feat: improve ci performance

split all pre-commit checks into individual workflows, so that
woodpecker spawns a container/job for each. this vastly improves the
time it takes for CI to complete checks for puppet

- create per-pre-commit-check pre-commit config files
- create per-pre-commit-check woodpecker workflows

.woodpecker/bolt-validate.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
     commands:
       - uvx pre-commit run --all-files --config ci/bolt-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1

.woodpecker/epp-validate.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
     commands:
       - uvx pre-commit run --all-files --config ci/epp-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1

.woodpecker/erb-validate.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
     commands:
       - uvx pre-commit run --all-files --config ci/erb-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1

.woodpecker/puppet-lint.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
     commands:
       - uvx pre-commit run --all-files --config ci/puppet-lint.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1

.woodpecker/puppet-validate.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
     commands:
       - uvx pre-commit run --all-files --config ci/puppet-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 2
-          limits:
-            memory: 2Gi
-            cpu: 2

.woodpecker/ruby-check.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
     commands:
       - uvx pre-commit run --all-files --config ci/ruby-check.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1

.woodpecker/ruby-validate.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
     commands:
       - uvx pre-commit run --all-files --config ci/ruby-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1

.woodpecker/yamllint.yaml

@@ -3,16 +3,6 @@ when:
 
 steps:
   - name: yamllint
-    image: git.unkin.net/unkin/almalinux9-base:20260606
+    image: git.unkin.net/unkin/almalinux9-base:20260317
     commands:
       - uvx pre-commit run --all-files --config ci/yamllint.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1

Puppetfile

@@ -53,6 +53,7 @@ mod 'saz-ssh', '13.1.0'
 mod 'saz-limits', '5.0.0'
 mod 'ghoneycutt-timezone', '4.0.0'
 mod 'ghoneycutt-puppet', '3.3.0'
+mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
 mod 'broadinstitute-certs', '3.0.1'

hiera.yaml

@@ -30,7 +30,6 @@ hierarchy:
       - "roles/%{::enc_role_tier1}.eyaml"
       - "roles/%{::enc_role_tier1}.yaml"
       - "virtual/%{facts.virtual}.yaml"
-      - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.%{facts.os.release.minor}.yaml"
       - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"
       - "os/%{facts.os.name}/all_releases.yaml"
       - "common.eyaml"

hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

@@ -1,7 +1,4 @@
 ---
-haproxy_server_k8s_syd1_traefik_internal: 'k8s-traefik-internal 198.18.200.4:443 ssl verify none check inter 2s rise 3 fall 2'
-haproxy_server_k8s_syd1_traefik_external: 'k8s-traefik-external 198.18.199.0:443 ssl verify none check inter 2s rise 3 fall 2'
-
 profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
 profiles::haproxy::dns::vrrp_cnames:
   - sonarr.main.unkin.net
@@ -19,7 +16,6 @@ profiles::haproxy::dns::vrrp_cnames:
   - mail.main.unkin.net
   - autoconfig.main.unkin.net
   - autodiscover.main.unkin.net
-  - auth.unkin.net
 
 profiles::haproxy::mappings:
   fe_http:
@@ -41,7 +37,6 @@ profiles::haproxy::mappings:
       - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
       - 'autoconfig.main.unkin.net be_stalwart_webadmin'
       - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
-      - 'auth.unkin.net be_k8s_kanidm'
   fe_https:
     ensure: present
     mappings:
@@ -61,7 +56,6 @@ profiles::haproxy::mappings:
       - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
       - 'autoconfig.main.unkin.net be_stalwart_webadmin'
       - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
-      - 'auth.unkin.net be_k8s_kanidm'
 
 profiles::haproxy::frontends:
   fe_http:
@@ -86,7 +80,6 @@ profiles::haproxy::frontends:
         - 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
         - 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
         - 'acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net'
-        - 'acl_kanidm req.hdr(host) -i auth.unkin.net'
         - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
       use_backend:
         - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -106,7 +99,6 @@ profiles::haproxy::frontends:
         - 'set-header X-Frame-Options DENY if acl_grafana'
         - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
         - 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
-        - 'set-header X-Frame-Options DENY if acl_kanidm'
         - 'set-header X-Content-Type-Options nosniff'
         - 'set-header X-XSS-Protection 1;mode=block'
 
