feat: token renewal for metal-console

common/roles/defaults/defaults/main.yaml

@@ -1,10 +1,10 @@
 ---
 metal_registry_auth_enabled: false
 metal_registry_auth_user: ""
 metal_registry_auth_password: ""
 metal_registry_url: "https://index.docker.io/v1/"
 
 metal_stack_release:
   mapping:
     # binaries
     metal_hammer_image_tag: "binaries.metal-stack.metal-hammer.version"
@@ -26,6 +26,8 @@
     metal_tenant_apiserver_image_name: "docker-images.metal-stack.control-plane.tenant-apiserver.name"
     metal_console_image_tag: "docker-images.metal-stack.control-plane.metal-console.tag"
     metal_console_image_name: "docker-images.metal-stack.control-plane.metal-console.name"
+    metal_console_v2_image_tag: "docker-images.metal-stack.control-plane.metal-console-v2.tag"
+    metal_console_v2_image_name: "docker-images.metal-stack.control-plane.metal-console-v2.name"
     metal_ipam_image_tag: "docker-images.metal-stack.control-plane.ipam.tag"
     metal_ipam_image_name: "docker-images.metal-stack.control-plane.ipam.name"
     metal_metrics_exporter_image_tag: "docker-images.metal-stack.control-plane.metal-metrics-exporter.tag"
@@ -99,6 +101,8 @@
     droptailer_image_name: "docker-images.metal-stack.kubernetes.droptailer.name"
     capms_controller_name: "docker-images.metal-stack.kubernetes.cluster-api-provider-metal-stack-controller.name"
     capms_controller_tag: "docker-images.metal-stack.kubernetes.cluster-api-provider-metal-stack-controller.tag"
+    metal_token_refresher_image_tag: "docker-images.metal-stack.kubernetes.metal-token-refresher.tag"
+    metal_token_refresher_image_name: "docker-images.metal-stack.kubernetes.metal-token-refresher.name"
     # third party
     alloy_image_tag: "docker-images.third-party.partition.alloy.tag"
     alloy_image_name: "docker-images.third-party.partition.alloy.name"
@@ -167,6 +171,10 @@
     metal_helm_chart_repo: "helm-charts.metal-stack.metal-control-plane.repository"
     metal_helm_chart: "helm-charts.metal-stack.metal-control-plane.oci"
     metal_helm_chart_tag: "helm-charts.metal-stack.metal-control-plane.tag"
+    metal_console_helm_chart_version: "helm-charts.metal-stack.metal-console.version"
+    metal_console_helm_chart_repo: "helm-charts.metal-stack.metal-console.repository"
+    metal_console_helm_chart: "helm-charts.metal-stack.metal-console.oci"
+    metal_console_helm_chart_tag: "helm-charts.metal-stack.metal-console.tag"
     logging_chart_version: "helm-charts.logging.loki.version"
     logging_chart_repo: "helm-charts.logging.loki.repository"
     gardener_logging_alloy_chart_version: "helm-charts.logging.alloy.version"

common/roles/metal-v2-client/tasks/main.yaml

@@ -9,8 +9,10 @@
         name:
           - metal-stack-api=={{ metal_api_version }}
           - bufbuild-protovalidate-protocolbuffers-python
+          - protobuf>=7.0
+          - connectrpc>=0.10.0,<0.11.0
       environment:
-        # to install the bug module we need for now a download from the buf.build index:
+        # to install the buffer module we need for now a download from the buf.build index:
         # https://github.com/bufbuild/protovalidate-python/pull/367
         PIP_EXTRA_INDEX_URL: https://buf.build/gen/python
 
@@ -30,6 +32,8 @@
         name:
           - metal-stack-api
           - bufbuild-protovalidate-protocolbuffers-python
+          - protobuf>=7.0
+          - connectrpc>=0.10.0,<0.11.0
       environment:
         PIP_EXTRA_INDEX_URL: https://buf.build/gen/python
       when: metal_v2_client_install_latest_on_version_error | bool

control-plane/roles/metal/defaults/main.yaml

@@ -58,9 +58,11 @@ metal_apiserver_rate_limiting_max_requests_per_minute: 1000
 metal_apiserver_rate_limiting_max_unauthenticated_requests_per_minute: 50
 metal_apiserver_oidc_discovery_url:
 metal_apiserver_oidc_end_session_url:
-metal_apiserver_oidc_client_id: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_id
+metal_apiserver_oidc_client_id:
+  "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_id
   | default('') | b64decode }}"
-metal_apiserver_oidc_client_secret: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_secret
+metal_apiserver_oidc_client_secret:
+  "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_secret
   | default('') | b64decode }}"
 metal_apiserver_session_secret: secret
 metal_apiserver_secure_cookie: true
@@ -90,7 +92,8 @@ metal_api_nsq_http_address: "nsqd:4151"
 metal_api_nsq_lookupd_address: "nsq-lookupd:4161"
 metal_api_nsq_tls_enabled: true
 metal_api_nsq_tls_secret_name: nsqd
-metal_api_nsq_tls_checksum: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='nsqd').get('data', {}) | string
+metal_api_nsq_tls_checksum:
+  "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='nsqd').get('data', {}) | string
   | hash('sha1') if metal_api_nsq_tls_enabled else None }}"
 metal_api_grpc_tls_enabled: true
 metal_api_bmc_superuser_enabled: false
@@ -165,8 +168,12 @@ metal_ipam_pdb_enabled: true
 metal_ipam_pdb_min_available: 1
 
