2025-11-03 - 2026-11-03
Overview
129 Pull requests merged by 3 users
Merged
#561 Run detached noop agent after k8s migration repoint
Merged
#554 Add dnsmasq resolver and edge base-class changes to the mail gateway
Merged
#559 Add the bne dmz vpc and move the mta2 edge to bne
Merged
#558 Move mail DMZ VPC subnet facts to RFC 1918 ranges
Merged
#555 Adapt base classes for the mail edge gateway
Merged
#557 Resolve subnet facts from secondary interfaces
Merged
#552 Fix edge postfix gateway config for unkin.net
Merged
#556 Map the binarylane DMZ VPCs in subnet facts
Merged
#553 Add local rspamd and redis to the mail edge gateway
Merged
#547 Add consul server federation SANs to consul server certs
Merged
#545 Migrate k8s roles to puppet-on-k8s
Merged
#546 Migrate incus nodes to puppet-on-k8s
Merged
#544 consul: use static server list for clients
Merged
#543 nzbget: fix params lookup copied from sonarr
Merged
#540 Migrate media roles to puppet-on-k8s
Merged
#542 halb: stop publishing haproxy2 site CNAMEs
Merged
#539 Persist rp_filter=0 on every router interface
Merged
#524 Install certmanager and sshsignhost from RPM
Merged
#538 Add wireguard module
Merged
#537 Add dnsmasq module
Merged
#536 Add router role for prodnxsr0020
Merged
#535 Add 198.18.2.0/24 router loopback subnet
Merged
#533 Pin the journald ingest URL to port 443
Merged
#531 Ship estate journald logs to the k8s log ingest endpoint
Merged
#532 Allow k8s edge health checks on arrstack hosts
Merged
#530 Trust the sshca host CA alongside the legacy signer
Merged
#529 Trust the estate CA when fetching ENC facts
Merged
#528 Fetch agent ENC facts from encapi
Merged
#527 Classify puppet masters through encapi
Merged
#526 Shorten metadata_expire on internal RPM repos
Merged
#525 Install encapic ENC client on puppet masters
Merged
#522 Bump openbao-plugin-secrets-arrstack to 0.2.0
Merged
#521 Install openbao-plugin-secrets-arrstack v0.1.0
Merged
#520 vault: install openbao-plugin-secrets-ghp on OpenBao nodes
Merged
#509 vault: move openbao plugin sockets off /tmp onto /run
Merged
#519 vault: install netbox and apptoken OpenBao plugin RPMs on bao nodes
Merged
#515 ceph: manage /etc/ceph/ceph.conf on osd and mon/mgr/mds hosts
Merged
#517 rke2: taint control-plane nodes NoSchedule
Merged
#516 fix: lock rke2-common and pin rke2 to 1.33.13~rke2r2 to unblock puppet
Merged
#505 ceph: set OSD disk I/O scheduler to none via udev rule
Merged
#514 rke2,puppet: enforce versionlock before package install
Merged
#513 lldpd: run on physicals and expose neighbour topology as the lldp fact
Merged
#512 fix: preload correct rke2 airgap images to break CNI bootstrap deadlock
Merged
#511 fix: avoid anycast ips
Merged
#510 chore: add new physicals
Merged
#507 chore: update dns nameserver in dhcp
Merged
#504 libs: add ceph_osd_devices fact listing ceph OSD block devices
Merged
#499 puppetserver: auto-restart JVM when its binaries are replaced by an upgrade
Merged
#496 yum: source AlmaLinux RPM repos from artifactapi, drop legacy unkin repo
Merged
#497 os/Fedora: add Fedora 44 support for the base role
Merged
#498 vault: install openbao-plugin-secrets-gitea on the storage role
Merged
#495 dns: stop exporting legacy DNS fragments (manage_export false)
Merged
#494 Migrate canary ausyd1nxvm2120 to puppet-on-k8s
Merged
#493 Add profiles::puppet::migrate: repoint VM agents onto puppet-on-k8s
Merged
#492 Pin openbao secrets plugins to exact versions
Merged
#491 Fix cobbler.main.unkin.net CNAME to resolve on k8s DNS
Merged
#490 feat: migrate clients to use bind-dns in kubernetes
Merged
#489 haproxy::dns: fully-qualify halb CNAME targets
Merged
#487 ceph/rgw: add s3.ceph.unkin.net to radosgw cert SAN + nginx aliases
Merged
#488 Upgrade openbao-plugin-secrets-rancher to latest (v0.1.1)
Merged
#486 yum: point rpmfusion repos at artifactapi
Merged
#485 dns: exclude k8s/LB ranges from dns-updater; track latest
Merged
#484 Add rpm-vendor yum repository
Merged
#483 Install openbao-plugin-secrets-rancher on vault nodes
Merged
#482 dns: deploy dns-updater daemon in place of the shell nsupdate script [HOLD: needs dns-updater RPM published]
Merged
#481 dns: fix dns-update fqdn() double-appending zone to FQDN records
