From 0daee69db7c05d3063ff839d8e86b1dbfb21fe1d Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Thu, 16 Jul 2026 15:13:35 +0200 Subject: [PATCH 01/11] feat: first draft of image cache sync --- deploy_partition.yaml | 14 ++++++++++++++ inventories/group_vars/all/release_vector.yaml | 2 +- inventories/group_vars/partition/image_cache.yaml | 2 ++ 3 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 inventories/group_vars/partition/image_cache.yaml diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 2ad4de4d..0320b785 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -99,6 +99,20 @@ tags: always - name: metal-roles/partition/roles/pixiecore tags: pixiecore + +- name: Deploy image-cache-sync + hosts: leaf01 + roles: + - name: ansible-common + tags: always + - name: metal-ansible-modules + tags: always + + - name: metal-roles/common/roles/metal-deployment-token + tags: always + + - name: metal-roles/partition/roles/image-cache + tags: always - name: Deploy monitoring on leaf01 hosts: leaf01 diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index 0fba64d3..b87fa93f 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -38,7 +38,7 @@ metal_stack_release_vectors: ## # ansible_common_version: -# metal_roles_version: pr- +metal_roles_version: pr-453-migrate-metal-image-cache-sync-to-metal-apiserver # metal_ansible_modules_version: ## diff --git a/inventories/group_vars/partition/image_cache.yaml b/inventories/group_vars/partition/image_cache.yaml new file mode 100644 index 00000000..aab913ca --- /dev/null +++ b/inventories/group_vars/partition/image_cache.yaml @@ -0,0 +1,2 @@ +image_cache_sync_metal_apiserver_url: "{{ metal_apiserver_url }}" + From aef031a6d1a44ea8e845c911df8ad4bffcc000d1 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Fri, 17 Jul 2026 15:03:47 +0200 Subject: [PATCH 02/11] feat: first successful deployment --- compose.yaml | 2 ++ deploy_partition.yaml | 33 +++++++++++-------- inventories/control-plane.yaml | 1 + .../group_vars/all/release_vector.yaml | 7 ++-- .../group_vars/control_plane/metal.yml | 1 + .../group_vars/partition/image_cache.yaml | 7 ++++ inventories/partition.yaml | 1 + 7 files changed, 37 insertions(+), 15 deletions(-) diff --git a/compose.yaml b/compose.yaml index 8fd3e0d9..e2e5b54a 100644 --- a/compose.yaml +++ b/compose.yaml @@ -35,6 +35,8 @@ services: environment: - ANSIBLE_DISPLAY_SKIPPED_HOSTS=${ANSIBLE_DISPLAY_SKIPPED_HOSTS:-false} - ANSIBLE_INVENTORY=inventories/partition.yaml,clab-mini-lab/ansible-inventory.yml + - KUBECONFIG=/mini-lab/.kubeconfig + - K8S_AUTH_KUBECONFIG=/mini-lab/.kubeconfig - CI=${CI} - DOCKER_HUB_USER=${DOCKER_HUB_USER} - DOCKER_HUB_TOKEN=${DOCKER_HUB_TOKEN} diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 0320b785..d0643469 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -91,6 +91,25 @@ pull: true failed_when: false +- name: Install python client and generate deployment token + hosts: localhost + connection: local + gather_facts: false + pre_tasks: + - name: Wait until the metal-apiserver is running + kubernetes.core.k8s_info: + kind: Deployment + name: metal-apiserver + namespace: "{{ metal_control_plane_namespace }}" + wait: true + wait_sleep: 1 + wait_timeout: 600 + roles: + - name: ansible-common + tags: always + - name: metal-roles/common/roles/metal-v2-client + - name: metal-roles/common/roles/metal-deployment-token + - name: Deploy pixiecore on leaf01 hosts: leaf01 become: true @@ -99,20 +118,8 @@ tags: always - name: metal-roles/partition/roles/pixiecore tags: pixiecore - -- name: Deploy image-cache-sync - hosts: leaf01 - roles: - - name: ansible-common - tags: always - - name: metal-ansible-modules - tags: always - - - name: metal-roles/common/roles/metal-deployment-token - tags: always - - name: metal-roles/partition/roles/image-cache - tags: always + tags: image-cache - name: Deploy monitoring on leaf01 hosts: leaf01 diff --git a/inventories/control-plane.yaml b/inventories/control-plane.yaml index e8413def..13ab9076 100644 --- a/inventories/control-plane.yaml +++ b/inventories/control-plane.yaml @@ -3,3 +3,4 @@ control_plane: hosts: localhost: ansible_python_interpreter: "{{ ansible_playbook_python }}" + ansible_connection: local diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index b87fa93f..bad58d4f 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -12,7 +12,7 @@ metal_stack_release_vectors: # metal_api_image_name: # metal_api_image_tag: # metal_apiserver_image_name: -# metal_apiserver_image_tag: +metal_apiserver_image_tag: v0.8.0 # metal_tenant_apiserver_image_name: # metal_tenant_apiserver_image_tag: # metal_metalctl_image_name: @@ -30,6 +30,9 @@ metal_stack_release_vectors: # headscale_db_image_name: postgres # sonic_configdb_utils_image_name: # sonic_configdb_utils_image_tag: +image_cache_sync_image_name: ghcr.io/metal-stack/metal-image-cache-sync +image_cache_sync_image_tag: pr-21-migrate-to-metal-apiserver +metal_api_version: v0.3.1 # ... # @@ -39,7 +42,7 @@ metal_stack_release_vectors: # ansible_common_version: metal_roles_version: pr-453-migrate-metal-image-cache-sync-to-metal-apiserver -# metal_ansible_modules_version: +metal_ansible_modules_version: v2-updates ## ## helm charts diff --git a/inventories/group_vars/control_plane/metal.yml b/inventories/group_vars/control_plane/metal.yml index 40db02a6..6ddabf57 100644 --- a/inventories/group_vars/control_plane/metal.yml +++ b/inventories/group_vars/control_plane/metal.yml @@ -20,6 +20,7 @@ metal_apiserver_url: http://v2.{{ metal_control_plane_ingress_dns }}:8080 metal_apiserver_oidc_discovery_url: https://auth.{{ metal_control_plane_ingress_dns }}:4443/.well-known/openid-configuration metal_apiserver_oidc_end_session_url: "https://auth.{{ metal_control_plane_ingress_dns }}:4443/oidc/v1/end_session" +metal_apiserver_session_secret: long-secret metal_apiserver_secure_cookie: false diff --git a/inventories/group_vars/partition/image_cache.yaml b/inventories/group_vars/partition/image_cache.yaml index aab913ca..ab66b26c 100644 --- a/inventories/group_vars/partition/image_cache.yaml +++ b/inventories/group_vars/partition/image_cache.yaml @@ -1,2 +1,9 @@ +metal_control_plane_ingress_dns: 172.17.0.1.nip.io +metal_apiserver_url: http://v2.{{ metal_control_plane_ingress_dns }}:8080 image_cache_sync_metal_apiserver_url: "{{ metal_apiserver_url }}" +image_cache_sync_token_expiration: 20m +image_cache_sync_excludes: + - "/pull_requests/" + - "/stable/" +image_cache_sync_expiration_grace_period: 100 diff --git a/inventories/partition.yaml b/inventories/partition.yaml index fb3aa8a3..c94ed694 100644 --- a/inventories/partition.yaml +++ b/inventories/partition.yaml @@ -6,6 +6,7 @@ partition: hosts: localhost: ansible_python_interpreter: "{{ ansible_playbook_python }}" + ansible_connection: local children: dell_sonic: leaves: From cd244815eb5392e8931d8abd3df4d1214d7b430f Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 20 Jul 2026 11:46:44 +0200 Subject: [PATCH 03/11] feat: wait for admin_editor_token secret --- deploy_partition.