Switch puppet compiler ENC from Cobbler to encapi

The k8s puppetserver compilers classify nodes via an exec ENC that
currently queries legacy Cobbler over TLS. encapi now exposes a
cobbler-wire-compatible endpoint in-cluster, so point the ENC at it as
a prerequisite for migrating VM agents onto puppet-on-k8s.

- Rename the ENC script cobbler-enc -> encapi-enc (and its configmap
  puppet-cobbler-enc -> puppet-encapi-enc, external_nodes path, and
  deployment volume/initContainer references)
- Target http://encapi.encapi.svc.cluster.local (plain in-cluster HTTP),
  overridable via ENCAPI_URL env var
- Drop the /opt/vault-ca-cert.crt verify for this request (no TLS
  in-cluster); classes-list / enc_env / testing-strip normalization
  unchanged

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -191,9 +191,9 @@ spec:
           mkdir -p /opt/bin
           mkdir -p /opt/bin/.cache/uv
 
-          # Copy cobbler to shared bin volume
+          # Copy encapi ENC script to shared bin volume
-          cp /configmaps/cobbler-enc /opt/bin/cobbler-enc
+          cp /configmaps/encapi-enc /opt/bin/encapi-enc
-          chmod +x /opt/bin/cobbler-enc
+          chmod +x /opt/bin/encapi-enc
 
           # Install uv to shared bin volume
           cd /tmp
@@ -206,9 +206,9 @@ spec:
         volumeMounts:
         - mountPath: /opt/bin/
           name: puppet-shared-bins
-        - mountPath: /configmaps/cobbler-enc
+        - mountPath: /configmaps/encapi-enc
-          name: puppet-cobbler-enc
+          name: puppet-encapi-enc
-          subPath: cobbler-enc
+          subPath: encapi-enc
       securityContext:
         fsGroup: 999
       volumes:
@@ -231,9 +231,9 @@ spec:
       - name: compiler-autosign-conf
         configMap:
           name: compiler-autosign.conf
-      - name: puppet-cobbler-enc
+      - name: puppet-encapi-enc
         configMap:
-          name: puppet-cobbler-enc
+          name: puppet-encapi-enc
       - name: puppet-shared-bins
         persistentVolumeClaim:
           claimName: puppet-shared-bins

apps/base/puppet/kustomization.yaml

@@ -53,9 +53,9 @@ configMapGenerator:
       - resources/compiler/puppetdb.conf
     options:
       disableNameSuffixHash: true
-  - name: puppet-cobbler-enc
+  - name: puppet-encapi-enc
     files:
-      - resources/cobbler-enc
+      - resources/encapi-enc
     options:
       disableNameSuffixHash: true
   - name: additional-ruby-gems

apps/base/puppet/resources/compiler/puppet.conf

@@ -11,7 +11,7 @@ logdir = /var/log/puppetlabs/puppetserver
 rundir = /var/run/puppetlabs/puppetserver
 pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
 node_terminus = exec
-external_nodes = /opt/bin/cobbler-enc
+external_nodes = /opt/bin/encapi-enc
 autosign = /etc/puppetlabs/puppet/autosign.conf
 storeconfigs = true
 storeconfigs_backend = puppetdb

apps/base/puppet/resources/encapi-enc

@@ -10,17 +10,22 @@ If the environment specified in the YAML file is 'testing',
 the environment is not included in the output.
 """
 
+import os
 import sys
 import yaml
 import requests
 
-def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
+# In-cluster encapi service (cobbler-wire-compatible endpoint). Plain HTTP,
+# so no CA bundle is needed. Overridable via ENCAPI_URL.
+ENCAPI_URL = os.environ.get("ENCAPI_URL", "http://encapi.encapi.svc.cluster.local")
+
+def fetch_enc_data(base_url: str, hostname: str) -> str:
     """
     Fetches and modifies ENC data from a given URL to ensure classes are in list format.
     """
-    url = f"{cobbler_url}/cblr/svc/op/puppet/hostname/{hostname}"
+    url = f"{base_url}/cblr/svc/op/puppet/hostname/{hostname}"
     try:
-        response = requests.get(url, verify='/opt/vault-ca-cert.crt')
+        response = requests.get(url)
         response.raise_for_status()
     except requests.RequestException as e:
         sys.exit(f"Request failed: {e}")
@@ -47,4 +52,4 @@ def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
 if __name__ == "__main__":
     if len(sys.argv) != 2:
         sys.exit(f"Usage: {sys.argv[0]} <hostname>")
-    print(fetch_enc_data("https://cobbler.main.unkin.net", sys.argv[1]))
+    print(fetch_enc_data(ENCAPI_URL, sys.argv[1]))