From 3c9fab2be7d22253fd07293d3a7910e8ffcf03e4 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 8 Jun 2026 16:37:52 +0200 Subject: [PATCH 1/5] feat: metal-console --- .gitignore | 3 ++- deploy_control_plane.yaml | 6 ++++- files/certs/bmc-proxy/client.json | 17 ++++++++++++++ files/certs/bmc-proxy/server.json | 22 +++++++++++++++++++ .../group_vars/control_plane/metal.yml | 10 +++++++++ scripts/roll_certs.sh | 9 ++++++++ 6 files changed, 65 insertions(+), 2 deletions(-) create mode 100644 files/certs/bmc-proxy/client.json create mode 100644 files/certs/bmc-proxy/server.json diff --git a/.gitignore b/.gitignore index cf409683..f46609e9 100644 --- a/.gitignore +++ b/.gitignore @@ -16,5 +16,6 @@ sonic-vs.img files/certs/*.pem files/certs/**/*.pem files/certs/**/*.crt +files/certs/**/*.pub .vscode -vrnetlab \ No newline at end of file +vrnetlab diff --git a/deploy_control_plane.yaml b/deploy_control_plane.yaml index bd0f0241..db596be4 100644 --- a/deploy_control_plane.yaml +++ b/deploy_control_plane.yaml @@ -6,6 +6,8 @@ roles: - name: ansible-common tags: always + - name: metal-ansible-modules + tags: always - name: ingress-controller tags: ingress-controller - name: metal-roles/control-plane/roles/prepare @@ -29,6 +31,8 @@ tags: valkey - name: metal-roles/control-plane/roles/zitadel tags: auth + - name: metal-roles/common/roles/metal-v2-client + tags: metal - name: metal-roles/control-plane/roles/metal tags: metal - name: metal-roles/control-plane/roles/logging @@ -41,7 +45,7 @@ - name: deploy gardener import_playbook: deploy_gardener.yaml when: gardener_enabled and not kamaji_enabled - + - name: deploy kamaji import_playbook: deploy_kamaji.yaml when: kamaji_enabled and not gardener_enabled diff --git a/files/certs/bmc-proxy/client.json b/files/certs/bmc-proxy/client.json new file mode 100644 index 00000000..2ca23049 --- /dev/null +++ b/files/certs/bmc-proxy/client.json @@ -0,0 +1,17 @@ +{ + "CN": "bmc-proxy-client", + "hosts": [""], + "key": { + "algo": "rsa", + "size": 4096 + }, + "names": [ + { + "C": "DE", + "L": "Munich", + "O": "Metal-Stack", + "OU": "DevOps", + "ST": "Bavaria" + } + ] +} diff --git a/files/certs/bmc-proxy/server.json b/files/certs/bmc-proxy/server.json new file mode 100644 index 00000000..69fc5ca5 --- /dev/null +++ b/files/certs/bmc-proxy/server.json @@ -0,0 +1,22 @@ +{ + "CN": "metal-console", + "hosts": [ + "localhost", + "metal-console", + "metal-console.svc", + "metal-console.svc.cluster.local" + ], + "key": { + "algo": "rsa", + "size": 4096 + }, + "names": [ + { + "C": "DE", + "L": "Munich", + "O": "Metal-Stack", + "OU": "DevOps", + "ST": "Bavaria" + } + ] +} diff --git a/inventories/group_vars/control_plane/metal.yml b/inventories/group_vars/control_plane/metal.yml index 40db02a6..fb9f6d30 100644 --- a/inventories/group_vars/control_plane/metal.yml +++ b/inventories/group_vars/control_plane/metal.yml @@ -154,6 +154,16 @@ metal_masterdata_api_projects: description: Sample project with static id metal_console_enabled: false +metal_console_token_renewal: + enabled: true +metal_console_token_expiration: 15m + +metal_console_bmc_proxy_certs_ca_cert: "{{ lookup('file', 'certs/ca.pem') }}" +metal_console_bmc_proxy_certs_server_cert: "{{ lookup('file', 'certs/bmc-proxy/server.pem') }}" +metal_console_bmc_proxy_certs_server_key: "{{ lookup('file', 'certs/bmc-proxy/server-key.pem') }}" +metal_console_bmc_proxy_certs_server_pub: "{{ lookup('file', 'certs/bmc-proxy/server-key.pub') }}" +metal_console_bmc_proxy_certs_client_cert: "{{ lookup('file', 'certs/bmc-proxy/client.pem') }}" +metal_console_bmc_proxy_certs_client_key: "{{ lookup('file', 