From 0daee69db7c05d3063ff839d8e86b1dbfb21fe1d Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Thu, 16 Jul 2026 15:13:35 +0200 Subject: [PATCH 1/6] feat: first draft of image cache sync --- deploy_partition.yaml | 14 ++++++++++++++ inventories/group_vars/all/release_vector.yaml | 2 +- inventories/group_vars/partition/image_cache.yaml | 2 ++ 3 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 inventories/group_vars/partition/image_cache.yaml diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 2ad4de4d..0320b785 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -99,6 +99,20 @@ tags: always - name: metal-roles/partition/roles/pixiecore tags: pixiecore + +- name: Deploy image-cache-sync + hosts: leaf01 + roles: + - name: ansible-common + tags: always + - name: metal-ansible-modules + tags: always + + - name: metal-roles/common/roles/metal-deployment-token + tags: always + + - name: metal-roles/partition/roles/image-cache + tags: always - name: Deploy monitoring on leaf01 hosts: leaf01 diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index 0fba64d3..b87fa93f 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -38,7 +38,7 @@ metal_stack_release_vectors: ## # ansible_common_version: -# metal_roles_version: pr- +metal_roles_version: pr-453-migrate-metal-image-cache-sync-to-metal-apiserver # metal_ansible_modules_version: ## diff --git a/inventories/group_vars/partition/image_cache.yaml b/inventories/group_vars/partition/image_cache.yaml new file mode 100644 index 00000000..aab913ca --- /dev/null +++ b/inventories/group_vars/partition/image_cache.yaml @@ -0,0 +1,2 @@ +image_cache_sync_metal_apiserver_url: "{{ metal_apiserver_url }}" + From aef031a6d1a44ea8e845c911df8ad4bffcc000d1 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 17 Jul 2026 15:03:47 +0200 Subject: [PATCH 2/6] feat: first successful deployment --- compose.yaml | 2 ++ deploy_partition.yaml | 33 +++++++++++-------- inventories/control-plane.yaml | 1 + .../group_vars/all/release_vector.yaml | 7 ++-- .../group_vars/control_plane/metal.yml | 1 + .../group_vars/partition/image_cache.yaml | 7 ++++ inventories/partition.yaml | 1 + 7 files changed, 37 insertions(+), 15 deletions(-) diff --git a/compose.yaml b/compose.yaml index 8fd3e0d9..e2e5b54a 100644 --- a/compose.yaml +++ b/compose.yaml @@ -35,6 +35,8 @@ services: environment: - ANSIBLE_DISPLAY_SKIPPED_HOSTS=${ANSIBLE_DISPLAY_SKIPPED_HOSTS:-false} - ANSIBLE_INVENTORY=inventories/partition.yaml,clab-mini-lab/ansible-inventory.yml + - KUBECONFIG=/mini-lab/.kubeconfig + - K8S_AUTH_KUBECONFIG=/mini-lab/.kubeconfig - CI=${CI} - DOCKER_HUB_USER=${DOCKER_HUB_USER} - DOCKER_HUB_TOKEN=${DOCKER_HUB_TOKEN} diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 0320b785..d0643469 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -91,6 +91,25 @@ pull: true failed_when: false +- name: Install python client and generate deployment token + hosts: localhost + connection: local + gather_facts: false + pre_tasks: + - name: Wait until the metal-apiserver is running + kubernetes.core.k8s_info: + kind: Deployment + name: metal-apiserver + namespace: "{{ metal_control_plane_namespace }}" + wait: true + wait_sleep: 1 + wait_timeout: 600 + roles: + - name: ansible-common + tags: always + - name: metal-roles/common/roles/metal-v2-client + - name: metal-roles/common/roles/metal-deployment-token + - name: Deploy pixiecore on leaf01 hosts: leaf01 become: true @@ -99,20 +118,8 @@ tags: always - name: metal-roles/partition/roles/pixiecore tags: pixiecore - -- name: Deploy image-cache-sync - hosts: leaf01 - roles: - - name: ansible-common - tags: always - - name: metal-ansible-modules - tags: always - - - name: metal-roles/common/roles/metal-deployment-token - tags: always - - name: metal-roles/partition/roles/image-cache - tags: always + tags: image-cache - name: Deploy monitoring on leaf01 hosts: leaf01 diff --git a/inventories/control-plane.yaml b/inventories/control-plane.yaml index e8413def..13ab9076 100644 --- a/inventories/control-plane.yaml +++ b/inventories/control-plane.yaml @@ -3,3 +3,4 @@ control_plane: hosts: localhost: ansible_python_interpreter: "{{ ansible_playbook_python }}" + ansible_connection: local diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index b87fa93f..bad58d4f 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -12,7 +12,7 @@ metal_stack_release_vectors: # metal_api_image_name: # metal_api_image_tag: # metal_apiserver_image_name: -# metal_apiserver_image_tag: +metal_apiserver_image_tag: v0.8.0 # metal_tenant_apiserver_image_name: # metal_tenant_apiserver_image_tag: # metal_metalctl_image_name: @@ -30,6 +30,9 @@ metal_stack_release_vectors: # headscale_db_image_name: postgres # sonic_configdb_utils_image_name: # sonic_configdb_utils_image_tag: +image_cache_sync_image_name: ghcr.io/metal-stack/metal-image-cache-sync +image_cache_sync_image_tag: pr-21-migrate-to-metal-apiserver +metal_api_version: v0.3.1 # ... # @@ -39,7 +42,7 @@ metal_stack_release_vectors: # ansible_common_version: metal_roles_version: pr-453-migrate-metal-image-cache-sync-to-metal-apiserver -# metal_ansible_modules_version: +metal_ansible_modules_version: v2-updates ## ## helm charts diff --git a/inventories/group_vars/control_plane/metal.yml b/inventories/group_vars/control_plane/metal.yml index 40db02a6..6ddabf57 100644 --- a/inventories/group_vars/control_plane/metal.yml +++ b/inventories/group_vars/control_plane/metal.yml @@ -20,6 +20,7 @@ metal_apiserver_url: http://v2.