Compilation results for ml-serve1015.eqiad.wmnet: System changes detected

You can retrieve this result from host.json.

Catalog differences

Summary

Total Resources:	2865
Resources added:	353
Resources removed:	5
Resources modified:	364
Change percentage:	25.20%

Resources only in the new catalog

File[/etc/amd]
File[/etc/kubernetes/pki/mlserve__istio-cni.pem]
Cfssl::Csr[/etc/cfssl/csr/mlserve__calicoctl.csr]
Cfssl::Csr[/etc/cfssl/csr/mlserve__calico-cni.csr]
Rsyslog::Conf[kubernetes-node-filters]
File[/etc/cfssl/csr/mlserve__calicoctl.csr]
Systemd::Syslog[rsyslog-release-deleted-inotify-watches]
File[/etc/default/cpupower]
Class[Profile::Kubernetes::Node]
Class[K8s::Base_dirs]
Exec[Generate cert mlserve__system_kube-proxy]
File[/etc/nerdctl/nerdctl.toml]
Cfssl::Cert[mlserve__calico-cni]
Sysctl::Parameters[kube_proxy_icmp]
Exec[apt_package_from_component_istio115]
Class[K8s::Kubelet::Cni::Base]
File[/etc/rsyslog.d/35-output-kafka-k8s.conf]
Exec[create chained cert /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]
Exec[create chained cert /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]
Apt::Pin[apt_pin_firmware-amd-graphics-trixie-bpo_trixie-bpo]
Sysctl::Parameters[ipv6-fowarding-accept-ra]
File[/etc/dragonfly/dfdaemon.yml]
Service[cpupower]
Concat_fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
Apt::Package_from_component[calico329]
File[/etc/apt/preferences.d/apt_pin_linux_6_16_trixie_trixie_bpo.pref]
File[/etc/default/kube-proxy]
Concat::Fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
File[/etc/kubernetes/pki/mlserve__calico-cni.chain.pem]
File[/etc/containerd/config.toml]
File[/etc/dragonfly]
Exec[systemd daemon-reload for cpupower.service (cpupower)]
File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem]
Exec[systemd daemon-reload for kube-proxy.service (kube-proxy)]
K8s::Kubeconfig[/etc/cni/net.d/istio-kubeconfig]
File[/var/lib/kubelet]
Class[Calico]
Concat_fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]
File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.csr]
Firewall::Service[calico-typha]
File[/etc/kubernetes/pki/mlserve__kubelet_server.csr]
File[/etc/kubernetes/pki/mlserve__calico-cni-key.pem]
File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.csr]
Service[rsyslog-release-deleted-inotify-watches.timer]
File[/etc/udev/rules.d/70-render.rules]
Docker::Credentials[/var/lib/kubelet/config.json]
Package[calico-cni]
Exec[Generate cert mlserve__kubelet_server refresh]
File[/etc/rsyslog.d/40-rsyslog-release-deleted-inotify-watches.conf]
Package[socat]
Package[apparmor]
Rsyslog::Conf[shellbox]
Exec[Generate cert mlserve__calicoctl refresh]
Exec[systemd daemon-reload for kubelet.service (kubelet-container-runtime)]
File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]
Sysctl::Parameters[kube_proxy_conntrack]
K8s::Kubeconfig[/etc/kubernetes/proxy.conf]
Exec[renew certificate - mlserve__system_kube-proxy]
Package[kubernetes-node]
Service[kube-proxy]
File[/etc/sysctl.d/75-kube_proxy_conntrack.conf]
Exec[Generate cert mlserve__amdgpu-node-labeller refresh]
Systemd::Service[rsyslog-imfile-remedy]
Sysctl::Conffile[increase_inotify_limits]
Class[Toil::Rsyslog_imfile_remedy]
Sysctl::Parameters[increase_inotify_limits]
Class[Wmflib::Service::Catalog]
Package[nerdctl]
Exec[Generate cert mlserve__kubelet_server refresh on intermediate ca change]
Concat[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
Rsyslog::Conf[input-file-kubernetes-json]
Systemd::Unit[cpupower]
File[/etc/containerd]
File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chained.pem]
Exec[create chained cert /etc/kubernetes/pki/mlserve__calico-cni.chain.pem]
Class[Profile::Lvs::Realserver]
Cfssl::Cert[mlserve__kubelet_server]
File[/etc/cfssl/csr/mlserve__istio-cni.csr]
Exec[Generate cert mlserve__amdgpu-node-labeller refresh on intermediate ca change]
File[/etc/kubernetes/pki/mlserve__calicoctl-key.pem]
Package[containerd]
Exec[Generate cert mlserve__system_kube-proxy refresh]
Exec[Generate cert mlserve__calicoctl]
Ferm::Service[dragonfly_dfget]
File[/etc/nerdctl]
File[/etc/kubernetes/pki]
Class[Profile::Rsyslog::Kubernetes]
Rsyslog::Conf[output_kafka_k8s]
Concat::Fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
File[/etc/udev/rules.d/75-kube_proxy_conntrack.rules]
Class[Profile::Calico::Kubernetes]
File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem]
Exec[/usr/sbin/dpkg-reconfigure -p critical -f noninteractive wikimedia-lvs-realserver]
Group[kube]
Package[linux-image-6.16.3+deb13-amd64]
Exec[renew certificate - mlserve__istio-cni]
Apt::Package_from_bpo[firmware-amd-graphics-trixie-bpo]
Exec[systemd daemon-reload for rsyslog-imfile-remedy.service (rsyslog-imfile-remedy.service)]
Exec[renew certificate - mlserve__rsyslog]
File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog-key.pem]
Package[rsyslog-kubernetes]
Exec[Generate cert mlserve__kubelet_server]
Exec[Generate cert mlserve__calicoctl refresh on intermediate ca change]
Systemd::Override[amd-devplugin-after-labeller]
File[/etc/systemd/system/ferm.service.d/ferm-service-auto-restart.conf]
Package[dragonfly-dfget]
Service[dragonfly-dfdaemon]
File[/etc/rsyslog.d/10-kubernetes-node-filters.conf]
Systemd::Override[ferm-service-auto-restart]
Class[K8s::Kubelet]
Class[Lvs::Realserver]
Cfssl::Cert[mlserve__amdgpu-node-labeller]
File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem]
Concat_fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]
Ferm::Service[calico_typha]
File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem]
Class[Profile::Lvs::Configuration]
File[/etc/apparmor.d/abstractions]
File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chained.pem]
File[/etc/cfssl/csr/mlserve__system_kube-proxy.csr]
Ferm::Service[calico-bird]
Apt::Package_from_component[kubernetes131]
Apt::Repository[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]
File[/etc/kubernetes/pki/mlserve__calicoctl.pem]
File[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr]
Systemd::Unit[ferm-ferm-service-auto-restart]
File[/etc/kubernetes/pki/mlserve__istio-cni.chained.pem]
Rsyslog::Conf[kubernetes]
Exec[Generate cert mlserve__system_kube-proxy refresh on intermediate ca change]
Exec[cpupower_reload]
Systemd::Service[kube-proxy]
Package[dragonfly-dfdaemon]
Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet]
File[/etc/cni/net.d/calico-kubeconfig]
File[/etc/cni/net.d/istio-kubeconfig]
Class[Profile::Dragonfly::Dfdaemon]
File[/etc/kubernetes/pki/mlserve__calicoctl.chain.pem]
File[/etc/default/kubelet]
File[/etc/sysctl.d/75-kube_proxy_icmp.conf]
Class[Profile::Rsyslog::Shellbox]
File[/etc/kubernetes]
File[/etc/kubernetes/pki/mlserve__kubelet_server.pem]
Udev::Rule[kube_proxy_conntrack]
Exec[apt_repository_component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]
Package[crictl]
Concat::Fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]
Systemd::Unit[kubelet-container-runtime]
File[/etc/calico/pki]
File[/etc/apt/preferences.d/apt_pin_firmware_amd_graphics_trixie_bpo_trixie_bpo.pref]
File[/etc/rsyslog.d/08-input-file-kubernetes-json.conf]
Exec[renew certificate - mlserve__kubelet_server]
File[/etc/systemd/system/kube-proxy.service.d]
Exec[exec-apt-get-update-firmware-amd-graphics-trixie-bpo_trixie-bpo]
Apt::Package_from_bpo[linux-6.16-trixie]
Exec[renew certificate - mlserve__calico-cni]
K8s::Kubeconfig[/etc/amd/node-labeller-kubeconfig]
Cfssl::Csr[/etc/cfssl/csr/mlserve__rsyslog.csr]
Class[K8s::Proxy]
Systemd::Timer[rsyslog-imfile-remedy]
File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet-key.pem]
File[/etc/kubernetes/pki/mlserve__system_kube-proxy-key.pem]
File[/usr/libexec/cpupower]
Exec[apt_package_from_component_calico329]
Systemd::Unit[amd-k8s-node-labeller-amd-devplugin-after-labeller]
Cfssl::Cert[mlserve__calicoctl]
Class[Cpufrequtils]
Concat[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
Class[Role::Ml_k8s::Worker]
Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh]
Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.service (rsyslog-release-deleted-inotify-watches.service)]
Class[Containerd]
Package[wikimedia-lvs-realserver]
Rsyslog::Input::File[kubernetes-json]
Exec[apt_pin_apt_pin_firmware-amd-graphics-trixie-bpo_trixie-bpo]
Concat::Fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]
Class[Containerd::Nerdctl]
File[/etc/cni/net.d]
Concat[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
File[/etc/kubernetes/pki/mlserve__calicoctl.csr]
File[/etc/amd/node-labeller-kubeconfig]
Exec[Generate cert mlserve__calico-cni refresh on intermediate ca change]
Exec[apt_repository_component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]
Class[Profile::Kubernetes::Container_runtime]
Cfssl::Csr[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]
Systemd::Unit[rsyslog-imfile-remedy.timer]
File[/etc/systemd/system/amd-k8s-node-labeller.service.d/amd-devplugin-after-labeller.conf]
File[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]
File[/etc/calico/calicoctl.cfg]
Exec[Generate cert mlserve__rsyslog refresh on intermediate ca change]
File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]
Service[kubelet]
File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chained.pem]
Cfssl::Csr[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr]
Exec[systemd daemon-reload for rsyslog-imfile-remedy.timer (rsyslog-imfile-remedy.timer)]
Exec[Generate cert mlserve__istio-cni]
File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller-key.pem]
Rsyslog::Conf[rsyslog-release-deleted-inotify-watches]
File[/etc/dragonfly/dfget.yml]
Cfssl::Csr[/etc/cfssl/csr/mlserve__system_kube-proxy.csr]
Exec[renew certificate - mlserve__system_node_ml-serve1015_eqiad_wmnet]
Concat_file[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
Cfssl::Cert[mlserve__system_node_ml-serve1015_eqiad_wmnet]
Apt::Repository[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]
File[/etc/cni]
Exec[create chained cert /etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]
Exec[create chained cert /etc/kubernetes/pki/mlserve__istio-cni.chain.pem]
Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh on intermediate ca change]
Systemd::Unit[rsyslog-release-deleted-inotify-watches.timer]
Class[Containerd::Configuration]
Systemd::Unit[rsyslog-imfile-remedy.service]
Service[containerd]
File[/var/log/rsyslog-release-deleted-inotify-watches]
Exec[Generate cert mlserve__istio-cni refresh]
File[/lib/systemd/system/rsyslog-imfile-remedy.service]
Concat_file[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
Exec[systemd daemon-reload for amd-k8s-node-labeller.service (amd-k8s-node-labeller-amd-devplugin-after-labeller)]
K8s::Kubeconfig[/etc/calico/calicoctl-kubeconfig]
File[/etc/cfssl/csr/mlserve__rsyslog.csr]
File[/etc/logrotate.d/rsyslog-release-deleted-inotify-watches]
Class[Profile::Containerd]
Logrotate::Conf[rsyslog-release-deleted-inotify-watches]
Exec[/sbin/modprobe overlay]
File[/etc/calico]
File[/etc/ferm/conf.d/10_dragonfly_dfget]
Exec[create chained cert /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]
Ferm::Service[kubelet-http]
File[/etc/calico/calicoctl-kubeconfig]
Concat::Fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
Concat_file[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
File[/etc/systemd/system/amd-k8s-node-labeller.service.d]
Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.timer (rsyslog-release-deleted-inotify-watches.timer)]
Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh on intermediate ca change]
Systemd::Unit[kube-proxy]
Systemd::Unit[rsyslog-release-deleted-inotify-watches.service]
Sysctl::Conffile[ipv6-fowarding-accept-ra]
File[/etc/kubernetes/pki/mlserve__istio-cni.chain.pem]
Cfssl::Cert[mlserve__rsyslog]
File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]
Cfssl::Csr[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr]
K8s::Package[kubelet]
File[/etc/kubernetes/pki/mlserve__istio-cni.csr]
File[/var/run/kubernetes]
Concat_fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
Exec[Generate cert mlserve__calico-cni]
Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh]
K8s::Kubelet::Cni[calico]
File[/lib/systemd/system/rsyslog-release-deleted-inotify-watches.timer]
File[/usr/local/sbin/rsyslog-release-deleted-inotify-watches]
Class[K8s::Clusters]
Package[amd-k8s-node-labeller]
Package[calicoctl]
File[/etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]
Package[amd-k8s-device-plugin]
K8s::Kubeconfig[/etc/cni/net.d/calico-kubeconfig]
File[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]
Cfssl::Csr[/etc/cfssl/csr/mlserve__kubelet_server.csr]
Concat_fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]
Exec[Generate cert mlserve__rsyslog refresh]
Exec[create chained cert /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]
File[/etc/kubernetes/pki/mlserve__system_kube-proxy.pem]
File[/etc/kubernetes/pki/mlserve__calico-cni.csr]
Systemd::Service[rsyslog-release-deleted-inotify-watches]
Class[Base::Sysctl::Inotify]
File[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]
File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chained.pem]
File[/etc/sysctl.d/70-increase_inotify_limits.conf]
Class[Dragonfly::Dfdaemon]
Motd::Script[ml_k8s::worker]
File[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr]
Sysctl::Conffile[kube_proxy_icmp]
File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]
File[/etc/kubernetes/kube-proxy-config.yaml]
Concat_fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
Sysctl::Conffile[kube_proxy_conntrack]
Exec[renew certificate - mlserve__amdgpu-node-labeller]
File[/etc/udev/rules.d/70-kfd.rules]
Class[Apparmor]
File[/etc/ferm/conf.d/10_kubelet-http]
Cfssl::Csr[/etc/cfssl/csr/mlserve__istio-cni.csr]
Apt::Package_from_component[istio115]
File[/etc/cfssl/csr/mlserve__calico-cni.csr]
File[/etc/kubernetes/pki/mlserve__calico-cni.pem]
File[/etc/kubernetes/pki/mlserve__istio-cni-key.pem]
Exec[apt_repository_component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]
Systemd::Timer::Job[rsyslog-imfile-remedy]
File[/etc/ferm/conf.d/10_calico-bird]
Apt::Pin[apt_pin_linux-6.16-trixie_trixie-bpo]
Node[__node_regexp__ml-serve1001-910-5.eqiad.]
File[/etc/default/wikimedia-lvs-realserver]
File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet-key.pem]
File[/etc/kubernetes/pki/mlserve__calico-cni.chained.pem]
Service[apparmor]
Exec[create chained cert /etc/kubernetes/pki/mlserve__calicoctl.chain.pem]
File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem]
Kmod::Module[overlay]
Cfssl::Cert[mlserve__istio-cni]
File[/etc/update-motd.d/05-ml-k8s--worker]
Concat::Fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]
File[/etc/kubernetes/proxy.conf]
K8s::Kubeconfig[/etc/kubernetes/kubelet.conf]
Exec[renew certificate - discovery__ml-serve1015_eqiad_wmnet]
File[/etc/rsyslog.d/20-shellbox.conf]
Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-auto-restart)]
Cfssl::Cert[discovery__ml-serve1015_eqiad_wmnet]
Motd::Message[ml_k8s::worker]
Package[linux-cpupower]
Cfssl::Cert[mlserve__system_kube-proxy]
Exec[Generate cert mlserve__amdgpu-node-labeller]
File[/etc/rsyslog.d/00-imfile.conf]
File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]
Systemd::Service[cpupower]
Systemd::Timer::Job[rsyslog-release-deleted-inotify-watches]
File[/var/lib/kubelet/config.json]
File[/etc/kubernetes/kubelet.conf]
Systemd::Timer[rsyslog-release-deleted-inotify-watches]
File[/etc/systemd/system/kubelet.service.d/container-runtime.conf]
Exec[Generate cert mlserve__rsyslog]
Systemd::Override[container-runtime]
File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]
K8s::Package[proxy]
File[/etc/kubernetes/pki/mlserve__calicoctl.chained.pem]
File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.csr]
File[/etc/modules-load.d/overlay.conf]
Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet]
User[kube]
File[/etc/systemd/system/kube-proxy.service.d/puppet-override.conf]
Firewall::Service[dragonfly_dfget]
File[/etc/ferm/conf.d/10_calico_typha]
File[/etc/cfssl/ssl/mlserve__rsyslog]
Package[istio-cni]
File[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]
File[/etc/systemd/system/kubelet.service.d]
Rsyslog::Conf[imfile]
File[/etc/kubernetes/pki/mlserve__system_kube-proxy.csr]
Service[rsyslog-imfile-remedy.timer]
File[/etc/rsyslog.d/09-kubernetes.conf]
Exec[Generate cert mlserve__calico-cni refresh]
File[/lib/systemd/system/rsyslog-release-deleted-inotify-watches.service]
Exec[exec-apt-get-update-linux-6.16-trixie_trixie-bpo]
File[/lib/systemd/system/rsyslog-imfile-remedy.timer]
Exec[apt_pin_apt_pin_linux-6.16-trixie_trixie-bpo]
Apt::Repository[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]
File[/etc/kubernetes/pki/mlserve__kubelet_server-key.pem]
Exec[renew certificate - mlserve__calicoctl]
File[/etc/cfssl/csr/mlserve__kubelet_server.csr]
File[/lib/systemd/system/cpupower.service]
File[/etc/cni/net.d/10-calico.conflist]
File[/etc/sysctl.d/70-ipv6-fowarding-accept-ra.conf]
Exec[Generate cert mlserve__istio-cni refresh on intermediate ca change]
Exec[create chained cert /etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]
File[/etc/kubernetes/kubelet-config.yaml]
File[/etc/kubernetes/pki/mlserve__kubelet_server.chained.pem]
Exec[apt_package_from_component_kubernetes131]

Resources only in the old catalog

File[/etc/update-motd.d/05-ml-k8s--insetup-gpu]
Class[Role::Ml_k8s::Insetup_gpu]
Node[__node_regexp__ml-serve10145.eqiad.]
Motd::Message[ml_k8s::insetup_gpu]
Motd::Script[ml_k8s::insetup_gpu]

Resources modified

Exec[apt_package_from_component_istio115]

Parameters differences:

--- Exec[apt_package_from_component_istio115].orig
+++ Exec[apt_package_from_component_istio115]

+    subscribe   => Apt::Repository[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]
+    command     => /usr/bin/apt-get update
+    refreshonly => True
+    before      => ['Package[istio-cni]']

File[/etc/rsyslog.d/35-output-kafka-k8s.conf]

Parameters differences:

--- File[/etc/rsyslog.d/35-output-kafka-k8s.conf].orig
+++ File[/etc/rsyslog.d/35-output-kafka-k8s.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Service[rsyslog]
+    ensure => present

Content differences:

--- /etc/rsyslog.d/35-output-kafka-k8s.conf.orig
+++ /etc/rsyslog.d/35-output-kafka-k8s.conf
@@ -0,0 +1,24 @@
+
+
+if ( $.log_outputs contains "k8s" ) then {
+    action(type="mmjsonparse" name="mmjsonparse_kafka_k8s")
+
+    action(type="omkafka"
+           name="omkafka_k8s"
+           broker=["kafka-logging1001.eqiad.wmnet:9093","kafka-logging1002.eqiad.wmnet:9093","kafka-logging1003.eqiad.wmnet:9093","kafka-logging1004.eqiad.wmnet:9093","kafka-logging1005.eqiad.wmnet:9093"]
+           topic="k8s-ml-serve-eqiad"
+           partitions.auto="on"
+           template="syslog_cee"
+           queue.type="LinkedList" queue.size="10000" queue.filename="output_kafka_k8s"
+           queue.highWatermark="7000" queue.lowWatermark="6000"
+           queue.checkpointInterval="5"
+           queue.maxDiskSpace="40960000"
+           confParam=[ "security.protocol=ssl",
+                       "ssl.ca.location=/etc/ssl/certs/wmf-ca-certificates.crt",
+                       "compression.codec=snappy",
+                       "socket.timeout.ms=10000",
+                       "socket.keepalive.enable=true",
+                       "queue.buffering.max.ms=50",
+                       "batch.num.messages=1000" ]
+    )
+}

K8s::Kubeconfig[/etc/cni/net.d/istio-kubeconfig]

Parameters differences:

--- K8s::Kubeconfig[/etc/cni/net.d/istio-kubeconfig].orig
+++ K8s::Kubeconfig[/etc/cni/net.d/istio-kubeconfig]

+    username    => istio-cni
+    mode        => 0400
+    group       => root
+    require     => ['File[/etc/cni/net.d]', 'Class[K8s::Base_dirs]']
+    ensure      => present
+    auth_cert   => {'cert': '/etc/kubernetes/pki/mlserve__istio-cni.pem', 'key': '/etc/kubernetes/pki/mlserve__istio-cni-key.pem', 'chain': '/etc/kubernetes/pki/mlserve__istio-cni.chain.pem', 'chained': '/etc/kubernetes/pki/mlserve__istio-cni.chained.pem'}
+    master_host => ml-ctrl.svc.eqiad.wmnet
+    owner       => root

File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.csr].orig
+++ File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.csr]

+    mode   => 0440
+    group  => root
+    owner  => dragonfly
+    ensure => file

File[/etc/kubernetes/pki/mlserve__kubelet_server.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__kubelet_server.csr].orig
+++ File[/etc/kubernetes/pki/mlserve__kubelet_server.csr]

+    mode   => 0440
+    group  => root
+    owner  => kube
+    ensure => file

File[/etc/kubernetes/pki/mlserve__calico-cni-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calico-cni-key.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__calico-cni-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => root
+    owner     => root
+    show_diff => False
+    ensure    => file

File[/etc/rsyslog.d/40-rsyslog-release-deleted-inotify-watches.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-rsyslog-release-deleted-inotify-watches.conf].orig
+++ File[/etc/rsyslog.d/40-rsyslog-release-deleted-inotify-watches.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Service[rsyslog]
+    ensure => absent

Content differences:

--- /etc/rsyslog.d/40-rsyslog-release-deleted-inotify-watches.conf.orig
+++ /etc/rsyslog.d/40-rsyslog-release-deleted-inotify-watches.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "rsyslog-release-deleted-inotify-watches" then {
+    action(
+        type="omfile" file="/var/log/rsyslog-release-deleted-inotify-watches/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Rsyslog::Conf[shellbox]

Parameters differences:

--- Rsyslog::Conf[shellbox].orig
+++ Rsyslog::Conf[shellbox]

+    priority => 20
+    mode     => 0444
+    ensure   => present
+    source   => puppet:///modules/profile/rsyslog/shellbox.rsyslog.conf

Exec[Generate cert mlserve__amdgpu-node-labeller refresh]

Parameters differences:

--- Exec[Generate cert mlserve__amdgpu-node-labeller refresh].orig
+++ Exec[Generate cert mlserve__amdgpu-node-labeller refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__amdgpu-node-labeller

+    refreshonly => True

Exec[Generate cert mlserve__system_kube-proxy refresh]

Parameters differences:

--- Exec[Generate cert mlserve__system_kube-proxy refresh].orig
+++ Exec[Generate cert mlserve__system_kube-proxy refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/mlserve__system_kube-proxy.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__system_kube-proxy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__system_kube-proxy

+    notify      => ['Service[kube-proxy]']
+    refreshonly => True

File[/etc/default/prometheus-node-exporter]

Content differences:

--- /etc/default/prometheus-node-exporter.orig
+++ /etc/default/prometheus-node-exporter
@@ -15,6 +15,7 @@
  --collector.netdev \
  --collector.netstat \
  --collector.netstat.fields=^(.*) \
+ --collector.processes \
  --collector.sockstat \
  --collector.stat \
  --collector.systemd.enable-restarts-metrics \

Exec[systemd daemon-reload for rsyslog-imfile-remedy.service (rsyslog-imfile-remedy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for rsyslog-imfile-remedy.service (rsyslog-imfile-remedy.service)].orig
+++ Exec[systemd daemon-reload for rsyslog-imfile-remedy.service (rsyslog-imfile-remedy.service)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

Exec[Generate cert mlserve__kubelet_server]

Parameters differences:

--- Exec[Generate cert mlserve__kubelet_server].orig
+++ Exec[Generate cert mlserve__kubelet_server]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__kubelet_server.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/mlserve__kubelet_server-key.pem 2>&1)"

+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve -profile server /etc/cfssl/csr/mlserve__kubelet_server.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__kubelet_server

+    notify      => ['Service[kubelet]']
+    require     => Cfssl::Csr[/etc/cfssl/csr/mlserve__kubelet_server.csr]

Cfssl::Cert[mlserve__amdgpu-node-labeller]