'certs/bmc-proxy/client-key.pem') }}" metal_api_grpc_certs_server_key: "{{ lookup('file', 'certs/grpc/server-key.pem') }}" metal_api_grpc_certs_server_cert: "{{ lookup('file', 'certs/grpc/server.pem') }}" diff --git a/scripts/roll_certs.sh b/scripts/roll_certs.sh index 7fc34acd..378f4f74 100755 --- a/scripts/roll_certs.sh +++ b/scripts/roll_certs.sh @@ -37,3 +37,12 @@ cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../ca-config.json -pro cat client.pem client-key.pem > client.crt rm -f *.csr popd + +echo "generating bmc-proxy certs" + +pushd bmc-proxy +cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../ca-config.json -profile=server server.json | cfssljson -bare server +cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../ca-config.json -profile=client client.json | cfssljson -bare client +rm *.csr +ssh-keygen -y -f server-key.pem > server-key.pub +popd From ccbd5e54a5ce7b3419145b5d7e467596acf79c31 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 8 Jun 2026 16:39:31 +0200 Subject: [PATCH 2/5] tmp: override versions --- inventories/group_vars/all/release_vector.yaml | 14 +++++++++++--- inventories/group_vars/control_plane/metal.yml | 2 +- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index 53d8d24c..ab8e2a7f 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -1,4 +1,6 @@ -metal_stack_release_version: develop +--- +metal_stack_release_version: separate-metal-console-helm-chart + metal_stack_release_vectors: - url: oci://ghcr.io/metal-stack/releases:{{ metal_stack_release_version }} variable_mapping_path: metal_stack_release.mapping @@ -20,7 +22,7 @@ metal_stack_release_vectors: # metal_masterdata_api_image_name: # metal_masterdata_api_image_tag: # metal_console_image_name: -# metal_console_image_tag: +metal_console_image_tag: pr-migrate-to-metal-apiserver-token-renewal # metal_core_image_name: # metal_core_image_tag: # headscale_image_tag: @@ -38,7 +40,8 @@ metal_stack_release_vectors: ## # ansible_common_version: -# metal_roles_version: +metal_roles_version: migrate-to-metal-apiserver-token-renewal + # metal_ansible_modules_version: ## @@ -46,6 +49,11 @@ metal_stack_release_vectors: ## # metal_helm_chart_tag: +metal_helm_chart_version: 0.8.3 +metal_helm_chart_tag: v0.8.3-pull-request.161 +metal_console_helm_chart_version: 0.1.0 +metal_console_helm_chart_tag: v0.1.0-pull-request.161 + # metal_helm_chart: # further overrides can be looked up in metal-roles where the mapping is defined: # https://github.com/metal-stack/metal-roles/blob/master/common/roles/defaults/defaults/main.yaml diff --git a/inventories/group_vars/control_plane/metal.yml b/inventories/group_vars/control_plane/metal.yml index fb9f6d30..eabe0ce3 100644 --- a/inventories/group_vars/control_plane/metal.yml +++ b/inventories/group_vars/control_plane/metal.yml @@ -153,7 +153,7 @@ metal_masterdata_api_projects: name: sample-project description: Sample project with static id -metal_console_enabled: false +metal_console_enabled: true metal_console_token_renewal: enabled: true metal_console_token_expiration: 15m From 71fb066f06e3bcbae5a94ce3f9da09b92893fc76 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 15 Jun 2026 08:37:14 +0200 Subject: [PATCH 3/5] test: enable --- inventories/group_vars/control_plane/metal.