Add serviceaccount token creation;Base delays on storage benchmark

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/certauthority.yml

@@ -133,7 +133,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'ok'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/git.yml

@@ -19,7 +19,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'pass'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
     - name: Configure additional SSH ingress
       ansible.builtin.template:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/gitops.yml

@@ -18,7 +18,7 @@
       until:
         - api_readycheck.json.Version is defined
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
     - name: Generate argo-cd API token
       ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/k3s.yml

@@ -40,7 +40,7 @@
   register: api_readycheck
   until: api_readycheck.json.apiVersion is defined
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"
 
 - name: Install kubectl tab-completion
   ansible.builtin.shell:
@@ -77,4 +77,4 @@
   until:
     - k8snode_patch.result.metadata.labels['ova.airgappedk8s/moref_id'] is defined
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/registry.yml

@@ -19,7 +19,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'healthy'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
     - name: Push images to registry
       ansible.builtin.shell:
@@ -40,7 +40,7 @@
       loop_control:
         label: "{{ item | basename }}"
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.short }}"
+      delay: "{{ (storage_benchmark * playbook.delay.short) | int }}"
       until: push_result is not failed
 
   module_defaults:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/storage.yml

@@ -17,7 +17,7 @@
       until:
         - api_readycheck is not failed
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/clusterapi.yml

@@ -150,7 +150,7 @@
   register: certificate_subject
   until: certificate_subject is not failed
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"
 - name: Apply workload cluster manifest
   kubernetes.core.k8s:
     definition: >-
@@ -168,7 +168,7 @@
   register: cluster_readycheck
   until: cluster_readycheck is succeeded
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.long }}"
+  delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
 - name: Initialize tempfile
   ansible.builtin.tempfile:

ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/gitops.yml

@@ -5,17 +5,10 @@
         template: serviceaccount.j2
         state: present
 
-    - name: Retrieve service account bearer token
-      kubernetes.core.k8s_info:
-        kind: ServiceAccount
-        name: "{{ _template.account.name }}"
-        namespace: "{{ _template.account.namespace }}"
-      register: workloadcluster_serviceaccount
-
     - name: Retrieve service account bearer token
       kubernetes.core.k8s_info:
         kind: Secret
-        name: "{{ workloadcluster_serviceaccount.resources | json_query('[].secrets[].name') | first }}"
+        name: "{{ _template.account.name }}-secret"
         namespace: "{{ _template.account.namespace }}"
       register: workloadcluster_bearertoken
 

ansible/roles/firstboot/files/ansible_payload/bootstrap/templates/serviceaccount.j2

@@ -4,6 +4,15 @@ metadata:
   name: {{ _template.account.name }}
   namespace: {{ _template.account.namespace }}
 ---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ _template.account.name }}-secret
+  namespace: {{ _template.account.namespace }}
+  annotations:
+    kubernetes.io/service-account.name: {{ _template.account.name }}
+type: kubernetes.io/service-account-token
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

ansible/roles/firstboot/files/ansible_payload/common/roles/metacluster/tasks/assets.yml

@@ -8,5 +8,5 @@
     label: "{{ item | basename }}"
   # Probably should add a task before that ensures K3s node is fully initialized before starting imports; currently K3s goes away briefly during this loop
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.short }}"
+  delay: "{{ (storage_benchmark * playbook.delay.short) | int }}"
   until: import_result is not failed

ansible/roles/firstboot/files/ansible_payload/common/roles/preflight/tasks/vcenter.yml

@@ -5,7 +5,7 @@
         schema: vsphere
       register: vcenter_info
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.short }}"
+      delay: "{{ (storage_benchmark * playbook.delay.short) | int }}"
       until: vcenter_info is not failed
 
   module_defaults:

ansible/roles/firstboot/files/ansible_payload/common/vars/defaults.yml

@@ -1,6 +1,7 @@
 playbook:
   retries: 5
   delay:
-    long: 60
+    # These values are multiplied with the value of `storage_benchmark`
-    medium: 30
+    long: 2
-    short: 10
+    medium: 1
+    short: 0.5

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/decommission/tasks/k3s.yml

@@ -24,7 +24,7 @@
     - nodedrain_results is not failed
     - (nodedrain_results.stdout_lines | last) is match('node/.* drained')
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.short }}"
+  delay: "{{ (storage_benchmark * playbook.delay.short) | int }}"
 
 - name: Delete node
   kubernetes.core.k8s:

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/metacluster/tasks/certauthority.yml

@@ -43,7 +43,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'ok'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/metacluster/tasks/containerimages.yml

@@ -19,7 +19,7 @@
       loop_control:
         label: "{{ item | basename }}"
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.short }}"
+      delay: "{{ (storage_benchmark * playbook.delay.short) | int }}"
       until: push_result is not failed
 
     - name: Get all stored container images (=artifacts)

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/metacluster/tasks/git.yml

@@ -18,7 +18,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'pass'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/metacluster/tasks/gitops.yml

@@ -17,7 +17,7 @@
       until:
         - api_readycheck.json.Version is defined
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/metacluster/tasks/k3s.yml

@@ -40,7 +40,7 @@
   register: api_readycheck
   until: api_readycheck.json.apiVersion is defined
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"
 
 - name: Install kubectl tab-completion
   ansible.builtin.shell:
@@ -77,4 +77,4 @@
   until:
     - k8snode_patch.result.metadata.labels['ova.airgappedk8s/moref_id'] is defined
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/metacluster/tasks/registry.yml

@@ -18,7 +18,7 @@
         - api_readycheck.json.status is defined
         - api_readycheck.json.status == 'healthy'
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/metacluster/tasks/storage.yml

@@ -25,7 +25,7 @@
         - (volume_details.json | json_query('data[? state==`attached`].robustness') | unique | length) == 1
         - (volume_details.json | json_query('data[? state==`attached`].robustness') | first) == "healthy"
       retries: "{{ ( playbook.retries * 2) | int }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
     - name: Upgrade longhorn chart
       kubernetes.core.helm:
@@ -44,7 +44,7 @@
       until:
         - api_readycheck is not failed
       retries: "{{ playbook.retries }}"
-      delay: "{{ playbook.delay.long }}"
+      delay: "{{ (storage_benchmark * playbook.delay.long) | int }}"
 
   module_defaults:
     ansible.builtin.uri:

ansible/roles/firstboot/files/ansible_payload/upgrade/roles/preflight/tasks/metacluster.yml

@@ -8,4 +8,4 @@
   until:
     - api_readycheck.json.apiVersion is defined
   retries: "{{ playbook.retries }}"
-  delay: "{{ playbook.delay.medium }}"
+  delay: "{{ (storage_benchmark * playbook.delay.medium) | int }}"