(*) replace legacy with modern facts

hieradata/common.yaml

@@ -430,7 +430,7 @@ sssd::main_config:
     auth_provider: "ipa"
     access_provider: "ipa"
     ldap_tls_cacert: "/etc/ipa/ca.crt"
-    ipa_hostname: "%{facts.fqdn}"
+    ipa_hostname: "%{facts.networking.fqdn}"
     chpass_provider: "ipa"
     ipa_server:
       - "_srv_"
@@ -472,9 +472,9 @@ mit_krb5::domain_realms:
     domains:
       - ".%{lookup('ipa::domain')}"
       - "%{lookup('ipa::domain')}"
-      - "%{facts.fqdn}"
-      - ".%{facts.domain}"
-      - "%{facts.domain}"
+      - "%{facts.networking.fqdn}"
+      - ".%{facts.networking.domain}"
+      - "%{facts.networking.domain}"
 
 openldap::client::tls_cacertdir: "/etc/openldap/certs"
 openldap::client::sasl_nocanon: true
@@ -489,7 +489,7 @@ profile::core::ipa::default:
     realm: "%{lookup('mit_krb5::default_realm')}"
     domain: "%{lookup('ipa::domain')}"
     server: "%{lookup('ipa::ipa_master_fqdn')}"
-    host: "%{facts.fqdn}"
+    host: "%{facts.networking.fqdn}"
     xmlrpc_uri: "https://%{lookup('ipa::ipa_master_fqdn')}/ipa/xml"
     enable_ra: "True"
 
@@ -501,7 +501,7 @@ resolv_conf::options:
 # Use NFSv4 on NFS enabled hosts.
 nfs::nfs_v4: true
 nfs::nfs_v4_client: true
-nfs::nfs_v4_idmap_domain: "%{::domain}"
+nfs::nfs_v4_idmap_domain: "%{facts.networking.domain}"
 
 profile::ccs::common::pkgurl: "https://repo-nexus.lsst.org/nexus/repository/ccs_private"
 ccs_hcu::pkgurl: "%{lookup('profile::ccs::common::pkgurl')}"
@@ -562,7 +562,7 @@ profile::core::firewall::firewall:
     proto: "all"
     jump: "reject"
 
-restic::bucket: "rubin-bm-backups/%{facts.fqdn}"
+restic::bucket: "rubin-bm-backups/%{facts.networking.fqdn}"
 restic::enable_backup: true
 restic::host: "s3.us-east-1.amazonaws.com"
 
@@ -574,7 +574,7 @@ rke2::version: "1.28.12~rke2r1"
 rke2::versionlock: true
 rke2::config:
   server: "https://%{::cluster}.%{::site}.lsst.org:9345"
-  node-name: "%{facts.hostname}"
+  node-name: "%{facts.networking.hostname}"
   tls-san:
     - "%{::cluster}.%{::site}.lsst.org"
   disable:

hieradata/node/auxtel-daq-mgt.cp.lsst.org.yaml

@@ -50,9 +50,9 @@ nfs::nfs_v4_client: false  # XXX disable v4 because of DAQ
 nfs::client_mounts:
   /net/self/dsl:
     share: "/srv/nfs/dsl"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/lsst-daq:
     share: "/srv/nfs/lsst-daq"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true

hieradata/node/auxtel-fp01.cp.lsst.org.yaml

@@ -51,7 +51,7 @@ nfs::client_enabled: true
 nfs::client_mounts:
   /net/self/data:
     share: "data"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
 
 ccs_software::services:

hieradata/node/auxtel-fp01.ls.lsst.org.yaml

@@ -18,7 +18,7 @@ nfs::client_enabled: true
 nfs::client_mounts:
   /net/self/ccs-data:
     share: "ccs-data"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
 
 ccs_software::services:

hieradata/node/auxtel-fp01.tu.lsst.org.yaml

@@ -59,7 +59,7 @@ nfs::client_enabled: true
 nfs::client_mounts:
   /net/self/ccs-data:
     share: "ccs-data"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
 
 ccs_software::services:

hieradata/node/comcam-archiver.cp.lsst.org.yaml

@@ -40,7 +40,7 @@ network::interfaces_hash:
     onboot: "no"
     type: "Ethernet"
 
