Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
43ff7bf3a4 |
@@ -0,0 +1,24 @@
|
||||
name: Build
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
|
||||
jobs:
|
||||
precommit:
|
||||
runs-on: almalinux-8
|
||||
container:
|
||||
image: git.unkin.net/unkin/almalinux9-actionsdind:latest
|
||||
options: --privileged
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Install requirements
|
||||
run: |
|
||||
dnf groupinstall -y "Development Tools" -y
|
||||
dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
|
||||
|
||||
- name: Pre-Commit All Files
|
||||
run: |
|
||||
uvx pre-commit run --all-files
|
||||
@@ -1,18 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: bolt-validate
|
||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
||||
commands:
|
||||
- uvx pre-commit run --all-files --config ci/bolt-validate.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1
|
||||
@@ -1,18 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: epp-validate
|
||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
||||
commands:
|
||||
- uvx pre-commit run --all-files --config ci/epp-validate.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1
|
||||
@@ -1,18 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: erb-validate
|
||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
||||
commands:
|
||||
- uvx pre-commit run --all-files --config ci/erb-validate.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1
|
||||
@@ -1,18 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: puppet-lint
|
||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
||||
commands:
|
||||
- uvx pre-commit run --all-files --config ci/puppet-lint.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1
|
||||
@@ -1,18 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: puppet-validate
|
||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
||||
commands:
|
||||
- uvx pre-commit run --all-files --config ci/puppet-validate.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
@@ -1,18 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: ruby-check
|
||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
||||
commands:
|
||||
- uvx pre-commit run --all-files --config ci/ruby-check.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1
|
||||
@@ -1,18 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: ruby-validate
|
||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
||||
commands:
|
||||
- uvx pre-commit run --all-files --config ci/ruby-validate.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1
|
||||
@@ -1,18 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: yamllint
|
||||
image: git.unkin.net/unkin/almalinux9-base:20260606
|
||||
commands:
|
||||
- uvx pre-commit run --all-files --config ci/yamllint.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1
|
||||
+2
-1
@@ -53,6 +53,7 @@ mod 'saz-ssh', '13.1.0'
|
||||
mod 'saz-limits', '5.0.0'
|
||||
mod 'ghoneycutt-timezone', '4.0.0'
|
||||
mod 'ghoneycutt-puppet', '3.3.0'
|
||||
mod 'dalen-puppetdbquery', '3.0.1'
|
||||
mod 'markt-galera', '3.1.0'
|
||||
mod 'kogitoapp-minio', '1.1.4'
|
||||
mod 'broadinstitute-certs', '3.0.1'
|
||||
@@ -65,5 +66,5 @@ mod 'thias-sysctl', '1.0.8'
|
||||
mod 'cirrax-dovecot', '1.3.3'
|
||||
|
||||
mod 'bind',
|
||||
:git => 'https://git.unkin.net/unkinben/puppet-bind.git',
|
||||
:git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',
|
||||
:tag => '1.0'
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
repos:
|
||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
||||
rev: v2.2.0
|
||||
hooks:
|
||||
- id: bolt-validate
|
||||
@@ -1,5 +0,0 @@
|
||||
repos:
|
||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
||||
rev: v2.2.0
|
||||
hooks:
|
||||
- id: epp-validate
|
||||
@@ -1,5 +0,0 @@
|
||||
repos:
|
||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
||||
rev: v2.2.0
|
||||
hooks:
|
||||
- id: erb-validate
|
||||
@@ -1,10 +0,0 @@
|
||||
repos:
|
||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
||||
rev: v2.2.0
|
||||
hooks:
|
||||
- id: puppet-lint
|
||||
args:
|
||||
- --no-80chars-check
|
||||
- --no-documentation-check
|
||||
- --no-puppet_url_without_modules-check
|
||||
- --fail-on-warnings
|
||||
@@ -1,5 +0,0 @@
|
||||
repos:
|
||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
||||
rev: v2.2.0
|
||||
hooks:
|
||||
- id: puppet-validate
|
||||
@@ -1,10 +0,0 @@
|
||||
repos:
|
||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
||||
rev: v2.2.0
|
||||
hooks:
|
||||
- id: ruby-validate
|
||||
- repo: 'https://github.com/jumanjihouse/pre-commit-hooks'
|
||||
rev: 3.0.0
|
||||
hooks:
|
||||
- id: reek
|
||||
- id: rubocop
|
||||
@@ -1,5 +0,0 @@
|
||||
repos:
|
||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
||||
rev: v2.2.0
|
||||
hooks:
|
||||
- id: ruby-validate
|
||||
@@ -1,10 +0,0 @@
|
||||
repos:
|
||||
- repo: 'https://github.com/adrienverge/yamllint'
|
||||
rev: v1.32.0
|
||||
hooks:
|
||||
- id: 'yamllint'
|
||||
args:
|
||||
[
|
||||
"-d {extends: relaxed, rules: {line-length: disable}, ignore: chart}",
|
||||
"-s",
|
||||
]
|
||||
+10
-28
@@ -31,32 +31,14 @@ Always refer back to the official documentation at https://docs.ceph.com/en/late
|
||||
|
||||
## managing cephfs with subvolumes
|
||||
|
||||
Create erasure code profiles. The K and M values are equivalent to the number of data disks (K) and parity disks (M) in RAID5, RAID6, etc.
|
||||
This will:
|
||||
|
||||
sudo ceph osd erasure-code-profile set ec_6_2 k=6 m=2
|
||||
sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
|
||||
Create erasure code profiles. The K and M values are equivalent to the number of data disks (K) and parity disks (M) in RAID5, RAID6, etc.
|
||||
Create data pools using the erasure-code-profile, set some required options
|
||||
Add the pool to the fs `cephfs`
|
||||
Create a subvolumegroup using the new data pool
|
||||
|
||||
Create data pools using the erasure-code-profile, set some required options
|
||||
|
||||
sudo ceph osd pool create cephfs_data_ssd_ec_6_2 erasure ec_6_2
|
||||
sudo ceph osd pool set cephfs_data_ssd_ec_6_2 allow_ec_overwrites true
|
||||
sudo ceph osd pool set cephfs_data_ssd_ec_6_2 bulk true
|
||||
|
||||
sudo ceph osd pool create cephfs_data_ssd_ec_4_1 erasure ec_4_1
|
||||
sudo ceph osd pool set cephfs_data_ssd_ec_4_1 allow_ec_overwrites true
|
||||
sudo ceph osd pool set cephfs_data_ssd_ec_4_1 bulk true
|
||||
|
||||
Add the pool to the fs `cephfs`
|
||||
|
||||
sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_6_2
|
||||
sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_4_1
|
||||
|
||||
Create a subvolumegroup using the new data pool
|
||||
|
||||
sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_6_2 --pool_layout cephfs_data_ssd_ec_6_2
|
||||
sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_4_1 --pool_layout cephfs_data_ssd_ec_4_1
|
||||
|
||||
All together:
|
||||
|
||||
sudo ceph osd erasure-code-profile set ec_6_2 k=6 m=2
|
||||
sudo ceph osd pool create cephfs_data_ssd_ec_6_2 erasure ec_6_2
|
||||
@@ -78,11 +60,11 @@ Create a key with access to the new subvolume groups. Check if the user already
|
||||
|
||||
If it doesnt:
|
||||
|
||||
sudo ceph auth get-or-create client.kubernetes-cephfs \
|
||||
mgr 'allow rw' \
|
||||
osd 'allow rw tag cephfs metadata=cephfs, allow rw tag cephfs data=cephfs' \
|
||||
mds 'allow r fsname=cephfs path=/volumes, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_6_2, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_4_1' \
|
||||
mon 'allow r fsname=cephfs'
|
||||
sudo ceph auth get-or-create client.kubernetes-cephfs \
|
||||
mgr 'allow rw' \
|
||||
osd 'allow rw tag cephfs metadata=cephfs, allow rw tag cephfs data=cephfs' \
|
||||
mds 'allow r fsname=cephfs path=/volumes, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_6_2, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_4_1' \
|
||||
mon 'allow r fsname=cephfs'
|
||||
|
||||
If it does, use `sudo ceph auth caps client.kubernetes-cephfs ...` instead to update existing capabilities.
|
||||
|
||||
|
||||
@@ -30,7 +30,6 @@ hierarchy:
|
||||
- "roles/%{::enc_role_tier1}.eyaml"
|
||||
- "roles/%{::enc_role_tier1}.yaml"
|
||||
- "virtual/%{facts.virtual}.yaml"
|
||||
- "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.%{facts.os.release.minor}.yaml"
|
||||
- "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"
|
||||
- "os/%{facts.os.name}/all_releases.yaml"
|
||||
- "common.eyaml"
|
||||
|
||||
@@ -6,4 +6,3 @@ profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDo
|
||||
profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
|
||||
profiles::consul::server::acl_tokens_default: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAh4Ag95xgkIZHL0gP9OLnZauih0dB1/2l9Jzw8mP3OiIv7fw23otHYONlS3Emtj7oxW8MKcZGKDCzwCT6T2p+V5wx1n15wr2J+FmL24VbclJwrMPQ4AdgP359B9h21uoyo7Zdy7RuuvLfkU1fWXbs3SeWbi2HJs1Ed1/oI1jzr3OgwMbVtbyzd1VuAXeZ9bHQG3IA8z+w/k5m61th0HTyHjw7eldQulbohDuwv545z9axHEoHKCRT2a3ZwBufV2ST6Dm3g9GERzXE9Adp9DQC5adqM74wfsujOMLK2QFJSSIOj2uCs1CpEnrNrQ8zjP3fudM2z3l7KdSHZazEamCSxTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBY/Tn9tzEKYc5dxnzP2rP7gDBWKgVP3lf2T4Q0WPQt3ns0E6RUSO6OtBegb/5qDyohY2nsDeJTnMKOYzYt/J1PhnY=]
|
||||
profiles::consul::server::acl_tokens_replication: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzTIxbaAR/TZYnC671aBhiahsfwf3ieyeSHpD5hQm40sMEF/fXlEDijq9i2ykPikm94074j1Uo4HNzv/V9GTf0NSC/64t61jJ/Ya3QKa5f/36+DcRj3lcETsSIyhWwmU+E+zkY8I2r68MtXAuvSoMSMZdpgWSkPx/3FFgZlrsg//bzDu69jS9cx4UK582N3A6QN4Uy/qwYtJcm+2iTQlqqgGRWGqnSgTirxhegxPbJGWTDoAEpAL4/DyF5/hqcUn6mgoSfAsHF3loPHOqN30lG+9o0THWJ9B8Gf4W/1X2UWA/avmUnqBnumGoz0p7AYdNgpW+qLl2rk4lyGYa4kvQjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD9KSLH3Pn/1EIzgVJM+8VOgDDpKWzHfSVsfUMyTD0XIRPGclTdmxqCnsdhKNqmUfSjkYIf2nI9rQtSK6n42TYuO4k=]
|
||||
profiles::dns::updater::key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJ4GrN3W4zGfVygfji1MeGyAlmlFN45TVP5st6b66jSKeDYNg9BwdnXahUzkmKvFIYdPWyvXqJdvuyUNz7lWr1dw/pTNHrvqUKSvI0C5TOwmtrTwXtTvucDGs7c7FZDfgUxvLs/Vrp0ZdW3C81QXWNBI8vBfVZyiegPNq+5mX7mtcrFE7jZj1g1qwpg/30lrlCguPyXqnmdtBa7VAyU2Al1UZwkrKIYSAOb9GTnvM6bk5L26pW/NXGj+ffacwf58b4AiKCak5lhoCIInVnlogPuThxULN4RF+MYAVIlgwk159CR1abjWjioxvmP7XgjQUwUuTlgoLh9fDZa0amDeFZTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBEb1BTjhuTN9wGrxc2rdQVgDCctNdt72UR/Hj4wteK7XIX6fF43+7FYKBZnPtyWIWalwDniH//H3gfsJ+ULqSb82w=]
|
||||
|
||||
+1
-23
@@ -146,8 +146,6 @@ lookup_options:
|
||||
strategy: deep
|
||||
profiles::etcd::node::initial_cluster_token:
|
||||
convert_to: Sensitive
|
||||
profiles::dns::updater::key_secret:
|
||||
convert_to: Sensitive
|
||||
sysctl::base::values:
|
||||
merge:
|
||||
strategy: deep
|
||||
@@ -208,28 +206,8 @@ vault::manage_config_dir: true
|
||||
vault::disable_mlock: false
|
||||
|
||||
profiles::dns::base::nameservers:
|
||||
- 198.18.200.7
|
||||
- 198.18.19.16
|
||||
profiles::dns::master::basedir: '/var/named/sources'
