feat: complete puppet infrastructure (#29)

complete the implementation of puppet in kubernetes, taking many
features from the openvox helm chart and improving on them. changes from
helm are:
- using vault for storing secrets
- using g10k instead of r10k
- using a single shared g10k cronjob for all masters/compilers
- using a single shared /etc/puppetlabs/code directory (shared, cephfs)

changes:
- deploy puppet master and compiler servers with statefulset/deployment
- deploy puppetdb with postgresql backend, taking advantage of cnpg cluster and pooler
- deploy puppetboard
- all supporting configmaps, services, ingresses, and hpas
- added vaultstaticsecret for eyaml private keys
- configured secure mounting of eyaml keys at /var/lib/puppet/keys/
- updated base kustomization to include all 23 new puppet resource files

Reviewed-on: #29

apps/base/puppet/configmap_puppetboard-config.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard-config
+  namespace: puppet
+data:
+  PUPPETDB_HOST: "puppetdb"
+  PUPPETDB_PORT: "8080"
+  LOGLEVEL: "info"
+  PUPPETDB_TIMEOUT: "20"
+  UNRESPONSIVE_HOURS: "3"
+  ENABLE_CATALOG: "False"
+  ENABLE_QUERY: "True"
+  LOCALISE_TIMESTAMP: "True"
+  OFFLINE_MODE: "True"
+  DEFAULT_ENVIRONMENT: "*"
+  REPORTS_COUNT: "40"

apps/base/puppet/configmap_puppetdb-config.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb-config
+  namespace: puppet
+data:
+  OPENVOXSERVER_HOSTNAME: "puppetca"
+  OPENVOXSERVER_PORT: "8140"
+  DNS_ALT_NAMES: "openvoxdb,puppetdb,puppetdb.k8s.syd1.au.unkin.net,puppetdb.puppet.svc.cluster.local"
+  OPENVOXDB_POSTGRES_HOSTNAME: "puppet-postgres-pooler"
+  OPENVOXDB_POSTGRES_DATABASE: "puppetdb"
+  OPENVOXDB_POSTGRES_PORT: "5432"
+  PUPPETDB_JAVA_ARGS: ""

apps/base/puppet/configmap_puppetserver-compiler-config.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-compiler-config
+  namespace: puppet
+data:
+  OPENVOXSERVER_PORT: "8140"
+  DNS_ALT_NAMES: "puppetserver-compiler-0,puppetserver-compiler-1,puppetserver-compiler-2,puppetserver-compiler-3,puppetserver-compiler-4,puppetserver-compiler,puppet,puppet.k8s.syd1.au.unkin.net"
+  OPENVOXDB_SERVER_URLS: "https://puppetdb:8081"
+  CA_ENABLED: "false"
+  CA_HOSTNAME: "puppetca"
+  CA_PORT: "8140"
+  PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false"

apps/base/puppet/configmap_puppetserver-init-config.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver-init
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-init-config
+  namespace: puppet
+data:
+  PUPPET_DATA_DIR: "/etc/puppetlabs/code/environments"
+  PUPPET_SSL_DIR: "/etc/puppetlabs/puppet/ssl/certs"
+  PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false"

apps/base/puppet/configmap_puppetserver-init-masters-config.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+data:
+  check_for_masters.sh: |
+    #!/usr/bin/env bash
+    if [[ -d "$PUPPET_SSL_DIR" ]]; then
+        ls -la /etc/puppetlabs/puppet/ssl/certs/
+        echo "A Puppetserver master has already started running."
+        echo "Waiting to finish the generation of the Puppet SSL certs..."
+        sleep 5
+        while ! [[ -n "$(find /etc/puppetlabs/puppet/ssl/certs -name 'puppet*.pem' | head -1)" ]];
+            do
+              echo "Still waiting..."
+              sleep 5
+            done
+        sleep 15
+        echo "Puppet SSL certs have been generated. Continuing..."
+    else
+        echo "No other Puppetserver master is running. Continuing..."
+    fi
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-init-masters-config
+  namespace: puppet

