From 4347937d40cc33fd7950a1572fbdfbb52b771913 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Tue, 2 Jun 2026 09:13:20 +0200 Subject: [PATCH 01/17] feat: token renewal for metal-console --- control-plane/roles/metal/README.md | 2 ++ control-plane/roles/metal/defaults/main.yaml | 16 +++++++++++----- control-plane/roles/metal/tasks/main.yaml | 7 +++++++ .../roles/metal/templates/metal-values.j2 | 2 ++ 4 files changed, 22 insertions(+), 5 deletions(-) diff --git a/control-plane/roles/metal/README.md b/control-plane/roles/metal/README.md index d7fb15aa3..ca9d6ce77 100644 --- a/control-plane/roles/metal/README.md +++ b/control-plane/roles/metal/README.md @@ -195,6 +195,8 @@ You can look up all the default values of this role [here](defaults/main.yaml). | metal_console_pdb_min_available | | The minimum number of available pods for the metal-console Pod Disruption Budget | | metal_console_tcproute_enabled | | Deploys a Gateway API TCPRoute exposing the metal-console | | metal_console_tcproute_parent_refs | | List of `parentRefs` (Gateways) the metal-console TCPRoute attaches to | +| metal_console_token | | The metal-apiserver token for the metal-console | +| metal_console_token_renewal | | Configuration regarding the renewal of the metal-apiserver token in Kubernetes | ### ipam diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index 1f45d9267..e3f301f0f 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -58,9 +58,11 @@ metal_apiserver_rate_limiting_max_requests_per_minute: 1000 metal_apiserver_rate_limiting_max_unauthenticated_requests_per_minute: 50 metal_apiserver_oidc_discovery_url: metal_apiserver_oidc_end_session_url: -metal_apiserver_oidc_client_id: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_id +metal_apiserver_oidc_client_id: + "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_id | default('') | b64decode }}" -metal_apiserver_oidc_client_secret: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_secret +metal_apiserver_oidc_client_secret: + "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_secret | default('') | b64decode }}" metal_apiserver_session_secret: secret metal_apiserver_secure_cookie: true @@ -90,7 +92,8 @@ metal_api_nsq_http_address: "nsqd:4151" metal_api_nsq_lookupd_address: "nsq-lookupd:4161" metal_api_nsq_tls_enabled: true metal_api_nsq_tls_secret_name: nsqd -metal_api_nsq_tls_checksum: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='nsqd').get('data', {}) | string +metal_api_nsq_tls_checksum: + "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='nsqd').get('data', {}) | string | hash('sha1') if metal_api_nsq_tls_enabled else None }}" metal_api_grpc_tls_enabled: true metal_api_bmc_superuser_enabled: false @@ -178,6 +181,9 @@ metal_console_pdb_enabled: false metal_console_pdb_min_available: 1 metal_console_tcproute_enabled: false metal_console_tcproute_parent_refs: [] +metal_console_token: +metal_console_token_renewal: {} + # ingress metal_deploy_ingress: true metal_deploy_ingress_api_v1_rules: "{{ True if not metal_api_httproute_enabled else False }}" @@ -189,7 +195,8 @@ metal_ingress_v2_dns: v2.{{ metal_control_plane_ingress_dns }} # headscale metal_api_headscale_enabled: false metal_api_headscale_tls: true -metal_api_headscale_api_key: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='headscale-api-key').get('data', +metal_api_headscale_api_key: + "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='headscale-api-key').get('data', {}).get('key') | b64decode if metal_api_headscale_enabled else '' }}" metal_api_headscale_control_plane_address: >- {% if headscale_httproute_enabled | default(false) -%} @@ -198,7 +205,6 @@ metal_api_headscale_control_plane_address: >- http{{ 's' if metal_api_headscale_tls }}://headscale.{{ metal_control_plane_ingress_dns }} {%- endif %} metal_api_headscale_internal_api_address: "headscale:50443" - # auditing metal_auditing_timescaledb_enabled: false metal_auditing_timescaledb_host: "auditing-timescaledb" diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index cef07e99f..c131fd625 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -56,3 +56,10 @@ retries: 60 delay: 10 when: metal_check_api_available + +- name: Create metal-apiserver token for metal-console + include_role: + name: metal-roles/common/roles/metal-deployment-token + vars: + metal_deployment_token_admin_role: "ADMIN_ROLE_VIEWER" + metal_deployment_token_expiration: "1h" diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2 index 0f36dec76..cecec27d8 100644 --- a/control-plane/roles/metal/templates/metal-values.j2 +++ b/control-plane/roles/metal/templates/metal-values.j2 @@ -69,6 +69,8 @@ metal_console: client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}" client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}" ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}" + token: {{ metal_console_token | to_json }} + token_renewal: {{ metal_console_token_renewal | to_json }} ports: metal_api: {{ metal_api_port }} From d616548a0b6daf0d158d4331a6d5742ab537855e Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Wed, 3 Jun 2026 13:31:36 +0200 Subject: [PATCH 02/17] refactor: separate metal-console chart --- control-plane/roles/metal/defaults/main.yaml | 1 + .../roles/metal/tasks/console-token.yaml | 27 +++++++++++++++++++ control-plane/roles/metal/tasks/main.yaml | 26 +++++++++++++++--- 3 files changed, 51 insertions(+), 3 deletions(-) create mode 100644 control-plane/roles/metal/tasks/console-token.yaml diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index e3f301f0f..8ffba4015 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -181,6 +181,7 @@ metal_console_pdb_enabled: false metal_console_pdb_min_available: 1 metal_console_tcproute_enabled: false metal_console_tcproute_parent_refs: [] +metal_console_token_expiration: 8h metal_console_token: metal_console_token_renewal: {} diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml new file mode 100644 index 000000000..b06c77b4e --- /dev/null +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -0,0 +1,27 @@ +--- +- name: create api token for metal-console + block: + + - name: create metal-console tenant + metal_v2_admin_tenant: + name: metal-console + description: tenant used by the metal-console service in the metal-stack control + plane + register: _tenant + + - name: create metal-console api token + metal_v2_admin_token: + user: "{{ _tenant.id }}" + description: "metal-console token" + expires: "{{ metal_console_token_expiration }}" + permissions: + - subject: "*" + methods: + - /metalstack.admin.v2.MachineService/Get + - /metalstack.api.v2.TokenService/Refresh + register: metal_console_token + + delegate_to: localhost + environment: + METALCTLV2_API_URL: "{{ metal_console_metal_apiserver_url }}" + METALCTLV2_API_TOKEN: "{{ hostvars['localhost'].metal_deployment_admin_token }}" diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index c131fd625..e3e394cef 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -58,8 +58,28 @@ when: metal_check_api_available - name: Create metal-apiserver token for metal-console - include_role: + import_role: name: metal-roles/common/roles/metal-deployment-token + +- name: Check metal-deployment-token has run + assert: + fail_msg: "this role requires the metal-deployment-token role to be run before + execution, check role documentation" + quiet: yes + that: + - "'metal_deployment_admin_token' in hostvars['localhost']" + +- name: Deploy metal console + include_role: + name: ansible-common/roles/helm-chart vars: - metal_deployment_token_admin_role: "ADMIN_ROLE_VIEWER" - metal_deployment_token_expiration: "1h" + helm_chart_version: "{{ metal_helm_chart_version if metal_helm_chart_local_path + is not none else metal_helm_chart_tag }}" + helm_chart_custom_folder: "{{ metal_helm_chart_local_path | default(omit) }}" + helm_chart: "oci://ghcr.io/metal-stack/helm-charts/metal-console:v0.8.3-pull-request.161" + helm_release_name: metal-console + helm_target_namespace: "{{ metal_control_plane_namespace }}" + helm_value_file_template: metal-values.j2 + # deployment can take a while due to post install hooks, therefore increasing the timeout for this chart... + helm_timeout: "{{ metal_helm_chart_timeout }}" + helm_chart_inject_config_hash: true From 1a6610e3e944e6c17471368495196cbf2c9d9b27 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Wed, 3 Jun 2026 13:42:23 +0200 Subject: [PATCH 03/17] refactor: separate metal-console chart --- .../roles/metal/tasks/console-token.yaml | 15 ++++----------- control-plane/roles/metal/tasks/main.yaml | 12 +++++++++--- 2 files changed, 13 insertions(+), 14 deletions(-) diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml index b06c77b4e..5a1a6eb5d 100644 --- a/control-plane/roles/metal/tasks/console-token.yaml +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -2,16 +2,8 @@ - name: create api token for metal-console block: - - name: create metal-console tenant - metal_v2_admin_tenant: - name: metal-console - description: tenant used by the metal-console service in the metal-stack control - plane - register: _tenant - - name: create metal-console api token - metal_v2_admin_token: - user: "{{ _tenant.id }}" + metal_v2_api_token: description: "metal-console token" expires: "{{ metal_console_token_expiration }}" permissions: @@ -19,9 +11,10 @@ methods: - /metalstack.admin.v2.MachineService/Get - /metalstack.api.v2.TokenService/Refresh - register: metal_console_token + - /metalstack.infra.v2.ComponentService/Ping + register: _token delegate_to: localhost environment: - METALCTLV2_API_URL: "{{ metal_console_metal_apiserver_url }}" + METALCTLV2_API_URL: "{{ metal_apiserver_url }}" METALCTLV2_API_TOKEN: "{{ hostvars['localhost'].metal_deployment_admin_token }}" diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index e3e394cef..fddde70b4 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -69,14 +69,20 @@ that: - "'metal_deployment_admin_token' in hostvars['localhost']" +- name: Create metal-console token + import_tasks: console-token.yaml + +- name: Set metal console token + set_fact: + metal_console_token: "{{ _token.secret }}" + - name: Deploy metal console include_role: name: ansible-common/roles/helm-chart vars: - helm_chart_version: "{{ metal_helm_chart_version if metal_helm_chart_local_path - is not none else metal_helm_chart_tag }}" + helm_chart_version: "v0.1.0-pull-request.161" helm_chart_custom_folder: "{{ metal_helm_chart_local_path | default(omit) }}" - helm_chart: "oci://ghcr.io/metal-stack/helm-charts/metal-console:v0.8.3-pull-request.161" + helm_chart: "oci://ghcr.io/metal-stack/helm-charts/metal-console:v0.1.0-pull-request.161" helm_release_name: metal-console helm_target_namespace: "{{ metal_control_plane_namespace }}" helm_value_file_template: metal-values.j2 From 053d54954ff699abe6a2c09bab517eff08386cc4 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 5 Jun 2026 11:11:12 +0200 Subject: [PATCH 04/17] refactor: create console token secret without helm chart --- control-plane/roles/metal/tasks/main.yaml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index fddde70b4..5b8f96227 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -72,9 +72,20 @@ - name: Create metal-console token import_tasks: console-token.yaml -- name: Set metal console token - set_fact: - metal_console_token: "{{ _token.secret }}" +- name: Create metal-console-token secret + when: '"secret" in _token' + k8s: + definition: + apiVersion: v1 + kind: Secret + metadata: + name: "metal-console-token" + namespace: "{{ metal_control_plane_namespace }}" + labels: + app: metal-console + data: + "token": "{{ _token.secret | b64encode }}" + apply: true - name: Deploy metal console include_role: From b13a0cef5ce273d280edc9f858e5dedef348eae0 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 8 Jun 2026 15:14:49 +0200 Subject: [PATCH 05/17] chore: use new release vector --- common/roles/defaults/defaults/main.yaml | 4 ++++ control-plane/roles/metal/README.md | 5 +++++ control-plane/roles/metal/defaults/main.yaml | 2 ++ control-plane/roles/metal/tasks/main.yaml | 10 ++++++---- 4 files changed, 17 insertions(+), 4 deletions(-) diff --git a/common/roles/defaults/defaults/main.yaml b/common/roles/defaults/defaults/main.yaml index 7f283d01e..5832cede9 100644 --- a/common/roles/defaults/defaults/main.yaml +++ b/common/roles/defaults/defaults/main.yaml @@ -167,6 +167,10 @@ metal_stack_release: metal_helm_chart_repo: "helm-charts.metal-stack.metal-control-plane.repository" metal_helm_chart: "helm-charts.metal-stack.metal-control-plane.oci" metal_helm_chart_tag: "helm-charts.metal-stack.metal-control-plane.tag" + metal_console_helm_chart_version: "helm-charts.metal-stack.metal-console.version" + metal_console_helm_chart_repo: "helm-charts.metal-stack.metal-console.repository" + metal_console_helm_chart: "helm-charts.metal-stack.metal-console.oci" + metal_console_helm_chart_tag: "helm-charts.metal-stack.metal-console.tag" logging_chart_version: "helm-charts.logging.loki.version" logging_chart_repo: "helm-charts.logging.loki.repository" gardener_logging_alloy_chart_version: "helm-charts.logging.alloy.version" diff --git a/control-plane/roles/metal/README.md b/control-plane/roles/metal/README.md index ca9d6ce77..c13ea4878 100644 --- a/control-plane/roles/metal/README.md +++ b/control-plane/roles/metal/README.md @@ -197,6 +197,11 @@ You can look up all the default values of this role [here](defaults/main.yaml). | metal_console_tcproute_parent_refs | | List of `parentRefs` (Gateways) the metal-console TCPRoute attaches to | | metal_console_token | | The metal-apiserver token for the metal-console | | metal_console_token_renewal | | Configuration regarding the renewal of the metal-apiserver token in Kubernetes | +| metal_console_helm_chart | | The repository URL of the metal console oci helm chart | +| metal_console_helm_chart_tag | | The tag of the metal console oci helm chart | +| metal_console_helm_chart_version | | The version of the metal console helm chart | +| metal_console_helm_chart_local_path | | Local path to the metal console helm chart, useful for development purposes | +| metal_console_helm_chart_timeout | | Timeout for deploying the metal console helm chart | ### ipam diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index 8ffba4015..808e4f955 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -168,6 +168,8 @@ metal_ipam_pdb_enabled: true metal_ipam_pdb_min_available: 1 # metal-console +metal_console_helm_chart_local_path: +metal_console_helm_chart_timeout: "600s" metal_console_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}" metal_console_enabled: false metal_console_replicas: 3 diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index 5b8f96227..e40af9604 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -26,6 +26,8 @@ - metal_console_image_tag is defined - metal_helm_chart_local_path is not none or metal_helm_chart is defined - metal_helm_chart_local_path is not none or metal_helm_chart_tag is defined + - metal_console_helm_chart_local_path is not none or metal_console_helm_chart is defined + - metal_console_helm_chart_local_path is not none or metal_console_helm_chart_tag is defined - not metal_api_s3_enabled or metal_api_s3_address is not none - not metal_apiserver_enabled or metal_apiserver_oidc_client_id is not none - not metal_apiserver_enabled or metal_apiserver_oidc_client_secret is not none @@ -91,12 +93,12 @@ include_role: name: ansible-common/roles/helm-chart vars: - helm_chart_version: "v0.1.0-pull-request.161" - helm_chart_custom_folder: "{{ metal_helm_chart_local_path | default(omit) }}" - helm_chart: "oci://ghcr.io/metal-stack/helm-charts/metal-console:v0.1.0-pull-request.161" + helm_chart_version: "{{ metal_console_helm_chart_version if metal_console_helm_chart_local_path is not none else metal_console_helm_chart_tag }}" + helm_chart_custom_folder: "{{ metal_console_helm_chart_local_path | default(omit) }}" + helm_chart: "{{ './metal-console' if metal_console_helm_chart_local_path is not none else 'oci://' + metal_console_helm_chart }}" helm_release_name: metal-console helm_target_namespace: "{{ metal_control_plane_namespace }}" helm_value_file_template: metal-values.j2 # deployment can take a while due to post install hooks, therefore increasing the timeout for this chart... - helm_timeout: "{{ metal_helm_chart_timeout }}" + helm_timeout: "{{ metal_console_helm_chart_timeout }}" helm_chart_inject_config_hash: true From c283bb805e32ffd4aaa87ede0efc28320d9712b4 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 8 Jun 2026 16:45:53 +0200 Subject: [PATCH 06/17] feat: only install when enabled console --- control-plane/roles/metal/tasks/main.