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index d0643469..421d7de8 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -104,6 +104,14 @@ wait: true wait_sleep: 1 wait_timeout: 600 + - name: Wait until the admin_editor_token secret exists + kubernetes.core.k8s_info: + kind: Secret + name: "{{ metal_deployment_token_secret_name }}" + namespace: "{{ metal_deployment_token_secret_namespace }}" + wait: true + wait_sleep: 1 + wait_timeout: 600 roles: - name: ansible-common tags: always From dbe2f893d9f310752b3202044c415a03092fd037 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Mon, 20 Jul 2026 11:47:33 +0200 Subject: [PATCH 04/11] tmp: override release vector --- inventories/group_vars/all/release_vector.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index bad58d4f..436f45f3 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -12,7 +12,7 @@ metal_stack_release_vectors: # metal_api_image_name: # metal_api_image_tag: # metal_apiserver_image_name: -metal_apiserver_image_tag: v0.8.0 +metal_apiserver_image_tag: pr-274-image-cache-sync-permission # metal_tenant_apiserver_image_name: # metal_tenant_apiserver_image_tag: # metal_metalctl_image_name: From 5ce595d2ba6c0396a4bd2333010a28315c74ec1d Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Tue, 21 Jul 2026 10:17:06 +0200 Subject: [PATCH 05/11] feat: explicit metal-deployment-token --- deploy_partition.yaml | 2 ++ inventories/group_vars/all/release_vector.yaml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 421d7de8..12d87b39 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -126,6 +126,8 @@ tags: always - name: metal-roles/partition/roles/pixiecore tags: pixiecore + - name: metal-roles/common/roles/metal-deployment-token + tags: image-cache - name: metal-roles/partition/roles/image-cache tags: image-cache diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index 436f45f3..49b02d04 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -12,7 +12,7 @@ metal_stack_release_vectors: # metal_api_image_name: # metal_api_image_tag: # metal_apiserver_image_name: -metal_apiserver_image_tag: pr-274-image-cache-sync-permission +metal_apiserver_image_tag: v0.8.1 # metal_tenant_apiserver_image_name: # metal_tenant_apiserver_image_tag: # metal_metalctl_image_name: From 57a2996c30d8d79227f80650d8dd78b0bc971d50 Mon Sep 17 00:00:00 2001 From: Valentin Knabel Date: Tue, 21 Jul 2026 10:49:21 +0200 Subject: [PATCH 06/11] fix: remove unnecessary local connection --- inventories/control-plane.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/inventories/control-plane.yaml b/inventories/control-plane.yaml index 13ab9076..e8413def 100644 --- a/inventories/control-plane.yaml +++ b/inventories/control-plane.yaml @@ -3,4 +3,3 @@ control_plane: hosts: localhost: ansible_python_interpreter: "{{ ansible_playbook_python }}" - ansible_connection: local From 07e53803a770b99e0c9a98b28c990b1a72f6c71f Mon Sep 17 00:00:00 2001 From: Gerrit Date: Wed, 19 Aug 2026 07:47:13 +0200 Subject: [PATCH 07/11] Fixes and trying to simplify partition.yaml --- deploy_partition.yaml | 122 ++---------------- deploy_partition_monitoring.yaml | 32 +++++ .../group_vars/all/metal_apiserver.yaml | 2 + .../group_vars/all/release_vector.yaml | 8 +- .../group_vars/control_plane/metal.yml | 1 - inventories/group_vars/partition/ansible.yaml | 2 + .../group_vars/partition/image_cache.yaml | 5 +- roles/dell-sonic/tasks/main.yaml | 50 +++++++ 8 files changed, 104 insertions(+), 118 deletions(-) create mode 100644 deploy_partition_monitoring.yaml create mode 100644 inventories/group_vars/all/metal_apiserver.yaml create mode 100644 inventories/group_vars/partition/ansible.yaml create mode 100644 roles/dell-sonic/tasks/main.yaml diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 