Configure whitehall_db_admin machine class

This creates a dedicated database admin machine for Whitehall, following the Account API convention devised in #11342.

This is in order to facilitate the implementation of [RFC-143][], which concludes that every GOV.UK relational database should have its own RDS instance.

Trello: https://trello.com/c/HjK4AbUS/49-configure-puppet-for-new-db-admin-mysql-instances

[RFC-143]: https://github.com/alphagov/govuk-rfcs/blob/main/rfc-143-split-database-instances.md

hieradata_aws/class/integration/whitehall_db_admin.yaml

@@ -0,0 +1,25 @@
+govuk_env_sync::tasks:
+  "pull_whitehall_production_daily":
+    ensure: "present"
+    hour: "0"
+    minute: "0"
+    action: "pull"
+    dbms: "mysql"
+    storagebackend: "s3"
+    database: "whitehall_production"
+    database_hostname: "whitehall-mysql"
+    temppath: "/tmp/whitehall_production"
+    url: "govuk-production-database-backups"
+    path: "whitehall-mysql"
+  # "push_whitehall_production_daily":
+  #   ensure: "present"
+  #   hour: "5"
+  #   minute: "0"
+  #   action: "push"
+  #   dbms: "mysql"
+  #   storagebackend: "s3"
+  #   database: "whitehall_production"
+  #   database_hostname: "whitehall-mysql"
+  #   temppath: "/tmp/whitehall_production"
+  #   url: "govuk-integration-database-backups"
+  #   path: "whitehall-mysql"

hieradata_aws/class/production/whitehall_db_admin.yaml

@@ -0,0 +1,13 @@
+# govuk_env_sync::tasks:
+#   "push_whitehall_production_daily":
+#     ensure: "present"
+#     hour: "23"
+#     minute: "0"
+#     action: "push"
+#     dbms: "mysql"
+#     storagebackend: "s3"
+#     database: "whitehall_production"
+#     database_hostname: "whitehall-mysql"
+#     temppath: "/tmp/whitehall_production"
+#     url: "govuk-production-database-backups"
+#     path: "whitehall-mysql"

hieradata_aws/class/staging/whitehall_db_admin.yaml

@@ -0,0 +1,25 @@
+govuk_env_sync::tasks:
+  "pull_whitehall_production_daily":
+    ensure: "present"
+    hour: "0"
+    minute: "0"
+    action: "pull"
+    dbms: "mysql"
+    storagebackend: "s3"
+    database: "whitehall_production"
+    database_hostname: "whitehall-mysql"
+    temppath: "/tmp/whitehall_production"
+    url: "govuk-production-database-backups"
+    path: "whitehall-mysql"
+  # "push_whitehall_production_daily":
+  #   ensure: "present"
+  #   hour: "5"
+  #   minute: "0"
+  #   action: "push"
+  #   dbms: "mysql"
+  #   storagebackend: "s3"
+  #   database: "whitehall_production"
+  #   database_hostname: "whitehall-mysql"
+  #   temppath: "/tmp/whitehall_production"
+  #   url: "govuk-staging-database-backups"
+  #   path: "whitehall-mysql"

hieradata_aws/common.yaml

@@ -580,6 +580,8 @@ govuk::apps::whitehall::admin_db_name: whitehall_production
 govuk::apps::whitehall::admin_db_password: "%{hiera('govuk::apps::whitehall::db::mysql_whitehall_admin')}"
 govuk::apps::whitehall::admin_db_username: whitehall
 # TODO this should be using a replica, but we can change that when we have deployed one
+# TODO: switch to "whitehall-mysql" and uncomment the 'push'
+# `govuk_env_sync::tasks` tasks when we're ready to switch to the dedicated RDS instance
 govuk::apps::whitehall::db_hostname: 'mysql-primary'
 govuk::apps::whitehall::db_name: whitehall_production
 govuk::apps::whitehall::db_password: "%{hiera('govuk::apps::whitehall::db::mysql_whitehall')}"

modules/govuk/manifests/node/s_whitehall_db_admin.pp

@@ -0,0 +1,34 @@
+# == Class: govuk_node::s_whitehall_db_admin
+#
+# This machine class is used to administer the Whitehall
+# MySQL RDS instances.
+#
+# === Parameters
+#
+# [*mysql_db_host*]
+#  The database hostname
+#
+# [*mysql_db_password*]
+#  The database password
+#
+# [*mysql_db_user*]
+#  The database user to connect to the remote database as
+#
+class govuk::node::s_whitehall_db_admin(
+  $mysql_db_host     = undef,
+  $mysql_db_password = undef,
+  $mysql_db_user     = undef,
+) {
+  include ::govuk::node::s_base
+  include govuk_env_sync
+
+  file { '/root/.my.cnf':
+    ensure  => 'present',
+    owner   => 'root',
+    group   => 'root',
+    content => template('govuk/mysql_my.cnf.erb'),
+  }
+
+  # include all MySQL classes that create databases and users
+  -> class { '::govuk::apps::whitehall::db': }
+}