dns: dual-write toggles + drift fact

Publish records both ways during the k8s cutover, and expose expected vs
deployed records for drift detection.

- profiles::dns::updater + ::record: manage_nsupdate and manage_export
  booleans (both default on); export keeps the legacy master flow, so
  disable it once k8s is authoritative
- dns_records fact: parses the expected records file and digs the
  authoritative server for each, reporting expected / in_sync / drift
  (plus dns_records_insync boolean); updater writes the server address
  to /var/lib/dns-updater/server for the fact
- hiera: manage_export/manage_nsupdate = true (cutover)

hieradata/common.yaml

@@ -146,8 +146,6 @@ lookup_options:
       strategy: deep
   profiles::etcd::node::initial_cluster_token:
     convert_to: Sensitive
-  profiles::dns::updater::key_secret:
-    convert_to: Sensitive
   sysctl::base::values:
     merge:
       strategy: deep

hieradata/os/AlmaLinux/all_releases.yaml

@@ -85,13 +85,6 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
     gpgcheck: false
     mirrorlist: absent
-  rpm-vendor:
-    name: rpm-vendor
-    descr: rpm-vendor repository
-    target: /etc/yum.repos.d/rpm-vendor.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent
 
   # Additional repositories - default to absent, roles can override with ensure: present
   # FRRouting repositories

hieradata/roles/infra/storage/vault.yaml

@@ -29,4 +29,3 @@ profiles::nginx::simpleproxy::proxy_path: '/'
 profiles::packages::include:
   openbao-plugins: {}
   openbao-plugin-secrets-litellm: {}
-  openbao-plugin-secrets-gpg: {}

site/profiles/manifests/dns/updater.pp

@@ -23,12 +23,6 @@ class profiles::dns::updater (
   Stdlib::AbsolutePath        $state_dir       = '/var/lib/dns-updater',
   Stdlib::AbsolutePath        $config_dir      = '/etc/dns-updater',
   Stdlib::AbsolutePath        $master_basedir  = lookup('profiles::dns::master::basedir'),
-  # dns-updater daemon (replaces the dns-update shell script).
-  String                      $package_ensure   = 'installed',
-  Stdlib::AbsolutePath        $api_socket       = '/run/dns-updater/api.sock',
-  String                      $resync           = '10m',
-  Enum['debug', 'info', 'warn', 'error'] $log_level = 'info',
-  Boolean                     $watch_interfaces = true,
 ) {
 
   $state_file  = "${state_dir}/applied"
@@ -97,57 +91,36 @@ class profiles::dns::updater (
         })),
       }
 
-      # dns-updater daemon: watches the records file (inotify) and network
-      # interfaces, pushes TSIG-signed RFC2136 updates to $server natively.
-      package { 'dns-updater':
-        ensure => $package_ensure,
-      }
-
-      $env_content = @("ENV")
-        # Managed by puppet (profiles::dns::updater).
-        DNS_UPDATER_SERVER=${server}
-        DNS_UPDATER_KEY_FILE=${key_file}
-        DNS_UPDATER_RECORDS_FILE=${records_file}
-        DNS_UPDATER_STATE_FILE=${state_file}
-        DNS_UPDATER_API=${api_socket}
-        DNS_UPDATER_RESYNC=${resync}
-        DNS_UPDATER_WATCH_INTERFACES=${watch_interfaces}
-        DNS_UPDATER_LOG_LEVEL=${log_level}
-        | ENV
-
-      file { "${config_dir}/env":
+      file { '/usr/local/bin/dns-update':
         ensure  => file,
         owner   => 'root',
         group   => 'root',
-        mode    => '0644',
-        content => $env_content,
-        require => [File[$config_dir], Package['dns-updater']],
-      }
-
-      # Restart only on config/key change; records-file changes are picked up by
-      # the daemon's own inotify watch, so no service churn on record edits.
-      service { 'dns-updater':
-        ensure    => running,
-        enable    => true,
-        subscribe => [File["${config_dir}/env"], File[$key_file]],
-        require   => [Package['dns-updater'], Concat[$records_file], File[$key_file]],
-      }
-
-      # Retire the previous shell-based mechanism.
-      file { '/usr/local/bin/dns-update':
-        ensure => absent,
+        mode    => '0755',
+        content => epp('profiles/dns/dns-update.sh.epp', {
+            'server'       => $server,
+            'key_file'     => $key_file,
+            'records_file' => $records_file,
+            'state_file'   => $state_file,
+        }),
       }
 
       systemd::unit_file { 'dns-update.service':
-        ensure => absent,
-        active => false,
-        enable => false,
+        content => epp('profiles/dns/dns-update.service.epp', { 'script' => '/usr/local/bin/dns-update' }),
       }
 
