Switch puppet compiler ENC from Cobbler to encapi (#272)

## Why

The k8s puppetserver compilers classify nodes via an exec ENC that today queries legacy Cobbler (`https://cobbler.main.unkin.net`) over TLS. `encapi` now runs in-cluster and exposes a cobbler-wire-compatible endpoint (`GET /cblr/svc/op/puppet/hostname/<certname>`), a drop-in for the Cobbler URL. This cuts the puppet-on-k8s ENC over from Cobbler to encapi — a prerequisite for migrating VM agents onto puppet-on-k8s.

## Changes

- Rename the ENC script `resources/cobbler-enc` -> `resources/encapi-enc`, and its configmap `puppet-cobbler-enc` -> `puppet-encapi-enc` (kustomization configMapGenerator + deployment volume, initContainer copy path, and volumeMount subPath).
- Point `external_nodes` in the compiler `puppet.conf` at `/opt/bin/encapi-enc`.
- Target the in-cluster encapi service `http://encapi.encapi.svc.cluster.local` (plain HTTP), overridable via the `ENCAPI_URL` env var.
- Drop the `/opt/vault-ca-cert.crt` verify for the ENC request (no TLS needed in-cluster).
- Leave the response normalization identical: classes coerced to a list, `enc_role`/`enc_env` params set, `environment` stripped when it equals `testing`.

Verified with `kubectl kustomize apps/overlays/au-syd1/puppet` (builds clean, exit 0); the generated `puppet-encapi-enc` configmap contains the new URL and env var.

## 🚨 Merge gate

**Do not merge until encapi is seeded** (terraform-incus `benvin/encapi-seed` PR applied). An empty encapi means every node resolves to a 404. On 404 the ENC script exits non-zero, so puppet fails the compile rather than classifying the node with zero classes — nodes will fail to run until they exist in encapi. Seed encapi first so real nodes classify correctly; only unknown nodes should 404.

Reviewed-on: #272
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -191,9 +191,9 @@ spec:
           mkdir -p /opt/bin
           mkdir -p /opt/bin/.cache/uv
 
-          # Copy cobbler to shared bin volume
-          cp /configmaps/cobbler-enc /opt/bin/cobbler-enc
-          chmod +x /opt/bin/cobbler-enc
+          # Copy encapi ENC script to shared bin volume
+          cp /configmaps/encapi-enc /opt/bin/encapi-enc
+          chmod +x /opt/bin/encapi-enc
 
           # Install uv to shared bin volume
           cd /tmp
@@ -206,9 +206,9 @@ spec:
         volumeMounts:
         - mountPath: /opt/bin/
           name: puppet-shared-bins
-        - mountPath: /configmaps/cobbler-enc
-          name: puppet-cobbler-enc
-          subPath: cobbler-enc
+        - mountPath: /configmaps/encapi-enc
+          name: puppet-encapi-enc
+          subPath: encapi-enc
       securityContext:
         fsGroup: 999
       volumes:
@@ -231,9 +231,9 @@ spec:
       - name: compiler-autosign-conf
         configMap:
           name: compiler-autosign.conf
-      - name: puppet-cobbler-enc
+      - name: puppet-encapi-enc
         configMap:
-          name: puppet-cobbler-enc
+          name: puppet-encapi-enc
       - name: puppet-shared-bins
         persistentVolumeClaim:
           claimName: puppet-shared-bins

apps/base/puppet/kustomization.yaml

@@ -53,9 +53,9 @@ configMapGenerator:
       - resources/compiler/puppetdb.conf
     options:
       disableNameSuffixHash: true
-  - name: puppet-cobbler-enc
+  - name: puppet-encapi-enc
     files:
-      - resources/cobbler-enc
+      - resources/encapi-enc
     options:
       disableNameSuffixHash: true
   - name: additional-ruby-gems

apps/base/puppet/resources/compiler/puppet.conf

@@ -11,7 +11,7 @@ logdir = /var/log/puppetlabs/puppetserver
 rundir = /var/run/puppetlabs/puppetserver
 pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
 node_terminus = exec
-external_nodes = /opt/bin/cobbler-enc
+external_nodes = /opt/bin/encapi-enc
 autosign = /etc/puppetlabs/puppet/autosign.conf
 storeconfigs = true
 storeconfigs_backend = puppetdb

apps/base/puppet/resources/encapi-enc

@@ -10,17 +10,22 @@ If the environment specified in the YAML file is 'testing',
 the environment is not included in the output.
 """
 
+import os
 import sys
 import yaml
 import requests
 
-def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
+# In-cluster encapi service (cobbler-wire-compatible endpoint). Plain HTTP,
+# so no CA bundle is needed. Overridable via ENCAPI_URL.
+ENCAPI_URL = os.environ.get("ENCAPI_URL", "http://encapi.encapi.svc.cluster.local")
+
+def fetch_enc_data(base_url: str, hostname: str) -> str:
     """
     Fetches and modifies ENC data from a given URL to ensure classes are in list format.
     """
-    url = f"{cobbler_url}/cblr/svc/op/puppet/hostname/{hostname}"
+    url = f"{base_url}/cblr/svc/op/puppet/hostname/{hostname}"
     try:
-        response = requests.get(url, verify='/opt/vault-ca-cert.crt')
+        response = requests.get(url)
         response.raise_for_status()
     except requests.RequestException as e:
         sys.exit(f"Request failed: {e}")
@@ -47,4 +52,4 @@ def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
 if __name__ == "__main__":
     if len(sys.argv) != 2:
         sys.exit(f"Usage: {sys.argv[0]} <hostname>")
-    print(fetch_enc_data("https://cobbler.main.unkin.net", sys.argv[1]))
+    print(fetch_enc_data(ENCAPI_URL, sys.argv[1]))