dns: dual-write toggles + drift fact

Publish records both ways during the k8s cutover, and expose expected vs
deployed records for drift detection.

- profiles::dns::updater + ::record: manage_nsupdate and manage_export
  booleans (both default on); export keeps the legacy master flow, so
  disable it once k8s is authoritative
- dns_records fact: parses the expected records file and digs the
  authoritative server for each, reporting expected / in_sync / drift
  (plus dns_records_insync boolean); updater writes the server address
  to /var/lib/dns-updater/server for the fact
- hiera: manage_export/manage_nsupdate = true (cutover)

hieradata/common.yaml

@@ -146,8 +146,6 @@ lookup_options:
       strategy: deep
   profiles::etcd::node::initial_cluster_token:
     convert_to: Sensitive
-  profiles::dns::updater::key_secret:
-    convert_to: Sensitive
   sysctl::base::values:
     merge:
       strategy: deep
@@ -208,7 +206,7 @@ vault::manage_config_dir: true
 vault::disable_mlock: false
 
 profiles::dns::base::nameservers:
-  - 198.18.200.7
+  - 198.18.19.16
 profiles::dns::master::basedir: '/var/named/sources'
 
 # dns record publishing. During the k8s cutover both methods run; set
@@ -219,13 +217,7 @@ profiles::dns::master::basedir: '/var/named/sources'
 #                 profiles::dns::updater::key_secret: ENC[...]
 #               (must match the key the bind-authoritative zones allow-update
 #               with; algorithm hmac-sha256)
-# k8s is now authoritative: clients resolve via the k8s bind-resolvers
+profiles::dns::updater::manage_export: true
-# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the
-# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s
-# bind-authoritative cluster fed by the nsupdate path below. The legacy
-# exported-resources -> VM-master /var/named/sources files are no longer in any
-# client's resolution path, so stop exporting them. Rollback: set back to true.
-profiles::dns::updater::manage_export: false
 profiles::dns::updater::manage_nsupdate: true
 profiles::dns::updater::server: '198.18.200.9'
 profiles::dns::updater::key_name: 'client-update'

hieradata/country/au/region/syd1.yaml

@@ -2,7 +2,7 @@
 timezone::timezone: 'Australia/Sydney'
 certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
 profiles_dns_upstream_forwarder_unkin:
-  - 198.18.200.7
+  - 198.18.19.15
 profiles_dns_upstream_forwarder_consul:
   - 198.18.19.14
 profiles_dns_upstream_forwarder_k8s:

hieradata/nodes/ausyd1nxvm2120.main.unkin.net.yaml

@@ -1,3 +0,0 @@
----
-# Canary for the puppet-on-k8s migration (roles::base test host).
-profiles::puppet::migrate::enabled: true

hieradata/os/AlmaLinux/all_releases.yaml

@@ -70,6 +70,14 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
     gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
     mirrorlist: absent
+  unkinben:
+    name: unkinben
+    descr: unkinben repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
+    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent
   rpm-internal:
     name: rpm-internal
     descr: rpm-internal repository
@@ -77,29 +85,6 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
     gpgcheck: false
     mirrorlist: absent
-  rpm-vendor:
-    name: rpm-vendor
-    descr: rpm-vendor repository
-    target: /etc/yum.repos.d/rpm-vendor.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
-    gpgcheck: false
-    mirrorlist: absent
-  # Per-release variants, resolved from the host's EL major version so el8
-  # hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
-  rpm-internal-release:
-    name: rpm-internal-el%{facts.os.release.major}
-    descr: rpm-internal-el%{facts.os.release.major} repository
-    target: /etc/yum.repos.d/rpm-internal-release.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent
-  rpm-vendor-release:
-    name: rpm-vendor-el%{facts.os.release.major}
-    descr: rpm-vendor-el%{facts.os.release.major} repository
-    target: /etc/yum.repos.d/rpm-vendor-release.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent
 