|
||||
|
||||
# dns record publishing. During the k8s cutover both methods run; set
|
||||
# manage_export false once k8s is authoritative.
|
||||
# - export: legacy exported-resources -> puppet DNS master
|
||||
# - nsupdate: RFC2136 to the k8s bind-authoritative write endpoint (.9),
|
||||
# inert until the TSIG key is set in eyaml:
|
||||
# profiles::dns::updater::key_secret: ENC[...]
|
||||
# (must match the key the bind-authoritative zones allow-update
|
||||
# with; algorithm hmac-sha256)
|
||||
# k8s is now authoritative: clients resolve via the k8s bind-resolvers
|
||||
# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the
|
||||
# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s
|
||||
# bind-authoritative cluster fed by the nsupdate path below. The legacy
|
||||
# exported-resources -> VM-master /var/named/sources files are no longer in any
|
||||
# client's resolution path, so stop exporting them. Rollback: set back to true.
|
||||
profiles::dns::updater::manage_export: false
|
||||
profiles::dns::updater::manage_nsupdate: true
|
||||
profiles::dns::updater::server: '198.18.200.9'
|
||||
profiles::dns::updater::key_name: 'client-update'
|
||||
profiles::dns::updater::key_algorithm: 'hmac-sha256'
|
||||
#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
|
||||
#profiles::dns::base::use_ns: 'region'
|
||||
profiles::consul::server::members_role: roles::infra::storage::consul
|
||||
|
||||
@@ -1,7 +1,4 @@
|
||||
---
|
||||
haproxy_server_k8s_syd1_traefik_internal: 'k8s-traefik-internal 198.18.200.4:443 ssl verify none check inter 2s rise 3 fall 2'
|
||||
haproxy_server_k8s_syd1_traefik_external: 'k8s-traefik-external 198.18.199.0:443 ssl verify none check inter 2s rise 3 fall 2'
|
||||
|
||||
profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
|
||||
profiles::haproxy::dns::vrrp_cnames:
|
||||
- sonarr.main.unkin.net
|
||||
@@ -19,7 +16,6 @@ profiles::haproxy::dns::vrrp_cnames:
|
||||
- mail.main.unkin.net
|
||||
- autoconfig.main.unkin.net
|
||||
- autodiscover.main.unkin.net
|
||||
- auth.unkin.net
|
||||
|
||||
profiles::haproxy::mappings:
|
||||
fe_http:
|
||||
@@ -41,7 +37,6 @@ profiles::haproxy::mappings:
|
||||
- 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
|
||||
- 'autoconfig.main.unkin.net be_stalwart_webadmin'
|
||||
- 'autodiscovery.main.unkin.net be_stalwart_webadmin'
|
||||
- 'auth.unkin.net be_k8s_kanidm'
|
||||
fe_https:
|
||||
ensure: present
|
||||
mappings:
|
||||
@@ -61,7 +56,6 @@ profiles::haproxy::mappings:
|
||||
- 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
|
||||
- 'autoconfig.main.unkin.net be_stalwart_webadmin'
|
||||
- 'autodiscovery.main.unkin.net be_stalwart_webadmin'
|
||||
- 'auth.unkin.net be_k8s_kanidm'
|
||||
|
||||
profiles::haproxy::frontends:
|
||||
fe_http:
|
||||
@@ -86,7 +80,6 @@ profiles::haproxy::frontends:
|
||||
- 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
|
||||
- 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
|
||||
- 'acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net'
|
||||
- 'acl_kanidm req.hdr(host) -i auth.unkin.net'
|
||||
- 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
|
||||
use_backend:
|
||||
- "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
|
||||
@@ -106,7 +99,6 @@ profiles::haproxy::frontends:
|
||||
- 'set-header X-Frame-Options DENY if acl_grafana'
|
||||
- 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
|
||||
- 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
|
||||
- 'set-header X-Frame-Options DENY if acl_kanidm'
|
||||
- 'set-header X-Content-Type-Options nosniff'
|
||||
- 'set-header X-XSS-Protection 1;mode=block'
|
||||
|
||||
@@ -328,26 +320,6 @@ profiles::haproxy::backends:
|
||||
- add-header X-Forwarded-Proto https if { dst_port 9443 }
|
||||
redirect: 'scheme https if !{ ssl_fc }'
|
||||
stick-table: 'type ip size 200k expire 30m'
|
||||
be_k8s_kanidm:
|
||||
description: Backend for Kanidm (auth.unkin.net via Kubernetes internal Traefik)
|
||||
collect_exported: false
|
||||
options:
|
||||
balance: roundrobin
|
||||
option:
|
||||
- httpchk
|
||||
- forwardfor
|
||||
- http-keep-alive
|
||||
- prefer-last-server
|
||||
http-check:
|
||||
- 'connect ssl sni auth.unkin.net'
|
||||
- 'send meth GET uri /status ver HTTP/1.1 hdr Host auth.unkin.net'
|
||||
- 'expect status 200'
|
||||
http-reuse: always
|
||||
http-request:
|
||||
- set-header X-Forwarded-Port %[dst_port]
|
||||
- add-header X-Forwarded-Proto https if { dst_port 443 }
|
||||
redirect: 'scheme https if !{ ssl_fc }'
|
||||
server: "%{lookup('haproxy_server_k8s_syd1_traefik_internal')} sni str(auth.unkin.net)"
|
||||
be_stalwart_imap:
|
||||
description: Backend for Stalwart IMAP (STARTTLS)
|
||||
collect_exported: false
|
||||
@@ -421,7 +393,6 @@ profiles::haproxy::certlist::certificates:
|
||||
- /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
|
||||
- /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
|
||||
- /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
|
||||
- /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
|
||||
- /etc/pki/tls/vault/certificate.pem
|
||||
|
||||
# additional altnames
|
||||
@@ -451,4 +422,3 @@ certbot::client::domains:
|
||||
- git.unkin.net
|
||||
- grafana.unkin.net
|
||||
- dashboard.ceph.unkin.net
|
||||
- auth.unkin.net
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
---
|
||||
# Canary for the puppet-on-k8s migration (roles::base test host).
|
||||
profiles::puppet::migrate::enabled: true
|
||||
@@ -1,7 +1,7 @@
|
||||
# hieradata/os/AlmaLinux/AlmaLinux8.yaml
|
||||
---
|
||||
crypto_policies::policy: 'DEFAULT'
|
||||
almalinux-base-repo: almalinux
|
||||
|
||||
profiles::packages::include:
|
||||
network-scripts: {}
|
||||
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
---
|
||||
almalinux-base-repo: almalinux-vault
|
||||
@@ -1,7 +1,7 @@
|
||||
# hieradata/os/AlmaLinux/AlmaLinux9.yaml
|
||||
---
|
||||
crypto_policies::policy: 'DEFAULT:SHA1'
|
||||
almalinux-base-repo: almalinux
|
||||
|
||||
profiles::yum::global::repos:
|
||||
crb:
|
||||
ensure: present
|
||||
|
||||
@@ -23,45 +23,45 @@ profiles::yum::global::repos:
|
||||
name: baseos
|
||||
descr: baseos repository
|
||||
target: /etc/yum.repos.d/baseos.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
mirrorlist: absent
|
||||
extras:
|
||||
name: extras
|
||||
descr: extras repository
|
||||
target: /etc/yum.repos.d/extras.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
mirrorlist: absent
|
||||
appstream:
|
||||
name: appstream
|
||||
descr: appstream repository
|
||||
target: /etc/yum.repos.d/appstream.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
mirrorlist: absent
|
||||
highavailability:
|
||||
name: highavailability
|
||||
descr: highavailability repository
|
||||
target: /etc/yum.repos.d/highavailability.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
mirrorlist: absent
|
||||
crb:
|
||||
ensure: absent
|
||||
name: crb
|
||||
descr: crb repository
|
||||
target: /etc/yum.repos.d/crb.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
mirrorlist: absent
|
||||
powertools:
|
||||
ensure: absent
|
||||
name: powertools
|
||||
descr: powertools repository
|
||||
target: /etc/yum.repos.d/powertools.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||
mirrorlist: absent
|
||||
epel:
|
||||
name: epel
|
||||
@@ -70,34 +70,12 @@ profiles::yum::global::repos:
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
|
||||
mirrorlist: absent
|
||||
rpm-internal:
|
||||
name: rpm-internal
|
||||
descr: rpm-internal repository
|
||||
target: /etc/yum.repos.d/rpm-internal.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
rpm-vendor:
|
||||
name: rpm-vendor
|
||||
descr: rpm-vendor repository
|
||||
target: /etc/yum.repos.d/rpm-vendor.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
# Per-release variants, resolved from the host's EL major version so el8
|
||||
# hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
|
||||
rpm-internal-release:
|
||||
name: rpm-internal-el%{facts.os.release.major}
|
||||
descr: rpm-internal-el%{facts.os.release.major} repository
|
||||
target: /etc/yum.repos.d/rpm-internal-release.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
rpm-vendor-release:
|
||||
name: rpm-vendor-el%{facts.os.release.major}
|
||||
descr: rpm-vendor-el%{facts.os.release.major} repository
|
||||
target: /etc/yum.repos.d/rpm-vendor-release.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
|
||||
unkinben:
|
||||
name: unkinben
|
||||
descr: unkinben repository
|
||||
target: /etc/yum.repos.d/unkin.repo
|
||||
baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
|
||||
gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
|
||||
@@ -269,8 +247,8 @@ profiles::yum::global::repos:
|
||||
name: rpmfusion-free
|
||||
descr: rpmfusion-free repository
|
||||
target: /etc/yum.repos.d/rpmfusion-free.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
|
||||
baseurl: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/
|
||||
gpgkey: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
|
||||
gpgcheck: 1
|
||||
mirrorlist: absent
|
||||
rpmfusion-nonfree:
|
||||
@@ -278,7 +256,15 @@ profiles::yum::global::repos:
|
||||
name: rpmfusion-nonfree
|
||||
descr: rpmfusion-nonfree repository
|
||||
target: /etc/yum.repos.d/rpmfusion-nonfree.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
|
||||
baseurl: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/
|
||||
gpgkey: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
|
||||
gpgcheck: 1
|
||||
mirrorlist: absent
|
||||
unkin:
|
||||
name: unkin
|
||||
descr: unkin repository
|
||||
target: /etc/yum.repos.d/unkin.repo
|
||||
baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el%{facts.os.release.major}
|
||||
gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
|
||||
@@ -1,69 +0,0 @@
|
||||
# hieradata/os/Fedora/all_releases.yaml
|
||||
---
|
||||
# Fedora reuses the RedHat osfamily code paths (dnf/yum, crypto-policies,
|
||||
# firewalld, openvox). Everything here keys off facts.os.release.major so a
|
||||
# future Fedora release only needs its artifactapi local repos created, not new
|
||||
# hieradata.
|
||||
|
||||
# crypto-policies: use the distro default. Kept here (not per-release) so newer
|
||||
# Fedora releases inherit it for free.
|
||||
crypto_policies::policy: 'DEFAULT'
