Add profiles::puppet::migrate: repoint VM agents onto puppet-on-k8s #493

Merged

benvin merged 2 commits from benvin/puppet-k8s-migrate into develop 2026-07-25 00:04:11 +10:00

Conversation 0 Commits 2 Files Changed 4

+152 -14

2 Commits

Author	SHA1	Message	Date
unkinben	7d75dcd188	puppet::migrate: drive k8s cutover from a single enabled boolean ... Wire profiles::puppet::migrate into profiles::base (shipping enabled=>false) so every node evaluates it. client.pp now includes migrate and folds new_server/new_ca_server/new_ssldir into the effective server/ca_server/ report_server/ssldir it renders, so flipping the one profiles::puppet::migrate::enabled key at any hiera layer (node/role/common) repoints a target -- no per-node client param overrides. Explicit client::ssldir/::report_server still override the migrate-derived value; unmigrated nodes render a byte-identical puppet.conf.	2026-07-24 23:48:59 +10:00
unkinben	22faf00628	Add profiles::puppet::migrate to repoint VM agents onto puppet-on-k8s ... Migrate VM puppet agents off the legacy VM puppetmasters and onto the new puppet-on-kubernetes servers, per-wave via hiera and reversible without re-enrolment. Changing server/ca_server alone is insufficient: the agent's ssldir holds a cert signed by the OLD CA that the new CA neither trusts nor recognises. This switches migrated nodes to a FRESH ssldir so the agent generates a new CSR (autosigned on the k8s CA) while the old creds stay on disk for rollback. - Add profiles::puppet::migrate: opt-in (hiera_include) toggle that owns the fresh ssldir directory and documents per-node/per-role/common wiring plus rollback in its class header. - Extend profiles::puppet::client with optional $ssldir and $report_server params (default undef); the ERB template omits both lines when unset, so unmigrated nodes render a byte-identical puppet.conf. - puppet.conf stays owned solely by client.pp's template; migrate.pp adds no competing File resource.	2026-07-24 22:42:28 +10:00