Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
d67cba2961 |
@@ -6,4 +6,3 @@ profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDo
|
||||
profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
|
||||
profiles::consul::server::acl_tokens_default: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAh4Ag95xgkIZHL0gP9OLnZauih0dB1/2l9Jzw8mP3OiIv7fw23otHYONlS3Emtj7oxW8MKcZGKDCzwCT6T2p+V5wx1n15wr2J+FmL24VbclJwrMPQ4AdgP359B9h21uoyo7Zdy7RuuvLfkU1fWXbs3SeWbi2HJs1Ed1/oI1jzr3OgwMbVtbyzd1VuAXeZ9bHQG3IA8z+w/k5m61th0HTyHjw7eldQulbohDuwv545z9axHEoHKCRT2a3ZwBufV2ST6Dm3g9GERzXE9Adp9DQC5adqM74wfsujOMLK2QFJSSIOj2uCs1CpEnrNrQ8zjP3fudM2z3l7KdSHZazEamCSxTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBY/Tn9tzEKYc5dxnzP2rP7gDBWKgVP3lf2T4Q0WPQt3ns0E6RUSO6OtBegb/5qDyohY2nsDeJTnMKOYzYt/J1PhnY=]
|
||||
profiles::consul::server::acl_tokens_replication: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzTIxbaAR/TZYnC671aBhiahsfwf3ieyeSHpD5hQm40sMEF/fXlEDijq9i2ykPikm94074j1Uo4HNzv/V9GTf0NSC/64t61jJ/Ya3QKa5f/36+DcRj3lcETsSIyhWwmU+E+zkY8I2r68MtXAuvSoMSMZdpgWSkPx/3FFgZlrsg//bzDu69jS9cx4UK582N3A6QN4Uy/qwYtJcm+2iTQlqqgGRWGqnSgTirxhegxPbJGWTDoAEpAL4/DyF5/hqcUn6mgoSfAsHF3loPHOqN30lG+9o0THWJ9B8Gf4W/1X2UWA/avmUnqBnumGoz0p7AYdNgpW+qLl2rk4lyGYa4kvQjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD9KSLH3Pn/1EIzgVJM+8VOgDDpKWzHfSVsfUMyTD0XIRPGclTdmxqCnsdhKNqmUfSjkYIf2nI9rQtSK6n42TYuO4k=]
|
||||
profiles::dns::updater::key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJ4GrN3W4zGfVygfji1MeGyAlmlFN45TVP5st6b66jSKeDYNg9BwdnXahUzkmKvFIYdPWyvXqJdvuyUNz7lWr1dw/pTNHrvqUKSvI0C5TOwmtrTwXtTvucDGs7c7FZDfgUxvLs/Vrp0ZdW3C81QXWNBI8vBfVZyiegPNq+5mX7mtcrFE7jZj1g1qwpg/30lrlCguPyXqnmdtBa7VAyU2Al1UZwkrKIYSAOb9GTnvM6bk5L26pW/NXGj+ffacwf58b4AiKCak5lhoCIInVnlogPuThxULN4RF+MYAVIlgwk159CR1abjWjioxvmP7XgjQUwUuTlgoLh9fDZa0amDeFZTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBEb1BTjhuTN9wGrxc2rdQVgDCctNdt72UR/Hj4wteK7XIX6fF43+7FYKBZnPtyWIWalwDniH//H3gfsJ+ULqSb82w=]
|
||||
|
||||
+1
-23
@@ -146,8 +146,6 @@ lookup_options:
|
||||
strategy: deep
|
||||
profiles::etcd::node::initial_cluster_token:
|
||||
convert_to: Sensitive
|
||||
profiles::dns::updater::key_secret:
|
||||
convert_to: Sensitive
|
||||
sysctl::base::values:
|
||||
merge:
|
||||
strategy: deep
|
||||
@@ -208,28 +206,8 @@ vault::manage_config_dir: true
|
||||
vault::disable_mlock: false
|
||||
|
||||
profiles::dns::base::nameservers:
|
||||
- 198.18.200.7
|
||||
- 198.18.19.16
|
||||
profiles::dns::master::basedir: '/var/named/sources'
|
||||
|
||||
# dns record publishing. During the k8s cutover both methods run; set
|
||||
# manage_export false once k8s is authoritative.
|
||||
# - export: legacy exported-resources -> puppet DNS master
|
||||
# - nsupdate: RFC2136 to the k8s bind-authoritative write endpoint (.9),
|
||||
# inert until the TSIG key is set in eyaml:
|
||||
# profiles::dns::updater::key_secret: ENC[...]
|
||||
# (must match the key the bind-authoritative zones allow-update
|
||||
# with; algorithm hmac-sha256)
|
||||
# k8s is now authoritative: clients resolve via the k8s bind-resolvers
|
||||
# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the
|
||||
# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s
|
||||
# bind-authoritative cluster fed by the nsupdate path below. The legacy
|
||||
# exported-resources -> VM-master /var/named/sources files are no longer in any
|
||||
# client's resolution path, so stop exporting them. Rollback: set back to true.
|
||||
profiles::dns::updater::manage_export: false
|
||||
profiles::dns::updater::manage_nsupdate: true
|
||||
profiles::dns::updater::server: '198.18.200.9'
|
||||
profiles::dns::updater::key_name: 'client-update'
|
||||
profiles::dns::updater::key_algorithm: 'hmac-sha256'
|
||||
#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
|
||||
#profiles::dns::base::use_ns: 'region'
|
||||
profiles::consul::server::members_role: roles::infra::storage::consul
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
timezone::timezone: 'Australia/Sydney'
|
||||
certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
|
||||
profiles_dns_upstream_forwarder_unkin:
|
||||
- 198.18.200.7
|
||||
- 198.18.19.15
|
||||
profiles_dns_upstream_forwarder_consul:
|
||||
- 198.18.19.14
|
||||
profiles_dns_upstream_forwarder_k8s:
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
---
|
||||
# Canary for the puppet-on-k8s migration (roles::base test host).
|
||||
profiles::puppet::migrate::enabled: true
|
||||
@@ -70,34 +70,12 @@ profiles::yum::global::repos:
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
|
||||
mirrorlist: absent
|
||||
rpm-internal:
|
||||
name: rpm-internal
|
||||
descr: rpm-internal repository
|
||||
target: /etc/yum.repos.d/rpm-internal.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
rpm-vendor:
|
||||
name: rpm-vendor
|
||||
descr: rpm-vendor repository
|
||||
target: /etc/yum.repos.d/rpm-vendor.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
# Per-release variants, resolved from the host's EL major version so el8
|
||||
# hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
|
||||
rpm-internal-release:
|
||||
name: rpm-internal-el%{facts.os.release.major}
|
||||
descr: rpm-internal-el%{facts.os.release.major} repository
|
||||
target: /etc/yum.repos.d/rpm-internal-release.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
rpm-vendor-release:
|
||||
name: rpm-vendor-el%{facts.os.release.major}
|
||||
descr: rpm-vendor-el%{facts.os.release.major} repository
|
||||
target: /etc/yum.repos.d/rpm-vendor-release.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
|
||||
unkinben:
|
||||
name: unkinben
|
||||
descr: unkinben repository
|
||||
target: /etc/yum.repos.d/unkin.repo
|
||||
baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
|
||||
gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
|
||||
@@ -269,8 +247,8 @@ profiles::yum::global::repos:
|
||||
name: rpmfusion-free
|
||||
descr: rpmfusion-free repository
|
||||
target: /etc/yum.repos.d/rpmfusion-free.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
|
||||
baseurl: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/
|
||||
gpgkey: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
|
||||
gpgcheck: 1
|
||||
mirrorlist: absent
|
||||
rpmfusion-nonfree:
|
||||
@@ -278,7 +256,15 @@ profiles::yum::global::repos:
|
||||
name: rpmfusion-nonfree
|
||||
descr: rpmfusion-nonfree repository
|
||||
target: /etc/yum.repos.d/rpmfusion-nonfree.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
|
||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
|
||||
baseurl: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/
|
||||
gpgkey: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
|
||||
gpgcheck: 1
|
||||
mirrorlist: absent
|
||||
unkin:
|
||||
name: unkin
|
||||
descr: unkin repository
|
||||
target: /etc/yum.repos.d/unkin.repo
|
||||
baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el%{facts.os.release.major}
|
||||
gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
|
||||
@@ -1,69 +0,0 @@
|
||||
# hieradata/os/Fedora/all_releases.yaml
|
||||
---
|
||||
# Fedora reuses the RedHat osfamily code paths (dnf/yum, crypto-policies,
|
||||
# firewalld, openvox). Everything here keys off facts.os.release.major so a
|
||||
# future Fedora release only needs its artifactapi local repos created, not new
|
||||
# hieradata.
|
||||
|
||||
# crypto-policies: use the distro default. Kept here (not per-release) so newer
|
||||
# Fedora releases inherit it for free.
|
||||
crypto_policies::policy: 'DEFAULT'
|
||||
|
||||
# Puppet agent via OpenVox. RedHat-family builds for Fedora live under
|
||||
# openvox7/fedora/<major> (see profiles::puppet::agent).
|
||||
profiles::puppet::agent::openvox_enable: true
|
||||
|
||||
lm-sensors::package: lm_sensors
|
||||
|
||||
# Fedora-specific base setup (NetworkManager, future workstation/laptop hooks).
|
||||
hiera_include:
|
||||
- profiles::fedora::base
|
||||
|
||||
# Base package set adjustments for Fedora:
|
||||
# - p7zip was dropped from Fedora; the real 7-Zip ships as "7zip"
|
||||
# - dstat was removed from Fedora with no drop-in successor in the base set
|
||||
# - iotop is provided by the C rewrite package "iotop-c"
|
||||
profiles::packages::exclude:
|
||||
- p7zip
|
||||
- dstat
|
||||
- iotop
|
||||
profiles::packages::include:
|
||||
7zip: {}
|
||||
iotop-c: {}
|
||||
crypto-policies-scripts: {}
|
||||
lzo: {}
|
||||
policycoreutils: {}
|
||||
unar: {}
|
||||
xz: {}
|
||||
|
||||
profiles::yum::global::repos:
|
||||
fedora:
|
||||
name: fedora
|
||||
descr: Fedora %{facts.os.release.major} - %{facts.os.architecture}
|
||||
target: /etc/yum.repos.d/fedora.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/%{facts.os.release.major}/Everything/%{facts.os.architecture}/os/
|
||||
gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
|
||||
metalink: absent
|
||||
mirrorlist: absent
|
||||
updates:
|
||||
name: updates
|
||||
descr: Fedora %{facts.os.release.major} - %{facts.os.architecture} - Updates
|
||||
target: /etc/yum.repos.d/fedora-updates.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/%{facts.os.release.major}/Everything/%{facts.os.architecture}/
|
||||
gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
|
||||
metalink: absent
|
||||
mirrorlist: absent
|
||||
rpm-internal:
|
||||
name: rpm-internal-f%{facts.os.release.major}
|
||||
descr: rpm-internal-f%{facts.os.release.major} repository
|
||||
target: /etc/yum.repos.d/rpm-internal.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f%{facts.os.release.major}/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
rpm-vendor:
|
||||
name: rpm-vendor-f%{facts.os.release.major}
|
||||
descr: rpm-vendor-f%{facts.os.release.major} repository
|
||||
target: /etc/yum.repos.d/rpm-vendor.repo
|
||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f%{facts.os.release.major}/
|
||||
gpgcheck: false
|
||||
mirrorlist: absent
|
||||
@@ -57,3 +57,5 @@ profiles::yum::global::repos:
|
||||
ensure: present
|
||||
rpmfusion-nonfree:
|
||||
ensure: present
|
||||
unkinben:
|
||||
ensure: present
|
||||
|
||||
@@ -14,9 +14,6 @@ profiles::pki::vault::alt_names:
|
||||
- radosgw.service.consul
|
||||
- radosgw.query.consul
|
||||
- "radosgw.service.%{facts.country}-%{facts.region}.consul"