apps/base/puppet/configmap_puppetserver-master-config.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-master-config
+  namespace: puppet
+data:
+  OPENVOXSERVER_HOSTNAME: "puppet"
+  OPENVOXSERVER_PORT: "8140"
+  DNS_ALT_NAMES: "puppet,puppetserver-agents-to-puppet,puppetca,puppet-compilers,puppetca.k8s.syd1.au.unkin.net,puppet.k8s.syd1.au.unkin.net"
+  OPENVOXDB_SERVER_URLS: "https://puppetdb:8081"
+  CA_ALLOW_SUBJECT_ALT_NAMES: "true"
+  PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false"

apps/base/puppet/deployment_puppetboard.yaml

@@ -0,0 +1,57 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: puppetboard
+      app.kubernetes.io/name: puppetserver
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app.kubernetes.io/component: puppetboard
+        app.kubernetes.io/instance: puppetserver
+        app.kubernetes.io/name: puppetserver
+        app.kubernetes.io/version: 8.8.0
+    spec:
+      containers:
+        - name: puppetboard
+          image: ghcr.io/voxpupuli/puppetboard:7.0.1
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 9090
+              name: puppetboard
+          envFrom:
+            - configMapRef:
+                name: puppetboard-config
+            - secretRef:
+                name: puppetboard-secrets
+          resources:
+            requests:
+              memory: 350Mi
+              cpu: 100m
+            limits:
+              memory: 1024Mi
+              cpu: 500m
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - all

apps/base/puppet/deployment_puppetdb.yaml

@@ -0,0 +1,151 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: puppetdb
+      app.kubernetes.io/name: puppetserver
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app.kubernetes.io/component: puppetdb
+        app.kubernetes.io/instance: puppetserver
+        app.kubernetes.io/name: puppetserver
+        app.kubernetes.io/version: 8.8.0
+    spec:
+      hostname: puppetdb
+      imagePullSecrets: null
+      containers:
+        - name: puppetdb
+          image: ghcr.io/openvoxproject/openvoxdb:8.9.0-main
+          imagePullPolicy: IfNotPresent
+          resources:
+            limits:
+              cpu: 1
+              memory: 1536Mi
+            requests:
+              cpu: 250m
+              memory: 512Mi
+          ports:
+            - containerPort: 8080
+              name: pdb-http
+            - containerPort: 8081
+              name: pdb-https
+          envFrom:
+            - configMapRef:
+                name: puppetdb-config
+          env:
+            - name: OPENVOXDB_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: postgres-credentials
+            - name: OPENVOXDB_POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  key: username
+                  name: postgres-credentials
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+                - CAP_FOWNER
+                - CAP_CHOWN
+                - CAP_SETUID
+                - CAP_SETGID
+                - CAP_DAC_OVERRIDE
+                - FOWNER
+                - CHOWN
+                - SETUID
+                - SETGID
+                - DAC_OVERRIDE
+              drop:
+                - all
+          volumeMounts:
+            - mountPath: /opt/puppetlabs/server/data/puppetdb
+              name: puppetdb-storage
+      initContainers:
+        - name: create-log-dir
+          image: docker.io/busybox:1.37
+          command:
+            - sh
+            - -c
+            - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs
+          volumeMounts:
+            - mountPath: /opt/puppetlabs/server/data/puppetdb
+              name: puppetdb-storage
+          securityContext:
+            runAsUser: 0
+          resources:
+            limits:
+              cpu: 20m
+              memory: 32Mi
+            requests:
+              cpu: 20m
+              memory: 32Mi
+        - command:
+            - sh
+            - -c
+            - |
+              echo 'Waiting for PostgreSQL to become ready...'
+              until printf "." && nc -z -w 2 puppet-postgres-pooler 5432; do
+                  sleep 2;
+              done;
+              echo 'PostgreSQL OK ✓'
+          image: docker.io/busybox:1.37
+          imagePullPolicy: IfNotPresent
+          name: pgchecker
+          resources:
+            limits:
+              cpu: 20m
+              memory: 32Mi
+            requests:
+              cpu: 20m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
+        - command:
+            - sh
+            - -c
+            - |
+              echo 'Waiting for puppetserver to become ready...'
+              until printf "." && curl --silent --fail --insecure 'https://puppetserver-puppet:8140/status/v1/simple' | grep -q '^running$'; do
+                sleep 2;
+              done;
+              echo 'Puppetserver OK ✓'
+          image: curlimages/curl:8.11.1
+          imagePullPolicy: IfNotPresent
+          name: wait-puppetserver
+          resources:
+            limits:
+              cpu: 20m
+              memory: 32Mi
+            requests:
+              cpu: 20m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
+      volumes:
+        - name: puppetdb-storage
+          persistentVolumeClaim:
+            claimName: puppetserver-puppetdb-claim