-network::hostname: "%{facts.fqdn}"
+network::hostname: "%{facts.networking.fqdn}"
 network::mroutes_hash:
   em2:
     routes:
@@ -95,11 +95,11 @@ nfs::client_enabled: true
 nfs::client_mounts:
   /net/self/data/lsstdata:
     share: "lsstdata"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /repo:
     share: "repo"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
 
 profile::core::k5login::k5login:

hieradata/node/comcam-archiver.tu.lsst.org.yaml

@@ -27,11 +27,11 @@ nfs::client_enabled: true
 nfs::client_mounts:
   /net/self/data/lsstdata:
     share: "lsstdata"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /repo:
     share: "repo"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
 
 profile::core::k5login::k5login:

hieradata/node/comcam-daq-mgt.cp.lsst.org.yaml

@@ -91,9 +91,9 @@ nfs::nfs_v4_client: false  # XXX disable v4 because of DAQ
 nfs::client_mounts:
   /net/self/dsl:
     share: "/srv/nfs/dsl"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/lsst-daq:
     share: "/srv/nfs/lsst-daq"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true

hieradata/node/comcam-fp01.cp.lsst.org.yaml

@@ -115,7 +115,7 @@ nfs::nfs_v4_client: true
 nfs::client_mounts:
   /net/self/ccs-data:
     share: "/ccs-data"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
 
 hosts::entries:

hieradata/node/comcam-fp01.tu.lsst.org.yaml

@@ -58,7 +58,7 @@ nfs::client_enabled: true
 nfs::client_mounts:
   /net/self/ccs-data:
     share: "ccs-data"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
 
 profile::ccs::file_transfer::s3daemon: true

hieradata/node/daq-mgt.tu.lsst.org.yaml

@@ -79,9 +79,9 @@ nfs::nfs_v4_client: false  # XXX disable v4 because of DAQ
 nfs::client_mounts:
   /net/self/dsl:
     share: "/srv/nfs/dsl"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/lsst-daq:
     share: "/srv/nfs/lsst-daq"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true

hieradata/node/lsstcam-daq-mgt.cp.lsst.org.yaml

@@ -117,9 +117,9 @@ nfs::nfs_v4_client: false  # XXX disable v4 because of DAQ
 nfs::client_mounts:
   /net/self/dsl:
     share: "/srv/nfs/dsl"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/lsst-daq:
     share: "/srv/nfs/lsst-daq"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true

hieradata/node/perfsonar1.cp.lsst.org.yaml

@@ -28,7 +28,7 @@ network::interfaces_hash:
     nozeroconf: "yes"
     mtu: "9000"
 
-network::hostname: "%{facts.fqdn}"
+network::hostname: "%{facts.networking.fqdn}"
 network::mroutes_hash:
   enp1s0f0.1120:
     routes:

hieradata/node/perfsonar1.ls.lsst.org.yaml

@@ -73,7 +73,7 @@ network::interfaces_hash:
     nozeroconf: "yes"
     mtu: "9000"
 
