Add CR to CI/CD and rework secrets

.github/workflows/merge.yml

@@ -0,0 +1,40 @@
+---
+name: Apply Zuul configuration
+
+on:
+  push:
+    branches:
+      master
+
+jobs:
+  deploy-zuul:
+
+    runs-on: self-hosted
+
+    env:
+      ANSIBLE_FORCE_COLOR: True
+      ANSIBLE_VAULT_PASSWORD_FILE: .vault.txt
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set Ansible Vault password file
+      run: |
+        echo ${{ secrets.ANSIBLE_VAULT_PASSWORD }} > $ANSIBLE_VAULT_PASSWORD_FILE
+
+    - name: Generate kubeconfig
+      env:
+        KUBE: ${{secrets.KUBE}}
+        OS_CLOUD: "smslab-stackhpc-ci"
+      run: |
+        mkdir -p ~/.kube
+        echo "$KUBE" > ~/.kube/config
+
+    - name: Run playbook
+      run: >
+        ansible-playbook -i ansible/inventory ansible/run.yml
+
+    - name: Remove credentials
+      run: |
+        rm -f ~/.kube/config .vault.txt
+

ansible/inventory/group_vars/all/cr

@@ -0,0 +1,34 @@
+---
+zuul_operator_cr: |
+  apiVersion: operator.zuul-ci.org/v1alpha2
+  kind: Zuul
+  metadata:
+    name: zuul
+  spec:
+    executor:
+      count: 1
+      sshkey:
+        secretName: zuul-sshkey
+    scheduler:
+      config:
+        secretName: zuul-tenant-config
+    launcher:
+      config:
+        secretName: zuul-nodepool-config
+    web:
+      count: 1
+    connections:
+      github:
+        driver: github
+        secretName: zuul-github
+        server: github.com
+      opendev:
+        driver: git
+        baseurl: https://opendev.org
+      stackhpc:
+        driver: git
+        baseurl: https://github.com/stackhpc
+        canonical_hostname: github.stackhpc.com
+    externalConfig:
+      openstack:
+        secretName: zuul-clouds-yaml