2026-05-03 - 2026-11-03
Overview
85 Pull requests merged by 3 users
Merged
#561 Run detached noop agent after k8s migration repoint
Merged
#554 Add dnsmasq resolver and edge base-class changes to the mail gateway
Merged
#559 Add the bne dmz vpc and move the mta2 edge to bne
Merged
#558 Move mail DMZ VPC subnet facts to RFC 1918 ranges
Merged
#555 Adapt base classes for the mail edge gateway
Merged
#557 Resolve subnet facts from secondary interfaces
Merged
#552 Fix edge postfix gateway config for unkin.net
Merged
#556 Map the binarylane DMZ VPCs in subnet facts
Merged
#553 Add local rspamd and redis to the mail edge gateway
Merged
#547 Add consul server federation SANs to consul server certs
Merged
#545 Migrate k8s roles to puppet-on-k8s
Merged
#546 Migrate incus nodes to puppet-on-k8s
Merged
#544 consul: use static server list for clients
Merged
#543 nzbget: fix params lookup copied from sonarr
Merged
#540 Migrate media roles to puppet-on-k8s
Merged
#542 halb: stop publishing haproxy2 site CNAMEs
Merged
#539 Persist rp_filter=0 on every router interface
Merged
#524 Install certmanager and sshsignhost from RPM
Merged
#538 Add wireguard module
Merged
#537 Add dnsmasq module
Merged
#536 Add router role for prodnxsr0020
Merged
#535 Add 198.18.2.0/24 router loopback subnet
Merged
#533 Pin the journald ingest URL to port 443
Merged
#531 Ship estate journald logs to the k8s log ingest endpoint
Merged
#532 Allow k8s edge health checks on arrstack hosts
Merged
#530 Trust the sshca host CA alongside the legacy signer
Merged
#529 Trust the estate CA when fetching ENC facts
Merged
#528 Fetch agent ENC facts from encapi
Merged
#527 Classify puppet masters through encapi
Merged
#526 Shorten metadata_expire on internal RPM repos
Merged
#525 Install encapic ENC client on puppet masters
Merged
#522 Bump openbao-plugin-secrets-arrstack to 0.2.0
Merged
#521 Install openbao-plugin-secrets-arrstack v0.1.0
Merged
#520 vault: install openbao-plugin-secrets-ghp on OpenBao nodes
Merged
#509 vault: move openbao plugin sockets off /tmp onto /run
Merged
#519 vault: install netbox and apptoken OpenBao plugin RPMs on bao nodes
Merged
#515 ceph: manage /etc/ceph/ceph.conf on osd and mon/mgr/mds hosts
Merged
#517 rke2: taint control-plane nodes NoSchedule
Merged
#516 fix: lock rke2-common and pin rke2 to 1.33.13~rke2r2 to unblock puppet
Merged
#505 ceph: set OSD disk I/O scheduler to none via udev rule
Merged
#514 rke2,puppet: enforce versionlock before package install
Merged
#513 lldpd: run on physicals and expose neighbour topology as the lldp fact
Merged
#512 fix: preload correct rke2 airgap images to break CNI bootstrap deadlock
Merged
#511 fix: avoid anycast ips
Merged
#510 chore: add new physicals
Merged
#507 chore: update dns nameserver in dhcp
Merged
#504 libs: add ceph_osd_devices fact listing ceph OSD block devices
Merged
#499 puppetserver: auto-restart JVM when its binaries are replaced by an upgrade
Merged
#496 yum: source AlmaLinux RPM repos from artifactapi, drop legacy unkin repo
Merged
#497 os/Fedora: add Fedora 44 support for the base role
Merged
#498 vault: install openbao-plugin-secrets-gitea on the storage role
Merged
#495 dns: stop exporting legacy DNS fragments (manage_export false)
Merged
#494 Migrate canary ausyd1nxvm2120 to puppet-on-k8s
Merged
#493 Add profiles::puppet::migrate: repoint VM agents onto puppet-on-k8s
Merged
#492 Pin openbao secrets plugins to exact versions
Merged
#491 Fix cobbler.main.unkin.net CNAME to resolve on k8s DNS
Merged
#490 feat: migrate clients to use bind-dns in kubernetes
Merged
#489 haproxy::dns: fully-qualify halb CNAME targets
Merged
#487 ceph/rgw: add s3.ceph.unkin.net to radosgw cert SAN + nginx aliases
Merged
#488 Upgrade openbao-plugin-secrets-rancher to latest (v0.1.1)
Merged
#486 yum: point rpmfusion repos at artifactapi
Merged
#485 dns: exclude k8s/LB ranges from dns-updater; track latest
Merged
#484 Add rpm-vendor yum repository
Merged
#483 Install openbao-plugin-secrets-rancher on vault nodes
Merged
#482 dns: deploy dns-updater daemon in place of the shell nsupdate script [HOLD: needs dns-updater RPM published]
Merged
#481 dns: fix dns-update fqdn() double-appending zone to FQDN records
Merged
#480 Install openbao-plugin-secrets-gpg on vault nodes
Merged
#475 dns: nsupdate host records to the authoritative server
Merged
#479 chore: change to openbao-plugin-secrets-litellm
Merged
#477 feat: install vault-plugin-secrets-litellm
Merged
#476 chore: add rpm-internal repo
Merged
#478 chore: reduce requsts for all jobs
Merged
#474 Convert RKE2 registries to template, disable default endpoints
Merged
#473 chore: enable rke2 registries
Merged
#472 feat: make rke2 registries.yaml conditional on manage_registries
Merged
#471 chore: bump almalinux9 image tags
Merged
#470 feat: upgrade grafana from default to 13.0.2
Merged
#469 feat: upgrade gitea from 1.22.0 to 1.26.2
Merged
#468 feat: add switch to change to almalinux-vault
Merged
#467 feat: add auth.unkin.net proxying to Kubernetes Traefik ingress
Merged
#466 chore: increase inotify limits on rke2 nodes to fix fsnotify watcher errors
Merged
#465 feat: restart rke2 when registries.yaml is deployed
Merged
#464 chore: expand puppet-validate to two cpus
Merged
#463 chore: setup proper resource requirements for puppet ci jobs
Merged
#462 chore: deploy rke2 registries.yaml
7 Pull requests proposed by 2 users
Proposed
#506 feat: NetBox IP/interface facts with offline cache
Proposed
#550 consul: point syd1 clients at k8s consul servers
Proposed
#551 Forward syd1 .consul DNS to the k8s consul LoadBalancer
Proposed
#560 Add the wgvpn role for the BinaryLane VPN hosts
Proposed
#562 Migrate vault nodes to puppet-on-k8s
Proposed
#563 Migrate consul servers to puppet-on-k8s
Proposed
#564 Migrate git redis nodes to puppet-on-k8s
5 Issues created by 1 user
Opened
#500 VM-side Vector rollout: ship host logs to the central logging stack
Opened
#501 Enable named query logging on VM BIND (companion to the logging pipeline)
Opened
#502 VM-side Vector rollout: ship host logs to the central logging stack
Opened
#503 Enable named query logging on VM BIND (companion to logging pipeline)
Opened
#518 netbox-facts: decide token source (no host->Vault auth exists)