unkin-agent
1a907467e9
A package pinned in hieradata right after its RPM lands in artifactapi is invisible to dnf until the host's 1h cached metadata expires, so the first Puppet run after a release cannot find the version. - Set `metadata_expire` 60s on `rpm-internal`/`rpm-vendor` and their per-release variants for AlmaLinux and Fedora - Leave upstream mirrors on the 1h default - Drop the stale expiry note in `profiles::dns::updater` Reviewed-on: #526 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
72 lines
2.8 KiB
YAML
72 lines
2.8 KiB
YAML
# hieradata/os/Fedora/all_releases.yaml
|
|
---
|
|
# Fedora reuses the RedHat osfamily code paths (dnf/yum, crypto-policies,
|
|
# firewalld, openvox). Everything here keys off facts.os.release.major so a
|
|
# future Fedora release only needs its artifactapi local repos created, not new
|
|
# hieradata.
|
|
|
|
# crypto-policies: use the distro default. Kept here (not per-release) so newer
|
|
# Fedora releases inherit it for free.
|
|
crypto_policies::policy: 'DEFAULT'
|
|
|
|
# Puppet agent via OpenVox. RedHat-family builds for Fedora live under
|
|
# openvox7/fedora/<major> (see profiles::puppet::agent).
|
|
profiles::puppet::agent::openvox_enable: true
|
|
|
|
lm-sensors::package: lm_sensors
|
|
|
|
# Fedora-specific base setup (NetworkManager, future workstation/laptop hooks).
|
|
hiera_include:
|
|
- profiles::fedora::base
|
|
|
|
# Base package set adjustments for Fedora:
|
|
# - p7zip was dropped from Fedora; the real 7-Zip ships as "7zip"
|
|
# - dstat was removed from Fedora with no drop-in successor in the base set
|
|
# - iotop is provided by the C rewrite package "iotop-c"
|
|
profiles::packages::exclude:
|
|
- p7zip
|
|
- dstat
|
|
- iotop
|
|
profiles::packages::include:
|
|
7zip: {}
|
|
iotop-c: {}
|
|
crypto-policies-scripts: {}
|
|
lzo: {}
|
|
policycoreutils: {}
|
|
unar: {}
|
|
xz: {}
|
|
|
|
profiles::yum::global::repos:
|
|
fedora:
|
|
name: fedora
|
|
descr: Fedora %{facts.os.release.major} - %{facts.os.architecture}
|
|
target: /etc/yum.repos.d/fedora.repo
|
|
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/%{facts.os.release.major}/Everything/%{facts.os.architecture}/os/
|
|
gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
|
|
metalink: absent
|
|
mirrorlist: absent
|
|
updates:
|
|
name: updates
|
|
descr: Fedora %{facts.os.release.major} - %{facts.os.architecture} - Updates
|
|
target: /etc/yum.repos.d/fedora-updates.repo
|
|
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/%{facts.os.release.major}/Everything/%{facts.os.architecture}/
|
|
gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
|
|
metalink: absent
|
|
mirrorlist: absent
|
|
rpm-internal:
|
|
name: rpm-internal-f%{facts.os.release.major}
|
|
descr: rpm-internal-f%{facts.os.release.major} repository
|
|
target: /etc/yum.repos.d/rpm-internal.repo
|
|
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f%{facts.os.release.major}/
|
|
gpgcheck: false
|
|
mirrorlist: absent
|
|
metadata_expire: '60'
|
|
rpm-vendor:
|
|
name: rpm-vendor-f%{facts.os.release.major}
|
|
descr: rpm-vendor-f%{facts.os.release.major} repository
|
|
target: /etc/yum.repos.d/rpm-vendor.repo
|
|
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f%{facts.os.release.major}/
|
|
gpgcheck: false
|
|
mirrorlist: absent
|
|
metadata_expire: '60'
|