-network::hostname: "%{facts.fqdn}"
+network::hostname: "%{facts.networking.fqdn}"
 network::mroutes_hash:
   p2p1.360:  # owamp
     routes:

hieradata/role/foreman.yaml

@@ -91,7 +91,7 @@ foreman::plugin::column_view::columns:
     after: "name"
     content: "params['cluster']"
 foreman::plugin::tasks::automatic_cleanup: true
-foreman_proxy::base_url: "https://%{facts.fqdn}"
+foreman_proxy::base_url: "https://%{facts.networking.fqdn}"
 foreman_proxy::bind_host: '*'
 foreman_proxy::bmc_default_provider: "ipmitool"
 foreman_proxy::bmc: true
@@ -132,15 +132,15 @@ foreman_proxy::realm: false  # krb5 support for ssh -- untested
 foreman_proxy::realm_provider: "freeipa"
 foreman_proxy::register_in_foreman: false  # do not re-register proxy on every agent run
 foreman_proxy::ssl_ca: "/etc/puppetlabs/puppet/ssl/certs/ca.pem"
-foreman_proxy::ssl_cert: "/etc/puppetlabs/puppet/ssl/certs/%{facts.fqdn}.pem"
-foreman_proxy::ssl_key: "/etc/puppetlabs/puppet/ssl/private_keys/%{facts.fqdn}.pem"
+foreman_proxy::ssl_cert: "/etc/puppetlabs/puppet/ssl/certs/%{facts.networking.fqdn}.pem"
+foreman_proxy::ssl_key: "/etc/puppetlabs/puppet/ssl/private_keys/%{facts.networking.fqdn}.pem"
 foreman_proxy::ssl_port: 8443
 foreman_proxy::ssl: true
 foreman_proxy::tftp_listen_on: "https"
 foreman_proxy::tftp_managed: true
 foreman_proxy::tftp_manage_wget: true
 foreman_proxy::tftp: true
-foreman_proxy::trusted_hosts: ["%{facts.fqdn}"]
+foreman_proxy::trusted_hosts: ["%{facts.networking.fqdn}"]
 foreman_proxy::version: "%{lookup('foreman::version')}"
 foreman::cli::version: "%{lookup('foreman::version')}"
 foreman::repo::configure_scl_repo: false

hieradata/role/hexrot.yaml

@@ -27,7 +27,7 @@ files:
 profile::core::docker::storage_driver: "devicemapper"
 accounts::group_list:
   # this is duplicating the ipa gid as a local group
-  &docker_name docker-%{facts.hostname}:
+  &docker_name docker-%{facts.networking.hostname}:
     ensure: "present"
     gid: 70014
     forcelocal: true

hieradata/role/ipareplica.yaml

@@ -13,7 +13,7 @@ ipa::ipa_role: "replica"
 ipa::configure_replica_ca: true
 ipa::enable_ip_address: false
 ipa::configure_dns_server: false
-ipa::ipa_server_fqdn: "%{facts.fqdn}"
+ipa::ipa_server_fqdn: "%{facts.networking.fqdn}"
 
 clustershell::groupmembers:
   ipa:
@@ -26,13 +26,13 @@ clustershell::groupmembers:
 
 profile::core::ipa::default:
   global:
-    server: "%{facts.fqdn}"
-    xmlrpc_uri: "https://%{facts.fqdn}/ipa/xml"
-openldap::client::uri: "ldaps://%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
+    xmlrpc_uri: "https://%{facts.networking.fqdn}/ipa/xml"
+openldap::client::uri: "ldaps://%{facts.networking.fqdn}"
 
 tailscale::up_options:
   accept-dns: false  # leave /etc/resolv.conf alone
-  hostname: "%{facts.fqdn}"  # use fqdn instead of short hostname
+  hostname: "%{facts.networking.fqdn}"  # use fqdn instead of short hostname
 
 hosts::manage_fqdn: false  # avoid conflict with tailscale address
 hosts::entries:

hieradata/site/cp/role/nfsserver.yaml

@@ -117,29 +117,29 @@ nfs::client_enabled: true
 nfs::client_mounts:
   /net/self/data/home:
     share: "home"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/data/jhome:
     share: "jhome"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/data/lsstdata:
     share: "lsstdata"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/data/project:
     share: "project"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/data/scratch:
     share: "scratch"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/dimm:
     share: "dimm"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true
   /net/self/data/rsphome:
     share: "rsphome"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true

hieradata/site/cp/role/vms-data.yaml

@@ -32,5 +32,5 @@ nfs::client_enabled: true
 nfs::client_mounts:
   /net/self/vms-data:
     share: "vms-data"
-    server: "%{facts.fqdn}"
+    server: "%{facts.networking.fqdn}"
     atboot: true

site/profile/manifests/ccs/nvidia.pp

@@ -40,7 +40,7 @@
       default: {}
     }
 
-    if $facts['efi'] {
+    if fact('efi') {
       $grubfile = '/boot/efi/EFI/centos/grub.cfg'
     } else {
       $grubfile = '/boot/grub2/grub.cfg'

site/profile/manifests/core/cmms.pp

@@ -6,7 +6,7 @@
 ) {
   include profile::core::letsencrypt
 
-  $fqdn  = $facts[fqdn]
+  $fqdn  = fact('networking.fqdn')
 
   #  Letsencrypt cert path
   $le_root = "/etc/letsencrypt/live/${fqdn}"

site/profile/manifests/core/foreman.pp

@@ -117,7 +117,7 @@
   }
 
   # The foreman-selinux package is not managed by theforeman/foreman when selinux is disabled.  # This is to cleanup old installs.
-  unless $facts['os']['selinux']['enabled'] {
+  unless fact('os.selinux.enabled') {
     package { 'foreman-selinux':
       ensure => absent,
     }

site/profile/manifests/core/hardware.pp

@@ -20,7 +20,7 @@
     /PowerEdge/: {
       include ipmi
 
-      if $facts['has_dellperc'] {
+      if fact('has_dellperc') {
         include profile::core::perccli
       }
     }

site/profile/manifests/core/ipam.pp

@@ -36,7 +36,7 @@
     'mod_ssl',
   ]
 
-  $fqdn = $facts[fqdn]
+  $fqdn = fact('networking.fqdn')
   $le_root = "/etc/letsencrypt/live/${fqdn}"
   $my_cnf_master = @("MYCNF")
     [mysqld]

site/profile/manifests/core/letsencrypt.pp

@@ -5,7 +5,7 @@
 #     include profile::core::letsencrypt
 #     include augeas  # needed by perfsonar
 #
-#     $fqdn    = $facts['fqdn']
+#     $fqdn    = fact('networking.fqdn')
 #     $le_root = "/etc/letsencrypt/live/${fqdn}"
 #
 #     letsencrypt::certonly { $fqdn:
@@ -49,7 +49,7 @@
   ensure_packages(['python-s3transfer'])
 
   # XXX https://github.com/voxpupuli/puppet-letsencrypt/issues/230
-  if $facts['os']['name'] == 'CentOS' {
+  if fact('os.name') == 'CentOS' {
     ensure_packages(['python2-futures.noarch'])
   }
 

site/profile/manifests/core/perfsonar.pp

@@ -11,11 +11,11 @@
   include profile::core::letsencrypt
   include augeas  # needed by perfsonar
 
-  $fqdn    = $facts['networking']['fqdn']
+  $fqdn    = fact('networking.fqdn')
   $le_root = "/etc/letsencrypt/live/${fqdn}"
-  $os_version = $facts['os']['release']['major']
+  $os_version = fact('os.release.major')
   $gpgkey_path = '/etc/pki/rpm-gpg/RPM-GPG-KEY-perfSONAR'
-  $release_url = "https://software.internet2.edu/rpms/el${facts['os']['release']['major']}/x86_64/latest/packages/perfsonar-repo-0.11-1.noarch.rpm"
+  $release_url = "https://software.internet2.edu/rpms/el${fact('os.release.major')}/x86_64/latest/packages/perfsonar-repo-0.11-1.noarch.rpm"
   $gpgkey = "file://${gpgkey_path}"
 
   exec { 'RPM-GPG-KEY-perfSONAR':