Add serviceaccount token creation;Base delays on storage benchmark

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/certauthority.yml

@@ -133,7 +133,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'ok'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/git.yml

@@ -19,7 +19,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'pass'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
     - name: Configure additional SSH ingress
       ansible.builtin.template:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/gitops.yml

@@ -18,7 +18,7 @@
       until:
         - api_readycheck.json.Version is defined
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
     - name: Generate argo-cd API token
       ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/k3s.yml

@@ -40,7 +40,7 @@
   register: api_readycheck
   until: api_readycheck.json.apiVersion is defined
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"
 
 - name: Install kubectl tab-completion
   ansible.builtin.shell:
@@ -77,4 +77,4 @@
   until:
     - k8snode_patch.result.metadata.labels['ova.airgappedk8s/moref_id'] is defined
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/registry.yml

@@ -19,7 +19,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'healthy'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
     - name: Push images to registry
       ansible.builtin.shell:
@@ -40,7 +40,7 @@
       loop_control:
         label: "{{ item | basename }}"
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.short }}"
+      delay: "{{ (storage_benchmark * playbook.delay.short) | int }}"
       until: push_result is not failed
 
   module_defaults:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/storage.yml

@@ -17,7 +17,7 @@
       until:
         - api_readycheck is not failed
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/clusterapi.yml

@@ -150,7 +150,7 @@
   register: certificate_subject
   until: certificate_subject is not failed
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"
 - name: Apply workload cluster manifest
   kubernetes.core.k8s:
     definition: >-
@@ -168,7 +168,7 @@
   register: cluster_readycheck
   until: cluster_readycheck is succeeded
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.long }}"
+  delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
 - name: Initialize tempfile
   ansible.builtin.tempfile:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/gitops.yml

@@ -5,17 +5,10 @@
         template: serviceaccount.j2
         state: present
 
-    - name: Retrieve service account bearer token
-      kubernetes.core.k8s_info:
-        kind: ServiceAccount
-        name: "{{ _template.account.name }}"
-        namespace: "{{ _template.account.namespace }}"
-      register: workloadcluster_serviceaccount
-
     - name: Retrieve service account bearer token
       kubernetes.core.k8s_info:
         kind: Secret
-        name: "{{ workloadcluster_serviceaccount.resources | json_query('[].secrets[].name') | first }}"
+        name: "{{ _template.account.name }}-secret"
         namespace: "{{ _template.account.namespace }}"
       register: workloadcluster_bearertoken
 

ansible/roles/firstboot/files/ansible_payload/bootstrap/templates/serviceaccount.j2

@@ -4,6 +4,15 @@ metadata:
   name: {{ _template.account.name }}
   namespace: {{ _template.account.namespace }}
 ---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ _template.account.name }}-secret
+  namespace: {{ _template.account.namespace }}
+  annotations:
+    kubernetes.io/service-account.name: {{ _template.account.name }}
+type: kubernetes.io/service-account-token
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata: