-for-crds.yaml

@@ -34,14 +34,6 @@ spec:
               set -e
               echo "Waiting for operator CRDs..."
 
-              # Wait for AWX CRD
-              echo "Checking for AWX CRD..."
-              until kubectl get crd awxs.awx.ansible.com 2>/dev/null; do
-                echo "Waiting for awxs.awx.ansible.com CRD..."
-                sleep 10
-              done
-              echo "AWX CRD ready"
-
               # Wait for ARC CRDs
               echo "Checking for ARC CRDs..."
               until kubectl get crd runnerdeployments.actions.summerwind.dev 2>/dev/null; do

operators/cloudflare/dns-adoption-job.yaml

@@ -54,7 +54,7 @@ spec:
 
               token = os.environ["CF_API_TOKEN"]
               domain = os.environ["CF_DOMAIN"]
-              hosts = ["argocd", "grafana", "status", "ansible"]
+              hosts = ["argocd", "grafana", "status"]
 
               def cf_request(method, path, params=None):
                   url = "https://api.cloudflare.com/client/v4" + path

operators/kustomization.yaml

@@ -12,6 +12,3 @@ resources:
   - headlamp
   - kube-prometheus-stack
   - tor-controller
-  # ansible/ contains an OLM Subscription; AWX is being deprecated. Re-enable
-  # here only if the operator comes back.
-  # - ansible