@@ -328,26 +320,6 @@ profiles::haproxy::backends:
         - add-header X-Forwarded-Proto https if { dst_port 9443 }
       redirect: 'scheme https if !{ ssl_fc }'
       stick-table: 'type ip size 200k expire 30m'
-  be_k8s_kanidm:
-    description: Backend for Kanidm (auth.unkin.net via Kubernetes internal Traefik)
-    collect_exported: false
-    options:
-      balance: roundrobin
-      option:
-        - httpchk
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      http-check:
-        - 'connect ssl sni auth.unkin.net'
-        - 'send meth GET uri /status ver HTTP/1.1 hdr Host auth.unkin.net'
-        - 'expect status 200'
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      server: "%{lookup('haproxy_server_k8s_syd1_traefik_internal')} sni str(auth.unkin.net)"
   be_stalwart_imap:
     description: Backend for Stalwart IMAP (STARTTLS)
     collect_exported: false
@@ -421,7 +393,6 @@ profiles::haproxy::certlist::certificates:
   - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/vault/certificate.pem
 
 # additional altnames
@@ -451,4 +422,3 @@ certbot::client::domains:
   - git.unkin.net
   - grafana.unkin.net
   - dashboard.ceph.unkin.net
-  - auth.unkin.net

hieradata/os/AlmaLinux/AlmaLinux8.yaml

@@ -1,7 +1,7 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
 crypto_policies::policy: 'DEFAULT'
-almalinux-base-repo: almalinux
+
 profiles::packages::include:
   network-scripts: {}
 

hieradata/os/AlmaLinux/AlmaLinux9.7.yaml

@@ -1,2 +0,0 @@
----
-almalinux-base-repo: almalinux-vault

hieradata/os/AlmaLinux/AlmaLinux9.yaml

@@ -1,7 +1,7 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
 crypto_policies::policy: 'DEFAULT:SHA1'
-almalinux-base-repo: almalinux
+
 profiles::yum::global::repos:
   crb:
     ensure: present

hieradata/os/AlmaLinux/all_releases.yaml

@@ -23,45 +23,45 @@ profiles::yum::global::repos:
     name: baseos
     descr: baseos repository
     target: /etc/yum.repos.d/baseos.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   extras:
     name: extras
     descr: extras repository
     target: /etc/yum.repos.d/extras.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   appstream:
     name: appstream
     descr: appstream repository
     target: /etc/yum.repos.d/appstream.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   highavailability:
     name: highavailability
     descr: highavailability repository
     target: /etc/yum.repos.d/highavailability.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   crb:
     ensure: absent
     name: crb
     descr: crb repository
     target: /etc/yum.repos.d/crb.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   powertools:
     ensure: absent
     name: powertools
     descr: powertools repository
     target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
   epel:
     name: epel

hieradata/roles/infra/dns/resolver.yaml

@@ -6,10 +6,8 @@ hiera_include:
 profiles::dns::resolver::acls:
   acl-main.unkin.net:
     addresses:
-      - 198.18.1.10/32
+      - 10.10.8.1/32
-      - 198.18.2.160/27
       - 198.18.21.160/27
-      - 198.18.2.192/27
       - 198.18.21.192/27
       - 198.18.13.0/24
       - 198.18.14.0/24

hieradata/roles/infra/git/server.yaml

@@ -82,14 +82,8 @@ profiles::sql::postgresdb::dbname: gitea
 profiles::sql::postgresdb::dbuser: gitea
 
