site/profiles/manifests/base.pp

@@ -12,6 +12,9 @@ class profiles::base () {
     # manage the puppet agent
     include profiles::puppet::agent
     include profiles::puppet::client
+    # k8s migration switch; ships disabled, flip its ::enabled boolean in
+    # hiera (node/role/common) to repoint a target onto puppet-on-k8s.
+    include profiles::puppet::migrate
 
     # include the base profiles
     include profiles::base::repos

site/profiles/manifests/puppet/client.pp

@@ -19,6 +19,49 @@ class profiles::puppet::client (
   Optional[Stdlib::Absolutepath] $ssldir = undef,
 ) {
 
+  # Pull in the k8s-migration switch. When
+  # profiles::puppet::migrate::enabled is true at ANY hiera layer
+  # (node/role/common) the effective endpoints below flip to the k8s
+  # servers and a fresh ssldir -- no other hiera keys required. This class
+  # never includes client.pp, so there is no include cycle.
+  include profiles::puppet::migrate
+
+  # Effective values fed to the template. Precedence differs by param type:
+  #
+  #   ssldir / report_server (Optional, default undef): an explicit client
+  #     param wins; else the migrate-derived value when enabled; else the
+  #     legacy default (undef -> template omits ssldir; report_server -> server).
+  #
+  #   server / ca_server (String, no undef sentinel): the migrate value wins
+  #     when migrate::enabled, otherwise the client param (which is the legacy
+  #     default unless an operator set it explicitly in hiera). To pin a
+  #     bespoke server while enabled, leave enabled => false for that target
+  #     and set profiles::puppet::client::server directly.
+  $migrate_on = $profiles::puppet::migrate::enabled
+
+  $effective_server = $migrate_on ? {
+    true    => $profiles::puppet::migrate::new_server,
+    default => $server,
+  }
+  $effective_ca_server = $migrate_on ? {
+    true    => $profiles::puppet::migrate::new_ca_server,
+    default => $ca_server,
+  }
+  # report_server: explicit param wins; else follow the effective server.
+  $effective_report_server = $report_server ? {
+    undef   => $effective_server,
+    default => $report_server,
+  }
+  # ssldir: explicit param wins; else the fresh k8s ssldir when migrating;
+  # else undef (template omits the key, i.e. puppet's built-in default).
+  $effective_ssldir = $ssldir ? {
+    undef   => $migrate_on ? {
+      true    => $profiles::puppet::migrate::new_ssldir,
+      default => undef,
+    },
+    default => $ssldir,
+  }
+
   # dont manage puppet.conf if this is a puppetmaster
   if $facts['enc_role'] != 'roles::infra::puppet::master' {
 