+      # The .path unit watches the records file and triggers the service.
       systemd::unit_file { 'dns-update.path':
-        ensure => absent,
-        active => false,
-        enable => false,
+        content => epp('profiles/dns/dns-update.path.epp', { 'records_file' => $records_file }),
+        active  => true,
+        enable  => true,
+      }
+
+      # Also apply within the puppet run whenever the records change.
+      exec { 'dns-update-apply':
+        command     => '/usr/local/bin/dns-update',
+        refreshonly => true,
+        subscribe   => Concat[$records_file],
+        require     => [File['/usr/local/bin/dns-update'], File[$key_file]],
       }
     }
   }

site/profiles/templates/dns/dns-update.path.epp

@@ -0,0 +1,10 @@
+<%- | String $records_file | -%>
+[Unit]
+Description=Watch the DNS records file and apply changes
+
+[Path]
+PathModified=<%= $records_file %>
+Unit=dns-update.service
+
+[Install]
+WantedBy=multi-user.target

site/profiles/templates/dns/dns-update.service.epp

@@ -0,0 +1,9 @@
+<%- | String $script | -%>
+[Unit]
+Description=Apply host DNS records via nsupdate
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=<%= $script %>

site/profiles/templates/dns/dns-update.sh.epp

@@ -0,0 +1,56 @@
+<%- | String $server, String $key_file, String $records_file, String $state_file | -%>
+#!/bin/bash
+# Managed by puppet (profiles::dns::updater). Applies this host's records to the
+# authoritative DNS server via TSIG nsupdate. Only the delta since the last
+# successful run is sent; removed records are deleted.
+set -euo pipefail
+
+SERVER="<%= $server %>"
+KEYFILE="<%= $key_file %>"
+RECORDS="<%= $records_file %>"
+STATE="<%= $state_file %>"
+
+[ -f "$RECORDS" ] || exit 0
+touch "$STATE"
+
+# Format per line: zone|name|type|ttl|value  (name is relative to zone, or @).
+desired="$(grep -vE '^[[:space:]]*(#|$)' "$RECORDS" | sort -u || true)"
+applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)"
+
+[ "$desired" = "$applied" ] && exit 0
+
+fqdn() { # name zone
+  if [ -z "$1" ] || [ "$1" = "@" ]; then printf '%s.' "$2"; else printf '%s.%s.' "$1" "$2"; fi
+}
+
+msg="$(mktemp)"
+trap 'rm -f "$msg"' EXIT
+printf 'server %s\n' "$SERVER" >> "$msg"
+
+# Process per zone so each UPDATE message targets a single zone.
+zones="$(printf '%s\n%s\n' "$desired" "$applied" | cut -d'|' -f1 | sort -u | grep -v '^$' || true)"
+for zone in $zones; do
+  printf 'zone %s.\n' "$zone" >> "$msg"
+  # Additions/updates: replace the RRset for every desired record in this zone.
+  printf '%s\n' "$desired" | awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
+    while IFS='|' read -r z name type ttl value; do
+      f="$(fqdn "$name" "$z")"
+      printf 'update delete %s %s\n' "$f" "$type" >> "$msg"
+      printf 'update add %s %s %s %s\n' "$f" "$ttl" "$type" "$value" >> "$msg"
+    done
+  # Deletions: records present last run but gone now.
+  comm -23 <(printf '%s\n' "$applied") <(printf '%s\n' "$desired") | \
+    awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
+    while IFS='|' read -r z name type ttl value; do
+      f="$(fqdn "$name" "$z")"
+      printf 'update delete %s %s %s\n' "$f" "$type" "$value" >> "$msg"
+    done
+  printf 'send\n' >> "$msg"
+done
+
+if nsupdate -k "$KEYFILE" "$msg"; then
+  printf '%s\n' "$desired" > "$STATE"
+else
+  echo "dns-update: nsupdate to ${SERVER} failed" >&2
+  exit 1
+fi