 # metal-console
+metal_console_helm_chart_local_path:
+metal_console_helm_chart_timeout: "600s"
 metal_console_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}"
 metal_console_enabled: false
+metal_console_v1_enabled: true
+metal_console_v2_enabled: false
 metal_console_replicas: 3
 metal_console_resources:
 metal_console_bmc_proxy_certs_server_key:
@@ -178,6 +185,14 @@ metal_console_pdb_enabled: false
 metal_console_pdb_min_available: 1
 metal_console_tcproute_enabled: false
 metal_console_tcproute_parent_refs: []
+metal_console_token_expiration: 8h
+metal_console_token_refresher_image_name: "{{ metal_token_refresher_image_name }}"
+metal_console_token_refresher_image_tag: "{{ metal_token_refresher_image_tag }}"
+metal_console_token_refresher_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}"
+metal_console_token_refresher_resources:
+metal_console_token_refresher_enabled: false
+metal_console_token_refresher_schedule: "@hourly"
+
 # ingress
 metal_deploy_ingress: true
 metal_deploy_ingress_api_v1_rules: "{{ True if not metal_api_httproute_enabled else False }}"
@@ -189,7 +204,8 @@ metal_ingress_v2_dns: v2.{{ metal_control_plane_ingress_dns }}
 # headscale
 metal_api_headscale_enabled: false
 metal_api_headscale_tls: true
-metal_api_headscale_api_key: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='headscale-api-key').get('data',
+metal_api_headscale_api_key:
+  "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='headscale-api-key').get('data',
   {}).get('key') | b64decode if metal_api_headscale_enabled else '' }}"
 metal_api_headscale_control_plane_address: >-
   {% if headscale_httproute_enabled | default(false) -%}
@@ -198,7 +214,6 @@ metal_api_headscale_control_plane_address: >-
   http{{ 's' if metal_api_headscale_tls }}://headscale.{{ metal_control_plane_ingress_dns }}
   {%- endif %}
 metal_api_headscale_internal_api_address: "headscale:50443"
-
 # auditing
 metal_auditing_timescaledb_enabled: false
 metal_auditing_timescaledb_host: "auditing-timescaledb"

control-plane/roles/metal/tasks/console-token.yaml

@@ -0,0 +1,19 @@
+---
+- name: create api token for metal-console
+  block:
+    - name: create metal-console api token
+      metal_v2_api_token:
+        description: "metal-console token"
+        expires: "{{ metal_console_token_expiration }}"
+        permissions:
+          - subject: ""
+            methods:
+              - /metalstack.admin.v2.MachineService/Get
+              - /metalstack.api.v2.TokenService/Refresh
+              - /metalstack.infra.v2.ComponentService/Ping
+      register: _token
+
+  delegate_to: localhost
+  environment:
+    METALCTLV2_API_URL: "{{ metal_apiserver_url }}"
+    METALCTLV2_API_TOKEN: "{{ hostvars['localhost'].metal_deployment_admin_token }}"

control-plane/roles/metal/tasks/main.yaml

@@ -24,8 +24,14 @@
       - metal_ipam_image_tag is defined
       - metal_console_image_name is defined
       - metal_console_image_tag is defined
+      - metal_console_v2_image_name is defined
+      - metal_console_v2_image_tag is defined
+      - metal_console_token_refresher_image_name is defined
+      - metal_console_token_refresher_image_tag is defined
       - metal_helm_chart_local_path is not none or metal_helm_chart is defined
       - metal_helm_chart_local_path is not none or metal_helm_chart_tag is defined
+      - metal_console_helm_chart_local_path is not none or metal_console_helm_chart is defined
+      - metal_console_helm_chart_local_path is not none or metal_console_helm_chart_tag is defined
       - not metal_api_s3_enabled or metal_api_s3_address is not none
       - not metal_apiserver_enabled or metal_apiserver_oidc_client_id is not none
       - not metal_apiserver_enabled or metal_apiserver_oidc_client_secret is not none
@@ -56,3 +62,52 @@
   retries: 60
   delay: 10
   when: metal_check_api_available
+
+- name: Create metal-apiserver token for metal-console
+  when: metal_console_enabled and metal_console_v2_enabled
+  ansible.builtin.import_role:
+    name: metal-roles/common/roles/metal-deployment-token
+
+- name: Check metal-deployment-token has run
+  when: metal_console_enabled and metal_console_v2_enabled
+  ansible.builtin.assert:
+    fail_msg:
+      "this role requires the metal-deployment-token role to be run before
+      execution, check role documentation"
+    quiet: true
+    that:
+      - "'metal_deployment_admin_token' in hostvars['localhost']"
+
+- name: Create metal-console token
+  when: metal_console_enabled and metal_console_v2_enabled
+  ansible.builtin.import_tasks: console-token.yaml
+
+- name: Create metal-console-token secret
+  when: '"secret" in _token and metal_console_enabled and metal_console_v2_enabled'
+  kubernetes.core.k8s:
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: "metal-console-token"
+        namespace: "{{ metal_control_plane_namespace }}"
+        labels:
+          app: metal-console
+      data:
+        "token": "{{ _token.secret | b64encode }}"
+    apply: true
+
+- name: Deploy metal console v2
+  when: metal_console_enabled and metal_console_v2_enabled
+  ansible.builtin.include_role:
+    name: ansible-common/roles/helm-chart
+  vars:
+    helm_chart_version: "{{ metal_console_helm_chart_version if metal_console_helm_chart_local_path is not none else metal_console_helm_chart_tag }}"
+    helm_chart_custom_folder: "{{ metal_console_helm_chart_local_path | default(omit) }}"
+    helm_chart: "{{ './metal-console' if metal_console_helm_chart_local_path is not none else 'oci://' + metal_console_helm_chart }}"
+    helm_release_name: metal-console
+    helm_target_namespace: "{{ metal_control_plane_namespace }}"
+    helm_value_file_template: metal-console-values.j2
+    # deployment can take a while due to post install hooks, therefore increasing the timeout for this chart...
+    helm_timeout: "{{ metal_console_helm_chart_timeout }}"
+    helm_chart_inject_config_hash: true

control-plane/roles/metal/templates/metal-console-values.j2

@@ -0,0 +1,63 @@
+---
+set_resource_limits: {{ metal_set_resource_limits }}
+
+images:
+  metal_console:
+    image: "{{ metal_console_v2_image_name }}"
+    imagePullPolicy: "{{ metal_console_image_pull_policy }}"
+    tag: "{{ metal_console_v2_image_tag }}"
+  metal_console_token_refresher:
+    image: "{{ metal_console_token_refresher_image_name }}"
+    imagePullPolicy: "{{ metal_console_token_refresher_image_pull_policy }}"
+    tag: "{{ metal_console_token_refresher_image_tag }}"
+
+resources:
+{% if metal_console_resources %}
+  metal_console: {{ metal_console_resources | to_json }}
+{% endif %}
+{% if metal_console_token_refresher_resources %}
+  metal_console: {{ metal_console_token_refresher_resources | to_json }}
+{% endif %}
+  placeholder: "prevents setting .resources to {} if no values are specified"
+
+metal_console:
+  enabled: {{ metal_console_enabled and metal_console_v1_enabled }}
+  replicas: "{{ metal_console_replicas }}"
+  tcpRoute:
+    enabled: {{ metal_console_tcproute_enabled }}
+    parentRefs: {{ metal_console_tcproute_parent_refs | to_json }}
+  bmc_proxy:
+    tls:
+      server_key_enc: "{{ metal_console_bmc_proxy_certs_server_key | b64encode }}"
+      server_pub_enc: "{{ metal_console_bmc_proxy_certs_server_pub | b64encode }}"
+      client_key_enc: "{{ metal_console_bmc_proxy_certs_client_key | b64encode }}"
+      client_cert_enc: "{{ metal_console_bmc_proxy_certs_client_cert | b64encode }}"
+      ca_cert_enc: "{{ metal_console_bmc_proxy_certs_ca_cert | b64encode }}"
+  token_file_secret_ref:
+    name: metal-console-token
+    key: token
+
+metal_console_token_refresher:
+  enabled: {{ metal_console_token_refresher_enabled | to_json }}
+  schedule: {{ metal_console_token_refresher_schedule | to_json }}
+
+ports:
+  metal_apiserver: {{ metal_apiserver_port }}
+  metal_console: {{ metal_console_port }}
+
+metal_apiserver:
+  base_path: ""
+
+metal_registry_auth_enabled: "{{ metal_registry_auth_enabled }}"
+metal_registry_auth:
+  auths:
+    "{{ metal_registry_url }}":
+      username: "{{ metal_registry_auth_user }}"
+      password: "{{ metal_registry_auth_password }}"
+      auth: "{{ (metal_registry_auth_user + ':' + metal_registry_auth_password) | b64encode }}"
+
+pod_disruption_budget:
+  metal_console:
+    enabled: {{ metal_console_pdb_enabled | lower }}
+    min_available: {{ metal_console_pdb_min_available }}
+