Parameters differences:

--- Cfssl::Cert[mlserve__amdgpu-node-labeller].orig
+++ Cfssl::Cert[mlserve__amdgpu-node-labeller]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => amdgpu-node-labeller
+    outdir          => /etc/kubernetes/pki
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    label           => mlserve
+    names           => []
+    auto_renew      => True
+    notify_services => []
+    provide_chain   => True
+    renew_seconds   => 952200
+    owner           => amd-nodelabeller
+    group           => amd-nodelabeller
+    ensure          => present
+    before_services => []
+    hosts           => []

Nrpe::Check[check_disk_space]

Parameters differences:

--- Nrpe::Check[check_disk_space].orig
+++ Nrpe::Check[check_disk_space]

@@
-    command => /usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" -i "/srv/nvme[0-9]n[0-9]p[0-9]" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs
+    command => /usr/lib/nagios/plugins/check_disk -w 10% -c 5% -W 6% -K 3% -l -e -A -i '/(var/lib|run)/(containerd|kubelet)/*' --exclude-type=tracefs

File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chained.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]
+    group   => root
+    owner   => kube
+    ensure  => file

Kmod::Blacklist[wmf_overlay]

Parameters differences:

--- Kmod::Blacklist[wmf_overlay].orig
+++ Kmod::Blacklist[wmf_overlay]

@@
-    ensure  => present
+    ensure  => absent
@@
-    modules => ['overlayfs', 'overlay']
+    modules => []

Class[Profile::Dragonfly::Dfdaemon]

Parameters differences:

--- Class[Profile::Dragonfly::Dfdaemon].orig
+++ Class[Profile::Dragonfly::Dfdaemon]

+    ratelimit            => 100M
+    proxy_urls_regex     => ['wikimedia/machinelearning-liftwing.*/blobs/sha256.*', 'amd-pytorch.*/blobs/sha256.*']
+    docker_registry_fqdn => docker-registry.discovery.wmnet
+    supernodes           => ['dragonfly-supernode1001.eqiad.wmnet:8002=1']
+    ensure               => present

File[/etc/kubernetes]

Parameters differences:

--- File[/etc/kubernetes].orig
+++ File[/etc/kubernetes]

+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => directory

Package[crictl]

Parameters differences:

--- Package[crictl].orig
+++ Package[crictl]

+    ensure   => installed
+    provider => apt

Exec[renew certificate - mlserve__kubelet_server]

Parameters differences:

--- Exec[renew certificate - mlserve__kubelet_server].orig
+++ Exec[renew certificate - mlserve__kubelet_server]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__kubelet_server.pem -checkend 952200
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve -profile server /etc/kubernetes/pki/mlserve__kubelet_server.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__kubelet_server

+    notify      => ['Service[kubelet]']
+    require     => Exec[Generate cert mlserve__kubelet_server]

Apt::Package_from_bpo[linux-6.16-trixie]

Parameters differences:

--- Apt::Package_from_bpo[linux-6.16-trixie].orig
+++ Apt::Package_from_bpo[linux-6.16-trixie]

+    priority        => 1001
+    distro          => trixie
+    packages        => {'linux-image-6.16.3+deb13-amd64': 'present'}
+    ensure_packages => True

Cfssl::Cert[mlserve__calicoctl]

Parameters differences:

--- Cfssl::Cert[mlserve__calicoctl].orig
+++ Cfssl::Cert[mlserve__calicoctl]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => calicoctl
+    outdir          => /etc/kubernetes/pki
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    label           => mlserve
+    names           => []
+    auto_renew      => True
+    notify_services => []
+    provide_chain   => True
+    renew_seconds   => 952200
+    owner           => root
+    group           => root
+    ensure          => present
+    before_services => []
+    hosts           => []

Exec[apt_repository_component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Exec[apt_repository_component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Exec[apt_repository_component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    command     => /usr/bin/apt-get update 
+    refreshonly => True

Concat_file[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

Parameters differences:

--- Concat_file[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources].orig
+++ Concat_file[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

+    backup         => puppet
+    mode           => 0444
+    group          => root
+    order          => alpha
+    tag            => _etc_apt_sources.list.d_component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    ensure_newline => False
+    force          => False
+    replace        => True
+    show_diff      => True
+    format         => plain
+    owner          => root

Class[Prometheus::Node_exporter]

Parameters differences:

--- Class[Prometheus::Node_exporter].orig
+++ Class[Prometheus::Node_exporter]

@@
-    collectors_extra => []
+    collectors_extra => ['processes']

File[/etc/systemd/system/amd-k8s-node-labeller.service.d]

Parameters differences:

--- File[/etc/systemd/system/amd-k8s-node-labeller.service.d].orig
+++ File[/etc/systemd/system/amd-k8s-node-labeller.service.d]

+    mode   => 0555
+    group  => root
+    owner  => root
+    ensure => directory

Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.timer (rsyslog-release-deleted-inotify-watches.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.timer (rsyslog-release-deleted-inotify-watches.timer)].orig
+++ Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.timer (rsyslog-release-deleted-inotify-watches.timer)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

Package[amd-k8s-device-plugin]

Parameters differences:

--- Package[amd-k8s-device-plugin].orig
+++ Package[amd-k8s-device-plugin]

+    ensure   => present
+    provider => apt

Nrpe::Monitor_service[disk_space]

Parameters differences:

--- Nrpe::Monitor_service[disk_space].orig
+++ Nrpe::Monitor_service[disk_space]

@@
-    nrpe_command => /usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" -i "/srv/nvme[0-9]n[0-9]p[0-9]" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs
+    nrpe_command => /usr/lib/nagios/plugins/check_disk -w 10% -c 5% -W 6% -K 3% -l -e -A -i '/(var/lib|run)/(containerd|kubelet)/*' --exclude-type=tracefs

Class[Dragonfly::Dfdaemon]

Parameters differences:

--- Class[Dragonfly::Dfdaemon].orig
+++ Class[Dragonfly::Dfdaemon]

+    ratelimit            => 100M
+    docker_registry_fqdn => docker-registry.discovery.wmnet
+    proxy_urls_regex     => ['wikimedia/machinelearning-liftwing.*/blobs/sha256.*', 'amd-pytorch.*/blobs/sha256.*']
+    dfdaemon_ssl_cert    => /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem
+    dfdaemon_ssl_key     => /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet-key.pem
+    supernodes           => ['dragonfly-supernode1001.eqiad.wmnet:8002=1']
+    ensure               => present

File[/etc/ferm/conf.d/10_calico-bird]

Parameters differences:

--- File[/etc/ferm/conf.d/10_calico-bird].orig
+++ File[/etc/ferm/conf.d/10_calico-bird]

+    mode    => 0400
+    group   => root
+    owner   => root
+    tag     => ferm
+    notify  => Service[ferm]
+    require => File[/etc/ferm/conf.d]
+    ensure  => present

Content differences:

--- /etc/ferm/conf.d/10_calico-bird.orig
+++ /etc/ferm/conf.d/10_calico-bird
@@ -0,0 +1,6 @@
+# Autogenerated by puppet. DO NOT EDIT BY HAND!
+#
+# 
+&R_SERVICE(tcp, 179, ($NETWORK_INFRA 10.64.167.1));
+
+

Service[apparmor]

Parameters differences:

--- Service[apparmor].orig
+++ Service[apparmor]

+    require    => Package[apparmor]
+    hasstatus  => True
+    ensure     => running
+    hasrestart => True

Exec[Generate cert mlserve__rsyslog]

Parameters differences:

--- Exec[Generate cert mlserve__rsyslog].orig
+++ Exec[Generate cert mlserve__rsyslog]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog-key.pem 2>&1)"

+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__rsyslog.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog

+    notify      => ['Service[rsyslog]']
+    require     => Cfssl::Csr[/etc/cfssl/csr/mlserve__rsyslog.csr]

Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet].orig
+++ Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet-key.pem 2>&1)"

+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet

+    notify      => ['Service[kubelet]']
+    require     => Cfssl::Csr[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]

File[/etc/systemd/system/kube-proxy.service.d/puppet-override.conf]

Parameters differences:

--- File[/etc/systemd/system/kube-proxy.service.d/puppet-override.conf].orig
+++ File[/etc/systemd/system/kube-proxy.service.d/puppet-override.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[systemd daemon-reload for kube-proxy.service (kube-proxy)]
+    ensure => present

Content differences:

--- /etc/systemd/system/kube-proxy.service.d/puppet-override.conf.orig
+++ /etc/systemd/system/kube-proxy.service.d/puppet-override.conf
@@ -0,0 +1,2 @@
+[Unit]
+After = ferm.service

Package[istio-cni]

Parameters differences:

--- Package[istio-cni].orig
+++ Package[istio-cni]

+    ensure   => installed
+    provider => apt

File[/etc/cfssl/csr/mlserve__kubelet_server.csr]

Parameters differences:

--- File[/etc/cfssl/csr/mlserve__kubelet_server.csr].orig
+++ File[/etc/cfssl/csr/mlserve__kubelet_server.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/mlserve__kubelet_server.csr.orig
+++ /etc/cfssl/csr/mlserve__kubelet_server.csr
@@ -0,0 +1,17 @@
+{
+  "CN": "kubelet",
+  "hosts": [
+    "ml-serve1015",
+    "ml-serve1015.eqiad.wmnet",
+    "10.64.167.6",
+    "2620:0:861:12f:10:64:167:6",
+    "kubelet"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+
+  ]
+}

File[/etc/cni/net.d/10-calico.conflist]

Parameters differences:

--- File[/etc/cni/net.d/10-calico.conflist].orig
+++ File[/etc/cni/net.d/10-calico.conflist]

+    owner => root
+    mode  => 0755
+    group => root

Content differences:

--- /etc/cni/net.d/10-calico.conflist.orig
+++ /etc/cni/net.d/10-calico.conflist
@@ -0,0 +1,39 @@
+{
+  "name": "k8s-pod-network",
+  "cniVersion": "0.3.1",
+  "plugins": [
+    {
+      "type": "calico",
+      "log_level": "info",
+      "datastore_type": "kubernetes",
+      "mtu": 1460,
+      "ipam": {
+        "type": "calico-ipam",
+        "assign_ipv4": "true",
+        "assign_ipv6": "true"
+      },
+      "policy": {
+        "type": "k8s"
+      },
+      "kubernetes": {
+        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
+      }
+    },
+    {
+      "name": "istio-cni",
+      "type": "istio-cni",
+      "log_level": "info",
+      "kubernetes": {
+        "kubeconfig": "/etc/cni/net.d/istio-kubeconfig",
+        "cni_bin_dir": "/opt/cni/bin",
+        "exclude_namespaces": [
+          "istio-system",
+          "kube-system",
+          "knative-serving",
+          "cert-manager",
+          "kserve"
+        ]
+      }
+    }
+  ]
+}

Exec[create chained cert /etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]

+    subscribe => ['Exec[renew certificate - mlserve__system_kube-proxy]', 'File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]', 'File[/etc/kubernetes/pki/mlserve__system_kube-proxy.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/mlserve__system_kube-proxy.pem /etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/mlserve__system_kube-proxy.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/mlserve__system_kube-proxy.pem /etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem > /etc/kubernetes/pki/mlserve__system_kube-proxy.chained.pem
+    notify    => ['Service[kube-proxy]']
+    require   => Exec[Generate cert mlserve__system_kube-proxy refresh on intermediate ca change]

File[/etc/amd]

Parameters differences:

--- File[/etc/amd].orig
+++ File[/etc/amd]

+    ensure => directory
+    owner  => root
+    group  => root

Systemd::Syslog[rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- Systemd::Syslog[rsyslog-release-deleted-inotify-watches].orig
+++ Systemd::Syslog[rsyslog-release-deleted-inotify-watches]

+    base_dir               => /var/log
+    readable_by            => all
+    group                  => root
+    ensure                 => absent
+    log_filename           => syslog.log
+    programname_comparison => startswith
+    force_stop             => True
+    owner                  => root

Exec[create chained cert /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem].orig
+++ Exec[create chained cert /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]

+    subscribe => ['Exec[renew certificate - mlserve__rsyslog]', 'File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]', 'File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem | sha512sum)" == "$(/bin/cat /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem > /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chained.pem
+    notify    => ['Service[rsyslog]']
+    require   => Exec[Generate cert mlserve__rsyslog refresh on intermediate ca change]

Concat_fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

Parameters differences:

--- Concat_fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia-header].orig
+++ Concat_fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

+    tag    => _etc_apt_sources.list.d_component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    target => /etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 01
+    source => puppet:///modules/apt/sources-deb822-header.txt

File[/etc/default/kube-proxy]

Parameters differences:

--- File[/etc/default/kube-proxy].orig
+++ File[/etc/default/kube-proxy]

+    mode   => 0644
+    group  => root
+    owner  => root
+    notify => Service[kube-proxy]
+    ensure => file

