feat: manage openbao audit devices

- manage openbao audit devices in the configuration file
- enable audit and audit_raw logs

hieradata/common.eyaml

@@ -1,6 +1,6 @@
 ---
 profiles::accounts::sysadmin::password: ENC[PKCS7,MIIBqQYJKoZIhvcNAQcDoIIBmjCCAZYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAoS7GyofFaXBNTWU+GtSiz4eCX/9j/sh3fDDRgOgNv1qpcQ87ZlTTenbHo9lxeURxKQ2HVVt7IsrBo/SC/WgipAKnliRkkIvo7nfAs+i+kEE8wakjAs0DcB4mhqtIZRuBkLG2Nay//DcG6cltVkbKEEKmKLMkDFZgTWreOZal8nDljpVe1S8QwtwP4/6hKTef5xsOnrisxuffWTXvwYJhj/VXrjdoH7EhtHGLybzEalglkVHEGft/WrrD/0bwJpmR0RegWI4HTsSvGiHgvf5DZJx8fXPZNPnicGtlfA9ccQPuVo17bY4Qf/WIc1A8Ssv4kHSbNIYJKRymI3UFb0Z4wzBsBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBBxDLb6pCGbittkcX6asd/gEBmMcUNupDjSECq5H09YA70eVwWWe0fBqxTxrr2cXCXtRKFvOk8SJmL0xHAWodaLN9+krTWHJcWbAK8JXEPC7rn]
-profiles::accounts::root::password: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAIgzGQLoHrm7JSnWG4vdAtxSuETmnqbV7kUsQS8WCRUwFGenDFkps+OGMnOGEHLzMJzXihLfgfdWwTAI4fp48M+zhTMo9TQkdzZqtbFk3+RjV2jDF0wfe4kVUIpReOq+EkaDSkoRSG8V6hWvszhDHUrJBC9eDhomL0f3xNAWxmy5EIX/uMEvg9Ux5YX+E6k2pEIKnHNoVIaWDojlofSIzIqTSS7l3jQtJhs3YqBzLL1DsoF1kdn+Rwl5kcsKkhV+vzl76wEbpYVZW8lu4bFfP6QHMLPcep2tuUDMCDvARRXD7YyZcAtS7aMuqll+BLAszpWxAA7EU2hgvdr6t2uyVCTCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ4D5oDoyE6LPdjpVtGPoJD4BwfnQ9ORjYFPvHQmt+lgU4jMqh6BhqP0VN3lqVfUpOmiVMIqkO/cYtlwVLKEg36TPCHBSpqvhuahSF5saCVr8JY3xWOAmTSgnNjQOPlGrPnYWYbuRLxVRsU+KUkpAzR0c6VN0wYi6bI85Pcv8yHF3UYA==]
+profiles::accounts::root::password: ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAM79PRxeAZHrDcSm4eSFqU94/LjuSbdUmJWivX/Pa8GumoW2e/PT9nGHW3p98zHthMgCglk52PECQ+TBKjxr+9dTyNK5ePG6ZJEqSHNRqsPGm+kfQj/hlTmq8vOBaFM5GapD1iTHs5JFbGngI56swKBEVXW9+Z37BjQb2xJuyLsu5Bo/tA0BaOKuCtjq1a6E38bOX+nJ+YF1uZgV9ofAEh1YvkcTmnEWYXFRPWd7AaNcWn03V2pfhGqxc+xydak620I47P+FE+qIY72+aQ6tmLU3X9vyA1HLF2Tv572l4a2i+YIk6nAgQdi+hQKznqNL9M9YV+s1AcmcKLT7cfLrjsjA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCMWrdCWBQgtW3NOEpERwP+gBA3KDiqe4pQq6DwRfsEXQNZ]
 profiles::consul::client::secret_id_salt: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAS7pNFRX4onccFaR87zB/eFFORuF22j6xqjyeAqqjgEduYhkt6w5kkz+YfUoHUesU0Q6F2p6HrCSZ8yAsx5M25NCiud9P4hIpjKmOZ4zCNO7uhATh4AQDYw3BrdRwfO+c6jOl5wOiNLCfDBJ0sFT3akCvcuPS1xIoRJq4Gyn+uCbOsMbvSl25ld2xKt1/cqs8gc1d8mkpjwWto7t+qZSUFMCehTbehH3G4a3Q5rvfBoNwv42Wbs676BDcCurDaAzHNqE7pDbOWhGuVOBl+q+BU0Ri/CRkGcTViN9fr8Dc9SveVC6EPsMbw+05/8/NlfzQse3KAwQ34nR9tR2PQw5qEzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB7LywscQtF7cG2nomfEsu9gDDVqJBFP1jAX2eGZ2crYS5gnBcsRwhc0HNo2/WWdhZprMW+vEJOOGXDelI53NxA3o0=]
 profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAO8IIF2r18dFf0bVKEwjJUe1TmXHH0AIzsQHxkHwV7d37kvH1cY9rYw0TtdHn7GTxvotJG7GZbWvbunpBs1g2p2RPADiM6TMhbO8mJ0tAWLnMk7bQ221xu8Pc7KceqWmU17dmgNhVCohyfwJNqbA756TlHVgxGA0LtNrKoLOmgKGXAL1VYZoKEQnWq7xOpO+z3e1UfjoO6CvX/Od2hGYfUkHdro8mwRw4GFKzU7XeKFdAMUGpn5rVmY3xe+1ARXwGFaSrTHzk2n85pvwhPRlQ+OwqzyT19Qo2FNeAO6RoCRIFTtqbsjTWPUlseHIhw4Q5bHO1I0Mrlm5IHDESw/22IzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCEe9wD72qxnpeq5nCi/d7BgDCP29sDFObkFTabt2uZ/nF9MT1g+QOrrdFKgnG6ThnwH1hwpZPsSVgIs+yRQH8laB4=]
 profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]

