ceph: manage /etc/ceph/ceph.conf on osd and mon/mgr/mds hosts

Bring the hand-maintained /etc/ceph/ceph.conf under Puppet on the
prodnxsr ceph cluster (fsid de96a98f). The file is identified per host
by role: k8s roles include profiles::ceph::osd only and get a [global]
section; the incus node role also includes profiles::ceph::mds and
additionally gets the [mds] + [mds.*] sections.

- Add cluster topology as a single source of truth in common.yaml:
  cluster_public_ips (all 13 ceph host /32s), mon_initial_members, and
  the mds_instances map (two mds daemons per mon/mgr/mds host).
- Render /etc/ceph/ceph.conf from that topology in the reworked
  client.conf.erb, preserving the live two-space indent and key order.
- Gate the [mds] sections on render_mds_config, set true only in the
  incus node role hiera (the role that includes profiles::ceph::mds).
- Drop the hard Package[ceph-common] dependency when the class does not
  manage the package (cephadm/profiles::packages deliver it on the k8s
  and incus hosts).
- Enable manage_ceph_conf on the k8s and incus node roles.

public_network is normalized to all 13 ceph host /32s on every host;
this rewrites it on the mon/mgr/mds hosts (adding .1-.8) as the one
intended content change. RGW hosts keep their profiles::ceph::conf
variant and are untouched.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

hieradata/common.yaml

@@ -409,6 +409,39 @@ profiles::ceph::client::mons:
   - 10.18.15.2
   - 10.18.15.3
 
+# de96a98f cluster topology (prodnxsr0001-0013) - single source of truth for
+# /etc/ceph/ceph.conf rendered by profiles::ceph::client on the k8s (osd) and
+# incus (mon/mgr/mds) roles. fsid/mons are overridden per-role in the role hiera.
+# public_network is the /32 of every ceph host's ceph-public loopback.
+profiles::ceph::client::cluster_public_ips:
+  - 198.18.23.1
+  - 198.18.23.2
+  - 198.18.23.3
+  - 198.18.23.4
+  - 198.18.23.5
+  - 198.18.23.6
+  - 198.18.23.7
+  - 198.18.23.8
+  - 198.18.23.9
+  - 198.18.23.10
+  - 198.18.23.11
+  - 198.18.23.12
+  - 198.18.23.13
+profiles::ceph::client::mon_initial_members:
+  - prodnxsr0009
+  - prodnxsr0010
+  - prodnxsr0011
+  - prodnxsr0012
+  - prodnxsr0013
+# two mds daemon instances per mon/mgr/mds host (rendered only where
+# render_mds_config is true, i.e. the incus node role).
+profiles::ceph::client::mds_instances:
+  prodnxsr0009: 2
+  prodnxsr0010: 2
+  prodnxsr0011: 2
+  prodnxsr0012: 2
+  prodnxsr0013: 2
+
 profiles::ceph::conf::config:
   global:
     auth_client_required: 'cephx'

hieradata/roles/infra/incus/node.yaml

@@ -203,7 +203,9 @@ profiles::accounts::sysadmin::extra_groups:
   - incus-admin
 
 # manage cephfs mounts
-profiles::ceph::client::manage_ceph_conf: false
+profiles::ceph::client::manage_ceph_conf: true
+# mon/mgr/mds host: render the [mds] + [mds.*] sections
+profiles::ceph::client::render_mds_config: true
 profiles::ceph::client::manage_ceph_package: false
 profiles::ceph::client::manage_ceph_paths: false
 profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'

hieradata/roles/infra/k8s.yaml

@@ -92,7 +92,7 @@ profiles::packages::include:
 
 profiles::selinux::setenforce::mode: disabled
 
-profiles::ceph::client::manage_ceph_conf: false
+profiles::ceph::client::manage_ceph_conf: true
 profiles::ceph::client::manage_ceph_package: false
 profiles::ceph::client::manage_ceph_paths: false
 profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'

hieradata/roles/infra/k8s/node.yaml

@@ -33,7 +33,7 @@ profiles::packages::include:
 
 profiles::selinux::setenforce::mode: disabled
 
-profiles::ceph::client::manage_ceph_conf: false
+profiles::ceph::client::manage_ceph_conf: true
 profiles::ceph::client::manage_ceph_package: false
 profiles::ceph::client::manage_ceph_paths: false
 profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'