Content differences:

--- /etc/default/kube-proxy.orig
+++ /etc/default/kube-proxy
@@ -0,0 +1,7 @@
+###
+# Kubernetes proxy config.
+
+# default config should be adequate
+
+DAEMON_ARGS="--config=/etc/kubernetes/kube-proxy-config.yaml \
+ --v=0"

File[/etc/containerd/config.toml]

Parameters differences:

--- File[/etc/containerd/config.toml].orig
+++ File[/etc/containerd/config.toml]

+    mode   => 0440
+    group  => root
+    owner  => root
+    notify => Service[containerd]
+    ensure => file

Content differences:

--- /etc/containerd/config.toml.orig
+++ /etc/containerd/config.toml
@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: Apache-2.0
+# This is based on the config shipped with the containerd package in Debian (1.6.20~ds1-1+b1)
+#
+# All possible config values including their defaults can be found by running:
+# containerd config default
+version = 2
+
+[plugins]
+  [plugins."io.containerd.grpc.v1.cri"]
+    # Define our sandbox image
+    sandbox_image = "docker-registry.discovery.wmnet/pause:3.6-1"
+    # max_container_log_line_size is the maximum log line size in bytes for a container.
+    # Log line longer than the limit will be split into multiple lines. -1 means no
+    # limit.
+    max_container_log_line_size = -1
+    # By default docker does set net.ipv4.ip_unprivileged_port_start=0 allowing containers to bind to ports
+    # below 1024 without explicit NET_BIND_SERVICE capability.
+    # It also sets net.ipv4.ping_group_range="0 2147483647", allowing ICMP sockets without CAP_NET_RAW.
+    # The following two options ensure compatibility with current workloads.
+    #
+    # enable_unprivileged_ports configures net.ipv4.ip_unprivileged_port_start=0
+    # for all containers which are not using host network and if it is not overwritten by PodSandboxConfig
+    # Note that currently default is set to disabled but target change it in future, see:
+    # https://github.com/kubernetes/kubernetes/issues/102612
+    enable_unprivileged_ports = true
+    # enable_unprivileged_icmp configures net.ipv4.ping_group_range="0 2147483647"
+    # for all containers which are not using host network, are not running in user namespace and if it is not
+    # overwritten by PodSandboxConfig.
+    # Note that currently default is set to disabled but target change it in future together with enable_unprivileged_ports
+    enable_unprivileged_icmp = true
+    [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+      # Re-define the runtime type as defining runc.options would shadow the default setting.
+      # Without this kubelet will fail to run containers with the following error:
+      # failed to create containerd container: create container failed validation: container.Runtime.Name must be set: invalid argument
+      runtime_type = "io.containerd.runc.v2"
+      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
+        # With cgroup v2 we need to use the systemd cgroup driver
+        SystemdCgroup = true
+    # If dragonfly is enabled, configure the local dfget as registry mirror
+    # https://d7y.io/docs/v2.0.2/setup/runtime/containerd/mirror
+    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker-registry.discovery.wmnet"]
+      endpoint = ["https://127.0.0.1:65001","https://docker-registry.discovery.wmnet"]
+    [plugins."io.containerd.grpc.v1.cri".cni]
+      bin_dir = "/opt/cni/bin"
+  [plugins."io.containerd.internal.v1.opt"]
+    # Debian overrides path from /opt/containerd
+    path = "/var/lib/containerd/opt"

Docker::Credentials[/var/lib/kubelet/config.json]

Parameters differences:

--- Docker::Credentials[/var/lib/kubelet/config.json].orig
+++ Docker::Credentials[/var/lib/kubelet/config.json]

+    registry_username => kubernetes
+    registry          => docker-registry.discovery.wmnet
+    owner             => root
+    group             => root
+    allow_group       => True
+    registry_password => somepassword2

Exec[renew certificate - mlserve__system_kube-proxy]

Parameters differences:

--- Exec[renew certificate - mlserve__system_kube-proxy].orig
+++ Exec[renew certificate - mlserve__system_kube-proxy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__system_kube-proxy.pem -checkend 952200
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/kubernetes/pki/mlserve__system_kube-proxy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__system_kube-proxy

+    notify      => ['Service[kube-proxy]']
+    require     => Exec[Generate cert mlserve__system_kube-proxy]

Sysctl::Parameters[increase_inotify_limits]

Parameters differences:

--- Sysctl::Parameters[increase_inotify_limits].orig
+++ Sysctl::Parameters[increase_inotify_limits]

+    priority => 70
+    ensure   => present
+    values   => {'fs.inotify.max_user_watches': 32768, 'fs.inotify.max_user_instances': 512}

Package[nerdctl]

Parameters differences:

--- Package[nerdctl].orig
+++ Package[nerdctl]

+    ensure   => installed
+    provider => apt

Exec[Generate cert mlserve__kubelet_server refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert mlserve__kubelet_server refresh on intermediate ca change].orig
+++ Exec[Generate cert mlserve__kubelet_server refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve -profile server /etc/cfssl/csr/mlserve__kubelet_server.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__kubelet_server

+    notify      => ['Service[kubelet]']
+    refreshonly => True

File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chained.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]
+    group   => root
+    owner   => kube
+    ensure  => file

Exec[create chained cert /etc/kubernetes/pki/mlserve__calico-cni.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/mlserve__calico-cni.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/mlserve__calico-cni.chain.pem]

+    subscribe => ['Exec[renew certificate - mlserve__calico-cni]', 'File[/etc/kubernetes/pki/mlserve__calico-cni.chain.pem]', 'File[/etc/kubernetes/pki/mlserve__calico-cni.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/mlserve__calico-cni.pem /etc/kubernetes/pki/mlserve__calico-cni.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/mlserve__calico-cni.chained.pem | sha512sum)"

+    require   => Exec[Generate cert mlserve__calico-cni refresh on intermediate ca change]
+    command   => /bin/cat /etc/kubernetes/pki/mlserve__calico-cni.pem /etc/kubernetes/pki/mlserve__calico-cni.chain.pem > /etc/kubernetes/pki/mlserve__calico-cni.chained.pem

Exec[Generate cert mlserve__amdgpu-node-labeller refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert mlserve__amdgpu-node-labeller refresh on intermediate ca change].orig
+++ Exec[Generate cert mlserve__amdgpu-node-labeller refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__amdgpu-node-labeller

+    refreshonly => True

Class[Profile::Rsyslog::Kubernetes]

Parameters differences:

--- Class[Profile::Rsyslog::Kubernetes].orig
+++ Class[Profile::Rsyslog::Kubernetes]

+    kubernetes_cluster_name => ml-serve-eqiad
+    kafka_brokers           => ['kafka-logging1001.eqiad.wmnet:9093', 'kafka-logging1002.eqiad.wmnet:9093', 'kafka-logging1003.eqiad.wmnet:9093', 'kafka-logging1004.eqiad.wmnet:9093', 'kafka-logging1005.eqiad.wmnet:9093']
+    enable                  => True

Exec[Generate cert mlserve__calicoctl refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert mlserve__calicoctl refresh on intermediate ca change].orig
+++ Exec[Generate cert mlserve__calicoctl refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/kubernetes/pki/mlserve__calicoctl.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__calicoctl.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__calicoctl

+    refreshonly => True

Systemd::Override[amd-devplugin-after-labeller]

Parameters differences:

--- Systemd::Override[amd-devplugin-after-labeller].orig
+++ Systemd::Override[amd-devplugin-after-labeller]

+    ensure  => present
+    unit    => amd-k8s-node-labeller
+    restart => True

Systemd::Override[ferm-service-auto-restart]

Parameters differences:

--- Systemd::Override[ferm-service-auto-restart].orig
+++ Systemd::Override[ferm-service-auto-restart]

+    restart => False
+    unit    => ferm
+    ensure  => present
+    source  => puppet:///modules/profile/kubernetes/node/ferm_systemd_override

Concat_fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Concat_fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Concat_fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    tag    => _etc_apt_sources.list.d_component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    target => /etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 10

Content differences:

--- component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.orig
+++ component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia
@@ -0,0 +1,5 @@
+Types: deb deb-src
+URIs: http://apt.wikimedia.org/wikimedia
+Suites: trixie-wikimedia
+Components: component/kubernetes131
+Signed-By: /etc/apt/keyrings/wikimedia-archive-keyring.gpg

Ferm::Service[calico_typha]

Parameters differences:

--- Ferm::Service[calico_typha].orig
+++ Ferm::Service[calico_typha]

+    proto               => tcp
+    unrestricted_access => False
+    src_sets            => ['DOMAIN_NETWORKS']
+    prio                => 10
+    ensure              => present
+    port                => 5473
+    notrack             => False
+    desc                =>

File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem]

+    mode   => 0440
+    group  => amd-nodelabeller
+    owner  => amd-nodelabeller
+    ensure => file

Apt::Repository[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Apt::Repository[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Apt::Repository[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    components               => component/istio115
+    uri                      => http://apt.wikimedia.org/wikimedia
+    keyfile                  => puppet:///modules/install_server/autoinstall/keyring/wikimedia-archive-keyring.gpg
+    bin                      => True
+    trust_repo               => False
+    ensure                   => present
+    source                   => True
+    allow_releaseinfo_change => False
+    dist                     => trixie-wikimedia

File[/etc/kubernetes/pki/mlserve__calicoctl.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calicoctl.chain.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__calicoctl.chain.pem]

+    mode   => 0440
+    group  => root
+    source => puppet:///modules/profile/pki/intermediates/mlserve-cert.pem
+    owner  => root
+    ensure => file

Exec[renew certificate - mlserve__calico-cni]

Parameters differences:

--- Exec[renew certificate - mlserve__calico-cni].orig
+++ Exec[renew certificate - mlserve__calico-cni]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__calico-cni.pem -checkend 952200
+    require     => Exec[Generate cert mlserve__calico-cni]
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/kubernetes/pki/mlserve__calico-cni.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__calico-cni

K8s::Kubeconfig[/etc/amd/node-labeller-kubeconfig]

Parameters differences:

--- K8s::Kubeconfig[/etc/amd/node-labeller-kubeconfig].orig
+++ K8s::Kubeconfig[/etc/amd/node-labeller-kubeconfig]

+    username    => amdgpu-node-labeller
+    mode        => 0400
+    group       => amd-nodelabeller
+    require     => ['File[/etc/amd]', 'Class[K8s::Base_dirs]']
+    ensure      => present
+    auth_cert   => {'cert': '/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem', 'key': '/etc/kubernetes/pki/mlserve__amdgpu-node-labeller-key.pem', 'chain': '/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem', 'chained': '/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chained.pem'}
+    master_host => ml-ctrl.svc.eqiad.wmnet
+    owner       => amd-nodelabeller

Class[Cpufrequtils]

Parameters differences:

--- Class[Cpufrequtils].orig
+++ Class[Cpufrequtils]

+    governor => performance
+    ensure   => present

Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.service (rsyslog-release-deleted-inotify-watches.service)]

Parameters differences:

--- Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.service (rsyslog-release-deleted-inotify-watches.service)].orig
+++ Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.service (rsyslog-release-deleted-inotify-watches.service)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

File[/etc/cni/net.d]

Parameters differences:

--- File[/etc/cni/net.d].orig
+++ File[/etc/cni/net.d]

+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => directory

File[/etc/kubernetes/pki/mlserve__calicoctl.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calicoctl.csr].orig
+++ File[/etc/kubernetes/pki/mlserve__calicoctl.csr]

+    mode   => 0440
+    group  => root
+    owner  => root
+    ensure => file

Logrotate::Conf[rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- Logrotate::Conf[rsyslog-release-deleted-inotify-watches].orig
+++ Logrotate::Conf[rsyslog-release-deleted-inotify-watches]

+    ensure => absent

File[/etc/calico]

Parameters differences:

--- File[/etc/calico].orig
+++ File[/etc/calico]

+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => directory

Exec[create chained cert /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]

+    subscribe => ['Exec[renew certificate - mlserve__amdgpu-node-labeller]', 'File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]', 'File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chained.pem | sha512sum)"

+    require   => Exec[Generate cert mlserve__amdgpu-node-labeller refresh on intermediate ca change]
+    command   => /bin/cat /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem > /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chained.pem

Systemd::Unit[rsyslog-release-deleted-inotify-watches.service]

Parameters differences:

--- Systemd::Unit[rsyslog-release-deleted-inotify-watches.service].orig
+++ Systemd::Unit[rsyslog-release-deleted-inotify-watches.service]

+    override_filename => puppet-override.conf
+    unit              => rsyslog-release-deleted-inotify-watches.service
+    restart           => False
+    override          => False
+    require           => ['Class[Systemd]']
+    ensure            => absent

File[/var/run/kubernetes]

Parameters differences:

--- File[/var/run/kubernetes].orig
+++ File[/var/run/kubernetes]