hieradata/country/au/region/syd1.yaml

@@ -5,5 +5,3 @@ profiles_dns_upstream_forwarder_unkin:
   - 198.18.19.15
 profiles_dns_upstream_forwarder_consul:
   - 198.18.19.14
-profiles_dns_upstream_forwarder_k8s:
-  - 198.18.19.20

hieradata/os/AlmaLinux/AlmaLinux8.yaml

@@ -7,4 +7,17 @@ profiles::packages::include:
 
 profiles::yum::global::repos:
   powertools:
-    ensure: present
+    name: powertools
+    descr: powertools repository
+    target: /etc/yum.repos.d/powertools.repo
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el8
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/os/AlmaLinux/AlmaLinux9.yaml

@@ -3,5 +3,34 @@
 crypto_policies::policy: 'DEFAULT:SHA1'
 
 profiles::yum::global::repos:
+  baseos:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  extras:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  appstream:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  highavailability:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
   crb:
-    ensure: present
+    name: crb
+    descr: crb repository
+    target: /etc/yum.repos.d/crb.repo
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el9
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/os/AlmaLinux/all_releases.yaml

@@ -23,52 +23,36 @@ profiles::yum::global::repos:
     name: baseos
     descr: baseos repository
     target: /etc/yum.repos.d/baseos.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   extras:
     name: extras
     descr: extras repository
     target: /etc/yum.repos.d/extras.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   appstream:
     name: appstream
     descr: appstream repository
     target: /etc/yum.repos.d/appstream.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   highavailability:
     name: highavailability
     descr: highavailability repository
     target: /etc/yum.repos.d/highavailability.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
-  crb:
-    ensure: absent
-    name: crb
-    descr: crb repository
-    target: /etc/yum.repos.d/crb.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
-  powertools:
-    ensure: absent
-    name: powertools
-    descr: powertools repository
-    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   epel:
     name: epel
     descr: epel repository
     target: /etc/yum.repos.d/epel.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
+    baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
+    gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
     mirrorlist: absent
   unkinben:
     name: unkinben
@@ -78,193 +62,3 @@ profiles::yum::global::repos:
     gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
     gpgcheck: false
     mirrorlist: absent
-
-  # Additional repositories - default to absent, roles can override with ensure: present
-  # FRRouting repositories
-  frr-extras:
-    ensure: absent
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/frr/el%{facts.os.release.major}/extras
-    gpgcheck: false
-    mirrorlist: absent
-  frr-stable:
-    ensure: absent
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/frr/el%{facts.os.release.major}/frr
-    gpgcheck: false
-    mirrorlist: absent
-
-  # PostgreSQL repositories
-  postgresql-15:
-    ensure: absent
-    name: postgresql-15
-    descr: postgresql-15 repository
-    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/15/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
-  postgresql-17:
-    ensure: absent
-    name: postgresql-17
-    descr: postgresql-17 repository
-    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/17/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
-  postgresql-common:
-    ensure: absent
-    name: postgresql-common
-    descr: postgresql-common repository
-    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/common/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
-
-  # Ceph repositories
-  ceph:
-    ensure: absent
-    name: ceph
-    descr: ceph repository
-    target: /etc/yum.repos.d/ceph.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/ceph-reef/el%{facts.os.release.major}/%{facts.os.architecture}
-    gpgcheck: false
-    mirrorlist: absent
-  ceph-noarch:
-    ensure: absent
-    name: ceph-noarch
-    descr: ceph noarch repository
-    target: /etc/yum.repos.d/ceph.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/ceph-reef/el%{facts.os.release.major}/noarch
-    gpgcheck: false
-    mirrorlist: absent
-
-  # Rancher RKE2 repositories
-  rancher-rke2-common-latest:
-    ensure: absent
-    name: rancher-rke2-common
-    descr: rancher-rke2-common repository
-    target: /etc/yum.repos.d/rancher-rke2-common.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/rke2/latest/common/centos/%{facts.os.release.major}/noarch
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/public.key
-    gpgcheck: 1
-    mirrorlist: absent
-  rancher-rke2-1-33-latest:
-    ensure: absent
-    name: rancher-rke2-1.33-latest
-    descr: rancher-rke2-1.33-latest repository
-    target: /etc/yum.repos.d/rancher-rke2.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/rke2/latest/1.33/centos/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/public.key
-    gpgcheck: 1
-    mirrorlist: absent
-
-  # CentOS repositories for legacy systems
-  centos_8_advanced_virtualization:
-    ensure: absent
-    name: centos_8_advanced_virtualization
-    descr: centos_8_advanced_virtualization repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/virt/x86_64/advanced-virtualization
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Virtualization
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_ceph_pacific:
-    ensure: absent
-    name: centos_8_ceph_pacific
-    descr: centos_8_ceph_pacific repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/storage/x86_64/ceph-pacific
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Storage
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_rabbitmq_38:
-    ensure: absent
-    name: centos_8_rabbitmq_38
-    descr: centos_8_rabbitmq_38 repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/messaging/x86_64/rabbitmq-38
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Messaging
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_nfv_openvswitch:
-    ensure: absent
-    name: centos_8_nfv_openvswitch
-    descr: centos_8_nfv_openvswitch repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/nfv/x86_64/openvswitch-2
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-NFV
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_openstack_xena:
-    ensure: absent
-    name: centos_8_openstack_xena
-    descr: centos_8_openstack_xena repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/cloud/x86_64/openstack-xena
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Cloud
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_opstools:
-    ensure: absent
-    name: centos_8_opstools
-    descr: centos_8_opstools repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/opstools/x86_64/collectd-5
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-OpsTools
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_ovirt45:
-    ensure: absent
-    name: centos_8_ovirt45
-    descr: centos_8_ovirt45 repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/virt/x86_64/ovirt-45
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Virtualization
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_stream_gluster10:
-    ensure: absent
-    name: centos_8_stream_gluster10
-    descr: centos_8_stream_gluster10 repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Storage
-    gpgcheck: 1
-    mirrorlist: absent
-
-  # Additional repositories
-  zfs-kmod:
-    ensure: absent
-    name: zfs-kmod
-    descr: zfs-kmod repository
-    target: /etc/yum.repos.d/zfs.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/zfs/epel/%{facts.os.release.major}/kmod/%{facts.os.architecture}/
-    gpgcheck: false
-    mirrorlist: absent
-  rpmfusion-free:
-    ensure: absent
-    name: rpmfusion-free
-    descr: rpmfusion-free repository
-    target: /etc/yum.repos.d/rpmfusion-free.repo
-    baseurl: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/
-    gpgkey: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
-    gpgcheck: 1
-    mirrorlist: absent
-  rpmfusion-nonfree:
-    ensure: absent
-    name: rpmfusion-nonfree
-    descr: rpmfusion-nonfree repository
-    target: /etc/yum.repos.d/rpmfusion-nonfree.repo
-    baseurl: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/
-    gpgkey: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
-    gpgcheck: 1
-    mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el%{facts.os.release.major}
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent

hieradata/roles/apps/media.yaml

@@ -3,8 +3,13 @@ hiera_include:
   - profiles::nginx::simpleproxy
 
 profiles::yum::global::repos:
-  ceph:
+  ceph-reef:
-    ensure: present
+    name: ceph-reef
+    descr: ceph reef repository
+    target: /etc/yum.repos.d/ceph-reef.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgcheck: 0,
+    mirrorlist: absent
 
 profiles::ceph::client::keyrings:
   media:

hieradata/roles/apps/media/jellyfin.yaml

@@ -54,8 +54,24 @@ profiles::consul::client::node_rules:
 
 profiles::yum::global::repos:
   rpmfusion-free:
-    ensure: present
+    name: rpmfusion-free
+    descr: rpmfusion-free repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    mirrorlist: absent
   rpmfusion-nonfree:
-    ensure: present
+    name: rpmfusion-nonfree
+    descr: rpmfusion-nonfree repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    mirrorlist: absent
   unkinben:
-    ensure: present
+    name: unkinben
+    descr: unkinben repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el8
+    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/roles/apps/media/nzbget.yaml

@@ -72,6 +72,16 @@ profiles::consul::client::node_rules:
 
 profiles::yum::global::repos:
   rpmfusion-free:
-    ensure: present
+    name: rpmfusion-free
+    descr: rpmfusion-free repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    mirrorlist: absent
   rpmfusion-nonfree:
-    ensure: present
+    name: rpmfusion-nonfree
+    descr: rpmfusion-nonfree repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    mirrorlist: absent

hieradata/roles/ceph.yaml

@@ -31,10 +31,30 @@ frrouting::daemons:
 # additional repos
 profiles::yum::global::repos:
   ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent

hieradata/roles/infra/ceph/rgw.yaml

@@ -18,9 +18,19 @@ profiles::pki::vault::alt_names:
 # additional repos
 profiles::yum::global::repos:
   ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
 
 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
@@ -28,7 +38,7 @@ profiles::nginx::simpleproxy::nginx_aliases:
   - radosgw.service.au-syd1.consul
 profiles::nginx::simpleproxy::proxy_port: 7480
 profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 5000M
+nginx::client_max_body_size: 100M
 
 # manage consul service
 consul::services:

hieradata/roles/infra/cobbler/server.yaml

@@ -57,9 +57,19 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
 
 # cobbler settings
 profiles::cobbler::params::service_cname: 'cobbler.main.unkin.net'

hieradata/roles/infra/dhcp/server.yaml

@@ -41,9 +41,19 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
 
 profiles::dhcp::server::ntpservers:
   - 0.au.pool.ntp.org

hieradata/roles/infra/dns/externaldns.eyaml

@@ -1,2 +0,0 @@
----
-externaldns::externaldns_key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEABqbZiK1NDTU+w2k7orz2HrB0EXwun7hn4pR6TeCHMp2IfrkPxlQT+f1J9c0PqJaAKvnyz+Cx0xNCrlnONqk+J57f48kYKYV+Vw+L0AYHYFj8/TizY5CwLpJS2XKyfRd4iEsWMonvfIYn71t3+YuXm4dkoEqGekW93qCr/KFtjAu0K3e+ypyl4EJqWokiUs7IbcSBNvrjUkP4yR8F/wHVKM1E5yfr+D1+nmMmt7Ob/J+am14492TppE2C7Xadg4us+kdYtuBsv9kTSi1GwwqUDjbeJVmfK3pKHjXdF+PI07AFLzo5bBZTJOzQfQ4SywpH8R5BDQoUCyHiaskB5wrmSDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB2LU9ZhefSg9PqqkwnfV65gDBvXuXco0moKCGjHqm5KcojWCK1BoS/+mltlr8kw9grZjN9jxHRLn1FjgBlq418c8w=]

hieradata/roles/infra/dns/externaldns.yaml

@@ -1,55 +0,0 @@
----
-hiera_include:
-  - externaldns
-  - frrouting
-  - exporters::frr_exporter
-
-externaldns::bind_master_hostname: 'ausyd1nxvm2127.main.unkin.net'
-externaldns::k8s_zones:
-  - 'k8s.syd1.au.unkin.net'
-  - '200.18.198.in-addr.arpa'
-externaldns::slave_servers:
-  - 'ausyd1nxvm2128.main.unkin.net'
-  - 'ausyd1nxvm2129.main.unkin.net'
-externaldns::externaldns_key_algorithm: 'hmac-sha256'
-
-# networking
-anycast_ip: 198.18.19.20
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-exporters::frr_exporter::enable: true
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# consul
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: frr_exporter
-    disposition: write
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    ensure: present
-  frr-stable:
-    ensure: present

hieradata/roles/infra/dns/master.yaml

@@ -200,6 +200,16 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent

hieradata/roles/infra/dns/resolver.yaml

@@ -82,11 +82,6 @@ profiles::dns::resolver::zones:
       - 10.10.16.32
       - 10.10.16.33
     forward: 'only'
-  k8s.syd1.au.unkin.net-forward:
-    domain: 'k8s.syd1.au.unkin.net'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_k8s')}"
-    forward: 'only'
   unkin.net-forward:
     domain: 'unkin.net'
     zone_type: 'forward'
@@ -177,11 +172,6 @@ profiles::dns::resolver::zones:
     zone_type: 'forward'
     forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
     forward: 'only'
-  200.18.198.in-addr.arpa-forward:
-    domain: '200.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_k8s')}"
-    forward: 'only'
   consul-forward:
     domain: 'consul'
     zone_type: 'forward'
@@ -198,7 +188,6 @@ profiles::dns::resolver::views:
       - network.unkin.net-forward
       - prod.unkin.net-forward
       - consul-forward
-      - k8s.syd1.au.unkin.net-forward
       - 13.18.198.in-addr.arpa-forward
       - 14.18.198.in-addr.arpa-forward
       - 15.18.198.in-addr.arpa-forward
@@ -261,6 +250,16 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent

hieradata/roles/infra/git/runner.yaml

@@ -8,9 +8,9 @@ docker::version: latest
 docker::curl_ensure: false
 docker::root_dir: /data/docker
 
-profiles::gitea::runner::instance: https://git.unkin.net
 profiles::gitea::runner::home: /data/runner
-profiles::gitea::runner::version: '0.2.12'
+profiles::gitea::runner::version: '0.2.10'
+profiles::gitea::runner::source: "https://gitea.com/gitea/act_runner/releases/download/v%{hiera('profiles::gitea::runner::version')}/act_runner-%{hiera('profiles::gitea::runner::version')}-linux-amd64"
 profiles::gitea::runner::config:
   log:
     level: info

hieradata/roles/infra/git/server.yaml

@@ -71,7 +71,7 @@ profiles::nginx::simpleproxy::nginx_aliases:
 
 profiles::nginx::simpleproxy::proxy_port: 3000
 profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 5144M
+nginx::client_max_body_size: 1024M
 
 # enable external access via haproxy
 profiles::gitea::haproxy::enable: true

hieradata/roles/infra/halb/haproxy2.yaml

@@ -35,9 +35,19 @@ frrouting::daemons:
 # additional repos
 profiles::yum::global::repos:
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
 
 # haproxy metrics
 consul::services:

hieradata/roles/infra/incus/node.yaml

@@ -85,15 +85,40 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
   ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   zfs-kmod:
-    ensure: present
+    name: zfs-kmod
+    descr: zfs-kmod repository
+    target: /etc/yum.repos.d/zfs-kmod.repo
+    baseurl: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-openzfs-2022
+    mirrorlist: absent
 
 # dns
 profiles::dns::base::primary_interface: loopback0

hieradata/roles/infra/k8s.yaml

@@ -47,17 +47,47 @@ profiles::ceph::client::mons:
 # additional repos
 profiles::yum::global::repos:
   ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   rancher-rke2-common-latest:
-    ensure: present
+    name: rancher-rke2-common-latest
+    descr: rancher-rke2-common-latest
+    target: /etc/yum.repos.d/rke2-common.repo
+    baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/
+    gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/public.key
+    mirrorlist: absent
   rancher-rke2-1-33-latest:
-    ensure: present
+    name: rancher-rke2-1-33-latest
+    descr: rancher-rke2-1-33-latest
+    target: /etc/yum.repos.d/rke2-1-33.repo
+    baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/
+    gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/public.key
+    mirrorlist: absent
 
 # dns
 profiles::dns::base::primary_interface: loopback0

hieradata/roles/infra/k8s/control.yaml

@@ -58,12 +58,6 @@ consul::services:
         tcp: "%{hiera('networking_loopback0_ip')}:9345"
         interval: '10s'
         timeout: '1s'
-      - id: 'rke2_server_ping_check'
-        name: 'rke2 Server Ping Check'
-        http: "https://%{hiera('networking_loopback0_ip')}:9345/ping"
-        interval: '10s'
-        timeout: '3s'
-        tls_skip_verify: true
 profiles::consul::client::node_rules:
   - resource: service
     segment: api-k8s

hieradata/roles/infra/k8s/node.yaml

@@ -47,17 +47,47 @@ profiles::ceph::client::mons:
 # additional repos
 profiles::yum::global::repos:
   ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   rancher-rke2-common-latest:
-    ensure: present
+    name: rancher-rke2-common-latest
+    descr: rancher-rke2-common-latest
+    target: /etc/yum.repos.d/rke2-common.repo
+    baseurl: https://rpm.rancher.io/rke2/latest/common/centos/%{facts.os.release.major}/noarch
+    gpgkey: https://rpm.rancher.io/public.key
+    mirrorlist: absent
   rancher-rke2-1-33-latest:
-    ensure: present
+    name: rancher-rke2-1-33-latest
+    descr: rancher-rke2-1-33-latest
+    target: /etc/yum.repos.d/rke2-1-33.repo
+    baseurl: https://rpm.rancher.io/rke2/latest/1.33/centos/%{facts.os.release.major}/x86_64
+    gpgkey: https://rpm.rancher.io/public.key
+    mirrorlist: absent
 
 # dns
 profiles::dns::base::primary_interface: loopback0

hieradata/roles/infra/nomad/agent.yaml

@@ -24,8 +24,13 @@ frrouting::ospfd_interfaces:
     area: 0.0.0.1
 
 profiles::yum::global::repos:
-  ceph:
+  ceph-reef:
-    ensure: present
+    name: ceph-reef
+    descr: ceph reef repository
+    target: /etc/yum.repos.d/ceph-reef.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgcheck: 0,
+    mirrorlist: absent
 
 profiles::ceph::client::keyrings:
   nomad:

hieradata/roles/infra/ovirt/engine.yaml

@@ -1,18 +1,50 @@
 ---
 profiles::yum::global::repos:
   centos_8_advanced_virtualization:
-    ensure: present
+    name: 'virt-advanced-virtualization'
+    descr: 'CentOS Advanced Virtualization'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/advancedvirt-common
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
   centos_8_ceph_pacific:
-    ensure: present
+    name: 'storage-ceph-pacific'
+    descr: 'CentOS Ceph Pacific'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/ceph-pacific
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
   centos_8_rabbitmq_38:
-    ensure: present
+    name: 'messaging-rabbitmq-38'
+    descr: 'CentOS RabbitMQ 38'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/messaging/x86_64/rabbitmq-38
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
   centos_8_nfv_openvswitch:
-    ensure: present
+    name: 'nfv-openvswitch-2'
+    descr: 'CentOS NFV OpenvSwitch'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/nfv/x86_64/openvswitch-2
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
   centos_8_openstack_xena:
-    ensure: present
+    name: 'cloud-openstack-xena'
+    descr: 'CentOS OpenStack Xena'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/cloud/x86_64/openstack-xena
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
   centos_8_opstools:
-    ensure: present
+    name: 'opstools-collectd-5'
+    descr: 'CentOS OpsTools - collectd'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/opstools/x86_64/collectd-5
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
   centos_8_ovirt45:
-    ensure: present
+    name: 'virt-ovirt-45'
+    descr: 'CentOS oVirt 4.5'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/ovirt-45
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
   centos_8_stream_gluster10:
-    ensure: present
+    name: 'storage-gluster-10'
+    descr: 'CentOS oVirt 4.5 - Glusterfs 10'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'

hieradata/roles/infra/ovirt/node.yaml

@@ -9,18 +9,50 @@ sudo::purge_ignore:
 
 profiles::yum::global::repos:
   centos_8_advanced_virtualization:
-    ensure: present
+    name: 'virt-advanced-virtualization'
+    descr: 'CentOS Advanced Virtualization'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/advancedvirt-common
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
   centos_8_ceph_pacific:
-    ensure: present
+    name: 'storage-ceph-pacific'
+    descr: 'CentOS Ceph Pacific'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/ceph-pacific
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
   centos_8_rabbitmq_38:
-    ensure: present
+    name: 'messaging-rabbitmq-38'
+    descr: 'CentOS RabbitMQ 38'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/messaging/x86_64/rabbitmq-38
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
   centos_8_nfv_openvswitch:
-    ensure: present
+    name: 'nfv-openvswitch-2'
+    descr: 'CentOS NFV OpenvSwitch'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/nfv/x86_64/openvswitch-2
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
   centos_8_openstack_xena:
-    ensure: present
+    name: 'cloud-openstack-xena'
+    descr: 'CentOS OpenStack Xena'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/cloud/x86_64/openstack-xena
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
   centos_8_opstools:
-    ensure: present
+    name: 'opstools-collectd-5'
+    descr: 'CentOS OpsTools - collectd'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/opstools/x86_64/collectd-5
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
   centos_8_ovirt45:
-    ensure: present
+    name: 'virt-ovirt-45'
+    descr: 'CentOS oVirt 4.5'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/ovirt-45
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
   centos_8_stream_gluster10:
-    ensure: present
+    name: 'storage-gluster-10'
+    descr: 'CentOS oVirt 4.5 - Glusterfs 10'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'

hieradata/roles/infra/puppetdb/sql.yaml

@@ -62,6 +62,14 @@ profiles::consul::client::node_rules:
 
 profiles::yum::global::repos:
   postgresql-17:
-    ensure: present
+    name: postgresql-17
+    descr: postgresql-17 repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
   postgresql-common:
-    ensure: present
+    name: postgresql-common
+    descr: postgresql-common repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL

hieradata/roles/infra/reposync/syncer.yaml

@@ -3,41 +3,6 @@ profiles::packages::include:
   createrepo: {}
 
 profiles::reposync::repos_list:
-  almalinux_9.7_baseos:
-    repository: 'baseos'
-    description: 'AlmaLinux 9.7 BaseOS'
-    osname: 'almalinux'
-    release: '9.7'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/baseos'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9.7_appstream:
-    repository: 'appstream'
-    description: 'AlmaLinux 9.7 AppStream'
-    osname: 'almalinux'
-    release: '9.7'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/appstream'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9.7_crb:
-    repository: 'crb'
-    description: 'AlmaLinux 9.7 CRB'
-    osname: 'almalinux'
-    release: '9.7'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/crb'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9.7_ha:
-    repository: 'ha'
-    description: 'AlmaLinux 9.7 HighAvailability'
-    osname: 'almalinux'
-    release: '9.7'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/highavailability'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9.7_extras:
-    repository: 'extras'
-    description: 'AlmaLinux 9.7 extras'
-    osname: 'almalinux'
-    release: '9.7'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.7/extras'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
   almalinux_9.6_baseos:
     repository: 'baseos'
     description: 'AlmaLinux 9.6 BaseOS'

hieradata/roles/infra/sql/patroni.yaml

@@ -1,9 +1,17 @@
 ---
 profiles::yum::global::repos:
   postgresql-15:
-    ensure: present
+    name: postgresql-15
+    descr: postgresql-15 repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
   postgresql-common:
-    ensure: present
+    name: postgresql-common
+    descr: postgresql-common repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
 
 profiles::sql::patroni::cluster_name: "patroni-%{facts.environment}"
 profiles::sql::patroni::postgres_exporter_enabled: true

hieradata/roles/infra/sql/shared.yaml

@@ -47,6 +47,14 @@ profiles::consul::client::node_rules:
 
 profiles::yum::global::repos:
   postgresql-17:
-    ensure: present
+    name: postgresql-17
+    descr: postgresql-17 repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
   postgresql-common:
-    ensure: present
+    name: postgresql-common
+    descr: postgresql-common repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL

hieradata/roles/infra/storage/consul.yaml

@@ -134,9 +134,19 @@ frrouting::ospfd_interfaces:
 frrouting::daemons:
   ospfd: true
 
-# additional repos - enable needed repositories
+# additional repos
 profiles::yum::global::repos:
   frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
   frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent

hieradata/roles/infra/storage/vault.yaml

@@ -4,6 +4,17 @@ profiles::vault::server::members_lookup: true
 profiles::vault::server::data_dir: /data/vault
 profiles::vault::server::manage_storage_dir: true
 profiles::vault::server::tls_disable: false
+profiles::vault::server::audit_devices:
+  - file:
+      audit-file:
+        options:
+          file_path: /data/vault/audit_raw.log
+          log_raw: true
+  - file:
+      audit-file:
+        options:
+          file_path: /data/vault/audit.log
+          log_raw: false
 vault::package_name: openbao
 vault::package_ensure: latest
 

modules/externaldns/manifests/init.pp

@@ -1,15 +0,0 @@
-# ExternalDNS BIND module - automatically configures master or slave
-class externaldns (
-  Stdlib::Fqdn $bind_master_hostname,
-  Array[Stdlib::Fqdn] $k8s_zones = [],
-  Array[Stdlib::Fqdn] $slave_servers = [],
-  String $externaldns_key_secret = '',
-  String $externaldns_key_algorithm = 'hmac-sha256',
-) {
-
-  if $trusted['certname'] == $bind_master_hostname {
-    include externaldns::master
-  } else {
-    include externaldns::slave
-  }
-}

modules/externaldns/manifests/master.pp

@@ -1,45 +0,0 @@
-# ExternalDNS BIND master server class
-class externaldns::master inherits externaldns {
-
-  include bind
-
-  # Query PuppetDB for slave server IP addresses
-  $slave_ips = $externaldns::slave_servers.map |$fqdn| {
-    puppetdb_query("inventory[facts.networking.ip] { certname = '${fqdn}' }")[0]['facts.networking.ip']
-  }.filter |$ip| { $ip != undef }
-
-  # Create TSIG key for ExternalDNS authentication
-  bind::key { 'externaldns-key':
-    algorithm => $externaldns::externaldns_key_algorithm,
-    secret    => $externaldns::externaldns_key_secret,
-  }
-
-  # Create ACL for slave servers
-  if !empty($slave_ips) {
-    bind::acl { 'dns-slaves':
-      addresses => $slave_ips,
-    }
-  }
-
-  # Create master zones for each Kubernetes domain
-  $externaldns::k8s_zones.each |$zone| {
-    bind::zone { $zone:
-      zone_type       => 'master',
-      dynamic         => true,
-      allow_updates   => ['key externaldns-key'],
-      allow_transfers => empty($slave_ips) ? {
-        true  => [],
-        false => ['dns-slaves'],
-      },
-      ns_notify       => !empty($slave_ips),
-      also_notify     => $slave_ips,
-      dnssec          => false,
-    }
-  }
-
-  # Create default view to include the zones
-  bind::view { 'externaldns':
-    recursion => false,
-    zones     => $externaldns::k8s_zones,
-  }
-}

modules/externaldns/manifests/slave.pp

@@ -1,36 +0,0 @@
-# ExternalDNS BIND slave server class
-class externaldns::slave inherits externaldns {
-
-  include bind
-
-  # Query PuppetDB for master server IP address
-  $query = "inventory[facts.networking.ip] { certname = '${externaldns::bind_master_hostname}' }"
-  $master_ip = puppetdb_query($query)[0]['facts.networking.ip']
-
-  # Create TSIG key for zone transfers (same as master)
-  bind::key { 'externaldns-key':
-    algorithm => $externaldns::externaldns_key_algorithm,
-    secret    => $externaldns::externaldns_key_secret,
-  }
-
-  # Create ACL for master server
-  bind::acl { 'dns-master':
-    addresses => [$master_ip],
-  }
-
-  # Create slave zones for each Kubernetes domain
-  $externaldns::k8s_zones.each |$zone| {
-    bind::zone { $zone:
-      zone_type    => 'slave',
-      masters      => [$master_ip],
-      allow_notify => ['dns-master'],
-      ns_notify    => false,
-    }
-  }
-
-  # Create default view to include the zones
-  bind::view { 'externaldns':
-    recursion => false,
-    zones     => $externaldns::k8s_zones,
-  }
-}

modules/rke2/manifests/install.pp

@@ -30,7 +30,7 @@ class rke2::install (
   # download required archive of containers
   archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
     ensure  => present,
-    source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
+    source  => "https://github.com/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
     require => [
       Package["rke2-${node_type}"],
       File['/var/lib/rancher/rke2/agent/images'],

modules/rke2/manifests/params.pp

@@ -1,7 +1,7 @@
 # rke2 params
 class rke2::params (
   Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.7',
+  String                  $rke2_version = '1.33.4',
   String                  $rke2_release = 'rke2r1',
   Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
   Hash                    $config_hash = {},

site/profiles/manifests/accounts/root.pp

@@ -1,12 +1,12 @@
 # manage the root user
 class profiles::accounts::root (
-  String $password,
   Optional[Array[String]] $sshkeys = undef,
 ) {
 
+  if $sshkeys {
     accounts::user { 'root':
       sshkeys => $sshkeys,
-    password => $password,
+    }
   }
 
   file {'/root/.config':

site/profiles/manifests/gitea/runner.pp

@@ -1,12 +1,13 @@
 # profiles::gitea::init
 class profiles::gitea::runner (
   String $registration_token,
+  Stdlib::HTTPSUrl $source,
   String $user = 'runner',
   String $group = 'runner',
   Stdlib::Absolutepath $home = '/data/runner',
   Hash $config = {},
   Stdlib::HTTPSUrl $instance = 'https://git.query.consul',
-  String $version = 'latest',
+  String $version = '0.2.10',
 ) {
 
   group { $group:
@@ -31,27 +32,24 @@ class profiles::gitea::runner (
     require => User[$user],
   }
 
-  unless $version in ['latest', 'present'] {
+  archive { '/usr/local/bin/act_runner':
-    # versionlock act
-    yum::versionlock{ 'act_runner':
     ensure  => present,
-      version => $version,
+    extract => false,
-      before  => Package['act_runner'],
+    source  => $source,
-    }
+    creates => '/usr/local/bin/act_runner',
+    cleanup => true,
   }
 
-  # install act
-  package { 'act_runner':
-    ensure => $version,
-  }
-
-  # remove manually installed act_runner
   file { '/usr/local/bin/act_runner':
-    ensure => absent,
+    ensure  => 'file',
+    mode    => '0755',
+    owner   => 'root',
+    group   => 'root',
+    require => Archive['/usr/local/bin/act_runner'],
   }
 