   # Additional repositories - default to absent, roles can override with ensure: present
   # FRRouting repositories
@@ -269,8 +254,8 @@ profiles::yum::global::repos:
     name: rpmfusion-free
     descr: rpmfusion-free repository
     target: /etc/yum.repos.d/rpmfusion-free.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
+    baseurl: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    gpgkey: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
     gpgcheck: 1
     mirrorlist: absent
   rpmfusion-nonfree:
@@ -278,7 +263,15 @@ profiles::yum::global::repos:
     name: rpmfusion-nonfree
     descr: rpmfusion-nonfree repository
     target: /etc/yum.repos.d/rpmfusion-nonfree.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
+    baseurl: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    gpgkey: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
     gpgcheck: 1
     mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el%{facts.os.release.major}
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/os/Fedora/all_releases.yaml

@@ -1,69 +0,0 @@
-# hieradata/os/Fedora/all_releases.yaml
----
-# Fedora reuses the RedHat osfamily code paths (dnf/yum, crypto-policies,
-# firewalld, openvox). Everything here keys off facts.os.release.major so a
-# future Fedora release only needs its artifactapi local repos created, not new
-# hieradata.
-
-# crypto-policies: use the distro default. Kept here (not per-release) so newer
-# Fedora releases inherit it for free.
-crypto_policies::policy: 'DEFAULT'
-
-# Puppet agent via OpenVox. RedHat-family builds for Fedora live under
-# openvox7/fedora/<major> (see profiles::puppet::agent).
-profiles::puppet::agent::openvox_enable: true
-
-lm-sensors::package: lm_sensors
-
-# Fedora-specific base setup (NetworkManager, future workstation/laptop hooks).
-hiera_include:
-  - profiles::fedora::base
-
-# Base package set adjustments for Fedora:
-#   - p7zip was dropped from Fedora; the real 7-Zip ships as "7zip"
-#   - dstat was removed from Fedora with no drop-in successor in the base set
-#   - iotop is provided by the C rewrite package "iotop-c"
-profiles::packages::exclude:
-  - p7zip
-  - dstat
-  - iotop
-profiles::packages::include:
-  7zip: {}
-  iotop-c: {}
-  crypto-policies-scripts: {}
-  lzo: {}
-  policycoreutils: {}
-  unar: {}
-  xz: {}
-
-profiles::yum::global::repos:
-  fedora:
-    name: fedora
-    descr: Fedora %{facts.os.release.major} - %{facts.os.architecture}
-    target: /etc/yum.repos.d/fedora.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/%{facts.os.release.major}/Everything/%{facts.os.architecture}/os/
-    gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
-    metalink: absent
-    mirrorlist: absent
-  updates:
-    name: updates
-    descr: Fedora %{facts.os.release.major} - %{facts.os.architecture} - Updates
-    target: /etc/yum.repos.d/fedora-updates.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/%{facts.os.release.major}/Everything/%{facts.os.architecture}/
-    gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
-    metalink: absent
-    mirrorlist: absent
-  rpm-internal:
-    name: rpm-internal-f%{facts.os.release.major}
-    descr: rpm-internal-f%{facts.os.release.major} repository
-    target: /etc/yum.repos.d/rpm-internal.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent
-  rpm-vendor:
-    name: rpm-vendor-f%{facts.os.release.major}
-    descr: rpm-vendor-f%{facts.os.release.major} repository
-    target: /etc/yum.repos.d/rpm-vendor.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent

hieradata/roles/apps/media/jellyfin.yaml

@@ -57,3 +57,5 @@ profiles::yum::global::repos:
     ensure: present
   rpmfusion-nonfree:
     ensure: present
+  unkinben:
+    ensure: present

hieradata/roles/infra/ceph/rgw.yaml

@@ -14,9 +14,6 @@ profiles::pki::vault::alt_names:
   - radosgw.service.consul
   - radosgw.query.consul
   - "radosgw.service.%{facts.country}-%{facts.region}.consul"
-  # S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
-  # on the cert so TLS validates for that hostname.
-  - s3.ceph.unkin.net
 
