# Class: profiles::puppet::migrate
#
# Repoints a VM puppet agent from the legacy VM puppetmasters onto the new
# puppet-on-kubernetes servers.
#
# The agent's existing ssldir holds a client certificate signed by the OLD CA;
# the new k8s CA will neither trust that cert nor recognise the agent. Rather
# than revoke/clean the old creds (which would burn the rollback path), this
# class switches the agent to a FRESH ssldir. On the next run the agent finds
# an empty ssldir, generates a new key + CSR, submits it to the new CA
# (autosign = true on the k8s side signs it immediately), and then pulls its
# catalog from the new compilers. The OLD ssldir is left untouched on disk, so
# reverting the hiera below restores the node to the legacy masters with no
# re-enrolment.
#
# The catalog that performs the switch is compiled by the OLD server (the node
# still points at it when it applies this change). profiles::puppet::client
# rewrites puppet.conf with the new server / ca_server / report_server / ssldir
# and notifies Service['puppet'], so the very next agent run lands on k8s.
#
# NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
# out and rolled back one target at a time. The class only manages the fresh
# ssldir; the actual puppet.conf changes ride on profiles::puppet::client's
# existing template. client.pp `include`s this class and, when enabled, folds
# new_server / new_ca_server / new_ssldir into the effective server /
# ca_server / report_server / ssldir it renders. Do NOT add a second File
# resource for puppet.conf here -- client.pp already owns it.
#
# == Wiring (single boolean)
#
# This class ships wired into profiles::base with enabled => false, so every
# node evaluates it but nothing changes until the boolean is flipped. Because
# client.pp includes it and reads its params, setting the ONE key below at any
# hiera layer repoints a target -- no client.pp param overrides needed.
#
# The endpoints (new_server / new_ca_server / new_ssldir) are param defaults
# on this class; override them in hiera too if the k8s names ever change.
#
# --- Canary: one node -> hieradata/nodes/<certname>.yaml -------------------
#   profiles::puppet::migrate::enabled: true
# ---------------------------------------------------------------------------
#
# --- Wave: a whole role -> hieradata/roles/<t1>/<t2>[/<t3>].yaml -----------
#   profiles::puppet::migrate::enabled: true
# ---------------------------------------------------------------------------
#
# --- Estate flip -> hieradata/common.yaml (retires the legacy masters) -----
#   profiles::puppet::migrate::enabled: true
# ---------------------------------------------------------------------------
#
# Manual override: profiles::puppet::client::ssldir and ::report_server are
# Optional and, when set explicitly in hiera, win over the migrate-derived
# value. server / ca_server have no undef sentinel, so while enabled => true
# the migrate endpoints win; to point a target at a bespoke server leave
# enabled => false for it and set profiles::puppet::client::server directly.
#
# == Rollback (per target)
#
# Remove the profiles::puppet::migrate::enabled key (or set it back to false)
# at the node/role/common layer. The next run rewrites puppet.conf back to the
# legacy server + legacy ssldir, which still contains the original CA-signed
# cert, and the node is back on the VM masters.
#
# site/profiles/manifests/puppet/migrate.pp
class profiles::puppet::migrate (
  Boolean $enabled                          = false,
  String $new_server                        = 'puppet.k8s.syd1.au.unkin.net',
  String $new_ca_server                     = 'puppetca.k8s.syd1.au.unkin.net',
  Stdlib::Absolutepath $new_ssldir          = '/etc/puppetlabs/puppet/ssl-k8s',
) {

  # never touch the puppet masters themselves (same guard as client.pp)
  if $enabled and $facts['enc_role'] != 'roles::infra::puppet::master' {

    # Ensure the fresh ssldir exists with agent-correct ownership/perms. The
    # puppet agent will create it on demand, but pre-creating it keeps the very
    # first post-switch run from racing directory creation and makes the
    # migration state auditable. Contents (keys, certs, crl) are populated by
    # the agent against the new CA -- we only own the directory itself.
    file { $new_ssldir:
      ensure => 'directory',
      owner  => 'root',
      group  => 'root',
      mode   => '0771',
    }
  }
}