Migrate cobbler to puppet-on-k8s (#568)

Agents move from the VM puppetmasters to puppet-on-k8s one role at a time. The cobbler server has no exported-resource or PuppetDB query coupling to roles still on the VM masters, so it can move on its own.

- enable profiles::puppet::migrate for roles::infra::cobbler::server

Reviewed-on: #568
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/roles/infra/auth/glauth.yaml

@@ -2,6 +2,8 @@
 hiera_include:
   - glauth
 
+profiles::puppet::migrate::enabled: true
+
 # additional altnames
 profiles::pki::vault::alt_names:
   - ldap.main.unkin.net

hieradata/roles/infra/ceph/rgw.yaml

@@ -3,6 +3,8 @@ hiera_include:
   - profiles::ceph::rgw
   - profiles::nginx::simpleproxy
 
+profiles::puppet::migrate::enabled: true
+
 profiles::ceph::rgw::enable: true
 
 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package

hieradata/roles/infra/cobbler/server.yaml

@@ -4,6 +4,8 @@ hiera_include:
   - frrouting
   - exporters::frr_exporter
 
+profiles::puppet::migrate::enabled: true
+
 profiles::packages::include:
   cobbler: {}
   cobbler3.2-web: {}

hieradata/roles/infra/dhcp/server.yaml

@@ -4,6 +4,8 @@ hiera_include:
   - profiles::dhcp::server
   - exporters::frr_exporter
 
+profiles::puppet::migrate::enabled: true
+
 # networking
 anycast_ip: 198.18.19.18
 systemd::manage_networkd: true

hieradata/roles/infra/git/server.yaml

@@ -6,8 +6,6 @@ hiera_include:
   - profiles::gitea::haproxy
   - gitea
 
-profiles::puppet::migrate::enabled: true
-
 # additional altnames
 profiles::pki::vault::alt_names:
   - git.unkin.net

hieradata/roles/infra/proxy/jumphost.yaml

@@ -1,3 +1,5 @@
+profiles::puppet::migrate::enabled: true
+
 profiles::pki::vault::alt_names:
   - jumphost.service.consul
   - jumphost.query.consul

hieradata/roles/infra/puppet/master.yaml

@@ -31,7 +31,7 @@ profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-
 # Deep-merged with the entries in roles/infra/puppet.yaml.
 profiles::packages::include:
   encapic:
-    ensure: '0.2.0'
+    ensure: '0.5.0'
   certmanager:
     ensure: '0.2.0'
   sshsignhost:

site/profiles/manifests/puppet/encapic.pp

@@ -5,14 +5,13 @@
 # config so the encapi endpoint can change without repackaging.
 class profiles::puppet::encapic (
   Stdlib::HTTPUrl       $encapi_url,
-  Stdlib::AbsolutePath  $config_dir = '/etc/encapic',
+  Stdlib::AbsolutePath  $config_dir = '/etc/encapi',
   String                $config_name = 'encapic.conf',
   String                $owner = 'root',
   String                $group = 'root',
 ) {
 
-  # The RPM ships this file as %config(noreplace), so puppet must write it only
-  # once the package is present or the install overwrites it.
+  # order after the package so the shim exists before the config does.
   file { $config_dir:
     ensure  => directory,
     mode    => '0755',
@@ -29,4 +28,11 @@ class profiles::puppet::encapic (
     content => "ENCAPI_URL=${encapi_url}\n",
     require => File[$config_dir],
   }
+
+  # legacy pre-0.5.0 config dir; also clears any rpm .rpmsave left behind
+  file { '/etc/encapic':
+    ensure  => absent,
+    force   => true,
+    require => Package['encapic'],
+  }
 }