unkinben
05318553d6
## Why The puppet-on-k8s compilers classify nodes with a uv/python ENC script (`encapi-enc`). Each fresh compiler pod resolves the script's python dependencies on first invocation, and that resolution fails on cold pods (observed exits 135/2), breaking puppet agent catalog compilation. `encapic` (git.unkin.net/unkin/encapic) is a stdlib-only Go replacement with no runtime dependency resolution — a behavioural drop-in whose output matches the python script byte-for-byte. ## Changes - Points the compiler `external_nodes` at `/opt/bin/encapic`. - Reworks the `setup-shared-bins` init container to `curl` the encapic `v0.1.0` `encapic_linux_amd64` release binary (sha256-verified against the published `.sha256`, installed mode 0755) into the shared bins dir, instead of copying the python script and installing uv. - Removes the `puppet-encapi-enc` configmap generator, its volume and mount, and the `resources/encapi-enc` script. uv was consumed solely by that script (grep of `apps/base/puppet` confirms no other consumer), so its installation is removed too. `kubectl kustomize apps/overlays/au-syd1/puppet` builds clean. ## Merge gate Do not merge until the encapic `v0.1.0` release assets exist: `https://git.unkin.net/unkin/encapic/releases/download/v0.1.0/encapic_linux_amd64` (+ `.sha256`). The init container pulls them at pod start. ## Rollback Revert this PR to restore the `encapi-enc` configmap script + uv install and repoint `external_nodes`. --------- Co-authored-by: benvin <neotheo@gmail.com> Reviewed-on: #277 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
61 lines
1.8 KiB
YAML
61 lines
1.8 KiB
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- cnpg_cluster.yaml
|
|
- cnpg_pooler.yaml
|
|
- cronjob_g10k-code.yaml
|
|
- cronjob_generate-types.yaml
|
|
- persistentvolumeclaims.yaml
|
|
- vaultauth.yaml
|
|
- vaultstaticsecret.yaml
|
|
- configmap_puppetboard-config.yaml
|
|
- configmap_puppetdb-config.yaml
|
|
- configmap_puppetdb-read-database.yaml
|
|
- configmap_puppetserver-compiler-config.yaml
|
|
- configmap_puppetserver-init-config.yaml
|
|
- configmap_puppetserver-init-masters-config.yaml
|
|
- configmap_puppetserver-master-config.yaml
|
|
- deployment_puppetboard.yaml
|
|
- deployment_puppetdb.yaml
|
|
- deployment_puppetserver-master.yaml
|
|
- horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml
|
|
- horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
|
|
- horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
|
|
- horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
|
|
- gateway_puppetboard.yaml
|
|
- httproute_puppetboard.yaml
|
|
- gateway_puppetdb.yaml
|
|
- httproute_puppetdb.yaml
|
|
- service_puppetserver-agents-to-puppet.yaml
|
|
- service_puppet-headless.yaml
|
|
- service_puppet.yaml
|
|
- service_puppetca.yaml
|
|
- service_puppetboard.yaml
|
|
- service_puppetdb.yaml
|
|
- deployment_puppetserver-compiler.yaml
|
|
|
|
configMapGenerator:
|
|
- name: compiler-autosign.conf
|
|
files:
|
|
- resources/compiler/autosign.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: compiler-puppet.conf
|
|
files:
|
|
- resources/compiler/puppet.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: compiler-puppetdb.conf
|
|
files:
|
|
- resources/compiler/puppetdb.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: additional-ruby-gems
|
|
files:
|
|
- resources/additional-ruby-gems.sh
|
|
options:
|
|
disableNameSuffixHash: true
|