Ben Vincent
57a472d24e
ci/woodpecker/pr/build-fedora42 Pipeline was successful
ci/woodpecker/pr/build-fedora44 Pipeline was successful
ci/woodpecker/pr/build-fedora43 Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build-almalinux9 Pipeline was successful
ci/woodpecker/pr/build-almalinux8 Pipeline was successful
The puppet-initial firstrun bootstrap hardcoded the legacy Consul CA endpoint puppetca.query.consul:8140. That VM-era CA is being replaced by the in-cluster puppetserver CA service. - Default the CA host to puppetca.k8s.syd1.au.unkin.net (still :8140, same /puppet-ca/v1/certificate/ca API; verified serving HTTP 200). - Read PUPPETCA_HOST / PUPPETCA_PORT from the environment so a host can be pointed at a different CA without rebuilding the RPM. - Wire the env through systemd via EnvironmentFile=-/etc/sysconfig/puppet-initial and ship a commented %config(noreplace) example at that path, so a kickstart %post can override per-host. - Document the override (incl. a kickstart %post example) in a new README. - Bump el8/el9 build version 1.0.3 -> 1.0.4 so a new RPM is published. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
14 lines
667 B
Plaintext
14 lines
667 B
Plaintext
# Environment overrides for the puppet-initial firstrun bootstrap.
|
|
# Read by the puppet-initial.service unit (EnvironmentFile=-/etc/sysconfig/puppet-initial).
|
|
# A kickstart %post can write this file to point a host at a different Puppet CA
|
|
# without rebuilding the RPM. All values are optional; the defaults below match
|
|
# the shipped in-cluster puppetserver CA service.
|
|
|
|
# Hostname of the Puppet CA service. Used both to fetch the CA certificate
|
|
# (https://<host>:<port>/puppet-ca/v1/certificate/ca) and as --server for the
|
|
# initial noop agent registration run.
|
|
#PUPPETCA_HOST=puppetca.k8s.syd1.au.unkin.net
|
|
|
|
# Port the Puppet CA API listens on.
|
|
#PUPPETCA_PORT=8140
|