dns: dual-write toggles + drift fact

Publish records both ways during the k8s cutover, and expose expected vs deployed records for drift detection. - profiles::dns::updater + ::record: manage_nsupdate and manage_export booleans (both default on); export keeps the legacy master flow, so disable it once k8s is authoritative - dns_records fact: parses the expected records file and digs the authoritative server for each, reporting expected / in_sync / drift (plus dns_records_insync boolean); updater writes the server address to /var/lib/dns-updater/server for the fact - hiera: manage_export/manage_nsupdate = true (cutover)
dns: nsupdate host records to the authoritative server
2026-07-11 01:02:02 +10:00 · 2026-07-11 01:02:02 +10:00 · 2026-07-06 23:26:21 +10:00 · 2026-07-06 23:02:12 +10:00 · 2026-07-06 23:02:02 +10:00 · 2026-07-06 22:22:51 +10:00
11 changed files with 17 additions and 8 deletions
@@ -12,7 +12,7 @@ steps:
        resources:
          requests:
            memory: 512Mi
-            cpu: 1
+            cpu: 250m
          limits:
            memory: 2Gi
            cpu: 1
@@ -12,7 +12,7 @@ steps:
        resources:
          requests:
            memory: 512Mi
-            cpu: 1
+            cpu: 250m
          limits:
            memory: 2Gi
            cpu: 1
@@ -12,7 +12,7 @@ steps:
        resources:
          requests:
            memory: 512Mi
-            cpu: 1
+            cpu: 250m
          limits:
            memory: 2Gi
            cpu: 1
@@ -12,7 +12,7 @@ steps:
        resources:
          requests:
            memory: 512Mi
-            cpu: 1
+            cpu: 250m
          limits:
            memory: 2Gi
            cpu: 1
@@ -12,7 +12,7 @@ steps:
        resources:
          requests:
            memory: 512Mi
-            cpu: 2
+            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2
@@ -12,7 +12,7 @@ steps:
        resources:
          requests:
            memory: 512Mi
-            cpu: 1
+            cpu: 250m
          limits:
            memory: 2Gi
            cpu: 1
@@ -12,7 +12,7 @@ steps:
        resources:
          requests:
            memory: 512Mi
-            cpu: 1
+            cpu: 250m
          limits:
            memory: 2Gi
            cpu: 1
@@ -12,7 +12,7 @@ steps:
        resources:
          requests:
            memory: 512Mi
-            cpu: 1
+            cpu: 250m
          limits:
            memory: 2Gi
            cpu: 1
@@ -6,3 +6,4 @@ profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDo
 profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
 profiles::consul::server::acl_tokens_default: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAh4Ag95xgkIZHL0gP9OLnZauih0dB1/2l9Jzw8mP3OiIv7fw23otHYONlS3Emtj7oxW8MKcZGKDCzwCT6T2p+V5wx1n15wr2J+FmL24VbclJwrMPQ4AdgP359B9h21uoyo7Zdy7RuuvLfkU1fWXbs3SeWbi2HJs1Ed1/oI1jzr3OgwMbVtbyzd1VuAXeZ9bHQG3IA8z+w/k5m61th0HTyHjw7eldQulbohDuwv545z9axHEoHKCRT2a3ZwBufV2ST6Dm3g9GERzXE9Adp9DQC5adqM74wfsujOMLK2QFJSSIOj2uCs1CpEnrNrQ8zjP3fudM2z3l7KdSHZazEamCSxTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBY/Tn9tzEKYc5dxnzP2rP7gDBWKgVP3lf2T4Q0WPQt3ns0E6RUSO6OtBegb/5qDyohY2nsDeJTnMKOYzYt/J1PhnY=]
 profiles::consul::server::acl_tokens_replication: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzTIxbaAR/TZYnC671aBhiahsfwf3ieyeSHpD5hQm40sMEF/fXlEDijq9i2ykPikm94074j1Uo4HNzv/V9GTf0NSC/64t61jJ/Ya3QKa5f/36+DcRj3lcETsSIyhWwmU+E+zkY8I2r68MtXAuvSoMSMZdpgWSkPx/3FFgZlrsg//bzDu69jS9cx4UK582N3A6QN4Uy/qwYtJcm+2iTQlqqgGRWGqnSgTirxhegxPbJGWTDoAEpAL4/DyF5/hqcUn6mgoSfAsHF3loPHOqN30lG+9o0THWJ9B8Gf4W/1X2UWA/avmUnqBnumGoz0p7AYdNgpW+qLl2rk4lyGYa4kvQjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD9KSLH3Pn/1EIzgVJM+8VOgDDpKWzHfSVsfUMyTD0XIRPGclTdmxqCnsdhKNqmUfSjkYIf2nI9rQtSK6n42TYuO4k=]
+profiles::dns::updater::key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJ4GrN3W4zGfVygfji1MeGyAlmlFN45TVP5st6b66jSKeDYNg9BwdnXahUzkmKvFIYdPWyvXqJdvuyUNz7lWr1dw/pTNHrvqUKSvI0C5TOwmtrTwXtTvucDGs7c7FZDfgUxvLs/Vrp0ZdW3C81QXWNBI8vBfVZyiegPNq+5mX7mtcrFE7jZj1g1qwpg/30lrlCguPyXqnmdtBa7VAyU2Al1UZwkrKIYSAOb9GTnvM6bk5L26pW/NXGj+ffacwf58b4AiKCak5lhoCIInVnlogPuThxULN4RF+MYAVIlgwk159CR1abjWjioxvmP7XgjQUwUuTlgoLh9fDZa0amDeFZTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBEb1BTjhuTN9wGrxc2rdQVgDCctNdt72UR/Hj4wteK7XIX6fF43+7FYKBZnPtyWIWalwDniH//H3gfsJ+ULqSb82w=]
@@ -78,6 +78,13 @@ profiles::yum::global::repos:
    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
    gpgcheck: false
    mirrorlist: absent
+  rpm-internal:
+    name: rpm-internal
+    descr: rpm-internal repository
+    target: /etc/yum.repos.d/rpm-internal.repo
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+    gpgcheck: false
+    mirrorlist: absent

