Migrate git servers to puppet-on-k8s

The git redis nodes build their redisha peer list from a puppetdb_query of their own role, so all members must move to puppet-on-k8s together.

- enable profiles::puppet::migrate for roles::infra::git::redis

Reviewed-on: #564
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/roles/infra/git/redis.yaml

@@ -14,6 +14,8 @@ profiles::ssh::sign::principals:
 hiera_include:
   - redisha
 
+profiles::puppet::migrate::enabled: true
+
 redisha::manage_repo: false
 redisha::redisha_members_lookup: true
 redisha::redisha_members_role: roles::infra::git::redis

hieradata/roles/infra/git/server.yaml

@@ -6,6 +6,8 @@ hiera_include:
   - profiles::gitea::haproxy
   - gitea
 
+profiles::puppet::migrate::enabled: true
+
 # additional altnames
 profiles::pki::vault::alt_names:
   - git.unkin.net

hieradata/roles/infra/storage/consul.yaml

@@ -3,6 +3,8 @@ hiera_include:
   - frrouting
   - exporters::frr_exporter
 
+profiles::puppet::migrate::enabled: true
+
 profiles::consul::server::members_lookup: true
 profiles::consul::server::data_dir: /data/consul
 profiles::consul::server::addresses:

hieradata/roles/infra/storage/vault.yaml

@@ -1,4 +1,6 @@
 ---
+profiles::puppet::migrate::enabled: true
+
 profiles::vault::server::members_role: roles::infra::storage::vault
 profiles::vault::server::members_lookup: true
 profiles::vault::server::data_dir: /data/vault

site/profiles/manifests/puppet/migrate.pp

@@ -17,6 +17,8 @@
 # still points at it when it applies this change). profiles::puppet::client
 # rewrites puppet.conf with the new server / ca_server / report_server / ssldir
 # and notifies Service['puppet'], so the very next agent run lands on k8s.
+# The puppet.conf change also fires a detached noop run so facts and exported
+# resources register in the k8s PuppetDB immediately.
 #
 # NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
 # out and rolled back one target at a time. The class only manages the fresh
@@ -83,5 +85,15 @@ class profiles::puppet::migrate (
       group  => 'root',
       mode   => '0771',
     }
+
+    exec { 'puppet-migrate-noop-run':
+      command     => join([
+        '/usr/bin/systemd-run --unit=puppet-migrate-noop --collect',
+        '/opt/puppetlabs/bin/puppet agent --onetime --no-daemonize --noop --no-splay --waitforlock 10 --maxwaitforlock 900',
+      ], ' '),
+      unless      => '/usr/bin/systemctl is-active --quiet puppet-migrate-noop',
+      refreshonly => true,
+      subscribe   => File['/etc/puppetlabs/puppet/puppet.conf'],
+    }
   }
 }