diff --git a/apps/base/puppet/statefulset_puppetserver-compiler.yaml b/apps/base/puppet/deployment_puppetserver-compiler.yaml similarity index 93% rename from apps/base/puppet/statefulset_puppetserver-compiler.yaml rename to apps/base/puppet/deployment_puppetserver-compiler.yaml index 38824e6..93ddedc 100644 --- a/apps/base/puppet/statefulset_puppetserver-compiler.yaml +++ b/apps/base/puppet/deployment_puppetserver-compiler.yaml @@ -1,5 +1,5 @@ apiVersion: apps/v1 -kind: StatefulSet +kind: Deployment metadata: annotations: reloader.stakater.com/auto: "true" @@ -11,12 +11,10 @@ metadata: name: puppetserver-compiler namespace: puppet spec: - podManagementPolicy: OrderedReady selector: matchLabels: app.kubernetes.io/component: puppetserver-compilers app.kubernetes.io/name: puppetserver - serviceName: puppet-headless template: metadata: labels: @@ -165,20 +163,12 @@ spec: - name: puppet-code-volume persistentVolumeClaim: claimName: puppetserver-code-shared + - name: puppet-puppet-volume + persistentVolumeClaim: + claimName: puppetserver-compiler-config-shared - name: eyaml-keys secret: secretName: eyaml-keys defaultMode: 0600 - updateStrategy: + strategy: type: RollingUpdate - volumeClaimTemplates: - - metadata: - annotations: null - name: puppet-puppet-volume - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - storageClassName: cephrbd-fast-delete diff --git a/apps/base/puppet/kustomization.yaml b/apps/base/puppet/kustomization.yaml index b169986..684f650 100644 --- a/apps/base/puppet/kustomization.yaml +++ b/apps/base/puppet/kustomization.yaml @@ -31,4 +31,18 @@ resources: - service_puppetca.yaml - service_puppetboard.yaml - service_puppetdb.yaml - - statefulset_puppetserver-compiler.yaml + - deployment_puppetserver-compiler.yaml + +configMapGenerator: + - name: compiler-autosign.conf + files: + - resources/compiler/autosign.conf + - name: compiler-puppet.conf + files: + - resources/compiler/puppet.conf + - name: compiler-puppetdb.conf + files: + - resources/compiler/puppetdb.conf + - name: puppet-cobbler-enc + files: + - resources/cobbler-enc diff --git a/apps/base/puppet/persistentvolumeclaims.yaml b/apps/base/puppet/persistentvolumeclaims.yaml index d89b812..dda0468 100644 --- a/apps/base/puppet/persistentvolumeclaims.yaml +++ b/apps/base/puppet/persistentvolumeclaims.yaml @@ -106,3 +106,21 @@ spec: requests: storage: 1Gi storageClassName: cephfs-raid6-delete +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + labels: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-compiler-config-shared + namespace: puppet +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi + storageClassName: cephfs-raid6-delete diff --git a/apps/base/puppet/resources/cobbler-enc b/apps/base/puppet/resources/cobbler-enc new file mode 100755 index 0000000..99f2f63 --- /dev/null +++ b/apps/base/puppet/resources/cobbler-enc @@ -0,0 +1,50 @@ +#!/usr/bin/env -S uv run --quiet --script +# /// script +# requires-python = ">=3.11" +# dependencies = ['pyyaml','requests'] +# /// +""" +External Node Classifier (ENC) for Puppet. + +If the environment specified in the YAML file is 'testing', +the environment is not included in the output. +""" + +import sys +import yaml +import requests + +def fetch_enc_data(cobbler_url: str, hostname: str) -> str: + """ + Fetches and modifies ENC data from a given URL to ensure classes are in list format. + """ + url = f"{cobbler_url}/cblr/svc/op/puppet/hostname/{hostname}" + try: + response = requests.get(url, verify='/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem') + response.raise_for_status() + except requests.RequestException as e: + sys.exit(f"Request failed: {e}") + + data = yaml.safe_load(response.text) + data["parameters"] = data.get("parameters", {}) + + # Ensure 'classes' is in the desired list format + if "classes" in data: + if isinstance(data["classes"], dict): + data["parameters"]["enc_role"] = list(data["classes"].keys()) + data["classes"] = list(data["classes"].keys()) + else: + data["parameters"]["enc_role"] = list(data["classes"]) + data["classes"] = list(data["classes"]) + + if "environment" in data: + data["parameters"]["enc_env"] = data["environment"] + if data["environment"] == "testing": + del data["environment"] + + return yaml.dump(data) + +if __name__ == "__main__": + if len(sys.argv) != 2: + sys.exit(f"Usage: {sys.argv[0]} ") + print(fetch_enc_data("https://cobbler.main.unkin.net", sys.argv[1])) diff --git a/apps/base/puppet/resources/compiler/autosign.conf b/apps/base/puppet/resources/compiler/autosign.conf new file mode 100644 index 0000000..c7ffc94 --- /dev/null +++ b/apps/base/puppet/resources/compiler/autosign.conf @@ -0,0 +1,15 @@ +# Autosign all nodes from these subnets +198.18.13.0/24 +198.18.14.0/24 +198.18.15.0/24 +198.18.16.0/24 +198.18.17.0/24 +198.18.20.0/24 +198.18.24.0/24 +198.18.25.0/24 +198.18.26.0/24 +198.18.27.0/24 +198.18.28.0/24 +198.18.29.0/24 +# Autosign all nodes from these domains +*.main.unkin.net diff --git a/apps/base/puppet/resources/compiler/puppet.conf b/apps/base/puppet/resources/compiler/puppet.conf new file mode 100644 index 0000000..fad2e46 --- /dev/null +++ b/apps/base/puppet/resources/compiler/puppet.conf @@ -0,0 +1,23 @@ +[main] +server = puppetserver-compiler +serverport = 8140 +dns_alt_names = puppetserver-compiler,puppet-headless,puppet,puppet.k8s.syd1.au.unkin.net + +[server] +vardir = /opt/puppetlabs/server/data/puppetserver +logdir = /var/log/puppetlabs/puppetserver +rundir = /var/run/puppetlabs/puppetserver +pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid +codedir = /etc/puppetlabs/code +environmentpath = /etc/puppetlabs/code/environments + +[master] +node_terminus = exec +external_nodes = /usr/local/bin/cobbler-enc +autosign = /etc/puppetlabs/puppet/autosign.conf +default_manifest = /etc/puppetlabs/code/environments/develop/manifests +default_environment = develop +storeconfigs = true +storeconfigs_backend = puppetdb +reports = puppetdb +usecacheonfailure = false diff --git a/apps/base/puppet/resources/compiler/puppetdb.conf b/apps/base/puppet/resources/compiler/puppetdb.conf new file mode 100644 index 0000000..72bc228 --- /dev/null +++ b/apps/base/puppet/resources/compiler/puppetdb.conf @@ -0,0 +1,3 @@ +[main] +server_urls = https://puppetdb.k8s.syd1.au.unkin.net +soft_write_failure = true