  # Additional repositories - default to absent, roles can override with ensure: present
  # FRRouting repositories
@@ -28,3 +28,4 @@ profiles::nginx::simpleproxy::proxy_path: '/'

 profiles::packages::include:
  openbao-plugins: {}
+  openbao-plugin-secrets-litellm: {}
Author	SHA1	Message	Date
unkinben	cf72d0c635	dns: dual-write toggles + drift fact ci/woodpecker/pr/ruby-validate Pipeline was successful Details ci/woodpecker/pr/puppet-lint Pipeline was successful Details ci/woodpecker/pr/yamllint Pipeline was successful Details ci/woodpecker/pr/bolt-validate Pipeline was successful Details ci/woodpecker/pr/erb-validate Pipeline was successful Details ci/woodpecker/pr/epp-validate Pipeline was successful Details ci/woodpecker/pr/ruby-check Pipeline was successful Details ci/woodpecker/pr/puppet-validate Pipeline was successful Details Publish records both ways during the k8s cutover, and expose expected vs deployed records for drift detection. - profiles::dns::updater + ::record: manage_nsupdate and manage_export booleans (both default on); export keeps the legacy master flow, so disable it once k8s is authoritative - dns_records fact: parses the expected records file and digs the authoritative server for each, reporting expected / in_sync / drift (plus dns_records_insync boolean); updater writes the server address to /var/lib/dns-updater/server for the fact - hiera: manage_export/manage_nsupdate = true (cutover)	2026-07-11 01:02:02 +10:00
unkinben	4b8a720e0c	dns: nsupdate host records to the authoritative server Replaces the exported-resources -> puppet DNS master zone-file flow with per-host RFC2136 dynamic updates against the k8s bind-authoritative write endpoint (198.18.200.9), so the master no longer manages zone files. - add profiles::dns::updater: assembles the host's records into a concat file and runs nsupdate via a systemd .path unit that watches it; the dns-update script sends only the delta and deletes removed records - switch profiles::dns::record to write local concat fragments (zone\|name\|type\|ttl\|value) instead of exporting to the master - include profiles::dns::updater from profiles::dns::base (all nodes) - inert until profiles::dns::updater::key_secret (TSIG) is set in eyaml - hiera: updater server/key_name/algorithm in common.yaml	2026-07-11 01:02:02 +10:00
benvin	69781df412	chore: change to openbao-plugin-secrets-litellm (#479 ) change to openbao litellm plugin as it installs to the correct directory --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #479	2026-07-06 23:26:21 +10:00
benvin	2ae215daf7	feat: install vault-plugin-secrets-litellm (#477 ) ensure the litellm plugin for vault is installed --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #477	2026-07-06 23:02:12 +10:00
benvin	cd1c3e6ae2	chore: add rpm-internal repo (#476 ) enable installing locally packaged rpms with no specific linux release - add the rpm-internal repo from artifactapi --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #476	2026-07-06 23:02:02 +10:00
benvin	00a8088aed	chore: reduce requsts for all jobs (#478 ) - found jobs stalling --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #478	2026-07-06 22:22:51 +10:00