 # deploy gitea
-gitea::base_url: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/gitea'
+gitea::ensure: '1.22.4'
-gitea::install::checksums:
+gitea::checksum: 'd549104f55067e6fb156e7ba060c9af488f36e12d5e747db7563fcc99eaf8532'
-  1.26.2:
-    linux:
-      amd64: 5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a
-
-gitea::ensure: '1.26.2'
-gitea::checksum: '5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a'
 gitea::manage_user: false
 gitea::manage_group: false
 gitea::manage_home: false

hieradata/roles/infra/incus/node.yaml

@@ -5,10 +5,6 @@ hiera_include:
   - incus
   - zfs
   - profiles::ceph::node
-  - profiles::ceph::mon
-  - profiles::ceph::mgr
-  - profiles::ceph::mds
-  - profiles::ceph::osd
   - profiles::ceph::client
   - profiles::ceph::dashboard
   - profiles::storage::cephfsvols
@@ -103,7 +99,7 @@ profiles::yum::global::repos:
 profiles::dns::base::primary_interface: loopback0
 
 # dashboard/haproxy
-profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback2_ip')}"
+profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback0_ip')}"
 
 # networking
 systemd::manage_networkd: true

hieradata/roles/infra/k8s.yaml

@@ -2,7 +2,6 @@
 hiera_include:
   - profiles::selinux::setenforce
   - profiles::ceph::node
-  - profiles::ceph::osd
   - profiles::ceph::client
   - exporters::frr_exporter
   - frrouting
@@ -11,62 +10,6 @@ hiera_include:
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345
-rke2::manage_registries: true
-rke2::registries:
-  docker.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "dockerhub/$1"
-    disable-default-registry-endpoint: true
-  ghcr.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "ghcr/$1"
-    disable-default-registry-endpoint: true
-  quay.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "quay/$1"
-    disable-default-registry-endpoint: true
-  registry.k8s.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "k8s-registry/$1"
-    disable-default-registry-endpoint: true
-  registry.gitlab.com:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "gitlab/$1"
-    disable-default-registry-endpoint: true
-  docker.elastic.co:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "elastic/$1"
-    disable-default-registry-endpoint: true
-  gcr.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "gcr/$1"
-    disable-default-registry-endpoint: true
-  docker.litellm.ai:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "litellm/$1"
-    disable-default-registry-endpoint: true
-  public.ecr.aws:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "ecr-public/$1"
-    disable-default-registry-endpoint: true
 rke2::config_hash:
   bind-address: "%{hiera('networking_loopback0_ip')}"
   node-ip: "%{hiera('networking_loopback0_ip')}"
@@ -182,17 +125,6 @@ frrouting::ospf_exclude_k8s_enable: true
 frrouting::k8s_cluster_cidr: '10.42.0.0/16'  # RKE2 cluster-cidr (pods)
 frrouting::k8s_service_cidr: '10.43.0.0/16'  # RKE2 service-cidr
 
-# sysctl recommendations
-sysctl::base::values:
-  net.ipv4.conf.default.rp_filter:
-    value: '0'
-  net.ipv4.conf.all.rp_filter:
-    value: '0'
-  fs.inotify.max_user_watches:
-    value: '524288'
-  fs.inotify.max_user_instances:
-    value: '512'
-
 # add loopback interfaces to ssh list
 ssh::server::options:
   ListenAddress:

hieradata/roles/infra/metrics/grafana.yaml

@@ -11,7 +11,6 @@ profiles::metrics::grafana::db_name: "%{hiera('profiles::sql::postgresdb::dbname
 profiles::metrics::grafana::db_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
 profiles::metrics::grafana::db_pass: "%{hiera('profiles::sql::postgresdb::dbpass')}"
 profiles::metrics::grafana::pgsql_backend: true
-profiles::metrics::grafana::version: '13.0.2'
 profiles::metrics::grafana::plugins:
   victoriametrics-logs-datasource:
     ensure: present

hieradata/roles/infra/pki/certbot.yaml

@@ -16,4 +16,3 @@ certbot::domains:
   - git.unkin.net
   - grafana.unkin.net
   - dashboard.ceph.unkin.net
-  - auth.unkin.net