site/profiles/manifests/puppet/migrate.pp

@@ -21,48 +21,45 @@
 # NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
 # out and rolled back one target at a time. The class only manages the fresh
 # ssldir; the actual puppet.conf changes ride on profiles::puppet::client's
-# existing template via its $server / $ca_server / $report_server / $ssldir
+# existing template. client.pp `include`s this class and, when enabled, folds
-# params (see the hiera block below). Do NOT add a second File resource for
+# new_server / new_ca_server / new_ssldir into the effective server /
-# puppet.conf here -- client.pp already owns it.
+# ca_server / report_server / ssldir it renders. Do NOT add a second File
+# resource for puppet.conf here -- client.pp already owns it.
 #
-# == Wiring (hiera_include convention)
+# == Wiring (single boolean)
 #
-# This class is opt-in via hiera_include; it is not pulled in by
+# This class ships wired into profiles::base with enabled => false, so every
-# profiles::base. To migrate a target add the class to hiera_include AND flip
+# node evaluates it but nothing changes until the boolean is flipped. Because
-# the client params so puppet.conf carries the new endpoints + fresh ssldir.
+# client.pp includes it and reads its params, setting the ONE key below at any
+# hiera layer repoints a target -- no client.pp param overrides needed.
+#
+# The endpoints (new_server / new_ca_server / new_ssldir) are param defaults
+# on this class; override them in hiera too if the k8s names ever change.
 #
 # --- Canary: one node -> hieradata/nodes/<certname>.yaml -------------------
-#   hiera_include:
-#     - profiles::puppet::migrate
-#
 #   profiles::puppet::migrate::enabled: true
-#
-#   # repoint the agent (client.pp owns puppet.conf; migrate.pp owns ssldir)
-#   profiles::puppet::client::server: 'puppet.k8s.syd1.au.unkin.net'
-#   profiles::puppet::client::ca_server: 'puppetca.k8s.syd1.au.unkin.net'
-#   profiles::puppet::client::report_server: 'puppet.k8s.syd1.au.unkin.net'
-#   profiles::puppet::client::ssldir: '/etc/puppetlabs/puppet/ssl-k8s'
 # ---------------------------------------------------------------------------
 #
 # --- Wave: a whole role -> hieradata/roles/<t1>/<t2>[/<t3>].yaml -----------
-#   (same keys as the canary block above)
+#   profiles::puppet::migrate::enabled: true
 # ---------------------------------------------------------------------------
 #
-# --- Final flip: hieradata/common.yaml (retires the legacy masters) --------
+# --- Estate flip -> hieradata/common.yaml (retires the legacy masters) -----
-#   profiles::puppet::client::server: 'puppet.k8s.syd1.au.unkin.net'
+#   profiles::puppet::migrate::enabled: true
-#   profiles::puppet::client::ca_server: 'puppetca.k8s.syd1.au.unkin.net'
-#   profiles::puppet::client::report_server: 'puppet.k8s.syd1.au.unkin.net'
-#   profiles::puppet::client::ssldir: '/etc/puppetlabs/puppet/ssl-k8s'
-#   # profiles::puppet::migrate no longer needs to be in hiera_include once the
-#   # fleet default points at k8s and the fresh ssldir exists everywhere.
 # ---------------------------------------------------------------------------
 #
+# Manual override: profiles::puppet::client::ssldir and ::report_server are
+# Optional and, when set explicitly in hiera, win over the migrate-derived
+# value. server / ca_server have no undef sentinel, so while enabled => true
+# the migrate endpoints win; to point a target at a bespoke server leave
+# enabled => false for it and set profiles::puppet::client::server directly.
+#
 # == Rollback (per target)
 #
-# Delete the migration block from the node/role hiera (or set the client keys
+# Remove the profiles::puppet::migrate::enabled key (or set it back to false)
-# back to the legacy values and drop the ssldir override). The next run
+# at the node/role/common layer. The next run rewrites puppet.conf back to the
-# rewrites puppet.conf back to the legacy ssldir, which still contains the
+# legacy server + legacy ssldir, which still contains the original CA-signed
-# original CA-signed cert, and the node is back on the VM masters.
+# cert, and the node is back on the VM masters.
 #
 # site/profiles/manifests/puppet/migrate.pp
 class profiles::puppet::migrate (

site/profiles/templates/puppet/client/puppet.conf.erb

@@ -1,15 +1,15 @@
 [main]
 dns_alt_names = <%= @dns_alt_names_string %>
-<% unless @ssldir.nil? -%>
+<% unless @effective_ssldir.nil? -%>
-ssldir = <%= @ssldir %>
+ssldir = <%= @effective_ssldir %>
 <% end -%>
 
 [agent]
-server = <%= @server %>
+server = <%= @effective_server %>
-ca_server = <%= @ca_server %>
+ca_server = <%= @effective_ca_server %>
 environment = <%= @environment %>
 report = true
-report_server = <%= @report_server.nil? ? @server : @report_server %>
+report_server = <%= @effective_report_server.nil? ? @effective_server : @effective_report_server %>
 runinterval = <%= @runinterval %>
 runtimeout = <%= @runtimeout %>
 show_diff = <%= @show_diff %>