Ben Vincent
054110d748
terragrunt-enc is the single source of truth for encapi ENC data (Puppet statuses, roles, and node classifications), managed with Terraform/Terragrunt. It supersedes Cobbler classification for Puppet and the terraform-incus dual-write prototype (PR #39). - Add modules/encapi (encapi_status / encapi_role / encapi_node, nodes FK-ordered after their role and status). - Add config/encapi leaf: 3 statuses, 51 roles, and 143 node assignments (130 container VMs env production + 13 prodnxsr physicals env develop), all YAML-driven. - Add config/root.hcl (consul backend infra/terraform/enc/<leaf>/state) and the encapi provider from the artifactapi registry (v0.1.0). - Add Makefile, Woodpecker pre-commit/plan/apply pipelines, pre-commit config, ci/extract_incus_nodes.py, and expand the README.
61 lines
2.5 KiB
Markdown
61 lines
2.5 KiB
Markdown
# terragrunt-enc
|
|
|
|
Single source of truth for [encapi](https://git.unkin.net/unkin/encapi) ENC
|
|
data, managed with Terraform/Terragrunt. This repo owns every Puppet node
|
|
classification the estate has:
|
|
|
|
- **statuses** — Puppet environments (`production`, `develop`, `testing`)
|
|
- **roles** — the Puppet role classes (`roles::…`) a node can be assigned
|
|
- **nodes** — the certname → role + environment mapping for all 143 hosts
|
|
(130 container VMs + 13 `prodnxsr*` physicals)
|
|
|
|
It **supersedes Cobbler** as the classification source for Puppet: encapi is the
|
|
live ENC, and this repo is the declarative, reviewed input to it. It also
|
|
supersedes the dual-write approach that was prototyped in terraform-incus
|
|
(PR #39) — terraform-incus is no longer involved in ENC data.
|
|
|
|
## Layout
|
|
|
|
```
|
|
config/
|
|
root.hcl # terragrunt root: consul backend (infra/terraform/enc/<leaf>/state)
|
|
encapi/
|
|
terragrunt.hcl # leaf: feeds the three YAMLs into modules/encapi
|
|
statuses.yaml # Puppet environments
|
|
roles.yaml # Puppet role classes
|
|
nodes.yaml # certname -> {role, environment} for all 143 hosts
|
|
modules/
|
|
encapi/ # encapi_status / encapi_role / encapi_node resources,
|
|
# ordered so nodes depend on their role + status (FK)
|
|
ci/
|
|
extract_incus_nodes.py # regenerates the container-VM block of nodes.yaml
|
|
# from a terraform-incus checkout
|
|
```
|
|
|
|
The encapi provider comes from the internal registry
|
|
(`artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi` v0.1.0). Writes to
|
|
encapi are authenticated with `ENCAPI_WRITE_TOKEN`, read from Vault by the
|
|
Makefile.
|
|
|
|
## Data provenance
|
|
|
|
- **130 container VMs** (`environment: production`) are extracted from
|
|
terraform-incus `config/instances/<host>/config.yaml`: certname is
|
|
`<host>.main.unkin.net`, role is `cobbler_mgmt_classes[0]` (default
|
|
`roles::base`). terraform-incus itself is not modified — the data is copied in
|
|
here as plain config. Re-run `ci/extract_incus_nodes.py --incus-repo <path>`
|
|
to refresh after VM changes.
|
|
- **13 `prodnxsr*` physical nodes** (`environment: develop`) are the bare-metal
|
|
hypervisor / k8s nodes, not managed by the incus module. Their roles come from
|
|
the PuppetDB `enc_role` fact and are maintained by hand in `nodes.yaml`.
|
|
|
|
## Usage
|
|
|
|
CI (Woodpecker) plans on every PR and applies on merge to `main`, authenticating
|
|
to Vault via kubernetes auth (`terraform-enc` ServiceAccount). Locally:
|
|
|
|
```sh
|
|
make plan # approle auth by default (needs env with VAULT_ROLEID)
|
|
make apply
|
|
```
|