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -0,0 +1,164 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    reloader.stakater.com/auto: "true"
+  labels:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-master
+  namespace: puppet
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: puppetserver
+      app.kubernetes.io/name: puppetserver
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app.kubernetes.io/component: puppetserver
+        app.kubernetes.io/instance: puppetserver
+        app.kubernetes.io/name: puppetserver
+        app.kubernetes.io/version: 8.8.0
+    spec:
+      hostname: puppet
+      imagePullSecrets: null
+      containers:
+        - name: puppetserver
+          image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
+          imagePullPolicy: IfNotPresent
+          resources:
+            limits:
+              cpu: 2
+              memory: 3500Mi
+            requests:
+              cpu: 250m
+              memory: 1024Mi
+          ports:
+            - containerPort: 8140
+          envFrom:
+            - configMapRef:
+                name: puppetserver-master-config
+          livenessProbe:
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            tcpSocket:
+              port: 8140
+            timeoutSeconds: 10
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /status/v1/simple
+              port: 8140
+              scheme: HTTPS
+            periodSeconds: 60
+            successThreshold: 1
+            timeoutSeconds: 20
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+                - CAP_CHOWN
+                - CAP_SETUID
+                - CAP_SETGID
+                - CAP_DAC_OVERRIDE
+                - CAP_AUDIT_WRITE
+                - CAP_FOWNER
+                - CHOWN
+                - SETUID
+                - SETGID
+                - DAC_OVERRIDE
+                - AUDIT_WRITE
+                - FOWNER
+              drop:
+                - all
+          startupProbe:
+            failureThreshold: 30
+            periodSeconds: 60
+            tcpSocket:
+              port: 8140
+          volumeMounts:
+            - mountPath: /etc/puppetlabs/puppet/
+              name: puppet-puppet-storage
+            - mountPath: /etc/puppetlabs/puppetserver/ca/
+              name: puppet-ca-storage
+            - mountPath: /var/lib/puppet/keys/
+              name: eyaml-keys
+              readOnly: true
+      initContainers:
+        - args:
+            - mkdir -p /etc/puppetlabs/puppet/eyaml/keys;
+              cp /tmp/puppet/configmap/check_for_masters.sh /etc/puppetlabs/puppet/check_for_masters.sh;
+              chown puppet:puppet /etc/puppetlabs/puppet/check_for_masters.sh;
+              chmod +x /etc/puppetlabs/puppet/check_for_masters.sh;
+              bash /etc/puppetlabs/puppet/check_for_masters.sh;
+              mkdir -p /etc/puppetlabs/code/environments;
+              mkdir -p /etc/puppetlabs/puppet/manifests;
+              chown -R puppet:puppet /etc/puppetlabs;
+              mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/;
+              touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde;
+              chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
+          command:
+            - sh
+            - -c
+          envFrom:
+            - configMapRef:
+                name: puppetserver-init-config
+          image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
+          imagePullPolicy: IfNotPresent
+          name: perms-and-dirs
+          resources:
+            limits:
+              cpu: 300m
+              memory: 256Mi
+            requests:
+              cpu: 200m
+              memory: 128Mi
+          securityContext:
+            capabilities:
+              add:
+                - CAP_CHOWN
+                - CAP_SETUID
+                - CAP_SETGID
+                - CAP_DAC_OVERRIDE
+                - CAP_AUDIT_WRITE
+                - CAP_FOWNER
+                - CHOWN
+                - SETUID
+                - SETGID
+                - DAC_OVERRIDE
+                - AUDIT_WRITE
+                - FOWNER
+              drop:
+                - all
+            runAsNonRoot: false
+            runAsUser: 0
+          volumeMounts:
+            - mountPath: /etc/puppetlabs/puppet/
+              name: puppet-puppet-storage
+            - mountPath: /tmp/puppet/configmap/check_for_masters.sh
+              name: init-masters-volume
+              subPath: check_for_masters.sh
+      securityContext:
+        fsGroup: 999
+      volumes:
+        - name: puppet-ca-storage
+          persistentVolumeClaim:
+            claimName: puppetserver-ca-claim
+        - name: puppet-puppet-storage
+          persistentVolumeClaim:
+            claimName: puppetserver-puppet-claim
+        - configMap:
+            name: puppetserver-init-masters-config
+          name: init-masters-volume
+        - name: eyaml-keys
+          secret:
+            secretName: eyaml-keys
+            defaultMode: 0600