+    mode   => 0700
+    group  => root
+    owner  => root
+    ensure => directory

Cfssl::Csr[/etc/cfssl/csr/mlserve__kubelet_server.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/mlserve__kubelet_server.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/mlserve__kubelet_server.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => kubelet
+    names       => []
+    hosts       => ['ml-serve1015', 'ml-serve1015.eqiad.wmnet', '10.64.167.6', '2620:0:861:12f:10:64:167:6']
+    ensure      => present

File[/etc/kubernetes/pki/mlserve__system_kube-proxy.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_kube-proxy.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__system_kube-proxy.pem]

+    mode   => 0440
+    group  => root
+    owner  => kube
+    ensure => file

Exec[renew certificate - mlserve__amdgpu-node-labeller]

Parameters differences:

--- Exec[renew certificate - mlserve__amdgpu-node-labeller].orig
+++ Exec[renew certificate - mlserve__amdgpu-node-labeller]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem -checkend 952200
+    require     => Exec[Generate cert mlserve__amdgpu-node-labeller]
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__amdgpu-node-labeller

File[/etc/cfssl/csr/mlserve__calico-cni.csr]

Parameters differences:

--- File[/etc/cfssl/csr/mlserve__calico-cni.csr].orig
+++ File[/etc/cfssl/csr/mlserve__calico-cni.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/mlserve__calico-cni.csr.orig
+++ /etc/cfssl/csr/mlserve__calico-cni.csr
@@ -0,0 +1,13 @@
+{
+  "CN": "calico-cni",
+  "hosts": [
+    "calico-cni"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+
+  ]
+}

File[/etc/rsyslog.d/20-shellbox.conf]

Parameters differences:

--- File[/etc/rsyslog.d/20-shellbox.conf].orig
+++ File[/etc/rsyslog.d/20-shellbox.conf]

+    mode   => 0444
+    group  => root
+    source => puppet:///modules/profile/rsyslog/shellbox.rsyslog.conf
+    owner  => root
+    notify => Service[rsyslog]
+    ensure => present

Motd::Message[ml_k8s::worker]

Parameters differences:

--- Motd::Message[ml_k8s::worker].orig
+++ Motd::Message[ml_k8s::worker]

+    priority => 5
+    message  => ml-serve1015 is a ML Kubernetes worker node (ml_k8s::worker)
+    ensure   => present

Cfssl::Cert[discovery__ml-serve1015_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[discovery__ml-serve1015_eqiad_wmnet].orig
+++ Cfssl::Cert[discovery__ml-serve1015_eqiad_wmnet]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => ml-serve1015.eqiad.wmnet
+    outdir          => /etc/dragonfly
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    label           => discovery
+    names           => []
+    auto_renew      => True
+    provide_chain   => True
+    notify_services => ['dragonfly-dfdaemon']
+    renew_seconds   => 952200
+    owner           => dragonfly
+    group           => root
+    ensure          => present
+    before_services => []
+    hosts           => ['ml-serve1015', 'ml-serve1015.eqiad.wmnet', 'docker-registry.discovery.wmnet', '127.0.0.1', '::1', 'localhost']

Exec[Generate cert mlserve__amdgpu-node-labeller]

Parameters differences:

--- Exec[Generate cert mlserve__amdgpu-node-labeller].orig
+++ Exec[Generate cert mlserve__amdgpu-node-labeller]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/mlserve__amdgpu-node-labeller-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__amdgpu-node-labeller

File[/etc/rsyslog.d/00-imfile.conf]

Parameters differences:

--- File[/etc/rsyslog.d/00-imfile.conf].orig
+++ File[/etc/rsyslog.d/00-imfile.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Service[rsyslog]
+    ensure => present

Content differences:

--- /etc/rsyslog.d/00-imfile.conf.orig
+++ /etc/rsyslog.d/00-imfile.conf
@@ -0,0 +1 @@
+module(load="imfile")

File[/etc/kubernetes/kubelet.conf]

Parameters differences:

--- File[/etc/kubernetes/kubelet.conf].orig
+++ File[/etc/kubernetes/kubelet.conf]

+    mode   => 0400
+    group  => kube
+    owner  => kube
+    ensure => present

Content differences:

--- /etc/kubernetes/kubelet.conf.orig
+++ /etc/kubernetes/kubelet.conf
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: default-auth
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://ml-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: default-auth
+  user:
+    client-certificate: /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem
+    client-key: /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet-key.pem

File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]

Parameters differences:

--- File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem].orig
+++ File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]

+    mode   => 0440
+    group  => root
+    source => puppet:///modules/profile/pki/intermediates/discovery-cert.pem
+    owner  => dragonfly
+    ensure => file

File[/etc/systemd/system/kubelet.service.d]

Parameters differences:

--- File[/etc/systemd/system/kubelet.service.d].orig
+++ File[/etc/systemd/system/kubelet.service.d]

+    mode   => 0555
+    group  => root
+    owner  => root
+    ensure => directory

Service[rsyslog-imfile-remedy.timer]

Parameters differences:

--- Service[rsyslog-imfile-remedy.timer].orig
+++ Service[rsyslog-imfile-remedy.timer]

+    ensure   => running
+    enable   => True
+    provider => systemd

File[/etc/kubernetes/pki/mlserve__kubelet_server.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__kubelet_server.chained.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__kubelet_server.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]
+    group   => root
+    owner   => kube
+    ensure  => file

File[/etc/default/cpupower]

Parameters differences:

--- File[/etc/default/cpupower].orig
+++ File[/etc/default/cpupower]

+    require => Package[linux-cpupower]
+    owner   => root
+    group   => root

Content differences:

--- /etc/default/cpupower.orig
+++ /etc/default/cpupower
@@ -0,0 +1 @@
+GOVERNOR=performance

Motd::Message[ml_k8s::insetup_gpu]

Parameters differences:

--- Motd::Message[ml_k8s::insetup_gpu].orig
+++ Motd::Message[ml_k8s::insetup_gpu]

-    priority => 5
-    message  => ml-serve1015 is a Machine Learning GPU host in setup. (ml_k8s::insetup_gpu)
-    ensure   => present

Sysctl::Parameters[kube_proxy_icmp]

Parameters differences:

--- Sysctl::Parameters[kube_proxy_icmp].orig
+++ Sysctl::Parameters[kube_proxy_icmp]

+    priority => 75
+    ensure   => present
+    values   => {'net.ipv4.conf.all.send_redirects': 0, 'net.ipv4.conf.default.send_redirects': 0, 'net.ipv4.conf.ens11f1np1.send_redirects': 0}

Motd::Script[ml_k8s::insetup_gpu]

Parameters differences:

--- Motd::Script[ml_k8s::insetup_gpu].orig
+++ Motd::Script[ml_k8s::insetup_gpu]

-    priority => 5
-    ensure   => present

Sysctl::Parameters[ipv6-fowarding-accept-ra]

Parameters differences:

--- Sysctl::Parameters[ipv6-fowarding-accept-ra].orig
+++ Sysctl::Parameters[ipv6-fowarding-accept-ra]

+    priority => 70
+    ensure   => present
+    values   => {'net.ipv6.conf.all.forwarding': 1, 'net.ipv6.conf.ens11f1np1.accept_ra': 2}

Service[cpupower]

Parameters differences:

--- Service[cpupower].orig
+++ Service[cpupower]

+    ensure => running
+    enable => True

Firewall::Service[calico-typha]

Parameters differences:

--- Firewall::Service[calico-typha].orig
+++ Firewall::Service[calico-typha]

+    proto               => tcp
+    unrestricted_access => False
+    src_sets            => ['DOMAIN_NETWORKS']
+    prio                => 10
+    ensure              => present
+    port                => 5473
+    notrack             => False
+    desc                =>

Exec[Generate cert mlserve__kubelet_server refresh]

Parameters differences:

--- Exec[Generate cert mlserve__kubelet_server refresh].orig
+++ Exec[Generate cert mlserve__kubelet_server refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/mlserve__kubelet_server.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve -profile server /etc/cfssl/csr/mlserve__kubelet_server.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__kubelet_server

+    notify      => ['Service[kubelet]']
+    refreshonly => True

Package[socat]

Parameters differences:

--- Package[socat].orig
+++ Package[socat]

+    ensure   => installed
+    provider => apt

K8s::Kubeconfig[/etc/kubernetes/proxy.conf]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/proxy.conf].orig
+++ K8s::Kubeconfig[/etc/kubernetes/proxy.conf]

+    username    => default-proxy
+    mode        => 0400
+    group       => kube
+    require     => ['Class[K8s::Base_dirs]']
+    ensure      => present
+    auth_cert   => {'cert': '/etc/kubernetes/pki/mlserve__system_kube-proxy.pem', 'key': '/etc/kubernetes/pki/mlserve__system_kube-proxy-key.pem', 'chain': '/etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem', 'chained': '/etc/kubernetes/pki/mlserve__system_kube-proxy.chained.pem'}
+    master_host => ml-ctrl.svc.eqiad.wmnet
+    owner       => kube

Rsyslog::Conf[input-file-kubernetes-json]

Parameters differences:

--- Rsyslog::Conf[input-file-kubernetes-json].orig
+++ Rsyslog::Conf[input-file-kubernetes-json]

+    require  => Rsyslog::Conf[imfile]
+    priority => 8
+    mode     => 0444
+    ensure   => present

Systemd::Unit[cpupower]

Parameters differences:

--- Systemd::Unit[cpupower].orig
+++ Systemd::Unit[cpupower]

+    override_filename => puppet-override.conf
+    unit              => cpupower
+    restart           => True
+    override          => False
+    require           => ['Class[Systemd]']
+    ensure            => present

File[/etc/cfssl/csr/mlserve__istio-cni.csr]

Parameters differences:

--- File[/etc/cfssl/csr/mlserve__istio-cni.csr].orig
+++ File[/etc/cfssl/csr/mlserve__istio-cni.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/mlserve__istio-cni.csr.orig
+++ /etc/cfssl/csr/mlserve__istio-cni.csr
@@ -0,0 +1,13 @@
+{
+  "CN": "istio-cni",
+  "hosts": [
+    "istio-cni"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+
+  ]
+}

File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog-key.pem].orig
+++ File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => root
+    owner     => root
+    show_diff => False
+    ensure    => file

File[/etc/rsyslog.d/10-kubernetes-node-filters.conf]

Parameters differences:

--- File[/etc/rsyslog.d/10-kubernetes-node-filters.conf].orig
+++ File[/etc/rsyslog.d/10-kubernetes-node-filters.conf]

+    mode   => 0444
+    group  => root
+    source => puppet:///modules/profile/kubernetes/node/kubernetes-node-filters.rsyslog.conf
+    owner  => root
+    notify => Service[rsyslog]
+    ensure => present

Class[Lvs::Realserver]

Parameters differences:

--- Class[Lvs::Realserver].orig
+++ Class[Lvs::Realserver]

+    realserver_ips => ['10.2.2.63', '10.2.2.84']

File[/etc/rsyslog.d/08-input-file-kubernetes-json.conf]

Parameters differences:

--- File[/etc/rsyslog.d/08-input-file-kubernetes-json.conf].orig
+++ File[/etc/rsyslog.d/08-input-file-kubernetes-json.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Service[rsyslog]
+    ensure => present

Content differences:

--- /etc/rsyslog.d/08-input-file-kubernetes-json.conf.orig
+++ /etc/rsyslog.d/08-input-file-kubernetes-json.conf
@@ -0,0 +1,8 @@
+# This file managed by puppet rsyslog::input::file
+
+input(type="imfile"
+      File="/var/log/containers/*.log"
+      reopenOnTruncate="on"
+      addMetadata="on"
+      addCeeTag="on"
+      Tag="input-file-kubernetes")

File[/etc/systemd/system/kube-proxy.service.d]

Parameters differences:

--- File[/etc/systemd/system/kube-proxy.service.d].orig
+++ File[/etc/systemd/system/kube-proxy.service.d]

+    mode   => 0555
+    group  => root
+    owner  => root
+    ensure => directory

Class[K8s::Proxy]

Parameters differences:

--- Class[K8s::Proxy].orig
+++ Class[K8s::Proxy]

+    kubeconfig    => /etc/kubernetes/proxy.conf
+    version       => 1.31
+    cluster_cidr  => {'v4': '10.67.16.0/21', 'v6': '2620:0:861:300::/64'}
+    proxy_mode    => iptables
+    v_log_level   => 0
+    ipv6dualstack => False

File[/etc/kubernetes/pki/mlserve__system_kube-proxy-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_kube-proxy-key.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__system_kube-proxy-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => root
+    owner     => kube
+    show_diff => False
+    ensure    => file

Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh].orig
+++ Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label discovery  /etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet

+    notify      => ['Service[dragonfly-dfdaemon]']
+    refreshonly => True

Rsyslog::Input::File[kubernetes-json]

