rke2,puppet: enforce versionlock before package install #514

Merged

benvin merged 1 commits from benvin/versionlock-before-upgrade into develop 2026-08-08 20:00:43 +10:00

Conversation 0 Commits 1 Files Changed 2

+4 -2

unkinben commented 2026-08-08 19:53:20 +10:00

Owner

Copy Link

Copy Source

Why

A package versionlock is only effective if it is applied before the package resource is evaluated. When the package is upgraded/installed first and locked afterwards, dnf can pull an unpinned version and the lock then pins whatever landed. This is the exact drift that let new RKE2 nodes boot 1.33.11 instead of the pinned version, and it also matters because a global dnf update -y autoupdate timer (profiles::yum::autoupdater) relies on the versionlock plugin already having the lock written.

Changes

• rke2::install orders the versionlock ahead of the package: adds before => Package["rke2-${node_type}"] so the lock exists before install/upgrade.
• profiles::puppet::agent (RedHat branch) adds before => Package[$use_package] on the versionlock for the same reason.
• Leaves profiles::gitea::runner and profiles::vault::server unchanged: both already order the versionlock ahead of the package (before => Package / before => Class['vault']).
• Changes ordering only; locked versions (including the RKE2 pin) are untouched. No dependency cycle is introduced (packages hold no back-reference to the versionlock).

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

## Why A package versionlock is only effective if it is applied **before** the package resource is evaluated. When the package is upgraded/installed first and locked afterwards, dnf can pull an unpinned version and the lock then pins whatever landed. This is the exact drift that let new RKE2 nodes boot 1.33.11 instead of the pinned version, and it also matters because a global `dnf update -y` autoupdate timer (`profiles::yum::autoupdater`) relies on the versionlock plugin already having the lock written. ## Changes - `rke2::install` orders the versionlock ahead of the package: adds `before => Package["rke2-${node_type}"]` so the lock exists before install/upgrade. - `profiles::puppet::agent` (RedHat branch) adds `before => Package[$use_package]` on the versionlock for the same reason. - Leaves `profiles::gitea::runner` and `profiles::vault::server` unchanged: both already order the versionlock ahead of the package (`before => Package` / `before => Class['vault']`). - Changes ordering only; locked versions (including the RKE2 pin) are untouched. No dependency cycle is introduced (packages hold no back-reference to the versionlock). https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

unkinben added 1 commit 2026-08-08 19:53:21 +10:00

rke2,puppet: enforce versionlock before package install ... 2c478ac029

A versionlock is useless if the package resource is evaluated before the
lock is in place: dnf upgrades the package to an unpinned version, then the
lock pins whatever landed. This is the drift that let new RKE2 nodes boot
1.33.11 instead of the pinned version.

Order the versionlock ahead of the package everywhere the two lacked a
relationship:

- rke2::install adds before => Package["rke2-${node_type}"] on the
  versionlock so the lock exists before install/upgrade.
- profiles::puppet::agent (RedHat) adds before => Package[$use_package] on
  the versionlock for the same reason.

profiles::gitea::runner and profiles::vault::server already ordered the
versionlock ahead of the package (before => Package / before => Class) and
are unchanged. Locked versions themselves are untouched.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

benvin merged commit 0fdc7c97d8 into develop 2026-08-08 20:00:43 +10:00

benvin deleted branch benvin/versionlock-before-upgrade 2026-08-08 20:00:43 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#514