statuses — Puppet environments (production, develop, testing)
roles — the Puppet role classes (roles::…) a node can be assigned
nodes — the certname → role + environment mapping for all 143 hosts (130 container VMs + 13 prodnxsr* physicals)

It supersedes Cobbler as the classification source for Puppet: encapi is the live ENC, and this repo is the declarative, reviewed input to it. It also supersedes the dual-write approach that was prototyped in terraform-incus (PR #39) — terraform-incus is no longer involved in ENC data.

Layout

config/
  root.hcl              # terragrunt root: consul backend (infra/terraform/enc/<leaf>/state)
  encapi/
    terragrunt.hcl      # leaf: feeds the three YAMLs into modules/encapi
    statuses.yaml       # Puppet environments
    roles.yaml          # Puppet role classes
    nodes.yaml          # certname -> {role, environment} for all 143 hosts
modules/
  encapi/               # encapi_status / encapi_role / encapi_node resources,
                        # ordered so nodes depend on their role + status (FK)
ci/
  extract_incus_nodes.py  # regenerates the container-VM block of nodes.yaml
                          # from a terraform-incus checkout

The encapi provider comes from the internal registry (artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi v0.1.0). Writes to encapi are authenticated with ENCAPI_WRITE_TOKEN, read from Vault by the Makefile.

Data provenance

130 container VMs (environment: production) are extracted from terraform-incus config/instances/<host>/config.yaml: certname is <host>.main.unkin.net, role is cobbler_mgmt_classes[0] (default roles::base). terraform-incus itself is not modified — the data is copied in here as plain config. Re-run ci/extract_incus_nodes.py --incus-repo <path> to refresh after VM changes.
13 prodnxsr* physical nodes (environment: develop) are the bare-metal hypervisor / k8s nodes, not managed by the incus module. Their roles come from the PuppetDB enc_role fact and are maintained by hand in nodes.yaml.

Usage

CI (Woodpecker) plans on every PR and applies on merge to main, authenticating to Vault via kubernetes auth (terraform-enc ServiceAccount). Locally:

make plan    # approle auth by default (needs env with VAULT_ROLEID)
make apply