From a250d30d7d68c88a1ca4bc6ef01c849ed456cc8b Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 9 Nov 2026 22:31:39 +1100
Subject: [PATCH] Remove legacy /etc/encapic config (#572)

encapic v0.5.0 drops the RPM-owned /etc/encapic/encapic.conf and the binary fallback to it; config lives in /etc/encapi. Upgraded masters can be left with an empty /etc/encapic or a .rpmsave.

- profiles::puppet::encapic removes /etc/encapic recursively after Package[encapic]
- puppet masters pin encapic 0.5.0

Requires encapic v0.5.0 released.

Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/572
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 hieradata/roles/infra/puppet/master.yaml  | 2 +-
 site/profiles/manifests/puppet/encapic.pp | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/hieradata/roles/infra/puppet/master.yaml b/hieradata/roles/infra/puppet/master.yaml
index 6e3155b..32829c7 100644
--- a/hieradata/roles/infra/puppet/master.yaml
+++ b/hieradata/roles/infra/puppet/master.yaml
@@ -31,7 +31,7 @@ profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-
 # Deep-merged with the entries in roles/infra/puppet.yaml.
 profiles::packages::include:
   encapic:
-    ensure: '0.4.0'
+    ensure: '0.5.0'
   certmanager:
     ensure: '0.2.0'
   sshsignhost:
diff --git a/site/profiles/manifests/puppet/encapic.pp b/site/profiles/manifests/puppet/encapic.pp
index eb5edfc..3a2b4ee 100644
--- a/site/profiles/manifests/puppet/encapic.pp
+++ b/site/profiles/manifests/puppet/encapic.pp
@@ -11,7 +11,6 @@ class profiles::puppet::encapic (
   String                $group = 'root',
 ) {
 
-  # encapic >= 0.4.0 reads this path ahead of the RPM-owned /etc/encapic one;
   # order after the package so the shim exists before the config does.
   file { $config_dir:
     ensure  => directory,
@@ -29,4 +28,11 @@ class profiles::puppet::encapic (
     content => "ENCAPI_URL=${encapi_url}\n",
     require => File[$config_dir],
   }
+
+  # legacy pre-0.5.0 config dir; also clears any rpm .rpmsave left behind
+  file { '/etc/encapic':
+    ensure  => absent,
+    force   => true,
+    require => Package['encapic'],
+  }
 }