Merge pull request 'feat: deep merge yum repos to manage' (#143) from neoloc/puppet7gpg into develop

Reviewed-on: unkinben/puppet-prod#143

hieradata/common.yaml

@@ -18,7 +18,7 @@ lookup_options:
   profiles::pki::vault::ip_sans:
     merge:
       strategy: deep
-  profiles::yum::managed_repos:
+  profiles::yum::global::managed_repos:
     merge:
       strategy: deep
 

hieradata/os/AlmaLinux/AlmaLinux8.yaml

@@ -1,6 +1,6 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
-profiles::yum::managed_repos:
+profiles::yum::global::managed_repos:
   - 'base'
   - 'appstream'
   - 'epel'

hieradata/os/AlmaLinux/AlmaLinux9.yaml

@@ -1,6 +1,6 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
-profiles::yum::managed_repos:
+profiles::yum::global::managed_repos:
   - 'base'
   - 'appstream'
   - 'epel'

hieradata/roles/infra/ovirt/engine.yaml

@@ -1,5 +1,5 @@
 ---
-profiles::yum::managed_repos:
+profiles::yum::global::managed_repos:
   - 'virt-advanced-virtualization'
   - 'storage-ceph-pacific'
   - 'cloud-openstack-xena'

hieradata/roles/infra/ovirt/node.yaml

@@ -1,7 +1,7 @@
 ---
 profiles::firewall::firewalld::ensure_package: 'installed'
 profiles::firewall::firewalld::ensure_service: 'running'
-profiles::yum::managed_repos:
+profiles::yum::global::managed_repos:
   - 'virt-advanced-virtualization'
   - 'storage-ceph-pacific'
   - 'cloud-openstack-xena'

hieradata/roles/infra/reposync/syncer.yaml

@@ -119,7 +119,7 @@ profiles::reposync::repos_list:
     osname: 'puppet7'
     release: 'el'
     baseurl: 'https://yum.puppet.com/puppet7/el/8/x86_64/'
-    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet'
+    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
   postgresql_rhel8_common:
     repository: 'common'
     description: 'PostgreSQL Common RHEL 8'

site/profiles/manifests/puppet/agent.pp

@@ -6,7 +6,8 @@ class profiles::puppet::agent (
 
   # Ensure the puppet-agent package is installed and locked to a specific version
   package { 'puppet-agent':
-    ensure => $puppet_version,
+    ensure  => $puppet_version,
+    require => Class['profiles::yum::puppet7'],
   }
 
   # if puppet-version is anything other than latest, set a versionlock

site/profiles/manifests/yum/global.pp

@@ -41,7 +41,7 @@
 #   - 'appstream'
 #
 class profiles::yum::global (
-  Array[String] $managed_repos = lookup('profiles::yum::managed_repos'),
+  Array[String] $managed_repos,
   Boolean       $purge         = true,
 ){
   class { 'yum':

site/profiles/manifests/yum/puppet7.pp

@@ -30,29 +30,19 @@
 #   }
 class profiles::yum::puppet7 (
   Array[String] $managed_repos,
-  String        $baseurl = 'http://yum.puppet.com',
+  String        $baseurl = 'http://repos.main.unkin.net/puppet7',
 ) {
   $releasever = $facts['os']['release']['major']
   $basearch = $facts['os']['architecture']
 
   if 'puppet7' in $managed_repos {
-    if ($releasever in [7,8,9]) {
-      $source = "${baseurl}/puppet7-release-el-${releasever}.noarch.rpm"
-
-      yum::install { 'puppet-release-el':
-        ensure => present,
-        source => $source,
-      }
-    } else {
-      err("Unsupported OS release ${releasever}")
-    }
-
     yumrepo { 'puppet7':
       name    => 'puppet7',
       descr   => 'puppet7 repository',
       target  => '/etc/yum.repos.d/puppet7.repo',
-      baseurl => "${baseurl}/puppet/el/${releasever}/${basearch}/",
-      gpgkey  => "${baseurl}/RPM-GPG-KEY-puppet",
+      baseurl => "${baseurl}/el/${releasever}-daily/${basearch}/os/",
+      gpgkey  => 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406',
+      #gpgkey => "${baseurl}/el/${releasever}-daily/${basearch}/os/RPM-GPG-KEY-puppet",
     }
   }
 }