From b71a7562f4d0891d76edf6c53ff40d16c6dfa90c Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 24 Jul 2026 22:41:22 +1000
Subject: [PATCH] Switch puppet compiler ENC from Cobbler to encapi

The k8s puppetserver compilers classify nodes via an exec ENC that
currently queries legacy Cobbler over TLS. encapi now exposes a
cobbler-wire-compatible endpoint in-cluster, so point the ENC at it as
a prerequisite for migrating VM agents onto puppet-on-k8s.

- Rename the ENC script cobbler-enc -> encapi-enc (and its configmap
  puppet-cobbler-enc -> puppet-encapi-enc, external_nodes path, and
  deployment volume/initContainer references)
- Target http://encapi.encapi.svc.cluster.local (plain in-cluster HTTP),
  overridable via ENCAPI_URL env var
- Drop the /opt/vault-ca-cert.crt verify for this request (no TLS
  in-cluster); classes-list / enc_env / testing-strip normalization
  unchanged
---
 .../puppet/deployment_puppetserver-compiler.yaml | 16 ++++++++--------
 apps/base/puppet/kustomization.yaml              |  4 ++--
 apps/base/puppet/resources/compiler/puppet.conf  |  2 +-
 .../puppet/resources/{cobbler-enc => encapi-enc} | 13 +++++++++----
 4 files changed, 20 insertions(+), 15 deletions(-)
 rename apps/base/puppet/resources/{cobbler-enc => encapi-enc} (76%)

diff --git a/apps/base/puppet/deployment_puppetserver-compiler.yaml b/apps/base/puppet/deployment_puppetserver-compiler.yaml
index 921c3de..4c2616d 100644
--- a/apps/base/puppet/deployment_puppetserver-compiler.yaml
+++ b/apps/base/puppet/deployment_puppetserver-compiler.yaml
@@ -191,9 +191,9 @@ spec:
           mkdir -p /opt/bin
           mkdir -p /opt/bin/.cache/uv
 
-          # Copy cobbler to shared bin volume
-          cp /configmaps/cobbler-enc /opt/bin/cobbler-enc
-          chmod +x /opt/bin/cobbler-enc
+          # Copy encapi ENC script to shared bin volume
+          cp /configmaps/encapi-enc /opt/bin/encapi-enc
+          chmod +x /opt/bin/encapi-enc
 
           # Install uv to shared bin volume
           cd /tmp
@@ -206,9 +206,9 @@ spec:
         volumeMounts:
         - mountPath: /opt/bin/
           name: puppet-shared-bins
-        - mountPath: /configmaps/cobbler-enc
-          name: puppet-cobbler-enc
-          subPath: cobbler-enc
+        - mountPath: /configmaps/encapi-enc
+          name: puppet-encapi-enc
+          subPath: encapi-enc
       securityContext:
         fsGroup: 999
       volumes:
@@ -231,9 +231,9 @@ spec:
       - name: compiler-autosign-conf
         configMap:
           name: compiler-autosign.conf
-      - name: puppet-cobbler-enc
+      - name: puppet-encapi-enc
         configMap:
-          name: puppet-cobbler-enc
+          name: puppet-encapi-enc
       - name: puppet-shared-bins
         persistentVolumeClaim:
           claimName: puppet-shared-bins
diff --git a/apps/base/puppet/kustomization.yaml b/apps/base/puppet/kustomization.yaml
index 8d44f05..86fc9e7 100644
--- a/apps/base/puppet/kustomization.yaml
+++ b/apps/base/puppet/kustomization.yaml
@@ -53,9 +53,9 @@ configMapGenerator:
       - resources/compiler/puppetdb.conf
     options:
       disableNameSuffixHash: true
-  - name: puppet-cobbler-enc
+  - name: puppet-encapi-enc
     files:
-      - resources/cobbler-enc
+      - resources/encapi-enc
     options:
       disableNameSuffixHash: true
   - name: additional-ruby-gems
diff --git a/apps/base/puppet/resources/compiler/puppet.conf b/apps/base/puppet/resources/compiler/puppet.conf
index 8210878..6e9b76c 100644
--- a/apps/base/puppet/resources/compiler/puppet.conf
+++ b/apps/base/puppet/resources/compiler/puppet.conf
@@ -11,7 +11,7 @@ logdir = /var/log/puppetlabs/puppetserver
 rundir = /var/run/puppetlabs/puppetserver
 pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
 node_terminus = exec
-external_nodes = /opt/bin/cobbler-enc
+external_nodes = /opt/bin/encapi-enc
 autosign = /etc/puppetlabs/puppet/autosign.conf
 storeconfigs = true
 storeconfigs_backend = puppetdb
diff --git a/apps/base/puppet/resources/cobbler-enc b/apps/base/puppet/resources/encapi-enc
similarity index 76%
rename from apps/base/puppet/resources/cobbler-enc
rename to apps/base/puppet/resources/encapi-enc
index 3dd9aa8..9ed9805 100755
--- a/apps/base/puppet/resources/cobbler-enc
+++ b/apps/base/puppet/resources/encapi-enc
@@ -10,17 +10,22 @@ If the environment specified in the YAML file is 'testing',
 the environment is not included in the output.
 """
 
+import os
 import sys
 import yaml
 import requests
 
-def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
+# In-cluster encapi service (cobbler-wire-compatible endpoint). Plain HTTP,
+# so no CA bundle is needed. Overridable via ENCAPI_URL.
+ENCAPI_URL = os.environ.get("ENCAPI_URL", "http://encapi.encapi.svc.cluster.local")
+
+def fetch_enc_data(base_url: str, hostname: str) -> str:
     """
     Fetches and modifies ENC data from a given URL to ensure classes are in list format.
     """
-    url = f"{cobbler_url}/cblr/svc/op/puppet/hostname/{hostname}"
+    url = f"{base_url}/cblr/svc/op/puppet/hostname/{hostname}"
     try:
-        response = requests.get(url, verify='/opt/vault-ca-cert.crt')
+        response = requests.get(url)
         response.raise_for_status()
     except requests.RequestException as e:
         sys.exit(f"Request failed: {e}")
@@ -47,4 +52,4 @@ def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
 if __name__ == "__main__":
     if len(sys.argv) != 2:
         sys.exit(f"Usage: {sys.argv[0]} <hostname>")
-    print(fetch_enc_data("https://cobbler.main.unkin.net", sys.argv[1]))
+    print(fetch_enc_data(ENCAPI_URL, sys.argv[1]))
-- 
2.47.3