benvin
e200c0f7d2
The uv/python ENC script fails its first-invocation dependency resolution on fresh compiler pods (exits 135/2), which breaks puppet agent catalog compilation. encapic is a stdlib-only Go replacement with no runtime dependency resolution. - Add encapic CLI: fetch the cobbler-wire ENC document from encapi (ENCAPI_URL override, in-cluster default compiled in) and reshape it to match the python script byte-for-byte (classes to list, enc_role/enc_env parameters, environment dropped when testing), exiting non-zero on any HTTP/parse failure so the puppet exec ENC fails safe. - Hand-parse the small fixed cobbler-wire YAML and hand-emit the output using the standard library only. - Add table-driven normalisation tests, httptest 200/404/500/timeout tests, and a golden-output test. - Add Makefile (build/test/lint/fmt + patch/minor/major with version ldflags), .gitignore, .pre-commit-config.yaml, and Woodpecker pipelines (build/test/pre-commit on pull_request; release on v* tags).
77 lines
2.5 KiB
Markdown
77 lines
2.5 KiB
Markdown
# encapic
|
|
|
|
Dependency-less Go CLI client for [encapi](https://git.unkin.net/unkin/encapi),
|
|
used as the Puppet exec External Node Classifier (ENC) on the Kubernetes
|
|
compilers.
|
|
|
|
It replaces the previous uv/python ENC script, whose first-invocation
|
|
dependency resolution failed on fresh compiler pods (exit 135/2), causing agent
|
|
catalog failures. encapic is a single static binary that depends on the Go
|
|
standard library only.
|
|
|
|
## Usage
|
|
|
|
```
|
|
encapic <certname>
|
|
```
|
|
|
|
encapic fetches the cobbler-wire ENC document from
|
|
|
|
```
|
|
${ENCAPI_URL}/cblr/svc/op/puppet/hostname/<certname>
|
|
```
|
|
|
|
reshapes it, and prints the resulting ENC YAML to stdout. It exits non-zero on
|
|
any HTTP or parse failure — including a 404 for an unknown node — so the puppet
|
|
exec `node_terminus` fails safe rather than compiling an empty catalog.
|
|
|
|
- `ENCAPI_URL` overrides the encapi base URL. The compiled-in default is
|
|
`http://encapi.encapi.svc.cluster.local` (the in-cluster service).
|
|
- The HTTP request has a 10s timeout.
|
|
|
|
## Behaviour (drop-in for the python ENC)
|
|
|
|
encapic reproduces the previous python script byte-for-byte:
|
|
|
|
- `classes` (a cobbler-wire map keyed by role, or a list) becomes a list of
|
|
role names;
|
|
- `parameters.enc_role` is set to that same list;
|
|
- when `environment` is present, `parameters.enc_env` is set to it, and the
|
|
top-level `environment` key is dropped when it equals `testing`;
|
|
- output keys are alphabetically sorted, matching python's `yaml.dump`.
|
|
|
|
Example output:
|
|
|
|
```yaml
|
|
classes:
|
|
- roles::infra::storage::vault
|
|
environment: develop
|
|
parameters:
|
|
enc_env: develop
|
|
enc_role:
|
|
- roles::infra::storage::vault
|
|
```
|
|
|
|
## Design: why the cobbler endpoint + hand-emitted YAML
|
|
|
|
encapi also exposes `/api/v1/nodes/<certname>/enc`, which serves the fully
|
|
reshaped document. encapic deliberately consumes the **cobbler-wire** endpoint
|
|
(`/cblr/svc/op/puppet/hostname/<certname>`) and reshapes it locally so its
|
|
output matches the python script it replaces byte-for-byte — meaning the swap
|
|
changes nothing the puppet agent sees. The consumed YAML has a small, fixed
|
|
shape and is hand-parsed; the emitted YAML is hand-written. This keeps encapic
|
|
on the standard library only, which is the entire point of the rewrite.
|
|
|
|
## Development
|
|
|
|
```
|
|
make build # static binary into dist/
|
|
make test # go test -v -race ./...
|
|
make lint # golangci-lint
|
|
make fmt # gofmt -w .
|
|
```
|
|
|
|
Release: `make minor` (etc.) tags `vX.Y.Z` and pushes it; the `release`
|
|
Woodpecker pipeline builds `encapic_linux_amd64` (+ `.sha256`) and attaches
|
|
them to a Gitea release.
|