hieradata/roles/infra/puppet/master.yaml

@@ -26,7 +26,7 @@ profiles::puppet::cobbler_enc::packages:
   - 'requests'
   - 'PyYAML'
 profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
-profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
+profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkin/puppet-r10k.git
 profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
 profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
 profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'

modules/externaldns/manifests/master.pp

@@ -28,8 +28,8 @@ class externaldns::master inherits externaldns {
       dynamic         => true,
       allow_updates   => ['key externaldns-key'],
       allow_transfers => empty($slave_ips) ? {
-        true  => ['key externaldns-key'],
+        true  => [],
-        false => ['key externaldns-key','dns-slaves'],
+        false => ['dns-slaves'],
       },
       ns_notify       => !empty($slave_ips),
       also_notify     => $slave_ips,
@@ -42,4 +42,4 @@ class externaldns::master inherits externaldns {
     recursion => false,
     zones     => $externaldns::k8s_zones,
   }
-}
+}

modules/incus/manifests/cluster.pp

@@ -22,12 +22,7 @@ class incus::cluster (
     }
 
     # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
 
   # else use provided array from params
   }else{

modules/libs/lib/facter/ceph_services.rb

@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-
-require 'facter'
-
-# Detects active ceph service instances via systemctl and exposes facts
-# for use in ceph service management profiles.
-# rubocop:disable Style/ClassAndModuleChildren
-module Unkin
-  module Ceph
-    # Detects active ceph service instances via systemctl and exposes Facter facts.
-    module Utils
-      TYPES = %w[mon mgr mds osd].freeze
-
-      def self.services
-        output = Facter::Core::Execution.execute(
-          'systemctl list-units "ceph*" --no-legend --plain --all 2>/dev/null',
-          on_fail: ''
-        )
-        parse_units(output)
-      end
-
-      def self.parse_units(output)
-        result = TYPES.each_with_object({}) { |type, hash| hash[type] = [] }
-        output.each_line do |line|
-          unit = line.split.first
-          next unless unit
-
-          match_unit(result, unit)
-        end
-        result
-      end
-
-      def self.match_unit(result, unit)
-        TYPES.each do |type|
-          match = unit.match(/\Aceph-#{type}@(.+)\.service\z/)
-          result[type] << "ceph-#{type}@#{match[1]}" if match
-        end
-      end
-
-      TYPES.each do |type|
-        define_singleton_method(:"#{type}?") { !services[type].empty? }
-      end
-    end
-  end
-end
-# rubocop:enable Style/ClassAndModuleChildren
-
-Facter.add('ceph_services') do
-  setcode { Unkin::Ceph::Utils.services }
-end
-
-Unkin::Ceph::Utils::TYPES.each do |type|
-  Facter.add("is_ceph_#{type}") do
-    setcode { Unkin::Ceph::Utils.public_send(:"#{type}?") }
-  end
-end

modules/redisha/manifests/redis.pp

@@ -20,12 +20,7 @@ class redisha::redis (
     }
 
     # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
+    $servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))
-      "facts[certname] {
-        name = 'enc_role' and value = '${redisha_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
 
   # else use provided array from params
   }else{

modules/redisha/manifests/sentinel.pp

@@ -23,12 +23,7 @@ class redisha::sentinel (
     }
 
     # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
+    $servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))
-      "facts[certname] {
-        name = 'enc_role' and value = '${redisha_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
 
   # else use provided array from params
   }else{

modules/rke2/manifests/config.pp

@@ -7,8 +7,6 @@ class rke2::config (
   Stdlib::Fqdn            $bootstrap_node = $rke2::bootstrap_node,
   String                  $node_token = $rke2::node_token,
   Array[String[1]]        $extra_config_files = $rke2::extra_config_files,
-  Boolean                 $manage_registries = $rke2::manage_registries,
-  Hash                    $registries = $rke2::registries,
 ){
 