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index e40af9604..4c30b9a20 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -75,7 +75,7 @@ import_tasks: console-token.yaml - name: Create metal-console-token secret - when: '"secret" in _token' + when: '"secret" in _token and metal_console_enabled' k8s: definition: apiVersion: v1 @@ -90,6 +90,7 @@ apply: true - name: Deploy metal console + when: 'metal_console_enabled' include_role: name: ansible-common/roles/helm-chart vars: From 9f325849283c157850b91c0757724877ae3b39ec Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Thu, 11 Jun 2026 11:39:35 +0200 Subject: [PATCH 07/17] feat: separate install of metal-console and v2 --- common/roles/defaults/defaults/main.yaml | 2 + control-plane/roles/metal/README.md | 8 ++- control-plane/roles/metal/defaults/main.yaml | 6 +-- .../roles/metal/tasks/console-token.yaml | 2 +- control-plane/roles/metal/tasks/main.yaml | 13 +++-- .../metal/templates/metal-console-values.j2 | 51 +++++++++++++++++++ .../roles/metal/templates/metal-values.j2 | 2 - 7 files changed, 72 insertions(+), 12 deletions(-) create mode 100644 control-plane/roles/metal/templates/metal-console-values.j2 diff --git a/common/roles/defaults/defaults/main.yaml b/common/roles/defaults/defaults/main.yaml index 5832cede9..459ba8b92 100644 --- a/common/roles/defaults/defaults/main.yaml +++ b/common/roles/defaults/defaults/main.yaml @@ -26,6 +26,8 @@ metal_stack_release: metal_tenant_apiserver_image_name: "docker-images.metal-stack.control-plane.tenant-apiserver.name" metal_console_image_tag: "docker-images.metal-stack.control-plane.metal-console.tag" metal_console_image_name: "docker-images.metal-stack.control-plane.metal-console.name" + metal_console_v2_image_tag: "docker-images.metal-stack.control-plane.metal-console-v2.tag" + metal_console_v2_image_name: "docker-images.metal-stack.control-plane.metal-console-v2.name" metal_ipam_image_tag: "docker-images.metal-stack.control-plane.ipam.tag" metal_ipam_image_name: "docker-images.metal-stack.control-plane.ipam.name" metal_metrics_exporter_image_tag: "docker-images.metal-stack.control-plane.metal-metrics-exporter.tag" diff --git a/control-plane/roles/metal/README.md b/control-plane/roles/metal/README.md index c13ea4878..2609520f8 100644 --- a/control-plane/roles/metal/README.md +++ b/control-plane/roles/metal/README.md @@ -38,6 +38,9 @@ You can look up all the default values of this role [here](defaults/main.yaml). | metal_console_image_name | yes | Image version of the metal-console | | metal_console_image_tag | yes | Image tag of the metal-console | | metal_console_image_pull_policy | | Image pull policy of the metal-console | +| metal_console_v2_image_name | yes | Image version of the metal-console v2 | +| metal_console_v2_image_tag | yes | Image tag of the metal-console v2 | +| metal_console_v2_image_pull_policy | | Image pull policy of the metal-console v2 | | metal_masterdata_api_image_name | yes | Image version of the masterdata-api | | metal_masterdata_api_image_tag | yes | Image tag of the masterdata-api | | metal_masterdata_api_image_pull_policy | | Image pull policy of the masterdata-api | @@ -184,6 +187,7 @@ You can look up all the default values of this role [here](defaults/main.yaml). | Name | Mandatory | Description | |-------------------------------------------|-----------|----------------------------------------------------------------------------------| | metal_console_enabled | | Whether to deploy or not to deploy the metal-console | +| metal_console_v2_enabled | | Whether to deploy or not to deploy the metal-console v2 | | metal_console_replicas | | The number of deployed replicas of the metal-console | | metal_console_resources | | Sets the given container resources | | metal_console_bmc_proxy_certs_ca_cert | | The bmc-proxy ca certificate as a string (required if enabled) | @@ -195,8 +199,8 @@ You can look up all the default values of this role [here](defaults/main.yaml). | metal_console_pdb_min_available | | The minimum number of available pods for the metal-console Pod Disruption Budget | | metal_console_tcproute_enabled | | Deploys a Gateway API TCPRoute exposing the metal-console | | metal_console_tcproute_parent_refs | | List of `parentRefs` (Gateways) the metal-console TCPRoute attaches to | -| metal_console_token | | The metal-apiserver token for the metal-console | -| metal_console_token_renewal | | Configuration regarding the renewal of the metal-apiserver token in Kubernetes | +| metal_console_v2_token | | The metal-apiserver token for the metal-console | +| metal_console_v2_token_renewal | | Configuration regarding the renewal of the metal-apiserver token in Kubernetes | | metal_console_helm_chart | | The repository URL of the metal console oci helm chart | | metal_console_helm_chart_tag | | The tag of the metal console oci helm chart | | metal_console_helm_chart_version | | The version of the metal console helm chart | diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index 808e4f955..cdb79ab48 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -183,9 +183,9 @@ metal_console_pdb_enabled: false metal_console_pdb_min_available: 1 metal_console_tcproute_enabled: false metal_console_tcproute_parent_refs: [] -metal_console_token_expiration: 8h -metal_console_token: -metal_console_token_renewal: {} +metal_console_v2_token_expiration: 8h +metal_console_v2_token: +metal_console_v2_token_renewal: {} # ingress metal_deploy_ingress: true diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml index 5a1a6eb5d..b07775e70 100644 --- a/control-plane/roles/metal/tasks/console-token.yaml +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -5,7 +5,7 @@ - name: create metal-console api token metal_v2_api_token: description: "metal-console token" - expires: "{{ metal_console_token_expiration }}" + expires: "{{ metal_console_v2_token_expiration }}" permissions: - subject: "*" methods: diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index 4c30b9a20..d7f6b088a 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -24,6 +24,8 @@ - metal_ipam_image_tag is defined - metal_console_image_name is defined - metal_console_image_tag is defined + - metal_console_v2_image_name is defined + - metal_console_v2_image_tag is defined - metal_helm_chart_local_path is not none or metal_helm_chart is defined - metal_helm_chart_local_path is not none or metal_helm_chart_tag is defined - metal_console_helm_chart_local_path is not none or metal_console_helm_chart is defined @@ -60,10 +62,12 @@ when: metal_check_api_available - name: Create metal-apiserver token for metal-console + when: metal_console_v2_enabled import_role: name: metal-roles/common/roles/metal-deployment-token - name: Check metal-deployment-token has run + when: metal_console_v2_enabled assert: fail_msg: "this role requires the metal-deployment-token role to be run before execution, check role documentation" @@ -72,10 +76,11 @@ - "'metal_deployment_admin_token' in hostvars['localhost']" - name: Create metal-console token + when: metal_console_v2_enabled import_tasks: console-token.yaml - name: Create metal-console-token secret - when: '"secret" in _token and metal_console_enabled' + when: '"secret" in _token and metal_console_v2_enabled' k8s: definition: apiVersion: v1 @@ -89,8 +94,8 @@ "token": "{{ _token.secret | b64encode }}" apply: true -- name: Deploy metal console - when: 'metal_console_enabled' +- name: Deploy metal console v2 + when: 'metal_console_v2_enabled' include_role: name: ansible-common/roles/helm-chart vars: @@ -99,7 +104,7 @@ helm_chart: "{{ './metal-console' if metal_console_helm_chart_local_path is not none else 'oci://' + metal_console_helm_chart }}" helm_release_name: metal-console helm_target_namespace: "{{ metal_control_plane_namespace }}" - helm_value_file_template: metal-values.j2 + helm_value_file_template: metal-console-values.j2 # deployment can take a while due to post install hooks, therefore increasing the timeout for this chart... helm_timeout: "{{ metal_console_helm_chart_timeout }}" helm_chart_inject_config_hash: true diff --git a/control-plane/roles/metal/templates/metal-console-values.j2 b/control-plane/roles/metal/templates/metal-console-values.j2 new file mode 100644 index 000000000..d6f2361ea --- /dev/null +++ b/control-plane/roles/metal/templates/metal-console-values.j2 @@ -0,0 +1,51 @@ +--- +set_resource_limits: {{ metal_set_resource_limits }} + +images: + metal_console: + image: "{{ metal_console_v2_image_name }}" + imagePullPolicy: "{{ metal_console_v2_image_pull_policy }}" + tag: "{{ metal_console_v2_image_tag }}" + +resources: +{% if metal_console_resources %} + metal_console: {{ metal_console_resources | to_json }} +{% endif %} + placeholder: "prevents setting .resources to {} if no values are specified" + +metal_console: + enabled: {{ metal_console_enabled }} + replicas: "{{ metal_console_replicas }}" + tcpRoute: + enabled: {{ metal_console_tcproute_enabled }} + parentRefs: {{ metal_console_tcproute_parent_refs | to_json }} + bmc_proxy: + tls: + server_key_enc: "{{ metal_console_bmc_proxy_certs_server_key | b64encode }}" + server_pub_enc: "{{ metal_console_bmc_proxy_certs_server_pub | b64encode }}" + client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}" + client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}" + ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}" + token: {{ metal_console_v2_token | to_json }} + token_renewal: {{ metal_console_v2_token_renewal | to_json }} + +ports: + metal_apiserver: {{ metal_apiserver_port }} + metal_console: {{ metal_console_port }} + +metal_apiserver: + base_path: "" + +metal_registry_auth_enabled: "{{ metal_registry_auth_enabled }}" +metal_registry_auth: + auths: + "{{ metal_registry_url }}": + username: "{{ metal_registry_auth_user }}" + password: "{{ metal_registry_auth_password }}" + auth: "{{ (metal_registry_auth_user + ':' + metal_registry_auth_password) | b64encode }}" + +pod_disruption_budget: + metal_console: + enabled: {{ metal_console_pdb_enabled | lower }} + min_available: {{ metal_console_pdb_min_available }} + diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2 index cecec27d8..0f36dec76 100644 --- a/control-plane/roles/metal/templates/metal-values.j2 +++ b/control-plane/roles/metal/templates/metal-values.j2 @@ -69,8 +69,6 @@ metal_console: client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}" client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}" ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}" - token: {{ metal_console_token | to_json }} - token_renewal: {{ metal_console_token_renewal | to_json }} ports: metal_api: {{ metal_api_port }} From eac665cae2821db7876d5a8f88a2433a5ce9800e Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Thu, 11 Jun 2026 12:57:48 +0200 Subject: [PATCH 08/17] refactor: use apiserver flag for metal-console --- common/roles/defaults/defaults/main.yaml | 2 -- control-plane/roles/metal/README.md | 9 +++------ control-plane/roles/metal/defaults/main.yaml | 7 ++++--- .../roles/metal/tasks/console-token.yaml | 2 +- control-plane/roles/metal/tasks/main.yaml | 15 +++++++-------- .../roles/metal/templates/metal-console-values.j2 | 12 ++++++------ .../roles/metal/templates/metal-values.j2 | 2 +- 7 files changed, 22 insertions(+), 27 deletions(-) diff --git a/common/roles/defaults/defaults/main.yaml b/common/roles/defaults/defaults/main.yaml index 459ba8b92..5832cede9 100644 --- a/common/roles/defaults/defaults/main.yaml +++ b/common/roles/defaults/defaults/main.yaml @@ -26,8 +26,6 @@ metal_stack_release: metal_tenant_apiserver_image_name: "docker-images.metal-stack.control-plane.tenant-apiserver.name" metal_console_image_tag: "docker-images.metal-stack.control-plane.metal-console.tag" metal_console_image_name: "docker-images.metal-stack.control-plane.metal-console.name" - metal_console_v2_image_tag: "docker-images.metal-stack.control-plane.metal-console-v2.tag" - metal_console_v2_image_name: "docker-images.metal-stack.control-plane.metal-console-v2.name" metal_ipam_image_tag: "docker-images.metal-stack.control-plane.ipam.tag" metal_ipam_image_name: "docker-images.metal-stack.control-plane.ipam.name" metal_metrics_exporter_image_tag: "docker-images.metal-stack.control-plane.metal-metrics-exporter.tag" diff --git a/control-plane/roles/metal/README.md b/control-plane/roles/metal/README.md index 2609520f8..0676fa8d8 100644 --- a/control-plane/roles/metal/README.md +++ b/control-plane/roles/metal/README.md @@ -38,9 +38,6 @@ You can look up all the default values of this role [here](defaults/main.yaml). | metal_console_image_name | yes | Image version of the metal-console | | metal_console_image_tag | yes | Image tag of the metal-console | | metal_console_image_pull_policy | | Image pull policy of the metal-console | -| metal_console_v2_image_name | yes | Image version of the metal-console v2 | -| metal_console_v2_image_tag | yes | Image tag of the metal-console v2 | -| metal_console_v2_image_pull_policy | | Image pull policy of the metal-console v2 | | metal_masterdata_api_image_name | yes | Image version of the masterdata-api | | metal_masterdata_api_image_tag | yes | Image tag of the masterdata-api | | metal_masterdata_api_image_pull_policy | | Image pull policy of the masterdata-api | @@ -187,7 +184,7 @@ You can look up all the default values of this role [here](defaults/main.yaml). | Name | Mandatory | Description | |-------------------------------------------|-----------|----------------------------------------------------------------------------------| | metal_console_enabled | | Whether to deploy or not to deploy the metal-console | -| metal_console_v2_enabled | | Whether to deploy or not to deploy the metal-console v2 | +| metal_console_use_apiserver | | Determines if the metal-console should use the new v2 chart and setup | | metal_console_replicas | | The number of deployed replicas of the metal-console | | metal_console_resources | | Sets the given container resources | | metal_console_bmc_proxy_certs_ca_cert | | The bmc-proxy ca certificate as a string (required if enabled) | @@ -199,8 +196,8 @@ You can look up all the default values of this role [here](defaults/main.yaml). | metal_console_pdb_min_available | | The minimum number of available pods for the metal-console Pod Disruption Budget | | metal_console_tcproute_enabled | | Deploys a Gateway API TCPRoute exposing the metal-console | | metal_console_tcproute_parent_refs | | List of `parentRefs` (Gateways) the metal-console TCPRoute attaches to | -| metal_console_v2_token | | The metal-apiserver token for the metal-console | -| metal_console_v2_token_renewal | | Configuration regarding the renewal of the metal-apiserver token in Kubernetes | +| metal_console_token | | The metal-apiserver token for the metal-console | +| metal_console_token_renewal | | Configuration regarding the renewal of the metal-apiserver token in Kubernetes | | metal_console_helm_chart | | The repository URL of the metal console oci helm chart | | metal_console_helm_chart_tag | | The tag of the metal console oci helm chart | | metal_console_helm_chart_version | | The version of the metal console helm chart | diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index cdb79ab48..08e9a45af 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -168,6 +168,7 @@ metal_ipam_pdb_enabled: true metal_ipam_pdb_min_available: 1 # metal-console +metal_console_use_apiserver: false metal_console_helm_chart_local_path: metal_console_helm_chart_timeout: "600s" metal_console_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}" @@ -183,9 +184,9 @@ metal_console_pdb_enabled: false metal_console_pdb_min_available: 1 metal_console_tcproute_enabled: false metal_console_tcproute_parent_refs: [] -metal_console_v2_token_expiration: 8h -metal_console_v2_token: -metal_console_v2_token_renewal: {} +metal_console_token_expiration: 8h +metal_console_token: +metal_console_token_renewal: {} # ingress metal_deploy_ingress: true diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml index b07775e70..5a1a6eb5d 100644 --- a/control-plane/roles/metal/tasks/console-token.yaml +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -5,7 +5,7 @@ - name: create metal-console api token metal_v2_api_token: description: "metal-console token" - expires: "{{ metal_console_v2_token_expiration }}" + expires: "{{ metal_console_token_expiration }}" permissions: - subject: "*" methods: diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index d7f6b088a..afe60fc8c 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -24,8 +24,6 @@ - metal_ipam_image_tag is defined - metal_console_image_name is defined - metal_console_image_tag is defined - - metal_console_v2_image_name is defined - - metal_console_v2_image_tag is defined - metal_helm_chart_local_path is not none or metal_helm_chart is defined - metal_helm_chart_local_path is not none or metal_helm_chart_tag is defined - metal_console_helm_chart_local_path is not none or metal_console_helm_chart is defined @@ -62,25 +60,26 @@ when: metal_check_api_available - name: Create metal-apiserver token for metal-console - when: metal_console_v2_enabled + when: metal_console_use_apiserver import_role: name: metal-roles/common/roles/metal-deployment-token - name: Check metal-deployment-token has run - when: metal_console_v2_enabled + when: metal_console_use_apiserver assert: - fail_msg: "this role requires the