unkinben
3af12180fd
## Why The k8s puppetserver compilers classify nodes via an exec ENC that today queries legacy Cobbler (`https://cobbler.main.unkin.net`) over TLS. `encapi` now runs in-cluster and exposes a cobbler-wire-compatible endpoint (`GET /cblr/svc/op/puppet/hostname/<certname>`), a drop-in for the Cobbler URL. This cuts the puppet-on-k8s ENC over from Cobbler to encapi — a prerequisite for migrating VM agents onto puppet-on-k8s. ## Changes - Rename the ENC script `resources/cobbler-enc` -> `resources/encapi-enc`, and its configmap `puppet-cobbler-enc` -> `puppet-encapi-enc` (kustomization configMapGenerator + deployment volume, initContainer copy path, and volumeMount subPath). - Point `external_nodes` in the compiler `puppet.conf` at `/opt/bin/encapi-enc`. - Target the in-cluster encapi service `http://encapi.encapi.svc.cluster.local` (plain HTTP), overridable via the `ENCAPI_URL` env var. - Drop the `/opt/vault-ca-cert.crt` verify for the ENC request (no TLS needed in-cluster). - Leave the response normalization identical: classes coerced to a list, `enc_role`/`enc_env` params set, `environment` stripped when it equals `testing`. Verified with `kubectl kustomize apps/overlays/au-syd1/puppet` (builds clean, exit 0); the generated `puppet-encapi-enc` configmap contains the new URL and env var. ## 🚨 Merge gate **Do not merge until encapi is seeded** (terraform-incus `benvin/encapi-seed` PR applied). An empty encapi means every node resolves to a 404. On 404 the ENC script exits non-zero, so puppet fails the compile rather than classifying the node with zero classes — nodes will fail to run until they exist in encapi. Seed encapi first so real nodes classify correctly; only unknown nodes should 404. Reviewed-on: #272 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
66 lines
1.9 KiB
YAML
66 lines
1.9 KiB
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- cnpg_cluster.yaml
|
|
- cnpg_pooler.yaml
|
|
- cronjob_g10k-code.yaml
|
|
- cronjob_generate-types.yaml
|
|
- persistentvolumeclaims.yaml
|
|
- vaultauth.yaml
|
|
- vaultstaticsecret.yaml
|
|
- configmap_puppetboard-config.yaml
|
|
- configmap_puppetdb-config.yaml
|
|
- configmap_puppetdb-read-database.yaml
|
|
- configmap_puppetserver-compiler-config.yaml
|
|
- configmap_puppetserver-init-config.yaml
|
|
- configmap_puppetserver-init-masters-config.yaml
|
|
- configmap_puppetserver-master-config.yaml
|
|
- deployment_puppetboard.yaml
|
|
- deployment_puppetdb.yaml
|
|
- deployment_puppetserver-master.yaml
|
|
- horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml
|
|
- horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
|
|
- horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
|
|
- horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
|
|
- gateway_puppetboard.yaml
|
|
- httproute_puppetboard.yaml
|
|
- gateway_puppetdb.yaml
|
|
- httproute_puppetdb.yaml
|
|
- service_puppetserver-agents-to-puppet.yaml
|
|
- service_puppet-headless.yaml
|
|
- service_puppet.yaml
|
|
- service_puppetca.yaml
|
|
- service_puppetboard.yaml
|
|
- service_puppetdb.yaml
|
|
- deployment_puppetserver-compiler.yaml
|
|
|
|
configMapGenerator:
|
|
- name: compiler-autosign.conf
|
|
files:
|
|
- resources/compiler/autosign.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: compiler-puppet.conf
|
|
files:
|
|
- resources/compiler/puppet.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: compiler-puppetdb.conf
|
|
files:
|
|
- resources/compiler/puppetdb.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: puppet-encapi-enc
|
|
files:
|
|
- resources/encapi-enc
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: additional-ruby-gems
|
|
files:
|
|
- resources/additional-ruby-gems.sh
|
|
options:
|
|
disableNameSuffixHash: true
|