|
||||
|
||||
# Puppet agent via OpenVox. RedHat-family builds for Fedora live under
|
||||
# openvox7/fedora/<major> (see profiles::puppet::agent).
|
||||
profiles::puppet::agent::openvox_enable: true
|
||||
|
||||
lm-sensors::package: lm_sensors
|
||||
|
||||
# Fedora-specific base setup (NetworkManager, future workstation/laptop hooks).
|
||||
hiera_include:
|
||||
- profiles::fedora::base
|
||||
|
||||
# Base package set adjustments for Fedora:
|
||||
# - p7zip was dropped from Fedora; the real 7-Zip ships as "7zip"
|
||||
# - dstat was removed from Fedora with no drop-in successor in the base set
|
||||
# - iotop is provided by the C rewrite package "iotop-c"
|
||||
profiles::packages::exclude:
|
||||
- p7zip
|
||||
- dstat
|
||||
- iotop
|
||||
profiles::packages::include:
|
||||
7zip: {}
|
||||
iotop-c: {}
|
||||
crypto-policies-scripts: {}
|
||||
lzo: {}
|
||||
policycoreutils: {}
|
||||
unar: {}
|
||||
xz: {}
|
||||
|
||||
profiles::yum::global::repos:
|
||||
fedora:
|
||||
name: fedora
|
||||
descr: Fedora %{facts.os.release.major} - %{facts.os.architecture}
|
||||
target: /etc/yum.repos.d/fedora.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/%{facts.os.release.major}/Everything/%{facts.os.architecture}/os/
|
||||
gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
|
||||
metalink: absent
|
||||
mirrorlist: absent
|
||||
updates:
|
||||
name: updates
|
||||
descr: Fedora %{facts.os.release.major} - %{facts.os.architecture} - Updates
|
||||
target: /etc/yum.repos.d/fedora-updates.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/%{facts.os.release.major}/Everything/%{facts.os.architecture}/
|
||||
gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
|
||||
metalink: absent
|
||||
mirrorlist: absent
|
||||
rpm-internal:
|
||||
name: rpm-internal-f%{facts.os.release.major}
|
||||
descr: rpm-internal-f%{facts.os.release.major} repository
|
||||
target: /etc/yum.repos.d/rpm-internal.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f%{facts.os.release.major}/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
rpm-vendor:
|
||||
name: rpm-vendor-f%{facts.os.release.major}
|
||||
descr: rpm-vendor-f%{facts.os.release.major} repository
|
||||
target: /etc/yum.repos.d/rpm-vendor.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f%{facts.os.release.major}/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
@@ -57,3 +57,5 @@ profiles::yum::global::repos:
|
||||
ensure: present
|
||||
rpmfusion-nonfree:
|
||||
ensure: present
|
||||
unkinben:
|
||||
ensure: present
|
||||
|
||||
@@ -66,9 +66,6 @@ glauth::users:
|
||||
- 20025 # jupyterhub_admin
|
||||
- 20026 # jupyterhub_user
|
||||
- 20027 # grafana_user
|
||||
- 20028 # k8s/au/syd1 operator
|
||||
- 20029 # k8s/au/syd1 admin
|
||||
- 20030 # k8s/au/syd1 root
|
||||
loginshell: '/bin/bash'
|
||||
homedir: '/home/benvin'
|
||||
passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
|
||||
@@ -388,12 +385,3 @@ glauth::groups:
|
||||
grafana_user:
|
||||
group_name: 'grafana_user'
|
||||
gidnumber: 20027
|
||||
kubernetes_au_syd1_cluster_operator:
|
||||
group_name: 'kubernetes_au_syd1_cluster_operator'
|
||||
gidnumber: 20028
|
||||
kubernetes_au_syd1_cluster_admin:
|
||||
group_name: 'kubernetes_au_syd1_cluster_admin'
|
||||
gidnumber: 20029
|
||||
kubernetes_au_syd1_cluster_root:
|
||||
group_name: 'kubernetes_au_syd1_cluster_root'
|
||||
gidnumber: 20030
|
||||
|
||||
@@ -14,9 +14,6 @@ profiles::pki::vault::alt_names:
|
||||
- radosgw.service.consul
|
||||
- radosgw.query.consul
|
||||
- "radosgw.service.%{facts.country}-%{facts.region}.consul"
|
||||
# S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
|
||||
# on the cert so TLS validates for that hostname.
|
||||
- s3.ceph.unkin.net
|
||||
|
||||
# additional repos
|
||||
profiles::yum::global::repos:
|
||||
@@ -29,8 +26,6 @@ profiles::yum::global::repos:
|
||||
profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
|
||||
profiles::nginx::simpleproxy::nginx_aliases:
|
||||
- radosgw.service.au-syd1.consul
|
||||
# nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
|
||||
- s3.ceph.unkin.net
|
||||
profiles::nginx::simpleproxy::proxy_port: 7480
|
||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||
nginx::client_max_body_size: 5000M
|
||||
|
||||
@@ -6,10 +6,8 @@ hiera_include:
|
||||
profiles::dns::resolver::acls:
|
||||
acl-main.unkin.net:
|
||||
addresses:
|
||||
- 198.18.1.10/32
|
||||
- 198.18.2.160/27
|
||||
- 10.10.8.1/32
|
||||
- 198.18.21.160/27
|
||||
- 198.18.2.192/27
|
||||
- 198.18.21.192/27
|
||||
- 198.18.13.0/24
|
||||
- 198.18.14.0/24
|
||||
|
||||
@@ -82,14 +82,8 @@ profiles::sql::postgresdb::dbname: gitea
|
||||
profiles::sql::postgresdb::dbuser: gitea
|
||||
|
||||
# deploy gitea
|
||||
gitea::base_url: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/gitea'
|
||||
gitea::install::checksums:
|
||||
1.26.2:
|
||||
linux:
|
||||
amd64: 5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a
|
||||
|
||||
gitea::ensure: '1.26.2'
|
||||
gitea::checksum: '5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a'
|
||||
gitea::ensure: '1.22.4'
|
||||
gitea::checksum: 'd549104f55067e6fb156e7ba060c9af488f36e12d5e747db7563fcc99eaf8532'
|
||||
gitea::manage_user: false
|
||||
gitea::manage_group: false
|
||||
gitea::manage_home: false
|
||||
|
||||
@@ -5,10 +5,6 @@ hiera_include:
|
||||
- incus
|
||||
- zfs
|
||||
- profiles::ceph::node
|
||||
- profiles::ceph::mon
|
||||
- profiles::ceph::mgr
|
||||
- profiles::ceph::mds
|
||||
- profiles::ceph::osd
|
||||
- profiles::ceph::client
|
||||
- profiles::ceph::dashboard
|
||||
- profiles::storage::cephfsvols
|
||||
@@ -103,7 +99,7 @@ profiles::yum::global::repos:
|
||||
profiles::dns::base::primary_interface: loopback0
|
||||
|
||||
# dashboard/haproxy
|
||||
profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback2_ip')}"
|
||||
profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback0_ip')}"
|
||||
|
||||
# networking
|
||||
systemd::manage_networkd: true
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
hiera_include:
|
||||
- profiles::selinux::setenforce
|
||||
- profiles::ceph::node
|
||||
- profiles::ceph::osd
|
||||
- profiles::ceph::client
|
||||
- exporters::frr_exporter
|
||||
- frrouting
|
||||
@@ -11,62 +10,6 @@ hiera_include:
|
||||
# manage rke2
|
||||
rke2::bootstrap_node: prodnxsr0001.main.unkin.net
|
||||
rke2::join_url: https://join-k8s.service.consul:9345
|
||||
rke2::manage_registries: true
|
||||
rke2::registries:
|
||||
docker.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "dockerhub/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
ghcr.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "ghcr/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
quay.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "quay/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
registry.k8s.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "k8s-registry/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
registry.gitlab.com:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "gitlab/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
docker.elastic.co:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "elastic/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
gcr.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "gcr/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
docker.litellm.ai:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "litellm/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
public.ecr.aws:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "ecr-public/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
rke2::config_hash:
|
||||
bind-address: "%{hiera('networking_loopback0_ip')}"
|
||||
node-ip: "%{hiera('networking_loopback0_ip')}"
|
||||
@@ -182,17 +125,6 @@ frrouting::ospf_exclude_k8s_enable: true
|
||||
frrouting::k8s_cluster_cidr: '10.42.0.0/16' # RKE2 cluster-cidr (pods)
|
||||
frrouting::k8s_service_cidr: '10.43.0.0/16' # RKE2 service-cidr
|
||||
|
||||
# sysctl recommendations
|
||||
sysctl::base::values:
|
||||
net.ipv4.conf.default.rp_filter:
|
||||
value: '0'
|
||||
net.ipv4.conf.all.rp_filter:
|
||||
value: '0'
|
||||
fs.inotify.max_user_watches:
|
||||
value: '524288'
|
||||
fs.inotify.max_user_instances:
|
||||
value: '512'
|
||||
|
||||
# add loopback interfaces to ssh list
|
||||
ssh::server::options:
|
||||
ListenAddress:
|
||||
|
||||
@@ -11,7 +11,6 @@ profiles::metrics::grafana::db_name: "%{hiera('profiles::sql::postgresdb::dbname
|
||||
profiles::metrics::grafana::db_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
|
||||
profiles::metrics::grafana::db_pass: "%{hiera('profiles::sql::postgresdb::dbpass')}"
|
||||
profiles::metrics::grafana::pgsql_backend: true
|
||||
profiles::metrics::grafana::version: '13.0.2'
|
||||
profiles::metrics::grafana::plugins:
|
||||
victoriametrics-logs-datasource:
|
||||
ensure: present
|
||||
|
||||
@@ -16,4 +16,3 @@ certbot::domains:
|
||||
- git.unkin.net
|
||||
- grafana.unkin.net
|
||||
- dashboard.ceph.unkin.net
|
||||
- auth.unkin.net
|
||||
|
||||
@@ -26,7 +26,7 @@ profiles::puppet::cobbler_enc::packages:
|
||||
- 'requests'
|
||||
- 'PyYAML'
|
||||
profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
|
||||
profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
|
||||
profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkin/puppet-r10k.git
|
||||
profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
|
||||
profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
|
||||
profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
|
||||
|
||||
@@ -29,7 +29,6 @@ profiles::consul::server::acl:
|
||||
profiles::pki::vault::alt_names:
|
||||
- consul.main.unkin.net
|
||||
- consul.service.consul
|
||||
- "consul.service.%{facts.country}-%{facts.region}.consul"
|
||||
- consul
|
||||
|
||||
# manage a simple nginx reverse proxy
|
||||
|
||||
@@ -2,12 +2,10 @@
|
||||
profiles::vault::server::members_role: roles::infra::storage::vault
|
||||
profiles::vault::server::members_lookup: true
|
||||
profiles::vault::server::data_dir: /data/vault
|
||||
profiles::vault::server::plugin_dir: /opt/openbao-plugins
|
||||
profiles::vault::server::manage_storage_dir: true
|
||||
profiles::vault::server::tls_disable: false
|
||||
profiles::vault::server::package_name: openbao
|
||||
profiles::vault::server::package_ensure: 2.4.4
|
||||
profiles::vault::server::disable_openbao: false
|
||||
vault::package_name: openbao
|
||||
vault::package_ensure: latest
|
||||
|
||||
# additional altnames
|
||||
profiles::pki::vault::alt_names:
|
||||
@@ -25,18 +23,3 @@ profiles::nginx::simpleproxy::proxy_scheme: 'http'
|
||||
profiles::nginx::simpleproxy::proxy_host: '127.0.0.1'
|
||||
profiles::nginx::simpleproxy::proxy_port: 8200
|
||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||
|
||||
profiles::packages::include:
|
||||
# openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
|
||||
openbao-plugins: {}
|
||||
# Secrets plugins pinned to the exact version whose binary matches the sha256
|
||||
# registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
|
||||
# on upgrade, or OpenBao refuses to launch the plugin after a restart.
|
||||
openbao-plugin-secrets-litellm:
|
||||
ensure: '0.1.1'
|
||||
openbao-plugin-secrets-gpg:
|
||||
ensure: '0.1.0'
|
||||
openbao-plugin-secrets-rancher:
|
||||
ensure: '0.1.1'
|
||||
openbao-plugin-secrets-gitea:
|
||||
ensure: '0.1.0'
|
||||
|
||||
@@ -28,8 +28,8 @@ class externaldns::master inherits externaldns {
|
||||
dynamic => true,
|
||||
allow_updates => ['key externaldns-key'],
|
||||
allow_transfers => empty($slave_ips) ? {
|
||||
true => ['key externaldns-key'],
|
||||
false => ['key externaldns-key','dns-slaves'],
|
||||
true => [],
|
||||
false => ['dns-slaves'],
|
||||
},
|
||||
ns_notify => !empty($slave_ips),
|
||||
also_notify => $slave_ips,
|
||||
@@ -42,4 +42,4 @@ class externaldns::master inherits externaldns {
|
||||
recursion => false,
|
||||
zones => $externaldns::k8s_zones,
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -22,12 +22,7 @@ class incus::cluster (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'facter'
|
||||
|
||||
Facter.add(:ceph_osd_devices) do
|
||||
confine kernel: 'Linux'
|
||||
confine { Facter.value(:is_virtual) == false }
|
||||
confine { Facter::Core::Execution.which('pvs') }
|
||||
setcode do
|
||||
devices = []
|
||||
output = Facter::Core::Execution.execute(
|
||||
'pvs --noheadings -o pv_name,vg_name 2>/dev/null',
|
||||
on_fail: nil
|
||||
)
|
||||
output&.each_line do |line|
|
||||
pv_name, vg_name = line.split
|
||||
next unless pv_name && vg_name
|
||||
|
||||
devices << pv_name if vg_name.start_with?('ceph-')
|
||||
end
|
||||
devices.sort
|
||||
end
|
||||
end
|
||||
@@ -1,56 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'facter'
|
||||
|
||||
# Detects active ceph service instances via systemctl and exposes facts
|
||||
# for use in ceph service management profiles.
|
||||
# rubocop:disable Style/ClassAndModuleChildren
|
||||
module Unkin
|
||||
module Ceph
|
||||
# Detects active ceph service instances via systemctl and exposes Facter facts.
|
||||
module Utils
|
||||
TYPES = %w[mon mgr mds osd].freeze
|
||||
|
||||
def self.services
|
||||
output = Facter::Core::Execution.execute(
|
||||
'systemctl list-units "ceph*" --no-legend --plain --all 2>/dev/null',
|
||||
on_fail: ''
|
||||
)
|
||||
parse_units(output)
|
||||
end
|
||||
|
||||
def self.parse_units(output)
|
||||
result = TYPES.each_with_object({}) { |type, hash| hash[type] = [] }
|
||||
output.each_line do |line|
|
||||
unit = line.split.first
|
||||
next unless unit
|
||||
|
||||
match_unit(result, unit)
|
||||
end
|
||||
result
|
||||
end
|
||||
|
||||
def self.match_unit(result, unit)
|
||||
TYPES.each do |type|
|
||||
match = unit.match(/\Aceph-#{type}@(.+)\.service\z/)
|
||||
result[type] << "ceph-#{type}@#{match[1]}" if match
|
||||
end
|
||||
end
|
||||
|
||||
TYPES.each do |type|
|
||||
define_singleton_method(:"#{type}?") { !services[type].empty? }
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
# rubocop:enable Style/ClassAndModuleChildren
|
||||
|
||||
Facter.add('ceph_services') do
|
||||
setcode { Unkin::Ceph::Utils.services }
|
||||
end
|
||||
|
||||
Unkin::Ceph::Utils::TYPES.each do |type|
|
||||
Facter.add("is_ceph_#{type}") do
|
||||
setcode { Unkin::Ceph::Utils.public_send(:"#{type}?") }
|
||||
end
|
||||
end
|
||||
@@ -1,88 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
# lib/facter/dns_records.rb
|
||||
#
|
||||
# Reports this host's expected DNS records (assembled by profiles::dns::updater
|
||||
# into its records file) versus what is currently deployed on the authoritative
|
||||
# server, so puppet can detect drift and re-apply.
|
||||
#
|
||||
# Structured value:
|
||||
# { server, count, expected => [{zone,fqdn,type,ttl,value}], in_sync,
|
||||
# drift => [{...,deployed => [...]}] }
|
||||
|
||||
# Helpers for the dns_records fact.
|
||||
module DnsRecordsFact
|
||||
RECORDS_FILE = '/var/lib/dns-updater/records'
|
||||
SERVER_FILE = '/var/lib/dns-updater/server'
|
||||
|
||||
module_function
|
||||
|
||||
# normalise a value for comparison: strip, drop trailing dot, downcase
|
||||
def norm(value)
|
||||
value.to_s.strip.chomp('.').downcase
|
||||
end
|
||||
|
||||
def server
|
||||
File.exist?(SERVER_FILE) ? File.read(SERVER_FILE).strip : nil
|
||||
end
|
||||
|
||||
# a name relative to a zone (or @) as a fully-qualified name
|
||||
def to_fqdn(name, zone)
|
||||
return "#{zone}." if name.to_s.empty? || name == '@'
|
||||
|
||||
"#{name}.#{zone}."
|
||||
end
|
||||
|
||||
# parse one "zone|name|type|ttl|value" line into a record hash (nil to skip)
|
||||
def parse_line(line)
|
||||
line = line.strip
|
||||
return nil if line.empty? || line.start_with?('#')
|
||||
|
||||
zone, name, type, ttl, value = line.split('|', 5)
|
||||
return nil unless zone && type && value
|
||||
|
||||
{ 'zone' => zone, 'fqdn' => to_fqdn(name, zone), 'type' => type, 'ttl' => ttl, 'value' => value }
|
||||
end
|
||||
|
||||
# parse the records file into record hashes
|
||||
def expected
|
||||
return [] unless File.exist?(RECORDS_FILE)
|
||||
|
||||
File.readlines(RECORDS_FILE).filter_map { |line| parse_line(line) }
|
||||
end
|
||||
|
||||
# the values currently deployed for a record, per the authoritative server
|
||||
def deployed(record, srv)
|
||||
cmd = ['dig', '+short', '+time=2', '+tries=1']
|
||||
cmd << "@#{srv}" if srv && !srv.empty?
|
||||
cmd += [record['fqdn'], record['type']]
|
||||
out = Facter::Core::Execution.execute(cmd.join(' '), on_fail: '')
|
||||
out.to_s.split("\n").map { |line| norm(line) }.reject(&:empty?)
|
||||
end
|
||||
|
||||
def report
|
||||
srv = server
|
||||
exp = expected
|
||||
drift = exp.filter_map do |record|
|
||||
dep = deployed(record, srv)
|
||||
record.merge('deployed' => dep) unless dep.include?(norm(record['value']))
|
||||
end
|
||||
{ 'server' => srv, 'count' => exp.length, 'expected' => exp, 'in_sync' => drift.empty?, 'drift' => drift }
|
||||
end
|
||||
end
|
||||
|
||||
Facter.add(:dns_records) do
|
||||
confine kernel: 'Linux'
|
||||
setcode do
|
||||
File.exist?(DnsRecordsFact::RECORDS_FILE) ? DnsRecordsFact.report : nil
|
||||
end
|
||||
end
|
||||
|
||||
# Convenience boolean for `if $facts['dns_records_insync']` guards.
|
||||
Facter.add(:dns_records_insync) do
|
||||
confine kernel: 'Linux'
|
||||
setcode do
|
||||
v = Facter.value(:dns_records)
|
||||
v.nil? ? nil : v['in_sync']
|
||||
end
|
||||
end
|
||||
@@ -1,130 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'facter'
|
||||
require 'net/http'
|
||||
require 'uri'
|
||||
require 'json'
|
||||
require 'fileutils'
|
||||
require 'time'
|
||||
|
||||
# Serves this node's IP/interface data from NetBox as the structured `netbox`
|
||||
# fact. NetBox is authoritative and static IPs never change, so every
|
||||
# successful response is cached forever and reused verbatim whenever NetBox is
|
||||
# unreachable: an outage serves stale-but-correct data and can never fail a
|
||||
# puppet run. Only a host that was never cached returns nothing.
|
||||
module NetboxFacts
|
||||
TOKEN_FILE = '/etc/puppetlabs/netbox.token'
|
||||
URL_FILE = '/etc/puppetlabs/netbox.url'
|
||||
CACHE_FILE = '/var/cache/puppet-netbox/facts.json'
|
||||
DEFAULT_URL = 'https://netbox.k8s.syd1.au.unkin.net'
|
||||
|
||||
# Talks to the NetBox REST API for one node and assembles the fact payload.
|
||||
class Client
|
||||
OPEN_TIMEOUT = 3
|
||||
READ_TIMEOUT = 5
|
||||
PAGE = 500
|
||||
|
||||
def initialize
|
||||
@token = File.read(TOKEN_FILE).strip
|
||||
@base = File.exist?(URL_FILE) ? File.read(URL_FILE).strip : DEFAULT_URL
|
||||
@names = [Facter.value(:fqdn), Facter.value(:hostname)].compact.uniq
|
||||
end
|
||||
|
||||
# Live payload, or nil when the node is absent from NetBox. Raises on any
|
||||
# transport/parse error so the caller can fall back to cache.
|
||||
def fetch
|
||||
device, kind, filter, iface_base = locate
|
||||
return nil unless device
|
||||
|
||||
primary = device.dig('primary_ip', 'address')
|
||||
{
|
||||
'source' => kind, 'name' => device['name'], 'primary_ip' => primary,
|
||||
'interfaces' => interfaces(iface_base, filter, primary),
|
||||
'fetched_at' => Time.now.utc.iso8601, 'cached' => false
|
||||
}
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def locate
|
||||
device = results("/api/dcim/devices/?#{name_query}").first
|
||||
return [device, 'device', "device_id=#{device['id']}", '/api/dcim/interfaces/'] if device
|
||||
|
||||
vm = results("/api/virtualization/virtual-machines/?#{name_query}").first
|
||||
vm && [vm, 'vm', "virtual_machine_id=#{vm['id']}", '/api/virtualization/interfaces/']
|
||||
end
|
||||
|
||||
def name_query
|
||||
@names.map { |name| "name=#{URI.encode_www_form_component(name)}" }.join('&')
|
||||
end
|
||||
|
||||
def interfaces(iface_base, filter, primary)
|
||||
ips = ips_by_interface(filter)
|
||||
results("#{iface_base}?#{filter}&limit=#{PAGE}").map do |iface|
|
||||
addrs = ips[iface['id']] || []
|
||||
mac = iface['mac_address'] || iface.dig('primary_mac_address', 'mac_address')
|
||||
{ 'name' => iface['name'], 'mac' => mac, 'ips' => addrs, 'primary' => addrs.include?(primary) }
|
||||
end
|
||||
end
|
||||
|
||||
def ips_by_interface(filter)
|
||||
results("/api/ipam/ip-addresses/?#{filter}&limit=#{PAGE}").each_with_object({}) do |ip, map|
|
||||
(map[ip['assigned_object_id']] ||= []) << ip['address']
|
||||
end
|
||||
end
|
||||
|
||||
def results(path)
|
||||
JSON.parse(get(URI("#{@base}#{path}")).body).fetch('results', [])
|
||||
end
|
||||
|
||||
def get(uri)
|
||||
http = Net::HTTP.new(uri.host, uri.port)
|
||||
http.use_ssl = uri.scheme == 'https'
|
||||
http.open_timeout = OPEN_TIMEOUT
|
||||
http.read_timeout = READ_TIMEOUT
|
||||
response = http.request(request_for(uri))
|
||||
return response if response.is_a?(Net::HTTPSuccess)
|
||||
|
||||
raise "netbox #{uri.path} -> HTTP #{response.code}"
|
||||
end
|
||||
|
||||
def request_for(uri)
|
||||
request = Net::HTTP::Get.new(uri)
|
||||
request['Authorization'] = "Token #{@token}"
|
||||
request['Accept'] = 'application/json'
|
||||
request
|
||||
end
|
||||
end
|
||||
|
||||
module_function
|
||||
|
||||
def write_cache(data)
|
||||
FileUtils.mkdir_p(File.dirname(CACHE_FILE))
|
||||
File.write(CACHE_FILE, JSON.pretty_generate(data))
|
||||
File.chmod(0o600, CACHE_FILE)
|
||||
end
|
||||
|
||||
def read_cache
|
||||
return nil unless File.exist?(CACHE_FILE)
|
||||
|
||||
JSON.parse(File.read(CACHE_FILE)).merge('cached' => true)
|
||||
rescue StandardError
|
||||
nil
|
||||
end
|
||||
|
||||
def resolve
|
||||
data = Client.new.fetch
|
||||
return read_cache unless data
|
||||
|
||||
write_cache(data)
|
||||
data
|
||||
rescue StandardError => e
|
||||
Facter.warn("netbox fact: live fetch failed (#{e.message}); serving cache")
|
||||
read_cache
|
||||
end
|
||||
end
|
||||
|
||||
Facter.add(:netbox) do
|
||||
confine { File.exist?(NetboxFacts::TOKEN_FILE) }
|
||||
setcode { NetboxFacts.resolve }
|
||||
end
|
||||
@@ -20,12 +20,7 @@ class redisha::redis (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${redisha_members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
|
||||
@@ -23,12 +23,7 @@ class redisha::sentinel (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${redisha_members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
|
||||
@@ -7,8 +7,6 @@ class rke2::config (
|
||||
Stdlib::Fqdn $bootstrap_node = $rke2::bootstrap_node,
|
||||
String $node_token = $rke2::node_token,
|
||||
Array[String[1]] $extra_config_files = $rke2::extra_config_files,
|
||||
Boolean $manage_registries = $rke2::manage_registries,
|
||||
Hash $registries = $rke2::registries,
|
||||
){
|
||||
|
||||
# if its not the bootstrap node, add join path to config
|
||||
@@ -30,24 +28,6 @@ class rke2::config (
|
||||
$config = $config_hash
|
||||
}
|
||||
|
||||
if $manage_registries {
|
||||
file { '/etc/rancher/rke2/registries.yaml':
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => epp('rke2/registries.yaml.epp', { registries => $registries }),
|
||||
require => Package["rke2-${node_type}"],
|
||||
notify => Service["rke2-${node_type}"],
|
||||
}
|
||||
}else{
|
||||
file { '/etc/rancher/rke2/registries.yaml':
|
||||
ensure => absent,
|
||||
require => Package["rke2-${node_type}"],
|
||||
notify => Service["rke2-${node_type}"],
|
||||
}
|
||||
}
|
||||
|
||||
# create the config file
|
||||
file { $config_file:
|
||||
ensure => file,
|
||||
|
||||
@@ -12,8 +12,6 @@ class rke2 (
|
||||
Hash $helm_repos = $rke2::params::helm_repos,
|
||||
Array[String[1]] $extra_config_files = $rke2::params::extra_config_files,
|
||||
Stdlib::HTTPUrl $container_archive_source = $rke2::params::container_archive_source,
|
||||
Boolean $manage_registries = $rke2::params::manage_registries,
|
||||
Hash $registries = $rke2::params::registries,
|
||||
) inherits rke2::params {
|
||||
|
||||
include rke2::install
|
||||
|
||||
@@ -12,6 +12,4 @@ class rke2::params (
|
||||
Hash $helm_repos = {},
|
||||
Array[String[1]] $extra_config_files = [],
|
||||
Stdlib::HTTPUrl $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
|
||||
Boolean $manage_registries = false,
|
||||
Hash $registries = {},
|
||||
) {}
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
<%- | Hash $registries | -%>
|
||||
---
|
||||
# DO NOT MODIFY - MANAGED BY PUPPET
|
||||
mirrors:
|
||||
<%- $registries.each |$registry, $config| { -%>
|
||||
<%= $registry %>:
|
||||
endpoint:
|
||||
<%- $config['endpoint'].each |$ep| { -%>
|
||||
- "<%= $ep %>"
|
||||
<%- } -%>
|
||||
<%- if $config['rewrite'] { -%>
|
||||
rewrite:
|
||||
<%- $config['rewrite'].each |$pattern, $replacement| { -%>
|
||||
"<%= $pattern %>": "<%= $replacement %>"
|
||||
<%- } -%>
|
||||
<%- } -%>
|
||||
<%- if $config['disable-default-registry-endpoint'] { -%>
|
||||
disable-default-registry-endpoint: true
|
||||
<%- } -%>
|
||||
<%- } -%>
|
||||
@@ -167,13 +167,7 @@ class stalwart (
|
||||
|
||||
# Query cluster members for validation
|
||||
$cluster_query = "enc_role='${cluster_role}' and country='${facts['country']}' and region='${facts['region']}'"
|
||||
$cluster_members_raw = puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${cluster_role}' and
|
||||
certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] }
|
||||
$cluster_members_raw = query_nodes($cluster_query, 'networking.fqdn')
|
||||
$cluster_members = $cluster_members_raw ? {
|
||||
undef => [],
|
||||
default => $cluster_members_raw,
|
||||
@@ -186,20 +180,7 @@ class stalwart (
|
||||
|
||||
# Query HAProxy nodes for proxy trusted networks
|
||||
$haproxy_query = "enc_role='${haproxy_role}' and country='${facts['country']}' and region='${facts['region']}'"
|
||||
$haproxy_members_raw = puppetdb_query(
|
||||
"facts[certname,value] {
|
||||
name = 'networking' and
|
||||
certname in facts[certname] {
|
||||
name = 'enc_role' and value = '${haproxy_role}'
|
||||
} and
|
||||
certname in facts[certname] {
|
||||
name = 'country' and value = '${facts['country']}'
|
||||
} and
|
||||
certname in facts[certname] {
|
||||
name = 'region' and value = '${facts['region']}'
|
||||
}
|
||||
}"
|
||||
).map |$fact| { $fact['value']['ip'] }
|
||||
$haproxy_members_raw = query_nodes($haproxy_query, 'networking.ip')
|
||||
$haproxy_ips = $haproxy_members_raw ? {
|
||||
undef => [],
|
||||
default => sort($haproxy_members_raw),
|
||||
|
||||
@@ -12,9 +12,6 @@ class profiles::base () {
|
||||
# manage the puppet agent
|
||||
include profiles::puppet::agent
|
||||
include profiles::puppet::client
|
||||
# k8s migration switch; ships disabled, flip its ::enabled boolean in
|
||||
# hiera (node/role/common) to repoint a target onto puppet-on-k8s.
|
||||
include profiles::puppet::migrate
|
||||
|
||||
# include the base profiles
|
||||
include profiles::base::repos
|
||||
@@ -35,7 +32,6 @@ class profiles::base () {
|
||||
include profiles::ssh::service
|
||||
include profiles::cloudinit::init
|
||||
include profiles::helpers::node_lookup
|
||||
include profiles::netbox::facts
|
||||
include profiles::consul::client
|
||||
include victorialogs::client::journald
|
||||
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
class profiles::ceph::mds (
|
||||
Boolean $ensure_running = true,
|
||||
) {
|
||||
|
||||
if $ensure_running and $facts['is_ceph_mds'] {
|
||||
$facts['ceph_services']['mds'].each |String $svc| {
|
||||
service { $svc:
|
||||
ensure => running,
|
||||
enable => true,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
class profiles::ceph::mgr (
|
||||
Boolean $ensure_running = true,
|
||||
) {
|
||||
|
||||
if $ensure_running and $facts['is_ceph_mgr'] {
|
||||
$facts['ceph_services']['mgr'].each |String $svc| {
|
||||
service { $svc:
|
||||
ensure => running,
|
||||
enable => true,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
class profiles::ceph::mon (
|
||||
Boolean $ensure_running = true,
|
||||
) {
|
||||
|
||||
if $ensure_running and $facts['is_ceph_mon'] {
|
||||
$facts['ceph_services']['mon'].each |String $svc| {
|
||||
service { $svc:
|
||||
ensure => running,
|
||||
enable => true,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
class profiles::ceph::osd (
|
||||
Boolean $ensure_running = true,
|
||||
) {
|
||||
|
||||
if $ensure_running and $facts['is_ceph_osd'] {
|
||||
$facts['ceph_services']['osd'].each |String $svc| {
|
||||
service { $svc:
|
||||
ensure => running,
|
||||
enable => true,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -68,10 +68,7 @@ class profiles::cobbler::config {
|
||||
# export cnames for cobbler
|
||||
if $is_cobbler_master {
|
||||
profiles::dns::record { "${::facts['networking']['fqdn']}_${service_cname}_CNAME":
|
||||
# CNAME target must be a fully-qualified name (trailing dot): dns-updater
|
||||
# parses the value with no $ORIGIN, so a bare label becomes root-absolute
|
||||
# ("ausyd1nxvm2098.") and dead-ends in NXDOMAIN.
|
||||
value => "${::facts['networking']['fqdn']}.",
|
||||
value => $::facts['networking']['hostname'],
|
||||
type => 'CNAME',
|
||||
record => "${service_cname}.",
|
||||
zone => $::facts['networking']['domain'],
|
||||
|
||||
@@ -28,12 +28,7 @@ class profiles::consul::client (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
|
||||
@@ -65,22 +65,12 @@ class profiles::consul::server (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
if $join_remote_regions {
|
||||
# get all nodes in the members_role for each other region
|
||||
$region_to_servers = $remote_regions.reduce({}) |$memo, $region| {
|
||||
$servers = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${region}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers = sort(query_nodes("enc_role='${members_role}' and region='${region}'", 'networking.fqdn'))
|
||||
$memo + { $region => $servers }
|
||||
}
|
||||
|
||||
|
||||
@@ -11,38 +11,16 @@ class profiles::dns::base (
|
||||
Optional[String] $ns_role = undef,
|
||||
){
|
||||
|
||||
# install bind_utils (provides nsupdate)
|
||||
# install bind_utils
|
||||
include bind::updater
|
||||
|
||||
# assemble the host's DNS records and nsupdate them to the authoritative server
|
||||
include profiles::dns::updater
|
||||
|
||||
# if ns_role is set, find all hosts matching that enc_role
|
||||
$nameserver_array = $ns_role ? {
|
||||
undef => $nameservers,
|
||||
default => $use_ns ? {
|
||||
'all' => puppetdb_query(
|
||||
"facts[certname,value] {
|
||||
name = 'networking' and
|
||||
certname in nodes[certname] { facts.enc_role = '${ns_role}' }
|
||||
}"
|
||||
).map |$fact| { $fact['value']['ip'] },
|
||||
'region' => puppetdb_query(
|
||||
"facts[certname,value] {
|
||||
name = 'networking' and
|
||||
certname in nodes[certname] {
|
||||
facts.enc_role = '${ns_role}' and facts.region = '${facts['region']}'
|
||||
}
|
||||
}"
|
||||
).map |$fact| { $fact['value']['ip'] },
|
||||
'country' => puppetdb_query(
|
||||
"facts[certname,value] {
|
||||
name = 'networking' and
|
||||
certname in nodes[certname] {
|
||||
facts.enc_role = '${ns_role}' and facts.country = '${facts['country']}'
|
||||
}
|
||||
}"
|
||||
).map |$fact| { $fact['value']['ip'] },
|
||||
'all' => query_nodes("enc_role='${ns_role}'", 'networking.ip'),
|
||||
'region' => query_nodes("enc_role='${ns_role}' and region=${facts['region']}", 'networking.ip'),
|
||||
'country' => query_nodes("enc_role='${ns_role}' and country=${facts['country']}", 'networking.ip'),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -20,21 +20,9 @@ class profiles::dns::master (
|
||||
$nameservers_array = $ns_role ? {
|
||||
undef => [$facts['networking']['fqdn']],
|
||||
default => $use_ns ? {
|
||||
'all' => sort(puppetdb_query(
|
||||
"facts[certname] { name = 'enc_role' and value = '${ns_role}' }"
|
||||
).map |$fact| { $fact['certname'] }),
|
||||
'region' => sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${ns_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] }),
|
||||
'country' => sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${ns_role}' and
|
||||
certname in facts[certname] { name = 'country' and value = '${facts['country']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] }),
|
||||
'all' => sort(query_nodes("enc_role='${ns_role}'", 'networking.fqdn')),
|
||||
'region' => sort(query_nodes("enc_role='${ns_role}' and region=${facts['region']}", 'networking.fqdn')),
|
||||
'country' => sort(query_nodes("enc_role='${ns_role}' and country=${facts['country']}", 'networking.fqdn')),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -44,9 +32,7 @@ class profiles::dns::master (
|
||||
$facts['networking']['fqdn'] => $facts['networking']['ip']
|
||||
},
|
||||
default => $nameservers_array.reduce({}) |$acc, $fqdn| {
|
||||
$result = puppetdb_query(
|
||||
"facts[certname,value] { name = 'networking' and certname = '${fqdn}' }"
|
||||
).map |$fact| { $fact['value']['ip'] }
|
||||
$result = query_nodes("networking.fqdn='${fqdn}'", 'networking.ip')
|
||||
$ip = $result[0]
