feat: make puppet-initial CA endpoint configurable, default to k8s puppetca #171

Merged

benvin merged 1 commits from benvin/puppet-initial-puppetca into master 2026-07-29 21:36:48 +10:00

Conversation 0 Commits 1 Files Changed 6

+70 -4

unkinben commented 2026-07-28 22:01:33 +10:00

Owner

Copy Link

Copy Source

Why

The puppet-initial firstrun bootstrap RPM hardcoded the legacy Consul-discovered CA endpoint puppetca.query.consul:8140. That VM-era CA is being replaced by the in-cluster puppetserver CA service puppetca.k8s.syd1.au.unkin.net. Rather than swap one hardcoded host for another, the endpoint is now configurable so kickstart can override it per host.

Verified the new service serves the same Puppet CA API on the same port: https://puppetca.k8s.syd1.au.unkin.net:8140/puppet-ca/v1/certificate/ca returns HTTP 200 with a valid Puppet CA cert.

Changes

• Default the CA host to puppetca.k8s.syd1.au.unkin.net (still port 8140, same /puppet-ca/v1/certificate/ca path).
• Bootstrap script reads PUPPETCA_HOST / PUPPETCA_PORT from the environment, falling back to the defaults, and uses them for both the CA cert fetch and the --server of the initial noop registration run.
• Add EnvironmentFile=-/etc/sysconfig/puppet-initial to the systemd unit so kickstart %post can drop overrides in there.
• Ship a commented example config at /etc/sysconfig/puppet-initial as %config(noreplace).
• Add a package README documenting the override, with a kickstart %post example.
• Bump el8/el9 build version 1.0.3 -> 1.0.4 so a new RPM is published (dedup skips identical filenames).

Note: the run loop still targets puppet.query.consul (the compile master, a separate host from the CA) — intentionally left unchanged; scope here is the CA endpoint only.

Validation

• make test — 72 passed
• pre-commit (metadata jsonschema, yamllint, shebang/executable checks) — all pass
• Local nfpm pkg build: RPM assembles; /etc/sysconfig/puppet-initial correctly listed by rpm -qcp as a config file; packaged script carries the new default + env wiring.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why The `puppet-initial` firstrun bootstrap RPM hardcoded the legacy Consul-discovered CA endpoint `puppetca.query.consul:8140`. That VM-era CA is being replaced by the in-cluster puppetserver CA service `puppetca.k8s.syd1.au.unkin.net`. Rather than swap one hardcoded host for another, the endpoint is now configurable so kickstart can override it per host. Verified the new service serves the same Puppet CA API on the same port: `https://puppetca.k8s.syd1.au.unkin.net:8140/puppet-ca/v1/certificate/ca` returns HTTP 200 with a valid Puppet CA cert. ## Changes - Default the CA host to `puppetca.k8s.syd1.au.unkin.net` (still port `8140`, same `/puppet-ca/v1/certificate/ca` path). - Bootstrap script reads `PUPPETCA_HOST` / `PUPPETCA_PORT` from the environment, falling back to the defaults, and uses them for both the CA cert fetch and the `--server` of the initial noop registration run. - Add `EnvironmentFile=-/etc/sysconfig/puppet-initial` to the systemd unit so kickstart `%post` can drop overrides in there. - Ship a commented example config at `/etc/sysconfig/puppet-initial` as `%config(noreplace)`. - Add a package README documenting the override, with a kickstart `%post` example. - Bump el8/el9 build version `1.0.3` -> `1.0.4` so a new RPM is published (dedup skips identical filenames). Note: the run loop still targets `puppet.query.consul` (the compile master, a separate host from the CA) — intentionally left unchanged; scope here is the CA endpoint only. ## Validation - `make test` — 72 passed - pre-commit (metadata jsonschema, yamllint, shebang/executable checks) — all pass - Local `nfpm pkg` build: RPM assembles; `/etc/sysconfig/puppet-initial` correctly listed by `rpm -qcp` as a config file; packaged script carries the new default + env wiring. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 1 commit 2026-07-28 22:01:34 +10:00

feat: make puppet-initial CA endpoint configurable, default to k8s puppetca ... 57a472d24e

The puppet-initial firstrun bootstrap hardcoded the legacy Consul CA
endpoint puppetca.query.consul:8140. That VM-era CA is being replaced by
the in-cluster puppetserver CA service.

- Default the CA host to puppetca.k8s.syd1.au.unkin.net (still :8140,
  same /puppet-ca/v1/certificate/ca API; verified serving HTTP 200).
- Read PUPPETCA_HOST / PUPPETCA_PORT from the environment so a host can
  be pointed at a different CA without rebuilding the RPM.
- Wire the env through systemd via EnvironmentFile=-/etc/sysconfig/puppet-initial
  and ship a commented %config(noreplace) example at that path, so a
  kickstart %post can override per-host.
- Document the override (incl. a kickstart %post example) in a new README.
- Bump el8/el9 build version 1.0.3 -> 1.0.4 so a new RPM is published.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

benvin merged commit c6df3a7619 into master 2026-07-29 21:36:48 +10:00

benvin deleted branch benvin/puppet-initial-puppetca 2026-07-29 21:36:48 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) droneci unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/rpmbuilder#171