|
||||
# S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
|
||||
# on the cert so TLS validates for that hostname.
|
||||
- s3.ceph.unkin.net
|
||||
|
||||
# additional repos
|
||||
profiles::yum::global::repos:
|
||||
@@ -29,8 +26,6 @@ profiles::yum::global::repos:
|
||||
profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
|
||||
profiles::nginx::simpleproxy::nginx_aliases:
|
||||
- radosgw.service.au-syd1.consul
|
||||
# nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
|
||||
- s3.ceph.unkin.net
|
||||
profiles::nginx::simpleproxy::proxy_port: 7480
|
||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||
nginx::client_max_body_size: 5000M
|
||||
|
||||
@@ -12,61 +12,6 @@ hiera_include:
|
||||
rke2::bootstrap_node: prodnxsr0001.main.unkin.net
|
||||
rke2::join_url: https://join-k8s.service.consul:9345
|
||||
rke2::manage_registries: true
|
||||
rke2::registries:
|
||||
docker.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "dockerhub/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
ghcr.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "ghcr/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
quay.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "quay/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
registry.k8s.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "k8s-registry/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
registry.gitlab.com:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "gitlab/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
docker.elastic.co:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "elastic/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
gcr.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "gcr/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
docker.litellm.ai:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "litellm/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
public.ecr.aws:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "ecr-public/$1"
|
||||
disable-default-registry-endpoint: true
|
||||
rke2::config_hash:
|
||||
bind-address: "%{hiera('networking_loopback0_ip')}"
|
||||
node-ip: "%{hiera('networking_loopback0_ip')}"
|
||||
|
||||
@@ -27,16 +27,4 @@ profiles::nginx::simpleproxy::proxy_port: 8200
|
||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||
|
||||
profiles::packages::include:
|
||||
# openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
|
||||
openbao-plugins: {}
|
||||
# Secrets plugins pinned to the exact version whose binary matches the sha256
|
||||
# registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
|
||||
# on upgrade, or OpenBao refuses to launch the plugin after a restart.
|
||||
openbao-plugin-secrets-litellm:
|
||||
ensure: '0.1.1'
|
||||
openbao-plugin-secrets-gpg:
|
||||
ensure: '0.1.0'
|
||||
openbao-plugin-secrets-rancher:
|
||||
ensure: '0.1.1'
|
||||
openbao-plugin-secrets-gitea:
|
||||
ensure: '0.1.0'
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'facter'
|
||||
|
||||
Facter.add(:ceph_osd_devices) do
|
||||
confine kernel: 'Linux'
|
||||
confine { Facter.value(:is_virtual) == false }
|
||||
confine { Facter::Core::Execution.which('pvs') }
|
||||
setcode do
|
||||
devices = []
|
||||
output = Facter::Core::Execution.execute(
|
||||
'pvs --noheadings -o pv_name,vg_name 2>/dev/null',
|
||||
on_fail: nil
|
||||
)
|
||||
output&.each_line do |line|
|
||||
pv_name, vg_name = line.split
|
||||
next unless pv_name && vg_name
|
||||
|
||||
devices << pv_name if vg_name.start_with?('ceph-')
|
||||
end
|
||||
devices.sort
|
||||
end
|
||||
end
|
||||
@@ -1,88 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
# lib/facter/dns_records.rb
|
||||
#
|
||||
# Reports this host's expected DNS records (assembled by profiles::dns::updater
|
||||
# into its records file) versus what is currently deployed on the authoritative
|
||||
# server, so puppet can detect drift and re-apply.
|
||||
#
|
||||
# Structured value:
|
||||
# { server, count, expected => [{zone,fqdn,type,ttl,value}], in_sync,
|
||||
# drift => [{...,deployed => [...]}] }
|
||||
|
||||
# Helpers for the dns_records fact.
|
||||
module DnsRecordsFact
|
||||
RECORDS_FILE = '/var/lib/dns-updater/records'
|
||||
SERVER_FILE = '/var/lib/dns-updater/server'
|
||||
|
||||
module_function
|
||||
|
||||
# normalise a value for comparison: strip, drop trailing dot, downcase
|
||||
def norm(value)
|
||||
value.to_s.strip.chomp('.').downcase
|
||||
end
|
||||
|
||||
def server
|
||||
File.exist?(SERVER_FILE) ? File.read(SERVER_FILE).strip : nil
|
||||
end
|
||||
|
||||
# a name relative to a zone (or @) as a fully-qualified name
|
||||
def to_fqdn(name, zone)
|
||||
return "#{zone}." if name.to_s.empty? || name == '@'
|
||||
|
||||
"#{name}.#{zone}."
|
||||
end
|
||||
|
||||
# parse one "zone|name|type|ttl|value" line into a record hash (nil to skip)
|
||||
def parse_line(line)
|
||||
line = line.strip
|
||||
return nil if line.empty? || line.start_with?('#')
|
||||
|
||||
zone, name, type, ttl, value = line.split('|', 5)
|
||||
return nil unless zone && type && value
|
||||
|
||||
{ 'zone' => zone, 'fqdn' => to_fqdn(name, zone), 'type' => type, 'ttl' => ttl, 'value' => value }
|
||||
end
|
||||
|
||||
# parse the records file into record hashes
|
||||
def expected
|
||||
return [] unless File.exist?(RECORDS_FILE)
|
||||
|
||||
File.readlines(RECORDS_FILE).filter_map { |line| parse_line(line) }
|
||||
end
|
||||
|
||||
# the values currently deployed for a record, per the authoritative server
|
||||
def deployed(record, srv)
|
||||
cmd = ['dig', '+short', '+time=2', '+tries=1']
|
||||
cmd << "@#{srv}" if srv && !srv.empty?
|
||||
cmd += [record['fqdn'], record['type']]
|
||||
out = Facter::Core::Execution.execute(cmd.join(' '), on_fail: '')
|
||||
out.to_s.split("\n").map { |line| norm(line) }.reject(&:empty?)
|
||||
end
|
||||
|
||||
def report
|
||||
srv = server
|
||||
exp = expected
|
||||
drift = exp.filter_map do |record|
|
||||
dep = deployed(record, srv)
|
||||
record.merge('deployed' => dep) unless dep.include?(norm(record['value']))
|
||||
end
|
||||
{ 'server' => srv, 'count' => exp.length, 'expected' => exp, 'in_sync' => drift.empty?, 'drift' => drift }
|
||||
end
|
||||
end
|
||||
|
||||
Facter.add(:dns_records) do
|
||||
confine kernel: 'Linux'
|
||||
setcode do
|
||||
File.exist?(DnsRecordsFact::RECORDS_FILE) ? DnsRecordsFact.report : nil
|
||||
end
|
||||
end
|
||||
|
||||
# Convenience boolean for `if $facts['dns_records_insync']` guards.
|
||||
Facter.add(:dns_records_insync) do
|
||||
confine kernel: 'Linux'
|
||||
setcode do
|
||||
v = Facter.value(:dns_records)
|
||||
v.nil? ? nil : v['in_sync']
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,38 @@
|
||||
---
|
||||
# DO NOT MODIFY - MANAGED BY PUPPET
|
||||
mirrors:
|
||||
docker.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "dockerhub/$1"
|
||||
ghcr.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "ghcr/$1"
|
||||
quay.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "quay/$1"
|
||||
registry.k8s.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "k8s-registry/$1"
|
||||
registry.gitlab.com:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "gitlab/$1"
|
||||
docker.elastic.co:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "elastic/$1"
|
||||
gcr.io:
|
||||
endpoint:
|
||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
rewrite:
|
||||
"^(.*)$": "gcr/$1"
|
||||
@@ -8,7 +8,6 @@ class rke2::config (
|
||||
String $node_token = $rke2::node_token,
|
||||
Array[String[1]] $extra_config_files = $rke2::extra_config_files,
|
||||
Boolean $manage_registries = $rke2::manage_registries,
|
||||
Hash $registries = $rke2::registries,
|
||||
){
|
||||
|
||||
# if its not the bootstrap node, add join path to config
|
||||
@@ -36,7 +35,7 @@ class rke2::config (
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => epp('rke2/registries.yaml.epp', { registries => $registries }),
|
||||
source => 'puppet:///modules/rke2/registries.yaml',
|
||||
require => Package["rke2-${node_type}"],
|
||||
notify => Service["rke2-${node_type}"],
|
||||
}
|
||||
|
||||
@@ -13,7 +13,6 @@ class rke2 (
|
||||
Array[String[1]] $extra_config_files = $rke2::params::extra_config_files,
|
||||
Stdlib::HTTPUrl $container_archive_source = $rke2::params::container_archive_source,
|
||||
Boolean $manage_registries = $rke2::params::manage_registries,
|
||||
Hash $registries = $rke2::params::registries,
|
||||
) inherits rke2::params {
|
||||
|
||||
include rke2::install
|
||||
|
||||
@@ -13,5 +13,4 @@ class rke2::params (
|
||||
Array[String[1]] $extra_config_files = [],
|
||||
Stdlib::HTTPUrl $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
|
||||
Boolean $manage_registries = false,
|
||||
Hash $registries = {},
|
||||
) {}
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
<%- | Hash $registries | -%>
|
||||
---
|
||||
# DO NOT MODIFY - MANAGED BY PUPPET
|
||||
mirrors:
|
||||
<%- $registries.each |$registry, $config| { -%>
|
||||
<%= $registry %>:
|
||||
endpoint:
|
||||
<%- $config['endpoint'].each |$ep| { -%>
|
||||
- "<%= $ep %>"
|
||||
<%- } -%>
|
||||
<%- if $config['rewrite'] { -%>
|
||||
rewrite:
|
||||
<%- $config['rewrite'].each |$pattern, $replacement| { -%>
|
||||
"<%= $pattern %>": "<%= $replacement %>"
|
||||
<%- } -%>
|
||||
<%- } -%>
|
||||
<%- if $config['disable-default-registry-endpoint'] { -%>
|
||||
disable-default-registry-endpoint: true
|
||||
<%- } -%>
|
||||
<%- } -%>
|
||||
@@ -12,9 +12,6 @@ class profiles::base () {
|
||||
# manage the puppet agent
|
||||
include profiles::puppet::agent
|
||||
include profiles::puppet::client
|
||||
# k8s migration switch; ships disabled, flip its ::enabled boolean in
|
||||
# hiera (node/role/common) to repoint a target onto puppet-on-k8s.
|
||||
include profiles::puppet::migrate
|
||||
|
||||
# include the base profiles
|
||||
include profiles::base::repos
|
||||
|
||||
@@ -68,10 +68,7 @@ class profiles::cobbler::config {
|
||||
# export cnames for cobbler
|
||||
if $is_cobbler_master {
|
||||
profiles::dns::record { "${::facts['networking']['fqdn']}_${service_cname}_CNAME":
|
||||
# CNAME target must be a fully-qualified name (trailing dot): dns-updater
|
||||
# parses the value with no $ORIGIN, so a bare label becomes root-absolute
|
||||
# ("ausyd1nxvm2098.") and dead-ends in NXDOMAIN.
|
||||
value => "${::facts['networking']['fqdn']}.",
|
||||
value => $::facts['networking']['hostname'],
|
||||
type => 'CNAME',
|
||||
record => "${service_cname}.",
|
||||
zone => $::facts['networking']['domain'],
|
||||
|
||||
@@ -11,12 +11,9 @@ class profiles::dns::base (
|
||||
Optional[String] $ns_role = undef,
|
||||
){
|
||||
|
||||
# install bind_utils (provides nsupdate)
|
||||
# install bind_utils
|
||||
include bind::updater
|
||||
|
||||
# assemble the host's DNS records and nsupdate them to the authoritative server
|
||||
include profiles::dns::updater
|
||||
|
||||
# if ns_role is set, find all hosts matching that enc_role
|
||||
$nameserver_array = $ns_role ? {
|
||||
undef => $nameservers,
|
||||
|
||||
@@ -1,10 +1,4 @@
|
||||
# profiles::dns::record
|
||||
#
|
||||
# Declares a DNS record for this host. Publishes it via either or both methods,
|
||||
# controlled by profiles::dns::updater's toggles (both on during cutover):
|
||||
# - nsupdate: a local concat fragment consumed by profiles::dns::updater,
|
||||
# which nsupdates it to the authoritative server.
|
||||
# - export: the legacy @@concat::fragment exported to the puppet DNS master.
|
||||
# defines the base record that will be exported
|
||||
define profiles::dns::record (
|
||||
String $record,
|
||||
Enum[
|
||||
@@ -19,26 +13,11 @@ define profiles::dns::record (
|
||||
String $value,
|
||||
String $zone,
|
||||
Integer $order,
|
||||
Integer $ttl = 300,
|
||||
Stdlib::AbsolutePath $basedir = lookup('profiles::dns::master::basedir'),
|
||||
) {
|
||||
include profiles::dns::updater
|
||||
|
||||
# new: local records file consumed by the nsupdate service
|
||||
if $profiles::dns::updater::manage_nsupdate {
|
||||
# zone|name|type|ttl|value (parsed by the dns-update script)
|
||||
concat::fragment { "dns-record-${name}":
|
||||
target => $profiles::dns::updater::records_file,
|
||||
content => "${zone}|${record}|${type}|${ttl}|${value}\n",
|
||||
order => sprintf('%03d', $order),
|
||||
}
|
||||
}
|
||||
|
||||
# legacy: export the fragment to the puppet DNS master
|
||||
if $profiles::dns::updater::manage_export {
|
||||
@@concat::fragment { "${zone}_${name}":
|
||||
target => "${profiles::dns::updater::master_basedir}/${zone}.conf",
|
||||
content => "${record} IN ${type} ${value}\n",
|
||||
order => $order,
|
||||
}
|
||||
@@concat::fragment { "${zone}_${name}":
|
||||
target => "${basedir}/${zone}.conf",
|
||||
content => "${record} IN ${type} ${value}\n",
|
||||
order => $order,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,173 +0,0 @@
|
||||
# profiles::dns::updater
|
||||
#
|
||||
# Publishes this host's DNS records. Two methods, independently toggled so both
|
||||
# can run during the k8s cutover (profiles::dns::record honours the same flags):
|
||||
#
|
||||
# - nsupdate ($manage_nsupdate): assemble the records into a local file and
|
||||
# nsupdate them to the k8s authoritative write endpoint via a systemd .path
|
||||
# unit that watches the file. Inert until $key_secret (TSIG) is set.
|
||||
# - export ($manage_export): the legacy exported-resources flow to the puppet
|
||||
# DNS master. Kept during cutover; disable once k8s is authoritative.
|
||||
#
|
||||
# nsupdate comes from bind-utils (installed via bind::updater in
|
||||
# profiles::dns::base).
|
||||
class profiles::dns::updater (
|
||||
Boolean $manage_nsupdate = true,
|
||||
Boolean $manage_export = true,
|
||||
String $server = '198.18.200.9',
|
||||
String $key_name = 'client-update',
|
||||
String $key_algorithm = 'hmac-sha256',
|
||||
Optional[Sensitive[String]] $key_secret = undef,
|
||||
Integer $default_ttl = 300,
|
||||
Stdlib::AbsolutePath $records_file = '/var/lib/dns-updater/records',
|
||||
Stdlib::AbsolutePath $state_dir = '/var/lib/dns-updater',
|
||||
Stdlib::AbsolutePath $config_dir = '/etc/dns-updater',
|
||||
Stdlib::AbsolutePath $master_basedir = lookup('profiles::dns::master::basedir'),
|
||||
# dns-updater daemon (replaces the dns-update shell script). 'latest' so hosts
|
||||
# pick up new releases (e.g. the record filter); rpm-internal metadata_expire
|
||||
# is 1h so this does not thrash.
|
||||
String $package_ensure = 'latest',
|
||||
Stdlib::AbsolutePath $api_socket = '/run/dns-updater/api.sock',
|
||||
String $resync = '10m',
|
||||
Enum['debug', 'info', 'warn', 'error'] $log_level = 'info',
|
||||
Boolean $watch_interfaces = true,
|
||||
# Never publish records whose address falls in these ranges: the k8s pod CIDR
|
||||
# (10.42.0.0/16) and service CIDR (10.43.0.0/16), the LB VIP pool
|
||||
# (198.18.200.0/24) and 198.18.199.0/24. Keeps kube-lb0/flannel/etc. out of
|
||||
# the authoritative zones and stops NOTAUTH updates for zones we do not host.
|
||||
Array[String] $deny_ranges = ['198.18.199.0/24', '198.18.200.0/24', '10.42.0.0/16', '10.43.0.0/16'],
|
||||
Array[String] $allow_ranges = [],
|
||||
Array[String] $deny_domains = [],
|
||||
Array[String] $allow_domains = [],
|
||||
) {
|
||||
|
||||
$state_file = "${state_dir}/applied"
|
||||
$server_file = "${state_dir}/server"
|
||||
$key_file = "${config_dir}/key"
|
||||
|
||||
if $manage_nsupdate {
|
||||
|
||||
file { $state_dir:
|
||||
ensure => directory,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0755',
|
||||
}
|
||||
|
||||
# Server address, read by the dns_records fact for drift detection.
|
||||
file { $server_file:
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => "${server}\n",
|
||||
require => File[$state_dir],
|
||||
}
|
||||
|
||||
# Records file, assembled from profiles::dns::record fragments.
|
||||
concat { $records_file:
|
||||
ensure => present,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
ensure_newline => true,
|
||||
warn => false,
|
||||
require => File[$state_dir],
|
||||
}
|
||||
|
||||
concat::fragment { 'dns-update-header':
|
||||
target => $records_file,
|
||||
content => "# Managed by puppet (profiles::dns::record): zone|name|type|ttl|value\n",
|
||||
order => '00',
|
||||
}
|
||||
|
||||
if $key_secret =~ Undef {
|
||||
notify { 'dns-updater-inert':
|
||||
message => 'profiles::dns::updater: key_secret unset; records assembled but not applied.',
|
||||
loglevel => 'info',
|
||||
}
|
||||
} else {
|
||||
file { $config_dir:
|
||||
ensure => directory,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0700',
|
||||
}
|
||||
|
||||
file { $key_file:
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0600',
|
||||
show_diff => false,
|
||||
content => Sensitive(epp('profiles/dns/tsig-key.epp', {
|
||||
'name' => $key_name,
|
||||
'algorithm' => $key_algorithm,
|
||||
'secret' => $key_secret.unwrap,
|
||||
})),
|
||||
}
|
||||
|
||||
# dns-updater daemon: watches the records file (inotify) and network
|
||||
# interfaces, pushes TSIG-signed RFC2136 updates to $server natively.
|
||||
package { 'dns-updater':
|
||||
ensure => $package_ensure,
|
||||
}
|
||||
|
||||
$deny_ranges_str = join($deny_ranges, ',')
|
||||
$allow_ranges_str = join($allow_ranges, ',')
|
||||
$deny_domains_str = join($deny_domains, ',')
|
||||
$allow_domains_str = join($allow_domains, ',')
|
||||
|
||||
$env_content = @("ENV")
|
||||
# Managed by puppet (profiles::dns::updater).
|
||||
DNS_UPDATER_SERVER=${server}
|
||||
DNS_UPDATER_KEY_FILE=${key_file}
|
||||
DNS_UPDATER_RECORDS_FILE=${records_file}
|
||||
DNS_UPDATER_STATE_FILE=${state_file}
|
||||
DNS_UPDATER_API=${api_socket}
|
||||
DNS_UPDATER_RESYNC=${resync}
|
||||
DNS_UPDATER_WATCH_INTERFACES=${watch_interfaces}
|
||||
DNS_UPDATER_LOG_LEVEL=${log_level}
|
||||
DNS_UPDATER_DENY_RANGES=${deny_ranges_str}
|
||||
DNS_UPDATER_ALLOW_RANGES=${allow_ranges_str}
|
||||
DNS_UPDATER_DENY_DOMAINS=${deny_domains_str}
|
||||
DNS_UPDATER_ALLOW_DOMAINS=${allow_domains_str}
|
||||
| ENV
|
||||
|
||||
file { "${config_dir}/env":
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => $env_content,
|
||||
require => [File[$config_dir], Package['dns-updater']],
|
||||
}
|
||||
|
||||
# Restart only on config/key change; records-file changes are picked up by
|
||||
# the daemon's own inotify watch, so no service churn on record edits.
|
||||
service { 'dns-updater':
|
||||
ensure => running,
|
||||
enable => true,
|
||||
subscribe => [File["${config_dir}/env"], File[$key_file]],
|
||||
require => [Package['dns-updater'], Concat[$records_file], File[$key_file]],
|
||||
}
|
||||
|
||||
# Retire the previous shell-based mechanism.
|
||||
file { '/usr/local/bin/dns-update':
|
||||
ensure => absent,
|
||||
}
|
||||
|
||||
systemd::unit_file { 'dns-update.service':
|
||||
ensure => absent,
|
||||
active => false,
|
||||
enable => false,
|
||||
}
|
||||
|
||||
systemd::unit_file { 'dns-update.path':
|
||||
ensure => absent,
|
||||
active => false,
|
||||
enable => false,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
# base fedora settings
|
||||
#
|
||||
# Fedora hosts share the RedHat-family base profiles (yum/dnf, crypto-policies,
|
||||
# firewalld); this class carries the handful of Fedora-specific bits. Kept
|
||||
# deliberately small so it can grow into workstation/laptop (e.g. sway) support
|
||||
# later without disturbing servers.
|
||||
class profiles::fedora::base {
|
||||
# Fedora manages interfaces through NetworkManager. Ensure it is enabled and
|
||||
# running (some minimal and cloud images ship it disabled).
|
||||
service { 'NetworkManager':
|
||||
ensure => running,
|
||||
enable => true,
|
||||
}
|
||||
}
|
||||
@@ -21,10 +21,7 @@ class profiles::haproxy::dns (
|
||||
$parts = split($cname, '\.')
|
||||
$domain = join($parts[1, $parts.length], '.')
|
||||
profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
|
||||
# CNAME target must be a fully-qualified name (trailing dot): dns-updater
|
||||
# parses the value with no $ORIGIN, so a bare label becomes root-absolute
|
||||
# ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
|
||||
value => "${location_environment}-halb.${facts['networking']['domain']}.",
|
||||
value => "${location_environment}-halb",
|
||||
type => 'CNAME',
|
||||
record => "${cname}.",
|
||||
zone => $domain,
|
||||
@@ -61,10 +58,7 @@ class profiles::haproxy::dns (
|
||||
$parts = split($cname, '\.')
|
||||
$domain = join($parts[1, $parts.length], '.')
|
||||
profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
|
||||
# Fully-qualified target (trailing dot); see the note on the non-vrrp
|
||||
# cnames above. The matching A record is published in main.unkin.net
|
||||
# and unkin.net just above.
|
||||
value => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
|
||||
value => "${location_environment}-halb-vrrp",
|
||||
type => 'CNAME',
|
||||
record => "${cname}.",
|
||||
zone => $domain,
|
||||
|
||||
@@ -16,18 +16,11 @@ class profiles::puppet::agent (
|
||||
$use_service = 'puppet'
|
||||
}
|
||||
|
||||
# OpenVox publishes RedHat-family builds per distribution: enterprise-linux
|
||||
# under el/<major>, Fedora under fedora/<major>.
|
||||
$openvox_dist = $facts['os']['name'] ? {
|
||||
'Fedora' => 'fedora',
|
||||
default => 'el',
|
||||
}
|
||||
|
||||
# manage the yumrepo for the given package
|
||||
if $openvox_enable and $facts['os']['family'] == 'RedHat' {
|
||||
yumrepo { 'openvox':
|
||||
ensure => 'present',
|
||||
baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/${openvox_dist}/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
|
||||
baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/el/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
