From 86cc00ab3d31e4d663904b411a77f5de9ca185aa Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 20 Sep 2026 00:51:00 +1000
Subject: [PATCH] Shorten metadata_expire on internal RPM repos

A package pinned in hieradata right after its RPM lands in artifactapi is
invisible to dnf until the host's 1h cached metadata expires, so the first
Puppet run after a release cannot find the version.

- Set metadata_expire 60s on rpm-internal/rpm-vendor and their per-release
  variants for AlmaLinux and Fedora
- Leave upstream mirrors on the 1h default
- Drop the stale expiry note in profiles::dns::updater
---
 hieradata/os/AlmaLinux/all_releases.yaml | 4 ++++
 hieradata/os/Fedora/all_releases.yaml    | 2 ++
 site/profiles/manifests/dns/updater.pp   | 3 +--
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/hieradata/os/AlmaLinux/all_releases.yaml b/hieradata/os/AlmaLinux/all_releases.yaml
index 5b5320e..3ff5da7 100644
--- a/hieradata/os/AlmaLinux/all_releases.yaml
+++ b/hieradata/os/AlmaLinux/all_releases.yaml
@@ -77,6 +77,7 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
     gpgcheck: false
     mirrorlist: absent
+    metadata_expire: '60'
   rpm-vendor:
     name: rpm-vendor
     descr: rpm-vendor repository
@@ -84,6 +85,7 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
     gpgcheck: false
     mirrorlist: absent
+    metadata_expire: '60'
   # Per-release variants, resolved from the host's EL major version so el8
   # hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
   rpm-internal-release:
@@ -93,6 +95,7 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
     gpgcheck: false
     mirrorlist: absent
+    metadata_expire: '60'
   rpm-vendor-release:
     name: rpm-vendor-el%{facts.os.release.major}
     descr: rpm-vendor-el%{facts.os.release.major} repository
@@ -100,6 +103,7 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
     gpgcheck: false
     mirrorlist: absent
+    metadata_expire: '60'
 
   # Additional repositories - default to absent, roles can override with ensure: present
   # FRRouting repositories
diff --git a/hieradata/os/Fedora/all_releases.yaml b/hieradata/os/Fedora/all_releases.yaml
index 5e05288..4470b0b 100644
--- a/hieradata/os/Fedora/all_releases.yaml
+++ b/hieradata/os/Fedora/all_releases.yaml
@@ -60,6 +60,7 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f%{facts.os.release.major}/
     gpgcheck: false
     mirrorlist: absent
+    metadata_expire: '60'
   rpm-vendor:
     name: rpm-vendor-f%{facts.os.release.major}
     descr: rpm-vendor-f%{facts.os.release.major} repository
@@ -67,3 +68,4 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f%{facts.os.release.major}/
     gpgcheck: false
     mirrorlist: absent
+    metadata_expire: '60'
diff --git a/site/profiles/manifests/dns/updater.pp b/site/profiles/manifests/dns/updater.pp
index 17d914d..7ee2641 100644
--- a/site/profiles/manifests/dns/updater.pp
+++ b/site/profiles/manifests/dns/updater.pp
@@ -24,8 +24,7 @@ class profiles::dns::updater (
   Stdlib::AbsolutePath        $config_dir      = '/etc/dns-updater',
   Stdlib::AbsolutePath        $master_basedir  = lookup('profiles::dns::master::basedir'),
   # dns-updater daemon (replaces the dns-update shell script). 'latest' so hosts
-  # pick up new releases (e.g. the record filter); rpm-internal metadata_expire
-  # is 1h so this does not thrash.
+  # pick up new releases (e.g. the record filter).
   String                      $package_ensure   = 'latest',
   Stdlib::AbsolutePath        $api_socket       = '/run/dns-updater/api.sock',
   String                      $resync           = '10m',
-- 
2.47.3