 # additional repos
 profiles::yum::global::repos:
@@ -29,8 +26,6 @@ profiles::yum::global::repos:
 profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
 profiles::nginx::simpleproxy::nginx_aliases:
   - radosgw.service.au-syd1.consul
-  # nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
-  - s3.ceph.unkin.net
 profiles::nginx::simpleproxy::proxy_port: 7480
 profiles::nginx::simpleproxy::proxy_path: '/'
 nginx::client_max_body_size: 5000M

hieradata/roles/infra/storage/vault.yaml

@@ -27,16 +27,5 @@ profiles::nginx::simpleproxy::proxy_port: 8200
 profiles::nginx::simpleproxy::proxy_path: '/'
 
 profiles::packages::include:
-  # openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
   openbao-plugins: {}
-  # Secrets plugins pinned to the exact version whose binary matches the sha256
+  openbao-plugin-secrets-litellm: {}
-  # registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
-  # on upgrade, or OpenBao refuses to launch the plugin after a restart.
-  openbao-plugin-secrets-litellm:
-    ensure: '0.1.1'
-  openbao-plugin-secrets-gpg:
-    ensure: '0.1.0'
-  openbao-plugin-secrets-rancher:
-    ensure: '0.1.1'
-  openbao-plugin-secrets-gitea:
-    ensure: '0.1.0'

modules/libs/lib/facter/ceph_osd_devices.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require 'facter'
-
-Facter.add(:ceph_osd_devices) do
-  confine kernel: 'Linux'
-  confine { Facter.value(:is_virtual) == false }
-  confine { Facter::Core::Execution.which('pvs') }
-  setcode do
-    devices = []
-    output = Facter::Core::Execution.execute(
-      'pvs --noheadings -o pv_name,vg_name 2>/dev/null',
-      on_fail: nil
-    )
-    output&.each_line do |line|
-      pv_name, vg_name = line.split
-      next unless pv_name && vg_name
-
-      devices << pv_name if vg_name.start_with?('ceph-')
-    end
-    devices.sort
-  end
-end

site/profiles/manifests/base.pp

@@ -12,9 +12,6 @@ class profiles::base () {
     # manage the puppet agent
     include profiles::puppet::agent
     include profiles::puppet::client
-    # k8s migration switch; ships disabled, flip its ::enabled boolean in
-    # hiera (node/role/common) to repoint a target onto puppet-on-k8s.
-    include profiles::puppet::migrate
 
     # include the base profiles
     include profiles::base::repos

site/profiles/manifests/cobbler/config.pp

@@ -68,10 +68,7 @@ class profiles::cobbler::config {
   # export cnames for cobbler
   if $is_cobbler_master {
     profiles::dns::record { "${::facts['networking']['fqdn']}_${service_cname}_CNAME":
-      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
+      value  => $::facts['networking']['hostname'],
-      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
-      # ("ausyd1nxvm2098.") and dead-ends in NXDOMAIN.
-      value  => "${::facts['networking']['fqdn']}.",
       type   => 'CNAME',
       record => "${service_cname}.",
       zone   => $::facts['networking']['domain'],

site/profiles/manifests/dns/updater.pp

@@ -23,22 +23,6 @@ class profiles::dns::updater (
   Stdlib::AbsolutePath        $state_dir       = '/var/lib/dns-updater',
   Stdlib::AbsolutePath        $config_dir      = '/etc/dns-updater',
   Stdlib::AbsolutePath        $master_basedir  = lookup('profiles::dns::master::basedir'),
-  # dns-updater daemon (replaces the dns-update shell script). 'latest' so hosts
-  # pick up new releases (e.g. the record filter); rpm-internal metadata_expire
-  # is 1h so this does not thrash.
-  String                      $package_ensure   = 'latest',
-  Stdlib::AbsolutePath        $api_socket       = '/run/dns-updater/api.sock',
-  String                      $resync           = '10m',
-  Enum['debug', 'info', 'warn', 'error'] $log_level = 'info',
-  Boolean                     $watch_interfaces = true,
-  # Never publish records whose address falls in these ranges: the k8s pod CIDR
-  # (10.42.0.0/16) and service CIDR (10.43.0.0/16), the LB VIP pool
-  # (198.18.200.0/24) and 198.18.199.0/24. Keeps kube-lb0/flannel/etc. out of
-  # the authoritative zones and stops NOTAUTH updates for zones we do not host.
-  Array[String]               $deny_ranges     = ['198.18.199.0/24', '198.18.200.0/24', '10.42.0.0/16', '10.43.0.0/16'],
-  Array[String]               $allow_ranges    = [],
-  Array[String]               $deny_domains    = [],
-  Array[String]               $allow_domains   = [],
 ) {
 
   $state_file  = "${state_dir}/applied"
@@ -107,66 +91,36 @@ class profiles::dns::updater (
         })),
       }
 
-      # dns-updater daemon: watches the records file (inotify) and network
+      file { '/usr/local/bin/dns-update':
-      # interfaces, pushes TSIG-signed RFC2136 updates to $server natively.
-      package { 'dns-updater':
-        ensure => $package_ensure,
-      }
-
-      $deny_ranges_str   = join($deny_ranges, ',')
-      $allow_ranges_str  = join($allow_ranges, ',')
-      $deny_domains_str  = join($deny_domains, ',')
-      $allow_domains_str = join($allow_domains, ',')
-
-      $env_content = @("ENV")
-        # Managed by puppet (profiles::dns::updater).
-        DNS_UPDATER_SERVER=${server}
-        DNS_UPDATER_KEY_FILE=${key_file}
-        DNS_UPDATER_RECORDS_FILE=${records_file}
-        DNS_UPDATER_STATE_FILE=${state_file}
-        DNS_UPDATER_API=${api_socket}
-        DNS_UPDATER_RESYNC=${resync}
-        DNS_UPDATER_WATCH_INTERFACES=${watch_interfaces}
-        DNS_UPDATER_LOG_LEVEL=${log_level}
-        DNS_UPDATER_DENY_RANGES=${deny_ranges_str}
-        DNS_UPDATER_ALLOW_RANGES=${allow_ranges_str}
-        DNS_UPDATER_DENY_DOMAINS=${deny_domains_str}
-        DNS_UPDATER_ALLOW_DOMAINS=${allow_domains_str}
-        | ENV
-
-      file { "${config_dir}/env":
         ensure  => file,
         owner   => 'root',
         group   => 'root',
-        mode    => '0644',
+        mode    => '0755',
-        content => $env_content,
+        content => epp('profiles/dns/dns-update.sh.epp', {
-        require => [File[$config_dir], Package['dns-updater']],
+            'server'       => $server,
-      }
+            'key_file'     => $key_file,
-
+            'records_file' => $records_file,
-      # Restart only on config/key change; records-file changes are picked up by
+            'state_file'   => $state_file,
-      # the daemon's own inotify watch, so no service churn on record edits.
+        }),
-      service { 'dns-updater':
-        ensure    => running,
-        enable    => true,
-        subscribe => [File["${config_dir}/env"], File[$key_file]],
-        require   => [Package['dns-updater'], Concat[$records_file], File[$key_file]],
-      }
-
-      # Retire the previous shell-based mechanism.
-      file { '/usr/local/bin/dns-update':
-        ensure => absent,
       }
 
       systemd::unit_file { 'dns-update.service':
-        ensure => absent,
+        content => epp('profiles/dns/dns-update.service.epp', { 'script' => '/usr/local/bin/dns-update' }),
-        active => false,
-        enable => false,
       }
 
+      # The .path unit watches the records file and triggers the service.
       systemd::unit_file { 'dns-update.path':
-        ensure => absent,
+        content => epp('profiles/dns/dns-update.path.epp', { 'records_file' => $records_file }),
-        active => false,
+        active  => true,
-        enable => false,
+        enable  => true,
+      }
+
+      # Also apply within the puppet run whenever the records change.
+      exec { 'dns-update-apply':
+        command     => '/usr/local/bin/dns-update',
+        refreshonly => true,
+        subscribe   => Concat[$records_file],
+        require     => [File['/usr/local/bin/dns-update'], File[$key_file]],
       }
     }
   }

site/profiles/manifests/fedora/base.pp

@@ -1,14 +0,0 @@
-# base fedora settings
-#
-# Fedora hosts share the RedHat-family base profiles (yum/dnf, crypto-policies,
-# firewalld); this class carries the handful of Fedora-specific bits. Kept
-# deliberately small so it can grow into workstation/laptop (e.g. sway) support
-# later without disturbing servers.
-class profiles::fedora::base {
-  # Fedora manages interfaces through NetworkManager. Ensure it is enabled and
-  # running (some minimal and cloud images ship it disabled).
-  service { 'NetworkManager':
-    ensure => running,
-    enable => true,
-  }
-}

site/profiles/manifests/haproxy/dns.pp

@@ -21,10 +21,7 @@ class profiles::haproxy::dns (
     $parts = split($cname, '\.')
     $domain = join($parts[1, $parts.length], '.')
     profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
+      value  => "${location_environment}-halb",
-      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
-      # ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
-      value  => "${location_environment}-halb.${facts['networking']['domain']}.",
       type   => 'CNAME',
       record => "${cname}.",
       zone   => $domain,
@@ -61,10 +58,7 @@ class profiles::haproxy::dns (
         $parts = split($cname, '\.')
         $domain = join($parts[1, $parts.length], '.')
         profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-          # Fully-qualified target (trailing dot); see the note on the non-vrrp
+          value  => "${location_environment}-halb-vrrp",
-          # cnames above. The matching A record is published in main.unkin.net
-          # and unkin.net just above.
-          value  => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
           type   => 'CNAME',
           record => "${cname}.",
           zone   => $domain,

site/profiles/manifests/puppet/agent.pp

@@ -16,18 +16,11 @@ class profiles::puppet::agent (
     $use_service = 'puppet'
   }
 
-  # OpenVox publishes RedHat-family builds per distribution: enterprise-linux
-  # under el/<major>, Fedora under fedora/<major>.
-  $openvox_dist = $facts['os']['name'] ? {
-    'Fedora' => 'fedora',
-    default  => 'el',
-  }
-
   # manage the yumrepo for the given package
   if $openvox_enable and $facts['os']['family'] == 'RedHat' {
     yumrepo { 'openvox':
       ensure  => 'present',
-      baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/${openvox_dist}/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
+      baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/el/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
       descr   => 'openvox repository',
       gpgkey  => 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub',
       notify  => Exec['dnf_makecache'],

site/profiles/manifests/puppet/client.pp

@@ -4,64 +4,19 @@
 #
 # site/profile/manifests/puppet/client.pp
 class profiles::puppet::client (
-  Array  $dns_alt_names                  = [$trusted['certname']],
+  Array  $dns_alt_names       = [$trusted['certname']],
-  String $server                         = 'puppetmaster',
+  String $server              = 'puppetmaster',
-  String $ca_server                      = 'puppetca',
+  String $ca_server           = 'puppetca',
-  Optional[String] $report_server        = undef,
+  String $environment         = 'develop',
-  String $environment                    = 'develop',
+  Integer $runinterval        = 1800,
-  Integer $runinterval                   = 1800,
+  Integer $runtimeout         = 3600,
-  Integer $runtimeout                    = 3600,
+  Boolean $show_diff          = true,
-  Boolean $show_diff                     = true,
+  Boolean $usecacheonfailure  = false,
-  Boolean $usecacheonfailure             = false,
+  Integer $facts_soft_limit   = 4096,
-  Integer $facts_soft_limit              = 4096,
+  Boolean $splay              = true,
-  Boolean $splay                         = true,
+  Integer $splaylimit         = 600,
-  Integer $splaylimit                    = 600,
-  Optional[Stdlib::Absolutepath] $ssldir = undef,
 ) {
 
-  # Pull in the k8s-migration switch. When
-  # profiles::puppet::migrate::enabled is true at ANY hiera layer
-  # (node/role/common) the effective endpoints below flip to the k8s
-  # servers and a fresh ssldir -- no other hiera keys required. This class
-  # never includes client.pp, so there is no include cycle.
-  include profiles::puppet::migrate
-
-  # Effective values fed to the template. Precedence differs by param type:
-  #
-  #   ssldir / report_server (Optional, default undef): an explicit client
-  #     param wins; else the migrate-derived value when enabled; else the
-  #     legacy default (undef -> template omits ssldir; report_server -> server).
-  #
-  #   server / ca_server (String, no undef sentinel): the migrate value wins
-  #     when migrate::enabled, otherwise the client param (which is the legacy
-  #     default unless an operator set it explicitly in hiera). To pin a
-  #     bespoke server while enabled, leave enabled => false for that target
-  #     and set profiles::puppet::client::server directly.
-  $migrate_on = $profiles::puppet::migrate::enabled
-
-  $effective_server = $migrate_on ? {
-    true    => $profiles::puppet::migrate::new_server,
-    default => $server,
-  }
-  $effective_ca_server = $migrate_on ? {
-    true    => $profiles::puppet::migrate::new_ca_server,
-    default => $ca_server,
-  }
-  # report_server: explicit param wins; else follow the effective server.
-  $effective_report_server = $report_server ? {
-    undef   => $effective_server,
-    default => $report_server,
-  }
-  # ssldir: explicit param wins; else the fresh k8s ssldir when migrating;
-  # else undef (template omits the key, i.e. puppet's built-in default).
-  $effective_ssldir = $ssldir ? {
-    undef   => $migrate_on ? {
-      true    => $profiles::puppet::migrate::new_ssldir,
-      default => undef,
-    },
-    default => $ssldir,
-  }
-
   # dont manage puppet.conf if this is a puppetmaster
   if $facts['enc_role'] != 'roles::infra::puppet::master' {
 

