unkinben
965849594e
## Why
We want to manage Fedora 44 hosts with this Puppet codebase, starting with the `base` role only. Fedora reuses the RedHat osfamily code paths (dnf/yum, crypto-policies, firewalld, openvox), so this adds the Fedora-specific hieradata, repositories, and gates needed for `base` to compile and apply, mirroring how AlmaLinux is wired and consuming the artifactapi `rpm-internal-f<major>` / `rpm-vendor-f<major>` local repos. Everything is keyed off `facts.os.release.major` so a future Fedora release only needs its artifactapi local repos created, not new hieradata.
## How
- Add `hieradata/os/Fedora/all_releases.yaml`:
- Define dnf repos via `profiles::yum::global::repos`: `fedora` and `updates` proxied through artifactapi's `fedora` remote, plus the artifactapi locals `rpm-internal-f%{major}` and `rpm-vendor-f%{major}`; GPG via the on-disk `fedora-gpg-keys`; metalink/mirrorlist cleared so only the artifactapi baseurl is used.
- Set `crypto_policies::policy: DEFAULT`, `profiles::puppet::agent::openvox_enable: true`, and `lm-sensors:📦 lm_sensors`.
- Fix up the base package set for Fedora: exclude `p7zip`/`dstat`/`iotop` (absent on Fedora) and include `7zip` and `iotop-c`, plus the same `crypto-policies-scripts`/`lzo`/`policycoreutils`/`unar`/`xz` additions AlmaLinux carries.
- Wire `profiles::fedora::base` via `hiera_include`.
- Add `profiles::fedora::base` (ensures NetworkManager enabled) as the Fedora analogue of `profiles::almalinux::base`; deliberately minimal so it can grow into workstation/laptop use later.
- Make `profiles::puppet::agent` select the OpenVox distribution path (`fedora/<major>` on Fedora, `el/<major>` elsewhere); AlmaLinux/Debian behaviour is unchanged.
## Validation
`puppet-lint`, puppet manifest validate, and `yamllint` all pass via the repo's pre-commit hooks on the changed files.
## Note for reviewer
OpenVox does not yet publish a Fedora 44 build (`openvox7/fedora/` currently has only 36/40/41), so `openvox-agent` will 404 until upstream publishes f44 or a build is placed in `rpm-internal-f44`. The Puppet code produces the correct path for when that exists; installing the agent is a prerequisite for a Fedora 44 host to actually run.
https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Reviewed-on: #497
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
88 lines
2.7 KiB
Puppet
88 lines
2.7 KiB
Puppet
# profiles::puppet::agent
|
|
# This class manages Puppet agent package and service.
|
|
class profiles::puppet::agent (
|
|
String $version = 'latest',
|
|
Boolean $openvox_enable = false,
|
|
) {
|
|
|
|
# set openvox package, yumrepo, service
|
|
if $openvox_enable {
|
|
$use_package = 'openvox-agent'
|
|
$use_yumrepo = 'openvox'
|
|
$use_service = 'puppet'
|
|
}else{
|
|
$use_package = 'puppet-agent'
|
|
$use_yumrepo = 'puppet'
|
|
$use_service = 'puppet'
|
|
}
|
|
|
|
# OpenVox publishes RedHat-family builds per distribution: enterprise-linux
|
|
# under el/<major>, Fedora under fedora/<major>.
|
|
$openvox_dist = $facts['os']['name'] ? {
|
|
'Fedora' => 'fedora',
|
|
default => 'el',
|
|
}
|
|
|
|
# manage the yumrepo for the given package
|
|
if $openvox_enable and $facts['os']['family'] == 'RedHat' {
|
|
yumrepo { 'openvox':
|
|
ensure => 'present',
|
|
baseurl => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/${openvox_dist}/${facts['os']['release']['major']}/${facts['os']['architecture']}/",
|
|
descr => 'openvox repository',
|
|
gpgkey => 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub',
|
|
notify => Exec['dnf_makecache'],
|
|
}
|
|
}else{
|
|
yumrepo { 'puppet':
|
|
ensure => 'present',
|
|
baseurl => "https://packagerepo.service.consul/puppet7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/",
|
|
descr => 'puppet repository',
|
|
gpgkey => "https://packagerepo.service.consul/puppet7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/RPM-GPG-KEY-puppet-20250406",
|
|
notify => Exec['dnf_makecache'],
|
|
}
|
|
}
|
|
|
|
# if agent-version is anything other than latest, set a versionlock
|
|
$agent_versionlock_ensure = $version ? {
|
|
'latest' => 'absent',
|
|
default => 'present',
|
|
}
|
|
$agent_versionlock_version = $version ? {
|
|
'latest' => undef,
|
|
default => $version,
|
|
}
|
|
|
|
case $facts['os']['family'] {
|
|
'RedHat': {
|
|
# Ensure the agent package is installed and locked to a specific version
|
|
package { $use_package:
|
|
ensure => $version,
|
|
require => Yumrepo[$use_yumrepo],
|
|
}
|
|
|
|
# versionlock puppet-agent
|
|
yum::versionlock{$use_package:
|
|
ensure => $agent_versionlock_ensure,
|
|
version => $agent_versionlock_version,
|
|
}
|
|
}
|
|
'Debian': {
|
|
# Ensure the puppet-agent package is installed and locked to a specific version
|
|
package { $use_package:
|
|
ensure => $version,
|
|
require => Class['profiles::apt::puppet7'],
|
|
}
|
|
}
|
|
default: {}
|
|
}
|
|
|
|
# Ensure the puppet service is running
|
|
service { $use_service:
|
|
ensure => 'running',
|
|
enable => true,
|
|
hasrestart => true,
|
|
require => Package[$use_package],
|
|
}
|
|
|
|
}
|