   # if its not the bootstrap node, add join path to config
@@ -30,24 +28,6 @@ class rke2::config (
     $config = $config_hash
   }
 
-  if $manage_registries {
-    file { '/etc/rancher/rke2/registries.yaml':
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => epp('rke2/registries.yaml.epp', { registries => $registries }),
-      require => Package["rke2-${node_type}"],
-      notify  => Service["rke2-${node_type}"],
-    }
-  }else{
-    file { '/etc/rancher/rke2/registries.yaml':
-      ensure  => absent,
-      require => Package["rke2-${node_type}"],
-      notify  => Service["rke2-${node_type}"],
-    }
-  }
-
   # create the config file
   file { $config_file:
     ensure  => file,

modules/rke2/manifests/init.pp

@@ -12,8 +12,6 @@ class rke2 (
   Hash                    $helm_repos = $rke2::params::helm_repos,
   Array[String[1]]        $extra_config_files = $rke2::params::extra_config_files,
   Stdlib::HTTPUrl         $container_archive_source = $rke2::params::container_archive_source,
-  Boolean                 $manage_registries = $rke2::params::manage_registries,
-  Hash                    $registries = $rke2::params::registries,
 ) inherits rke2::params {
 
   include rke2::install

modules/rke2/manifests/params.pp

@@ -12,6 +12,4 @@ class rke2::params (
   Hash                    $helm_repos = {},
   Array[String[1]]        $extra_config_files = [],
   Stdlib::HTTPUrl         $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
-  Boolean                 $manage_registries = false,
-  Hash                    $registries = {},
 ) {}

modules/rke2/templates/registries.yaml.epp

@@ -1,20 +0,0 @@
-<%- | Hash $registries | -%>
----
-# DO NOT MODIFY - MANAGED BY PUPPET
-mirrors:
-<%- $registries.each |$registry, $config| { -%>
-  <%= $registry %>:
-    endpoint:
-<%- $config['endpoint'].each |$ep| { -%>
-      - "<%= $ep %>"
-<%- } -%>
-<%- if $config['rewrite'] { -%>
-    rewrite:
-<%- $config['rewrite'].each |$pattern, $replacement| { -%>
-      "<%= $pattern %>": "<%= $replacement %>"
-<%- } -%>
-<%- } -%>
-<%- if $config['disable-default-registry-endpoint'] { -%>
-    disable-default-registry-endpoint: true
-<%- } -%>
-<%- } -%>

modules/stalwart/manifests/init.pp

@@ -167,13 +167,7 @@ class stalwart (
 
   # Query cluster members for validation
   $cluster_query = "enc_role='${cluster_role}' and country='${facts['country']}' and region='${facts['region']}'"
-  $cluster_members_raw = puppetdb_query(
+  $cluster_members_raw = query_nodes($cluster_query, 'networking.fqdn')
-    "facts[certname] {
-      name = 'enc_role' and value = '${cluster_role}' and
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-    }"
-  ).map |$fact| { $fact['certname'] }
   $cluster_members = $cluster_members_raw ? {
     undef   => [],
     default => $cluster_members_raw,
@@ -186,20 +180,7 @@ class stalwart (
 
   # Query HAProxy nodes for proxy trusted networks
   $haproxy_query = "enc_role='${haproxy_role}' and country='${facts['country']}' and region='${facts['region']}'"
-  $haproxy_members_raw = puppetdb_query(
+  $haproxy_members_raw = query_nodes($haproxy_query, 'networking.ip')
-    "facts[certname,value] {
-      name = 'networking' and
-      certname in facts[certname] {
-        name = 'enc_role' and value = '${haproxy_role}'
-      } and
-      certname in facts[certname] {
-        name = 'country' and value = '${facts['country']}'
-      } and
-      certname in facts[certname] {
-        name = 'region' and value = '${facts['region']}'
-      }
-    }"
-  ).map |$fact| { $fact['value']['ip'] }
   $haproxy_ips = $haproxy_members_raw ? {
     undef   => [],
     default => sort($haproxy_members_raw),

