unkinben
22faf00628
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
Migrate VM puppet agents off the legacy VM puppetmasters and onto the new puppet-on-kubernetes servers, per-wave via hiera and reversible without re-enrolment. Changing server/ca_server alone is insufficient: the agent's ssldir holds a cert signed by the OLD CA that the new CA neither trusts nor recognises. This switches migrated nodes to a FRESH ssldir so the agent generates a new CSR (autosigned on the k8s CA) while the old creds stay on disk for rollback. - Add profiles::puppet::migrate: opt-in (hiera_include) toggle that owns the fresh ssldir directory and documents per-node/per-role/common wiring plus rollback in its class header. - Extend profiles::puppet::client with optional $ssldir and $report_server params (default undef); the ERB template omits both lines when unset, so unmigrated nodes render a byte-identical puppet.conf. - puppet.conf stays owned solely by client.pp's template; migrate.pp adds no competing File resource.
47 lines
1.5 KiB
Puppet
47 lines
1.5 KiB
Puppet
# Class: profiles::puppet::client
|
|
#
|
|
# This class manages Puppet client configuration.
|
|
#
|
|
# site/profile/manifests/puppet/client.pp
|
|
class profiles::puppet::client (
|
|
Array $dns_alt_names = [$trusted['certname']],
|
|
String $server = 'puppetmaster',
|
|
String $ca_server = 'puppetca',
|
|
Optional[String] $report_server = undef,
|
|
String $environment = 'develop',
|
|
Integer $runinterval = 1800,
|
|
Integer $runtimeout = 3600,
|
|
Boolean $show_diff = true,
|
|
Boolean $usecacheonfailure = false,
|
|
Integer $facts_soft_limit = 4096,
|
|
Boolean $splay = true,
|
|
Integer $splaylimit = 600,
|
|
Optional[Stdlib::Absolutepath] $ssldir = undef,
|
|
) {
|
|
|
|
# dont manage puppet.conf if this is a puppetmaster
|
|
if $facts['enc_role'] != 'roles::infra::puppet::master' {
|
|
|
|
|
|
$dns_alt_names_string = join(sort($dns_alt_names), ',')
|
|
|
|
# Assuming you want to manage puppet.conf with this profile
|
|
file { '/etc/puppetlabs/puppet/puppet.conf':
|
|
ensure => 'present',
|
|
content => template('profiles/puppet/client/puppet.conf.erb'),
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
notify => Service['puppet'],
|
|
}
|
|
|
|
package { 'toml_puppetagent_gem':
|
|
ensure => installed,
|
|
name => 'toml',
|
|
provider => 'puppet_gem',
|
|
notify => Service['puppet'],
|
|
}
|
|
}
|
|
}
|
|
|