diff --git a/compose.yaml b/compose.yaml
index 67762c08..e2a42109 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -47,6 +47,8 @@ services:
       # - ${HOME}/.ansible/roles/metal-ansible-modules:/root/.ansible/roles/metal-ansible-modules:ro
     environment:
       - ANSIBLE_CONFIG=/mini-lab/ansible.cfg
+      - KUBECONFIG=/mini-lab/.kubeconfig
+      - K8S_AUTH_KUBECONFIG=/mini-lab/.kubeconfig
       - CI=${CI}
       - DOCKER_HUB_USER=${DOCKER_HUB_USER}
       - DOCKER_HUB_TOKEN=${DOCKER_HUB_TOKEN}
diff --git a/deploy_partition.yaml b/deploy_partition.yaml
index c8299608..94d840d4 100644
--- a/deploy_partition.yaml
+++ b/deploy_partition.yaml
@@ -1,4 +1,14 @@
 ---
+- name: Install python client and generate deployment token
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  roles:
+    - name: ansible-common
+      tags: always
+    - name: metal-roles/control-plane/roles/metal-python
+    - name: metal-roles/control-plane/roles/metal-deployment-token
+
 - name: Configure leaves
   hosts: leaves
   any_errors_fatal: true
@@ -31,6 +41,8 @@
       tags: dhcp
     - name: metal-roles/partition/roles/pixiecore
       tags: pixiecore
+    - name: metal-roles/partition/roles/image-cache
+      tags: image-cache
 
 - name: Deploy metal-core
   hosts: leaves
@@ -52,8 +64,6 @@
       tags: always
     - name: metal-ansible-modules
       tags: always
-    - name: metal-roles/control-plane/roles/metal-python
-      tags: metal-python
   post_tasks:
     - name: Wait for switches to register
       command: echo
diff --git a/inventories/control-plane.yaml b/inventories/control-plane.yaml
index f6d4f244..42af64e0 100644
--- a/inventories/control-plane.yaml
+++ b/inventories/control-plane.yaml
@@ -3,3 +3,4 @@ control-plane:
   hosts:
     localhost:
       ansible_python_interpreter: "{{ ansible_playbook_python }}"
+      ansible_connection: local
diff --git a/inventories/group_vars/all/images.yaml b/inventories/group_vars/all/images.yaml
index f79bfd9f..7ae5d5a3 100644
--- a/inventories/group_vars/all/images.yaml
+++ b/inventories/group_vars/all/images.yaml
@@ -10,8 +10,8 @@ setup_yaml:
 ##
 
 # metal_hammer_image_url: https://images.metal-stack.io/metal-hammer/pull-requests/<pr-number-and-title>/metal-hammer-initrd.img.lz4
-# metal_api_image_name:
-# metal_api_image_tag:
+# metal_api_image_name: ghcr.io/metal-stack/metal-api
+# metal_api_image_tag: mep-4-network-migration
 # metal_apiserver_image_name:
 # metal_apiserver_image_tag:
 # metal_metalctl_image_name:
@@ -25,18 +25,23 @@ setup_yaml:
 # headscale_image_tag: v0.26.1
 # headscale_db_backup_restore_sidecar_image_tag: latest
 # headscale_db_backup_restore_sidecar_image_name: ghcr.io/metal-stack/backup-restore-sidecar
-# headscale_db_image_tag: 17-alpine
+# headscale_db_image_tag: 16-alpine
+ipam_db_image_tag: 18.0-alpine
+masterdata_db_image_tag: 18.0-alpine
 # headscale_db_image_name: postgres
 # ...
 #
 
+image_cache_sync_image_tag: migrate-to-metal-apiserver
+image_cache_sync_image_name: ghcr.io/metal-stack/metal-image-cache-sync
+
 ##
 ## for ansible roles
 ##
 
-# ansible_common_version:
-# metal_roles_version:
-# metal_ansible_modules_version:
+# ansible_common_version: support-systemd-credentials
+metal_roles_version: migrate-metal-image-cache-sync-to-metal-apiserver
+metal_ansible_modules_version: v2-modules
 
 ##
 ## helm charts
diff --git a/inventories/group_vars/partition/image_cache.yaml b/inventories/group_vars/partition/image_cache.yaml
new file mode 100644
index 00000000..71709675
--- /dev/null
+++ b/inventories/group_vars/partition/image_cache.yaml
@@ -0,0 +1,6 @@
+---
+image_cache_sync_metal_apiserver_url: "http://v2.api.172.17.0.1.nip.io:8080"
+image_cache_sync_excludes:
+  - "/pull_requests/"
+  - "/stable/"
+image_cache_sync_expiration_grace_period: 100
diff --git a/inventories/partition.yaml b/inventories/partition.yaml
index 23c0490e..f5f84812 100644
--- a/inventories/partition.yaml
+++ b/inventories/partition.yaml
@@ -6,6 +6,7 @@ partition:
   hosts:
     localhost:
       ansible_python_interpreter: "{{ ansible_playbook_python }}"
+      ansible_connection: local
   children:
     leaves: