chore: bump rke2 version

2026-01-17 01:48:06 +11:00
82 changed files with 531 additions and 1421 deletions
@@ -0,0 +1,24 @@
+name: Build
+
+on:
+  pull_request:
+
+jobs:
+  precommit:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Install requirements
+        run: |
+          dnf groupinstall -y "Development Tools" -y
+          dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
+
+      - name: Pre-Commit All Files
+        run: |
+          uvx pre-commit run --all-files
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: bolt-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/bolt-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: epp-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/epp-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: erb-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/erb-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: puppet-lint
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/puppet-lint.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: puppet-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/puppet-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: ruby-check
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/ruby-check.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: ruby-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/ruby-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: yamllint
-    image: git.unkin.net/unkin/almalinux9-base:20260606
-    commands:
-      - uvx pre-commit run --all-files --config ci/yamllint.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -53,6 +53,7 @@ mod 'saz-ssh', '13.1.0'
 mod 'saz-limits', '5.0.0'
 mod 'ghoneycutt-timezone', '4.0.0'
 mod 'ghoneycutt-puppet', '3.3.0'
+mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
 mod 'broadinstitute-certs', '3.0.1'
@@ -65,5 +66,5 @@ mod 'thias-sysctl', '1.0.8'
 mod 'cirrax-dovecot', '1.3.3'

 mod 'bind',
-  :git => 'https://git.unkin.net/unkinben/puppet-bind.git',
+  :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',
  :tag => '1.0'
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: bolt-validate
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: epp-validate
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: erb-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: puppet-lint
-        args:
-          - --no-80chars-check
-          - --no-documentation-check
-          - --no-puppet_url_without_modules-check
-          - --fail-on-warnings
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: puppet-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: ruby-validate
-  - repo: 'https://github.com/jumanjihouse/pre-commit-hooks'
-    rev: 3.0.0
-    hooks:
-      - id: reek
-      - id: rubocop
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: ruby-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/adrienverge/yamllint'
-    rev: v1.32.0
-    hooks:
-      - id: 'yamllint'
-        args:
-          [
-            "-d {extends: relaxed, rules: {line-length: disable}, ignore: chart}",
-            "-s",
-          ]
@@ -28,98 +28,6 @@ Always refer back to the official documentation at https://docs.ceph.com/en/late
    sudo ceph fs set mediafs max_mds 2
 ```

-
-## managing cephfs with subvolumes
-
-Create erasure code profiles. The K and M values are equivalent to the number of data disks (K) and parity disks (M) in RAID5, RAID6, etc.
-
-    sudo ceph osd erasure-code-profile set ec_6_2 k=6 m=2
-    sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
-
-Create data pools using the erasure-code-profile, set some required options
-
-    sudo ceph osd pool create cephfs_data_ssd_ec_6_2 erasure ec_6_2
-    sudo ceph osd pool set cephfs_data_ssd_ec_6_2 allow_ec_overwrites true
-    sudo ceph osd pool set cephfs_data_ssd_ec_6_2 bulk true
-
-    sudo ceph osd pool create cephfs_data_ssd_ec_4_1 erasure ec_4_1
-    sudo ceph osd pool set cephfs_data_ssd_ec_4_1 allow_ec_overwrites true
-    sudo ceph osd pool set cephfs_data_ssd_ec_4_1 bulk true
-
-Add the pool to the fs `cephfs`
-
-    sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_6_2
-    sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_4_1
-
-Create a subvolumegroup using the new data pool
-
-    sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_6_2 --pool_layout cephfs_data_ssd_ec_6_2
-    sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_4_1 --pool_layout cephfs_data_ssd_ec_4_1
-
-All together:
-
-    sudo ceph osd erasure-code-profile set ec_6_2 k=6 m=2
-    sudo ceph osd pool create cephfs_data_ssd_ec_6_2 erasure ec_6_2
-    sudo ceph osd pool set cephfs_data_ssd_ec_6_2 allow_ec_overwrites true
-    sudo ceph osd pool set cephfs_data_ssd_ec_6_2 bulk true
-    sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_6_2
-    sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_6_2 --pool_layout cephfs_data_ssd_ec_6_2
-
-    sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
-    sudo ceph osd pool create cephfs_data_ssd_ec_4_1 erasure ec_4_1
-    sudo ceph osd pool set cephfs_data_ssd_ec_4_1 allow_ec_overwrites true
-    sudo ceph osd pool set cephfs_data_ssd_ec_4_1 bulk true
-    sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_4_1
-    sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_4_1 --pool_layout cephfs_data_ssd_ec_4_1
-
-Create a key with access to the new subvolume groups. Check if the user already exists first:
-
-    sudo ceph auth get client.kubernetes-cephfs
-
-If it doesnt:
-
-    sudo ceph auth get-or-create client.kubernetes-cephfs \
-      mgr 'allow rw' \
-      osd 'allow rw tag cephfs metadata=cephfs, allow rw tag cephfs data=cephfs' \
-      mds 'allow r fsname=cephfs path=/volumes, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_6_2, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_4_1' \
-      mon 'allow r fsname=cephfs'
-
-If it does, use `sudo ceph auth caps client.kubernetes-cephfs ...` instead to update existing capabilities.
-
-## removing a cephfs subvolumegroup from cephfs
-
-This will cleanup the subvolumegroup, and subvolumes if they exist, then remove the pool.
-
-Check for subvolumegroups first, then for subvolumes in it
-
-    sudo ceph fs subvolumegroup ls cephfs
-    sudo ceph fs subvolume ls cephfs --group_name csi_raid6
-
-
-If subvolumes exist, remove each one-by-one:
-
-    sudo ceph fs subvolume rm cephfs <subvol_name> --group_name csi_raid6
-
-If you have snapshots, remove snapshots first:
-
-    sudo ceph fs subvolume snapshot ls cephfs <subvol_name> --group_name csi_raid6
-    sudo ceph fs subvolume snapshot rm cephfs <subvol_name> <snap_name> --group_name csi_raid6
-
-Once the group is empty, remove it:
-
-    sudo ceph fs subvolumegroup rm cephfs csi_raid6
-
-If it complains it’s not empty, go back as there’s still a subvolume or snapshot.
-
-If you added it with `ceph fs add_data_pool`. Undo with `rm_data_pool`:
-
-    sudo ceph fs rm_data_pool cephfs cephfs_data_csi_raid6
-
-After it’s detached from CephFS, you can delete it.
-
-    sudo ceph osd pool rm cephfs_data_csi_raid6 cephfs_data_csi_raid6 --yes-i-really-really-mean-it
-
-
 ## creating authentication tokens

 - this will create a client keyring named media
@@ -150,78 +58,3 @@ this will overwrite the current capabilities of a given client.user
      mon 'allow r' \
      mds 'allow rw path=/' \
      osd 'allow rw pool=media_data'
-
-## adding a new osd on new node
-
-create the ceph conf (automate this?)
-
-    cat <<EOF | sudo tee /etc/ceph/ceph.conf
-    [global]
-      auth_client_required = cephx
-      auth_cluster_required = cephx
-      auth_service_required = cephx
-      fsid = de96a98f-3d23-465a-a899-86d3d67edab8
-      mon_allow_pool_delete = true
-      mon_initial_members = prodnxsr0009,prodnxsr0010,prodnxsr0011,prodnxsr0012,prodnxsr0013
-      mon_host = 198.18.23.9,198.18.23.10,198.18.23.11,198.18.23.12,198.18.23.13
-      ms_bind_ipv4 = true
-      ms_bind_ipv6 = false
-      osd_crush_chooseleaf_type = 1
-      osd_pool_default_min_size = 2
-      osd_pool_default_size = 3
-      osd_pool_default_pg_num = 128
-      public_network = 198.18.23.1/32,198.18.23.2/32,198.18.23.3/32,198.18.23.4/32,198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,198.18.23.13/32
-    EOF
-
-ssh to one of the monitor hosts, then transfer the keys required
-
-    sudo cat /etc/ceph/ceph.client.admin.keyring | ssh prodnxsr0003 'sudo tee /etc/ceph/ceph.client.admin.keyring'
-    sudo cat /var/lib/ceph/bootstrap-osd/ceph.keyring | ssh prodnxsr0003 'sudo tee /var/lib/ceph/bootstrap-osd/ceph.keyring'
-
-assuming we are adding /dev/sda to the cluster, first zap the disk to remove partitions/lvm/metadata
-
-    sudo ceph-volume lvm zap /dev/sda --destroy
-
-then add it to the cluster
-
-    sudo ceph-volume lvm create --data /dev/sda
-
-## removing an osd
-
-check what OSD IDs were on this host (if you know it)
-
-    sudo ceph osd tree
-
-or check for any DOWN osds
-
-    sudo ceph osd stat
-    sudo ceph health detail
-
-once you identify the old OSD ID, remove it with these steps, replace X with the actual OSD ID:
-
-    sudo ceph osd out osd.X
-    sudo ceph osd down osd.X
-    sudo ceph osd crush remove osd.X
-    sudo ceph auth del osd.X
-    sudo ceph osd rm osd.X
-
-
-## maintenance mode for the cluster
-
-from one node in the cluster disable recovery
-
-    sudo ceph osd set noout
-    sudo ceph osd set nobackfill
-    sudo ceph osd set norecover
-    sudo ceph osd set norebalance
-    sudo ceph osd set nodown
-    sudo ceph osd set pause
-
-to undo the change, use unset
-
-    sudo ceph osd unset noout
-    sudo ceph osd unset nobackfill
-    sudo ceph osd unset norecover
-    sudo ceph osd unset norebalance
-    sudo ceph osd unset nodown
-    sudo ceph osd unset pause
@@ -30,7 +30,6 @@ hierarchy:
      - "roles/%{::enc_role_tier1}.eyaml"
      - "roles/%{::enc_role_tier1}.yaml"
      - "virtual/%{facts.virtual}.yaml"
-      - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.%{facts.os.release.minor}.yaml"
      - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"
      - "os/%{facts.os.name}/all_releases.yaml"
      - "common.eyaml"
@@ -6,4 +6,3 @@ profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDo
 profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
 profiles::consul::server::acl_tokens_default: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAh4Ag95xgkIZHL0gP9OLnZauih0dB1/2l9Jzw8mP3OiIv7fw23otHYONlS3Emtj7oxW8MKcZGKDCzwCT6T2p+V5wx1n15wr2J+FmL24VbclJwrMPQ4AdgP359B9h21uoyo7Zdy7RuuvLfkU1fWXbs3SeWbi2HJs1Ed1/oI1jzr3OgwMbVtbyzd1VuAXeZ9bHQG3IA8z+w/k5m61th0HTyHjw7eldQulbohDuwv545z9axHEoHKCRT2a3ZwBufV2ST6Dm3g9GERzXE9Adp9DQC5adqM74wfsujOMLK2QFJSSIOj2uCs1CpEnrNrQ8zjP3fudM2z3l7KdSHZazEamCSxTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBY/Tn9tzEKYc5dxnzP2rP7gDBWKgVP3lf2T4Q0WPQt3ns0E6RUSO6OtBegb/5qDyohY2nsDeJTnMKOYzYt/J1PhnY=]
 profiles::consul::server::acl_tokens_replication: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzTIxbaAR/TZYnC671aBhiahsfwf3ieyeSHpD5hQm40sMEF/fXlEDijq9i2ykPikm94074j1Uo4HNzv/V9GTf0NSC/64t61jJ/Ya3QKa5f/36+DcRj3lcETsSIyhWwmU+E+zkY8I2r68MtXAuvSoMSMZdpgWSkPx/3FFgZlrsg//bzDu69jS9cx4UK582N3A6QN4Uy/qwYtJcm+2iTQlqqgGRWGqnSgTirxhegxPbJGWTDoAEpAL4/DyF5/hqcUn6mgoSfAsHF3loPHOqN30lG+9o0THWJ9B8Gf4W/1X2UWA/avmUnqBnumGoz0p7AYdNgpW+qLl2rk4lyGYa4kvQjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD9KSLH3Pn/1EIzgVJM+8VOgDDpKWzHfSVsfUMyTD0XIRPGclTdmxqCnsdhKNqmUfSjkYIf2nI9rQtSK6n42TYuO4k=]
-profiles::dns::updater::key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJ4GrN3W4zGfVygfji1MeGyAlmlFN45TVP5st6b66jSKeDYNg9BwdnXahUzkmKvFIYdPWyvXqJdvuyUNz7lWr1dw/pTNHrvqUKSvI0C5TOwmtrTwXtTvucDGs7c7FZDfgUxvLs/Vrp0ZdW3C81QXWNBI8vBfVZyiegPNq+5mX7mtcrFE7jZj1g1qwpg/30lrlCguPyXqnmdtBa7VAyU2Al1UZwkrKIYSAOb9GTnvM6bk5L26pW/NXGj+ffacwf58b4AiKCak5lhoCIInVnlogPuThxULN4RF+MYAVIlgwk159CR1abjWjioxvmP7XgjQUwUuTlgoLh9fDZa0amDeFZTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBEb1BTjhuTN9wGrxc2rdQVgDCctNdt72UR/Hj4wteK7XIX6fF43+7FYKBZnPtyWIWalwDniH//H3gfsJ+ULqSb82w=]
@@ -146,8 +146,6 @@ lookup_options:
      strategy: deep
  profiles::etcd::node::initial_cluster_token:
    convert_to: Sensitive
-  profiles::dns::updater::key_secret:
-    convert_to: Sensitive
  sysctl::base::values:
    merge:
      strategy: deep
@@ -208,28 +206,8 @@ vault::manage_config_dir: true
 vault::disable_mlock: false

 profiles::dns::base::nameservers:
-  - 198.18.200.7
+  - 198.18.19.16
 profiles::dns::master::basedir: '/var/named/sources'
-
-# dns record publishing. During the k8s cutover both methods run; set
-# manage_export false once k8s is authoritative.
-#   - export:   legacy exported-resources -> puppet DNS master
-#   - nsupdate: RFC2136 to the k8s bind-authoritative write endpoint (.9),
-#               inert until the TSIG key is set in eyaml:
-#                 profiles::dns::updater::key_secret: ENC[...]
-#               (must match the key the bind-authoritative zones allow-update
-#               with; algorithm hmac-sha256)
-# k8s is now authoritative: clients resolve via the k8s bind-resolvers
-# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the
-# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s
-# bind-authoritative cluster fed by the nsupdate path below. The legacy
-# exported-resources -> VM-master /var/named/sources files are no longer in any
-# client's resolution path, so stop exporting them. Rollback: set back to true.
-profiles::dns::updater::manage_export: false
-profiles::dns::updater::manage_nsupdate: true
-profiles::dns::updater::server: '198.18.200.9'
-profiles::dns::updater::key_name: 'client-update'
-profiles::dns::updater::key_algorithm: 'hmac-sha256'
 #profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
 #profiles::dns::base::use_ns: 'region'
 profiles::consul::server::members_role: roles::infra::storage::consul
@@ -1,7 +1,4 @@
 ---
-haproxy_server_k8s_syd1_traefik_internal: 'k8s-traefik-internal 198.18.200.4:443 ssl verify none check inter 2s rise 3 fall 2'
-haproxy_server_k8s_syd1_traefik_external: 'k8s-traefik-external 198.18.199.0:443 ssl verify none check inter 2s rise 3 fall 2'
-
 profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
 profiles::haproxy::dns::vrrp_cnames:
  - sonarr.main.unkin.net
@@ -19,7 +16,6 @@ profiles::haproxy::dns::vrrp_cnames:
  - mail.main.unkin.net
  - autoconfig.main.unkin.net
  - autodiscover.main.unkin.net
-  - auth.unkin.net

 profiles::haproxy::mappings:
  fe_http:
@@ -41,7 +37,6 @@ profiles::haproxy::mappings:
      - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
      - 'autoconfig.main.unkin.net be_stalwart_webadmin'
      - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
-      - 'auth.unkin.net be_k8s_kanidm'
  fe_https:
    ensure: present
    mappings:
@@ -61,7 +56,6 @@ profiles::haproxy::mappings:
      - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
      - 'autoconfig.main.unkin.net be_stalwart_webadmin'
      - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
-      - 'auth.unkin.net be_k8s_kanidm'

 profiles::haproxy::frontends:
  fe_http:
@@ -86,7 +80,6 @@ profiles::haproxy::frontends:
        - 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
        - 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
        - 'acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net'
-        - 'acl_kanidm req.hdr(host) -i auth.unkin.net'
        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
      use_backend:
        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -106,7 +99,6 @@ profiles::haproxy::frontends:
        - 'set-header X-Frame-Options DENY if acl_grafana'
        - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
        - 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
-        - 'set-header X-Frame-Options DENY if acl_kanidm'
        - 'set-header X-Content-Type-Options nosniff'
        - 'set-header X-XSS-Protection 1;mode=block'

@@ -328,26 +320,6 @@ profiles::haproxy::backends:
        - add-header X-Forwarded-Proto https if { dst_port 9443 }
      redirect: 'scheme https if !{ ssl_fc }'
      stick-table: 'type ip size 200k expire 30m'
-  be_k8s_kanidm:
-    description: Backend for Kanidm (auth.unkin.net via Kubernetes internal Traefik)
-    collect_exported: false
-    options:
-      balance: roundrobin
-      option:
-        - httpchk
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      http-check:
-        - 'connect ssl sni auth.unkin.net'
-        - 'send meth GET uri /status ver HTTP/1.1 hdr Host auth.unkin.net'
-        - 'expect status 200'
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      server: "%{lookup('haproxy_server_k8s_syd1_traefik_internal')} sni str(auth.unkin.net)"
  be_stalwart_imap:
    description: Backend for Stalwart IMAP (STARTTLS)
    collect_exported: false
@@ -421,7 +393,6 @@ profiles::haproxy::certlist::certificates:
  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/vault/certificate.pem

 # additional altnames
@@ -451,4 +422,3 @@ certbot::client::domains:
  - git.unkin.net
  - grafana.unkin.net
  - dashboard.ceph.unkin.net
-  - auth.unkin.net
@@ -1,3 +0,0 @@
---
-# Canary for the puppet-on-k8s migration (roles::base test host).
-profiles::puppet::migrate::enabled: true
@@ -1,7 +1,7 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
 crypto_policies::policy: 'DEFAULT'
-almalinux-base-repo: almalinux
+
 profiles::packages::include:
  network-scripts: {}

@@ -1,2 +0,0 @@
---
-almalinux-base-repo: almalinux-vault
@@ -1,7 +1,7 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
 crypto_policies::policy: 'DEFAULT:SHA1'
-almalinux-base-repo: almalinux
+
 profiles::yum::global::repos:
  crb:
    ensure: present
@@ -23,45 +23,45 @@ profiles::yum::global::repos:
    name: baseos
    descr: baseos repository
    target: /etc/yum.repos.d/baseos.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  extras:
    name: extras
    descr: extras repository
    target: /etc/yum.repos.d/extras.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  appstream:
    name: appstream
    descr: appstream repository
    target: /etc/yum.repos.d/appstream.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  highavailability:
    name: highavailability
    descr: highavailability repository
    target: /etc/yum.repos.d/highavailability.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  crb:
    ensure: absent
    name: crb
    descr: crb repository
    target: /etc/yum.repos.d/crb.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  powertools:
    ensure: absent
    name: powertools
    descr: powertools repository
    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  epel:
    name: epel
@@ -78,20 +78,6 @@ profiles::yum::global::repos:
    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
    gpgcheck: false
    mirrorlist: absent
-  rpm-internal:
-    name: rpm-internal
-    descr: rpm-internal repository
-    target: /etc/yum.repos.d/rpm-internal.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
-    gpgcheck: false
-    mirrorlist: absent
-  rpm-vendor:
-    name: rpm-vendor
-    descr: rpm-vendor repository
-    target: /etc/yum.repos.d/rpm-vendor.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent

  # Additional repositories - default to absent, roles can override with ensure: present
  # FRRouting repositories
@@ -261,8 +247,8 @@ profiles::yum::global::repos:
    name: rpmfusion-free
    descr: rpmfusion-free repository
    target: /etc/yum.repos.d/rpmfusion-free.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    baseurl: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/
+    gpgkey: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
    gpgcheck: 1
    mirrorlist: absent
  rpmfusion-nonfree:
@@ -270,8 +256,8 @@ profiles::yum::global::repos:
    name: rpmfusion-nonfree
    descr: rpmfusion-nonfree repository
    target: /etc/yum.repos.d/rpmfusion-nonfree.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    baseurl: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/
+    gpgkey: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
    gpgcheck: 1
    mirrorlist: absent
  unkin:
@@ -66,9 +66,6 @@ glauth::users:
      - 20025   # jupyterhub_admin
      - 20026   # jupyterhub_user
      - 20027   # grafana_user
-      - 20028   # k8s/au/syd1 operator
-      - 20029   # k8s/au/syd1 admin
-      - 20030   # k8s/au/syd1 root
    loginshell: '/bin/bash'
    homedir: '/home/benvin'
    passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
@@ -226,24 +223,6 @@ glauth::users:
    loginshell: '/bin/bash'
    homedir: '/home/debvin'
    passsha256: 'cdac05ddb02e665d4ea65a974995f38a10236bc158731d92d78f6cde89b294a1'
-  jassol:
-    user_name: 'jassol'
-    givenname: 'Jason'
-    sn: 'Solomon'
-    mail: 'jassol@users.main.unkin.net'
-    uidnumber: 20010
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-      - 20027 # grafana user
-    loginshell: '/bin/bash'
-    homedir: '/home/jassol'
-    passsha256: 'd8e215d3c94b954e1318c9c7243ce72713f2fb1d006037724fe857c1fb7e88e9'

 glauth::services:
  svc_jellyfin:
@@ -388,12 +367,3 @@ glauth::groups:
  grafana_user:
    group_name: 'grafana_user'
    gidnumber: 20027
-  kubernetes_au_syd1_cluster_operator:
-    group_name: 'kubernetes_au_syd1_cluster_operator'
-    gidnumber: 20028
-  kubernetes_au_syd1_cluster_admin:
-    group_name: 'kubernetes_au_syd1_cluster_admin'
-    gidnumber: 20029
-  kubernetes_au_syd1_cluster_root:
-    group_name: 'kubernetes_au_syd1_cluster_root'
-    gidnumber: 20030
@@ -14,9 +14,6 @@ profiles::pki::vault::alt_names:
  - radosgw.service.consul
  - radosgw.query.consul
  - "radosgw.service.%{facts.country}-%{facts.region}.consul"
-  # S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
-  # on the cert so TLS validates for that hostname.
-  - s3.ceph.unkin.net

 # additional repos
 profiles::yum::global::repos:
@@ -29,8 +26,6 @@ profiles::yum::global::repos:
 profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
 profiles::nginx::simpleproxy::nginx_aliases:
  - radosgw.service.au-syd1.consul
-  # nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
-  - s3.ceph.unkin.net
 profiles::nginx::simpleproxy::proxy_port: 7480
 profiles::nginx::simpleproxy::proxy_path: '/'
 nginx::client_max_body_size: 5000M
@@ -6,10 +6,8 @@ hiera_include:
 profiles::dns::resolver::acls:
  acl-main.unkin.net:
    addresses:
-      - 198.18.1.10/32
-      - 198.18.2.160/27
+      - 10.10.8.1/32
      - 198.18.21.160/27
-      - 198.18.2.192/27
      - 198.18.21.192/27
      - 198.18.13.0/24
      - 198.18.14.0/24
@@ -82,14 +82,8 @@ profiles::sql::postgresdb::dbname: gitea
 profiles::sql::postgresdb::dbuser: gitea

 # deploy gitea
-gitea::base_url: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/gitea'
-gitea::install::checksums:
-  1.26.2:
-    linux:
-      amd64: 5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a
-
-gitea::ensure: '1.26.2'
-gitea::checksum: '5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a'
+gitea::ensure: '1.22.4'
+gitea::checksum: 'd549104f55067e6fb156e7ba060c9af488f36e12d5e747db7563fcc99eaf8532'
 gitea::manage_user: false
 gitea::manage_group: false
 gitea::manage_home: false
@@ -5,10 +5,6 @@ hiera_include:
  - incus
  - zfs
  - profiles::ceph::node
-  - profiles::ceph::mon
-  - profiles::ceph::mgr
-  - profiles::ceph::mds
-  - profiles::ceph::osd
  - profiles::ceph::client
  - profiles::ceph::dashboard
  - profiles::storage::cephfsvols
@@ -103,7 +99,7 @@ profiles::yum::global::repos:
 profiles::dns::base::primary_interface: loopback0

 # dashboard/haproxy
-profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback2_ip')}"
+profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback0_ip')}"

 # networking
 systemd::manage_networkd: true
@@ -2,7 +2,6 @@
 hiera_include:
  - profiles::selinux::setenforce
  - profiles::ceph::node
-  - profiles::ceph::osd
  - profiles::ceph::client
  - exporters::frr_exporter
  - frrouting
@@ -11,62 +10,6 @@ hiera_include:
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345
-rke2::manage_registries: true
-rke2::registries:
-  docker.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "dockerhub/$1"
-    disable-default-registry-endpoint: true
-  ghcr.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "ghcr/$1"
-    disable-default-registry-endpoint: true
-  quay.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "quay/$1"
-    disable-default-registry-endpoint: true
-  registry.k8s.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "k8s-registry/$1"
-    disable-default-registry-endpoint: true
-  registry.gitlab.com:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "gitlab/$1"
-    disable-default-registry-endpoint: true
-  docker.elastic.co:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "elastic/$1"
-    disable-default-registry-endpoint: true
-  gcr.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "gcr/$1"
-    disable-default-registry-endpoint: true
-  docker.litellm.ai:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "litellm/$1"
-    disable-default-registry-endpoint: true
-  public.ecr.aws:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "ecr-public/$1"
-    disable-default-registry-endpoint: true
 rke2::config_hash:
  bind-address: "%{hiera('networking_loopback0_ip')}"
  node-ip: "%{hiera('networking_loopback0_ip')}"
@@ -182,17 +125,6 @@ frrouting::ospf_exclude_k8s_enable: true
 frrouting::k8s_cluster_cidr: '10.42.0.0/16'  # RKE2 cluster-cidr (pods)
 frrouting::k8s_service_cidr: '10.43.0.0/16'  # RKE2 service-cidr

-# sysctl recommendations
-sysctl::base::values:
-  net.ipv4.conf.default.rp_filter:
-    value: '0'
-  net.ipv4.conf.all.rp_filter:
-    value: '0'
-  fs.inotify.max_user_watches:
-    value: '524288'
-  fs.inotify.max_user_instances:
-    value: '512'
-
 # add loopback interfaces to ssh list
 ssh::server::options:
  ListenAddress:
@@ -3,6 +3,9 @@
 rke2::node_type: server
 rke2::helm_install: true
 rke2::helm_repos:
+  rancher-stable: https://releases.rancher.com/server-charts/stable
+  purelb: https://gitlab.com/api/v4/projects/20400619/packages/helm/stable
+  jetstack: https://charts.jetstack.io
  harbor: https://helm.goharbor.io
  traefik: https://traefik.github.io/charts
  hashicorp: https://helm.releases.hashicorp.com
@@ -11,7 +11,6 @@ profiles::metrics::grafana::db_name: "%{hiera('profiles::sql::postgresdb::dbname
 profiles::metrics::grafana::db_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
 profiles::metrics::grafana::db_pass: "%{hiera('profiles::sql::postgresdb::dbpass')}"
 profiles::metrics::grafana::pgsql_backend: true
-profiles::metrics::grafana::version: '13.0.2'
 profiles::metrics::grafana::plugins:
  victoriametrics-logs-datasource:
    ensure: present
@@ -16,4 +16,3 @@ certbot::domains:
  - git.unkin.net
  - grafana.unkin.net
  - dashboard.ceph.unkin.net
-  - auth.unkin.net
@@ -26,7 +26,7 @@ profiles::puppet::cobbler_enc::packages:
  - 'requests'
  - 'PyYAML'
 profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
-profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
+profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkin/puppet-r10k.git
 profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
 profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
 profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
@@ -3,6 +3,125 @@ profiles::packages::include:
  createrepo: {}

 profiles::reposync::repos_list:
+  almalinux_9.7_baseos:
+    repository: 'baseos'
+    description: 'AlmaLinux 9.7 BaseOS'
+    osname: 'almalinux'
+    release: '9.7'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/baseos'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.7_appstream:
+    repository: 'appstream'
+    description: 'AlmaLinux 9.7 AppStream'
+    osname: 'almalinux'
+    release: '9.7'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/appstream'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.7_crb:
+    repository: 'crb'
+    description: 'AlmaLinux 9.7 CRB'
+    osname: 'almalinux'
+    release: '9.7'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/crb'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.7_ha:
+    repository: 'ha'
+    description: 'AlmaLinux 9.7 HighAvailability'
+    osname: 'almalinux'
+    release: '9.7'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/highavailability'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.7_extras:
+    repository: 'extras'
+    description: 'AlmaLinux 9.7 extras'
+    osname: 'almalinux'
+    release: '9.7'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/extras'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_baseos:
+    repository: 'baseos'
+    description: 'AlmaLinux 9.6 BaseOS'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/baseos'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_appstream:
+    repository: 'appstream'
+    description: 'AlmaLinux 9.6 AppStream'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/appstream'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_crb:
+    repository: 'crb'
+    description: 'AlmaLinux 9.6 CRB'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/crb'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_ha:
+    repository: 'ha'
+    description: 'AlmaLinux 9.6 HighAvailability'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/highavailability'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_extras:
+    repository: 'extras'
+    description: 'AlmaLinux 9.6 extras'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/extras'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_baseos:
+    repository: 'baseos'
+    description: 'AlmaLinux 9.5 BaseOS'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/baseos'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_appstream:
+    repository: 'appstream'
+    description: 'AlmaLinux 9.5 AppStream'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/appstream'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_crb:
+    repository: 'crb'
+    description: 'AlmaLinux 9.5 CRB'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/crb'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_ha:
+    repository: 'ha'
+    description: 'AlmaLinux 9.5 HighAvailability'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/highavailability'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_extras:
+    repository: 'extras'
+    description: 'AlmaLinux 9.5 extras'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/extras'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  epel_8:
+    repository: 'everything'
+    description: 'EPEL8'
+    osname: 'epel'
+    release: '8'
+    mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-8&arch=x86_64'
+    gpgkey: 'https://epel.mirror.digitalpacific.com.au/RPM-GPG-KEY-EPEL-8'
+  epel_9:
+    repository: 'everything'
+    description: 'EPEL9'
+    osname: 'epel'
+    release: '9'
+    mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-9&arch=x86_64'
+    gpgkey: 'https://epel.mirror.digitalpacific.com.au/RPM-GPG-KEY-EPEL-9'
  docker_stable_el8:
    repository: 'stable'
    description: 'Docker CE Stable EL8'
@@ -17,6 +136,34 @@ profiles::reposync::repos_list:
    release: 'el9'
    baseurl: 'https://download.docker.com/linux/centos/9/x86_64/stable/'
    gpgkey: 'https://download.docker.com/linux/centos/gpg'
+  frr_stable_el8:
+    repository: 'stable'
+    description: 'FRR Stable EL8'
+    osname: 'frr'
+    release: 'el8'
+    baseurl: 'https://rpm.frrouting.org/repo/el8/frr/'
+    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
+  frr_extras_el8:
+    repository: 'extras'
+    description: 'FRR Extras EL8'
+    osname: 'frr'
+    release: 'el8'
+    baseurl: 'https://rpm.frrouting.org/repo/el8/extras/'
+    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
+  frr_stable_el9:
+    repository: 'stable'
+    description: 'FRR Stable EL9'
+    osname: 'frr'
+    release: 'el9'
+    baseurl: 'https://rpm.frrouting.org/repo/el9/frr/'
+    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
+  frr_extras_el9:
+    repository: 'extras'
+    description: 'FRR Extras el9'
+    osname: 'frr'
+    release: 'el9'
+    baseurl: 'https://rpm.frrouting.org/repo/el9/extras/'
+    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
  k8s_1.32:
    repository: '1.32'
    description: 'Kubernetes 1.32'
@@ -31,6 +178,62 @@ profiles::reposync::repos_list:
    release: '1.33'
    baseurl: 'https://pkgs.k8s.io/core:/stable:/v1.33/rpm/'
    gpgkey: 'https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key'
+  mariadb_11_8_el8:
+    repository: 'el8'
+    description: 'MariaDB 11.8'
+    osname: 'mariadb'
+    release: '11.8'
+    baseurl: 'http://mariadb.mirror.digitalpacific.com.au/yum/11.8/rhel8-amd64/'
+    gpgkey: 'https://mariadb.mirror.digitalpacific.com.au/yum/RPM-GPG-KEY-MariaDB'
+  mariadb_11_8_el9:
+    repository: 'el9'
+    description: 'MariaDB 11.8'
+    osname: 'mariadb'
+    release: '11.8'
+    baseurl: 'http://mariadb.mirror.digitalpacific.com.au/yum/11.8/rhel9-amd64/'
+    gpgkey: 'https://mariadb.mirror.digitalpacific.com.au/yum/RPM-GPG-KEY-MariaDB'
+  openvox7_el8:
+    repository: '8'
+    description: 'openvox 7 EL8'
+    osname: 'openvox7'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox7/el/8/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox7_el9:
+    repository: '9'
+    description: 'openvox 7 EL9'
+    osname: 'openvox7'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox7/el/9/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox7_el10:
+    repository: '10'
+    description: 'openvox 7 EL10'
+    osname: 'openvox7'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox7/el/10/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox8_el8:
+    repository: '8'
+    description: 'openvox 8 EL8'
+    osname: 'openvox8'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox8/el/8/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox8_el9:
+    repository: '9'
+    description: 'openvox 8 EL9'
+    osname: 'openvox8'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox8/el/9/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox8_el10:
+    repository: '10'
+    description: 'openvox 8 EL10'
+    osname: 'openvox8'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox8/el/10/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
  puppet7_el8:
    repository: '8'
    description: 'Puppet 7 EL8'
@@ -59,6 +262,76 @@ profiles::reposync::repos_list:
    release: 'el'
    baseurl: 'https://yum.puppet.com/puppet8/el/9/x86_64/'
    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
+  postgresql_rhel8_common:
+    repository: 'common'
+    description: 'PostgreSQL Common RHEL 8'
+    osname: 'postgresql'
+    release: 'rhel8'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-8-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel9_common:
+    repository: 'common'
+    description: 'PostgreSQL Common RHEL 9'
+    osname: 'postgresql'
+    release: 'rhel9'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-9-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel8_15:
+    repository: '15'
+    description: 'PostgreSQL 15 RHEL 8'
+    osname: 'postgresql'
+    release: 'rhel8'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/15/redhat/rhel-8-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel9_15:
+    repository: '15'
+    description: 'PostgreSQL 15 RHEL 9'
+    osname: 'postgresql'
+    release: 'rhel9'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/15/redhat/rhel-9-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel8_16:
+    repository: '16'
+    description: 'PostgreSQL 16 RHEL 8'
+    osname: 'postgresql'
+    release: 'rhel8'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel9_16:
+    repository: '16'
+    description: 'PostgreSQL 16 RHEL 9'
+    osname: 'postgresql'
+    release: 'rhel9'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-9-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel8_17:
+    repository: '17'
+    description: 'PostgreSQL 17 RHEL 8'
+    osname: 'postgresql'
+    release: 'rhel8'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-8-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel9_17:
+    repository: '17'
+    description: 'PostgreSQL 17 RHEL 9'
+    osname: 'postgresql'
+    release: 'rhel9'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-9-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  rke2_common_el9:
+    repository: 'common'
+    description: 'RKE2 common RHEL 9'
+    osname: 'rke2'
+    release: "rhel9"
+    baseurl: "https://rpm.rancher.io/rke2/latest/common/centos/9/noarch"
+    gpgkey: "https://rpm.rancher.io/public.key"
+  rke2_1_33_el9:
+    repository: '1.33'
+    description: 'RKE2 1.33 RHEL 9'
+    osname: 'rke2'
+    release: "rhel9"
+    baseurl: "https://rpm.rancher.io/rke2/latest/1.33/centos/9/x86_64"
+    gpgkey: "https://rpm.rancher.io/public.key"
  zfs_dkms_rhel8:
    repository: 'dkms'
    description: 'ZFS DKMS RHEL 8'
@@ -29,7 +29,6 @@ profiles::consul::server::acl:
 profiles::pki::vault::alt_names:
  - consul.main.unkin.net
  - consul.service.consul
-  - "consul.service.%{facts.country}-%{facts.region}.consul"
  - consul

 # manage a simple nginx reverse proxy
@@ -39,7 +38,6 @@ profiles::nginx::simpleproxy::nginx_aliases:
  - consul.main.unkin.net
 profiles::nginx::simpleproxy::proxy_port: 8500
 profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 512M

 # consul
 profiles::consul::client::node_rules:
@@ -2,12 +2,10 @@
 profiles::vault::server::members_role: roles::infra::storage::vault
 profiles::vault::server::members_lookup: true
 profiles::vault::server::data_dir: /data/vault
-profiles::vault::server::plugin_dir: /opt/openbao-plugins
 profiles::vault::server::manage_storage_dir: true
 profiles::vault::server::tls_disable: false
-profiles::vault::server::package_name: openbao
-profiles::vault::server::package_ensure: 2.4.4
-profiles::vault::server::disable_openbao: false
+vault::package_name: openbao
+vault::package_ensure: latest

 # additional altnames
 profiles::pki::vault::alt_names:
@@ -25,16 +23,3 @@ profiles::nginx::simpleproxy::proxy_scheme: 'http'
 profiles::nginx::simpleproxy::proxy_host: '127.0.0.1'
 profiles::nginx::simpleproxy::proxy_port: 8200
 profiles::nginx::simpleproxy::proxy_path: '/'
-
-profiles::packages::include:
-  # openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
-  openbao-plugins: {}
-  # Secrets plugins pinned to the exact version whose binary matches the sha256
-  # registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
-  # on upgrade, or OpenBao refuses to launch the plugin after a restart.
-  openbao-plugin-secrets-litellm:
-    ensure: '0.1.1'
-  openbao-plugin-secrets-gpg:
-    ensure: '0.1.0'
-  openbao-plugin-secrets-rancher:
-    ensure: '0.1.1'
@@ -28,8 +28,8 @@ class externaldns::master inherits externaldns {
      dynamic         => true,
      allow_updates   => ['key externaldns-key'],
      allow_transfers => empty($slave_ips) ? {
-        true  => ['key externaldns-key'],
-        false => ['key externaldns-key','dns-slaves'],
+        true  => [],
+        false => ['dns-slaves'],
      },
      ns_notify       => !empty($slave_ips),
      also_notify     => $slave_ips,
@@ -22,12 +22,7 @@ class incus::cluster (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-
-require 'facter'
-
-# Detects active ceph service instances via systemctl and exposes facts
-# for use in ceph service management profiles.
-# rubocop:disable Style/ClassAndModuleChildren
-module Unkin
-  module Ceph
-    # Detects active ceph service instances via systemctl and exposes Facter facts.
-    module Utils
-      TYPES = %w[mon mgr mds osd].freeze
-
-      def self.services
-        output = Facter::Core::Execution.execute(
-          'systemctl list-units "ceph*" --no-legend --plain --all 2>/dev/null',
-          on_fail: ''
-        )
-        parse_units(output)
-      end
-
-      def self.parse_units(output)
-        result = TYPES.each_with_object({}) { |type, hash| hash[type] = [] }
-        output.each_line do |line|
-          unit = line.split.first
-          next unless unit
-
-          match_unit(result, unit)
-        end
-        result
-      end
-
-      def self.match_unit(result, unit)
-        TYPES.each do |type|
-          match = unit.match(/\Aceph-#{type}@(.+)\.service\z/)
-          result[type] << "ceph-#{type}@#{match[1]}" if match
-        end
-      end
-
-      TYPES.each do |type|
-        define_singleton_method(:"#{type}?") { !services[type].empty? }
-      end
-    end
-  end
-end
-# rubocop:enable Style/ClassAndModuleChildren
-
-Facter.add('ceph_services') do
-  setcode { Unkin::Ceph::Utils.services }
-end
-
-Unkin::Ceph::Utils::TYPES.each do |type|
-  Facter.add("is_ceph_#{type}") do
-    setcode { Unkin::Ceph::Utils.public_send(:"#{type}?") }
-  end
-end
@@ -1,88 +0,0 @@
-# frozen_string_literal: true
-
-# lib/facter/dns_records.rb
-#
-# Reports this host's expected DNS records (assembled by profiles::dns::updater
-# into its records file) versus what is currently deployed on the authoritative
-# server, so puppet can detect drift and re-apply.
-#
-# Structured value:
-#   { server, count, expected => [{zone,fqdn,type,ttl,value}], in_sync,
-#     drift => [{...,deployed => [...]}] }
-
-# Helpers for the dns_records fact.
-module DnsRecordsFact
-  RECORDS_FILE = '/var/lib/dns-updater/records'
-  SERVER_FILE  = '/var/lib/dns-updater/server'
-
-  module_function
-
-  # normalise a value for comparison: strip, drop trailing dot, downcase
-  def norm(value)
-    value.to_s.strip.chomp('.').downcase
-  end
-
-  def server
-    File.exist?(SERVER_FILE) ? File.read(SERVER_FILE).strip : nil
-  end
-
-  # a name relative to a zone (or @) as a fully-qualified name
-  def to_fqdn(name, zone)
-    return "#{zone}." if name.to_s.empty? || name == '@'
-
-    "#{name}.#{zone}."
-  end
-
-  # parse one "zone|name|type|ttl|value" line into a record hash (nil to skip)
-  def parse_line(line)
-    line = line.strip
-    return nil if line.empty? || line.start_with?('#')
-
-    zone, name, type, ttl, value = line.split('|', 5)
-    return nil unless zone && type && value
-
-    { 'zone' => zone, 'fqdn' => to_fqdn(name, zone), 'type' => type, 'ttl' => ttl, 'value' => value }
-  end
-
-  # parse the records file into record hashes
-  def expected
-    return [] unless File.exist?(RECORDS_FILE)
-
-    File.readlines(RECORDS_FILE).filter_map { |line| parse_line(line) }
-  end
-
-  # the values currently deployed for a record, per the authoritative server
-  def deployed(record, srv)
-    cmd = ['dig', '+short', '+time=2', '+tries=1']
-    cmd << "@#{srv}" if srv && !srv.empty?
-    cmd += [record['fqdn'], record['type']]
-    out = Facter::Core::Execution.execute(cmd.join(' '), on_fail: '')
-    out.to_s.split("\n").map { |line| norm(line) }.reject(&:empty?)
-  end
-
-  def report
-    srv = server
-    exp = expected
-    drift = exp.filter_map do |record|
-      dep = deployed(record, srv)
-      record.merge('deployed' => dep) unless dep.include?(norm(record['value']))
-    end
-    { 'server' => srv, 'count' => exp.length, 'expected' => exp, 'in_sync' => drift.empty?, 'drift' => drift }
-  end
-end
-
-Facter.add(:dns_records) do
-  confine kernel: 'Linux'
-  setcode do
-    File.exist?(DnsRecordsFact::RECORDS_FILE) ? DnsRecordsFact.report : nil
-  end
-end
-
-# Convenience boolean for `if $facts['dns_records_insync']` guards.
-Facter.add(:dns_records_insync) do
-  confine kernel: 'Linux'
-  setcode do
-    v = Facter.value(:dns_records)
-    v.nil? ? nil : v['in_sync']
-  end
-end
@@ -20,12 +20,7 @@ class redisha::redis (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${redisha_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -23,12 +23,7 @@ class redisha::sentinel (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${redisha_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -0,0 +1,23 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    kubernetes.io/ingress.class: nginx
+spec:
+  tls:
+    - hosts: [rancher.main.unkin.net]
+      secretName: tls-rancher
+  rules:
+    - host: rancher.main.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80
@@ -0,0 +1,45 @@
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  name: common
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
+---
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - subnet: 198.18.199.0/24
+        pool: 198.18.199.0/24
+        aggregation: /32
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  name: common
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - subnet: 198.18.200.0/24
+        pool: 198.18.200.0/24
+        aggregation: /32
@@ -7,8 +7,6 @@ class rke2::config (
  Stdlib::Fqdn            $bootstrap_node = $rke2::bootstrap_node,
  String                  $node_token = $rke2::node_token,
  Array[String[1]]        $extra_config_files = $rke2::extra_config_files,
-  Boolean                 $manage_registries = $rke2::manage_registries,
-  Hash                    $registries = $rke2::registries,
 ){

  # if its not the bootstrap node, add join path to config
@@ -30,24 +28,6 @@ class rke2::config (
    $config = $config_hash
  }

-  if $manage_registries {
-    file { '/etc/rancher/rke2/registries.yaml':
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => epp('rke2/registries.yaml.epp', { registries => $registries }),
-      require => Package["rke2-${node_type}"],
-      notify  => Service["rke2-${node_type}"],
-    }
-  }else{
-    file { '/etc/rancher/rke2/registries.yaml':
-      ensure  => absent,
-      require => Package["rke2-${node_type}"],
-      notify  => Service["rke2-${node_type}"],
-    }
-  }
-
  # create the config file
  file { $config_file:
    ensure  => file,
@@ -88,6 +68,30 @@ class rke2::config (
  # on the controller nodes only
  if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {

+    # wait for purelb helm to setup namespace
+    if 'purelb' in $facts['k8s_namespaces'] {
+      file {'/var/lib/rancher/rke2/server/manifests/purelb-config.yaml':
+        ensure  => file,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0644',
+        source  => 'puppet:///modules/rke2/purelb-config.yaml',
+        require => Service['rke2-server'],
+      }
+    }
+
+    # wait for rancher helm to setup namespace
+    if 'cattle-system' in $facts['k8s_namespaces'] {
+      file {'/var/lib/rancher/rke2/server/manifests/ingress-route-rancher.yaml':
+        ensure  => file,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0644',
+        source  => 'puppet:///modules/rke2/ingress-route-rancher.yaml',
+        require => Service['rke2-server'],
+      }
+    }
+
    # manage extra config config (these are not dependent on helm)
    $extra_config_files.each |$file| {

@@ -38,6 +38,44 @@ class rke2::helm (
          }
        }
      }
+
+      # install specific helm charts to bootstrap environment
+      $plb_cmd = 'helm install purelb purelb/purelb \
+                  --create-namespace \
+                  --namespace=purelb \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_purelb':
+        command     => $plb_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n purelb | grep -q ^purelb',
+      }
+
+      $cm_cmd = 'helm install cert-manager jetstack/cert-manager \
+                  --namespace cert-manager \
+                  --create-namespace \
+                  --set crds.enabled=true \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_cert_manager':
+        command     => $cm_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n cert-manager | grep -q ^cert-manager',
+      }
+
+      $r_cmd = 'helm install rancher rancher-stable/rancher \
+                  --namespace cattle-system \
+                  --create-namespace \
+                  --set hostname=rancher.main.unkin.net \
+                  --set bootstrapPassword=admin \
+                  --set ingress.tls.source=secret \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_rancher':
+        command     => $r_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n cattle-system | grep -q ^rancher',
+      }
    }
  }
 }
@@ -12,8 +12,6 @@ class rke2 (
  Hash                    $helm_repos = $rke2::params::helm_repos,
  Array[String[1]]        $extra_config_files = $rke2::params::extra_config_files,
  Stdlib::HTTPUrl         $container_archive_source = $rke2::params::container_archive_source,
-  Boolean                 $manage_registries = $rke2::params::manage_registries,
-  Hash                    $registries = $rke2::params::registries,
 ) inherits rke2::params {

  include rke2::install
@@ -1,7 +1,7 @@
 # rke2 params
 class rke2::params (
  Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.4',
+  String                  $rke2_version = '1.33.7',
  String                  $rke2_release = 'rke2r1',
  Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
  Hash                    $config_hash = {},
@@ -12,6 +12,4 @@ class rke2::params (
  Hash                    $helm_repos = {},
  Array[String[1]]        $extra_config_files = [],
  Stdlib::HTTPUrl         $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
-  Boolean                 $manage_registries = false,
-  Hash                    $registries = {},
 ) {}
@@ -1,20 +0,0 @@
-<%- | Hash $registries | -%>
---
-# DO NOT MODIFY - MANAGED BY PUPPET
-mirrors:
-<%- $registries.each |$registry, $config| { -%>
-  <%= $registry %>:
-    endpoint:
-<%- $config['endpoint'].each |$ep| { -%>
-      - "<%= $ep %>"
-<%- } -%>
-<%- if $config['rewrite'] { -%>
-    rewrite:
-<%- $config['rewrite'].each |$pattern, $replacement| { -%>
-      "<%= $pattern %>": "<%= $replacement %>"
-<%- } -%>
-<%- } -%>
-<%- if $config['disable-default-registry-endpoint'] { -%>
-    disable-default-registry-endpoint: true
-<%- } -%>
-<%- } -%>
@@ -167,13 +167,7 @@ class stalwart (

  # Query cluster members for validation
  $cluster_query = "enc_role='${cluster_role}' and country='${facts['country']}' and region='${facts['region']}'"
-  $cluster_members_raw = puppetdb_query(
-    "facts[certname] {
-      name = 'enc_role' and value = '${cluster_role}' and
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-    }"
-  ).map |$fact| { $fact['certname'] }
+  $cluster_members_raw = query_nodes($cluster_query, 'networking.fqdn')
  $cluster_members = $cluster_members_raw ? {
    undef   => [],
    default => $cluster_members_raw,
@@ -186,20 +180,7 @@ class stalwart (

  # Query HAProxy nodes for proxy trusted networks
  $haproxy_query = "enc_role='${haproxy_role}' and country='${facts['country']}' and region='${facts['region']}'"
-  $haproxy_members_raw = puppetdb_query(
-    "facts[certname,value] {
-      name = 'networking' and
-      certname in facts[certname] {
-        name = 'enc_role' and value = '${haproxy_role}'
-      } and
-      certname in facts[certname] {
-        name = 'country' and value = '${facts['country']}'
-      } and
-      certname in facts[certname] {
-        name = 'region' and value = '${facts['region']}'
-      }
-    }"
-  ).map |$fact| { $fact['value']['ip'] }
+  $haproxy_members_raw = query_nodes($haproxy_query, 'networking.ip')
  $haproxy_ips = $haproxy_members_raw ? {
    undef   => [],
    default => sort($haproxy_members_raw),
@@ -12,9 +12,6 @@ class profiles::base () {
    # manage the puppet agent
    include profiles::puppet::agent
    include profiles::puppet::client
-    # k8s migration switch; ships disabled, flip its ::enabled boolean in
-    # hiera (node/role/common) to repoint a target onto puppet-on-k8s.
-    include profiles::puppet::migrate

    # include the base profiles
    include profiles::base::repos
@@ -1,13 +0,0 @@
-class profiles::ceph::mds (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mds'] {
-    $facts['ceph_services']['mds'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}
@@ -1,13 +0,0 @@
-class profiles::ceph::mgr (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mgr'] {
-    $facts['ceph_services']['mgr'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}
@@ -1,13 +0,0 @@
-class profiles::ceph::mon (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mon'] {
-    $facts['ceph_services']['mon'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}
@@ -1,13 +0,0 @@
-class profiles::ceph::osd (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_osd'] {
-    $facts['ceph_services']['osd'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}
@@ -68,10 +68,7 @@ class profiles::cobbler::config {
  # export cnames for cobbler
  if $is_cobbler_master {
    profiles::dns::record { "${::facts['networking']['fqdn']}_${service_cname}_CNAME":
-      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
-      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
-      # ("ausyd1nxvm2098.") and dead-ends in NXDOMAIN.
-      value  => "${::facts['networking']['fqdn']}.",
+      value  => $::facts['networking']['hostname'],
      type   => 'CNAME',
      record => "${service_cname}.",
      zone   => $::facts['networking']['domain'],
@@ -28,12 +28,7 @@ class profiles::consul::client (
      }

      # if it is, find hosts, sort them so they dont cause changes every run
-      $servers_array = sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${members_role}' and
-          certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] })
+      $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))

    # else use provided array from params
    }else{
@@ -65,22 +65,12 @@ class profiles::consul::server (
      }

      # if it is, find hosts, sort them so they dont cause changes every run
-      $servers_array = sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${members_role}' and
-          certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] })
+      $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))

      if $join_remote_regions {
        # get all nodes in the members_role for each other region
        $region_to_servers = $remote_regions.reduce({}) |$memo, $region| {
-          $servers = sort(puppetdb_query(
-            "facts[certname] {
-              name = 'enc_role' and value = '${members_role}' and
-              certname in facts[certname] { name = 'region' and value = '${region}' }
-            }"
-          ).map |$fact| { $fact['certname'] })
+          $servers = sort(query_nodes("enc_role='${members_role}' and region='${region}'", 'networking.fqdn'))
          $memo + { $region => $servers }
        }

@@ -11,38 +11,16 @@ class profiles::dns::base (
  Optional[String] $ns_role = undef,
 ){

-  # install bind_utils (provides nsupdate)
+  # install bind_utils
  include bind::updater

-  # assemble the host's DNS records and nsupdate them to the authoritative server
-  include profiles::dns::updater
-
  # if ns_role is set, find all hosts matching that enc_role
  $nameserver_array = $ns_role ? {
    undef   => $nameservers,
    default => $use_ns ? {
-      'all'     => puppetdb_query(
-        "facts[certname,value] {
-          name = 'networking' and
-          certname in nodes[certname] { facts.enc_role = '${ns_role}' }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
-      'region'  => puppetdb_query(
-        "facts[certname,value] {
-          name = 'networking' and
-          certname in nodes[certname] {
-            facts.enc_role = '${ns_role}' and facts.region = '${facts['region']}'
-          }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
-      'country' => puppetdb_query(
-        "facts[certname,value] {
-          name = 'networking' and
-          certname in nodes[certname] {
-            facts.enc_role = '${ns_role}' and facts.country = '${facts['country']}'
-          }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
+      'all'     => query_nodes("enc_role='${ns_role}'", 'networking.ip'),
+      'region'  => query_nodes("enc_role='${ns_role}' and region=${facts['region']}", 'networking.ip'),
+      'country' => query_nodes("enc_role='${ns_role}' and country=${facts['country']}", 'networking.ip'),
    }
  }

@@ -20,21 +20,9 @@ class profiles::dns::master (
  $nameservers_array = $ns_role ? {
    undef   => [$facts['networking']['fqdn']],
    default => $use_ns ? {
-      'all'     => sort(puppetdb_query(
-        "facts[certname] { name = 'enc_role' and value = '${ns_role}' }"
-      ).map |$fact| { $fact['certname'] }),
-      'region'  => sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${ns_role}' and
-          certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] }),
-      'country' => sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${ns_role}' and
-          certname in facts[certname] { name = 'country' and value = '${facts['country']}' }
-        }"
-      ).map |$fact| { $fact['certname'] }),
+      'all'     => sort(query_nodes("enc_role='${ns_role}'", 'networking.fqdn')),
+      'region'  => sort(query_nodes("enc_role='${ns_role}' and region=${facts['region']}", 'networking.fqdn')),
+      'country' => sort(query_nodes("enc_role='${ns_role}' and country=${facts['country']}", 'networking.fqdn')),
    }
  }

@@ -44,9 +32,7 @@ class profiles::dns::master (
      $facts['networking']['fqdn'] => $facts['networking']['ip']
    },
    default => $nameservers_array.reduce({}) |$acc, $fqdn| {
-      $result = puppetdb_query(
-        "facts[certname,value] { name = 'networking' and certname = '${fqdn}' }"
-      ).map |$fact| { $fact['value']['ip'] }
+      $result = query_nodes("networking.fqdn='${fqdn}'", 'networking.ip')
      $ip = $result[0]
      $acc + { "${fqdn}." => $ip }
    }
@@ -1,10 +1,4 @@
-# profiles::dns::record
-#
-# Declares a DNS record for this host. Publishes it via either or both methods,
-# controlled by profiles::dns::updater's toggles (both on during cutover):
-#   - nsupdate: a local concat fragment consumed by profiles::dns::updater,
-#     which nsupdates it to the authoritative server.
-#   - export: the legacy @@concat::fragment exported to the puppet DNS master.
+# defines the base record that will be exported
 define profiles::dns::record (
  String  $record,
  Enum[
@@ -19,26 +13,11 @@ define profiles::dns::record (
  String  $value,
  String  $zone,
  Integer $order,
-  Integer $ttl = 300,
+  Stdlib::AbsolutePath $basedir = lookup('profiles::dns::master::basedir'),
 ) {
-  include profiles::dns::updater
-
-  # new: local records file consumed by the nsupdate service
-  if $profiles::dns::updater::manage_nsupdate {
-    # zone|name|type|ttl|value  (parsed by the dns-update script)
-    concat::fragment { "dns-record-${name}":
-      target  => $profiles::dns::updater::records_file,
-      content => "${zone}|${record}|${type}|${ttl}|${value}\n",
-      order   => sprintf('%03d', $order),
-    }
-  }
-
-  # legacy: export the fragment to the puppet DNS master
-  if $profiles::dns::updater::manage_export {
  @@concat::fragment { "${zone}_${name}":
-      target  => "${profiles::dns::updater::master_basedir}/${zone}.conf",
+    target  => "${basedir}/${zone}.conf",
    content => "${record} IN ${type} ${value}\n",
    order   => $order,
  }
 }
-}
@@ -1,173 +0,0 @@
-# profiles::dns::updater
-#
-# Publishes this host's DNS records. Two methods, independently toggled so both
-# can run during the k8s cutover (profiles::dns::record honours the same flags):
-#
-#   - nsupdate ($manage_nsupdate): assemble the records into a local file and
-#     nsupdate them to the k8s authoritative write endpoint via a systemd .path
-#     unit that watches the file. Inert until $key_secret (TSIG) is set.
-#   - export ($manage_export): the legacy exported-resources flow to the puppet
-#     DNS master. Kept during cutover; disable once k8s is authoritative.
-#
-# nsupdate comes from bind-utils (installed via bind::updater in
-# profiles::dns::base).
-class profiles::dns::updater (
-  Boolean                     $manage_nsupdate = true,
-  Boolean                     $manage_export   = true,
-  String                      $server          = '198.18.200.9',
-  String                      $key_name        = 'client-update',
-  String                      $key_algorithm   = 'hmac-sha256',
-  Optional[Sensitive[String]] $key_secret      = undef,
-  Integer                     $default_ttl     = 300,
-  Stdlib::AbsolutePath        $records_file    = '/var/lib/dns-updater/records',
-  Stdlib::AbsolutePath        $state_dir       = '/var/lib/dns-updater',
-  Stdlib::AbsolutePath        $config_dir      = '/etc/dns-updater',
-  Stdlib::AbsolutePath        $master_basedir  = lookup('profiles::dns::master::basedir'),
-  # dns-updater daemon (replaces the dns-update shell script). 'latest' so hosts
-  # pick up new releases (e.g. the record filter); rpm-internal metadata_expire
-  # is 1h so this does not thrash.
-  String                      $package_ensure   = 'latest',
-  Stdlib::AbsolutePath        $api_socket       = '/run/dns-updater/api.sock',
-  String                      $resync           = '10m',
-  Enum['debug', 'info', 'warn', 'error'] $log_level = 'info',
-  Boolean                     $watch_interfaces = true,
-  # Never publish records whose address falls in these ranges: the k8s pod CIDR
-  # (10.42.0.0/16) and service CIDR (10.43.0.0/16), the LB VIP pool
-  # (198.18.200.0/24) and 198.18.199.0/24. Keeps kube-lb0/flannel/etc. out of
-  # the authoritative zones and stops NOTAUTH updates for zones we do not host.
-  Array[String]               $deny_ranges     = ['198.18.199.0/24', '198.18.200.0/24', '10.42.0.0/16', '10.43.0.0/16'],
-  Array[String]               $allow_ranges    = [],
-  Array[String]               $deny_domains    = [],
-  Array[String]               $allow_domains   = [],
-) {
-
-  $state_file  = "${state_dir}/applied"
-  $server_file = "${state_dir}/server"
-  $key_file    = "${config_dir}/key"
-
-  if $manage_nsupdate {
-
-    file { $state_dir:
-      ensure => directory,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0755',
-    }
-
-    # Server address, read by the dns_records fact for drift detection.
-    file { $server_file:
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => "${server}\n",
-      require => File[$state_dir],
-    }
-
-    # Records file, assembled from profiles::dns::record fragments.
-    concat { $records_file:
-      ensure         => present,
-      owner          => 'root',
-      group          => 'root',
-      mode           => '0644',
-      ensure_newline => true,
-      warn           => false,
-      require        => File[$state_dir],
-    }
-
-    concat::fragment { 'dns-update-header':
-      target  => $records_file,
-      content => "# Managed by puppet (profiles::dns::record): zone|name|type|ttl|value\n",
-      order   => '00',
-    }
-
-    if $key_secret =~ Undef {
-      notify { 'dns-updater-inert':
-        message  => 'profiles::dns::updater: key_secret unset; records assembled but not applied.',
-        loglevel => 'info',
-      }
-    } else {
-      file { $config_dir:
-        ensure => directory,
-        owner  => 'root',
-        group  => 'root',
-        mode   => '0700',
-      }
-
-      file { $key_file:
-        ensure    => file,
-        owner     => 'root',
-        group     => 'root',
-        mode      => '0600',
-        show_diff => false,
-        content   => Sensitive(epp('profiles/dns/tsig-key.epp', {
-            'name'      => $key_name,
-            'algorithm' => $key_algorithm,
-            'secret'    => $key_secret.unwrap,
-        })),
-      }
-
-      # dns-updater daemon: watches the records file (inotify) and network
-      # interfaces, pushes TSIG-signed RFC2136 updates to $server natively.
-      package { 'dns-updater':
-        ensure => $package_ensure,
-      }
-
-      $deny_ranges_str   = join($deny_ranges, ',')
-      $allow_ranges_str  = join($allow_ranges, ',')
-      $deny_domains_str  = join($deny_domains, ',')
-      $allow_domains_str = join($allow_domains, ',')
-
-      $env_content = @("ENV")
-        # Managed by puppet (profiles::dns::updater).
-        DNS_UPDATER_SERVER=${server}
-        DNS_UPDATER_KEY_FILE=${key_file}
-        DNS_UPDATER_RECORDS_FILE=${records_file}
-        DNS_UPDATER_STATE_FILE=${state_file}
-        DNS_UPDATER_API=${api_socket}
-        DNS_UPDATER_RESYNC=${resync}
-        DNS_UPDATER_WATCH_INTERFACES=${watch_interfaces}
-        DNS_UPDATER_LOG_LEVEL=${log_level}
-        DNS_UPDATER_DENY_RANGES=${deny_ranges_str}
-        DNS_UPDATER_ALLOW_RANGES=${allow_ranges_str}
-        DNS_UPDATER_DENY_DOMAINS=${deny_domains_str}
-        DNS_UPDATER_ALLOW_DOMAINS=${allow_domains_str}
-        | ENV
-
-      file { "${config_dir}/env":
-        ensure  => file,
-        owner   => 'root',
-        group   => 'root',
-        mode    => '0644',
-        content => $env_content,
-        require => [File[$config_dir], Package['dns-updater']],
-      }
-
-      # Restart only on config/key change; records-file changes are picked up by
-      # the daemon's own inotify watch, so no service churn on record edits.
-      service { 'dns-updater':
-        ensure    => running,
-        enable    => true,
-        subscribe => [File["${config_dir}/env"], File[$key_file]],
-        require   => [Package['dns-updater'], Concat[$records_file], File[$key_file]],
-      }
-
-      # Retire the previous shell-based mechanism.
-      file { '/usr/local/bin/dns-update':
-        ensure => absent,
-      }
-
-      systemd::unit_file { 'dns-update.service':
-        ensure => absent,
-        active => false,
-        enable => false,
-      }
-
-      systemd::unit_file { 'dns-update.path':
-        ensure => absent,
-        active => false,
-        enable => false,
-      }
-    }
-  }
-}
@@ -18,12 +18,7 @@ class profiles::etcd::node (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -36,7 +31,7 @@ class profiles::etcd::node (
    $initial_cluster = $servers_array.map |$fqdn| {

      # lookup the ip address for the current fqdn
-      $ip = puppetdb_query("facts[certname,value] { name = 'networking' and certname = '${fqdn}' }").map |$fact| { $fact['value']['ip'] }[0]
+      $ip = query_nodes("networking.fqdn='${fqdn}'", 'networking.ip')[0]

      # construct the string for this server
      "${fqdn}=https://${ip}:${peer_port}"
@@ -21,10 +21,7 @@ class profiles::haproxy::dns (
    $parts = split($cname, '\.')
    $domain = join($parts[1, $parts.length], '.')
    profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
-      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
-      # ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
-      value  => "${location_environment}-halb.${facts['networking']['domain']}.",
+      value  => "${location_environment}-halb",
      type   => 'CNAME',
      record => "${cname}.",
      zone   => $domain,
@@ -33,14 +30,13 @@ class profiles::haproxy::dns (
  }

  # if it is, find hosts, sort them so they dont cause changes every run
-  $servers_array = sort(puppetdb_query(
-    "facts[certname] {
-      name = 'enc_role' and value = '${facts['enc_role']}' and
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' } and
-      certname in facts[certname] { name = 'environment' and value = '${facts['environment']}' }
-    }"
-  ).map |$fact| { $fact['certname'] })
+  $servers_array = sort(query_nodes(
+    "enc_role='${facts['enc_role']}' and
+      country='${facts['country']}' and
+      region='${facts['region']}' and
+      environment='${facts['environment']}'",
+    'networking.fqdn'
+  ))

  # give enough time for a few hosts to be provisioned
  if length($servers_array) >= 3 {
@@ -61,10 +57,7 @@ class profiles::haproxy::dns (
        $parts = split($cname, '\.')
        $domain = join($parts[1, $parts.length], '.')
        profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-          # Fully-qualified target (trailing dot); see the note on the non-vrrp
-          # cnames above. The matching A record is published in main.unkin.net
-          # and unkin.net just above.
-          value  => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
+          value  => "${location_environment}-halb-vrrp",
          type   => 'CNAME',
          record => "${cname}.",
          zone   => $domain,
@@ -1,7 +1,6 @@
 # profiles::metrics::grafana
 class profiles::metrics::grafana (
  String    $ldap_bind_pass,
-  String    $version        = 'installed',
  Stdlib::Port $http_port   = 8080,
  String    $app_mode       = 'production',
  Boolean   $allow_sign_up  = false,
@@ -108,7 +107,6 @@ class profiles::metrics::grafana (

  # deploy grafana
  class { 'grafana':
-    version  => $version,
    cfg      => $cfg,
    ldap_cfg => $ldap_cfg,
    plugins  => $plugins,
@@ -98,15 +98,8 @@ class profiles::minio::server (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    #$servers_array = sort(puppetdb_query(
-    #  "facts[certname] { name = 'enc_role' and value = '${minio_members_role}' }"
-    #).map |$fact| { $fact['certname'] })
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${minio_members_role}' and
-        certname in facts[certname] { name = 'minio_region' and value = '${minio_region}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    #$servers_array = sort(query_nodes("enc_role='${minio_members_role}'", 'networking.fqdn'))
+    $servers_array = sort(query_nodes("enc_role='${minio_members_role}' and minio_region='${minio_region}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -26,21 +26,9 @@ class profiles::ntp::client (
    $ntpserver_array = $ntp_role ? {
      undef   => $peers,
      default => $use_ntp ? {
-        'all'     => puppetdb_query(
-          "facts[certname] { name = 'enc_role' and value = '${ntp_role}' }"
-        ).map |$fact| { $fact['certname'] },
-        'region'  => puppetdb_query(
-          "facts[certname] {
-            name = 'enc_role' and value = '${ntp_role}' and
-            certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-          }"
-        ).map |$fact| { $fact['certname'] },
-        'country' => puppetdb_query(
-          "facts[certname] {
-            name = 'enc_role' and value = '${ntp_role}' and
-            certname in facts[certname] { name = 'country' and value = '${facts['country']}' }
-          }"
-        ).map |$fact| { $fact['certname'] },
+        'all'     => query_nodes("enc_role='${ntp_role}'", 'networking.fqdn'),
+        'region'  => query_nodes("enc_role='${ntp_role}' and region=${facts['region']}", 'networking.fqdn'),
+        'country' => query_nodes("enc_role='${ntp_role}' and country=${facts['country']}", 'networking.fqdn'),
      }
    }

@@ -24,13 +24,10 @@ class profiles::proxmox::clusterinit {
    }
  }

-  $servers_array = sort(puppetdb_query(
-    "facts[certname] {
-      name = 'enc_role' and value = '${membersrole}' and
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-    }"
-  ).map |$fact| { $fact['certname'] })
+  $servers_array = sort(query_nodes(
+    "enc_role='${membersrole}' and country='${facts['country']}' and region='${facts['region']}'",
+    'networking.fqdn'
+  ))

  if ! $profiles::proxmox::params::pve_clusterinit_master {
    if !empty($servers_array) {
@@ -11,14 +11,13 @@ class profiles::proxmox::clusterjoin {
  $root_password      = $profiles::proxmox::params::root_password

  # query puppetdb for list of cluster members
-  $members_array = sort(puppetdb_query(
-    "facts[certname] {
-      name = 'enc_role' and value = '${membersrole}' and
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' } and
-      certname in facts[certname] { name = 'pve_cluster' and value.cluster_name = '${clustername}' }
-    }"
-  ).map |$fact| { $fact['certname'] })
+  $members_array = sort(query_nodes(
+    "enc_role='${membersrole}' and \
+    country='${facts['country']}' and \
+    region='${facts['region']}' and \
+    pve_cluster.cluster_name='${clustername}'",
+    'networking.fqdn'
+  ))

  # check if the pve kernerl is running
  if $facts['kernelrelease'] == $profiles::proxmox::params::pve_kernel_release {
@@ -7,7 +7,6 @@ class profiles::puppet::client (
  Array  $dns_alt_names       = [$trusted['certname']],
  String $server              = 'puppetmaster',
  String $ca_server           = 'puppetca',
-  Optional[String] $report_server        = undef,
  String $environment         = 'develop',
  Integer $runinterval        = 1800,
  Integer $runtimeout         = 3600,
@@ -16,52 +15,8 @@ class profiles::puppet::client (
  Integer $facts_soft_limit   = 4096,
  Boolean $splay              = true,
  Integer $splaylimit         = 600,
-  Optional[Stdlib::Absolutepath] $ssldir = undef,
 ) {

-  # Pull in the k8s-migration switch. When
-  # profiles::puppet::migrate::enabled is true at ANY hiera layer
-  # (node/role/common) the effective endpoints below flip to the k8s
-  # servers and a fresh ssldir -- no other hiera keys required. This class
-  # never includes client.pp, so there is no include cycle.
-  include profiles::puppet::migrate
-
-  # Effective values fed to the template. Precedence differs by param type:
-  #
-  #   ssldir / report_server (Optional, default undef): an explicit client
-  #     param wins; else the migrate-derived value when enabled; else the
-  #     legacy default (undef -> template omits ssldir; report_server -> server).
-  #
-  #   server / ca_server (String, no undef sentinel): the migrate value wins
-  #     when migrate::enabled, otherwise the client param (which is the legacy
-  #     default unless an operator set it explicitly in hiera). To pin a
-  #     bespoke server while enabled, leave enabled => false for that target
-  #     and set profiles::puppet::client::server directly.
-  $migrate_on = $profiles::puppet::migrate::enabled
-
-  $effective_server = $migrate_on ? {
-    true    => $profiles::puppet::migrate::new_server,
-    default => $server,
-  }
-  $effective_ca_server = $migrate_on ? {
-    true    => $profiles::puppet::migrate::new_ca_server,
-    default => $ca_server,
-  }
-  # report_server: explicit param wins; else follow the effective server.
-  $effective_report_server = $report_server ? {
-    undef   => $effective_server,
-    default => $report_server,
-  }
-  # ssldir: explicit param wins; else the fresh k8s ssldir when migrating;
-  # else undef (template omits the key, i.e. puppet's built-in default).
-  $effective_ssldir = $ssldir ? {
-    undef   => $migrate_on ? {
-      true    => $profiles::puppet::migrate::new_ssldir,
-      default => undef,
-    },
-    default => $ssldir,
-  }
-
  # dont manage puppet.conf if this is a puppetmaster
  if $facts['enc_role'] != 'roles::infra::puppet::master' {

@@ -1,87 +0,0 @@
-# Class: profiles::puppet::migrate
-#
-# Repoints a VM puppet agent from the legacy VM puppetmasters onto the new
-# puppet-on-kubernetes servers.
-#
-# The agent's existing ssldir holds a client certificate signed by the OLD CA;
-# the new k8s CA will neither trust that cert nor recognise the agent. Rather
-# than revoke/clean the old creds (which would burn the rollback path), this
-# class switches the agent to a FRESH ssldir. On the next run the agent finds
-# an empty ssldir, generates a new key + CSR, submits it to the new CA
-# (autosign = true on the k8s side signs it immediately), and then pulls its
-# catalog from the new compilers. The OLD ssldir is left untouched on disk, so
-# reverting the hiera below restores the node to the legacy masters with no
-# re-enrolment.
-#
-# The catalog that performs the switch is compiled by the OLD server (the node
-# still points at it when it applies this change). profiles::puppet::client
-# rewrites puppet.conf with the new server / ca_server / report_server / ssldir
-# and notifies Service['puppet'], so the very next agent run lands on k8s.
-#
-# NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
-# out and rolled back one target at a time. The class only manages the fresh
-# ssldir; the actual puppet.conf changes ride on profiles::puppet::client's
-# existing template. client.pp `include`s this class and, when enabled, folds
-# new_server / new_ca_server / new_ssldir into the effective server /
-# ca_server / report_server / ssldir it renders. Do NOT add a second File
-# resource for puppet.conf here -- client.pp already owns it.
-#
-# == Wiring (single boolean)
-#
-# This class ships wired into profiles::base with enabled => false, so every
-# node evaluates it but nothing changes until the boolean is flipped. Because
-# client.pp includes it and reads its params, setting the ONE key below at any
-# hiera layer repoints a target -- no client.pp param overrides needed.
-#
-# The endpoints (new_server / new_ca_server / new_ssldir) are param defaults
-# on this class; override them in hiera too if the k8s names ever change.
-#
-# --- Canary: one node -> hieradata/nodes/<certname>.yaml -------------------
-#   profiles::puppet::migrate::enabled: true
-# ---------------------------------------------------------------------------
-#
-# --- Wave: a whole role -> hieradata/roles/<t1>/<t2>[/<t3>].yaml -----------
-#   profiles::puppet::migrate::enabled: true
-# ---------------------------------------------------------------------------
-#
-# --- Estate flip -> hieradata/common.yaml (retires the legacy masters) -----
-#   profiles::puppet::migrate::enabled: true
-# ---------------------------------------------------------------------------
-#
-# Manual override: profiles::puppet::client::ssldir and ::report_server are
-# Optional and, when set explicitly in hiera, win over the migrate-derived
-# value. server / ca_server have no undef sentinel, so while enabled => true
-# the migrate endpoints win; to point a target at a bespoke server leave
-# enabled => false for it and set profiles::puppet::client::server directly.
-#
-# == Rollback (per target)
-#
-# Remove the profiles::puppet::migrate::enabled key (or set it back to false)
-# at the node/role/common layer. The next run rewrites puppet.conf back to the
-# legacy server + legacy ssldir, which still contains the original CA-signed
-# cert, and the node is back on the VM masters.
-#
-# site/profiles/manifests/puppet/migrate.pp
-class profiles::puppet::migrate (
-  Boolean $enabled                          = false,
-  String $new_server                        = 'puppet.k8s.syd1.au.unkin.net',
-  String $new_ca_server                     = 'puppetca.k8s.syd1.au.unkin.net',
-  Stdlib::Absolutepath $new_ssldir          = '/etc/puppetlabs/puppet/ssl-k8s',
-) {
-
-  # never touch the puppet masters themselves (same guard as client.pp)
-  if $enabled and $facts['enc_role'] != 'roles::infra::puppet::master' {
-
-    # Ensure the fresh ssldir exists with agent-correct ownership/perms. The
-    # puppet agent will create it on demand, but pre-creating it keeps the very
-    # first post-switch run from racing directory creation and makes the
-    # migration state auditable. Contents (keys, certs, crl) are populated by
-    # the agent against the new CA -- we only own the directory itself.
-    file { $new_ssldir:
-      ensure => 'directory',
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0771',
-    }
-  }
-}
@@ -3,7 +3,7 @@
 # This class manages the Puppetboard, a web interface to PuppetDB.
 #
 class profiles::puppet::puppetboard (
-  String  $python_version       = '3.12',
+  String  $python_version       = $facts['python3_release'],
  Boolean $manage_virtualenv    = false,
  Integer $reports_count        = 40,
  Boolean $offline_mode         = true,
@@ -48,12 +48,7 @@ class profiles::sql::galera_member (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${galera_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${galera_members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -18,12 +18,7 @@ class profiles::sql::postgresdb (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -6,15 +6,11 @@ class profiles::vault::server (
    Undef
  ]         $members_role   = undef,
  Array     $vault_servers  = [],
-  String        $package_name       = 'vault',
-  String        $package_ensure     = 'latest',
-  Boolean       $disable_openbao    = true,
  Boolean       $tls_disable        = false,
  Stdlib::Port  $client_port        = 8200,
  Stdlib::Port  $cluster_port       = 8201,
  Boolean   $manage_storage_dir     = false,
  Stdlib::Absolutepath $data_dir    = '/opt/vault',
-  Stdlib::Absolutepath $plugin_dir  = '/opt/vault_plugins',
  Stdlib::Absolutepath $bin_dir     = '/usr/bin',
  Stdlib::Absolutepath $ssl_crt     = '/etc/pki/tls/vault/certificate.crt',
  Stdlib::Absolutepath $ssl_key     = '/etc/pki/tls/vault/private.key',
@@ -29,12 +25,7 @@ class profiles::vault::server (
  if $members_lookup and $members_role != undef {

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -60,33 +51,7 @@ class profiles::vault::server (
      }
    }

-    # cleanup openbao?
-    if $disable_openbao {
-      package {'openbao':
-        ensure => absent,
-        before => Class['vault']
-      }
-      package {'openbao-vault-compat':
-        ensure => absent,
-        before => [
-          Class['vault'],
-          Package['openbao']
-        ]
-      }
-    }
-
-    # add versionlock for package_name?
-    if $package_ensure != 'latest' {
-      yum::versionlock{$package_name:
-        ensure  => present,
-        version => $package_ensure,
-        before  => Class['vault']
-      }
-    }
-
    class { 'vault':
-      package_name       => $package_name,
-      package_ensure     => $package_ensure,
      manage_service     => false,
      manage_storage_dir => $manage_storage_dir,
      enable_ui          => true,
@@ -100,7 +65,6 @@ class profiles::vault::server (
      api_addr           => "${http_scheme}://${::facts['networking']['fqdn']}:${client_port}",
      extra_config       => {
        cluster_addr => "${http_scheme}://${::facts['networking']['fqdn']}:${cluster_port}",
-        plugin_directory => $plugin_dir,
      },
      listener           => [
        {
@@ -1,5 +0,0 @@
-<%- | String $name, String $algorithm, String $secret | -%>
-key "<%= $name %>" {
-    algorithm <%= $algorithm %>;
-    secret "<%= $secret %>";
-};
@@ -1,15 +1,12 @@
 [main]
 dns_alt_names = <%= @dns_alt_names_string %>
-<% unless @effective_ssldir.nil? -%>
-ssldir = <%= @effective_ssldir %>
-<% end -%>

 [agent]
-server = <%= @effective_server %>
-ca_server = <%= @effective_ca_server %>
+server = <%= @server %>
+ca_server = <%= @ca_server %>
 environment = <%= @environment %>
 report = true
-report_server = <%= @effective_report_server.nil? ? @effective_server : @effective_report_server %>
+report_server = <%= @server %>
 runinterval = <%= @runinterval %>
 runtimeout = <%= @runtimeout %>
 show_diff = <%= @show_diff %>