|
||||
descr => 'openvox repository',
|
||||
gpgkey => 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub',
|
||||
notify => Exec['dnf_makecache'],
|
||||
|
||||
@@ -4,64 +4,19 @@
|
||||
#
|
||||
# site/profile/manifests/puppet/client.pp
|
||||
class profiles::puppet::client (
|
||||
Array $dns_alt_names = [$trusted['certname']],
|
||||
String $server = 'puppetmaster',
|
||||
String $ca_server = 'puppetca',
|
||||
Optional[String] $report_server = undef,
|
||||
String $environment = 'develop',
|
||||
Integer $runinterval = 1800,
|
||||
Integer $runtimeout = 3600,
|
||||
Boolean $show_diff = true,
|
||||
Boolean $usecacheonfailure = false,
|
||||
Integer $facts_soft_limit = 4096,
|
||||
Boolean $splay = true,
|
||||
Integer $splaylimit = 600,
|
||||
Optional[Stdlib::Absolutepath] $ssldir = undef,
|
||||
Array $dns_alt_names = [$trusted['certname']],
|
||||
String $server = 'puppetmaster',
|
||||
String $ca_server = 'puppetca',
|
||||
String $environment = 'develop',
|
||||
Integer $runinterval = 1800,
|
||||
Integer $runtimeout = 3600,
|
||||
Boolean $show_diff = true,
|
||||
Boolean $usecacheonfailure = false,
|
||||
Integer $facts_soft_limit = 4096,
|
||||
Boolean $splay = true,
|
||||
Integer $splaylimit = 600,
|
||||
) {
|
||||
|
||||
# Pull in the k8s-migration switch. When
|
||||
# profiles::puppet::migrate::enabled is true at ANY hiera layer
|
||||
# (node/role/common) the effective endpoints below flip to the k8s
|
||||
# servers and a fresh ssldir -- no other hiera keys required. This class
|
||||
# never includes client.pp, so there is no include cycle.
|
||||
include profiles::puppet::migrate
|
||||
|
||||
# Effective values fed to the template. Precedence differs by param type:
|
||||
#
|
||||
# ssldir / report_server (Optional, default undef): an explicit client
|
||||
# param wins; else the migrate-derived value when enabled; else the
|
||||
# legacy default (undef -> template omits ssldir; report_server -> server).
|
||||
#
|
||||
# server / ca_server (String, no undef sentinel): the migrate value wins
|
||||
# when migrate::enabled, otherwise the client param (which is the legacy
|
||||
# default unless an operator set it explicitly in hiera). To pin a
|
||||
# bespoke server while enabled, leave enabled => false for that target
|
||||
# and set profiles::puppet::client::server directly.
|
||||
$migrate_on = $profiles::puppet::migrate::enabled
|
||||
|
||||
$effective_server = $migrate_on ? {
|
||||
true => $profiles::puppet::migrate::new_server,
|
||||
default => $server,
|
||||
}
|
||||
$effective_ca_server = $migrate_on ? {
|
||||
true => $profiles::puppet::migrate::new_ca_server,
|
||||
default => $ca_server,
|
||||
}
|
||||
# report_server: explicit param wins; else follow the effective server.
|
||||
$effective_report_server = $report_server ? {
|
||||
undef => $effective_server,
|
||||
default => $report_server,
|
||||
}
|
||||
# ssldir: explicit param wins; else the fresh k8s ssldir when migrating;
|
||||
# else undef (template omits the key, i.e. puppet's built-in default).
|
||||
$effective_ssldir = $ssldir ? {
|
||||
undef => $migrate_on ? {
|
||||
true => $profiles::puppet::migrate::new_ssldir,
|
||||
default => undef,
|
||||
},
|
||||
default => $ssldir,
|
||||
}
|
||||
|
||||
# dont manage puppet.conf if this is a puppetmaster
|
||||
if $facts['enc_role'] != 'roles::infra::puppet::master' {
|
||||
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
# Class: profiles::puppet::migrate
|
||||
#
|
||||
# Repoints a VM puppet agent from the legacy VM puppetmasters onto the new
|
||||
# puppet-on-kubernetes servers.
|
||||
#
|
||||
# The agent's existing ssldir holds a client certificate signed by the OLD CA;
|
||||
# the new k8s CA will neither trust that cert nor recognise the agent. Rather
|
||||
# than revoke/clean the old creds (which would burn the rollback path), this
|
||||
# class switches the agent to a FRESH ssldir. On the next run the agent finds
|
||||
# an empty ssldir, generates a new key + CSR, submits it to the new CA
|
||||
# (autosign = true on the k8s side signs it immediately), and then pulls its
|
||||
# catalog from the new compilers. The OLD ssldir is left untouched on disk, so
|
||||
# reverting the hiera below restores the node to the legacy masters with no
|
||||
# re-enrolment.
|
||||
#
|
||||
# The catalog that performs the switch is compiled by the OLD server (the node
|
||||
# still points at it when it applies this change). profiles::puppet::client
|
||||
# rewrites puppet.conf with the new server / ca_server / report_server / ssldir
|
||||
# and notifies Service['puppet'], so the very next agent run lands on k8s.
|
||||
#
|
||||
# NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
|
||||
# out and rolled back one target at a time. The class only manages the fresh
|
||||
# ssldir; the actual puppet.conf changes ride on profiles::puppet::client's
|
||||
# existing template. client.pp `include`s this class and, when enabled, folds
|
||||
# new_server / new_ca_server / new_ssldir into the effective server /
|
||||
# ca_server / report_server / ssldir it renders. Do NOT add a second File
|
||||
# resource for puppet.conf here -- client.pp already owns it.
|
||||
#
|
||||
# == Wiring (single boolean)
|
||||
#
|
||||
# This class ships wired into profiles::base with enabled => false, so every
|
||||
# node evaluates it but nothing changes until the boolean is flipped. Because
|
||||
# client.pp includes it and reads its params, setting the ONE key below at any
|
||||
# hiera layer repoints a target -- no client.pp param overrides needed.
|
||||
#
|
||||
# The endpoints (new_server / new_ca_server / new_ssldir) are param defaults
|
||||
# on this class; override them in hiera too if the k8s names ever change.
|
||||
#
|
||||
# --- Canary: one node -> hieradata/nodes/<certname>.yaml -------------------
|
||||
# profiles::puppet::migrate::enabled: true
|
||||
# ---------------------------------------------------------------------------
|
||||
#
|
||||
# --- Wave: a whole role -> hieradata/roles/<t1>/<t2>[/<t3>].yaml -----------
|
||||
# profiles::puppet::migrate::enabled: true
|
||||
# ---------------------------------------------------------------------------
|
