unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 3 Actions Packages Projects Releases Wiki Activity
1,215 Commits 19 Branches 0 Tags
734fcb8cf43dd1e9ac327a7389cc9ba0ce19e0cf
Commit Graph

3 Commits

Author SHA1 Message Date
unkin-agent 734fcb8cf4 Trust the estate CA when fetching ENC facts (#529) 
Facter runs under Puppet's vendored Ruby, which reads its own bundled CA file and never the system trust store. The ENC fact now fetches over HTTPS, so every node fails certificate verification and falls back to its cached value.

- set ca_file on the request to the vaultca anchor bundle
- keep VERIFY_PEER on, and fall through to the existing cache path when the anchor is absent

Reviewed-on: #529
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
 2026-09-20 23:32:16 +10:00
unkin-agent f933660d3b Fetch agent ENC facts from encapi (#528) 
The enc_role and enc_env facts still resolve against Cobbler on every agent, the last Cobbler dependency in the classification path now that the master-side ENC runs encapic-enc.

- Point the fact at https://encapi.k8s.syd1.au.unkin.net
- Rename the module and its messages from Cobbler to encapi

Cache file, TTL and fallback-to-cache failure behaviour are unchanged.

Reviewed-on: #528
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
 2026-09-20 23:08:20 +10:00
unkinben 8eb751e22f feat: change enc_* fact to read direct from cobbler (#219) 
- change enc_role and enc_env to read direct from cobbler
- cleanup profiles::base::facts

Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/219
 2025-03-12 23:09:15 +11:00