unkinben
7d75dcd188
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
Wire profiles::puppet::migrate into profiles::base (shipping enabled=>false) so every node evaluates it. client.pp now includes migrate and folds new_server/new_ca_server/new_ssldir into the effective server/ca_server/ report_server/ssldir it renders, so flipping the one profiles::puppet::migrate::enabled key at any hiera layer (node/role/common) repoints a target -- no per-node client param overrides. Explicit client::ssldir/::report_server still override the migrate-derived value; unmigrated nodes render a byte-identical puppet.conf.
90 lines
3.3 KiB
Puppet
90 lines
3.3 KiB
Puppet
# Class: profiles::puppet::client
|
|
#
|
|
# This class manages Puppet client configuration.
|
|
#
|
|
# site/profile/manifests/puppet/client.pp
|
|
class profiles::puppet::client (
|
|
Array $dns_alt_names = [$trusted['certname']],
|
|
String $server = 'puppetmaster',
|
|
String $ca_server = 'puppetca',
|
|
Optional[String] $report_server = undef,
|
|
String $environment = 'develop',
|
|
Integer $runinterval = 1800,
|
|
Integer $runtimeout = 3600,
|
|
Boolean $show_diff = true,
|
|
Boolean $usecacheonfailure = false,
|
|
Integer $facts_soft_limit = 4096,
|
|
Boolean $splay = true,
|
|
Integer $splaylimit = 600,
|
|
Optional[Stdlib::Absolutepath] $ssldir = undef,
|
|
) {
|
|
|
|
# Pull in the k8s-migration switch. When
|
|
# profiles::puppet::migrate::enabled is true at ANY hiera layer
|
|
# (node/role/common) the effective endpoints below flip to the k8s
|
|
# servers and a fresh ssldir -- no other hiera keys required. This class
|
|
# never includes client.pp, so there is no include cycle.
|
|
include profiles::puppet::migrate
|
|
|
|
# Effective values fed to the template. Precedence differs by param type:
|
|
#
|
|
# ssldir / report_server (Optional, default undef): an explicit client
|
|
# param wins; else the migrate-derived value when enabled; else the
|
|
# legacy default (undef -> template omits ssldir; report_server -> server).
|
|
#
|
|
# server / ca_server (String, no undef sentinel): the migrate value wins
|
|
# when migrate::enabled, otherwise the client param (which is the legacy
|
|
# default unless an operator set it explicitly in hiera). To pin a
|
|
# bespoke server while enabled, leave enabled => false for that target
|
|
# and set profiles::puppet::client::server directly.
|
|
$migrate_on = $profiles::puppet::migrate::enabled
|
|
|
|
$effective_server = $migrate_on ? {
|
|
true => $profiles::puppet::migrate::new_server,
|
|
default => $server,
|
|
}
|
|
$effective_ca_server = $migrate_on ? {
|
|
true => $profiles::puppet::migrate::new_ca_server,
|
|
default => $ca_server,
|
|
}
|
|
# report_server: explicit param wins; else follow the effective server.
|
|
$effective_report_server = $report_server ? {
|
|
undef => $effective_server,
|
|
default => $report_server,
|
|
}
|
|
# ssldir: explicit param wins; else the fresh k8s ssldir when migrating;
|
|
# else undef (template omits the key, i.e. puppet's built-in default).
|
|
$effective_ssldir = $ssldir ? {
|
|
undef => $migrate_on ? {
|
|
true => $profiles::puppet::migrate::new_ssldir,
|
|
default => undef,
|
|
},
|
|
default => $ssldir,
|
|
}
|
|
|
|
# dont manage puppet.conf if this is a puppetmaster
|
|
if $facts['enc_role'] != 'roles::infra::puppet::master' {
|
|
|
|
|
|
$dns_alt_names_string = join(sort($dns_alt_names), ',')
|
|
|
|
# Assuming you want to manage puppet.conf with this profile
|
|
file { '/etc/puppetlabs/puppet/puppet.conf':
|
|
ensure => 'present',
|
|
content => template('profiles/puppet/client/puppet.conf.erb'),
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
notify => Service['puppet'],
|
|
}
|
|
|
|
package { 'toml_puppetagent_gem':
|
|
ensure => installed,
|
|
name => 'toml',
|
|
provider => 'puppet_gem',
|
|
notify => Service['puppet'],
|
|
}
|
|
}
|
|
}
|
|
|