unkinben
3af12180fd
## Why The k8s puppetserver compilers classify nodes via an exec ENC that today queries legacy Cobbler (`https://cobbler.main.unkin.net`) over TLS. `encapi` now runs in-cluster and exposes a cobbler-wire-compatible endpoint (`GET /cblr/svc/op/puppet/hostname/<certname>`), a drop-in for the Cobbler URL. This cuts the puppet-on-k8s ENC over from Cobbler to encapi — a prerequisite for migrating VM agents onto puppet-on-k8s. ## Changes - Rename the ENC script `resources/cobbler-enc` -> `resources/encapi-enc`, and its configmap `puppet-cobbler-enc` -> `puppet-encapi-enc` (kustomization configMapGenerator + deployment volume, initContainer copy path, and volumeMount subPath). - Point `external_nodes` in the compiler `puppet.conf` at `/opt/bin/encapi-enc`. - Target the in-cluster encapi service `http://encapi.encapi.svc.cluster.local` (plain HTTP), overridable via the `ENCAPI_URL` env var. - Drop the `/opt/vault-ca-cert.crt` verify for the ENC request (no TLS needed in-cluster). - Leave the response normalization identical: classes coerced to a list, `enc_role`/`enc_env` params set, `environment` stripped when it equals `testing`. Verified with `kubectl kustomize apps/overlays/au-syd1/puppet` (builds clean, exit 0); the generated `puppet-encapi-enc` configmap contains the new URL and env var. ## 🚨 Merge gate **Do not merge until encapi is seeded** (terraform-incus `benvin/encapi-seed` PR applied). An empty encapi means every node resolves to a 404. On 404 the ENC script exits non-zero, so puppet fails the compile rather than classifying the node with zero classes — nodes will fail to run until they exist in encapi. Seed encapi first so real nodes classify correctly; only unknown nodes should 404. Reviewed-on: #272 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
24 lines
745 B
Plaintext
24 lines
745 B
Plaintext
[main]
|
|
server = puppetserver-compiler
|
|
serverport = 8140
|
|
dns_alt_names = puppetserver-compiler,puppet-headless,puppet,puppet.k8s.syd1.au.unkin.net
|
|
codedir = /etc/puppetlabs/code
|
|
environmentpath = /etc/puppetlabs/code/environments
|
|
|
|
[server]
|
|
vardir = /opt/puppetlabs/server/data/puppetserver
|
|
logdir = /var/log/puppetlabs/puppetserver
|
|
rundir = /var/run/puppetlabs/puppetserver
|
|
pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
|
|
node_terminus = exec
|
|
external_nodes = /opt/bin/encapi-enc
|
|
autosign = /etc/puppetlabs/puppet/autosign.conf
|
|
storeconfigs = true
|
|
storeconfigs_backend = puppetdb
|
|
reports = puppetdb
|
|
usecacheonfailure = false
|
|
|
|
[user]
|
|
default_manifest = /etc/puppetlabs/code/environments/develop/manifests
|
|
default_environment = develop
|