metal-deployment-token role to be run before + fail_msg: + "this role requires the metal-deployment-token role to be run before execution, check role documentation" quiet: yes that: - "'metal_deployment_admin_token' in hostvars['localhost']" - name: Create metal-console token - when: metal_console_v2_enabled + when: metal_console_use_apiserver import_tasks: console-token.yaml - name: Create metal-console-token secret - when: '"secret" in _token and metal_console_v2_enabled' + when: '"secret" in _token and metal_console_use_apiserver' k8s: definition: apiVersion: v1 @@ -95,7 +94,7 @@ apply: true - name: Deploy metal console v2 - when: 'metal_console_v2_enabled' + when: metal_console_use_apiserver include_role: name: ansible-common/roles/helm-chart vars: diff --git a/control-plane/roles/metal/templates/metal-console-values.j2 b/control-plane/roles/metal/templates/metal-console-values.j2 index d6f2361ea..f1f5a5769 100644 --- a/control-plane/roles/metal/templates/metal-console-values.j2 +++ b/control-plane/roles/metal/templates/metal-console-values.j2 @@ -3,9 +3,9 @@ set_resource_limits: {{ metal_set_resource_limits }} images: metal_console: - image: "{{ metal_console_v2_image_name }}" - imagePullPolicy: "{{ metal_console_v2_image_pull_policy }}" - tag: "{{ metal_console_v2_image_tag }}" + image: "{{ metal_console_image_name }}" + imagePullPolicy: "{{ metal_console_image_pull_policy }}" + tag: "{{ metal_console_image_tag }}" resources: {% if metal_console_resources %} @@ -14,7 +14,7 @@ resources: placeholder: "prevents setting .resources to {} if no values are specified" metal_console: - enabled: {{ metal_console_enabled }} + enabled: {{ metal_console_enabled and metal_console_use_apiserver }} replicas: "{{ metal_console_replicas }}" tcpRoute: enabled: {{ metal_console_tcproute_enabled }} @@ -26,8 +26,8 @@ metal_console: client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}" client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}" ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}" - token: {{ metal_console_v2_token | to_json }} - token_renewal: {{ metal_console_v2_token_renewal | to_json }} + token: {{ metal_console_token | to_json }} + token_renewal: {{ metal_console_token_renewal | to_json }} ports: metal_apiserver: {{ metal_apiserver_port }} diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2 index 0f36dec76..da7c4d279 100644 --- a/control-plane/roles/metal/templates/metal-values.j2 +++ b/control-plane/roles/metal/templates/metal-values.j2 @@ -57,7 +57,7 @@ hpa: cpu_percentage: {{ metal_api_hpa_cpu_percentage }} metal_console: - enabled: {{ metal_console_enabled }} + enabled: {{ metal_console_enabled and not metal_console_use_apiserver }} replicas: "{{ metal_console_replicas }}" tcpRoute: enabled: {{ metal_console_tcproute_enabled }} From 9f29d819b4b37465c8cc5bd97d7cc600bff00eb4 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 09:10:17 +0200 Subject: [PATCH 09/17] fix: version conflicts --- common/roles/metal-v2-client/tasks/main.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/common/roles/metal-v2-client/tasks/main.yaml b/common/roles/metal-v2-client/tasks/main.yaml index 3a384f59a..bd57b7524 100644 --- a/common/roles/metal-v2-client/tasks/main.yaml +++ b/common/roles/metal-v2-client/tasks/main.yaml @@ -9,8 +9,10 @@ name: - metal-stack-api=={{ metal_api_version }} - bufbuild-protovalidate-protocolbuffers-python + - protobuf>=7.0 + - connectrpc>=0.10.0,<0.11.0 environment: - # to install the bug module we need for now a download from the buf.build index: + # to install the buffer module we need for now a download from the buf.build index: # https://github.com/bufbuild/protovalidate-python/pull/367 PIP_EXTRA_INDEX_URL: https://buf.build/gen/python @@ -30,6 +32,8 @@ name: - metal-stack-api - bufbuild-protovalidate-protocolbuffers-python + - protobuf>=7.0 + - connectrpc>=0.10.0,<0.11.0 environment: PIP_EXTRA_INDEX_URL: https://buf.build/gen/python when: metal_v2_client_install_latest_on_version_error | bool From 05c3261b5e0677972884921cdd53b944277dc760 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 11:18:31 +0200 Subject: [PATCH 10/17] refactor: rename token file --- common/roles/defaults/defaults/main.yaml | 2 ++ control-plane/roles/metal/defaults/main.yaml | 8 ++++++-- control-plane/roles/metal/tasks/main.yaml | 2 ++ .../metal/templates/metal-console-values.j2 | 16 ++++++++++++++-- 4 files changed, 24 insertions(+), 4 deletions(-) diff --git a/common/roles/defaults/defaults/main.yaml b/common/roles/defaults/defaults/main.yaml index 5832cede9..f2d2cfb6d 100644 --- a/common/roles/defaults/defaults/main.yaml +++ b/common/roles/defaults/defaults/main.yaml @@ -99,6 +99,8 @@ metal_stack_release: droptailer_image_name: "docker-images.metal-stack.kubernetes.droptailer.name" capms_controller_name: "docker-images.metal-stack.kubernetes.cluster-api-provider-metal-stack-controller.name" capms_controller_tag: "docker-images.metal-stack.kubernetes.cluster-api-provider-metal-stack-controller.tag" + metal_token_refresher_image_tag: "docker-images.metal-stack.kubernetes.metal-token-refresher.tag" + metal_token_refresher_image_name: "docker-images.metal-stack.kubernetes.metal-token-refresher.name" # third party alloy_image_tag: "docker-images.third-party.partition.alloy.tag" alloy_image_name: "docker-images.third-party.partition.alloy.name" diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index 08e9a45af..794f718ad 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -185,8 +185,12 @@ metal_console_pdb_min_available: 1 metal_console_tcproute_enabled: false metal_console_tcproute_parent_refs: [] metal_console_token_expiration: 8h -metal_console_token: -metal_console_token_renewal: {} +metal_console_token_refresher_image_name: "{{ metal_token_refresher_image_name }}" +metal_console_token_refresher_image_tag: "{{ metal_token_refresher_image_tag }}" +metal_console_token_refresher_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}" +metal_console_token_refresher_resources: +metal_console_token_refresher_enabled: false +metal_console_token_refresher_schedule: "@hourly" # ingress metal_deploy_ingress: true diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index afe60fc8c..908a810ea 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -24,6 +24,8 @@ - metal_ipam_image_tag is defined - metal_console_image_name is defined - metal_console_image_tag is defined + - metal_console_token_refresher_image_name is defined + - metal_console_token_refresher_image_tag is defined - metal_helm_chart_local_path is not none or metal_helm_chart is defined - metal_helm_chart_local_path is not none or metal_helm_chart_tag is defined - metal_console_helm_chart_local_path is not none or metal_console_helm_chart is defined diff --git a/control-plane/roles/metal/templates/metal-console-values.j2 b/control-plane/roles/metal/templates/metal-console-values.j2 index f1f5a5769..e1b520712 100644 --- a/control-plane/roles/metal/templates/metal-console-values.j2 +++ b/control-plane/roles/metal/templates/metal-console-values.j2 @@ -6,10 +6,17 @@ images: image: "{{ metal_console_image_name }}" imagePullPolicy: "{{ metal_console_image_pull_policy }}" tag: "{{ metal_console_image_tag }}" + metal_console_token_refresher: + image: "{{ metal_console_token_refresher_image_name }}" + imagePullPolicy: "{{ metal_console_token_refresher_image_pull_policy }}" + tag: "{{ metal_console_token_refresher_image_tag }}" resources: {% if metal_console_resources %} metal_console: {{ metal_console_resources | to_json }} +{% endif %} +{% if metal_console_token_refresher_resources %} + metal_console: {{ metal_console_token_refresher_resources | to_json }} {% endif %} placeholder: "prevents setting .resources to {} if no values are specified" @@ -26,8 +33,13 @@ metal_console: client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}" client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}" ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}" - token: {{ metal_console_token | to_json }} - token_renewal: {{ metal_console_token_renewal | to_json }} + token_file_secret_ref: + name: metal-console-token + key: token + +metal_console_token_refresher: + enabled: {{ metal_console_token_refresher_enabled | to_json }} + schedule: {{ metal_console_token_refresher_schedule | to_json }} ports: metal_apiserver: {{ metal_apiserver_port }} From 67f966cfbc14cc73f370913f0c96784e68bc19ca Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 13:22:44 +0200 Subject: [PATCH 11/17] fix: wrong permissions --- control-plane/roles/metal/tasks/console-token.