Add compatibility for metal-console API V2.

common/roles/defaults/defaults/main.yaml

@@ -1,10 +1,10 @@
 ---
 metal_registry_auth_enabled: false
 metal_registry_auth_user: ""
 metal_registry_auth_password: ""
 metal_registry_url: "https://index.docker.io/v1/"
 
 metal_stack_release:
   mapping:
     # binaries
     metal_hammer_image_tag: "binaries.metal-stack.metal-hammer.version"
@@ -32,6 +32,8 @@
     metal_metrics_exporter_image_name: "docker-images.metal-stack.control-plane.metal-metrics-exporter.name"
     rethinkdb_exporter_name: "docker-images.metal-stack.control-plane.rethinkdb-exporter.name"
     rethinkdb_exporter_tag: "docker-images.metal-stack.control-plane.rethinkdb-exporter.tag"
+    metal_token_refresher_image_tag: "docker-images.metal-stack.kubernetes.metal-token-refresher.tag"
+    metal_token_refresher_image_name: "docker-images.metal-stack.kubernetes.metal-token-refresher.name"
     # partition
     metal_core_image_tag: "docker-images.metal-stack.partition.metal-core.tag"
     metal_core_image_name: "docker-images.metal-stack.partition.metal-core.name"

control-plane/roles/metal/defaults/main.yaml

@@ -205,6 +205,20 @@ metal_console_pdb_enabled: false
 metal_console_pdb_min_available: 1
 metal_console_tcproute_enabled: false
 metal_console_tcproute_parent_refs: []
+metal_console_token_expiration: 8h
+metal_console_token_refresher_image_name: "{{ metal_token_refresher_image_name }}"
+metal_console_token_refresher_image_tag: "{{ metal_token_refresher_image_tag }}"
+metal_console_token_refresher_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}"
+metal_console_token_refresher_resources:
+metal_console_token_refresher_schedule: "@hourly"
+metal_console_token_permissions:
+  - self:
+      methods:
+        - /metalstack.api.v2.TokenService/Refresh
+  - infra:
+      methods:
+        - /metalstack.infra.v2.ComponentService/Ping
+
 # ingress
 metal_deploy_ingress: true
 metal_deploy_ingress_api_v1_rules: "{{ True if not metal_api_httproute_enabled else False }}"

control-plane/roles/metal/meta/main.yml

@@ -13,5 +13,6 @@ galaxy_info:
 
 dependencies:
   - role: ansible-common
+  - role: metal-ansible-modules
   - role: metal-roles/common/roles/defaults
   - role: metal-roles/control-plane/roles/defaults

control-plane/roles/metal/tasks/console-token.yaml

@@ -0,0 +1,22 @@
+---
+- name: Create api token for metal-console
+  delegate_to: localhost
+  environment:
+    METAL_APIV2_URL: "{{ metal_apiserver_url }}"
+    METAL_APIV2_TOKEN: "{{ hostvars['localhost'].metal_deployment_admin_token }}"
+  block:
+    - name: Create metal-console tenant
+      metal_v2_admin_tenant:
+        identifier: metal-console
+        name: metal-console
+        description: tenant used by the metal-console
+      register: _tenant
+
+    - name: Create metal-console api token
+      metal_v2_admin_token:
+        identifier: metal-console
+        user: "{{ _tenant.id }}"
+        description: metal-console token
+        expires: "{{ metal_console_token_expiration }}"
+        permissions: "{{ metal_console_token_permissions }}"
+      register: _token

control-plane/roles/metal/tasks/main.yaml

@@ -24,13 +24,39 @@
       - metal_ipam_image_tag is defined
       - metal_console_image_name is defined
       - metal_console_image_tag is defined
+      - metal_console_token_refresher_image_name is defined
+      - metal_console_token_refresher_image_tag is defined
       - metal_helm_chart_local_path is not none or metal_helm_chart is defined
       - metal_helm_chart_local_path is not none or metal_helm_chart_tag is defined
       - not metal_api_s3_enabled or metal_api_s3_address is not none
       - not metal_apiserver_enabled or metal_apiserver_oidc_client_id is not none
       - not metal_apiserver_enabled or metal_apiserver_oidc_client_secret is not none
       - not metal_apiserver_enabled or (metal_apiserver_session_secret is not none and metal_apiserver_session_secret | length >= 10)
 
+- name: Create metal-apiserver token for metal-console
+  ansible.builtin.import_role:
+    name: metal-roles/common/roles/metal-deployment-token
+  when: metal_console_enabled
+
+- name: Create metal-console token
+  ansible.builtin.import_tasks: console-token.yaml
+  when: metal_console_enabled
+
+- name: Create metal-console-token secret
+  kubernetes.core.k8s:
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: "metal-console-token"
+        namespace: "{{ metal_control_plane_namespace }}"
+        labels:
+          app: metal-console
+      data:
+        token: "{{ _token.secret | b64encode }}"
+    apply: true
+  when: '"secret" in _token and metal_console_enabled'
+
 - name: Deploy metal control plane
   ansible.builtin.include_role:
     name: ansible-common/roles/helm-chart

control-plane/roles/metal/templates/metal-values.j2

@@ -18,6 +18,10 @@ images:
     image: "{{ metal_console_image_name }}"
     imagePullPolicy: "{{ metal_console_image_pull_policy }}"
     tag: "{{ metal_console_image_tag }}"
+  metal_console_token_refresher:
+    image: "{{ metal_console_token_refresher_image_name }}"
+    imagePullPolicy: "{{ metal_console_token_refresher_image_pull_policy }}"
+    tag: "{{ metal_console_token_refresher_image_tag }}"
   masterdata_api:
     image: "{{ metal_masterdata_api_image_name }}"
     imagePullPolicy: "{{ metal_masterdata_api_image_pull_policy }}"
@@ -41,6 +45,9 @@ resources:
 {% if metal_console_resources %}
   metal_console: {{ metal_console_resources | to_json }}
 {% endif %}
+{% if metal_console_token_refresher_resources %}
+  metal_console_token_refresher: {{ metal_console_token_refresher_resources | to_json }}
+{% endif %}
 {% if metal_ipam_resources %}
   ipam: {{ metal_ipam_resources | to_json }}
 {% endif %}
@@ -69,6 +76,12 @@ metal_console:
       client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}"
       client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}"
       ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}"
+  token_file_secret_ref:
+    name: metal-console-token
+    key: token
+
+  token_refresher:
+    schedule: {{ metal_console_token_refresher_schedule | to_json }}
 
 ports:
   metal_api: {{ metal_api_port }}