Add encapic ENC client #1

2026-07-25T09:55:47+10:00

unkinben commented

2026-07-25 09:55:47 +10:00

Why

The puppet-on-k8s compilers use a uv/python ENC script whose first-invocation dependency resolution fails on fresh compiler pods (observed exits 135/2), causing puppet agent catalog failures. This adds encapic, a stdlib-only Go replacement with no runtime dependency resolution, so a fresh compiler pod can classify nodes immediately.

Changes

Adds the encapic <certname> CLI: fetches the cobbler-wire ENC document from ${ENCAPI_URL}/cblr/svc/op/puppet/hostname/<certname> (env override; in-cluster default http://encapi.encapi.svc.cluster.local compiled in), reshapes it, and prints the ENC YAML.
Reproduces the python script byte-for-byte: classes to list form, enc_role/enc_env parameters, top-level environment dropped when it equals testing, alphabetically sorted keys.
Exits non-zero on any HTTP or parse failure (404 included) with a 10s timeout, so the puppet exec node_terminus fails safe.
Consumes the cobbler-wire endpoint and hand-parses/hand-emits the small fixed YAML shape using the standard library only (documented in the README).
Adds table-driven normalisation tests, httptest 200/404/500/timeout tests, and a golden-output test.
Adds Makefile (build/test/lint/fmt + patch/minor/major with version ldflags), .gitignore, .pre-commit-config.yaml, and Woodpecker pipelines (build/test/pre-commit on pull_request; release on v* tags building encapic_linux_amd64 + sha256).

Verified live against encapi.k8s.syd1.au.unkin.net: output matches the python script byte-for-byte for ausyd1nxvm2000, ausyd1nxvm2120, prodnxsr0009, and a nonexistent node exits non-zero.

## Why The puppet-on-k8s compilers use a uv/python ENC script whose first-invocation dependency resolution fails on fresh compiler pods (observed exits 135/2), causing puppet agent catalog failures. This adds `encapic`, a stdlib-only Go replacement with no runtime dependency resolution, so a fresh compiler pod can classify nodes immediately. ## Changes - Adds the `encapic <certname>` CLI: fetches the cobbler-wire ENC document from `${ENCAPI_URL}/cblr/svc/op/puppet/hostname/<certname>` (env override; in-cluster default `http://encapi.encapi.svc.cluster.local` compiled in), reshapes it, and prints the ENC YAML. - Reproduces the python script byte-for-byte: classes to list form, `enc_role`/`enc_env` parameters, top-level `environment` dropped when it equals `testing`, alphabetically sorted keys. - Exits non-zero on any HTTP or parse failure (404 included) with a 10s timeout, so the puppet exec `node_terminus` fails safe. - Consumes the cobbler-wire endpoint and hand-parses/hand-emits the small fixed YAML shape using the standard library only (documented in the README). - Adds table-driven normalisation tests, httptest 200/404/500/timeout tests, and a golden-output test. - Adds Makefile (build/test/lint/fmt + patch/minor/major with version ldflags), `.gitignore`, `.pre-commit-config.yaml`, and Woodpecker pipelines (build/test/pre-commit on pull_request; release on `v*` tags building `encapic_linux_amd64` + sha256). Verified live against `encapi.k8s.syd1.au.unkin.net`: output matches the python script byte-for-byte for `ausyd1nxvm2000`, `ausyd1nxvm2120`, `prodnxsr0009`, and a nonexistent node exits non-zero.

unkinben added 1 commit 2026-07-25 09:55:47 +10:00

Add encapic ENC client

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline failed

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

e200c0f7d2

The uv/python ENC script fails its first-invocation dependency resolution on
fresh compiler pods (exits 135/2), which breaks puppet agent catalog
compilation. encapic is a stdlib-only Go replacement with no runtime
dependency resolution.

- Add encapic CLI: fetch the cobbler-wire ENC document from encapi
  (ENCAPI_URL override, in-cluster default compiled in) and reshape it to
  match the python script byte-for-byte (classes to list, enc_role/enc_env
  parameters, environment dropped when testing), exiting non-zero on any
  HTTP/parse failure so the puppet exec ENC fails safe.
- Hand-parse the small fixed cobbler-wire YAML and hand-emit the output using
  the standard library only.
- Add table-driven normalisation tests, httptest 200/404/500/timeout tests,
  and a golden-output test.
- Add Makefile (build/test/lint/fmt + patch/minor/major with version
  ldflags), .gitignore, .pre-commit-config.yaml, and Woodpecker pipelines
  (build/test/pre-commit on pull_request; release on v* tags).

unkinben added 1 commit 2026-07-25 10:00:09 +10:00

Check error returns to satisfy errcheck lint

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

7f8ca8046e

benvin merged commit 75ed5e5cdf into main

2026-07-25 10:18:41 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/encapic#1