diff --git a/.gitignore b/.gitignore
index 5f48a8c13fede9fdada5178d667f594ea30ef174..26c584815647e31869c8bbd432944f2911828a8d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@
 
 # Ignore files created during CI using test/ci-bootstrap.py
 /test/group_vars/
+/test/secrets/
 /test/inventory.yml
 
 # Etc
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 311aec0868f07c300fec8bd346f4bd68c9cf2367..36f15ba00cbeb54d5c86424c85da0d21c6167ae0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -30,7 +30,8 @@ bootstrap:
     - eval $(ssh-agent -s)
     - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add - > /dev/null
     # - mkdir -p --mode 700 ~/.ssh
-    - ANSIBLE_HOST_KEY_CHECKING=False python3 -u ./ci-bootstrap.py --create_droplet --terminate
+    - ANSIBLE_HOST_KEY_CHECKING=False python3 -u ./ci-bootstrap.py --create_droplet
+    - python3 -c "import cosmos; cosmos.terminate_droplets_by_name(\"^ci-${CI_JOB_ID}\$\")"
   artifacts:
     paths:
     - ansible/rke.log
diff --git a/ansible/group_vars/cluster/settings.yml.example b/ansible/group_vars/cluster/settings.yml.example
index 81c82c18079835dd2658221cbc498189274b68ea..57f70bd5221976ea03c6617fe7203c055b69c0bd 100644
--- a/ansible/group_vars/cluster/settings.yml.example
+++ b/ansible/group_vars/cluster/settings.yml.example
@@ -6,3 +6,4 @@ domain: "example.com"
 admin_email: "admin@example.com"
 # Label of this deployment.
 release_name: "test"
+keycloak_password: "{{ lookup('password', './secrets/keycloak_admin_password') }}"
diff --git a/ansible/roles/get_control/files/oas_control b/ansible/roles/get_control/files/oas_control
index 3aab1f4543558c42264027b622247d51587ba28e..3288e358de3d603a9635f053d2f75f5647f135ff 100644
--- a/ansible/roles/get_control/files/oas_control
+++ b/ansible/roles/get_control/files/oas_control
@@ -6,6 +6,7 @@
 
 docker run --rm -i \
     --hostname=control \
+    -e KEYCLOAK_PASSWORD="$KEYCLOAK_PASSWORD" \
     -v /oas:/oas \
     -v /oas/control/local:/control/local \
     -v /oas/config/ssh_known_hosts:/etc/ssh/ssh_known_hosts \
diff --git a/ansible/roles/setup/tasks/main.yml b/ansible/roles/setup/tasks/main.yml
index 691a7bd3a5d7f68c9f352e714b11cf35a0a3ac33..84b529207284c07fc500b40ba354660106cd445c 100644
--- a/ansible/roles/setup/tasks/main.yml
+++ b/ansible/roles/setup/tasks/main.yml
@@ -53,6 +53,8 @@
 - debug: var=configFiles.stdout
 
 - name: Apply helmfiles
+  environment:
+    - KEYCLOAK_PASSWORD: "{{ keycloak_password }}"
   command: 'oas_control /usr/local/bin/control applyHelmfiles'
   register: applyHelmfiles
 - debug: var=applyHelmfiles.stdout
diff --git a/test/bootstrap.yml b/test/bootstrap.yml
new file mode 120000
index 0000000000000000000000000000000000000000..d29cf97c10ac85c0dc68fa448f5d9aaeae9714fe
--- /dev/null
+++ b/test/bootstrap.yml
@@ -0,0 +1 @@
+../ansible/bootstrap.yml
\ No newline at end of file
diff --git a/test/ci-bootstrap.py b/test/ci-bootstrap.py
index 311929391ce301ff1788d21bbc930364dce1cd49..176b868f8e1064caa4db9c9ba02f1d3d7f9a1d66 100755
--- a/test/ci-bootstrap.py
+++ b/test/ci-bootstrap.py
@@ -121,7 +121,7 @@ if __name__ == "__main__":
             name='ci-' + instance_id,
             ssh_key_id=args.ssh_key_id,
             region='ams1',
-            size=2048,
+            size=4096,
             disk=8,
             image=18)
         id = droplet['droplet']['id']
@@ -189,7 +189,7 @@ if __name__ == "__main__":
     # Bootstrap
     # playbook path here is relative to private_data_dir/project, see
     # https://ansible-runner.readthedocs.io/en/latest/intro.html#inputdir
-    playbook='../ansible/bootstrap.yml'
+    playbook='./bootstrap.yml'
     ansible_playbook_cmd = 'ansible-playbook %s' % playbook
 
     log.info('Running %s', ansible_playbook_cmd)
diff --git a/test/roles b/test/roles
new file mode 120000
index 0000000000000000000000000000000000000000..e4109d3736f47053d8deb67b0356f17ce2e2b9e0
--- /dev/null
+++ b/test/roles
@@ -0,0 +1 @@
+../ansible/roles
\ No newline at end of file