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/inventories/group_vars/control_plane/metal.yml b/inventories/group_vars/control_plane/metal.yml index eabe0ce3..9dc3e776 100644 --- a/inventories/group_vars/control_plane/metal.yml +++ b/inventories/group_vars/control_plane/metal.yml @@ -154,6 +154,7 @@ metal_masterdata_api_projects: description: Sample project with static id metal_console_enabled: true +metal_console_use_apiserver: true metal_console_token_renewal: enabled: true metal_console_token_expiration: 15m From 278d45a0d7fccce334a5ba6f3bc9496a018843ad Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Tue, 7 Jul 2026 16:49:31 +0200 Subject: [PATCH 4/5] remove some redundant overrides --- inventories/group_vars/all/release_vector.yaml | 8 ++------ inventories/group_vars/control_plane/metal.yml | 2 +- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index ab8e2a7f..f16357d0 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -22,7 +22,7 @@ metal_stack_release_vectors: # metal_masterdata_api_image_name: # metal_masterdata_api_image_tag: # metal_console_image_name: -metal_console_image_tag: pr-migrate-to-metal-apiserver-token-renewal +# metal_console_image_tag: pr-migrate-to-metal-apiserver-token-renewal # metal_core_image_name: # metal_core_image_tag: # headscale_image_tag: @@ -40,7 +40,7 @@ metal_console_image_tag: pr-migrate-to-metal-apiserver-token-renewal ## # ansible_common_version: -metal_roles_version: migrate-to-metal-apiserver-token-renewal +metal_roles_version: pr-611-migrate-to-metal-apiserver-token-renewal # metal_ansible_modules_version: @@ -49,10 +49,6 @@ metal_roles_version: migrate-to-metal-apiserver-token-renewal ## # metal_helm_chart_tag: -metal_helm_chart_version: 0.8.3 -metal_helm_chart_tag: v0.8.3-pull-request.161 -metal_console_helm_chart_version: 0.1.0 -metal_console_helm_chart_tag: v0.1.0-pull-request.161 # metal_helm_chart: # further overrides can be looked up in metal-roles where the mapping is defined: diff --git a/inventories/group_vars/control_plane/metal.yml b/inventories/group_vars/control_plane/metal.yml index 9dc3e776..8bae9bec 100644 --- a/inventories/group_vars/control_plane/metal.yml +++ b/inventories/group_vars/control_plane/metal.yml @@ -156,7 +156,7 @@ metal_masterdata_api_projects: metal_console_enabled: true metal_console_use_apiserver: true metal_console_token_renewal: - enabled: true + enabled: false metal_console_token_expiration: 15m metal_console_bmc_proxy_certs_ca_cert: "{{ lookup('file', 'certs/ca.pem') }}" From db488a73fb2016b50a6eec5ae8712f5942291dfd Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 13 Jul 2026 08:50:09 +0200 Subject: [PATCH 5/5] chore: overrides --- inventories/group_vars/all/release_vector.yaml | 2 +- inventories/group_vars/control_plane/metal.yml | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index f16357d0..e679d153 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -22,7 +22,7 @@ metal_stack_release_vectors: # metal_masterdata_api_image_name: # metal_masterdata_api_image_tag: # metal_console_image_name: -# metal_console_image_tag: pr-migrate-to-metal-apiserver-token-renewal +# metal_console_image_tag: pr-migrate-to-metal-apiserver-token-file # metal_core_image_name: # metal_core_image_tag: # headscale_image_tag: diff --git a/inventories/group_vars/control_plane/metal.yml b/inventories/group_vars/control_plane/metal.yml index 8bae9bec..709870a5 100644 --- a/inventories/group_vars/control_plane/metal.yml +++ b/inventories/group_vars/control_plane/metal.yml @@ -154,10 +154,9 @@ metal_masterdata_api_projects: description: Sample project with static id metal_console_enabled: true -metal_console_use_apiserver: true -metal_console_token_renewal: - enabled: false -metal_console_token_expiration: 15m +metal_console_v1_enabled: true +metal_console_v2_enabled: true +metal_console_token_refresher_enabled: true metal_console_bmc_proxy_certs_ca_cert: "{{ lookup('file', 'certs/ca.pem') }}" metal_console_bmc_proxy_certs_server_cert: "{{ lookup('file', 'certs/bmc-proxy/server.pem') }}"