{{ metal_control_plane_ingress_dns }}:8080 metal_apiserver_oidc_discovery_url: https://auth.{{ metal_control_plane_ingress_dns }}:4443/.well-known/openid-configuration metal_apiserver_oidc_end_session_url: "https://auth.{{ metal_control_plane_ingress_dns }}:4443/oidc/v1/end_session" +metal_apiserver_session_secret: long-secret metal_apiserver_secure_cookie: false diff --git a/inventories/group_vars/partition/image_cache.yaml b/inventories/group_vars/partition/image_cache.yaml index aab913ca..ab66b26c 100644 --- a/inventories/group_vars/partition/image_cache.yaml +++ b/inventories/group_vars/partition/image_cache.yaml @@ -1,2 +1,9 @@ +metal_control_plane_ingress_dns: 172.17.0.1.nip.io +metal_apiserver_url: http://v2.{{ metal_control_plane_ingress_dns }}:8080 image_cache_sync_metal_apiserver_url: "{{ metal_apiserver_url }}" +image_cache_sync_token_expiration: 20m +image_cache_sync_excludes: + - "/pull_requests/" + - "/stable/" +image_cache_sync_expiration_grace_period: 100 diff --git a/inventories/partition.yaml b/inventories/partition.yaml index fb3aa8a3..c94ed694 100644 --- a/inventories/partition.yaml +++ b/inventories/partition.yaml @@ -6,6 +6,7 @@ partition: hosts: localhost: ansible_python_interpreter: "{{ ansible_playbook_python }}" + ansible_connection: local children: dell_sonic: leaves: From cd244815eb5392e8931d8abd3df4d1214d7b430f Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 20 Jul 2026 11:46:44 +0200 Subject: [PATCH 3/6] feat: wait for admin_editor_token secret --- deploy_partition.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index d0643469..421d7de8 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -104,6 +104,14 @@ wait: true wait_sleep: 1 wait_timeout: 600 + - name: Wait until the admin_editor_token secret exists + kubernetes.core.k8s_info: + kind: Secret + name: "{{ metal_deployment_token_secret_name }}" + namespace: "{{ metal_deployment_token_secret_namespace }}" + wait: true + wait_sleep: 1 + wait_timeout: 600 roles: - name: ansible-common tags: always From dbe2f893d9f310752b3202044c415a03092fd037 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 20 Jul 2026 11:47:33 +0200 Subject: [PATCH 4/6] tmp: override release vector --- inventories/group_vars/all/release_vector.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index bad58d4f..436f45f3 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -12,7 +12,7 @@ metal_stack_release_vectors: # metal_api_image_name: # metal_api_image_tag: # metal_apiserver_image_name: -metal_apiserver_image_tag: v0.8.0 +metal_apiserver_image_tag: pr-274-image-cache-sync-permission # metal_tenant_apiserver_image_name: # metal_tenant_apiserver_image_tag: # metal_metalctl_image_name: From 5ce595d2ba6c0396a4bd2333010a28315c74ec1d Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Tue, 21 Jul 2026 10:17:06 +0200 Subject: [PATCH 5/6] feat: explicit metal-deployment-token --- deploy_partition.yaml | 2 ++ inventories/group_vars/all/release_vector.yaml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 421d7de8..12d87b39 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -126,6 +126,8 @@ tags: always - name: metal-roles/partition/roles/pixiecore tags: pixiecore + - name: metal-roles/common/roles/metal-deployment-token + tags: image-cache - name: metal-roles/partition/roles/image-cache tags: image-cache diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index 436f45f3..49b02d04 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -12,7 +12,7 @@ metal_stack_release_vectors: # metal_api_image_name: # metal_api_image_tag: # metal_apiserver_image_name: -metal_apiserver_image_tag: pr-274-image-cache-sync-permission +metal_apiserver_image_tag: v0.8.1 # metal_tenant_apiserver_image_name: # metal_tenant_apiserver_image_tag: # metal_metalctl_image_name: From 57a2996c30d8d79227f80650d8dd78b0bc971d50 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Tue, 21 Jul 2026 10:49:21 +0200 Subject: [PATCH 6/6] fix: remove unnecessary local connection --- inventories/control-plane.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/inventories/control-plane.yaml b/inventories/control-plane.yaml index 13ab9076..e8413def 100644 --- a/inventories/control-plane.yaml +++ b/inventories/control-plane.yaml @@ -3,4 +3,3 @@ control_plane: hosts: localhost: ansible_python_interpreter: "{{ ansible_playbook_python }}" - ansible_connection: local