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml index 5a1a6eb5d..48121acf7 100644 --- a/control-plane/roles/metal/tasks/console-token.yaml +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -1,7 +1,6 @@ --- - name: create api token for metal-console block: - - name: create metal-console api token metal_v2_api_token: description: "metal-console token" @@ -12,6 +11,11 @@ - /metalstack.admin.v2.MachineService/Get - /metalstack.api.v2.TokenService/Refresh - /metalstack.infra.v2.ComponentService/Ping + - subject: "" + methods: + - /metalstack.admin.v2.MachineService/Get + - /metalstack.api.v2.TokenService/Refresh + - /metalstack.infra.v2.ComponentService/Ping register: _token delegate_to: localhost From 37a2a52d85adeadbec89bc487c1798fc9c4bd674 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 14:42:59 +0200 Subject: [PATCH 12/17] fix: minimal permissions --- control-plane/roles/metal/tasks/console-token.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/control-plane/roles/metal/tasks/console-token.yaml b/control-plane/roles/metal/tasks/console-token.yaml index 48121acf7..78e25334b 100644 --- a/control-plane/roles/metal/tasks/console-token.yaml +++ b/control-plane/roles/metal/tasks/console-token.yaml @@ -6,11 +6,6 @@ description: "metal-console token" expires: "{{ metal_console_token_expiration }}" permissions: - - subject: "*" - methods: - - /metalstack.admin.v2.MachineService/Get - - /metalstack.api.v2.TokenService/Refresh - - /metalstack.infra.v2.ComponentService/Ping - subject: "" methods: - /metalstack.admin.v2.MachineService/Get From a3465136348d128873a1bf903967a00edb972607 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 14:55:49 +0200 Subject: [PATCH 13/17] test: is install both possible --- control-plane/roles/metal/templates/metal-values.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2 index da7c4d279..0f36dec76 100644 --- a/control-plane/roles/metal/templates/metal-values.j2 +++ b/control-plane/roles/metal/templates/metal-values.j2 @@ -57,7 +57,7 @@ hpa: cpu_percentage: {{ metal_api_hpa_cpu_percentage }} metal_console: - enabled: {{ metal_console_enabled and not metal_console_use_apiserver }} + enabled: {{ metal_console_enabled }} replicas: "{{ metal_console_replicas }}" tcpRoute: enabled: {{ metal_console_tcproute_enabled }} From bf92af1413dddcc03389d4f09d16b869de1209dd Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 15:00:12 +0200 Subject: [PATCH 14/17] Revert "test: is install both possible" This reverts commit a3465136348d128873a1bf903967a00edb972607. --- control-plane/roles/metal/templates/metal-values.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2 index 0f36dec76..da7c4d279 100644 --- a/control-plane/roles/metal/templates/metal-values.j2 +++ b/control-plane/roles/metal/templates/metal-values.j2 @@ -57,7 +57,7 @@ hpa: cpu_percentage: {{ metal_api_hpa_cpu_percentage }} metal_console: - enabled: {{ metal_console_enabled }} + enabled: {{ metal_console_enabled and not metal_console_use_apiserver }} replicas: "{{ metal_console_replicas }}" tcpRoute: enabled: {{ metal_console_tcproute_enabled }} From d84fb90b6e1f663ca6e48dc87560f00bea9e1698 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 15:15:38 +0200 Subject: [PATCH 15/17] feat: allow installing v1 and v2 api based console --- control-plane/roles/metal/templates/metal-values.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2 index da7c4d279..0f36dec76 100644 --- a/control-plane/roles/metal/templates/metal-values.j2 +++ b/control-plane/roles/metal/templates/metal-values.j2 @@ -57,7 +57,7 @@ hpa: cpu_percentage: {{ metal_api_hpa_cpu_percentage }} metal_console: - enabled: {{ metal_console_enabled and not metal_console_use_apiserver }} + enabled: {{ metal_console_enabled }} replicas: "{{ metal_console_replicas }}" tcpRoute: enabled: {{ metal_console_tcproute_enabled }} From ba145a3fdb6630fd8279f2b2bf30971e5aed9152 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 15:34:52 +0200 Subject: [PATCH 16/17] feat: separate metal-console v1 and v2 --- common/roles/defaults/defaults/main.yaml | 2 + control-plane/roles/metal/README.md | 127 ++++++++++-------- control-plane/roles/metal/defaults/main.yaml | 3 +- control-plane/roles/metal/tasks/main.yaml | 12 +- .../metal/templates/metal-console-values.j2 | 6 +- 5 files changed, 82 insertions(+), 68 deletions(-) diff --git a/common/roles/defaults/defaults/main.yaml b/common/roles/defaults/defaults/main.yaml index f2d2cfb6d..9f63de210 100644 --- a/common/roles/defaults/defaults/main.yaml +++ b/common/roles/defaults/defaults/main.yaml @@ -26,6 +26,8 @@ metal_stack_release: metal_tenant_apiserver_image_name: "docker-images.metal-stack.control-plane.tenant-apiserver.name" metal_console_image_tag: "docker-images.metal-stack.control-plane.metal-console.tag" metal_console_image_name: "docker-images.metal-stack.control-plane.metal-console.name" + metal_console_v2_image_tag: "docker-images.metal-stack.control-plane.metal-console-v2.tag" + metal_console_v2_image_name: "docker-images.metal-stack.control-plane.metal-console-v2.name" metal_ipam_image_tag: "docker-images.metal-stack.control-plane.ipam.tag" metal_ipam_image_name: "docker-images.metal-stack.control-plane.ipam.name" metal_metrics_exporter_image_tag: "docker-images.metal-stack.control-plane.metal-metrics-exporter.tag" diff --git a/control-plane/roles/metal/README.md b/control-plane/roles/metal/README.md index 0676fa8d8..1f259ac08 100644 --- a/control-plane/roles/metal/README.md +++ b/control-plane/roles/metal/README.md @@ -11,7 +11,7 @@ You can look up all the default values of this role [here](defaults/main.yaml). ### General | Name | Mandatory | Description | -|---------------------------------|-----------|----------------------------------------------------------------------------------------------------------| +| ------------------------------- | --------- | -------------------------------------------------------------------------------------------------------- | | metal_check_api_available | | Checks whether the metal-api is reachable from the outside after deployment | | metal_check_api_health_endpoint | | The endpoint to call if the metal-api is reachable from the outside after deployment | | metal_set_resource_limits | | Deploys metal components with or without resource limits (possibly disable for development environments) | @@ -24,43 +24,47 @@ You can look up all the default values of this role [here](defaults/main.yaml). ### Images -| Name | Mandatory | Description | -|------------------------------------------|-----------|-------------------------------------------| -| metal_api_image_name | yes | Image version of the metal-api | -| metal_api_image_tag | yes | Image tag of the metal-api | -| metal_api_image_pull_policy | | Image pull policy of the metal-api | -| metal_apiserver_image_tag | yes | Image version of the metal-apiserver | -| metal_apiserver_url | yes | Image tag of the metal-apiserver | -| metal_apiserver_image_pull_policy | | Image pull policy of the metal-apiserver | -| metal_metalctl_image_name | yes | Image version of metalctl | -| metal_metalctl_image_tag | yes | Image tag of metalctl | -| metal_metalctl_image_pull_policy | | Image pull policy of metalctl | -| metal_console_image_name | yes | Image version of the metal-console | -| metal_console_image_tag | yes | Image tag of the metal-console | -| metal_console_image_pull_policy | | Image pull policy of the metal-console | -| metal_masterdata_api_image_name | yes | Image version of the masterdata-api | -| metal_masterdata_api_image_tag | yes | Image tag of the masterdata-api | -| metal_masterdata_api_image_pull_policy | | Image pull policy of the masterdata-api | -| metal_tenant_apiserver_image_name | yes | Image version of the tenant-apiserver | -| metal_tenant_apiserver_image_tag | yes | Image tag of the tenant-apiserver | -| metal_tenant_apiserver_image_pull_policy | | Image pull policy of the tenant-apiserver | -| metal_ipam_image_name | yes | Image version of the ipam | -| metal_ipam_image_tag | yes | Image tag of the ipam | +| Name | Mandatory | Description | +| ---------------------------------------- | --------- | ------------------------------------------ | +| metal_api_image_name | yes | Image version of the metal-api | +| metal_api_image_tag | yes | Image tag of the metal-api | +| metal_api_image_pull_policy | | Image pull policy of the metal-api | +| metal_apiserver_image_tag | yes | Image version of the metal-apiserver | +| metal_apiserver_url | yes | Image tag of the metal-apiserver | +| metal_apiserver_image_pull_policy | | Image pull policy of the metal-apiserver | +| metal_metalctl_image_name | yes | Image version of metalctl | +| metal_metalctl_image_tag | yes | Image tag of metalctl | +| metal_metalctl_image_pull_policy | | Image pull policy of metalctl | +| metal_console_image_name | yes | Image version of the metal-console | +| metal_console_image_tag | yes | Image tag of the metal-console | +| metal_console_v2_image_name | yes | Image version of the metal-console v2 | +| metal_console_v2_image_tag | yes | Image tag of the metal-console v2 | +| metal_console_image_pull_policy | | Image pull policy of the metal-console | +| metal_token_refresher_image_name | yes | Image version of the metal-token-refresher | +| metal_token_refresher_image_tag | yes | Image tag of the metal-token-refresher | +| metal_masterdata_api_image_name | yes | Image version of the masterdata-api | +| metal_masterdata_api_image_tag | yes | Image tag of the masterdata-api | +| metal_masterdata_api_image_pull_policy | | Image pull policy of the masterdata-api | +| metal_tenant_apiserver_image_name | yes | Image version of the tenant-apiserver | +| metal_tenant_apiserver_image_tag | yes | Image tag of the tenant-apiserver | +| metal_tenant_apiserver_image_pull_policy | | Image pull policy of the tenant-apiserver | +| metal_ipam_image_name | yes | Image version of the ipam | +| metal_ipam_image_tag | yes | Image tag of the ipam | ### Service Ports -| Name | Mandatory | Description | -|-------------------------------------|-----------|-----------------------------------------------------| -| metal_api_port | | Service port of the metal-api | -| metal_api_metrics_port | | Service port of the metal-api metrics server | -| metal_masterdata_api_port | | Service port of the masterdata-api | -| metal_masterdata_api_metrics_port | | Service port of the masterdata-api metrics server | -| metal_console_port | | Service port of the metal-console | +| Name | Mandatory | Description | +| --------------------------------- | --------- | ------------------------------------------------- | +| metal_api_port | | Service port of the metal-api | +| metal_api_metrics_port | | Service port of the metal-api metrics server | +| metal_masterdata_api_port | | Service port of the masterdata-api | +| metal_masterdata_api_metrics_port | | Service port of the masterdata-api metrics server | +| metal_console_port | | Service port of the metal-console | ### metal-api | Name | Mandatory | Description | -|-------------------------------------|-----------|------------------------------------------------------------------------------------------------| +| ----------------------------------- | --------- | ---------------------------------------------------------------------------------------------- | | metal_api_replicas | | The number of deployed replicas of the metal-api | | metal_api_hpa_enabled | | Enables horizontal pod autoscaling for the metal-api | | metal_api_hpa_max | | Max amount of replicas for the HPA of the metal-api | @@ -116,7 +120,7 @@ You can look up all the default values of this role [here](defaults/main.yaml). ### metal-apiserver | Name | Mandatory | Description | -|-----------------------------------------------------------------------|-----------|------------------------------------------------------------------------------------| +| --------------------------------------------------------------------- | --------- | ---------------------------------------------------------------------------------- | | metal_apiserver_enabled | | Enables the deployment of the metal-apiserver | | metal_apiserver_replicas | | The number of deployed replicas of the metal-apiserver | | metal_apiserver_db_addresses | | The addresses of the metal-db instances | @@ -146,7 +150,7 @@ You can look up all the default values of this role [here](defaults/main.yaml). ### masterdata-api | Name | Mandatory | Description | -|----------------------------------------|-----------|-----------------------------------------------------------------------------------| +| -------------------------------------- | --------- | --------------------------------------------------------------------------------- | | metal_masterdata_api_db_address | | The URL to the masterdata database | | metal_masterdata_api_db_port | | The port of the masterdata database | | metal_masterdata_api_db_name | | The database name of the masterdata database | @@ -181,33 +185,38 @@ You can look up all the default values of this role [here](defaults/main.yaml). ### metal-console -| Name | Mandatory | Description | -|-------------------------------------------|-----------|----------------------------------------------------------------------------------| -| metal_console_enabled | | Whether to deploy or not to deploy the metal-console | -| metal_console_use_apiserver | | Determines if the metal-console should use the new v2 chart and setup | -| metal_console_replicas | | The number of deployed replicas of the metal-console | -| metal_console_resources | | Sets the given container resources | -| metal_console_bmc_proxy_certs_ca_cert | | The bmc-proxy ca certificate as a string (required if enabled) | -| metal_console_bmc_proxy_certs_server_key | | The bmc-proxy server key as a string (required if enabled) | -| metal_console_bmc_proxy_certs_server_pub | | The bmc-proxy server public key as a string (required if enabled) | -| metal_console_bmc_proxy_certs_client_cert | | The bmc-proxy client certificate as a string (required if enabled) | -| metal_console_bmc_proxy_certs_client_key | | The bmc-proxy client key as a string (required if enabled) | -| metal_console_pdb_enabled | | Enables the Pod Disruption Budget for the metal-console | -| metal_console_pdb_min_available | | The minimum number of available pods for the metal-console Pod Disruption Budget | -| metal_console_tcproute_enabled | | Deploys a Gateway API TCPRoute exposing the metal-console | -| metal_console_tcproute_parent_refs | | List of `parentRefs` (Gateways) the metal-console TCPRoute attaches to | -| metal_console_token | | The metal-apiserver token for the metal-console | -| metal_console_token_renewal | | Configuration regarding the renewal of the metal-apiserver token in Kubernetes | -| metal_console_helm_chart | | The repository URL of the metal console oci helm chart | -| metal_console_helm_chart_tag | | The tag of the metal console oci helm chart | -| metal_console_helm_chart_version | | The version of the metal console helm chart | -| metal_console_helm_chart_local_path | | Local path to the metal console helm chart, useful for development purposes | -| metal_console_helm_chart_timeout | | Timeout for deploying the metal console helm chart | +| Name | Mandatory | Description | +| ----------------------------------------------- | --------- | ------------------------------------------------------------------------------------- | +| metal_console_enabled | | Whether to deploy or not to deploy the metal-console | +| metal_console_v1_enabled | | Deploys the metal-console using metal-api | +| metal_console_v2_enabled | | Deploys the metal-console using metal-apiserver | +| metal_console_replicas | | The number of deployed replicas of the metal-console | +| metal_console_resources | | Sets the given container resources | +| metal_console_bmc_proxy_certs_ca_cert | | The bmc-proxy ca certificate as a string (required if enabled) | +| metal_console_bmc_proxy_certs_server_key | | The bmc-proxy server key as a string (required if enabled) | +| metal_console_bmc_proxy_certs_server_pub | | The bmc-proxy server public key as a string (required if enabled) | +| metal_console_bmc_proxy_certs_client_cert | | The bmc-proxy client certificate as a string (required if enabled) | +| metal_console_bmc_proxy_certs_client_key | | The bmc-proxy client key as a string (required if enabled) | +| metal_console_pdb_enabled | | Enables the Pod Disruption Budget for the metal-console | +| metal_console_pdb_min_available | | The minimum number of available pods for the metal-console Pod Disruption Budget | +| metal_console_tcproute_enabled | | Deploys a Gateway API TCPRoute exposing the metal-console | +| metal_console_tcproute_parent_refs | | List of `parentRefs` (Gateways) the metal-console TCPRoute attaches to | +| metal_console_helm_chart | | The repository URL of the metal console oci helm chart | +| metal_console_helm_chart_tag | | The tag of the