unkin-agent
3370aff38f
The VM puppet masters are the last part of the classification path still calling Cobbler; the k8s compilers already classify through encapi and the encapic RPM is installed on all six masters. - Point `profiles::puppet::server::external_nodes` at `/usr/bin/encapic-enc` for `roles::infra::puppet::master`. - Drop the stale comment about external_nodes still using cobbler-enc. `profiles::puppet::cobbler_enc` stays in place so the revert is one hiera line. Depends on the encapic 0.2.0 install (#525). Reviewed-on: #527 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
105 lines
3.0 KiB
YAML
105 lines
3.0 KiB
YAML
---
|
|
profiles::puppet::autosign::subnet_ranges:
|
|
- '198.18.13.0/24'
|
|
- '198.18.14.0/24'
|
|
- '198.18.15.0/24'
|
|
- '198.18.16.0/24'
|
|
- '198.18.17.0/24'
|
|
- '198.18.20.0/24'
|
|
- '198.18.24.0/24'
|
|
- '198.18.25.0/24'
|
|
- '198.18.26.0/24'
|
|
- '198.18.27.0/24'
|
|
- '198.18.28.0/24'
|
|
- '198.18.29.0/24'
|
|
|
|
profiles::puppet::autosign::domains:
|
|
- '*.main.unkin.net'
|
|
|
|
# profiles::puppet::autosign::nodes:
|
|
# - 'somenode.main.unkin.net'
|
|
|
|
profiles::puppet::cobbler_enc::cobbler_scheme: https
|
|
profiles::puppet::cobbler_enc::cobbler_hostname: cobbler.main.unkin.net
|
|
profiles::puppet::cobbler_enc::version: 'system'
|
|
profiles::puppet::cobbler_enc::packages:
|
|
- 'requests'
|
|
- 'PyYAML'
|
|
profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
|
|
|
|
# Deep-merged with the entries in roles/infra/puppet.yaml.
|
|
profiles::packages::include:
|
|
encapic:
|
|
ensure: '0.2.0'
|
|
|
|
profiles::puppet::encapic::encapi_url: https://encapi.k8s.syd1.au.unkin.net
|
|
profiles::puppet::server::external_nodes: '/usr/bin/encapic-enc'
|
|
|
|
profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
|
|
profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
|
|
profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
|
|
profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
|
|
profiles::puppet::g10k::default_environment: 'develop'
|
|
profiles::puppet::gems::puppet:
|
|
- 'deep_merge'
|
|
- 'ipaddr'
|
|
- 'hiera-eyaml'
|
|
- 'toml'
|
|
|
|
profiles::helpers::certmanager::vault_config:
|
|
addr: 'https://vault.service.consul:8200'
|
|
mount_point: 'pki_int'
|
|
approle_path: 'approle'
|
|
role_name: 'servers_default'
|
|
output_path: '/tmp/certmanager'
|
|
role_id: "%{lookup('certmanager::role_id')}"
|
|
|
|
profiles::helpers::sshsignhost::vault_config:
|
|
addr: 'https://vault.service.consul:8200'
|
|
mount_point: 'ssh-host-signer'
|
|
approle_path: 'approle'
|
|
role_name: 'hostrole'
|
|
output_path: '/tmp/sshsignhost'
|
|
role_id: "%{lookup('sshsignhost::role_id')}"
|
|
|
|
profiles::puppet::server::agent_server: 'puppet.query.consul'
|
|
profiles::puppet::server::report_server: 'puppet.query.consul'
|
|
profiles::puppet::server::ca_server: 'puppetca.query.consul'
|
|
profiles::puppet::server::dns_alt_names:
|
|
- "%{facts.networking.fqdn}"
|
|
- "%{facts.networking.hostname}"
|
|
- puppetmaster.main.unkin.net
|
|
- puppet.main.unkin.net
|
|
- puppet.service.consul
|
|
- puppet.query.consul
|
|
- puppetmaster
|
|
- puppet
|
|
|
|
profiles::ssh::sign::principals:
|
|
- puppet.service.consul
|
|
- puppet.query.consul
|
|
|
|
consul::services:
|
|
puppet:
|
|
service_name: 'puppet'
|
|
tags:
|
|
- 'puppet'
|
|
- 'master'
|
|
address: "%{facts.networking.ip}"
|
|
port: 8140
|
|
checks:
|
|
- id: 'puppet_https_check'
|
|
name: 'Puppet HTTPS Check'
|
|
http: "https://%{facts.networking.fqdn}:8140/status/v1/simple"
|
|
method: 'GET'
|
|
tls_skip_verify: true
|
|
interval: '10s'
|
|
timeout: '1s'
|
|
profiles::consul::client::node_rules:
|
|
- resource: service
|
|
segment: puppet
|
|
disposition: write
|
|
- resource: service
|
|
segment: puppetca
|
|
disposition: write
|