site/profiles/manifests/puppet/migrate.pp

@@ -1,87 +0,0 @@
-# Class: profiles::puppet::migrate
-#
-# Repoints a VM puppet agent from the legacy VM puppetmasters onto the new
-# puppet-on-kubernetes servers.
-#
-# The agent's existing ssldir holds a client certificate signed by the OLD CA;
-# the new k8s CA will neither trust that cert nor recognise the agent. Rather
-# than revoke/clean the old creds (which would burn the rollback path), this
-# class switches the agent to a FRESH ssldir. On the next run the agent finds
-# an empty ssldir, generates a new key + CSR, submits it to the new CA
-# (autosign = true on the k8s side signs it immediately), and then pulls its
-# catalog from the new compilers. The OLD ssldir is left untouched on disk, so
-# reverting the hiera below restores the node to the legacy masters with no
-# re-enrolment.
-#
-# The catalog that performs the switch is compiled by the OLD server (the node
-# still points at it when it applies this change). profiles::puppet::client
-# rewrites puppet.conf with the new server / ca_server / report_server / ssldir
-# and notifies Service['puppet'], so the very next agent run lands on k8s.
-#
-# NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
-# out and rolled back one target at a time. The class only manages the fresh
-# ssldir; the actual puppet.conf changes ride on profiles::puppet::client's
-# existing template. client.pp `include`s this class and, when enabled, folds
-# new_server / new_ca_server / new_ssldir into the effective server /
-# ca_server / report_server / ssldir it renders. Do NOT add a second File
-# resource for puppet.conf here -- client.pp already owns it.
-#
-# == Wiring (single boolean)
-#
-# This class ships wired into profiles::base with enabled => false, so every
-# node evaluates it but nothing changes until the boolean is flipped. Because
-# client.pp includes it and reads its params, setting the ONE key below at any
-# hiera layer repoints a target -- no client.pp param overrides needed.
-#
-# The endpoints (new_server / new_ca_server / new_ssldir) are param defaults
-# on this class; override them in hiera too if the k8s names ever change.
-#
-# --- Canary: one node -> hieradata/nodes/<certname>.yaml -------------------
-#   profiles::puppet::migrate::enabled: true
-# ---------------------------------------------------------------------------
-#
-# --- Wave: a whole role -> hieradata/roles/<t1>/<t2>[/<t3>].yaml -----------
-#   profiles::puppet::migrate::enabled: true
-# ---------------------------------------------------------------------------
-#
-# --- Estate flip -> hieradata/common.yaml (retires the legacy masters) -----
-#   profiles::puppet::migrate::enabled: true
-# ---------------------------------------------------------------------------
-#
-# Manual override: profiles::puppet::client::ssldir and ::report_server are
-# Optional and, when set explicitly in hiera, win over the migrate-derived
-# value. server / ca_server have no undef sentinel, so while enabled => true
-# the migrate endpoints win; to point a target at a bespoke server leave
-# enabled => false for it and set profiles::puppet::client::server directly.
-#
-# == Rollback (per target)
-#
-# Remove the profiles::puppet::migrate::enabled key (or set it back to false)
-# at the node/role/common layer. The next run rewrites puppet.conf back to the
-# legacy server + legacy ssldir, which still contains the original CA-signed
-# cert, and the node is back on the VM masters.
-#
-# site/profiles/manifests/puppet/migrate.pp
-class profiles::puppet::migrate (
-  Boolean $enabled                          = false,
-  String $new_server                        = 'puppet.k8s.syd1.au.unkin.net',
-  String $new_ca_server                     = 'puppetca.k8s.syd1.au.unkin.net',
-  Stdlib::Absolutepath $new_ssldir          = '/etc/puppetlabs/puppet/ssl-k8s',
-) {
-
-  # never touch the puppet masters themselves (same guard as client.pp)
-  if $enabled and $facts['enc_role'] != 'roles::infra::puppet::master' {
-
-    # Ensure the fresh ssldir exists with agent-correct ownership/perms. The
-    # puppet agent will create it on demand, but pre-creating it keeps the very
-    # first post-switch run from racing directory creation and makes the
-    # migration state auditable. Contents (keys, certs, crl) are populated by
-    # the agent against the new CA -- we only own the directory itself.
-    file { $new_ssldir:
-      ensure => 'directory',
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0771',
-    }
-  }
-}

site/profiles/manifests/puppet/server.pp

@@ -134,64 +134,4 @@ class profiles::puppet::server (
     enable          => true,
     require         => File['/usr/local/bin/puppet_generate_types.sh'],
   }
-
-  # Guard against an OpenJDK (or other JVM library) package upgrade landing
-  # underneath a long-running puppetserver. When the java package is replaced
-  # out-of-band (e.g. a yum repo/version bump), the old versioned JAVA_HOME is
-  # removed while the JVM keeps running against the now-deleted files. The JVM
-  # still execs jspawnhelper from its original (deleted) JAVA_HOME on every
-  # subprocess spawn, so ProcessBuilder fails with "error=2, No such file or
-  # directory" -- which breaks the exec ENC (/opt/cobbler-enc/cobbler-enc) and
-  # 500s every catalog compile fleet-wide. A restart re-binds to the new JVM.
-  # This timer detects the running JVM executing from deleted binaries and
-  # restarts the service to recover automatically.
-  file { '/usr/local/bin/puppetserver_jvm_guard.sh':
-    ensure  => file,
-    mode    => '0755',
-    content => @(EOF),
-      #!/bin/bash
-      # Restart puppetserver if its running JVM is executing deleted binaries
-      # (e.g. an OpenJDK package upgrade replaced the versioned JAVA_HOME),
-      # which breaks subprocess spawning and thus ENC / catalog compilation.
-      for pid in $(pgrep -f puppet-server-release.jar); do
-        exe=$(readlink "/proc/${pid}/exe" 2>/dev/null)
-        case "${exe}" in
-          *'(deleted)'*)
-            logger -t puppetserver-jvm-guard "puppetserver JVM (pid ${pid}) running on deleted binaries; restarting"
-            systemctl restart puppetserver
-            exit 0
-            ;;
-        esac
-      done
-      exit 0
-      | EOF
-  }
-
-  $_guard_timer = @(EOT)
-  [Unit]
-  Description=puppetserver JVM guard timer
-  [Timer]
-  OnCalendar=*:0/5
-  RandomizedDelaySec=30s
-  [Install]
-  WantedBy=timers.target
-  EOT
-
-  $_guard_service = @(EOT)
-  [Unit]
-  Description=puppetserver JVM guard service
-  [Service]
-  Type=oneshot
-  ExecStart=/usr/local/bin/puppetserver_jvm_guard.sh
-  User=root
-  Group=root
-  EOT
-
-  systemd::timer { 'puppetserver-jvm-guard.timer':
-    timer_content   => $_guard_timer,
-    service_content => $_guard_service,
-    active          => true,
-    enable          => true,
-    require         => File['/usr/local/bin/puppetserver_jvm_guard.sh'],
-  }
 }

site/profiles/manifests/vault/server.pp

@@ -122,15 +122,6 @@ class profiles::vault::server (
       ]
     }
 
-    # go-plugin creates each secrets plugin's control socket as /tmp/pluginNNN;
-    # systemd-tmpfiles-clean reaps files aged past the /tmp policy, severing the
-    # socket of a long-lived plugin and orphaning the still-running process
-    # (every request then fails: rpc Unavailable, dial unix /tmp/pluginNNN: no
-    # such file). Exclude the sockets from cleaning for all plugins.
-    systemd::tmpfile { 'openbao-plugin-sockets.conf':
-      content => "x /tmp/plugin*\n",
-    }
-
     # ensure the vault audit log exists
     file { $audit_log:
       ensure => 'file',

