Include profile::boot_security_upgrade in terraformer and both elastic roles

[akuzminsky]

Completes the Puppet side of the rollout. role::ecsnode is not used anywhere, and the remaining roles (base, mta, teleport, webserver, infrahouse_github_backup) are out of scope.

All three take the default fail_on_error => false.

Elastic needs no special handling

I previously flagged that boot-time patching would fight profile::elastic::service's restart suppression and would need an explicit ordering edge. On closer reading it does not, for two independent reasons:

• The elasticsearch package blacklist is belt-and-braces for this. Nothing in the repo sets Allowed-Origins or Origins-Pattern, so only Ubuntu's defaults apply — archive, security, ESM. The elasticsearch package comes from elastic.co, which is not among them, so unattended-upgrade would never upgrade it regardless of who invokes it or whether the blacklist is in place yet.
• The needrestart list-only drop-in is a persistent file. On any reboot it is already on disk before the exec runs. The only window is first provisioning, when Elasticsearch is not yet serving.

Both suppressions are declarative apt.conf.d / needrestart config that unattended-upgrade honours regardless of the invoker. Adding an ordering edge would have been coupling for a case that cannot happen, so none was added.

Verification

role::terraformer compiles a full catalog (external modules stubbed, provision-time facts supplied):

returns : [0, 1]
creates : /run/boot-security-upgrade.done
Package[cloud-guest-utils]: 1
Package[awscli]:            1
total resources: 103

returns [0,1] confirms the log-and-continue default. Both packages appearing exactly once rules out a duplicate declaration against profile::base.

Both elastic roles do not compile locally — and do not compile at HEAD either, without this change (exit 1, no output). Confirmed by compiling both ways rather than assuming, same as #297 and #298. They got puppet-lint, puppet parser validate, and a check that neither cloud-guest-utils nor awscli is declared anywhere in profile::elastic_master, profile::elastic_data or modules/profile/manifests/elastic/.

CI does not compile catalogs, so the elastic pair is worth a real check on first apply.

Terraform side

Separate, per service, as before. Elasticsearch goes through website-pod (two instantiations — master and data, both need the flag or half the cluster stays untagged), which already has defer_inspector_findings_until_patched as of v6.5.0. terraformer needs checking — I have not looked at what backs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KLGAXtoyoakLXUjaJSL4M3