Parameters differences:

--- Rsyslog::Input::File[kubernetes-json].orig
+++ Rsyslog::Input::File[kubernetes-json]

+    reopen_on_truncate => on
+    priority           => 8
+    ensure             => present
+    syslog_tag_prefix  => input-file
+    path               => /var/log/containers/*.log
+    addmetadata        => on
+    addceetag          => on
+    syslog_tag         => kubernetes

Exec[apt_pin_apt_pin_firmware-amd-graphics-trixie-bpo_trixie-bpo]

Parameters differences:

--- Exec[apt_pin_apt_pin_firmware-amd-graphics-trixie-bpo_trixie-bpo].orig
+++ Exec[apt_pin_apt_pin_firmware-amd-graphics-trixie-bpo_trixie-bpo]

+    command     => /usr/bin/apt-get update
+    refreshonly => True

Class[Profile::Apt]

Parameters differences:

--- Class[Profile::Apt].orig
+++ Class[Profile::Apt]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[atop]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[rocm-smi]', 'Package[python3-requests]', 'Package[firmware-amd-graphics]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[atop]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[dragonfly-dfdaemon]', 'Package[dragonfly-dfget]', 'Package[crictl]', 'Package[containerd]', 'Package[nerdctl]', 'Package[rsyslog-kubernetes]', 'Package[linux-cpupower]', 'Package[apparmor]', 'Package[socat]', 'Package[amd-k8s-device-plugin]', 'Package[amd-k8s-node-labeller]', 'Package[rocm-smi]', 'Package[python3-requests]', 'Package[wikimedia-lvs-realserver]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[linux-image-6.16.3+deb13-amd64]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[kubernetes-node]', 'Package[calicoctl]', 'Package[calico-cni]', 'Package[istio-cni]', 'Package[firmware-amd-graphics]']

File[/etc/systemd/system/amd-k8s-node-labeller.service.d/amd-devplugin-after-labeller.conf]

Parameters differences:

--- File[/etc/systemd/system/amd-k8s-node-labeller.service.d/amd-devplugin-after-labeller.conf].orig
+++ File[/etc/systemd/system/amd-k8s-node-labeller.service.d/amd-devplugin-after-labeller.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[systemd daemon-reload for amd-k8s-node-labeller.service (amd-k8s-node-labeller-amd-devplugin-after-labeller)]
+    ensure => present

Content differences:

--- /etc/systemd/system/amd-k8s-node-labeller.service.d/amd-devplugin-after-labeller.conf.orig
+++ /etc/systemd/system/amd-k8s-node-labeller.service.d/amd-devplugin-after-labeller.conf
@@ -0,0 +1,3 @@
+[Unit]
+After=amd-k8s-device-plugin.service
+Requires=amd-k8s-device-plugin.service

File[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]

Parameters differences:

--- File[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.list].orig
+++ File[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]

+    ensure => absent
+    owner  => root
+    group  => root

Exec[systemd daemon-reload for rsyslog-imfile-remedy.timer (rsyslog-imfile-remedy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for rsyslog-imfile-remedy.timer (rsyslog-imfile-remedy.timer)].orig
+++ Exec[systemd daemon-reload for rsyslog-imfile-remedy.timer (rsyslog-imfile-remedy.timer)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True
+    before      => ['Service[rsyslog-imfile-remedy.timer]']

File[/etc/dragonfly/dfget.yml]

Parameters differences:

--- File[/etc/dragonfly/dfget.yml].orig
+++ File[/etc/dragonfly/dfget.yml]

+    mode   => 0644
+    group  => root
+    owner  => root
+    notify => Service[dragonfly-dfdaemon]
+    ensure => file

Content differences:

--- /etc/dragonfly/dfget.yml.orig
+++ /etc/dragonfly/dfget.yml
@@ -0,0 +1,5 @@
+# List of supernodes in the format
+# host:port(default:8002)=weight(default:1)
+# FIXME: Figure out how weight is exactly handled, could we use multiple supernodes without split brain?
+nodes:
+  - dragonfly-supernode1001.eqiad.wmnet:8002=1

Exec[renew certificate - mlserve__system_node_ml-serve1015_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - mlserve__system_node_ml-serve1015_eqiad_wmnet].orig
+++ Exec[renew certificate - mlserve__system_node_ml-serve1015_eqiad_wmnet]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem -checkend 952200
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet

+    notify      => ['Service[kubelet]']
+    require     => Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet]

Exec[systemd daemon-reload for amd-k8s-node-labeller.service (amd-k8s-node-labeller-amd-devplugin-after-labeller)]

Parameters differences:

--- Exec[systemd daemon-reload for amd-k8s-node-labeller.service (amd-k8s-node-labeller-amd-devplugin-after-labeller)].orig
+++ Exec[systemd daemon-reload for amd-k8s-node-labeller.service (amd-k8s-node-labeller-amd-devplugin-after-labeller)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

K8s::Kubeconfig[/etc/calico/calicoctl-kubeconfig]

Parameters differences:

--- K8s::Kubeconfig[/etc/calico/calicoctl-kubeconfig].orig
+++ K8s::Kubeconfig[/etc/calico/calicoctl-kubeconfig]

+    username    => calicoctl
+    mode        => 0400
+    group       => root
+    require     => ['Class[K8s::Base_dirs]']
+    ensure      => present
+    auth_cert   => {'cert': '/etc/kubernetes/pki/mlserve__calicoctl.pem', 'key': '/etc/kubernetes/pki/mlserve__calicoctl-key.pem', 'chain': '/etc/kubernetes/pki/mlserve__calicoctl.chain.pem', 'chained': '/etc/kubernetes/pki/mlserve__calicoctl.chained.pem'}
+    master_host => ml-ctrl.svc.eqiad.wmnet
+    owner       => root

Ferm::Service[kubelet-http]

Parameters differences:

--- Ferm::Service[kubelet-http].orig
+++ Ferm::Service[kubelet-http]

+    proto               => tcp
+    unrestricted_access => False
+    prio                => 10
+    ensure              => present
+    srange              => (@resolve((ml-serve-ctrl1001.eqiad.wmnet ml-serve-ctrl1002.eqiad.wmnet)) @resolve((ml-serve-ctrl1001.eqiad.wmnet ml-serve-ctrl1002.eqiad.wmnet), AAAA))
+    port                => 10250
+    notrack             => False
+    desc                =>

File[/etc/calico/calicoctl-kubeconfig]

Parameters differences:

--- File[/etc/calico/calicoctl-kubeconfig].orig
+++ File[/etc/calico/calicoctl-kubeconfig]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => present

Content differences:

--- /etc/calico/calicoctl-kubeconfig.orig
+++ /etc/calico/calicoctl-kubeconfig
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: calicoctl
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://ml-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: calicoctl
+  user:
+    client-certificate: /etc/kubernetes/pki/mlserve__calicoctl.pem
+    client-key: /etc/kubernetes/pki/mlserve__calicoctl-key.pem

Exec[Generate cert mlserve__calico-cni]

Parameters differences:

--- Exec[Generate cert mlserve__calico-cni].orig
+++ Exec[Generate cert mlserve__calico-cni]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__calico-cni.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/mlserve__calico-cni-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/mlserve__calico-cni.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__calico-cni.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__calico-cni

K8s::Kubelet::Cni[calico]

Parameters differences:

--- K8s::Kubelet::Cni[calico].orig
+++ K8s::Kubelet::Cni[calico]

+    config   => {'name': 'k8s-pod-network', 'cniVersion': '0.3.1', 'plugins': [{'type': 'calico', 'log_level': 'info', 'datastore_type': 'kubernetes', 'mtu': 1460, 'ipam': {'type': 'calico-ipam', 'assign_ipv4': 'true', 'assign_ipv6': 'true'}, 'policy': {'type': 'k8s'}, 'kubernetes': {'kubeconfig': '/etc/cni/net.d/calico-kubeconfig'}}, {'name': 'istio-cni', 'type': 'istio-cni', 'log_level': 'info', 'kubernetes': {'kubeconfig': '/etc/cni/net.d/istio-kubeconfig', 'cni_bin_dir': '/opt/cni/bin', 'exclude_namespaces': ['istio-system', 'kube-system', 'knative-serving', 'cert-manager', 'kserve']}}]}
+    priority => 10
+    require  => ['Class[K8s::Kubelet::Cni::Base]']

Exec[create chained cert /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem].orig
+++ Exec[create chained cert /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]

+    subscribe => ['Exec[renew certificate - discovery__ml-serve1015_eqiad_wmnet]', 'File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]', 'File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem | sha512sum)" == "$(/bin/cat /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem > /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem
+    notify    => ['Service[dragonfly-dfdaemon]']
+    require   => Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh on intermediate ca change]

File[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr]

Parameters differences:

--- File[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr].orig
+++ File[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr.orig
+++ /etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr
@@ -0,0 +1,13 @@
+{
+  "CN": "amdgpu-node-labeller",
+  "hosts": [
+    "amdgpu-node-labeller"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+
+  ]
+}

Sysctl::Conffile[kube_proxy_icmp]

Parameters differences:

--- Sysctl::Conffile[kube_proxy_icmp].orig
+++ Sysctl::Conffile[kube_proxy_icmp]

+    priority => 75
+    ensure   => present

File[/etc/kubernetes/kube-proxy-config.yaml]

Parameters differences:

--- File[/etc/kubernetes/kube-proxy-config.yaml].orig
+++ File[/etc/kubernetes/kube-proxy-config.yaml]

+    mode    => 0400
+    group   => kube
+    owner   => kube
+    notify  => Service[kube-proxy]
+    require => K8s::Package[proxy]
+    ensure  => file

Content differences:

--- /etc/kubernetes/kube-proxy-config.yaml.orig
+++ /etc/kubernetes/kube-proxy-config.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+hostnameOverride: ml-serve1015.eqiad.wmnet
+clientConnection:
+  kubeconfig: "/etc/kubernetes/proxy.conf"
+clusterCIDR: 10.67.16.0/21
+mode: iptables
+metricsBindAddress: 0.0.0.0
+nodePortAddresses:
+- 0.0.0.0/0
+- "::/0"

Package[firmware-amd-graphics]

Parameters differences:

--- Package[firmware-amd-graphics].orig
+++ Package[firmware-amd-graphics]

@@
-    ensure => installed
+    ensure => 20251021-1~bpo13+1

File[/etc/default/wikimedia-lvs-realserver]

Parameters differences:

--- File[/etc/default/wikimedia-lvs-realserver].orig
+++ File[/etc/default/wikimedia-lvs-realserver]

+    mode   => 0444
+    group  => root
+    owner  => root
+    ensure => present

Content differences:

--- /etc/default/wikimedia-lvs-realserver.orig
+++ /etc/default/wikimedia-lvs-realserver
@@ -0,0 +1,10 @@
+# This file is managed by puppet!
+
+
+
+# Location of the sysctl file containing LVS ARP settings
+SYSCTLFILE=/usr/share/wikimedia-lvs-realserver/sysctl.conf
+
+# LVS service IPs to be bound to the loopback interface,
+# separate using spaces
+LVS_SERVICE_IPS="10.2.2.63 10.2.2.84"

File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet-key.pem].orig
+++ File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => root
+    owner     => dragonfly
+    show_diff => False
+    ensure    => file

File[/etc/kubernetes/pki/mlserve__calico-cni.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calico-cni.chained.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__calico-cni.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/mlserve__calico-cni.chain.pem]
+    group   => root
+    owner   => root
+    ensure  => file

Exec[create chained cert /etc/kubernetes/pki/mlserve__calicoctl.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/mlserve__calicoctl.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/mlserve__calicoctl.chain.pem]

+    subscribe => ['Exec[renew certificate - mlserve__calicoctl]', 'File[/etc/kubernetes/pki/mlserve__calicoctl.chain.pem]', 'File[/etc/kubernetes/pki/mlserve__calicoctl.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/mlserve__calicoctl.pem /etc/kubernetes/pki/mlserve__calicoctl.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/mlserve__calicoctl.chained.pem | sha512sum)"

+    require   => Exec[Generate cert mlserve__calicoctl refresh on intermediate ca change]
+    command   => /bin/cat /etc/kubernetes/pki/mlserve__calicoctl.pem /etc/kubernetes/pki/mlserve__calicoctl.chain.pem > /etc/kubernetes/pki/mlserve__calicoctl.chained.pem

Kmod::Module[overlay]

Parameters differences:

--- Kmod::Module[overlay].orig
+++ Kmod::Module[overlay]

+    ensure => present

Package[linux-cpupower]

Parameters differences:

--- Package[linux-cpupower].orig
+++ Package[linux-cpupower]

+    ensure   => installed
+    provider => apt

Systemd::Service[cpupower]

Parameters differences:

--- Systemd::Service[cpupower].orig
+++ Systemd::Service[cpupower]