|
||||
$acc + { "${fqdn}." => $ip }
|
||||
}
|
||||
|
||||
@@ -1,10 +1,4 @@
|
||||
# profiles::dns::record
|
||||
#
|
||||
# Declares a DNS record for this host. Publishes it via either or both methods,
|
||||
# controlled by profiles::dns::updater's toggles (both on during cutover):
|
||||
# - nsupdate: a local concat fragment consumed by profiles::dns::updater,
|
||||
# which nsupdates it to the authoritative server.
|
||||
# - export: the legacy @@concat::fragment exported to the puppet DNS master.
|
||||
# defines the base record that will be exported
|
||||
define profiles::dns::record (
|
||||
String $record,
|
||||
Enum[
|
||||
@@ -19,26 +13,11 @@ define profiles::dns::record (
|
||||
String $value,
|
||||
String $zone,
|
||||
Integer $order,
|
||||
Integer $ttl = 300,
|
||||
Stdlib::AbsolutePath $basedir = lookup('profiles::dns::master::basedir'),
|
||||
) {
|
||||
include profiles::dns::updater
|
||||
|
||||
# new: local records file consumed by the nsupdate service
|
||||
if $profiles::dns::updater::manage_nsupdate {
|
||||
# zone|name|type|ttl|value (parsed by the dns-update script)
|
||||
concat::fragment { "dns-record-${name}":
|
||||
target => $profiles::dns::updater::records_file,
|
||||
content => "${zone}|${record}|${type}|${ttl}|${value}\n",
|
||||
order => sprintf('%03d', $order),
|
||||
}
|
||||
}
|
||||
|
||||
# legacy: export the fragment to the puppet DNS master
|
||||
if $profiles::dns::updater::manage_export {
|
||||
@@concat::fragment { "${zone}_${name}":
|
||||
target => "${profiles::dns::updater::master_basedir}/${zone}.conf",
|
||||
content => "${record} IN ${type} ${value}\n",
|
||||
order => $order,
|
||||
}
|
||||
@@concat::fragment { "${zone}_${name}":
|
||||
target => "${basedir}/${zone}.conf",
|
||||
content => "${record} IN ${type} ${value}\n",
|
||||
order => $order,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,173 +0,0 @@
|
||||
# profiles::dns::updater
|
||||
#
|
||||
# Publishes this host's DNS records. Two methods, independently toggled so both
|
||||
# can run during the k8s cutover (profiles::dns::record honours the same flags):
|
||||
#
|
||||
# - nsupdate ($manage_nsupdate): assemble the records into a local file and
|
||||
# nsupdate them to the k8s authoritative write endpoint via a systemd .path
|
||||
# unit that watches the file. Inert until $key_secret (TSIG) is set.
|
||||
# - export ($manage_export): the legacy exported-resources flow to the puppet
|
||||
# DNS master. Kept during cutover; disable once k8s is authoritative.
|
||||
#
|
||||
# nsupdate comes from bind-utils (installed via bind::updater in
|
||||
# profiles::dns::base).
|
||||
class profiles::dns::updater (
|
||||
Boolean $manage_nsupdate = true,
|
||||
Boolean $manage_export = true,
|
||||
String $server = '198.18.200.9',
|
||||
String $key_name = 'client-update',
|
||||
String $key_algorithm = 'hmac-sha256',
|
||||
Optional[Sensitive[String]] $key_secret = undef,
|
||||
Integer $default_ttl = 300,
|
||||
Stdlib::AbsolutePath $records_file = '/var/lib/dns-updater/records',
|
||||
Stdlib::AbsolutePath $state_dir = '/var/lib/dns-updater',
|
||||
Stdlib::AbsolutePath $config_dir = '/etc/dns-updater',
|
||||
Stdlib::AbsolutePath $master_basedir = lookup('profiles::dns::master::basedir'),
|
||||
# dns-updater daemon (replaces the dns-update shell script). 'latest' so hosts
|
||||
# pick up new releases (e.g. the record filter); rpm-internal metadata_expire
|
||||
# is 1h so this does not thrash.
|
||||
String $package_ensure = 'latest',
|
||||
Stdlib::AbsolutePath $api_socket = '/run/dns-updater/api.sock',
|
||||
String $resync = '10m',
|
||||
Enum['debug', 'info', 'warn', 'error'] $log_level = 'info',
|
||||
Boolean $watch_interfaces = true,
|
||||
# Never publish records whose address falls in these ranges: the k8s pod CIDR
|
||||
# (10.42.0.0/16) and service CIDR (10.43.0.0/16), the LB VIP pool
|
||||
# (198.18.200.0/24) and 198.18.199.0/24. Keeps kube-lb0/flannel/etc. out of
|
||||
# the authoritative zones and stops NOTAUTH updates for zones we do not host.
|
||||
Array[String] $deny_ranges = ['198.18.199.0/24', '198.18.200.0/24', '10.42.0.0/16', '10.43.0.0/16'],
|
||||
Array[String] $allow_ranges = [],
|
||||
Array[String] $deny_domains = [],
|
||||
Array[String] $allow_domains = [],
|
||||
) {
|
||||
|
||||
$state_file = "${state_dir}/applied"
|
||||
$server_file = "${state_dir}/server"
|
||||
$key_file = "${config_dir}/key"
|
||||
|
||||
if $manage_nsupdate {
|
||||
|
||||
file { $state_dir:
|
||||
ensure => directory,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0755',
|
||||
}
|
||||
|
||||
# Server address, read by the dns_records fact for drift detection.
|
||||
file { $server_file:
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => "${server}\n",
|
||||
require => File[$state_dir],
|
||||
}
|
||||
|
||||
# Records file, assembled from profiles::dns::record fragments.
|
||||
concat { $records_file:
|
||||
ensure => present,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
ensure_newline => true,
|
||||
warn => false,
|
||||
require => File[$state_dir],
|
||||
}
|
||||
|
||||
concat::fragment { 'dns-update-header':
|
||||
target => $records_file,
|
||||
content => "# Managed by puppet (profiles::dns::record): zone|name|type|ttl|value\n",
|
||||
order => '00',
|
||||
}
|
||||
|
||||
if $key_secret =~ Undef {
|
||||
notify { 'dns-updater-inert':
|
||||
message => 'profiles::dns::updater: key_secret unset; records assembled but not applied.',
|
||||
loglevel => 'info',
|
||||
}
|
||||
} else {
|
||||
file { $config_dir:
|
||||
ensure => directory,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0700',
|
||||
}
|
||||
|
||||
file { $key_file:
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0600',
|
||||
show_diff => false,
|
||||
content => Sensitive(epp('profiles/dns/tsig-key.epp', {
|
||||
'name' => $key_name,
|
||||
'algorithm' => $key_algorithm,
|
||||
'secret' => $key_secret.unwrap,
|
||||
})),
|
||||
}
|
||||
|
||||
# dns-updater daemon: watches the records file (inotify) and network
|
||||
# interfaces, pushes TSIG-signed RFC2136 updates to $server natively.
|
||||
package { 'dns-updater':
|
||||
ensure => $package_ensure,
|
||||
}
|
||||
|
||||
$deny_ranges_str = join($deny_ranges, ',')
|
||||
$allow_ranges_str = join($allow_ranges, ',')
|
||||
$deny_domains_str = join($deny_domains, ',')
|
||||
$allow_domains_str = join($allow_domains, ',')
|
||||
|
||||
$env_content = @("ENV")
|
||||
# Managed by puppet (profiles::dns::updater).
|
||||
DNS_UPDATER_SERVER=${server}
|
||||
DNS_UPDATER_KEY_FILE=${key_file}
|
||||
DNS_UPDATER_RECORDS_FILE=${records_file}
|
||||
DNS_UPDATER_STATE_FILE=${state_file}
|
||||
DNS_UPDATER_API=${api_socket}
|
||||
DNS_UPDATER_RESYNC=${resync}
|
||||
DNS_UPDATER_WATCH_INTERFACES=${watch_interfaces}
|
||||
DNS_UPDATER_LOG_LEVEL=${log_level}
|
||||
DNS_UPDATER_DENY_RANGES=${deny_ranges_str}
|
||||
DNS_UPDATER_ALLOW_RANGES=${allow_ranges_str}
|
||||
DNS_UPDATER_DENY_DOMAINS=${deny_domains_str}
|
||||
DNS_UPDATER_ALLOW_DOMAINS=${allow_domains_str}
|
||||
| ENV
|
||||
|
||||
file { "${config_dir}/env":
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => $env_content,
|
||||
require => [File[$config_dir], Package['dns-updater']],
|
||||
}
|
||||
|
||||
# Restart only on config/key change; records-file changes are picked up by
|
||||
# the daemon's own inotify watch, so no service churn on record edits.
|
||||
service { 'dns-updater':
|
||||
ensure => running,
|
||||
enable => true,
|
||||
subscribe => [File["${config_dir}/env"], File[$key_file]],
|
||||
require => [Package['dns-updater'], Concat[$records_file], File[$key_file]],
|
||||
}
|
||||
|
||||
# Retire the previous shell-based mechanism.
|
||||
file { '/usr/local/bin/dns-update':
|
||||
ensure => absent,
|
||||
}
|
||||
|
||||
systemd::unit_file { 'dns-update.service':
|
||||
ensure => absent,
|
||||
active => false,
|
||||
enable => false,
|
||||
}
|
||||
|
||||
systemd::unit_file { 'dns-update.path':
|
||||
ensure => absent,
|
||||
active => false,
|
||||
enable => false,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -18,12 +18,7 @@ class profiles::etcd::node (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
@@ -36,7 +31,7 @@ class profiles::etcd::node (
|
||||
$initial_cluster = $servers_array.map |$fqdn| {
|
||||
|
||||
# lookup the ip address for the current fqdn
|
||||
$ip = puppetdb_query("facts[certname,value] { name = 'networking' and certname = '${fqdn}' }").map |$fact| { $fact['value']['ip'] }[0]
|
||||
$ip = query_nodes("networking.fqdn='${fqdn}'", 'networking.ip')[0]
|
||||
|
||||
# construct the string for this server
|
||||
"${fqdn}=https://${ip}:${peer_port}"
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
# base fedora settings
|
||||
#
|
||||
# Fedora hosts share the RedHat-family base profiles (yum/dnf, crypto-policies,
|
||||
# firewalld); this class carries the handful of Fedora-specific bits. Kept
|
||||
# deliberately small so it can grow into workstation/laptop (e.g. sway) support
|
||||
# later without disturbing servers.
|
||||
class profiles::fedora::base {
|
||||
# Fedora manages interfaces through NetworkManager. Ensure it is enabled and
|
||||
# running (some minimal and cloud images ship it disabled).
|
||||
service { 'NetworkManager':
|
||||
ensure => running,
|
||||
enable => true,
|
||||
}
|
||||
}
|
||||
@@ -21,10 +21,7 @@ class profiles::haproxy::dns (
|
||||
$parts = split($cname, '\.')
|
||||
$domain = join($parts[1, $parts.length], '.')
|
||||
profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
|
||||
# CNAME target must be a fully-qualified name (trailing dot): dns-updater
|
||||
# parses the value with no $ORIGIN, so a bare label becomes root-absolute
|
||||
# ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
|
||||
value => "${location_environment}-halb.${facts['networking']['domain']}.",
|
||||
value => "${location_environment}-halb",
|
||||
type => 'CNAME',
|
||||
record => "${cname}.",
|
||||
zone => $domain,
|
||||
@@ -33,14 +30,13 @@ class profiles::haproxy::dns (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${facts['enc_role']}' and
|
||||
certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' } and
|
||||
certname in facts[certname] { name = 'environment' and value = '${facts['environment']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes(
|
||||
"enc_role='${facts['enc_role']}' and
|
||||
country='${facts['country']}' and
|
||||
region='${facts['region']}' and
|
||||
environment='${facts['environment']}'",
|
||||
'networking.fqdn'
|
||||
))
|
||||
|
||||
# give enough time for a few hosts to be provisioned
|
||||
if length($servers_array) >= 3 {
|
||||
@@ -61,10 +57,7 @@ class profiles::haproxy::dns (
|
||||
$parts = split($cname, '\.')
|
||||
$domain = join($parts[1, $parts.length], '.')
|
||||
profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
|
||||
# Fully-qualified target (trailing dot); see the note on the non-vrrp
|
||||
# cnames above. The matching A record is published in main.unkin.net
|
||||
# and unkin.net just above.
|
||||
value => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
|
||||
value => "${location_environment}-halb-vrrp",
|
||||
type => 'CNAME',
|
||||
record => "${cname}.",
|
||||
zone => $domain,
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
# profiles::metrics::grafana
|
||||
class profiles::metrics::grafana (
|
||||
String $ldap_bind_pass,
|
||||
String $version = 'installed',
|
||||
Stdlib::Port $http_port = 8080,
|
||||
String $app_mode = 'production',
|
||||
Boolean $allow_sign_up = false,
|
||||
@@ -108,7 +107,6 @@ class profiles::metrics::grafana (
|
||||
|
||||
# deploy grafana
|
||||
class { 'grafana':
|
||||
version => $version,
|
||||
cfg => $cfg,
|
||||
ldap_cfg => $ldap_cfg,
|
||||
plugins => $plugins,
|
||||
|
||||
@@ -98,15 +98,8 @@ class profiles::minio::server (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
#$servers_array = sort(puppetdb_query(
|
||||
# "facts[certname] { name = 'enc_role' and value = '${minio_members_role}' }"
|
||||
#).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${minio_members_role}' and
|
||||
certname in facts[certname] { name = 'minio_region' and value = '${minio_region}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
#$servers_array = sort(query_nodes("enc_role='${minio_members_role}'", 'networking.fqdn'))
|
||||
$servers_array = sort(query_nodes("enc_role='${minio_members_role}' and minio_region='${minio_region}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
# profiles::netbox::facts
|
||||
#
|
||||
# Seeds the credentials the `netbox` custom fact needs to read this node's
|
||||
# IP/interface data from NetBox. Inert until $api_token is set: with no token
|
||||
# the fact is confined off (unenrolled hosts no-op).
|
||||
#
|
||||
# NetBox is authoritative and static IPs never change, so the fact caches every
|
||||
# successful response under $cache_dir forever and reuses it during a NetBox
|
||||
# outage - an outage can never fail a puppet run.
|
||||
class profiles::netbox::facts (
|
||||
Optional[Sensitive[String]] $api_token = undef,
|
||||
Stdlib::HTTPSUrl $url = 'https://netbox.k8s.syd1.au.unkin.net',
|
||||
Stdlib::AbsolutePath $token_file = '/etc/puppetlabs/netbox.token',
|
||||
Stdlib::AbsolutePath $url_file = '/etc/puppetlabs/netbox.url',
|
||||
Stdlib::AbsolutePath $cache_dir = '/var/cache/puppet-netbox',
|
||||
) {
|
||||
|
||||
if $api_token =~ Undef {
|
||||
notify { 'netbox-facts-inert':
|
||||
message => 'profiles::netbox::facts: api_token unset; netbox fact disabled on this host.',
|
||||
loglevel => 'info',
|
||||
}
|
||||
} else {
|
||||
file { $token_file:
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0600',
|
||||
show_diff => false,
|
||||
content => Sensitive("${api_token.unwrap}\n"),
|
||||
}
|
||||
|
||||
file { $url_file:
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => "${url}\n",
|
||||
}
|
||||
|
||||
file { $cache_dir:
|
||||
ensure => directory,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0700',
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -26,21 +26,9 @@ class profiles::ntp::client (
|
||||
$ntpserver_array = $ntp_role ? {
|
||||
undef => $peers,
|
||||
default => $use_ntp ? {
|
||||
'all' => puppetdb_query(
|
||||
"facts[certname] { name = 'enc_role' and value = '${ntp_role}' }"
|
||||
).map |$fact| { $fact['certname'] },
|
||||
'region' => puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${ntp_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] },
|
||||
'country' => puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${ntp_role}' and
|
||||
certname in facts[certname] { name = 'country' and value = '${facts['country']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] },
|
||||
'all' => query_nodes("enc_role='${ntp_role}'", 'networking.fqdn'),
|
||||
'region' => query_nodes("enc_role='${ntp_role}' and region=${facts['region']}", 'networking.fqdn'),
|
||||
'country' => query_nodes("enc_role='${ntp_role}' and country=${facts['country']}", 'networking.fqdn'),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -24,13 +24,10 @@ class profiles::proxmox::clusterinit {
|
||||
}
|
||||
}
|
||||
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${membersrole}' and
|
||||
certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes(
|
||||
"enc_role='${membersrole}' and country='${facts['country']}' and region='${facts['region']}'",
|
||||
'networking.fqdn'
|
||||
))
|
||||
|
||||
if ! $profiles::proxmox::params::pve_clusterinit_master {
|
||||
if !empty($servers_array) {
|
||||
|
||||
@@ -11,14 +11,13 @@ class profiles::proxmox::clusterjoin {
|
||||
$root_password = $profiles::proxmox::params::root_password
|
||||
|
||||
# query puppetdb for list of cluster members
|
||||
$members_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${membersrole}' and
|
||||
certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' } and
|
||||
certname in facts[certname] { name = 'pve_cluster' and value.cluster_name = '${clustername}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$members_array = sort(query_nodes(
|
||||
"enc_role='${membersrole}' and \
|
||||
country='${facts['country']}' and \
|
||||
region='${facts['region']}' and \
|
||||
pve_cluster.cluster_name='${clustername}'",
|
||||
'networking.fqdn'
|
||||
))
|
||||
|
||||
# check if the pve kernerl is running
|
||||
if $facts['kernelrelease'] == $profiles::proxmox::params::pve_kernel_release {
|
||||
|
||||
@@ -16,18 +16,11 @@ class profiles::puppet::agent (
|
||||
$use_service = 'puppet'
|
||||
}
|
||||
|
||||
# OpenVox publishes RedHat-family builds per distribution: enterprise-linux
|
||||
# under el/<major>, Fedora under fedora/<major>.
|
||||
$openvox_dist = $facts['os']['name'] ? {
|
||||
'Fedora' => 'fedora',
|
||||
default => 'el',
|
||||
}
|
||||
|
||||
# manage the yumrepo for the given package
|
||||
if $openvox_enable and $facts['os']['family'] == 'RedHat' {
|
||||
yumrepo { 'openvox':
|
||||
ensure => 'present',
|
||||
baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/${openvox_dist}/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
|
||||
baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/el/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