site/profiles/templates/dns/dns-update.path.epp

@@ -0,0 +1,10 @@
+<%- | String $records_file | -%>
+[Unit]
+Description=Watch the DNS records file and apply changes
+
+[Path]
+PathModified=<%= $records_file %>
+Unit=dns-update.service
+
+[Install]
+WantedBy=multi-user.target

site/profiles/templates/dns/dns-update.service.epp

@@ -0,0 +1,9 @@
+<%- | String $script | -%>
+[Unit]
+Description=Apply host DNS records via nsupdate
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=<%= $script %>

site/profiles/templates/dns/dns-update.sh.epp

@@ -0,0 +1,56 @@
+<%- | String $server, String $key_file, String $records_file, String $state_file | -%>
+#!/bin/bash
+# Managed by puppet (profiles::dns::updater). Applies this host's records to the
+# authoritative DNS server via TSIG nsupdate. Only the delta since the last
+# successful run is sent; removed records are deleted.
+set -euo pipefail
+
+SERVER="<%= $server %>"
+KEYFILE="<%= $key_file %>"
+RECORDS="<%= $records_file %>"
+STATE="<%= $state_file %>"
+
+[ -f "$RECORDS" ] || exit 0
+touch "$STATE"
+
+# Format per line: zone|name|type|ttl|value  (name is relative to zone, or @).
+desired="$(grep -vE '^[[:space:]]*(#|$)' "$RECORDS" | sort -u || true)"
+applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)"
+
+[ "$desired" = "$applied" ] && exit 0
+
+fqdn() { # name zone
+  if [ -z "$1" ] || [ "$1" = "@" ]; then printf '%s.' "$2"; else printf '%s.%s.' "$1" "$2"; fi
+}
+
+msg="$(mktemp)"
+trap 'rm -f "$msg"' EXIT
+printf 'server %s\n' "$SERVER" >> "$msg"
+
+# Process per zone so each UPDATE message targets a single zone.
+zones="$(printf '%s\n%s\n' "$desired" "$applied" | cut -d'|' -f1 | sort -u | grep -v '^$' || true)"
+for zone in $zones; do
+  printf 'zone %s.\n' "$zone" >> "$msg"
+  # Additions/updates: replace the RRset for every desired record in this zone.
+  printf '%s\n' "$desired" | awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
+    while IFS='|' read -r z name type ttl value; do
+      f="$(fqdn "$name" "$z")"
+      printf 'update delete %s %s\n' "$f" "$type" >> "$msg"
+      printf 'update add %s %s %s %s\n' "$f" "$ttl" "$type" "$value" >> "$msg"
+    done
+  # Deletions: records present last run but gone now.
+  comm -23 <(printf '%s\n' "$applied") <(printf '%s\n' "$desired") | \
+    awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
+    while IFS='|' read -r z name type ttl value; do
+      f="$(fqdn "$name" "$z")"
+      printf 'update delete %s %s %s\n' "$f" "$type" "$value" >> "$msg"
+    done
+  printf 'send\n' >> "$msg"
+done
+
+if nsupdate -k "$KEYFILE" "$msg"; then
+  printf '%s\n' "$desired" > "$STATE"
+else
+  echo "dns-update: nsupdate to ${SERVER} failed" >&2
+  exit 1
+fi

site/profiles/templates/puppet/client/puppet.conf.erb

@@ -1,15 +1,12 @@
 [main]
 dns_alt_names = <%= @dns_alt_names_string %>
-<% unless @effective_ssldir.nil? -%>
-ssldir = <%= @effective_ssldir %>
-<% end -%>
 
 [agent]
-server = <%= @effective_server %>
+server = <%= @server %>
-ca_server = <%= @effective_ca_server %>
+ca_server = <%= @ca_server %>
 environment = <%= @environment %>
 report = true
-report_server = <%= @effective_report_server.nil? ? @effective_server : @effective_report_server %>
+report_server = <%= @server %>
 runinterval = <%= @runinterval %>
 runtimeout = <%= @runtimeout %>
 show_diff = <%= @show_diff %>