From b0fe1c10d8294d80b8427ef688df01cf5126154f Mon Sep 17 00:00:00 2001 From: Gerrit Date: Fri, 14 Aug 2026 10:22:25 +0200 Subject: [PATCH 1/7] Add compatibility for metal-console API V2. --- common/roles/defaults/defaults/main.yaml | 2 ++ control-plane/roles/metal/defaults/main.yaml | 19 ++++++++++++++ .../roles/metal/tasks/console-token.yaml | 22 ++++++++++++++++ control-plane/roles/metal/tasks/main.yaml | 26 +++++++++++++++++++ .../roles/metal/templates/metal-values.j2 | 13 ++++++++++ 5 files changed, 82 insertions(+) create mode 100644 control-plane/roles/metal/tasks/console-token.yaml diff --git a/common/roles/defaults/defaults/main.yaml b/common/roles/defaults/defaults/main.yaml index 4551e6fca..747be02a5 100644 --- a/common/roles/defaults/defaults/main.yaml +++ b/common/roles/defaults/defaults/main.yaml @@ -32,6 +32,8 @@ metal_stack_release: metal_metrics_exporter_image_name: "docker-images.metal-stack.control-plane.metal-metrics-exporter.name" rethinkdb_exporter_name: "docker-images.metal-stack.control-plane.rethinkdb-exporter.name" rethinkdb_exporter_tag: "docker-images.metal-stack.control-plane.rethinkdb-exporter.tag" + metal_token_refresher_image_tag: "docker-images.metal-stack.kubernetes.metal-token-refresher.tag" + metal_token_refresher_image_name: "docker-images.metal-stack.kubernetes.metal-token-refresher.name" # partition metal_core_image_tag: "docker-images.metal-stack.partition.metal-core.tag" metal_core_image_name: "docker-images.metal-stack.partition.metal-core.name" diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index 973e7fe5e..d365dc9f5 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -204,6 +204,25 @@ metal_console_pdb_enabled: false metal_console_pdb_min_available: 1 metal_console_tcproute_enabled: false metal_console_tcproute_parent_refs: [] +metal_console_token_expiration: 8h +metal_console_token_refresher_image_name: "{{ metal_token_refresher_image_name }}" +metal_console_token_refresher_image_tag: "{{ metal_token_refresher_image_tag }}" +metal_console_token_refresher_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}" +metal_console_token_refresher_resources: +metal_console_token_refresher_schedule: "@hourly" +metal_console_token_permissions: + - self: + methods: + - /metalstack.api.v2.UserService/Get + - /metalstack.api.v2.TokenService/Refresh + - /metalstack.api.v2.PartitionService/List + - admin: + methods: + - /metalstack.admin.v2.MachineService/Get + - infra: + methods: + - /metalstack.infra.v2.ComponentService/Ping + # ingress metal_deploy_ingress: true metal_deploy_ingress_api_v1_rules: "{{ True if not metal_api_httproute_enabled else False }}" diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml new file mode 100644 index 000000000..c55ec0308 --- /dev/null +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -0,0 +1,22 @@ +--- +- name: create api token for metal-console + delegate_to: localhost + environment: + METALCTLV2_API_URL: "{{ metal_apiserver_url }}" + METALCTLV2_API_TOKEN: "{{ hostvars['localhost'].metal_deployment_admin_token }}" + block: + - name: Create metal-console tenant + metal_v2_admin_tenant: + identifier: metal-console + name: metal-console + description: tenant used by the metal-console + register: _tenant + + - name: Create metal-console api token + metal_v2_admin_token: + identifier: metal-console + user: "{{ _tenant.id }}" + description: "metal-console token + expires: "{{ metal_console_token_expiration }}" + permissions: "{{ metal_console_token_permissions }}" + register: _token diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index cef07e99f..196d8ae83 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -24,12 +24,38 @@ - metal_ipam_image_tag is defined - metal_console_image_name is defined - metal_console_image_tag is defined + - metal_console_token_refresher_image_name is defined + - metal_console_token_refresher_image_tag is defined - metal_helm_chart_local_path is not none or metal_helm_chart is defined - metal_helm_chart_local_path is not none or metal_helm_chart_tag is defined - not metal_api_s3_enabled or metal_api_s3_address is not none - not metal_apiserver_enabled or metal_apiserver_oidc_client_id is not none - not metal_apiserver_enabled or metal_apiserver_oidc_client_secret is not none +- name: Create metal-apiserver token for metal-console + ansible.builtin.import_role: + name: metal-roles/common/roles/metal-deployment-token + when: metal_console_enabled + +- name: Create metal-console token + ansible.builtin.import_tasks: console-token.yaml + when: metal_console_enabled + +- name: Create metal-console-token secret + kubernetes.core.k8s: + definition: + apiVersion: v1 + kind: Secret + metadata: + name: "metal-console-token" + namespace: "{{ metal_control_plane_namespace }}" + labels: + app: metal-console + data: + token: "{{ _token.secret | b64encode }}" + apply: true + when: '"secret" in _token and metal_console_enabled' + - name: Deploy metal control plane ansible.builtin.include_role: name: ansible-common/roles/helm-chart diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2 index 056a21089..5aa15ad58 100644 --- a/control-plane/roles/metal/templates/metal-values.j2 +++ b/control-plane/roles/metal/templates/metal-values.j2 @@ -18,6 +18,10 @@ images: image: "{{ metal_console_image_name }}" imagePullPolicy: "{{ metal_console_image_pull_policy }}" tag: "{{ metal_console_image_tag }}" + metal_console_token_refresher: + image: "{{ metal_console_token_refresher_image_name }}" + imagePullPolicy: "{{ metal_console_token_refresher_image_pull_policy }}" + tag: "{{ metal_console_token_refresher_image_tag }}" masterdata_api: image: "{{ metal_masterdata_api_image_name }}" imagePullPolicy: "{{ metal_masterdata_api_image_pull_policy }}" @@ -41,6 +45,9 @@ resources: {% if metal_console_resources %} metal_console: {{ metal_console_resources | to_json }} {% endif %} +{% if metal_console_token_refresher_resources %} + metal_console_token_refresher: {{ metal_console_token_refresher_resources | to_json }} +{% endif %} {% if metal_ipam_resources %} ipam: {{ metal_ipam_resources | to_json }} {% endif %} @@ -69,6 +76,12 @@ metal_console: client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}" client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}" ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}" + token_file_secret_ref: + name: metal-console-token + key: token + + token_refresher: + schedule: {{ metal_console_token_refresher_schedule | to_json }} ports: metal_api: {{ metal_api_port }} From c8d2ed13acc904b49c2ebf5c9a262c7fb2ff9d72 Mon Sep 17 00:00:00 2001 From: Gerrit Date: Fri, 14 Aug 2026 10:30:26 +0200 Subject: [PATCH 2/7] =?UTF-8?q?Syntaktisch=20fragw=C3=BCrdig?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- control-plane/roles/metal/tasks/console-token.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml index c55ec0308..99ef219ec 100644 --- a/control-plane/roles/metal/tasks/console-token.yaml +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -16,7 +16,7 @@ metal_v2_admin_token: identifier: metal-console user: "{{ _tenant.id }}" - description: "metal-console token + description: metal-console token expires: "{{ metal_console_token_expiration }}" permissions: "{{ metal_console_token_permissions }}" register: _token From 61e3003542dabb531b080847b6188a4cd522d486 Mon Sep 17 00:00:00 2001 From: Gerrit Date: Fri, 14 Aug 2026 10:33:19 +0200 Subject: [PATCH 3/7] Meta --- control-plane/roles/metal/meta/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/control-plane/roles/metal/meta/main.yml b/control-plane/roles/metal/meta/main.yml index 315c69059..b30b07367 100644 --- a/control-plane/roles/metal/meta/main.yml +++ b/control-plane/roles/metal/meta/main.yml @@ -13,5 +13,6 @@ galaxy_info: dependencies: - role: ansible-common + - role: metal-ansible-modules - role: metal-roles/common/roles/defaults - role: metal-roles/control-plane/roles/defaults From 6006fb277d56bacf5cb0f671f8c944572a2866d2 Mon Sep 17 00:00:00 2001 From: Gerrit Date: Fri, 14 Aug 2026 10:46:38 +0200 Subject: [PATCH 4/7] Renaming. --- control-plane/roles/metal/tasks/console-token.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml index 99ef219ec..28d173e6b 100644 --- a/control-plane/roles/metal/tasks/console-token.yaml +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -2,8 +2,8 @@ - name: create api token for metal-console delegate_to: localhost environment: - METALCTLV2_API_URL: "{{ metal_apiserver_url }}" - METALCTLV2_API_TOKEN: "{{ hostvars['localhost'].metal_deployment_admin_token }}" + METAL_APIV2_URL: "{{ metal_apiserver_url }}" + METAL_APIV2_TOKEN: "{{ hostvars['localhost'].metal_deployment_admin_token }}" block: - name: Create metal-console tenant metal_v2_admin_tenant: From ce363b6ae3fcd12feab51291c7f16a58ff0dde6a Mon Sep 17 00:00:00 2001 From: Gerrit Date: Fri, 14 Aug 2026 10:48:51 +0200 Subject: [PATCH 5/7] Linti linti --- control-plane/roles/metal/tasks/console-token.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml index 28d173e6b..12f57bfce 100644 --- a/control-plane/roles/metal/tasks/console-token.yaml +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -1,5 +1,5 @@ --- -- name: create api token for metal-console +- name: Create api token for metal-console delegate_to: localhost environment: METAL_APIV2_URL: "{{ metal_apiserver_url }}" From 244e0acaa3c19df9c7c53c3c81cb72397cc7d2ec Mon Sep 17 00:00:00 2001 From: Stefan Majer Date: Thu, 3 Sep 2026 11:44:02 +0200 Subject: [PATCH 6/7] Reduce required permissions --- control-plane/roles/metal/defaults/main.yaml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index 21db8cde1..03a0849f9 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -212,14 +212,6 @@ metal_console_token_refresher_image_pull_policy: "{{ metal_control_plane_image_p metal_console_token_refresher_resources: metal_console_token_refresher_schedule: "@hourly" metal_console_token_permissions: - - self: - methods: - - /metalstack.api.v2.UserService/Get - - /metalstack.api.v2.TokenService/Refresh - - /metalstack.api.v2.PartitionService/List - - admin: - methods: - - /metalstack.admin.v2.MachineService/Get - infra: methods: - /metalstack.infra.v2.ComponentService/Ping From dfae7537d425ebcb3e4255c7b98a91d2e1089d73 Mon Sep 17 00:00:00 2001 From: Stefan Majer Date: Thu, 3 Sep 2026 14:03:17 +0200 Subject: [PATCH 7/7] Fix --- control-plane/roles/metal/defaults/main.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index 03a0849f9..aa7accd21 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -212,6 +212,9 @@ metal_console_token_refresher_image_pull_policy: "{{ metal_control_plane_image_p metal_console_token_refresher_resources: metal_console_token_refresher_schedule: "@hourly" metal_console_token_permissions: + - self: + methods: + - /metalstack.api.v2.TokenService/Refresh - infra: methods: - /metalstack.infra.v2.ComponentService/Ping