feat: initial puppet deployment

working towards a larger, redundant, autoscaling and simple puppet
implementation in kubernetes. this was originally based on the openvox
helm chart with several improvements (not all in this pr)

- use of cnpg instead of single bitnamilegacy postgres container
- use for g10k instead of r10k
- run one instance of g10k per namespace, instead of per-pod
- store only keep one copy of the environments/branches (instead of per-pod)
- change g10k to native cronjob instead of hacky implementation
- use vault secrets

part one adds:

- cnpg puppetdb pgsql cluster
- cnpg puppetdb pgpooler
- persistent volume claims for puppet, puppetdb, the code repository, etc

apps/base/puppet/cronjob_g10k-code.yaml

@@ -0,0 +1,106 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: r10k-code
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: g10k-code
+  namespace: puppet
+spec:
+  schedule: "*/1 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/component: g10k-code
+            app.kubernetes.io/instance: puppetserver
+            app.kubernetes.io/name: puppetserver
+            app.kubernetes.io/version: 8.8.0
+        spec:
+          hostname: g10k-code
+          imagePullSecrets: null
+          initContainers:
+            - name: fetch-config
+              image: alpine/git:latest
+              imagePullPolicy: IfNotPresent
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 64Mi
+                limits:
+                  cpu: 100m
+                  memory: 128Mi
+              args:
+                - |
+                  set -e
+                  echo "Cloning r10k config repository..."
+                  git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/config
+                  cp /tmp/config/r10k.yaml /shared/r10k.yaml
+                  echo "r10k.yaml fetched successfully"
+              command:
+                - /bin/sh
+                - -c
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - all
+                runAsGroup: 999
+                runAsNonRoot: true
+                runAsUser: 999
+              volumeMounts:
+                - mountPath: /shared
+                  name: shared-config
+          containers:
+            - name: g10k-code
+              image: git.unkin.net/unkin/almalinux9-g10k:20260308
+              imagePullPolicy: IfNotPresent
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 128Mi
+                limits:
+                  cpu: 200m
+                  memory: 256Mi
+              args:
+                - -config
+                - /shared/r10k.yaml
+              command:
+                - /usr/bin/g10k
+              envFrom: null
+              env: []
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - all
+                runAsGroup: 999
+                runAsNonRoot: true
+                runAsUser: 999
+              volumeMounts:
+                - mountPath: /etc/puppetlabs/code/
+                  name: puppet-code-volume
+                - mountPath: /opt/puppetlabs/cache/
+                  name: puppet-cache-volume
+                - mountPath: /shared
+                  name: shared-config
+          restartPolicy: OnFailure
+          securityContext:
+            fsGroup: 999
+          volumes:
+            - name: puppet-code-volume
+              persistentVolumeClaim:
+                claimName: puppetserver-code-shared
+            - name: puppet-cache-volume
+              persistentVolumeClaim:
+                claimName: puppetserver-cache
+            - name: shared-config
+              persistentVolumeClaim:
+                claimName: puppetserver-shared-config