feat: rollout new tokens/passwords for qa stage

group_vars/all/plain.yml

@@ -296,3 +296,7 @@ hcloud_firewall_objects:
        type: label_selector
        label_selector:
          selector: 'service=keycloak'
+
+hetzner_authentication_ansible: "{{ hetzner_authentication_ansible_vault }}"
+hetzner_authentication_ccm: "{{ hetzner_authentication_ccm_vault }}"
+hetzner_authentication_csi: "{{ hetzner_authentication_csi_vault }}"

group_vars/stage_dev/plain.yml

@@ -343,7 +343,3 @@ management_oidc_client_secret: "{{ management_oidc_client_secret_vault }}"
 # smardigo automation DEV gpg key
 # pub part => https://dev-gitea-01.smardigo.digital/gitea-admin/communication-keys/
 gpg_key_smardigo_automation__private: '{{ gpg_key_smardigo_automation__private__vault }}'
-
-hetzner_authentication_ansible: "{{ hetzner_authentication_ansible_vault }}"
-hetzner_authentication_ccm: "{{ hetzner_authentication_ccm_vault }}"
-hetzner_authentication_csi: "{{ hetzner_authentication_csi_vault }}"

roles/kubernetes/cloud-controller-manager/tasks/main.yml

@@ -10,7 +10,7 @@
       kind: Secret
       metadata:
         namespace: kube-system
-        name: hcloud
+        name: hcloud-ccm
         label:
           app: ccm
           provider: hcloud

roles/kubernetes/cloud-controller-manager/templates/hetzner-ccm-networks__v1.12.0.yaml.j2

@@ -1,86 +0,0 @@
-# NOTE: this release was tested against kubernetes v1.18.x
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cloud-controller-manager
-  namespace: kube-system
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: system:cloud-controller-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: cloud-controller-manager
-    namespace: kube-system
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hcloud-cloud-controller-manager
-  namespace: kube-system
-spec:
-  replicas: 1
-  revisionHistoryLimit: 2
-  selector:
-    matchLabels:
-      app: hcloud-cloud-controller-manager
-  template:
-    metadata:
-      labels:
-        app: hcloud-cloud-controller-manager
-      annotations:
-        scheduler.alpha.kubernetes.io/critical-pod: ''
-    spec:
-      serviceAccountName: cloud-controller-manager
-      dnsPolicy: Default
-      tolerations:
-        # this taint is set by all kubelets running `--cloud-provider=external`
-        # so we should tolerate it to schedule the cloud controller manager
-        - key: "node.cloudprovider.kubernetes.io/uninitialized"
-          value: "true"
-          effect: "NoSchedule"
-        - key: "CriticalAddonsOnly"
-          operator: "Exists"
-        # cloud controller manages should be able to run on masters
-        - key: "node-role.kubernetes.io/master"
-          effect: NoSchedule
-        - key: "node-role.kubernetes.io/control-plane"
-          effect: NoSchedule
-        - key: "node.kubernetes.io/not-ready"
-          effect: "NoSchedule"
-      hostNetwork: true
-      containers:
-        - image: hetznercloud/hcloud-cloud-controller-manager:v1.12.0
-          name: hcloud-cloud-controller-manager
-          command:
-            - "/bin/hcloud-cloud-controller-manager"
-            - "--cloud-provider=hcloud"
-            - "--leader-elect=false"
-            - "--allow-untagged-cloud"
-            - "--allocate-node-cidrs=true"
-            - "--cluster-cidr={{ k8s_ccm__cluster_cidr | default('10.244.0.0/16') }}"
-          resources:
-            requests:
-              cpu: 100m
-              memory: 50Mi
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: HCLOUD_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: hcloud
-                  key: token
-            - name: HCLOUD_NETWORK
-              valueFrom:
-                secretKeyRef:
-                  name: hcloud
-                  key: network

roles/kubernetes/cloud-controller-manager/templates/hetzner-ccm-networks__v1.12.1.yaml.j2

@@ -79,10 +79,10 @@ spec:
             - name: HCLOUD_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: hcloud
+                  name: hcloud-ccm
                   key: token
             - name: HCLOUD_NETWORK
               valueFrom:
                 secretKeyRef:
-                  name: hcloud
+                  name: hcloud-ccm
                   key: network

stage-netgo-hcloud.yml

@@ -11,7 +11,7 @@
 
 plugin: netgo-hcloud
 
-api_token: !vault |
+api_token_dev: !vault |
           $ANSIBLE_VAULT;1.1;AES256
           31303065663564373265333132646634653566653234396232343765623232363964343231643663
           3835363666633435373336656530323966653062336536320a653364393835313130383363633339
@@ -21,3 +21,14 @@ api_token: !vault |
           64666665353434623139373563653131306437616636316236326537303532626266356530643966
           31343633343639306138656262313330623165326531356239383739623065633930663234343265
           33343035363263613035
+
+api_token_qa: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          36326436363431623035633730393332623665663439613835373436636637393838333865646564
+          6461343366393765383332323662326339623836336566660a666462633333613236663362643835
+          39313166323139616162353366303839346664386237306562306363333731626338316134396561
+          3435316335343534620a396432353430396138343933663866613730333564646639323935366134
+          37653935313437313263366462643033316662363366353866663664633835376661623737336363
+          32393431666138303538356138663163303965623339343063353234643664363933663330356237
+          32386139363033656538646236323237333631626161383966663839303666373266633039363337
+          64313830353765633865