Switch puppet compiler ENC from Cobbler to encapi #272

2026-07-24T22:41:59+10:00

unkinben commented

2026-07-24 22:41:59 +10:00

Why

The k8s puppetserver compilers classify nodes via an exec ENC that today queries legacy Cobbler (https://cobbler.main.unkin.net) over TLS. encapi now runs in-cluster and exposes a cobbler-wire-compatible endpoint (GET /cblr/svc/op/puppet/hostname/<certname>), a drop-in for the Cobbler URL. This cuts the puppet-on-k8s ENC over from Cobbler to encapi — a prerequisite for migrating VM agents onto puppet-on-k8s.

Changes

Rename the ENC script resources/cobbler-enc -> resources/encapi-enc, and its configmap puppet-cobbler-enc -> puppet-encapi-enc (kustomization configMapGenerator + deployment volume, initContainer copy path, and volumeMount subPath).
Point external_nodes in the compiler puppet.conf at /opt/bin/encapi-enc.
Target the in-cluster encapi service http://encapi.encapi.svc.cluster.local (plain HTTP), overridable via the ENCAPI_URL env var.
Drop the /opt/vault-ca-cert.crt verify for the ENC request (no TLS needed in-cluster).
Leave the response normalization identical: classes coerced to a list, enc_role/enc_env params set, environment stripped when it equals testing.

Verified with kubectl kustomize apps/overlays/au-syd1/puppet (builds clean, exit 0); the generated puppet-encapi-enc configmap contains the new URL and env var.

🚨 Merge gate

Do not merge until encapi is seeded (terraform-incus benvin/encapi-seed PR applied). An empty encapi means every node resolves to a 404. On 404 the ENC script exits non-zero, so puppet fails the compile rather than classifying the node with zero classes — nodes will fail to run until they exist in encapi. Seed encapi first so real nodes classify correctly; only unknown nodes should 404.

## Why The k8s puppetserver compilers classify nodes via an exec ENC that today queries legacy Cobbler (`https://cobbler.main.unkin.net`) over TLS. `encapi` now runs in-cluster and exposes a cobbler-wire-compatible endpoint (`GET /cblr/svc/op/puppet/hostname/<certname>`), a drop-in for the Cobbler URL. This cuts the puppet-on-k8s ENC over from Cobbler to encapi — a prerequisite for migrating VM agents onto puppet-on-k8s. ## Changes - Rename the ENC script `resources/cobbler-enc` -> `resources/encapi-enc`, and its configmap `puppet-cobbler-enc` -> `puppet-encapi-enc` (kustomization configMapGenerator + deployment volume, initContainer copy path, and volumeMount subPath). - Point `external_nodes` in the compiler `puppet.conf` at `/opt/bin/encapi-enc`. - Target the in-cluster encapi service `http://encapi.encapi.svc.cluster.local` (plain HTTP), overridable via the `ENCAPI_URL` env var. - Drop the `/opt/vault-ca-cert.crt` verify for the ENC request (no TLS needed in-cluster). - Leave the response normalization identical: classes coerced to a list, `enc_role`/`enc_env` params set, `environment` stripped when it equals `testing`. Verified with `kubectl kustomize apps/overlays/au-syd1/puppet` (builds clean, exit 0); the generated `puppet-encapi-enc` configmap contains the new URL and env var. ## :rotating_light: Merge gate **Do not merge until encapi is seeded** (terraform-incus `benvin/encapi-seed` PR applied). An empty encapi means every node resolves to a 404. On 404 the ENC script exits non-zero, so puppet fails the compile rather than classifying the node with zero classes — nodes will fail to run until they exist in encapi. Seed encapi first so real nodes classify correctly; only unknown nodes should 404.

unkinben added 1 commit 2026-07-24 22:41:59 +10:00

Switch puppet compiler ENC from Cobbler to encapi

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

b71a7562f4

The k8s puppetserver compilers classify nodes via an exec ENC that
currently queries legacy Cobbler over TLS. encapi now exposes a
cobbler-wire-compatible endpoint in-cluster, so point the ENC at it as
a prerequisite for migrating VM agents onto puppet-on-k8s.

- Rename the ENC script cobbler-enc -> encapi-enc (and its configmap
  puppet-cobbler-enc -> puppet-encapi-enc, external_nodes path, and
  deployment volume/initContainer references)
- Target http://encapi.encapi.svc.cluster.local (plain in-cluster HTTP),
  overridable via ENCAPI_URL env var
- Drop the /opt/vault-ca-cert.crt verify for this request (no TLS
  in-cluster); classes-list / enc_env / testing-strip normalization
  unchanged

benvin merged commit 3af12180fd into main

2026-07-24 23:42:24 +10:00

benvin deleted branch benvin/puppet-enc-encapi

2026-07-24 23:42:24 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#272