|
||||
descr => 'openvox repository',
|
||||
gpgkey => 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub',
|
||||
notify => Exec['dnf_makecache'],
|
||||
|
||||
@@ -4,64 +4,19 @@
|
||||
#
|
||||
# site/profile/manifests/puppet/client.pp
|
||||
class profiles::puppet::client (
|
||||
Array $dns_alt_names = [$trusted['certname']],
|
||||
String $server = 'puppetmaster',
|
||||
String $ca_server = 'puppetca',
|
||||
Optional[String] $report_server = undef,
|
||||
String $environment = 'develop',
|
||||
Integer $runinterval = 1800,
|
||||
Integer $runtimeout = 3600,
|
||||
Boolean $show_diff = true,
|
||||
Boolean $usecacheonfailure = false,
|
||||
Integer $facts_soft_limit = 4096,
|
||||
Boolean $splay = true,
|
||||
Integer $splaylimit = 600,
|
||||
Optional[Stdlib::Absolutepath] $ssldir = undef,
|
||||
Array $dns_alt_names = [$trusted['certname']],
|
||||
String $server = 'puppetmaster',
|
||||
String $ca_server = 'puppetca',
|
||||
String $environment = 'develop',
|
||||
Integer $runinterval = 1800,
|
||||
Integer $runtimeout = 3600,
|
||||
Boolean $show_diff = true,
|
||||
Boolean $usecacheonfailure = false,
|
||||
Integer $facts_soft_limit = 4096,
|
||||
Boolean $splay = true,
|
||||
Integer $splaylimit = 600,
|
||||
) {
|
||||
|
||||
# Pull in the k8s-migration switch. When
|
||||
# profiles::puppet::migrate::enabled is true at ANY hiera layer
|
||||
# (node/role/common) the effective endpoints below flip to the k8s
|
||||
# servers and a fresh ssldir -- no other hiera keys required. This class
|
||||
# never includes client.pp, so there is no include cycle.
|
||||
include profiles::puppet::migrate
|
||||
|
||||
# Effective values fed to the template. Precedence differs by param type:
|
||||
#
|
||||
# ssldir / report_server (Optional, default undef): an explicit client
|
||||
# param wins; else the migrate-derived value when enabled; else the
|
||||
# legacy default (undef -> template omits ssldir; report_server -> server).
|
||||
#
|
||||
# server / ca_server (String, no undef sentinel): the migrate value wins
|
||||
# when migrate::enabled, otherwise the client param (which is the legacy
|
||||
# default unless an operator set it explicitly in hiera). To pin a
|
||||
# bespoke server while enabled, leave enabled => false for that target
|
||||
# and set profiles::puppet::client::server directly.
|
||||
$migrate_on = $profiles::puppet::migrate::enabled
|
||||
|
||||
$effective_server = $migrate_on ? {
|
||||
true => $profiles::puppet::migrate::new_server,
|
||||
default => $server,
|
||||
}
|
||||
$effective_ca_server = $migrate_on ? {
|
||||
true => $profiles::puppet::migrate::new_ca_server,
|
||||
default => $ca_server,
|
||||
}
|
||||
# report_server: explicit param wins; else follow the effective server.
|
||||
$effective_report_server = $report_server ? {
|
||||
undef => $effective_server,
|
||||
default => $report_server,
|
||||
}
|
||||
# ssldir: explicit param wins; else the fresh k8s ssldir when migrating;
|
||||
# else undef (template omits the key, i.e. puppet's built-in default).
|
||||
$effective_ssldir = $ssldir ? {
|
||||
undef => $migrate_on ? {
|
||||
true => $profiles::puppet::migrate::new_ssldir,
|
||||
default => undef,
|
||||
},
|
||||
default => $ssldir,
|
||||
}
|
||||
|
||||
# dont manage puppet.conf if this is a puppetmaster
|
||||
if $facts['enc_role'] != 'roles::infra::puppet::master' {
|
||||
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
# Class: profiles::puppet::migrate
|
||||
#
|
||||
# Repoints a VM puppet agent from the legacy VM puppetmasters onto the new
|
||||
# puppet-on-kubernetes servers.
|
||||
#
|
||||
# The agent's existing ssldir holds a client certificate signed by the OLD CA;
|
||||
# the new k8s CA will neither trust that cert nor recognise the agent. Rather
|
||||
# than revoke/clean the old creds (which would burn the rollback path), this
|
||||
# class switches the agent to a FRESH ssldir. On the next run the agent finds
|
||||
# an empty ssldir, generates a new key + CSR, submits it to the new CA
|
||||
# (autosign = true on the k8s side signs it immediately), and then pulls its
|
||||
# catalog from the new compilers. The OLD ssldir is left untouched on disk, so
|
||||
# reverting the hiera below restores the node to the legacy masters with no
|
||||
# re-enrolment.
|
||||
#
|
||||
# The catalog that performs the switch is compiled by the OLD server (the node
|
||||
# still points at it when it applies this change). profiles::puppet::client
|
||||
# rewrites puppet.conf with the new server / ca_server / report_server / ssldir
|
||||
# and notifies Service['puppet'], so the very next agent run lands on k8s.
|
||||
#
|
||||
# NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
|
||||
# out and rolled back one target at a time. The class only manages the fresh
|
||||
# ssldir; the actual puppet.conf changes ride on profiles::puppet::client's
|
||||
# existing template. client.pp `include`s this class and, when enabled, folds
|
||||
# new_server / new_ca_server / new_ssldir into the effective server /
|
||||
# ca_server / report_server / ssldir it renders. Do NOT add a second File
|
||||
# resource for puppet.conf here -- client.pp already owns it.
|
||||
#
|
||||
# == Wiring (single boolean)
|
||||
#
|
||||
# This class ships wired into profiles::base with enabled => false, so every
|
||||
# node evaluates it but nothing changes until the boolean is flipped. Because
|
||||
# client.pp includes it and reads its params, setting the ONE key below at any
|
||||
# hiera layer repoints a target -- no client.pp param overrides needed.
|
||||
#
|
||||
# The endpoints (new_server / new_ca_server / new_ssldir) are param defaults
|
||||
# on this class; override them in hiera too if the k8s names ever change.
|
||||
#
|
||||
# --- Canary: one node -> hieradata/nodes/<certname>.yaml -------------------
|
||||
# profiles::puppet::migrate::enabled: true
|
||||
# ---------------------------------------------------------------------------
|
||||
#
|
||||
# --- Wave: a whole role -> hieradata/roles/<t1>/<t2>[/<t3>].yaml -----------
|
||||
# profiles::puppet::migrate::enabled: true
|
||||
# ---------------------------------------------------------------------------
|
||||
#
|
||||
# --- Estate flip -> hieradata/common.yaml (retires the legacy masters) -----
|
||||
# profiles::puppet::migrate::enabled: true
|
||||
# ---------------------------------------------------------------------------
|
||||
#
|
||||
# Manual override: profiles::puppet::client::ssldir and ::report_server are
|
||||
# Optional and, when set explicitly in hiera, win over the migrate-derived
|
||||
# value. server / ca_server have no undef sentinel, so while enabled => true
|
||||
# the migrate endpoints win; to point a target at a bespoke server leave
|
||||
# enabled => false for it and set profiles::puppet::client::server directly.
|
||||
#
|
||||
# == Rollback (per target)
|
||||
#
|
||||
# Remove the profiles::puppet::migrate::enabled key (or set it back to false)
|
||||
# at the node/role/common layer. The next run rewrites puppet.conf back to the
|
||||
# legacy server + legacy ssldir, which still contains the original CA-signed
|
||||
# cert, and the node is back on the VM masters.
|
||||
#
|
||||
# site/profiles/manifests/puppet/migrate.pp
|
||||
class profiles::puppet::migrate (
|
||||
Boolean $enabled = false,
|
||||
String $new_server = 'puppet.k8s.syd1.au.unkin.net',
|
||||
String $new_ca_server = 'puppetca.k8s.syd1.au.unkin.net',
|
||||
Stdlib::Absolutepath $new_ssldir = '/etc/puppetlabs/puppet/ssl-k8s',
|
||||
) {
|
||||
|
||||
# never touch the puppet masters themselves (same guard as client.pp)
|
||||
if $enabled and $facts['enc_role'] != 'roles::infra::puppet::master' {
|
||||
|
||||
# Ensure the fresh ssldir exists with agent-correct ownership/perms. The
|
||||
# puppet agent will create it on demand, but pre-creating it keeps the very
|
||||
# first post-switch run from racing directory creation and makes the
|
||||
# migration state auditable. Contents (keys, certs, crl) are populated by
|
||||
# the agent against the new CA -- we only own the directory itself.
|
||||
file { $new_ssldir:
|
||||
ensure => 'directory',
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0771',
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -3,7 +3,7 @@
|
||||
# This class manages the Puppetboard, a web interface to PuppetDB.
|
||||
#
|
||||
class profiles::puppet::puppetboard (
|
||||
String $python_version = '3.12',
|
||||
String $python_version = $facts['python3_release'],
|
||||
Boolean $manage_virtualenv = false,
|
||||
Integer $reports_count = 40,
|
||||
Boolean $offline_mode = true,
|
||||
|
||||
@@ -134,64 +134,4 @@ class profiles::puppet::server (
|
||||
enable => true,
|
||||
require => File['/usr/local/bin/puppet_generate_types.sh'],
|
||||
}
|
||||
|
||||
# Guard against an OpenJDK (or other JVM library) package upgrade landing
|
||||
# underneath a long-running puppetserver. When the java package is replaced
|
||||
# out-of-band (e.g. a yum repo/version bump), the old versioned JAVA_HOME is
|
||||
# removed while the JVM keeps running against the now-deleted files. The JVM
|
||||
# still execs jspawnhelper from its original (deleted) JAVA_HOME on every
|
||||
# subprocess spawn, so ProcessBuilder fails with "error=2, No such file or
|
||||
# directory" -- which breaks the exec ENC (/opt/cobbler-enc/cobbler-enc) and
|
||||
# 500s every catalog compile fleet-wide. A restart re-binds to the new JVM.
|
||||
# This timer detects the running JVM executing from deleted binaries and
|
||||
# restarts the service to recover automatically.
|
||||
file { '/usr/local/bin/puppetserver_jvm_guard.sh':
|
||||
ensure => file,
|
||||
mode => '0755',
|
||||
content => @(EOF),
|
||||
#!/bin/bash
|
||||
# Restart puppetserver if its running JVM is executing deleted binaries
|
||||
# (e.g. an OpenJDK package upgrade replaced the versioned JAVA_HOME),
|
||||
# which breaks subprocess spawning and thus ENC / catalog compilation.
|
||||
for pid in $(pgrep -f puppet-server-release.jar); do
|
||||
exe=$(readlink "/proc/${pid}/exe" 2>/dev/null)
|
||||
case "${exe}" in
|
||||
*'(deleted)'*)
|
||||
logger -t puppetserver-jvm-guard "puppetserver JVM (pid ${pid}) running on deleted binaries; restarting"
|
||||
systemctl restart puppetserver
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
done
|
||||
exit 0
|
||||
| EOF
|
||||
}
|
||||
|
||||
$_guard_timer = @(EOT)
|
||||
[Unit]
|
||||
Description=puppetserver JVM guard timer
|
||||
[Timer]
|
||||
OnCalendar=*:0/5
|
||||
RandomizedDelaySec=30s
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
EOT
|
||||
|
||||
$_guard_service = @(EOT)
|
||||
[Unit]
|
||||
Description=puppetserver JVM guard service
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/puppetserver_jvm_guard.sh
|
||||
User=root
|
||||
Group=root
|
||||
EOT
|
||||
|
||||
systemd::timer { 'puppetserver-jvm-guard.timer':
|
||||
timer_content => $_guard_timer,
|
||||
service_content => $_guard_service,
|
||||
active => true,
|
||||
enable => true,
|
||||
require => File['/usr/local/bin/puppetserver_jvm_guard.sh'],
|
||||
}
|
||||
}
|
||||
|
||||
@@ -48,12 +48,7 @@ class profiles::sql::galera_member (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${galera_members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${galera_members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
|
||||
@@ -18,12 +18,7 @@ class profiles::sql::postgresdb (
|
||||
}
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
|
||||
@@ -6,15 +6,11 @@ class profiles::vault::server (
|
||||
Undef
|
||||
] $members_role = undef,
|
||||
Array $vault_servers = [],
|
||||
String $package_name = 'vault',
|
||||
String $package_ensure = 'latest',
|
||||
Boolean $disable_openbao = true,
|
||||
Boolean $tls_disable = false,
|
||||
Stdlib::Port $client_port = 8200,
|
||||
Stdlib::Port $cluster_port = 8201,
|
||||
Boolean $manage_storage_dir = false,
|
||||
Stdlib::Absolutepath $data_dir = '/opt/vault',
|
||||
Stdlib::Absolutepath $plugin_dir = '/opt/vault_plugins',
|
||||
Stdlib::Absolutepath $bin_dir = '/usr/bin',
|
||||
Stdlib::Absolutepath $ssl_crt = '/etc/pki/tls/vault/certificate.crt',
|
||||
Stdlib::Absolutepath $ssl_key = '/etc/pki/tls/vault/private.key',
|
||||
@@ -29,12 +25,7 @@ class profiles::vault::server (
|
||||
if $members_lookup and $members_role != undef {
|
||||
|
||||
# if it is, find hosts, sort them so they dont cause changes every run
|
||||
$servers_array = sort(puppetdb_query(
|
||||
"facts[certname] {
|
||||
name = 'enc_role' and value = '${members_role}' and
|
||||
certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
|
||||
}"
|
||||
).map |$fact| { $fact['certname'] })
|
||||
$servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))
|
||||
|
||||
# else use provided array from params
|
||||
}else{
|
||||
@@ -60,33 +51,7 @@ class profiles::vault::server (
|
||||
}
|
||||
}
|
||||
|
||||
# cleanup openbao?
|
||||
if $disable_openbao {
|
||||
package {'openbao':
|
||||
ensure => absent,
|
||||
before => Class['vault']
|
||||
}
|
||||
package {'openbao-vault-compat':
|
||||
ensure => absent,
|
||||
before => [
|
||||
Class['vault'],
|
||||
Package['openbao']
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# add versionlock for package_name?
|
||||
if $package_ensure != 'latest' {
|
||||
yum::versionlock{$package_name:
|
||||
ensure => present,
|
||||
version => $package_ensure,
|
||||
before => Class['vault']
|
||||
}
|
||||
}
|
||||
|
||||
class { 'vault':
|
||||
package_name => $package_name,
|
||||
package_ensure => $package_ensure,
|
||||
manage_service => false,
|
||||
manage_storage_dir => $manage_storage_dir,
|
||||
enable_ui => true,
|
||||
@@ -99,8 +64,7 @@ class profiles::vault::server (
|
||||
},
|
||||
api_addr => "${http_scheme}://${::facts['networking']['fqdn']}:${client_port}",
|
||||
extra_config => {
|
||||
cluster_addr => "${http_scheme}://${::facts['networking']['fqdn']}:${cluster_port}",
|
||||
plugin_directory => $plugin_dir,
|
||||
cluster_addr => "${http_scheme}://${::facts['networking']['fqdn']}:${cluster_port}",
|
||||
},
|
||||
listener => [
|
||||
{
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
<%- | String $name, String $algorithm, String $secret | -%>
|
||||
key "<%= $name %>" {
|
||||
algorithm <%= $algorithm %>;
|
||||
secret "<%= $secret %>";
|
||||
};
|
||||
@@ -1,15 +1,12 @@
|
||||
[main]
|
||||
dns_alt_names = <%= @dns_alt_names_string %>
|
||||
<% unless @effective_ssldir.nil? -%>
|
||||
ssldir = <%= @effective_ssldir %>
|
||||
<% end -%>
|
||||
|
||||
[agent]
|
||||
server = <%= @effective_server %>
|
||||
ca_server = <%= @effective_ca_server %>
|
||||
server = <%= @server %>
|
||||
ca_server = <%= @ca_server %>
|
||||
environment = <%= @environment %>
|
||||
report = true
|
||||
report_server = <%= @effective_report_server.nil? ? @effective_server : @effective_report_server %>
|
||||
report_server = <%= @server %>
|
||||
runinterval = <%= @runinterval %>
|
||||
runtimeout = <%= @runtimeout %>
|
||||
show_diff = <%= @show_diff %>
|
||||
|
||||
Reference in New Issue
Block a user