apps/base/puppet/horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml

@@ -0,0 +1,37 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-compiler-autoscaler
+  namespace: puppet
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: StatefulSet
+    name: puppetserver-compiler
+  minReplicas: 2
+  maxReplicas: 5
+  metrics:
+  - resource:
+      name: cpu
+      target:
+        averageUtilization: 75
+        type: Utilization
+    type: Resource
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+      - type: Percent
+        value: 50
+        periodSeconds: 15
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+      - type: Percent
+        value: 25
+        periodSeconds: 60

apps/base/puppet/horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml

@@ -0,0 +1,37 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-masters-autoscaler
+  namespace: puppet
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: puppetserver-master
+  minReplicas: 2
+  maxReplicas: 5
+  metrics:
+  - resource:
+      name: cpu
+      target:
+        averageUtilization: 75
+        type: Utilization
+    type: Resource
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+      - type: Percent
+        value: 50
+        periodSeconds: 15
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+      - type: Percent
+        value: 25
+        periodSeconds: 60

apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml

@@ -0,0 +1,44 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-puppetboard-autoscaler
+  namespace: puppet
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: puppetboard
+  minReplicas: 2
+  maxReplicas: 5
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 70
+  - type: Resource
+    resource:
+      name: memory
+      target:
+        type: Utilization
+        averageUtilization: 90
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+      - type: Percent
+        value: 100
+        periodSeconds: 15
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+      - type: Percent
+        value: 50
+        periodSeconds: 60

apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml

@@ -0,0 +1,44 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-puppetdb-autoscaler
+  namespace: puppet
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: puppetdb
+  minReplicas: 2
+  maxReplicas: 5
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 70
+  - type: Resource
+    resource:
+      name: memory
+      target:
+        type: Utilization
+        averageUtilization: 90
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+      - type: Percent
+        value: 100
+        periodSeconds: 15
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+      - type: Percent
+        value: 50
+        periodSeconds: 60

apps/base/puppet/ingress_puppetboard.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-puppetboard
+  namespace: puppet
+spec:
+  rules:
+    - host: puppetboard.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetboard
+                port:
+                  number: 9090
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - puppetboard.k8s.syd1.au.unkin.net
+      secretName: puppetboard-tls

apps/base/puppet/ingress_puppetdb.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  rules:
+    - host: puppetdb.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetdb
+                port:
+                  number: 8081
+            path: /
+            pathType: Prefix

apps/base/puppet/ingress_puppetserver-compilers.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: puppet.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+  labels:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-compiler
+  namespace: puppet
+spec:
+  rules:
+    - host: puppet.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetserver-compiler
+                port:
+                  number: 8140
+            path: /
+            pathType: ImplementationSpecific

apps/base/puppet/ingress_puppetserver-masters.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: puppetca.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+  labels:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-masters
+  namespace: puppet
+spec:
+  rules:
+    - host: puppetca.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - backend:
+              service:
+                name: puppetserver-puppet
+                port:
+                  number: 8140
+            path: /
+            pathType: ImplementationSpecific

apps/base/puppet/kustomization.yaml

@@ -10,3 +10,27 @@ resources:
   - persistentvolumeclaims.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - configmap_puppetboard-config.yaml
+  - configmap_puppetdb-config.yaml
+  - configmap_puppetserver-compiler-config.yaml
+  - configmap_puppetserver-init-config.yaml
+  - configmap_puppetserver-init-masters-config.yaml
+  - configmap_puppetserver-master-config.yaml
+  - deployment_puppetboard.yaml
+  - deployment_puppetdb.yaml
+  - deployment_puppetserver-master.yaml
+  - horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml
+  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
+  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
+  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
+  - ingress_puppetboard.yaml
+  - ingress_puppetdb.yaml
+  - ingress_puppetserver-compilers.yaml
+  - ingress_puppetserver-masters.yaml
+  - service_puppetserver-agents-to-puppet.yaml
+  - service_puppetserver-puppet-compilers-headless.yaml
+  - service_puppetserver-puppet-compilers.yaml
+  - service_puppetserver-puppet.yaml
+  - service_puppetserver-puppetboard.yaml
+  - service_puppetserver-puppetdb.yaml
+  - statefulset_puppetserver-compiler.yaml

apps/base/puppet/service_puppetserver-agents-to-puppet.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-agents-to-puppet
+  namespace: puppet
+spec:
+  ports:
+  - name: puppetserver
+    port: 8140
+  selector:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/name: puppetserver
+  type: ClusterIP

apps/base/puppet/service_puppetserver-puppet-compilers-headless.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-compiler-headless
+  namespace: puppet
+spec:
+  clusterIP: None
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8140
+  selector:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/name: puppetserver

apps/base/puppet/service_puppetserver-puppet-compilers.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-compiler
+  namespace: puppet
+spec:
+  ports:
+  - name: puppetserver
+    port: 8140
+  selector:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/name: puppetserver
+  type: ClusterIP

apps/base/puppet/service_puppetserver-puppet.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetca
+  namespace: puppet
+spec:
+  ports:
+  - name: puppetserver
+    port: 8140
+  selector:
+    app.kubernetes.io/component: puppetserver
+    app.kubernetes.io/name: puppetserver
+  type: ClusterIP

apps/base/puppet/service_puppetserver-puppetboard.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  ports:
+  - name: puppetboard
+    port: 9090
+    protocol: TCP
+    targetPort: puppetboard
+  selector:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/name: puppetserver
+  type: ClusterIP

apps/base/puppet/service_puppetserver-puppetdb.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  clusterIP: null
+  ports:
+  - name: pdb-http
+    port: 8080
+    targetPort: pdb-http
+  - name: pdb-https
+    port: 8081
+    targetPort: pdb-https
+  selector:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/name: puppetserver
+  type: ClusterIP

