diff --git a/roles/cluster_issuer/handlers/main.yml b/roles/cluster_issuer/handlers/main.yml
index 711faa3..ce91b4f 100644
--- a/roles/cluster_issuer/handlers/main.yml
+++ b/roles/cluster_issuer/handlers/main.yml
@@ -13,5 +13,6 @@
 # under the License.
 
 - name: Update CA certificates on host
+  changed_when: true
   ansible.builtin.command:
     cmd: update-ca-certificates
diff --git a/roles/defaults/vars/main.yml b/roles/defaults/vars/main.yml
index b8bfad7..6d06192 100644
--- a/roles/defaults/vars/main.yml
+++ b/roles/defaults/vars/main.yml
@@ -192,7 +192,7 @@
   staffeln_db_sync: ghcr.io/vexxhost/atmosphere/staffeln:v2.2.3@sha256:c09b73991d4ffa3b582e8d6c92888b6964f7023d69a84762de1a62678cad1777
   staffeln_conductor: ghcr.io/vexxhost/atmosphere/staffeln:v2.2.3@sha256:c09b73991d4ffa3b582e8d6c92888b6964f7023d69a84762de1a62678cad1777
   staffeln_api: ghcr.io/vexxhost/atmosphere/staffeln:v2.2.3@sha256:c09b73991d4ffa3b582e8d6c92888b6964f7023d69a84762de1a62678cad1777
-  tempest_run_tests: ghcr.io/vexxhost/atmosphere/tempest:master@sha256:82300000bc99670cc3f4be3ba0e8577a0e8e59ef9d58ca71d069a9a1928804f5
+  tempest_run_tests: ghcr.io/vexxhost/atmosphere/tempest:master@sha256:e60b44b4a181f04879db1aa364e9b29904e705243b7a06fb27ecf9ae002660d0
   vector: docker.io/timberio/vector:0.27.0-debian@sha256:29f23dab76fa306b67b10eac3e9decdb01c906f8aa3b00a2f5b2e8ae088b84e0
 
 atmosphere_images: '{{ _atmosphere_images | combine(atmosphere_image_overrides, recursive=True)
diff --git a/roles/keycloak/meta/main.yml b/roles/keycloak/meta/main.yml
index 1a2d277..7fd6458 100644
--- a/roles/keycloak/meta/main.yml
+++ b/roles/keycloak/meta/main.yml
@@ -26,8 +26,7 @@
 dependencies:
   - role: defaults
   - role: openstack_helm_endpoints
-    vars:
-      openstack_helm_endpoints_list: ["oslo_db"]
+    openstack_helm_endpoints_list: ["oslo_db"]
   - role: vexxhost.kubernetes.upload_helm_chart
     vars:
       upload_helm_chart_src: "{{ keycloak_helm_chart_path }}"
diff --git a/roles/openstack_helm_endpoints/tasks/main.yml b/roles/openstack_helm_endpoints/tasks/main.yml
index 6e4056f..afabb02 100644
--- a/roles/openstack_helm_endpoints/tasks/main.yml
+++ b/roles/openstack_helm_endpoints/tasks/main.yml
@@ -14,7 +14,6 @@
 
 - name: Retrieve list of all the needed endpoints
   ansible.builtin.set_fact:
-    # noqa: yaml[line-length]
     openstack_helm_endpoints_list: |-
       {{ lookup('ansible.builtin.file', '../../../charts/' ~ openstack_helm_endpoints_chart ~ '/values.yaml', split_lines=False) | from_yaml | community.general.json_query('keys(endpoints)') | difference(_openstack_helm_endpoints_ignore) }}
   when:
diff --git a/roles/staffeln/vars/main.yml b/roles/staffeln/vars/main.yml
index 5f26973..c0be4b3 100644
--- a/roles/staffeln/vars/main.yml
+++ b/roles/staffeln/vars/main.yml
@@ -23,8 +23,8 @@
   conf:
     staffeln:
       conductor:
-        backup_metadata_key: "{{staffeln_backup_metadata_key}}"
-        retention_metadata_key: "{{staffeln_retention_metadata_key}}"
+        backup_metadata_key: "{{ staffeln_backup_metadata_key }}"
+        retention_metadata_key: "{{ staffeln_retention_metadata_key }}"
   manifests:
     ingress_api: false
     service_ingress_api: false
diff --git a/roles/tempest/vars/main.yml b/roles/tempest/vars/main.yml
index c1eb848..39eb4245 100644
--- a/roles/tempest/vars/main.yml
+++ b/roles/tempest/vars/main.yml
@@ -38,10 +38,15 @@
         v3_endpoint_type: internal
       image:
         endpoint_type: internal
+      load_balancer:
+        endpoint_type: internal
+        enable_security_groups: true
       network:
         endpoint_type: internal
         floating_network_name: public
         shared_physical_network: false
+      network-feature-enabled:
+        port_security: true
       placement:
         endpoint_type: internal
       validation: