Add rpm-vendor yum repository

rpmbuilder's vendored third-party RPMs are moving from Gitea's RPM registry
to the artifactapi rpm-vendor local repos. Managed AlmaLinux hosts need the
matching yum repo to install them; this mirrors the existing rpm-internal
repo and selects the per-EL-release repo via os.release.major.

- Add rpm-vendor to profiles::yum::global::repos in
  hieradata/os/AlmaLinux/all_releases.yaml, pointing at
  .../api/v1/local/rpm-vendor-el<major>/ (el8/el9), gpgcheck disabled and
  mirrorlist absent, matching the rpm-internal repo definition.

hieradata/os/AlmaLinux/all_releases.yaml

@@ -85,6 +85,13 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
     gpgcheck: false
     mirrorlist: absent
+  rpm-vendor:
+    name: rpm-vendor
+    descr: rpm-vendor repository
+    target: /etc/yum.repos.d/rpm-vendor.repo
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
+    gpgcheck: false
+    mirrorlist: absent
 
   # Additional repositories - default to absent, roles can override with ensure: present
   # FRRouting repositories

site/profiles/manifests/dns/updater.pp

@@ -23,22 +23,12 @@ class profiles::dns::updater (
   Stdlib::AbsolutePath        $state_dir       = '/var/lib/dns-updater',
   Stdlib::AbsolutePath        $config_dir      = '/etc/dns-updater',
   Stdlib::AbsolutePath        $master_basedir  = lookup('profiles::dns::master::basedir'),
-  # dns-updater daemon (replaces the dns-update shell script). 'latest' so hosts
-  # pick up new releases (e.g. the record filter); rpm-internal metadata_expire
-  # is 1h so this does not thrash.
-  String                      $package_ensure   = 'latest',
+  # dns-updater daemon (replaces the dns-update shell script).
+  String                      $package_ensure   = 'installed',
   Stdlib::AbsolutePath        $api_socket       = '/run/dns-updater/api.sock',
   String                      $resync           = '10m',
   Enum['debug', 'info', 'warn', 'error'] $log_level = 'info',
   Boolean                     $watch_interfaces = true,
-  # Never publish records whose address falls in these ranges: the k8s pod CIDR
-  # (10.42.0.0/16) and service CIDR (10.43.0.0/16), the LB VIP pool
-  # (198.18.200.0/24) and 198.18.199.0/24. Keeps kube-lb0/flannel/etc. out of
-  # the authoritative zones and stops NOTAUTH updates for zones we do not host.
-  Array[String]               $deny_ranges     = ['198.18.199.0/24', '198.18.200.0/24', '10.42.0.0/16', '10.43.0.0/16'],
-  Array[String]               $allow_ranges    = [],
-  Array[String]               $deny_domains    = [],
-  Array[String]               $allow_domains   = [],
 ) {
 
   $state_file  = "${state_dir}/applied"
@@ -113,11 +103,6 @@ class profiles::dns::updater (
         ensure => $package_ensure,
       }
 
-      $deny_ranges_str   = join($deny_ranges, ',')
-      $allow_ranges_str  = join($allow_ranges, ',')
-      $deny_domains_str  = join($deny_domains, ',')
-      $allow_domains_str = join($allow_domains, ',')
-
       $env_content = @("ENV")
         # Managed by puppet (profiles::dns::updater).
         DNS_UPDATER_SERVER=${server}
@@ -128,10 +113,6 @@ class profiles::dns::updater (
         DNS_UPDATER_RESYNC=${resync}
         DNS_UPDATER_WATCH_INTERFACES=${watch_interfaces}
         DNS_UPDATER_LOG_LEVEL=${log_level}
-        DNS_UPDATER_DENY_RANGES=${deny_ranges_str}
-        DNS_UPDATER_ALLOW_RANGES=${allow_ranges_str}
-        DNS_UPDATER_DENY_DOMAINS=${deny_domains_str}
-        DNS_UPDATER_ALLOW_DOMAINS=${allow_domains_str}
         | ENV
 
       file { "${config_dir}/env":