+    migration_task           => T407130
+    monitoring_enabled       => False
+    restart                  => True
+    override                 => False
+    service_params           => {}
+    ensure                   => present
+    monitoring_critical      => False
+    monitoring_contact_group => admins
+    unit_type                => service

Systemd::Timer::Job[rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- Systemd::Timer::Job[rsyslog-release-deleted-inotify-watches].orig
+++ Systemd::Timer::Job[rsyslog-release-deleted-inotify-watches]

+    environment               => {}
+    logfile_basedir           => /var/log
+    logging_enabled           => True
+    description               => Restart rsyslog to release inotify watches of deleted container logs
+    syslog_force_stop         => True
+    logfile_perms             => all
+    private_tmp               => False
+    logfile_group             => root
+    send_mail_only_on_error   => True
+    success_exit_status       => []
+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* *:54:00'}
+    user                      => root
+    ignore_errors             => False
+    command                   => /usr/local/sbin/rsyslog-release-deleted-inotify-watches
+    logfile_name              => syslog.log
+    monitoring_enabled        => False
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    ensure                    => absent
+    send_mail_to              => root@ml-serve1015.eqiad.wmnet
+    syslog_match_startswith   => True
+    send_mail                 => False
+    fixed_random_delay        => False
+    monitoring_contact_groups => admins

Systemd::Timer[rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- Systemd::Timer[rsyslog-release-deleted-inotify-watches].orig
+++ Systemd::Timer[rsyslog-release-deleted-inotify-watches]

+    unit_name          => rsyslog-release-deleted-inotify-watches.service
+    accuracy           => 15sec
+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* *:54:00'}]
+    fixed_random_delay => False
+    splay              => 0
+    ensure             => absent

File[/etc/kubernetes/pki/mlserve__calicoctl.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calicoctl.chained.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__calicoctl.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/mlserve__calicoctl.chain.pem]
+    group   => root
+    owner   => root
+    ensure  => file

File[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]

Parameters differences:

--- File[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.list].orig
+++ File[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]

+    ensure => absent
+    owner  => root
+    group  => root

File[/etc/sysctl.d/70-ipv6-fowarding-accept-ra.conf]

Parameters differences:

--- File[/etc/sysctl.d/70-ipv6-fowarding-accept-ra.conf].orig
+++ File[/etc/sysctl.d/70-ipv6-fowarding-accept-ra.conf]

+    notify => Exec[update_sysctl]
+    group  => root
+    owner  => root
+    ensure => present

Content differences:

--- /etc/sysctl.d/70-ipv6-fowarding-accept-ra.conf.orig
+++ /etc/sysctl.d/70-ipv6-fowarding-accept-ra.conf
@@ -0,0 +1,3 @@
+# sysctl parameters managed by Puppet.
+net.ipv6.conf.all.forwarding = 1
+net.ipv6.conf.ens11f1np1.accept_ra = 2

File[/etc/kubernetes/pki/mlserve__istio-cni.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__istio-cni.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__istio-cni.pem]

+    mode   => 0440
+    group  => root
+    owner  => root
+    ensure => file

Exec[systemd daemon-reload for kube-proxy.service (kube-proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for kube-proxy.service (kube-proxy)].orig
+++ Exec[systemd daemon-reload for kube-proxy.service (kube-proxy)]

+    notify      => ['Service[kube-proxy]']
+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

Concat_fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Concat_fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Concat_fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    tag    => _etc_apt_sources.list.d_component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    target => /etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 10

Content differences:

--- component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.orig
+++ component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia
@@ -0,0 +1,5 @@
+Types: deb deb-src
+URIs: http://apt.wikimedia.org/wikimedia
+Suites: trixie-wikimedia
+Components: component/istio115
+Signed-By: /etc/apt/keyrings/wikimedia-archive-keyring.gpg

Package[apparmor]

Parameters differences:

--- Package[apparmor].orig
+++ Package[apparmor]

+    ensure   => installed
+    provider => apt

Sysctl::Parameters[kube_proxy_conntrack]

Parameters differences:

--- Sysctl::Parameters[kube_proxy_conntrack].orig
+++ Sysctl::Parameters[kube_proxy_conntrack]

+    ensure   => present
+    module   => nf_conntrack
+    priority => 75
+    values   => {'net.netfilter.nf_conntrack_max': 1048576}

Package[kubernetes-node]

Parameters differences:

--- Package[kubernetes-node].orig
+++ Package[kubernetes-node]

+    require  => Apt::Package_from_component[kubernetes131]
+    ensure   => >=1.31 <1.32
+    provider => apt

Concat[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

Parameters differences:

--- Concat[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources].orig
+++ Concat[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

+    backup         => puppet
+    mode           => 0444
+    group          => root
+    order          => alpha
+    warn           => False
+    ensure_newline => False
+    ensure         => present
+    force          => False
+    show_diff      => True
+    replace        => True
+    path           => /etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    format         => plain
+    notify         => Exec[apt_repository_component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]
+    owner          => root

Class[Profile::Calico::Kubernetes]

Parameters differences:

--- Class[Profile::Calico::Kubernetes].orig
+++ Class[Profile::Calico::Kubernetes]

+    kubernetes_cluster_name => ml-serve-eqiad

File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem]

Parameters differences:

--- File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem].orig
+++ File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem]

+    require => Exec[create chained cert /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]
+    group   => root
+    owner   => dragonfly
+    ensure  => file

Group[kube]

Parameters differences:

--- Group[kube].orig
+++ Group[kube]

+    system => True
+    ensure => present

Package[dragonfly-dfget]

Parameters differences:

--- Package[dragonfly-dfget].orig
+++ Package[dragonfly-dfget]

+    ensure   => installed
+    provider => apt

Class[Profile::Base::Production]

Parameters differences:

--- Class[Profile::Base::Production].orig
+++ Class[Profile::Base::Production]

@@
-    role_description => Machine Learning GPU host in setup.
+    role_description => ML Kubernetes worker node

File[/etc/apparmor.d/abstractions]

Parameters differences:

--- File[/etc/apparmor.d/abstractions].orig
+++ File[/etc/apparmor.d/abstractions]

+    mode    => 0755
+    group   => root
+    owner   => root
+    require => Package[apparmor]
+    ensure  => directory

Package[dragonfly-dfdaemon]

Parameters differences:

--- Package[dragonfly-dfdaemon].orig
+++ Package[dragonfly-dfdaemon]

+    ensure   => installed
+    provider => apt

File[/etc/cni/net.d/istio-kubeconfig]

Parameters differences:

--- File[/etc/cni/net.d/istio-kubeconfig].orig
+++ File[/etc/cni/net.d/istio-kubeconfig]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => present

Content differences:

--- /etc/cni/net.d/istio-kubeconfig.orig
+++ /etc/cni/net.d/istio-kubeconfig
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: istio-cni
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://ml-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: istio-cni
+  user:
+    client-certificate: /etc/kubernetes/pki/mlserve__istio-cni.pem
+    client-key: /etc/kubernetes/pki/mlserve__istio-cni-key.pem

File[/etc/default/kubelet]

Parameters differences:

--- File[/etc/default/kubelet].orig
+++ File[/etc/default/kubelet]

+    mode   => 0644
+    group  => root
+    owner  => root
+    notify => Service[kubelet]
+    ensure => file

Content differences:

--- /etc/default/kubelet.orig
+++ /etc/default/kubelet
@@ -0,0 +1,11 @@
+###
+# kubernetes kubelet (minion) config
+
+DAEMON_ARGS="--config=/etc/kubernetes/kubelet-config.yaml \
+ --hostname-override=ml-serve1015.eqiad.wmnet \
+ --kubeconfig=/etc/kubernetes/kubelet.conf \
+ --node-ip=10.64.167.6 \
+ --node-labels=node.kubernetes.io/disk-type=ssd,topology.kubernetes.io/region=eqiad,topology.kubernetes.io/zone=row-e12 \
+ --register-schedulable=false \
+ --system-reserved=cpu=45.3,memory=50.83Gi \
+ --v=0"

Exec[apt_repository_component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Exec[apt_repository_component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Exec[apt_repository_component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    command     => /usr/bin/apt-get update 
+    refreshonly => True

Systemd::Unit[kubelet-container-runtime]

Parameters differences:

--- Systemd::Unit[kubelet-container-runtime].orig
+++ Systemd::Unit[kubelet-container-runtime]

+    override_filename => container-runtime
+    unit              => kubelet
+    restart           => True
+    override          => True
+    require           => ['Class[Systemd]']
+    ensure            => present

Exec[exec-apt-get-update-firmware-amd-graphics-trixie-bpo_trixie-bpo]

Parameters differences:

--- Exec[exec-apt-get-update-firmware-amd-graphics-trixie-bpo_trixie-bpo].orig
+++ Exec[exec-apt-get-update-firmware-amd-graphics-trixie-bpo_trixie-bpo]

+    command     => /usr/bin/apt-get update
+    refreshonly => True

Cfssl::Csr[/etc/cfssl/csr/mlserve__rsyslog.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/mlserve__rsyslog.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/mlserve__rsyslog.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => rsyslog
+    names       => [{'organisation': 'view'}]
+    hosts       => []
+    ensure      => present

Exec[apt_package_from_component_calico329]

Parameters differences:

--- Exec[apt_package_from_component_calico329].orig
+++ Exec[apt_package_from_component_calico329]

+    subscribe   => Apt::Repository[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]
+    command     => /usr/bin/apt-get update
+    refreshonly => True
+    before      => ['Package[calicoctl]', 'Package[calico-cni]']

File[/etc/modprobe.d/blacklist-wmf_overlay.conf]

Parameters differences:

--- File[/etc/modprobe.d/blacklist-wmf_overlay.conf].orig
+++ File[/etc/modprobe.d/blacklist-wmf_overlay.conf]

@@
-    ensure => present
+    ensure => absent

Content differences:

--- /etc/modprobe.d/blacklist-wmf_overlay.conf.orig
+++ /etc/modprobe.d/blacklist-wmf_overlay.conf
@@ -1,7 +1,3 @@
 # wmf_overlay - blacklisted kernel modules
 # This file is managed by Puppet
 #
-blacklist overlay
-install overlay /bin/true
-blacklist overlayfs
-install overlayfs /bin/true

File[/etc/amd/node-labeller-kubeconfig]

Parameters differences:

--- File[/etc/amd/node-labeller-kubeconfig].orig
+++ File[/etc/amd/node-labeller-kubeconfig]

+    mode   => 0400
+    group  => amd-nodelabeller
+    owner  => amd-nodelabeller
+    ensure => present

Content differences:

--- /etc/amd/node-labeller-kubeconfig.orig
+++ /etc/amd/node-labeller-kubeconfig
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: amdgpu-node-labeller
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://ml-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: amdgpu-node-labeller
+  user:
+    client-certificate: /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.pem
+    client-key: /etc/kubernetes/pki/mlserve__amdgpu-node-labeller-key.pem

Exec[Generate cert mlserve__istio-cni]

Parameters differences:

--- Exec[Generate cert mlserve__istio-cni].orig
+++ Exec[Generate cert mlserve__istio-cni]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__istio-cni.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/mlserve__istio-cni-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/mlserve__istio-cni.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__istio-cni.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__istio-cni

Cfssl::Cert[mlserve__system_node_ml-serve1015_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[mlserve__system_node_ml-serve1015_eqiad_wmnet].orig
+++ Cfssl::Cert[mlserve__system_node_ml-serve1015_eqiad_wmnet]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => system:node:ml-serve1015.eqiad.wmnet
+    outdir          => /etc/kubernetes/pki
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    label           => mlserve
+    names           => [{'organisation': 'system:nodes'}]
+    auto_renew      => True
+    provide_chain   => True
+    notify_services => ['kubelet']
+    renew_seconds   => 952200
+    owner           => kube
+    group           => root
+    ensure          => present
+    before_services => []
+    hosts           => []

Exec[create chained cert /etc/kubernetes/pki/mlserve__istio-cni.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/mlserve__istio-cni.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/mlserve__istio-cni.chain.pem]

+    subscribe => ['Exec[renew certificate - mlserve__istio-cni]', 'File[/etc/kubernetes/pki/mlserve__istio-cni.chain.pem]', 'File[/etc/kubernetes/pki/mlserve__istio-cni.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/mlserve__istio-cni.pem /etc/kubernetes/pki/mlserve__istio-cni.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/mlserve__istio-cni.chained.pem | sha512sum)"

+    require   => Exec[Generate cert mlserve__istio-cni refresh on intermediate ca change]
+    command   => /bin/cat /etc/kubernetes/pki/mlserve__istio-cni.pem /etc/kubernetes/pki/mlserve__istio-cni.chain.pem > /etc/kubernetes/pki/mlserve__istio-cni.chained.pem

Exec[/sbin/modprobe overlay]

Parameters differences:

