unkinben
5d1cc10588
## Why The puppet MASTER is the singleton CA/master. A second master, even transiently during a rolling update, races on CA/cert signing and shared state (the CA lives on a shared PVC mounted by every master pod). The master was previously driven by an HPA with `minReplicas: 2`, `maxReplicas: 5` and a `RollingUpdate` strategy, so 2-5 masters could coexist normally and a rollout would briefly run old+new masters against the same CA data — a latent CA-corruption/split-brain bug. Recreate guarantees the old pod terminates before the new one starts, so two masters never coexist. ## Changes - Set `puppetserver-master` `spec.replicas: 1` and `spec.strategy.type: Recreate` (drops RollingUpdate). - Remove the `puppetserver-masters-autoscaler` HPA and its kustomization entry, which forced 2-5 master replicas and would otherwise override `replicas: 1`. - Refresh the `puppetserver-master-vpa` note to reflect the pinned-singleton, no-HPA state (VPA stays `updateMode: Off`, recommendation-only). The compiler (`puppetserver-compiler`) remains the horizontally-scalable tier with its own HPA — untouched. puppetdb/puppetboard untouched. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --------- Co-authored-by: Ben Vincent <neotheo@gmail.com> Reviewed-on: #341 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
62 lines
1.8 KiB
YAML
62 lines
1.8 KiB
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- cnpg_cluster.yaml
|
|
- cnpg_backup.yaml
|
|
- cnpg_pooler.yaml
|
|
- cronjob_g10k-code.yaml
|
|
- cronjob_generate-types.yaml
|
|
- persistentvolumeclaims.yaml
|
|
- vaultauth.yaml
|
|
- vaultstaticsecret.yaml
|
|
- configmap_puppetboard-config.yaml
|
|
- configmap_puppetdb-config.yaml
|
|
- configmap_puppetdb-read-database.yaml
|
|
- configmap_puppetserver-compiler-config.yaml
|
|
- configmap_puppetserver-init-config.yaml
|
|
- configmap_puppetserver-init-masters-config.yaml
|
|
- configmap_puppetserver-master-config.yaml
|
|
- deployment_puppetboard.yaml
|
|
- deployment_puppetdb.yaml
|
|
- deployment_puppetserver-master.yaml
|
|
- horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml
|
|
- horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
|
|
- horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
|
|
- gateway_puppetboard.yaml
|
|
- httproute_puppetboard.yaml
|
|
- gateway_puppetdb.yaml
|
|
- httproute_puppetdb.yaml
|
|
- service_puppetserver-agents-to-puppet.yaml
|
|
- service_puppet-headless.yaml
|
|
- service_puppet.yaml
|
|
- service_puppetca.yaml
|
|
- service_puppetboard.yaml
|
|
- service_puppetdb.yaml
|
|
- deployment_puppetserver-compiler.yaml
|
|
- vpa.yaml
|
|
|
|
configMapGenerator:
|
|
- name: compiler-autosign.conf
|
|
files:
|
|
- resources/compiler/autosign.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: compiler-puppet.conf
|
|
files:
|
|
- resources/compiler/puppet.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: compiler-puppetdb.conf
|
|
files:
|
|
- resources/compiler/puppetdb.conf
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: additional-ruby-gems
|
|
files:
|
|
- resources/additional-ruby-gems.sh
|
|
options:
|
|
disableNameSuffixHash: true
|