From 6c5e894018e571aaf8e6a850a96ab151b50b58a9 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 19 Sep 2026 23:37:01 +1000
Subject: [PATCH 1/2] Install encapic ENC client on puppet masters

The VM masters classify through the cobbler ENC while the k8s compilers
already use encapi. Install the client ahead of that cutover;
external_nodes still points at cobbler-enc, so classification is unchanged.

- pin the encapic package to 0.2.0 via profiles::packages::include
- add profiles::puppet::encapic managing /etc/encapic/encapic.conf from a
  hiera-driven ENCAPI_URL, ordered after profiles::packages
- include the class from profiles::puppet::puppetmaster
---
 hieradata/roles/infra/puppet/master.yaml      |  9 ++++++
 site/profiles/manifests/puppet/encapic.pp     | 32 +++++++++++++++++++
 .../profiles/manifests/puppet/puppetmaster.pp |  1 +
 3 files changed, 42 insertions(+)
 create mode 100644 site/profiles/manifests/puppet/encapic.pp

diff --git a/hieradata/roles/infra/puppet/master.yaml b/hieradata/roles/infra/puppet/master.yaml
index 7673440..da9809b 100644
--- a/hieradata/roles/infra/puppet/master.yaml
+++ b/hieradata/roles/infra/puppet/master.yaml
@@ -26,6 +26,15 @@ profiles::puppet::cobbler_enc::packages:
   - 'requests'
   - 'PyYAML'
 profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
+
+# encapic is installed alongside the cobbler ENC; external_nodes still points
+# at cobbler-enc. Deep-merged with the entries in roles/infra/puppet.yaml.
+profiles::packages::include:
+  encapic:
+    ensure: '0.2.0'
+
+profiles::puppet::encapic::encapi_url: https://encapi.k8s.syd1.au.unkin.net
+
 profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
 profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
 profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
diff --git a/site/profiles/manifests/puppet/encapic.pp b/site/profiles/manifests/puppet/encapic.pp
new file mode 100644
index 0000000..85096e8
--- /dev/null
+++ b/site/profiles/manifests/puppet/encapic.pp
@@ -0,0 +1,32 @@
+# Class: profiles::puppet::encapic
+#
+# Manages the configuration for the encapic ENC client. The package itself is
+# installed through profiles::packages (pinned in hiera); this class owns the
+# config so the encapi endpoint can change without repackaging.
+class profiles::puppet::encapic (
+  Stdlib::HTTPUrl       $encapi_url,
+  Stdlib::AbsolutePath  $config_dir = '/etc/encapic',
+  String                $config_name = 'encapic.conf',
+  String                $owner = 'root',
+  String                $group = 'root',
+) {
+
+  # The RPM ships this file as %config(noreplace), so puppet must write it only
+  # once the package is present or the install overwrites it.
+  file { $config_dir:
+    ensure  => directory,
+    mode    => '0755',
+    owner   => $owner,
+    group   => $group,
+    require => Class['profiles::packages'],
+  }
+
+  file { "${config_dir}/${config_name}":
+    ensure  => file,
+    mode    => '0644',
+    owner   => $owner,
+    group   => $group,
+    content => "ENCAPI_URL=${encapi_url}\n",
+    require => File[$config_dir],
+  }
+}
diff --git a/site/profiles/manifests/puppet/puppetmaster.pp b/site/profiles/manifests/puppet/puppetmaster.pp
index 35d326d..dea779d 100644
--- a/site/profiles/manifests/puppet/puppetmaster.pp
+++ b/site/profiles/manifests/puppet/puppetmaster.pp
@@ -12,6 +12,7 @@ class profiles::puppet::puppetmaster (
     include profiles::puppet::g10k
     include profiles::puppet::enc
     include profiles::puppet::cobbler_enc
+    include profiles::puppet::encapic
     include profiles::puppet::autosign
     include profiles::puppet::gems
     include profiles::helpers::certmanager
-- 
2.47.3


From f01ef43ae9604083ad4828fccff6a1aea25cd2ea Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 19 Sep 2026 23:52:31 +1000
Subject: [PATCH 2/2] Require Package[encapic] for the encapic config dir

---
 site/profiles/manifests/puppet/encapic.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/site/profiles/manifests/puppet/encapic.pp b/site/profiles/manifests/puppet/encapic.pp
index 85096e8..ecb0ed5 100644
--- a/site/profiles/manifests/puppet/encapic.pp
+++ b/site/profiles/manifests/puppet/encapic.pp
@@ -18,7 +18,7 @@ class profiles::puppet::encapic (
     mode    => '0755',
     owner   => $owner,
     group   => $group,
-    require => Class['profiles::packages'],
+    require => Package['encapic'],
   }
 
   file { "${config_dir}/${config_name}":
-- 
2.47.3