Wire profiles::puppet::migrate into profiles::base (shipping enabled=>false)
so every node evaluates it. client.pp now includes migrate and folds
new_server/new_ca_server/new_ssldir into the effective server/ca_server/
report_server/ssldir it renders, so flipping the one
profiles::puppet::migrate::enabled key at any hiera layer (node/role/common)
repoints a target -- no per-node client param overrides.
Explicit client::ssldir/::report_server still override the migrate-derived
value; unmigrated nodes render a byte-identical puppet.conf.
Migrate VM puppet agents off the legacy VM puppetmasters and onto the new
puppet-on-kubernetes servers, per-wave via hiera and reversible without
re-enrolment. Changing server/ca_server alone is insufficient: the agent's
ssldir holds a cert signed by the OLD CA that the new CA neither trusts nor
recognises. This switches migrated nodes to a FRESH ssldir so the agent
generates a new CSR (autosigned on the k8s CA) while the old creds stay on
disk for rollback.
- Add profiles::puppet::migrate: opt-in (hiera_include) toggle that owns the
fresh ssldir directory and documents per-node/per-role/common wiring plus
rollback in its class header.
- Extend profiles::puppet::client with optional $ssldir and $report_server
params (default undef); the ERB template omits both lines when unset, so
unmigrated nodes render a byte-identical puppet.conf.
- puppet.conf stays owned solely by client.pp's template; migrate.pp adds no
competing File resource.
- add puppetdb_api and puppetdb_sql role
- add puppetdb_api and puppetdb_sql profile
- add prodinf01n05 to /etc/hosts file
- set listen_address for all services to be hosts ip
- set storeconfigs and storeconfigs_backend to be managed by puppetmaster profile
- set through puppet.conf
- created symbolic link from develop -> production in code/environments
- changed puppet-g10k script to be generated from a template
- parameterised g10k into hieradata
unkinben
Ben Vincent