||||
#
|
||||
# --- Estate flip -> hieradata/common.yaml (retires the legacy masters) -----
|
||||
# profiles::puppet::migrate::enabled: true
|
||||
# ---------------------------------------------------------------------------
|
||||
#
|
||||
# Manual override: profiles::puppet::client::ssldir and ::report_server are
|
||||
# Optional and, when set explicitly in hiera, win over the migrate-derived
|
||||
# value. server / ca_server have no undef sentinel, so while enabled => true
|
||||
# the migrate endpoints win; to point a target at a bespoke server leave
|
||||
# enabled => false for it and set profiles::puppet::client::server directly.
|
||||
#
|
||||
# == Rollback (per target)
|
||||
#
|
||||
# Remove the profiles::puppet::migrate::enabled key (or set it back to false)
|
||||
# at the node/role/common layer. The next run rewrites puppet.conf back to the
|
||||
# legacy server + legacy ssldir, which still contains the original CA-signed
|
||||
# cert, and the node is back on the VM masters.
|
||||
#
|
||||
# site/profiles/manifests/puppet/migrate.pp
|
||||
class profiles::puppet::migrate (
|
||||
Boolean $enabled = false,
|
||||
String $new_server = 'puppet.k8s.syd1.au.unkin.net',
|
||||
String $new_ca_server = 'puppetca.k8s.syd1.au.unkin.net',
|
||||
Stdlib::Absolutepath $new_ssldir = '/etc/puppetlabs/puppet/ssl-k8s',
|
||||
) {
|
||||
|
||||
# never touch the puppet masters themselves (same guard as client.pp)
|
||||
if $enabled and $facts['enc_role'] != 'roles::infra::puppet::master' {
|
||||
|
||||
# Ensure the fresh ssldir exists with agent-correct ownership/perms. The
|
||||
# puppet agent will create it on demand, but pre-creating it keeps the very
|
||||
# first post-switch run from racing directory creation and makes the
|
||||
# migration state auditable. Contents (keys, certs, crl) are populated by
|
||||
# the agent against the new CA -- we only own the directory itself.
|
||||
file { $new_ssldir:
|
||||
ensure => 'directory',
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0771',
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -134,64 +134,4 @@ class profiles::puppet::server (
|
||||
enable => true,
|
||||
require => File['/usr/local/bin/puppet_generate_types.sh'],
|
||||
}
|
||||
|
||||
# Guard against an OpenJDK (or other JVM library) package upgrade landing
|
||||
# underneath a long-running puppetserver. When the java package is replaced
|
||||
# out-of-band (e.g. a yum repo/version bump), the old versioned JAVA_HOME is
|
||||
# removed while the JVM keeps running against the now-deleted files. The JVM
|
||||
# still execs jspawnhelper from its original (deleted) JAVA_HOME on every
|
||||
# subprocess spawn, so ProcessBuilder fails with "error=2, No such file or
|
||||
# directory" -- which breaks the exec ENC (/opt/cobbler-enc/cobbler-enc) and
|
||||
# 500s every catalog compile fleet-wide. A restart re-binds to the new JVM.
|
||||
# This timer detects the running JVM executing from deleted binaries and
|
||||
# restarts the service to recover automatically.
|
||||
file { '/usr/local/bin/puppetserver_jvm_guard.sh':
|
||||
ensure => file,
|
||||
mode => '0755',
|
||||
content => @(EOF),
|
||||
#!/bin/bash
|
||||
# Restart puppetserver if its running JVM is executing deleted binaries
|
||||
# (e.g. an OpenJDK package upgrade replaced the versioned JAVA_HOME),
|
||||
# which breaks subprocess spawning and thus ENC / catalog compilation.
|
||||
for pid in $(pgrep -f puppet-server-release.jar); do
|
||||
exe=$(readlink "/proc/${pid}/exe" 2>/dev/null)
|
||||
case "${exe}" in
|
||||
*'(deleted)'*)
|
||||
logger -t puppetserver-jvm-guard "puppetserver JVM (pid ${pid}) running on deleted binaries; restarting"
|
||||
systemctl restart puppetserver
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
done
|
||||
exit 0
|
||||
| EOF
|
||||
}
|
||||
|
||||
$_guard_timer = @(EOT)
|
||||
[Unit]
|
||||
Description=puppetserver JVM guard timer
|
||||
[Timer]
|
||||
OnCalendar=*:0/5
|
||||
RandomizedDelaySec=30s
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
EOT
|
||||
|
||||
$_guard_service = @(EOT)
|
||||
[Unit]
|
||||
Description=puppetserver JVM guard service
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/puppetserver_jvm_guard.sh
|
||||
User=root
|
||||
Group=root
|
||||
EOT
|
||||
|
||||
systemd::timer { 'puppetserver-jvm-guard.timer':
|
||||
timer_content => $_guard_timer,
|
||||
service_content => $_guard_service,
|
||||
active => true,
|
||||
enable => true,
|
||||
require => File['/usr/local/bin/puppetserver_jvm_guard.sh'],
|
||||
}
|
||||
}
|
||||
|
||||
@@ -122,15 +122,6 @@ class profiles::vault::server (
|
||||
]
|
||||
}
|
||||
|
||||
# go-plugin creates each secrets plugin's control socket as /tmp/pluginNNN;
|
||||
# systemd-tmpfiles-clean reaps files aged past the /tmp policy, severing the
|
||||
# socket of a long-lived plugin and orphaning the still-running process
|
||||
# (every request then fails: rpc Unavailable, dial unix /tmp/pluginNNN: no
|
||||
# such file). Exclude the sockets from cleaning for all plugins.
|
||||
systemd::tmpfile { 'openbao-plugin-sockets.conf':
|
||||
content => "x /tmp/plugin*\n",
|
||||
}
|
||||
|
||||
# ensure the vault audit log exists
|
||||
file { $audit_log:
|
||||
ensure => 'file',
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
<%- | String $name, String $algorithm, String $secret | -%>
|
||||
key "<%= $name %>" {
|
||||
algorithm <%= $algorithm %>;
|
||||
secret "<%= $secret %>";
|
||||
};
|
||||
@@ -1,15 +1,12 @@
|
||||
[main]
|
||||
dns_alt_names = <%= @dns_alt_names_string %>
|
||||
<% unless @effective_ssldir.nil? -%>
|
||||
ssldir = <%= @effective_ssldir %>
|
||||
<% end -%>
|
||||
|
||||
[agent]
|
||||
server = <%= @effective_server %>
|
||||
ca_server = <%= @effective_ca_server %>
|
||||
server = <%= @server %>
|
||||
ca_server = <%= @ca_server %>
|
||||
environment = <%= @environment %>
|
||||
report = true
|
||||
report_server = <%= @effective_report_server.nil? ? @effective_server : @effective_report_server %>
|
||||
report_server = <%= @server %>
|
||||
runinterval = <%= @runinterval %>
|
||||
runtimeout = <%= @runtimeout %>
|
||||
show_diff = <%= @show_diff %>
|
||||
|
||||
Reference in New Issue
Block a user