unkinben
2c478ac029
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
A versionlock is useless if the package resource is evaluated before the
lock is in place: dnf upgrades the package to an unpinned version, then the
lock pins whatever landed. This is the drift that let new RKE2 nodes boot
1.33.11 instead of the pinned version.
Order the versionlock ahead of the package everywhere the two lacked a
relationship:
- rke2::install adds before => Package["rke2-${node_type}"] on the
versionlock so the lock exists before install/upgrade.
- profiles::puppet::agent (RedHat) adds before => Package[$use_package] on
the versionlock for the same reason.
profiles::gitea::runner and profiles::vault::server already ordered the
versionlock ahead of the package (before => Package / before => Class) and
are unchanged. Locked versions themselves are untouched.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
89 lines
2.8 KiB
Puppet
89 lines
2.8 KiB
Puppet
# profiles::puppet::agent
|
|
# This class manages Puppet agent package and service.
|
|
class profiles::puppet::agent (
|
|
String $version = 'latest',
|
|
Boolean $openvox_enable = false,
|
|
) {
|
|
|
|
# set openvox package, yumrepo, service
|
|
if $openvox_enable {
|
|
$use_package = 'openvox-agent'
|
|
$use_yumrepo = 'openvox'
|
|
$use_service = 'puppet'
|
|
}else{
|
|
$use_package = 'puppet-agent'
|
|
$use_yumrepo = 'puppet'
|
|
$use_service = 'puppet'
|
|
}
|
|
|
|
# OpenVox publishes RedHat-family builds per distribution: enterprise-linux
|
|
# under el/<major>, Fedora under fedora/<major>.
|
|
$openvox_dist = $facts['os']['name'] ? {
|
|
'Fedora' => 'fedora',
|
|
default => 'el',
|
|
}
|
|
|
|
# manage the yumrepo for the given package
|
|
if $openvox_enable and $facts['os']['family'] == 'RedHat' {
|
|
yumrepo { 'openvox':
|
|
ensure => 'present',
|
|
baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/${openvox_dist}/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
|
|
descr => 'openvox repository',
|
|
gpgkey => 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub',
|
|
notify => Exec['dnf_makecache'],
|
|
}
|
|
}else{
|
|
yumrepo { 'puppet':
|
|
ensure => 'present',
|
|
baseurl => "https://packagerepo.service.consul/puppet7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/",
|
|
descr => 'puppet repository',
|
|
gpgkey => "https://packagerepo.service.consul/puppet7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/RPM-GPG-KEY-puppet-20250406",
|
|
notify => Exec['dnf_makecache'],
|
|
}
|
|
}
|
|
|
|
# if agent-version is anything other than latest, set a versionlock
|
|
$agent_versionlock_ensure = $version ? {
|
|
'latest' => 'absent',
|
|
default => 'present',
|
|
}
|
|
$agent_versionlock_version = $version ? {
|
|
'latest' => undef,
|
|
default => $version,
|
|
}
|
|
|
|
case $facts['os']['family'] {
|
|
'RedHat': {
|
|
# Ensure the agent package is installed and locked to a specific version
|
|
package { $use_package:
|
|
ensure => $version,
|
|
require => Yumrepo[$use_yumrepo],
|
|
}
|
|
|
|
# versionlock puppet-agent before install so the lock exists before any upgrade is attempted
|
|
yum::versionlock{$use_package:
|
|
ensure => $agent_versionlock_ensure,
|
|
version => $agent_versionlock_version,
|
|
before => Package[$use_package],
|
|
}
|
|
}
|
|
'Debian': {
|
|
# Ensure the puppet-agent package is installed and locked to a specific version
|
|
package { $use_package:
|
|
ensure => $version,
|
|
require => Class['profiles::apt::puppet7'],
|
|
}
|
|
}
|
|
default: {}
|
|
}
|
|
|
|
# Ensure the puppet service is running
|
|
service { $use_service:
|
|
ensure => 'running',
|
|
enable => true,
|
|
hasrestart => true,
|
|
require => Package[$use_package],
|
|
}
|
|
|
|
}
|