apps/base/puppet/statefulset_puppetserver-compiler.yaml

@@ -0,0 +1,183 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  annotations:
+    reloader.stakater.com/auto: "true"
+  labels:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-compiler
+  namespace: puppet
+spec:
+  podManagementPolicy: OrderedReady
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: puppetserver-compilers
+      app.kubernetes.io/name: puppetserver
+  serviceName: puppet-compilers-headless
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: puppetserver-compilers
+        app.kubernetes.io/instance: puppetserver
+        app.kubernetes.io/name: puppetserver
+        app.kubernetes.io/version: 8.8.0
+    spec:
+      hostname: puppetserver-compiler
+      imagePullSecrets: null
+      containers:
+      - name: puppetserver
+        image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
+        imagePullPolicy: IfNotPresent
+        resources:
+          limits:
+            cpu: 2
+            memory: 3072Mi
+          requests:
+            cpu: 500m
+            memory: 1024Mi
+        ports:
+        - containerPort: 8140
+        envFrom: null
+        env:
+        - name: OPENVOXSERVER_HOSTNAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: OPENVOXSERVER_PORT
+          value: "8140"
+        - name: DNS_ALT_NAMES
+          value: puppetserver-compiler-0,puppetserver-compiler-1,puppetserver-compiler-2,puppetserver-compiler-3,puppetserver-compiler-4,puppet-compilers,puppet,puppet.k8s.syd1.au.unkin.net
+        - name: OPENVOXDB_SERVER_URLS
+          value: https://puppetdb:8081
+        - name: CA_ENABLED
+          value: "false"
+        - name: CA_HOSTNAME
+          value: puppetca
+        - name: CA_PORT
+          value: "8140"
+        - name: PUPPETSERVER_JAVA_ARGS
+          value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
+        livenessProbe:
+          failureThreshold: 3
+          periodSeconds: 30
+          successThreshold: 1
+          tcpSocket:
+            port: 8140
+          timeoutSeconds: 10
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /status/v1/simple
+            port: 8140
+            scheme: HTTPS
+          periodSeconds: 60
+          successThreshold: 1
+          timeoutSeconds: 20
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - CAP_CHOWN
+            - CAP_SETUID
+            - CAP_SETGID
+            - CAP_DAC_OVERRIDE
+            - CAP_AUDIT_WRITE
+            - CAP_FOWNER
+            - CHOWN
+            - SETUID
+            - SETGID
+            - DAC_OVERRIDE
+            - AUDIT_WRITE
+            - FOWNER
+            drop:
+            - all
+        startupProbe:
+          failureThreshold: 30
+          periodSeconds: 15
+          tcpSocket:
+            port: 8140
+        volumeMounts:
+        - mountPath: /etc/puppetlabs/code/
+          name: puppet-code-volume
+        - mountPath: /etc/puppetlabs/puppet/
+          name: puppet-puppet-volume
+        - mountPath: /var/lib/puppet/keys/
+          name: eyaml-keys
+          readOnly: true
+      initContainers:
+      - args:
+        - mkdir -p /etc/puppetlabs/puppet/eyaml/keys;
+          mkdir -p /etc/puppetlabs/code/environments;
+          mkdir -p /etc/puppetlabs/puppet/manifests;
+          chown -R puppet:puppet /etc/puppetlabs;
+          chown puppet:puppet /etc/puppetlabs/puppet/r10k.yaml;
+          mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/;
+          touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde;
+          chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
+        command:
+        - sh
+        - -c
+        env:
+        - name: PUPPETSERVER_JAVA_ARGS
+          value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
+        envFrom: null
+        image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
+        imagePullPolicy: IfNotPresent
+        name: perms-and-dirs
+        resources:
+          limits:
+            cpu: 300m
+            memory: 256Mi
+          requests:
+            cpu: 200m
+            memory: 128Mi
+        securityContext:
+          capabilities:
+            add:
+            - CAP_CHOWN
+            - CAP_SETUID
+            - CAP_SETGID
+            - CAP_DAC_OVERRIDE
+            - CAP_AUDIT_WRITE
+            - CAP_FOWNER
+            - CHOWN
+            - SETUID
+            - SETGID
+            - DAC_OVERRIDE
+            - AUDIT_WRITE
+            - FOWNER
+            drop:
+            - all
+          runAsNonRoot: false
+          runAsUser: 0
+        volumeMounts:
+        - mountPath: /etc/puppetlabs/code/
+          name: puppet-code-volume
+        - mountPath: /etc/puppetlabs/puppet/
+          name: puppet-puppet-volume
+      securityContext:
+        fsGroup: 999
+      volumes:
+      - name: puppet-code-volume
+        persistentVolumeClaim:
+          claimName: puppetserver-code-shared
+      - name: eyaml-keys
+        secret:
+          secretName: eyaml-keys
+          defaultMode: 0600
+  updateStrategy:
+    type: RollingUpdate
+  volumeClaimTemplates:
+  - metadata:
+      annotations: null
+      name: puppet-puppet-volume
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 1Gi
+      storageClassName: cephrbd-fast-delete

apps/base/puppet/vaultstaticsecret.yaml

@@ -32,3 +32,20 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: eyaml-keys
+  namespace: puppet
+spec:
+  destination:
+    create: true
+    name: eyaml-keys
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/puppet/default/eyaml-keys
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default