site/profiles/manifests/ceph/mds.pp

@@ -1,13 +0,0 @@
-class profiles::ceph::mds (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mds'] {
-    $facts['ceph_services']['mds'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}

site/profiles/manifests/ceph/mgr.pp

@@ -1,13 +0,0 @@
-class profiles::ceph::mgr (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mgr'] {
-    $facts['ceph_services']['mgr'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}

site/profiles/manifests/ceph/mon.pp

@@ -1,13 +0,0 @@
-class profiles::ceph::mon (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mon'] {
-    $facts['ceph_services']['mon'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}

site/profiles/manifests/ceph/osd.pp

@@ -1,13 +0,0 @@
-class profiles::ceph::osd (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_osd'] {
-    $facts['ceph_services']['osd'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}

site/profiles/manifests/consul/client.pp

@@ -28,12 +28,7 @@ class profiles::consul::client (
       }
 
       # if it is, find hosts, sort them so they dont cause changes every run
-      $servers_array = sort(puppetdb_query(
+      $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))
-        "facts[certname] {
-          name = 'enc_role' and value = '${members_role}' and
-          certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] })
 
     # else use provided array from params
     }else{

site/profiles/manifests/consul/server.pp

@@ -65,22 +65,12 @@ class profiles::consul::server (
       }
 
       # if it is, find hosts, sort them so they dont cause changes every run
-      $servers_array = sort(puppetdb_query(
+      $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))
-        "facts[certname] {
-          name = 'enc_role' and value = '${members_role}' and
-          certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] })
 
       if $join_remote_regions {
         # get all nodes in the members_role for each other region
         $region_to_servers = $remote_regions.reduce({}) |$memo, $region| {
-          $servers = sort(puppetdb_query(
+          $servers = sort(query_nodes("enc_role='${members_role}' and region='${region}'", 'networking.fqdn'))
-            "facts[certname] {
-              name = 'enc_role' and value = '${members_role}' and
-              certname in facts[certname] { name = 'region' and value = '${region}' }
-            }"
-          ).map |$fact| { $fact['certname'] })
           $memo + { $region => $servers }
         }
 

site/profiles/manifests/dns/base.pp

@@ -18,28 +18,9 @@ class profiles::dns::base (
   $nameserver_array = $ns_role ? {
     undef   => $nameservers,
     default => $use_ns ? {
-      'all'     => puppetdb_query(
+      'all'     => query_nodes("enc_role='${ns_role}'", 'networking.ip'),
-        "facts[certname,value] {
+      'region'  => query_nodes("enc_role='${ns_role}' and region=${facts['region']}", 'networking.ip'),
-          name = 'networking' and
+      'country' => query_nodes("enc_role='${ns_role}' and country=${facts['country']}", 'networking.ip'),
-          certname in nodes[certname] { facts.enc_role = '${ns_role}' }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
-      'region'  => puppetdb_query(
-        "facts[certname,value] {
-          name = 'networking' and
-          certname in nodes[certname] {
-            facts.enc_role = '${ns_role}' and facts.region = '${facts['region']}'
-          }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
-      'country' => puppetdb_query(
-        "facts[certname,value] {
-          name = 'networking' and
-          certname in nodes[certname] {
-            facts.enc_role = '${ns_role}' and facts.country = '${facts['country']}'
-          }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
     }
   }
 

site/profiles/manifests/dns/master.pp

@@ -20,21 +20,9 @@ class profiles::dns::master (
   $nameservers_array = $ns_role ? {
     undef   => [$facts['networking']['fqdn']],
     default => $use_ns ? {
-      'all'     => sort(puppetdb_query(
+      'all'     => sort(query_nodes("enc_role='${ns_role}'", 'networking.fqdn')),
-        "facts[certname] { name = 'enc_role' and value = '${ns_role}' }"
+      'region'  => sort(query_nodes("enc_role='${ns_role}' and region=${facts['region']}", 'networking.fqdn')),
-      ).map |$fact| { $fact['certname'] }),
+      'country' => sort(query_nodes("enc_role='${ns_role}' and country=${facts['country']}", 'networking.fqdn')),
-      'region'  => sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${ns_role}' and
-          certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] }),
-      'country' => sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${ns_role}' and
-          certname in facts[certname] { name = 'country' and value = '${facts['country']}' }
-        }"
-      ).map |$fact| { $fact['certname'] }),
     }
   }
 
@@ -44,9 +32,7 @@ class profiles::dns::master (
       $facts['networking']['fqdn'] => $facts['networking']['ip']
     },
     default => $nameservers_array.reduce({}) |$acc, $fqdn| {
-      $result = puppetdb_query(
+      $result = query_nodes("networking.fqdn='${fqdn}'", 'networking.ip')
-        "facts[certname,value] { name = 'networking' and certname = '${fqdn}' }"
-      ).map |$fact| { $fact['value']['ip'] }
       $ip = $result[0]
       $acc + { "${fqdn}." => $ip }
     }

site/profiles/manifests/etcd/node.pp

@@ -18,12 +18,7 @@ class profiles::etcd::node (
     }
 
     # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
 
   # else use provided array from params
   }else{
@@ -36,7 +31,7 @@ class profiles::etcd::node (
     $initial_cluster = $servers_array.map |$fqdn| {
 
       # lookup the ip address for the current fqdn
-      $ip = puppetdb_query("facts[certname,value] { name = 'networking' and certname = '${fqdn}' }").map |$fact| { $fact['value']['ip'] }[0]
+      $ip = query_nodes("networking.fqdn='${fqdn}'", 'networking.ip')[0]
 
       # construct the string for this server
       "${fqdn}=https://${ip}:${peer_port}"

site/profiles/manifests/haproxy/dns.pp

@@ -30,14 +30,13 @@ class profiles::haproxy::dns (
   }
 
   # if it is, find hosts, sort them so they dont cause changes every run
-  $servers_array = sort(puppetdb_query(
+  $servers_array = sort(query_nodes(
-    "facts[certname] {
+    "enc_role='${facts['enc_role']}' and
-      name = 'enc_role' and value = '${facts['enc_role']}' and
+      country='${facts['country']}' and
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
+      region='${facts['region']}' and
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' } and
+      environment='${facts['environment']}'",
-      certname in facts[certname] { name = 'environment' and value = '${facts['environment']}' }
+    'networking.fqdn'
-    }"
+  ))
-  ).map |$fact| { $fact['certname'] })
 
   # give enough time for a few hosts to be provisioned
   if length($servers_array) >= 3 {

site/profiles/manifests/metrics/grafana.pp

@@ -1,7 +1,6 @@
 # profiles::metrics::grafana
 class profiles::metrics::grafana (
   String    $ldap_bind_pass,
-  String    $version        = 'installed',
   Stdlib::Port $http_port   = 8080,
   String    $app_mode       = 'production',
   Boolean   $allow_sign_up  = false,
@@ -108,7 +107,6 @@ class profiles::metrics::grafana (
 
   # deploy grafana
   class { 'grafana':
-    version  => $version,
     cfg      => $cfg,
     ldap_cfg => $ldap_cfg,
     plugins  => $plugins,

site/profiles/manifests/minio/server.pp

@@ -98,15 +98,8 @@ class profiles::minio::server (
     }
 
     # if it is, find hosts, sort them so they dont cause changes every run
-    #$servers_array = sort(puppetdb_query(
+    #$servers_array = sort(query_nodes("enc_role='${minio_members_role}'", 'networking.fqdn'))
-    #  "facts[certname] { name = 'enc_role' and value = '${minio_members_role}' }"
+    $servers_array = sort(query_nodes("enc_role='${minio_members_role}' and minio_region='${minio_region}'", 'networking.fqdn'))
-    #).map |$fact| { $fact['certname'] })
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${minio_members_role}' and
-        certname in facts[certname] { name = 'minio_region' and value = '${minio_region}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
 
