diff --git a/common/roles/defaults/defaults/main.yaml b/common/roles/defaults/defaults/main.yaml index 4551e6fca..747be02a5 100644 --- a/common/roles/defaults/defaults/main.yaml +++ b/common/roles/defaults/defaults/main.yaml @@ -32,6 +32,8 @@ metal_stack_release: metal_metrics_exporter_image_name: "docker-images.metal-stack.control-plane.metal-metrics-exporter.name" rethinkdb_exporter_name: "docker-images.metal-stack.control-plane.rethinkdb-exporter.name" rethinkdb_exporter_tag: "docker-images.metal-stack.control-plane.rethinkdb-exporter.tag" + metal_token_refresher_image_tag: "docker-images.metal-stack.kubernetes.metal-token-refresher.tag" + metal_token_refresher_image_name: "docker-images.metal-stack.kubernetes.metal-token-refresher.name" # partition metal_core_image_tag: "docker-images.metal-stack.partition.metal-core.tag" metal_core_image_name: "docker-images.metal-stack.partition.metal-core.name" diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index c9ddf7a7f..aa7accd21 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -205,6 +205,20 @@ metal_console_pdb_enabled: false metal_console_pdb_min_available: 1 metal_console_tcproute_enabled: false metal_console_tcproute_parent_refs: [] +metal_console_token_expiration: 8h +metal_console_token_refresher_image_name: "{{ metal_token_refresher_image_name }}" +metal_console_token_refresher_image_tag: "{{ metal_token_refresher_image_tag }}" +metal_console_token_refresher_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}" +metal_console_token_refresher_resources: +metal_console_token_refresher_schedule: "@hourly" +metal_console_token_permissions: + - self: + methods: + - /metalstack.api.v2.TokenService/Refresh + - infra: + methods: + - /metalstack.infra.v2.ComponentService/Ping + # ingress metal_deploy_ingress: true metal_deploy_ingress_api_v1_rules: "{{ True if not metal_api_httproute_enabled else False }}" diff --git a/control-plane/roles/metal/meta/main.yml b/control-plane/roles/metal/meta/main.yml index 315c69059..b30b07367 100644 --- a/control-plane/roles/metal/meta/main.yml +++ b/control-plane/roles/metal/meta/main.yml @@ -13,5 +13,6 @@ galaxy_info: dependencies: - role: ansible-common + - role: metal-ansible-modules - role: metal-roles/common/roles/defaults - role: metal-roles/control-plane/roles/defaults diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml new file mode 100644 index 000000000..8f092ae56 --- /dev/null +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -0,0 +1,24 @@ +--- +- name: Create api token for metal-console + delegate_to: localhost + environment: + METAL_APIV2_URL: "{{ metal_apiserver_url }}" + METAL_APIV2_TOKEN: "{{ hostvars['localhost'].metal_deployment_admin_token }}" + block: + - name: Create metal-console tenant + run_once: true + metal_v2_admin_tenant: + identifier: metal-console + name: metal-console + description: tenant used by the metal-console + register: _tenant + + - name: Create metal-console api token + metal_v2_admin_token: + identifier: metal-console + use_latest_identifier: true + user: "{{ _tenant.id }}" + description: metal-console token + expires: "{{ metal_console_token_expiration }}" + permissions: "{{ metal_console_token_permissions }}" + register: _token diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index 62e05d0da..8cd38b877 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -24,6 +24,8 @@ - metal_ipam_image_tag is defined - metal_console_image_name is defined - metal_console_image_tag is defined + - metal_console_token_refresher_image_name is defined + - metal_console_token_refresher_image_tag is defined - metal_helm_chart_local_path is not none or metal_helm_chart is defined - metal_helm_chart_local_path is not none or metal_helm_chart_tag is defined - not metal_api_s3_enabled or metal_api_s3_address is not none @@ -31,6 +33,30 @@ - not metal_apiserver_enabled or metal_apiserver_oidc_client_secret is not none - not metal_apiserver_enabled or (metal_apiserver_session_secret is not none and metal_apiserver_session_secret | length >= 10) +- name: Create metal-apiserver token for metal-console + ansible.builtin.import_role: + name: metal-roles/common/roles/metal-deployment-token + when: metal_console_enabled + +- name: Create metal-console token + ansible.builtin.import_tasks: console-token.yaml + when: metal_console_enabled + +- name: Create metal-console-token secret + kubernetes.core.k8s: + definition: + apiVersion: v1 + kind: Secret + metadata: + name: "metal-console-token" + namespace: "{{ metal_control_plane_namespace }}" + labels: + app: metal-console + data: + token: "{{ _token.secret | b64encode }}" + apply: true + when: '"secret" in _token and metal_console_enabled' + - name: Deploy metal control plane ansible.builtin.include_role: name: ansible-common/roles/helm-chart diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2 index c6c9a7dad..3c28cf7c2 100644 --- a/control-plane/roles/metal/templates/metal-values.j2 +++ b/control-plane/roles/metal/templates/metal-values.j2 @@ -18,6 +18,10 @@ images: image: "{{ metal_console_image_name }}" imagePullPolicy: "{{ metal_console_image_pull_policy }}" tag: "{{ metal_console_image_tag }}" + metal_console_token_refresher: + image: "{{ metal_console_token_refresher_image_name }}" + imagePullPolicy: "{{ metal_console_token_refresher_image_pull_policy }}" + tag: "{{ metal_console_token_refresher_image_tag }}" masterdata_api: image: "{{ metal_masterdata_api_image_name }}" imagePullPolicy: "{{ metal_masterdata_api_image_pull_policy }}" @@ -41,6 +45,9 @@ resources: {% if metal_console_resources %} metal_console: {{ metal_console_resources | to_json }} {% endif %} +{% if metal_console_token_refresher_resources %} + metal_console_token_refresher: {{ metal_console_token_refresher_resources | to_json }} +{% endif %} {% if metal_ipam_resources %} ipam: {{ metal_ipam_resources | to_json }} {% endif %} @@ -69,6 +76,12 @@ metal_console: client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}" client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}" ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}" + token_file_secret_ref: + name: metal-console-token + key: token + + token_refresher: + schedule: {{ metal_console_token_refresher_schedule | to_json }} ports: metal_api: {{ metal_api_port }}