Change 935424 had a related patch set uploaded (by Jbond; author: jbond):

[operations/puppet@production] puppetboard::bookworm: migrate to puppet7

https://gerrit.wikimedia.org/r/935424

Change 935424 merged by Jbond:

[operations/puppet@production] puppetboard::bookworm: migrate to puppet7

https://gerrit.wikimedia.org/r/935424

Change 935429 had a related patch set uploaded (by Jbond; author: jbond):

[operations/puppet@production] puppetboard::bookworm: switch server to new puppet infrastructre

https://gerrit.wikimedia.org/r/935429

Change 935429 merged by Jbond:

[operations/puppet@production] puppetboard::bookworm: switch server to new puppet infrastructre

https://gerrit.wikimedia.org/r/935429

Theses are the manual steps i made to migrate puppetboard1003

• Agent: update hiera to force puppet7
• Agent: run puppet agent
• Agent: upgrade puppet
• Agent: update config to use new puppetserver and ca (in future this may be replaced by setting use_srv_records, we can probably do this when we set force_puppet7 as well)
• Agent: run puppet
• Agent: delete the ssl folder on the client sudo rm -rf /var/lib/puppet/ssl
• Agent: run puppet with wait e.g. puppet agent -t -w 1 (this should generate a certificate on the ca server to sign)
• puppet CA server: sign the new certtificate sudo puppetserver ca sign --certname $agent_fdqn

In T340739#8988130, @jbond wrote:

Theses are the manual steps i made to migrate puppetboard1003

Evaluate calling before:
https://doc.wikimedia.org/spicerack/master/api/spicerack.puppet.html#spicerack.puppet.PuppetMaster.delete
https://doc.wikimedia.org/spicerack/master/api/spicerack.puppet.html#spicerack.puppet.PuppetMaster.destroy

• Agent: update hiera to force puppet7

manual

• Agent: run puppet agent

https://doc.wikimedia.org/spicerack/master/api/spicerack.puppet.html#spicerack.puppet.PuppetHosts.run

• Agent: upgrade puppet

https://doc.wikimedia.org/spicerack/master/api/spicerack.apt.html#spicerack.apt.AptGetHosts.install

• Agent: update config to use new puppetserver and ca (in future this may be replaced by setting use_srv_records, we can probably do this when we set force_puppet7 as well)

manual

• Agent: run puppet

https://doc.wikimedia.org/spicerack/master/api/spicerack.puppet.html#spicerack.puppet.PuppetHosts.run

• Agent: delete the ssl folder on the client sudo rm -rf /var/lib/puppet/ssl
• Agent: run puppet with wait e.g. puppet agent -t -w 1 (this should generate a certificate on the ca server to sign)

https://doc.wikimedia.org/spicerack/master/api/spicerack.puppet.html#spicerack.puppet.PuppetHosts.regenerate_certificate (for both)

• puppet CA server: sign the new certtificate sudo puppetserver ca sign --certname $agent_fdqn

This might need some tweaking on the spicerack side, check spicerack.puppet.get_puppet_ca_hostname()
https://doc.wikimedia.org/spicerack/master/api/spicerack.puppet.html#spicerack.puppet.PuppetMaster.wait_for_csr
https://doc.wikimedia.org/spicerack/master/api/spicerack.puppet.html#spicerack.puppet.PuppetMaster.sign

Change 953262 had a related patch set uploaded (by Jbond; author: jbond):

[operations/cookbooks@master] sre.puppet.migrate_host: migrate hosts from puppet5 to puppet7

https://gerrit.wikimedia.org/r/953262

Change 953640 had a related patch set uploaded (by Jbond; author: jbond):

[operations/puppet@production] puppetserver: prepare to migrate to new infrastructre

https://gerrit.wikimedia.org/r/953640

Change 953640 merged by Jbond:

[operations/puppet@production] puppetserver: prepare to migrate to new infrastructre

https://gerrit.wikimedia.org/r/953640

Change 953645 had a related patch set uploaded (by Jbond; author: jbond):

[operations/puppet@production] stie.pp: move server back to insetup

https://gerrit.wikimedia.org/r/953645

Change 953645 merged by Jbond:

[operations/puppet@production] stie.pp: move server back to insetup

https://gerrit.wikimedia.org/r/953645

Change 953683 had a related patch set uploaded (by Jbond; author: jbond):

[operations/puppet@production] cluster::managment: add ssh fingerprints for new puppetservers

https://gerrit.wikimedia.org/r/953683

Change 953683 merged by Jbond:

[operations/puppet@production] cluster::managment: add ssh fingerprints for new puppetservers

https://gerrit.wikimedia.org/r/953683

Change 955063 had a related patch set uploaded (by Jbond; author: Jbond):

[operations/puppet@production] stie.pp: move server to puppetserver role

https://gerrit.wikimedia.org/r/955063

Change 955063 merged by Jbond:

[operations/puppet@production] stie.pp: move server to puppetserver role

https://gerrit.wikimedia.org/r/955063

Change 953262 merged by jenkins-bot:

[operations/cookbooks@master] sre.puppet.migrate_host: migrate hosts from puppet5 to puppet7

https://gerrit.wikimedia.org/r/953262

Change 967935 had a related patch set uploaded (by Jbond; author: jbond):

[operations/cookbooks@master] sre.puppet.migrate-role: add new cookbook to migrate roles to puppet7

https://gerrit.wikimedia.org/r/967935

Change 968258 had a related patch set uploaded (by Jbond; author: jbond):

[operations/puppet@production] idp_test: migrate to puppet7

https://gerrit.wikimedia.org/r/968258

Change 968258 merged by Jbond:

[operations/puppet@production] idp_test: migrate to puppet7

https://gerrit.wikimedia.org/r/968258

Change 969760 had a related patch set uploaded (by Jbond; author: jbond):

[operations/cookbooks@master] sre.ganeti.makevm: Add pppet-version arguments to makevm

https://gerrit.wikimedia.org/r/969760

Change 969760 merged by jenkins-bot:

[operations/cookbooks@master] sre.ganeti.makevm: Add puppet-version arguments to makevm

https://gerrit.wikimedia.org/r/969760

Change 967935 merged by jenkins-bot:

[operations/cookbooks@master] sre.puppet.migrate-role: add new cookbook to migrate roles to puppet7

https://gerrit.wikimedia.org/r/967935