unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

pdbmux: deploy the merging PuppetDB proxy in-cluster #275

Merged
benvin merged 2 commits from benvin/pdbmux-deploy into main 2026-07-24 23:40:57 +10:00
Conversation 0 Commits 2 Files Changed 10
+210
unkinben commented 2026-07-24 23:12:28 +10:00
Owner
Copy Link
Copy Source

Why

During the VM -> k8s Puppet migration, two PuppetDBs coexist and nodes move
between them as they migrate. node-lookup (and pblastreport) need a single,
consistent PuppetDB v4 view spanning both. pdbmux is a small merging proxy
that provides exactly that. Per the all-in-kubernetes estate direction it runs
as an in-cluster service, not a per-VM systemd unit.

pdbmux now lives in its own repository (https://git.unkin.net/unkin/pdbmux) —
split out of the earlier node-lookup prototype — and is released as a container
image on its own v* tags.

Changes

  • Add apps/base/pdbmux/ (namespace, configmap, deployment, service, gateway,
    httproute), modeled directly on the encapi app.
  • Deployment: 2 replicas, image git.unkin.net/unkin/pdbmux:v0.1.0, port 8080,
    /healthz liveness + readiness, config via PDBMUX_* env from a ConfigMap.
  • Backends: old=http://puppetdbapi.service.consul:8080,
    new=http://puppetdb.puppet.svc.cluster.local:8080 (in-cluster, verified
    against apps/base/puppet/service_puppetdb.yaml port pdb-http/8080 — the
    in-cluster address is preferred over the external gateway). new is
    primary/prefer, merge = freshness.
  • Expose over HTTPS at pdbmux.k8s.syd1.au.unkin.net via a traefik-internal
    Gateway (cert-manager vault-issuer, external-dns), plain-HTTP backend on a
    port-80 Service — same shape as the puppetdb/encapi gateways — so
    VM/workstation node-lookup can reach it.
  • Add apps/overlays/au-syd1/pdbmux/ and wire pdbmux into the platform
    ApplicationSet (apps/overlays/*/pdbmux) and the platform AppProject
    (pdbmux namespace destination), exactly as encapi is wired.

No new woodpecker ServiceAccount is required: the pdbmux image push uses the
docker-buildx plugin against the Gitea registry with the default SA (same as
encapi), not artifactapi.

Verification

  • kubectl kustomize apps/overlays/au-syd1/pdbmux builds clean (image resolves
    to git.unkin.net/unkin/pdbmux:v0.1.0).
  • ApplicationSet + AppProject YAML validated.

Merge gates

  1. The pdbmux repo initial-content PR
    (unkin/pdbmux#1) must merge first.
  2. v0.1.0 must then be tagged on the pdbmux repo so the image
    git.unkin.net/unkin/pdbmux:v0.1.0 is built and pushed by that repos .woodpecker/docker.yaml`.
  3. Then merge this PR. (If the first release tag differs from v0.1.0, update
    the image tag in apps/base/pdbmux/deployment.yaml to match before merging.)
## Why During the VM -> k8s Puppet migration, two PuppetDBs coexist and nodes move between them as they migrate. `node-lookup` (and `pblastreport`) need a single, consistent PuppetDB v4 view spanning both. `pdbmux` is a small merging proxy that provides exactly that. Per the all-in-kubernetes estate direction it runs as an in-cluster service, not a per-VM systemd unit. pdbmux now lives in its own repository (https://git.unkin.net/unkin/pdbmux) — split out of the earlier node-lookup prototype — and is released as a container image on its own `v*` tags. ## Changes - Add `apps/base/pdbmux/` (namespace, configmap, deployment, service, gateway, httproute), modeled directly on the encapi app. - Deployment: 2 replicas, image `git.unkin.net/unkin/pdbmux:v0.1.0`, port 8080, `/healthz` liveness + readiness, config via `PDBMUX_*` env from a ConfigMap. - Backends: `old=http://puppetdbapi.service.consul:8080`, `new=http://puppetdb.puppet.svc.cluster.local:8080` (in-cluster, verified against `apps/base/puppet/service_puppetdb.yaml` port `pdb-http`/8080 — the in-cluster address is preferred over the external gateway). `new` is primary/prefer, merge = freshness. - Expose over HTTPS at `pdbmux.k8s.syd1.au.unkin.net` via a `traefik-internal` Gateway (cert-manager `vault-issuer`, external-dns), plain-HTTP backend on a port-80 Service — same shape as the puppetdb/encapi gateways — so VM/workstation `node-lookup` can reach it. - Add `apps/overlays/au-syd1/pdbmux/` and wire pdbmux into the platform ApplicationSet (`apps/overlays/*/pdbmux`) and the platform AppProject (`pdbmux` namespace destination), exactly as encapi is wired. No new woodpecker ServiceAccount is required: the pdbmux image push uses the `docker-buildx` plugin against the Gitea registry with the `default` SA (same as encapi), not artifactapi. ## Verification - `kubectl kustomize apps/overlays/au-syd1/pdbmux` builds clean (image resolves to `git.unkin.net/unkin/pdbmux:v0.1.0`). - ApplicationSet + AppProject YAML validated. ## Merge gates 1. The pdbmux repo initial-content PR (https://git.unkin.net/unkin/pdbmux/pulls/1) must merge first. 2. `v0.1.0` must then be tagged on the pdbmux repo so the image `git.unkin.net/unkin/pdbmux:v0.1.0` is built and pushed by that repo`s `.woodpecker/docker.yaml`. 3. Then merge this PR. (If the first release tag differs from `v0.1.0`, update the image tag in `apps/base/pdbmux/deployment.yaml` to match before merging.)
unkinben added 1 commit 2026-07-24 23:12:28 +10:00
pdbmux: deploy the merging PuppetDB proxy in-cluster
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
b82ae4d935 
node-lookup (and pblastreport) need a single merged view over the two PuppetDBs
that coexist during the VM -> k8s Puppet migration. pdbmux provides that merged
PuppetDB v4 surface. Per the all-in-kubernetes direction it runs in-cluster
rather than as a per-VM systemd service.

- Add apps/base/pdbmux/ (namespace, configmap, deployment, service, gateway,
  httproute) modeled on the encapi app.
- Deployment: 2 replicas, image git.unkin.net/unkin/pdbmux:v0.6.0, port 8080,
  /healthz liveness+readiness, PDBMUX_* env from a configmap. Backends: old =
  http://puppetdbapi.service.consul:8080, new =
  http://puppetdb.puppet.svc.cluster.local:8080 (in-cluster, preferred); new is
  primary/prefer.
- Expose over HTTPS at pdbmux.k8s.syd1.au.unkin.net via a traefik-internal
  Gateway (cert-manager vault-issuer, external-dns), plain-HTTP backend, same
  shape as the puppetdb/encapi gateways, so VM/workstation node-lookup can reach
  it.
- Add apps/overlays/au-syd1/pdbmux/ and wire it into the platform
  ApplicationSet + AppProject (pdbmux namespace destination), as encapi is.
unkinben added 1 commit 2026-07-24 23:27:09 +10:00
pdbmux: pin image to v0.1.0 from the standalone pdbmux repo
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
68026cc331 
pdbmux moved out of node-lookup into its own repo (git.unkin.net/unkin/pdbmux);
the first release there is v0.1.0, not the earlier v0.6.0 assumption.
benvin merged commit 6d7cdd59e3 into main 2026-07-24 23:40:57 +10:00
benvin deleted branch benvin/pdbmux-deploy 2026-07-24 23:40:57 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#275
Delete Branch "benvin/pdbmux-deploy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?