planning stage:

- change from statefulset -> deployment
- manage the puppet.conf and puppetdb.conf

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -1,5 +1,5 @@
 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
   annotations:
     reloader.stakater.com/auto: "true"
@@ -11,12 +11,10 @@ metadata:
   name: puppetserver-compiler
   namespace: puppet
 spec:
-  podManagementPolicy: OrderedReady
   selector:
     matchLabels:
       app.kubernetes.io/component: puppetserver-compilers
       app.kubernetes.io/name: puppetserver
-  serviceName: puppet-headless
   template:
     metadata:
       labels:
@@ -165,20 +163,12 @@ spec:
       - name: puppet-code-volume
         persistentVolumeClaim:
           claimName: puppetserver-code-shared
+      - name: puppet-puppet-volume
+        persistentVolumeClaim:
+          claimName: puppetserver-compiler-config-shared
       - name: eyaml-keys
         secret:
           secretName: eyaml-keys
           defaultMode: 0600
-  updateStrategy:
+  strategy:
     type: RollingUpdate
-  volumeClaimTemplates:
-  - metadata:
-      annotations: null
-      name: puppet-puppet-volume
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 1Gi
-      storageClassName: cephrbd-fast-delete

apps/base/puppet/kustomization.yaml

@@ -31,4 +31,18 @@ resources:
   - service_puppetca.yaml
   - service_puppetboard.yaml
   - service_puppetdb.yaml
-  - statefulset_puppetserver-compiler.yaml
+  - deployment_puppetserver-compiler.yaml
+
+configMapGenerator:
+  - name: compiler-autosign.conf
+    files:
+      - resources/compiler/autosign.conf
+  - name: compiler-puppet.conf
+    files:
+      - resources/compiler/puppet.conf
+  - name: compiler-puppetdb.conf
+    files:
+      - resources/compiler/puppetdb.conf
+  - name: puppet-cobbler-enc
+    files:
+      - resources/cobbler-enc

apps/base/puppet/persistentvolumeclaims.yaml

@@ -106,3 +106,21 @@ spec:
     requests:
       storage: 1Gi
   storageClassName: cephfs-raid6-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-compiler-config-shared
+  namespace: puppet
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: cephfs-raid6-delete

apps/base/puppet/resources/cobbler-enc

@@ -0,0 +1,50 @@
+#!/usr/bin/env -S uv run --quiet --script
+# /// script
+# requires-python = ">=3.11"
+# dependencies = ['pyyaml','requests']
+# ///
+"""
+External Node Classifier (ENC) for Puppet.
+
+If the environment specified in the YAML file is 'testing',
+the environment is not included in the output.
+"""
+
+import sys
+import yaml
+import requests
+
+def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
+    """
+    Fetches and modifies ENC data from a given URL to ensure classes are in list format.
+    """
+    url = f"{cobbler_url}/cblr/svc/op/puppet/hostname/{hostname}"
+    try:
+        response = requests.get(url, verify='/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem')
+        response.raise_for_status()
+    except requests.RequestException as e:
+        sys.exit(f"Request failed: {e}")
+
+    data = yaml.safe_load(response.text)
+    data["parameters"] = data.get("parameters", {})
+
+    # Ensure 'classes' is in the desired list format
+    if "classes" in data:
+        if isinstance(data["classes"], dict):
+            data["parameters"]["enc_role"] = list(data["classes"].keys())
+            data["classes"] = list(data["classes"].keys())
+        else:
+            data["parameters"]["enc_role"] = list(data["classes"])
+            data["classes"] = list(data["classes"])
+
+    if "environment" in data:
+        data["parameters"]["enc_env"] = data["environment"]
+        if data["environment"] == "testing":
+            del data["environment"]
+
+    return yaml.dump(data)
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        sys.exit(f"Usage: {sys.argv[0]} <hostname>")
+    print(fetch_enc_data("https://cobbler.main.unkin.net", sys.argv[1]))

apps/base/puppet/resources/compiler/autosign.conf

@@ -0,0 +1,15 @@
+# Autosign all nodes from these subnets
+198.18.13.0/24
+198.18.14.0/24
+198.18.15.0/24
+198.18.16.0/24
+198.18.17.0/24
+198.18.20.0/24
+198.18.24.0/24
+198.18.25.0/24
+198.18.26.0/24
+198.18.27.0/24
+198.18.28.0/24
+198.18.29.0/24
+# Autosign all nodes from these domains
+*.main.unkin.net

apps/base/puppet/resources/compiler/puppet.conf

@@ -0,0 +1,23 @@
+[main]
+server = puppetserver-compiler
+serverport = 8140
+dns_alt_names = puppetserver-compiler,puppet-headless,puppet,puppet.k8s.syd1.au.unkin.net
+
+[server]
+vardir = /opt/puppetlabs/server/data/puppetserver
+logdir = /var/log/puppetlabs/puppetserver
+rundir = /var/run/puppetlabs/puppetserver
+pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
+codedir = /etc/puppetlabs/code
+environmentpath = /etc/puppetlabs/code/environments
+
+[master]
+node_terminus = exec
+external_nodes = /usr/local/bin/cobbler-enc
+autosign = /etc/puppetlabs/puppet/autosign.conf
+default_manifest = /etc/puppetlabs/code/environments/develop/manifests
+default_environment = develop
+storeconfigs = true
+storeconfigs_backend = puppetdb
+reports = puppetdb
+usecacheonfailure = false

apps/base/puppet/resources/compiler/puppetdb.conf

@@ -0,0 +1,3 @@
+[main]
+server_urls = https://puppetdb.k8s.syd1.au.unkin.net
+soft_write_failure = true