-  exec { 'register_act_runner':
+  exec {'register_act_runner':
-    command => "/usr/bin/act_runner register \
+    command => "/usr/local/bin/act_runner register \
                 --no-interactive \
                 --instance ${instance} \
                 --token ${registration_token} \
@@ -62,12 +60,12 @@ class profiles::gitea::runner (
     user    => $user,
     group   => $group,
     require => [
-      Package['act_runner'],
+      File['/usr/local/bin/act_runner'],
       File["${home}/config.yaml"],
     ],
   }
 
-  systemd::unit_file { 'act_runner.service':
+  systemd::unit_file {'act_runner.service':
     enable  => true,
     active  => true,
     content => template('profiles/gitea/act_runner.service.erb'),

site/profiles/manifests/puppet/agent.pp

@@ -20,9 +20,9 @@ class profiles::puppet::agent (
   if $openvox_enable and $facts['os']['family'] == 'RedHat' {
     yumrepo { 'openvox':
       ensure  => 'present',
-      baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/el/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
+      baseurl => "https://packagerepo.service.consul/openvox7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/",
       descr   => 'openvox repository',
-      gpgkey  => 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub',
+      gpgkey  => "https://packagerepo.service.consul/openvox7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/GPG-KEY-openvox.pub",
       notify  => Exec['dnf_makecache'],
     }
   }else{

site/profiles/manifests/puppet/client.pp

@@ -13,8 +13,6 @@ class profiles::puppet::client (
   Boolean $show_diff          = true,
   Boolean $usecacheonfailure  = false,
   Integer $facts_soft_limit   = 4096,
-  Boolean $splay              = true,
-  Integer $splaylimit         = 600,
 ) {
 
   # dont manage puppet.conf if this is a puppetmaster

site/profiles/manifests/vault/server.pp

@@ -15,7 +15,7 @@ class profiles::vault::server (
   Stdlib::Absolutepath $ssl_crt     = '/etc/pki/tls/vault/certificate.crt',
   Stdlib::Absolutepath $ssl_key     = '/etc/pki/tls/vault/private.key',
   Stdlib::Absolutepath $ssl_ca      = '/etc/pki/tls/certs/ca-bundle.crt',
-  Stdlib::Absolutepath $audit_log   = '/var/log/vault_audit.log',
+  Optional[Array[Hash]] $audit_devices = undef,
 ){
 
   # set a datacentre/cluster name
@@ -66,6 +66,7 @@ class profiles::vault::server (
       extra_config       => {
         cluster_addr => "${http_scheme}://${::facts['networking']['fqdn']}:${cluster_port}",
       },
+      audit              => $audit_devices,
       listener           => [
         {
           tcp => {
@@ -86,13 +87,6 @@ class profiles::vault::server (
       ]
     }
 
-    # ensure the vault audit log exists
-    file { $audit_log:
-      ensure => 'file',
-      owner  => 'vault',
-      group  => 'vault',
-      mode   => '0600',
-    }
 
     service { 'vault':
       ensure    => true,

site/profiles/manifests/yum/global.pp

@@ -32,8 +32,6 @@ class profiles::yum::global (
       $key_url = $repo['gpgkey']
       $key_file = "/etc/pki/rpm-gpg/${name}-gpg-key"
 
-      # only download the key if the repo is present
-      if $repo['ensure'] == 'present' {
       exec { "download_gpg_key_${name}":
         command => "curl -s -o ${key_file} ${key_url} && rpm --import ${key_file}",
         path    => ['/bin', 'usr/bin'],
@@ -41,7 +39,6 @@ class profiles::yum::global (
         before  => Yumrepo[$name],
       }
     }
-    }
     # create the repo
     yumrepo { $name:
       * => $repo,

site/profiles/templates/gitea/act_runner.service.erb

@@ -4,7 +4,7 @@ Documentation=https://gitea.com/gitea/act_runner
 After=docker.service
 
 [Service]
-ExecStart=/usr/bin/act_runner daemon --config <%= @home %>/config.yaml
+ExecStart=/usr/local/bin/act_runner daemon --config <%= @home %>/config.yaml
 ExecReload=/bin/kill -s HUP $MAINPID
 WorkingDirectory=<%= @home %>
 TimeoutSec=0

site/profiles/templates/puppet/client/puppet.conf.erb

@@ -12,5 +12,3 @@ runtimeout = <%= @runtimeout %>
 show_diff = <%= @show_diff %>
 usecacheonfailure = <%= @usecacheonfailure %>
 number_of_facts_soft_limit = <%= @facts_soft_limit %>
-splay = <%= @splay %>
-splaylimit = <%= @splaylimit %>

site/roles/manifests/infra/dns/externaldns.pp

@@ -1,11 +0,0 @@
-# BIND server role for ExternalDNS integration
-class roles::infra::dns::externaldns {
-  if $facts['firstrun'] {
-    include profiles::defaults
-    include profiles::firstrun::init
-  } else {
-    include profiles::defaults
-    include profiles::base
-    include externaldns
-  }
-}