Merged
#480 Install openbao-plugin-secrets-gpg on vault nodes
Merged
#475 dns: nsupdate host records to the authoritative server
Merged
#479 chore: change to openbao-plugin-secrets-litellm
Merged
#477 feat: install vault-plugin-secrets-litellm
Merged
#476 chore: add rpm-internal repo
Merged
#478 chore: reduce requsts for all jobs
Merged
#474 Convert RKE2 registries to template, disable default endpoints
Merged
#473 chore: enable rke2 registries
Merged
#472 feat: make rke2 registries.yaml conditional on manage_registries
Merged
#471 chore: bump almalinux9 image tags
Merged
#470 feat: upgrade grafana from default to 13.0.2
Merged
#469 feat: upgrade gitea from 1.22.0 to 1.26.2
Merged
#468 feat: add switch to change to almalinux-vault
Merged
#467 feat: add auth.unkin.net proxying to Kubernetes Traefik ingress
Merged
#466 chore: increase inotify limits on rke2 nodes to fix fsnotify watcher errors
Merged
#465 feat: restart rke2 when registries.yaml is deployed
Merged
#464 chore: expand puppet-validate to two cpus
Merged
#463 chore: setup proper resource requirements for puppet ci jobs
Merged
#462 chore: deploy rke2 registries.yaml
Merged
#461 chore: disable rp_filter on k8s nodes
Merged
#459 feat: add ceph service management profiles and facts
Merged
#460 chore: enable access to dns
Merged
#458 chore: change to ceph-public loopback
Merged
#457 fix: replace puppetdbquery with native PQL queries
Merged
#456 fix: allow transfer for external-dns
Merged
#455 feat: improve ci performance
Merged
#454 chore: update r10k repo path
Merged
#453 feat: puppetboard 7 python
Merged
#452 chore: update puppet-bind repo url
Merged
#451 chore: cleanup gitea actions workflows
Merged
#450 feat: add woodpecker ci jobs
Merged
#449 feat: add ldap groups for kubernetes/vault
Merged
#448 chore: add alt-names to consul
Merged
#446 feat: manage vault version
Merged
#447 feat: enable plugins for vault/openbao
Merged
#445 docs: add docs for cephfs
Merged
#444 chore: remove helm deploys from puppet
Merged
#443 chore: add additional user
Merged
#442 chore: terraform state too large for body
Merged
#441 chore: reduce synced repos
Merged
#440 chore: docs for ceph
Merged
#438 chore: update ceph gpgkey
Merged
#437 fix: ceph repos remove dash
Merged
#436 chore: centralise all yum repo configuration
Merged
#435 fix: thundering hurd
Merged
#434 fix: ensure join-api is functioning
Merged
#433 core: bump radowgw client_max_body_size
Merged
#432 feat: act runner updates
Merged
#431 fix: increase artifact upload size for git
Merged
#430 chore: add almalinux 9.7 repositories
Merged
#429 feat: enable managing root password
Merged
#428 feat: manage externaldns bind
Merged
#427 feat: add syslog listener for vlinsert
Merged
#426 feat: add vmcluster static targets
Merged
#425 feat: add SMTP submission listener and enhance stalwart configuration
Merged
#424 chore: replace stalwart S3 keys
Merged
#423 fix: remove . from end of vrrp_cnames
Merged
#422 chore: add stalwart required tls alt names
Merged
#421 chore: change transport for main.unkin.net
Merged
#420 feat: manage haproxy for stalwart
Merged
#419 feat: manage additional ceph sections
Merged
#418 feat: create stalwart module
Merged
#417 feat: ensure latest openbao package
8 Pull requests proposed by 2 users
Proposed
#439 chore: bump rke2 version
Proposed
#506 feat: NetBox IP/interface facts with offline cache
Proposed
#551 Forward syd1 .consul DNS to the k8s consul LoadBalancer
Proposed
#550 consul: point syd1 clients at k8s consul servers
Proposed
#560 Add the wgvpn role for the BinaryLane VPN hosts
Proposed
#562 Migrate vault nodes to puppet-on-k8s
Proposed
#563 Migrate consul servers to puppet-on-k8s
Proposed
#564 Migrate git redis nodes to puppet-on-k8s
5 Issues created by 1 user
Opened
#500 VM-side Vector rollout: ship host logs to the central logging stack
Opened
#501 Enable named query logging on VM BIND (companion to the logging pipeline)
Opened
#502 VM-side Vector rollout: ship host logs to the central logging stack
Opened
#503 Enable named query logging on VM BIND (companion to logging pipeline)
Opened
#518 netbox-facts: decide token source (no host->Vault auth exists)