12d87b39..3d9e09d5 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -10,86 +10,24 @@ timeout: 50 roles: - name: ansible-common - tags: always - name: metal-roles/partition/roles/sonic-config - tags: sonic - name: sonic - tags: sonic + post_tasks: + - name: Temporary workaround for EOL debian bullseye backports repository (using archive.debian.org) + lineinfile: + path: /etc/apt/sources.list + search_string: deb [arch=amd64] http://deb.debian.org/debian/ bullseye-backports main contrib non-free + line: deb [arch=amd64] http://archive.debian.org/debian/ bullseye-backports main contrib non-free - name: Configure leaves (Enterprise SONiC) hosts: dell_sonic any_errors_fatal: true - become: true handlers: - name: reload systemd daemon systemd: daemon_reload: true - tasks: - - name: Check for bgpd.conf presence - ansible.builtin.stat: - path: /etc/sonic/frr/bgpd.conf - register: bgpd_conf_stat - - - name: Restart bgp service when non-split docker_routing_config_mode is still active - ansible.builtin.service: - name: bgp - state: restarted - when: bgpd_conf_stat.stat.exists - - - name: Ensure root has authorized_key - ansible.builtin.authorized_key: - user: root - state: present - key: "{{ lookup('file', 'ssh/id_ed25519.pub') }}" - - - name: Install frr-reload.service - copy: - src: /root/.ansible/roles/metal-roles/partition/roles/sonic-config/files/frr-reload.service - dest: /etc/systemd/system/frr-reload.service - remote_src: false - notify: - - reload systemd daemon - changed_when: true - - - name: Activate IP MASQUERADE on eth0 - ansible.builtin.iptables: - chain: POSTROUTING - jump: MASQUERADE - out_interface: eth0 - table: nat - - - name: Activate IPv4 forwarding on eth0 - ansible.posix.sysctl: - name: net.ipv4.conf.eth0.forwarding - reload: no - sysctl_set: yes - value: "1" - -- name: Deploy dhcp server on leaf01 (Community SONiC) - hosts: leaf01:!dell_sonic - pre_tasks: - - name: Temporary workaround for EOL debian bullseye backports repository (using archive.debian.org) - lineinfile: - path: /etc/apt/sources.list - search_string: deb [arch=amd64] http://deb.debian.org/debian/ bullseye-backports main contrib non-free - line: deb [arch=amd64] http://archive.debian.org/debian/ bullseye-backports main contrib non-free roles: - - name: ansible-common - tags: always - - name: metal-roles/partition/roles/dhcp - tags: dhcp - -# FIXME: For some reason, the first docker pull always fails on dell_sonic but succeeds on second attempt. -# Investigate the cause and remove this play -- name: Intentionally fail on first docker pull - hosts: dell_sonic - tasks: - - community.docker.docker_container: - name: hello-world - image: library/hello-world:latest - cleanup: true - pull: true - failed_when: false + - name: dell-sonic - name: Install python client and generate deployment token hosts: localhost @@ -104,6 +42,7 @@ wait: true wait_sleep: 1 wait_timeout: 600 + - name: Wait until the admin_editor_token secret exists kubernetes.core.k8s_info: kind: Secret @@ -112,62 +51,29 @@ wait: true wait_sleep: 1 wait_timeout: 600 + roles: - name: ansible-common - tags: always - name: metal-roles/common/roles/metal-v2-client - name: metal-roles/common/roles/metal-deployment-token -- name: Deploy pixiecore on leaf01 +- name: Deploy mgmt-server components on leaf01 hosts: leaf01 - become: true roles: - name: ansible-common - tags: always + - name: metal-roles/partition/roles/dhcp - name: metal-roles/partition/roles/pixiecore - tags: pixiecore - name: metal-roles/common/roles/metal-deployment-token - tags: image-cache - name: metal-roles/partition/roles/image-cache - tags: image-cache -- name: Deploy monitoring on leaf01 - hosts: leaf01 - become: true - roles: - - name: ansible-common - tags: always - - name: metal-roles/partition/roles/monitoring/prometheus - when: monitoring_enabled - tags: prometheus - - name: metal-roles/partition/roles/monitoring/ipmi-exporter - when: monitoring_enabled - tags: ipmi-exporter - -- name: Deploy monitoring on leaves - hosts: leaves - become: true - roles: - - name: ansible-common - tags: always - - name: metal-roles/partition/roles/alloy - when: monitoring_enabled - tags: alloy - - name: metal-roles/partition/roles/monitoring/node-exporter - when: monitoring_enabled - tags: node-exporter - - name: metal-roles/partition/roles/monitoring/blackbox-exporter - when: monitoring_enabled - tags: blackbox-exporter - - name: metal-roles/partition/roles/monitoring/sonic-exporter - when: monitoring_enabled - tags: sonic-exporter +- name: Deploy partition monitoring + import_playbook: deploy_partition_monitoring.yaml # So, route propagation was broken in community sonic for a while now. Turns out # during a change in upstream sonic some time in the end of 2024 sonic switched # the module used for FRR->fpmsyncd communication, which does not provide a # default connection endpoint. We just needed to add `fpm address 127.0.0.1` -# to the frr.conf template and could remove all route-propagation related +# to the frr.conf template and could remove all route-propagation related # workarounds - name: Deploy metal-core (SONiC with dplane_fpm_sonic) hosts: leaves:!dell_sonic diff --git a/deploy_partition_monitoring.yaml b/deploy_partition_monitoring.yaml new file mode 100644 index 00000000..a3abc4ac --- /dev/null +++ b/deploy_partition_monitoring.yaml @@ -0,0 +1,32 @@ +--- +- name: Deploy monitoring on leaf01 + hosts: leaf01 + become: true + roles: + - name: ansible-common + tags: always + - name: metal-roles/partition/roles/monitoring/prometheus + when: monitoring_enabled + tags: prometheus + - name: metal-roles/partition/roles/monitoring/ipmi-exporter + when: monitoring_enabled + tags: ipmi-exporter + +- name: Deploy monitoring on leaves + hosts: leaves + become: true + roles: + - name: ansible-common + tags: always + - name: metal-roles/partition/roles/alloy + when: monitoring_enabled + tags: alloy + - name: metal-roles/partition/roles/monitoring/node-exporter + when: monitoring_enabled + tags: node-exporter + - name: metal-roles/partition/roles/monitoring/blackbox-exporter + when: monitoring_enabled + tags: blackbox-exporter + - name: metal-roles/partition/roles/monitoring/sonic-exporter + when: monitoring_enabled + tags: sonic-exporter diff --git a/inventories/group_vars/all/metal_apiserver.yaml b/inventories/group_vars/all/metal_apiserver.yaml new file mode 100644 index 00000000..614271cc --- /dev/null +++ b/inventories/group_vars/all/metal_apiserver.yaml @@ -0,0 +1,2 @@ +--- +metal_apiserver_url: http://v2.{{ metal_control_plane_gateway_dns }} diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index 49b02d04..f6e2a3cc 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -1,3 +1,4 @@ +--- metal_stack_release_version: develop metal_stack_release_vectors: - url: oci://ghcr.io/metal-stack/releases:{{ metal_stack_release_version }} @@ -12,7 +13,7 @@ metal_stack_release_vectors: # metal_api_image_name: # metal_api_image_tag: # metal_apiserver_image_name: -metal_apiserver_image_tag: v0.8.1 +# metal_apiserver_image_tag: # metal_tenant_apiserver_image_name: # metal_tenant_apiserver_image_tag: # metal_metalctl_image_name: @@ -30,9 +31,6 @@ metal_apiserver_image_tag: v0.8.1 # headscale_db_image_name: postgres # sonic_configdb_utils_image_name: # sonic_configdb_utils_image_tag: -image_cache_sync_image_name: ghcr.io/metal-stack/metal-image-cache-sync -image_cache_sync_image_tag: pr-21-migrate-to-metal-apiserver -metal_api_version: v0.3.1 # ... # @@ -42,7 +40,7 @@ metal_api_version: v0.3.1 # ansible_common_version: metal_roles_version: pr-453-migrate-metal-image-cache-sync-to-metal-apiserver -metal_ansible_modules_version: v2-updates +# metal_ansible_modules_version: ## ## helm charts diff --git a/inventories/group_vars/control_plane/metal.yml b/inventories/group_vars/control_plane/metal.yml index 3083c07e..5d29ad57 100644 --- a/inventories/group_vars/control_plane/metal.yml +++ b/inventories/group_vars/control_plane/metal.yml @@ -30,7 +30,6 @@ metal_api_nsq_tcp_address: nsqd:4150 metal_apiserver_pdb_min_available: 1 metal_apiserver_enabled: true -metal_apiserver_url: http://v2.{{ metal_control_plane_gateway_dns }} metal_apiserver_oidc_discovery_url: https://auth.{{ metal_control_plane_gateway_dns }}/.well-known/openid-configuration metal_apiserver_oidc_end_session_url: "https://auth.{{ metal_control_plane_gateway_dns }}/oidc/v1/end_session" diff --git a/inventories/group_vars/partition/ansible.yaml b/inventories/group_vars/partition/ansible.yaml new file mode 100644 index 00000000..d12894ff --- /dev/null +++ b/inventories/group_vars/partition/ansible.yaml @@ -0,0 +1,2 @@ +--- +ansible_become: true diff --git a/inventories/group_vars/partition/image_cache.yaml b/inventories/group_vars/partition/image_cache.yaml index ab66b26c..c75f4188 100644 --- a/inventories/group_vars/partition/image_cache.yaml +++ b/inventories/group_vars/partition/image_cache.yaml @@ -1,8 +1,5 @@ -metal_control_plane_ingress_dns: 172.17.0.1.nip.io -metal_apiserver_url: http://v2.{{ metal_control_plane_ingress_dns }}:8080 -image_cache_sync_metal_apiserver_url: "{{ metal_apiserver_url }}" +--- image_cache_sync_token_expiration: 20m - image_cache_sync_excludes: - "/pull_requests/" - "/stable/" diff --git a/roles/dell-sonic/tasks/main.yaml b/roles/dell-sonic/tasks/main.yaml new file mode 100644 index 00000000..9b16d5d9 --- /dev/null +++ b/roles/dell-sonic/tasks/main.yaml @@ -0,0 +1,50 @@ +--- +- name: Check for bgpd.conf presence + ansible.builtin.stat: + path: /etc/sonic/frr/bgpd.conf + register: bgpd_conf_stat + +- name: Restart bgp service when non-split docker_routing_config_mode is still active + ansible.builtin.service: + name: bgp + state: restarted + when: bgpd_conf_stat.stat.exists + +- name: Ensure root has authorized_key + ansible.builtin.authorized_key: + user: root + state: present + key: "{{ lookup('file', 'ssh/id_ed25519.pub') }}" + +- name: Install frr-reload.service + copy: + src: /root/.ansible/roles/metal-roles/partition/roles/sonic-config/files/frr-reload.service + dest: /etc/systemd/system/frr-reload.service + remote_src: false + notify: + - reload systemd daemon + changed_when: true + +- name: Activate IP MASQUERADE on eth0 + ansible.builtin.iptables: + chain: POSTROUTING + jump: MASQUERADE + out_interface: eth0 + table: nat + +- name: Activate IPv4 forwarding on eth0 + ansible.posix.sysctl: + name: net.ipv4.conf.eth0.forwarding + reload: no + sysctl_set: yes + value: "1" + +# FIXME: For some reason, the first docker pull always fails on dell_sonic but succeeds on second attempt. +# Investigate the cause and remove this play +- name: Intentionally fail on first docker pull + community.docker.docker_container: + name: hello-world + image: library/hello-world:latest + cleanup: true + pull: true + failed_when: false From 59a00b832eb7abc427b427e07830f22b0605cfc1 Mon Sep 17 00:00:00 2001 From: Gerrit Date: Wed, 19 Aug 2026 15:24:18 +0200 Subject: [PATCH 08/11] Drop DHCP role from play. --- deploy_partition.