{"host": "ms-fe2009.codfw.wmnet", "state": "core_diff", "description": "Differences to core resources", "diff": {"full": {"total": 3370, "only_in_self": [], "only_in_other": ["Envoyproxy::Cluster[cluster_ratelimit]", "Envoyproxy::Conf[cluster_ratelimit]", "File[/etc/envoy/clusters.d/01-cluster_ratelimit.yaml]"], "resource_diffs": [{"resource": "Envoyproxy::Cluster[cluster_ratelimit]", "parameters": "--- Envoyproxy::Cluster[cluster_ratelimit].orig\n+++ Envoyproxy::Cluster[cluster_ratelimit]\n\n+    priority => 1\n"}, {"resource": "Envoyproxy::Tls_terminator[443]", "parameters": "--- Envoyproxy::Tls_terminator[443].orig\n+++ Envoyproxy::Tls_terminator[443]\n\n-    circuit_breakers_config => defaults\n-    generate_request_id     => True\n-    global_certs            => [{'cert_path': '/etc/envoy/ssl/discovery2026__swift_discovery_wmnet_server.chained.pem', 'key_path': '/etc/envoy/ssl/discovery2026__swift_discovery_wmnet_server-key.pem'}]\n-    stek_files              => []\n+    global_key_path         => /etc/envoy/ssl/discovery2026__swift_discovery_wmnet_server-key.pem\n+    rate_limit_enabled      => True\n+    global_cert_path        => /etc/envoy/ssl/discovery2026__swift_discovery_wmnet_server.chained.pem\n+    rate_limit_config       => {'address': 'ratelimit-media.svc.codfw.wmnet', 'port': 8081, 'domain': 'upload'}\n@@\n-    upstreams               => [{'server_names': ['*'], 'certificates': None, 'upstream': {'port': 80, 'addr': '10.192.0.139'}}]\n+    upstreams               => [{'server_names': ['*'], 'cert_path': None, 'key_path': None, 'upstream_port': 80, 'upstream_addr': '10.192.0.139'}]\n"}, {"resource": "Envoyproxy::Conf[cluster_ratelimit]", "parameters": "--- Envoyproxy::Conf[cluster_ratelimit].orig\n+++ Envoyproxy::Conf[cluster_ratelimit]\n\n+    conf_type => cluster\n+    priority  => 1\n"}, {"resource": "File[/etc/envoy/clusters.d/01-cluster_ratelimit.yaml]", "content": "--- /etc/envoy/clusters.d/01-cluster_ratelimit.yaml.orig\n+++ /etc/envoy/clusters.d/01-cluster_ratelimit.yaml\n@@ -0,0 +1,18 @@\n+name: ratelimit\n+type: static\n+connect_timeout: 0.25s\n+lb_policy: ROUND_ROBIN\n+typed_extension_protocol_options:\n+  envoy.extensions.upstreams.http.v3.HttpProtocolOptions:\n+    \"@type\": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\n+    explicit_http_config:\n+      http2_protocol_options: {}\n+load_assignment:\n+  cluster_name: ratelimit\n+  endpoints:\n+  - lb_endpoints:\n+    - endpoint:\n+        address:\n+          socket_address:\n+            address: ratelimit-media.svc.codfw.wmnet\n+            port_value: 8081", "parameters": "--- File[/etc/envoy/clusters.d/01-cluster_ratelimit.yaml].orig\n+++ File[/etc/envoy/clusters.d/01-cluster_ratelimit.yaml]\n\n+    ensure => present\n+    notify => Exec[verify-envoy-config]\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n"}, {"resource": "Class[Profile::Tlsproxy::Envoy]", "parameters": "--- Class[Profile::Tlsproxy::Envoy].orig\n+++ Class[Profile::Tlsproxy::Envoy]\n\n+    rate_limit_enabled => True\n+    rate_limit_config  => {'address': 'ratelimit-media.svc.codfw.wmnet', 'port': 8081, 'domain': 'upload'}\n"}], "perc_changed": "0.24%"}, "core": {"total": 3370, "only_in_self": [], "only_in_other": ["File[/etc/envoy/clusters.d/01-cluster_ratelimit.yaml]"], "resource_diffs": [], "perc_changed": "0.03%"}, "main": {"total": 3370, "only_in_self": [], "only_in_other": ["Envoyproxy::Cluster[cluster_ratelimit]", "Envoyproxy::Conf[cluster_ratelimit]", "File[/etc/envoy/clusters.d/01-cluster_ratelimit.yaml]"], "resource_diffs": [{"resource": "Envoyproxy::Tls_terminator[443]", "parameters": "--- Envoyproxy::Tls_terminator[443].orig\n+++ Envoyproxy::Tls_terminator[443]\n\n-    circuit_breakers_config => defaults\n-    generate_request_id     => True\n-    global_certs            => [{'cert_path': '/etc/envoy/ssl/discovery2026__swift_discovery_wmnet_server.chained.pem', 'key_path': '/etc/envoy/ssl/discovery2026__swift_discovery_wmnet_server-key.pem'}]\n-    stek_files              => []\n+    global_key_path         => /etc/envoy/ssl/discovery2026__swift_discovery_wmnet_server-key.pem\n+    rate_limit_enabled      => True\n+    global_cert_path        => /etc/envoy/ssl/discovery2026__swift_discovery_wmnet_server.chained.pem\n+    rate_limit_config       => {'address': 'ratelimit-media.svc.codfw.wmnet', 'port': 8081, 'domain': 'upload'}\n@@\n-    upstreams               => [{'server_names': ['*'], 'certificates': None, 'upstream': {'port': 80, 'addr': '10.192.0.139'}}]\n+    upstreams               => [{'server_names': ['*'], 'cert_path': None, 'key_path': None, 'upstream_port': 80, 'upstream_addr': '10.192.0.139'}]\n"}, {"resource": "Class[Profile::Tlsproxy::Envoy]", "parameters": "--- Class[Profile::Tlsproxy::Envoy].orig\n+++ Class[Profile::Tlsproxy::Envoy]\n\n+    rate_limit_enabled => True\n+    rate_limit_config  => {'address': 'ratelimit-media.svc.codfw.wmnet', 'port': 8081, 'domain': 'upload'}\n"}], "perc_changed": "0.15%"}}}