unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Swap puppet compiler ENC to the encapic Go binary #277

Merged
benvin merged 1 commits from benvin/puppet-enc-encapic-go into main 2026-07-25 12:40:43 +10:00
Conversation 0 Commits 1 Files Changed 4
+14 -77
unkinben commented 2026-07-25 09:58:18 +10:00
Owner
Copy Link
Copy Source

Why

The puppet-on-k8s compilers classify nodes with a uv/python ENC script (encapi-enc). Each fresh compiler pod resolves the script's python dependencies on first invocation, and that resolution fails on cold pods (observed exits 135/2), breaking puppet agent catalog compilation. encapic (git.unkin.net/unkin/encapic) is a stdlib-only Go replacement with no runtime dependency resolution — a behavioural drop-in whose output matches the python script byte-for-byte.

Changes

  • Points the compiler external_nodes at /opt/bin/encapic.
  • Reworks the setup-shared-bins init container to curl the encapic v0.1.0 encapic_linux_amd64 release binary (sha256-verified against the published .sha256, installed mode 0755) into the shared bins dir, instead of copying the python script and installing uv.
  • Removes the puppet-encapi-enc configmap generator, its volume and mount, and the resources/encapi-enc script. uv was consumed solely by that script (grep of apps/base/puppet confirms no other consumer), so its installation is removed too.

kubectl kustomize apps/overlays/au-syd1/puppet builds clean.

Merge gate

Do not merge until the encapic v0.1.0 release assets exist:
https://git.unkin.net/unkin/encapic/releases/download/v0.1.0/encapic_linux_amd64 (+ .sha256). The init container pulls them at pod start.

Rollback

Revert this PR to restore the encapi-enc configmap script + uv install and repoint external_nodes.

## Why The puppet-on-k8s compilers classify nodes with a uv/python ENC script (`encapi-enc`). Each fresh compiler pod resolves the script's python dependencies on first invocation, and that resolution fails on cold pods (observed exits 135/2), breaking puppet agent catalog compilation. `encapic` (git.unkin.net/unkin/encapic) is a stdlib-only Go replacement with no runtime dependency resolution — a behavioural drop-in whose output matches the python script byte-for-byte. ## Changes - Points the compiler `external_nodes` at `/opt/bin/encapic`. - Reworks the `setup-shared-bins` init container to `curl` the encapic `v0.1.0` `encapic_linux_amd64` release binary (sha256-verified against the published `.sha256`, installed mode 0755) into the shared bins dir, instead of copying the python script and installing uv. - Removes the `puppet-encapi-enc` configmap generator, its volume and mount, and the `resources/encapi-enc` script. uv was consumed solely by that script (grep of `apps/base/puppet` confirms no other consumer), so its installation is removed too. `kubectl kustomize apps/overlays/au-syd1/puppet` builds clean. ## Merge gate Do not merge until the encapic `v0.1.0` release assets exist: `https://git.unkin.net/unkin/encapic/releases/download/v0.1.0/encapic_linux_amd64` (+ `.sha256`). The init container pulls them at pod start. ## Rollback Revert this PR to restore the `encapi-enc` configmap script + uv install and repoint `external_nodes`.
unkinben added 1 commit 2026-07-25 09:58:18 +10:00
Swap puppet compiler ENC to the encapic Go binary
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
a4ab25778a 
The uv/python encapi-enc ENC script resolves its dependencies on first
invocation inside each fresh compiler pod; that resolution fails on cold pods
(exits 135/2), breaking puppet agent catalog compilation. encapic is a
stdlib-only Go replacement with no runtime dependency resolution.

- Point the compiler external_nodes at /opt/bin/encapic.
- Rework the setup-shared-bins init container to curl the encapic v0.1.0
  linux/amd64 release binary (sha256-verified, installed 0755) instead of
  copying the python script and installing uv.
- Remove the puppet-encapi-enc configmap generator, volume, mount, and the
  resources/encapi-enc script; uv was used solely by that script, so its
  installation is removed too.
benvin merged commit 05318553d6 into main 2026-07-25 12:40:43 +10:00
benvin deleted branch benvin/puppet-enc-encapic-go 2026-07-25 12:40:44 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#277
Delete Branch "benvin/puppet-enc-encapic-go"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?