feat: add ollama workload with linter overrides

Author: xnoto

workloads/apps/kustomization.yaml

@@ -12,4 +12,5 @@ resources:
   - ansible-app.yaml
   - arc-app.yaml
   - grafana-app.yaml
+  - ollama-app.yaml
   - ../openshift-gitops  # Direct include - TunnelBinding for ArgoCD

workloads/apps/ollama-app.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ollama
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/makeitworkcloud/kustomize-cluster.git
+    path: workloads/ollama
+    targetRevision: main
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ollama
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 30s
+        maxDuration: 5m
+        factor: 2

workloads/ollama/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - ollama.yaml

workloads/ollama/ollama.yaml

@@ -0,0 +1,112 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ollama
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ollama-data
+  namespace: ollama
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+    argocd.argoproj.io/sync-options: Delete=false,Prune=false
+    argocd.argoproj.io/ignore-healthcheck: "true"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 50Gi
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ollama-anyuid
+  namespace: ollama
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:privileged
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: ollama
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ollama
+  namespace: ollama
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+    ignore-check.kube-linter.io/unset-cpu-requirements: "No requests on single-node cluster"
+    ignore-check.kube-linter.io/unset-memory-requirements: "No limits on single-node cluster"
+    ignore-check.kube-linter.io/no-read-only-root-fs: "Ollama requires writable root for model management"
+    ignore-check.kube-linter.io/run-as-non-root: "Ollama requires root for certain operations"
+    ignore-check.kube-linter.io/latest-tag: "Using latest for initial deployment"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ollama
+  template:
+    metadata:
+      labels:
+        app: ollama
+    spec:
+      containers:
+      - name: ollama
+        image: ollama/ollama:0.5.7
+        ports:
+        - containerPort: 11434
+          name: api
+        env:
+        - name: OLLAMA_HOST
+          value: "0.0.0.0"
+        - name: OLLAMA_KEEP_ALIVE
+          value: "24h"
+        resources: {}
+        volumeMounts:
+        - name: data
+          mountPath: /root/.ollama
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: ollama-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ollama
+  namespace: ollama
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  selector:
+    app: ollama
+  ports:
+  - protocol: TCP
+    port: 11434
+    targetPort: api
+---
+apiVersion: networking.cfargotunnel.com/v1alpha1
+kind: TunnelBinding
+metadata:
+  name: ollama
+  namespace: ollama
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  tunnelRef:
+    kind: ClusterTunnel
+    name: cluster-apps
+  subjects:
+  - name: ollama
+    spec:
+      fqdn: ollama.makeitwork.cloud
+      target: http://ollama.ollama.svc:11434