metal console oci helm chart | +| metal_console_helm_chart_version | | The version of the metal console helm chart | +| metal_console_helm_chart_local_path | | Local path to the metal console helm chart, useful for development purposes | +| metal_console_helm_chart_timeout | | Timeout for deploying the metal console helm chart | +| metal_console_token_refresher_image_name | | Image version of the metal-console token-refresher, defaults to metal-token-refresher | +| metal_console_token_refresher_image_tag | | Image tag of the metal-console token-refresher, defaults to metal-token-refresher | +| metal_console_token_refresher_image_pull_policy | | Image pull policy of the metal-console_token_refresher | +| metal_console_use_apiserver | | | +| metal_console_token_refresher_enabled | | | +| metal_console_token_refresher_schedule | | | ### ipam | Name | Mandatory | Description | -|------------------------------|-----------|-----------------------------------------------------------------------------------| +| ---------------------------- | --------- | --------------------------------------------------------------------------------- | | metal_ipam_db_address | | The hostname of the ipam service | | metal_ipam_db_port | | The port of the ipam service | | metal_ipam_db_name | | The database name of the ipam service | @@ -234,7 +243,7 @@ You can look up all the default values of this role [here](defaults/main.yaml). Configuration for metal-api: | Name | Mandatory | Description | -|--------------------------------------|-----------|----------------------------------------------------------------------| +| ------------------------------------ | --------- | -------------------------------------------------------------------- | | metal_auditing_timescaledb_enabled | | Whether or not to configure timescaledb auditing. Default false. | | metal_auditing_timescaledb_host | | The timescaledb host | | metal_auditing_timescaledb_port | | The timescaledb port | @@ -245,7 +254,7 @@ Configuration for metal-api: | metal_auditing_search_backend | | Explicitly sets a configured audit backend to be used for search | | Name | Mandatory | Description | -|-----------------------------------|-----------|-------------------------------------------------------------| +| --------------------------------- | --------- | ----------------------------------------------------------- | | metal_auditing_splunk_enabled | | Whether or not to configure splunk auditing. Default false. | | metal_auditing_splunk_endpoint | | The splunk endpoint. | | metal_auditing_splunk_hec_token | | The splunk hec token. | @@ -258,7 +267,7 @@ Configuration for metal-api: Configuration for metal-apiserver: | Name | Mandatory | Description | -|------------------------------------------------|-----------|----------------------------------------------------------------------| +| ---------------------------------------------- | --------- | -------------------------------------------------------------------- | | metal_apiserver_auditing_timescaledb_enabled | | Whether or not to configure timescaledb auditing. Default true. | | metal_apiserver_auditing_timescaledb_host | | The timescaledb host | | metal_apiserver_auditing_timescaledb_port | | The timescaledb port | diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml index 794f718ad..1898cd5cf 100644 --- a/control-plane/roles/metal/defaults/main.yaml +++ b/control-plane/roles/metal/defaults/main.yaml @@ -168,11 +168,12 @@ metal_ipam_pdb_enabled: true metal_ipam_pdb_min_available: 1 # metal-console -metal_console_use_apiserver: false metal_console_helm_chart_local_path: metal_console_helm_chart_timeout: "600s" metal_console_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}" metal_console_enabled: false +metal_console_v1_enabled: true +metal_console_v2_enabled: false metal_console_replicas: 3 metal_console_resources: metal_console_bmc_proxy_certs_server_key: diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index 908a810ea..2b745630d 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -24,6 +24,8 @@ - metal_ipam_image_tag is defined - metal_console_image_name is defined - metal_console_image_tag is defined + - metal_console_v2_image_name is defined + - metal_console_v2_image_tag is defined - metal_console_token_refresher_image_name is defined - metal_console_token_refresher_image_tag is defined - metal_helm_chart_local_path is not none or metal_helm_chart is defined @@ -62,12 +64,12 @@ when: metal_check_api_available - name: Create metal-apiserver token for metal-console - when: metal_console_use_apiserver + when: metal_console_enabled and metal_console_v2_enabled import_role: name: metal-roles/common/roles/metal-deployment-token - name: Check metal-deployment-token has run - when: metal_console_use_apiserver + when: metal_console_enabled and metal_console_v2_enabled assert: fail_msg: "this role requires the metal-deployment-token role to be run before @@ -77,11 +79,11 @@ - "'metal_deployment_admin_token' in hostvars['localhost']" - name: Create metal-console token - when: metal_console_use_apiserver + when: metal_console_enabled and metal_console_v2_enabled import_tasks: console-token.yaml - name: Create metal-console-token secret - when: '"secret" in _token and metal_console_use_apiserver' + when: '"secret" in _token and metal_console_enabled and metal_console_v2_enabled' k8s: definition: apiVersion: v1 @@ -96,7 +98,7 @@ apply: true - name: Deploy metal console v2 - when: metal_console_use_apiserver + when: metal_console_enabled and metal_console_v2_enabled include_role: name: ansible-common/roles/helm-chart vars: diff --git a/control-plane/roles/metal/templates/metal-console-values.j2 b/control-plane/roles/metal/templates/metal-console-values.j2 index e1b520712..07826d830 100644 --- a/control-plane/roles/metal/templates/metal-console-values.j2 +++ b/control-plane/roles/metal/templates/metal-console-values.j2 @@ -3,9 +3,9 @@ set_resource_limits: {{ metal_set_resource_limits }} images: metal_console: - image: "{{ metal_console_image_name }}" + image: "{{ metal_console_v2_image_name }}" imagePullPolicy: "{{ metal_console_image_pull_policy }}" - tag: "{{ metal_console_image_tag }}" + tag: "{{ metal_console_v2_image_tag }}" metal_console_token_refresher: image: "{{ metal_console_token_refresher_image_name }}" imagePullPolicy: "{{ metal_console_token_refresher_image_pull_policy }}" @@ -21,7 +21,7 @@ resources: placeholder: "prevents setting .resources to {} if no values are specified" metal_console: - enabled: {{ metal_console_enabled and metal_console_use_apiserver }} + enabled: {{ metal_console_enabled and metal_console_v1_enabled }} replicas: "{{ metal_console_replicas }}" tcpRoute: enabled: {{ metal_console_tcproute_enabled }} From c7096b9f0665b09b8153e1904d40f24266d792a1 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 10 Jul 2026 15:49:10 +0200 Subject: [PATCH 17/17] fix: linting --- control-plane/roles/metal/tasks/main.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/control-plane/roles/metal/tasks/main.yaml b/control-plane/roles/metal/tasks/main.yaml index 2b745630d..77c9c4c92 100644 --- a/control-plane/roles/metal/tasks/main.yaml +++ b/control-plane/roles/metal/tasks/main.yaml @@ -65,26 +65,26 @@ - name: Create metal-apiserver token for metal-console when: metal_console_enabled and metal_console_v2_enabled - import_role: + ansible.builtin.import_role: name: metal-roles/common/roles/metal-deployment-token - name: Check metal-deployment-token has run when: metal_console_enabled and metal_console_v2_enabled - assert: + ansible.builtin.assert: fail_msg: "this role requires the metal-deployment-token role to be run before execution, check role documentation" - quiet: yes + quiet: true that: - "'metal_deployment_admin_token' in hostvars['localhost']" - name: Create metal-console token when: metal_console_enabled and metal_console_v2_enabled - import_tasks: console-token.yaml + ansible.builtin.import_tasks: console-token.yaml - name: Create metal-console-token secret when: '"secret" in _token and metal_console_enabled and metal_console_v2_enabled' - k8s: + kubernetes.core.k8s: definition: apiVersion: v1 kind: Secret @@ -99,7 +99,7 @@ - name: Deploy metal console v2 when: metal_console_enabled and metal_console_v2_enabled - include_role: + ansible.builtin.include_role: name: ansible-common/roles/helm-chart vars: helm_chart_version: "{{ metal_console_helm_chart_version if metal_console_helm_chart_local_path is not none else metal_console_helm_chart_tag }}"