Migrate git servers to puppet-on-k8s

hieradata/roles/infra/auth/glauth.yaml

@@ -2,8 +2,6 @@
 hiera_include:
   - glauth
 
-profiles::puppet::migrate::enabled: true
-
 # additional altnames
 profiles::pki::vault::alt_names:
   - ldap.main.unkin.net

hieradata/roles/infra/ceph/rgw.yaml

@@ -3,8 +3,6 @@ hiera_include:
   - profiles::ceph::rgw
   - profiles::nginx::simpleproxy
 
-profiles::puppet::migrate::enabled: true
-
 profiles::ceph::rgw::enable: true
 
 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package

hieradata/roles/infra/cobbler/server.yaml

@@ -4,8 +4,6 @@ hiera_include:
   - frrouting
   - exporters::frr_exporter
 
-profiles::puppet::migrate::enabled: true
-
 profiles::packages::include:
   cobbler: {}
   cobbler3.2-web: {}

hieradata/roles/infra/dhcp/server.yaml

@@ -4,8 +4,6 @@ hiera_include:
   - profiles::dhcp::server
   - exporters::frr_exporter
 
-profiles::puppet::migrate::enabled: true
-
 # networking
 anycast_ip: 198.18.19.18
 systemd::manage_networkd: true

hieradata/roles/infra/git/server.yaml

@@ -6,6 +6,8 @@ hiera_include:
   - profiles::gitea::haproxy
   - gitea
 
+profiles::puppet::migrate::enabled: true
+
 # additional altnames
 profiles::pki::vault::alt_names:
   - git.unkin.net

hieradata/roles/infra/proxy/jumphost.yaml

@@ -1,5 +1,3 @@
-profiles::puppet::migrate::enabled: true
-
 profiles::pki::vault::alt_names:
   - jumphost.service.consul
   - jumphost.query.consul

hieradata/roles/infra/puppet/master.yaml

@@ -31,7 +31,7 @@ profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-
 # Deep-merged with the entries in roles/infra/puppet.yaml.
 profiles::packages::include:
   encapic:
-    ensure: '0.5.0'
+    ensure: '0.2.0'
   certmanager:
     ensure: '0.2.0'
   sshsignhost:

site/profiles/manifests/puppet/encapic.pp

@@ -5,13 +5,14 @@
 # config so the encapi endpoint can change without repackaging.
 class profiles::puppet::encapic (
   Stdlib::HTTPUrl       $encapi_url,
-  Stdlib::AbsolutePath  $config_dir = '/etc/encapi',
+  Stdlib::AbsolutePath  $config_dir = '/etc/encapic',
   String                $config_name = 'encapic.conf',
   String                $owner = 'root',
   String                $group = 'root',
 ) {
 
-  # order after the package so the shim exists before the config does.
+  # The RPM ships this file as %config(noreplace), so puppet must write it only
+  # once the package is present or the install overwrites it.
   file { $config_dir:
     ensure  => directory,
     mode    => '0755',
@@ -28,11 +29,4 @@ class profiles::puppet::encapic (
     content => "ENCAPI_URL=${encapi_url}\n",
     require => File[$config_dir],
   }
-
-  # legacy pre-0.5.0 config dir; also clears any rpm .rpmsave left behind
-  file { '/etc/encapic':
-    ensure  => absent,
-    force   => true,
-    require => Package['encapic'],
-  }
 }