unkin/terragrunt-enc

Fork 0

Files

T

Ben Vincent 054110d748

ci/woodpecker/pr/plan Pipeline failed

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

Populate terragrunt-enc: encapi ENC data as code

terragrunt-enc is the single source of truth for encapi ENC data (Puppet
statuses, roles, and node classifications), managed with Terraform/Terragrunt.
It supersedes Cobbler classification for Puppet and the terraform-incus
dual-write prototype (PR #39).

- Add modules/encapi (encapi_status / encapi_role / encapi_node, nodes
  FK-ordered after their role and status).
- Add config/encapi leaf: 3 statuses, 51 roles, and 143 node assignments
  (130 container VMs env production + 13 prodnxsr physicals env develop),
  all YAML-driven.
- Add config/root.hcl (consul backend infra/terraform/enc/<leaf>/state) and
  the encapi provider from the artifactapi registry (v0.1.0).
- Add Makefile, Woodpecker pre-commit/plan/apply pipelines, pre-commit
  config, ci/extract_incus_nodes.py, and expand the README.

2026-07-24 23:12:03 +10:00

2.5 KiB

Raw Permalink Blame History

terragrunt-enc

Single source of truth for encapi ENC data, managed with Terraform/Terragrunt. This repo owns every Puppet node classification the estate has:

statuses — Puppet environments (production, develop, testing)
roles — the Puppet role classes (roles::…) a node can be assigned
nodes — the certname → role + environment mapping for all 143 hosts (130 container VMs + 13 prodnxsr* physicals)

It supersedes Cobbler as the classification source for Puppet: encapi is the live ENC, and this repo is the declarative, reviewed input to it. It also supersedes the dual-write approach that was prototyped in terraform-incus (PR #39) — terraform-incus is no longer involved in ENC data.

Layout

config/
  root.hcl              # terragrunt root: consul backend (infra/terraform/enc/<leaf>/state)
  encapi/
    terragrunt.hcl      # leaf: feeds the three YAMLs into modules/encapi
    statuses.yaml       # Puppet environments
    roles.yaml          # Puppet role classes
    nodes.yaml          # certname -> {role, environment} for all 143 hosts
modules/
  encapi/               # encapi_status / encapi_role / encapi_node resources,
                        # ordered so nodes depend on their role + status (FK)
ci/
  extract_incus_nodes.py  # regenerates the container-VM block of nodes.yaml
                          # from a terraform-incus checkout

The encapi provider comes from the internal registry (artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi v0.1.0). Writes to encapi are authenticated with ENCAPI_WRITE_TOKEN, read from Vault by the Makefile.

Data provenance

130 container VMs (environment: production) are extracted from terraform-incus config/instances/<host>/config.yaml: certname is <host>.main.unkin.net, role is cobbler_mgmt_classes[0] (default roles::base). terraform-incus itself is not modified — the data is copied in here as plain config. Re-run ci/extract_incus_nodes.py --incus-repo <path> to refresh after VM changes.
13 prodnxsr* physical nodes (environment: develop) are the bare-metal hypervisor / k8s nodes, not managed by the incus module. Their roles come from the PuppetDB enc_role fact and are maintained by hand in nodes.yaml.

Usage

CI (Woodpecker) plans on every PR and applies on merge to main, authenticating to Vault via kubernetes auth (terraform-enc ServiceAccount). Locally:

make plan    # approle auth by default (needs env with VAULT_ROLEID)
make apply

2.5 KiB Raw Permalink Blame History

terragrunt-enc

Layout

Data provenance

Usage

2.5 KiB

Raw Permalink Blame History