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 3d9e09d5..01691932 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -61,7 +61,6 @@ hosts: leaf01 roles: - name: ansible-common - - name: metal-roles/partition/roles/dhcp - name: metal-roles/partition/roles/pixiecore - name: metal-roles/common/roles/metal-deployment-token - name: metal-roles/partition/roles/image-cache From 897bb519d6dc3adc9467f0cf2ffb815f9d298b3a Mon Sep 17 00:00:00 2001 From: Gerrit Date: Wed, 19 Aug 2026 16:13:10 +0200 Subject: [PATCH 09/11] Add back dhcp installation on community sonic. --- deploy_partition.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 01691932..7cb7f200 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -29,6 +29,14 @@ roles: - name: dell-sonic +- name: Deploy dhcp server on leaf01 (Community SONiC) + hosts: leaf01:!dell_sonic + roles: + - name: ansible-common + tags: always + - name: metal-roles/partition/roles/dhcp + tags: dhcp + - name: Install python client and generate deployment token hosts: localhost connection: local From 2012ca516f911bb4d14a68727d66155a0a8ab522 Mon Sep 17 00:00:00 2001 From: Gerrit Date: Wed, 19 Aug 2026 16:13:22 +0200 Subject: [PATCH 10/11] Remove contributing. --- CONTRIBUTING.md | 3 --- 1 file changed, 3 deletions(-) delete mode 100644 CONTRIBUTING.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md deleted file mode 100644 index 63418fe7..00000000 --- a/CONTRIBUTING.md +++ /dev/null @@ -1,3 +0,0 @@ -# Contributing - -Please check out the [contributing section](https://docs.metal-stack.io/stable/development/contributing/) in our [docs](https://docs.metal-stack.io/). \ No newline at end of file From f2c87c42a2590c16eb95a2d29a275e3c12ea7f7b Mon Sep 17 00:00:00 2001 From: Gerrit Date: Wed, 19 Aug 2026 16:38:27 +0200 Subject: [PATCH 11/11] Clean up overwrite. --- deploy_partition.yaml | 1 + inventories/group_vars/all/release_vector.yaml | 2 +- inventories/group_vars/partition/image_cache.yaml | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/deploy_partition.yaml b/deploy_partition.yaml index 7cb7f200..6c8d2a89 100644 --- a/deploy_partition.yaml +++ b/deploy_partition.yaml @@ -72,6 +72,7 @@ - name: metal-roles/partition/roles/pixiecore - name: metal-roles/common/roles/metal-deployment-token - name: metal-roles/partition/roles/image-cache + when: deploy_partition_image_cache - name: Deploy partition monitoring import_playbook: deploy_partition_monitoring.yaml diff --git a/inventories/group_vars/all/release_vector.yaml b/inventories/group_vars/all/release_vector.yaml index f6e2a3cc..4a7f2eca 100644 --- a/inventories/group_vars/all/release_vector.yaml +++ b/inventories/group_vars/all/release_vector.yaml @@ -39,7 +39,7 @@ metal_stack_release_vectors: ## # ansible_common_version: -metal_roles_version: pr-453-migrate-metal-image-cache-sync-to-metal-apiserver +# metal_roles_version: # metal_ansible_modules_version: ## diff --git a/inventories/group_vars/partition/image_cache.yaml b/inventories/group_vars/partition/image_cache.yaml index c75f4188..e71004f8 100644 --- a/inventories/group_vars/partition/image_cache.yaml +++ b/inventories/group_vars/partition/image_cache.yaml @@ -1,4 +1,7 @@ --- +# the cache is not properly wired up yet +deploy_partition_image_cache: false + image_cache_sync_token_expiration: 20m image_cache_sync_excludes: - "/pull_requests/"