From 0fdc7c97d8478a657157d2840ee26ef79fb3459a Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 8 Aug 2026 20:00:42 +1000
Subject: [PATCH] rke2,puppet: enforce versionlock before package install
 (#514)

## Why

A package versionlock is only effective if it is applied **before** the package resource is evaluated. When the package is upgraded/installed first and locked afterwards, dnf can pull an unpinned version and the lock then pins whatever landed. This is the exact drift that let new RKE2 nodes boot 1.33.11 instead of the pinned version, and it also matters because a global `dnf update -y` autoupdate timer (`profiles::yum::autoupdater`) relies on the versionlock plugin already having the lock written.

## Changes

- `rke2::install` orders the versionlock ahead of the package: adds `before => Package["rke2-${node_type}"]` so the lock exists before install/upgrade.
- `profiles::puppet::agent` (RedHat branch) adds `before => Package[$use_package]` on the versionlock for the same reason.
- Leaves `profiles::gitea::runner` and `profiles::vault::server` unchanged: both already order the versionlock ahead of the package (`before => Package` / `before => Class['vault']`).
- Changes ordering only; locked versions (including the RKE2 pin) are untouched. No dependency cycle is introduced (packages hold no back-reference to the versionlock).

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/514
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
---
 modules/rke2/manifests/install.pp       | 3 ++-
 site/profiles/manifests/puppet/agent.pp | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/rke2/manifests/install.pp b/modules/rke2/manifests/install.pp
index 7c5b7b3..4630f3c 100644
--- a/modules/rke2/manifests/install.pp
+++ b/modules/rke2/manifests/install.pp
@@ -6,10 +6,11 @@ class rke2::install (
   Stdlib::HTTPUrl         $container_archive_source = $rke2::container_archive_source,
 ){
 
-  # versionlock rke2
+  # versionlock rke2 before install so the lock exists before any upgrade is attempted
   yum::versionlock{"rke2-${node_type}":
     ensure  => present,
     version => "${rke2_version}~${rke2_release}",
+    before  => Package["rke2-${node_type}"],
   }
 
   # install rke2
diff --git a/site/profiles/manifests/puppet/agent.pp b/site/profiles/manifests/puppet/agent.pp
index b8847c2..35d365c 100644
--- a/site/profiles/manifests/puppet/agent.pp
+++ b/site/profiles/manifests/puppet/agent.pp
@@ -60,10 +60,11 @@ class profiles::puppet::agent (
         require => Yumrepo[$use_yumrepo],
       }
 
-      # versionlock puppet-agent
+      # versionlock puppet-agent before install so the lock exists before any upgrade is attempted
       yum::versionlock{$use_package:
         ensure  => $agent_versionlock_ensure,
         version => $agent_versionlock_version,
+        before  => Package[$use_package],
       }
     }
     'Debian': {