   # else use provided array from params
   }else{

site/profiles/manifests/ntp/client.pp

@@ -26,21 +26,9 @@ class profiles::ntp::client (
     $ntpserver_array = $ntp_role ? {
       undef   => $peers,
       default => $use_ntp ? {
-        'all'     => puppetdb_query(
+        'all'     => query_nodes("enc_role='${ntp_role}'", 'networking.fqdn'),
-          "facts[certname] { name = 'enc_role' and value = '${ntp_role}' }"
+        'region'  => query_nodes("enc_role='${ntp_role}' and region=${facts['region']}", 'networking.fqdn'),
-        ).map |$fact| { $fact['certname'] },
+        'country' => query_nodes("enc_role='${ntp_role}' and country=${facts['country']}", 'networking.fqdn'),
-        'region'  => puppetdb_query(
-          "facts[certname] {
-            name = 'enc_role' and value = '${ntp_role}' and
-            certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-          }"
-        ).map |$fact| { $fact['certname'] },
-        'country' => puppetdb_query(
-          "facts[certname] {
-            name = 'enc_role' and value = '${ntp_role}' and
-            certname in facts[certname] { name = 'country' and value = '${facts['country']}' }
-          }"
-        ).map |$fact| { $fact['certname'] },
       }
     }
 

site/profiles/manifests/proxmox/clusterinit.pp

@@ -24,13 +24,10 @@ class profiles::proxmox::clusterinit {
     }
   }
 
-  $servers_array = sort(puppetdb_query(
+  $servers_array = sort(query_nodes(
-    "facts[certname] {
+    "enc_role='${membersrole}' and country='${facts['country']}' and region='${facts['region']}'",
-      name = 'enc_role' and value = '${membersrole}' and
+    'networking.fqdn'
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
+  ))
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-    }"
-  ).map |$fact| { $fact['certname'] })
 
   if ! $profiles::proxmox::params::pve_clusterinit_master {
     if !empty($servers_array) {

site/profiles/manifests/proxmox/clusterjoin.pp

@@ -11,14 +11,13 @@ class profiles::proxmox::clusterjoin {
   $root_password      = $profiles::proxmox::params::root_password
 
   # query puppetdb for list of cluster members
-  $members_array = sort(puppetdb_query(
+  $members_array = sort(query_nodes(
-    "facts[certname] {
+    "enc_role='${membersrole}' and \
-      name = 'enc_role' and value = '${membersrole}' and
+    country='${facts['country']}' and \
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
+    region='${facts['region']}' and \
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' } and
+    pve_cluster.cluster_name='${clustername}'",
-      certname in facts[certname] { name = 'pve_cluster' and value.cluster_name = '${clustername}' }
+    'networking.fqdn'
-    }"
+  ))
-  ).map |$fact| { $fact['certname'] })
 
   # check if the pve kernerl is running
   if $facts['kernelrelease'] == $profiles::proxmox::params::pve_kernel_release {

site/profiles/manifests/sql/galera_member.pp

@@ -48,12 +48,7 @@ class profiles::sql::galera_member (
     }
 
     # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
+    $servers_array = sort(query_nodes("enc_role='${galera_members_role}' and region='${facts['region']}'", 'networking.fqdn'))
-      "facts[certname] {
-        name = 'enc_role' and value = '${galera_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
 
   # else use provided array from params
   }else{

site/profiles/manifests/sql/postgresdb.pp

@@ -18,12 +18,7 @@ class profiles::sql::postgresdb (
     }
 
     # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
 
   # else use provided array from params
   }else{

site/profiles/manifests/vault/server.pp

@@ -29,12 +29,7 @@ class profiles::vault::server (
   if $members_lookup and $members_role != undef {
 
     # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
 
   # else use provided array from params
   }else{