--- Exec[/sbin/modprobe overlay].orig
+++ Exec[/sbin/modprobe overlay]

+    unless      => /bin/lsmod | /bin/grep -q '^overlay '
+    refreshonly => True

File[/etc/ferm/conf.d/10_dragonfly_dfget]

Parameters differences:

--- File[/etc/ferm/conf.d/10_dragonfly_dfget].orig
+++ File[/etc/ferm/conf.d/10_dragonfly_dfget]

+    mode    => 0400
+    group   => root
+    owner   => root
+    tag     => ferm
+    notify  => Service[ferm]
+    require => File[/etc/ferm/conf.d]
+    ensure  => present

Content differences:

--- /etc/ferm/conf.d/10_dragonfly_dfget.orig
+++ /etc/ferm/conf.d/10_dragonfly_dfget
@@ -0,0 +1,6 @@
+# Autogenerated by puppet. DO NOT EDIT BY HAND!
+#
+# 
+&R_SERVICE(tcp, 15001, $DOMAIN_NETWORKS);
+
+

Sysctl::Conffile[ipv6-fowarding-accept-ra]

Parameters differences:

--- Sysctl::Conffile[ipv6-fowarding-accept-ra].orig
+++ Sysctl::Conffile[ipv6-fowarding-accept-ra]

+    priority => 70
+    ensure   => present

File[/etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__kubelet_server.chain.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]

+    mode   => 0440
+    group  => root
+    source => puppet:///modules/profile/pki/intermediates/mlserve-cert.pem
+    owner  => kube
+    ensure => file

Concat_fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Concat_fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Concat_fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    tag    => _etc_apt_sources.list.d_component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    target => /etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 10

Content differences:

--- component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.orig
+++ component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia
@@ -0,0 +1,5 @@
+Types: deb deb-src
+URIs: http://apt.wikimedia.org/wikimedia
+Suites: trixie-wikimedia
+Components: component/calico329
+Signed-By: /etc/apt/keyrings/wikimedia-archive-keyring.gpg

File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chained.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chained.pem].orig
+++ File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chained.pem]

+    require => Exec[create chained cert /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]
+    group   => root
+    owner   => root
+    ensure  => file

Cfssl::Csr[/etc/cfssl/csr/mlserve__istio-cni.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/mlserve__istio-cni.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/mlserve__istio-cni.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => istio-cni
+    names       => []
+    hosts       => []
+    ensure      => present

Apt::Package_from_component[istio115]

Parameters differences:

--- Apt::Package_from_component[istio115].orig
+++ Apt::Package_from_component[istio115]

+    packages        => {'istio-cni': 'present'}
+    distro          => trixie-wikimedia
+    uri             => http://apt.wikimedia.org/wikimedia
+    ensure_packages => True
+    priority        => 1001
+    component       => component/istio115
+    ensure          => present

File[/etc/kubernetes/pki/mlserve__istio-cni-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__istio-cni-key.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__istio-cni-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => root
+    owner     => root
+    show_diff => False
+    ensure    => file

Exec[renew certificate - discovery__ml-serve1015_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - discovery__ml-serve1015_eqiad_wmnet].orig
+++ Exec[renew certificate - discovery__ml-serve1015_eqiad_wmnet]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem -checkend 952200
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label discovery  /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet

+    notify      => ['Service[dragonfly-dfdaemon]']
+    require     => Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet]

File[/var/lib/kubelet/config.json]

Parameters differences:

--- File[/var/lib/kubelet/config.json].orig
+++ File[/var/lib/kubelet/config.json]

+    mode      => 0440
+    group     => root
+    owner     => root
+    show_diff => False
+    ensure    => present

Content differences:

--- /var/lib/kubelet/config.json.orig
+++ /var/lib/kubelet/config.json
@@ -0,0 +1,7 @@
+{
+  "auths": {
+    "https://docker-registry.discovery.wmnet": {
+      "auth": "a3ViZXJuZXRlczpzb21lcGFzc3dvcmQy"
+    }
+  }
+}

K8s::Package[proxy]

Parameters differences:

--- K8s::Package[proxy].orig
+++ K8s::Package[proxy]

+    require         => ['Class[K8s::Base_dirs]']
+    version         => 1.31
+    distro          => trixie-wikimedia
+    uri             => http://apt.wikimedia.org/wikimedia
+    package         => node
+    priority        => 1001
+    ensure_packages => True

File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.csr].orig
+++ File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.csr]

+    mode   => 0440
+    group  => amd-nodelabeller
+    owner  => amd-nodelabeller
+    ensure => file

File[/etc/modules-load.d/overlay.conf]

Parameters differences:

--- File[/etc/modules-load.d/overlay.conf].orig
+++ File[/etc/modules-load.d/overlay.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[/sbin/modprobe overlay]
+    ensure => present

Content differences:

--- /etc/modules-load.d/overlay.conf.orig
+++ /etc/modules-load.d/overlay.conf
@@ -0,0 +1 @@
+overlay

File[/etc/rsyslog.d/09-kubernetes.conf]

Parameters differences:

--- File[/etc/rsyslog.d/09-kubernetes.conf].orig
+++ File[/etc/rsyslog.d/09-kubernetes.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Service[rsyslog]
+    ensure => present

Content differences:

--- /etc/rsyslog.d/09-kubernetes.conf.orig
+++ /etc/rsyslog.d/09-kubernetes.conf
@@ -0,0 +1,9 @@
+module(load="mmkubernetes"
+        KubernetesURL="https://ml-ctrl.svc.eqiad.wmnet:6443"
+        tls.mycert="/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem"
+        tls.myprivkey="/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog-key.pem")
+action(type="mmkubernetes"
+       name="mmkubernetes"
+       action.resumeRetryCount="-1"
+       action.resumeIntervalMax="300"
+       action.reportSuspensionContinuation="on")

Exec[Generate cert mlserve__calico-cni refresh]

Parameters differences:

--- Exec[Generate cert mlserve__calico-cni refresh].orig
+++ Exec[Generate cert mlserve__calico-cni refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/mlserve__calico-cni.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__calico-cni.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__calico-cni

+    refreshonly => True

Exec[apt_pin_apt_pin_linux-6.16-trixie_trixie-bpo]

Parameters differences:

--- Exec[apt_pin_apt_pin_linux-6.16-trixie_trixie-bpo].orig
+++ Exec[apt_pin_apt_pin_linux-6.16-trixie_trixie-bpo]

+    command     => /usr/bin/apt-get update
+    refreshonly => True

Exec[Generate cert mlserve__istio-cni refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert mlserve__istio-cni refresh on intermediate ca change].orig
+++ Exec[Generate cert mlserve__istio-cni refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/kubernetes/pki/mlserve__istio-cni.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__istio-cni.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__istio-cni

+    refreshonly => True

Cfssl::Csr[/etc/cfssl/csr/mlserve__calicoctl.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/mlserve__calicoctl.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/mlserve__calicoctl.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => calicoctl
+    names       => []
+    hosts       => []
+    ensure      => present

Class[Profile::Kubernetes::Node]

Parameters differences:

--- Class[Profile::Kubernetes::Node].orig
+++ Class[Profile::Kubernetes::Node]

+    feature_flags                   => {}
+    kubernetes_cluster_name         => ml-serve-eqiad
+    kubelet_node_labels             => []
+    docker_kubernetes_user_password => somepassword2
+    require                         => ['Class[Profile::Rsyslog::Kubernetes]', 'Class[Profile::Netbox::Host]']
+    kubelet_node_taints             => []

Apt::Package_from_component[calico329]

Parameters differences:

--- Apt::Package_from_component[calico329].orig
+++ Apt::Package_from_component[calico329]

+    packages        => {'calicoctl': '>=3.29 <3.30', 'calico-cni': '>=3.29 <3.30'}
+    distro          => trixie-wikimedia
+    uri             => http://apt.wikimedia.org/wikimedia
+    ensure_packages => True
+    priority        => 1001
+    component       => component/calico329
+    ensure          => present

File[/etc/apt/preferences.d/apt_pin_linux_6_16_trixie_trixie_bpo.pref]

Parameters differences:

--- File[/etc/apt/preferences.d/apt_pin_linux_6_16_trixie_trixie_bpo.pref].orig
+++ File[/etc/apt/preferences.d/apt_pin_linux_6_16_trixie_trixie_bpo.pref]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[exec-apt-get-update-linux-6.16-trixie_trixie-bpo]
+    ensure => present

Content differences:

--- /etc/apt/preferences.d/apt_pin_linux_6_16_trixie_trixie_bpo.pref.orig
+++ /etc/apt/preferences.d/apt_pin_linux_6_16_trixie_trixie_bpo.pref
@@ -0,0 +1,3 @@
+Package: linux-image-6.16.3+deb13-amd64
+Pin: release a=trixie-backports
+Pin-Priority: 1001

File[/etc/dragonfly]

Parameters differences:

--- File[/etc/dragonfly].orig
+++ File[/etc/dragonfly]

+    mode    => 0740
+    group   => root
+    owner   => dragonfly
+    recurse => True
+    ensure  => directory

Service[rsyslog-release-deleted-inotify-watches.timer]

Parameters differences:

--- Service[rsyslog-release-deleted-inotify-watches.timer].orig
+++ Service[rsyslog-release-deleted-inotify-watches.timer]

+    provider => systemd
+    before   => ['Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.timer (rsyslog-release-deleted-inotify-watches.timer)]']
+    ensure   => stopped
+    enable   => False

Service[kube-proxy]

Parameters differences:

--- Service[kube-proxy].orig
+++ Service[kube-proxy]

+    ensure => running
+    enable => True

Class[Adduser]

Parameters differences:

--- Class[Adduser].orig
+++ Class[Adduser]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[atop]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[rocm-smi]', 'Package[python3-requests]', 'Package[firmware-amd-graphics]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[atop]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[dragonfly-dfdaemon]', 'Package[dragonfly-dfget]', 'Package[crictl]', 'Package[containerd]', 'Package[nerdctl]', 'Package[rsyslog-kubernetes]', 'Package[linux-cpupower]', 'Package[apparmor]', 'Package[socat]', 'Package[amd-k8s-device-plugin]', 'Package[amd-k8s-node-labeller]', 'Package[rocm-smi]', 'Package[python3-requests]', 'Package[wikimedia-lvs-realserver]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[linux-image-6.16.3+deb13-amd64]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[kubernetes-node]', 'Package[calicoctl]', 'Package[calico-cni]', 'Package[istio-cni]', 'Package[firmware-amd-graphics]']

Sysctl::Conffile[increase_inotify_limits]

Parameters differences:

--- Sysctl::Conffile[increase_inotify_limits].orig
+++ Sysctl::Conffile[increase_inotify_limits]

+    priority => 70
+    ensure   => present

Class[Profile::Lvs::Realserver]

Parameters differences:

--- Class[Profile::Lvs::Realserver].orig
+++ Class[Profile::Lvs::Realserver]

+    poolcounter_backends => [{'label': 'pc1', 'fqdn': 'poolcounter1006.eqiad.wmnet'}, {'label': 'pc2', 'fqdn': 'poolcounter1007.eqiad.wmnet'}]
+    use_conftool         => False
+    pools                => {'inference': {}, 'k8s-ingress-ml-serve': {}}

Package[containerd]

Parameters differences:

--- Package[containerd].orig
+++ Package[containerd]

+    ensure   => installed
+    provider => apt

Ferm::Service[dragonfly_dfget]

Parameters differences:

--- Ferm::Service[dragonfly_dfget].orig
+++ Ferm::Service[dragonfly_dfget]

+    proto               => tcp
+    unrestricted_access => False
+    src_sets            => ['DOMAIN_NETWORKS']
+    prio                => 10
+    ensure              => present
+    port                => 15001
+    notrack             => False
+    desc                =>

File[/etc/kubernetes/pki]

Parameters differences:

--- File[/etc/kubernetes/pki].orig
+++ File[/etc/kubernetes/pki]

+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => directory

Package[linux-image-6.16.3+deb13-amd64]

Parameters differences:

--- Package[linux-image-6.16.3+deb13-amd64].orig
+++ Package[linux-image-6.16.3+deb13-amd64]

+    ensure   => installed
+    provider => apt

Exec[renew certificate - mlserve__istio-cni]

Parameters differences:

--- Exec[renew certificate - mlserve__istio-cni].orig
+++ Exec[renew certificate - mlserve__istio-cni]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__istio-cni.pem -checkend 952200
+    require     => Exec[Generate cert mlserve__istio-cni]
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/kubernetes/pki/mlserve__istio-cni.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__istio-cni

File[/etc/cfssl/csr/mlserve__system_kube-proxy.csr]

Parameters differences:

--- File[/etc/cfssl/csr/mlserve__system_kube-proxy.csr].orig
+++ File[/etc/cfssl/csr/mlserve__system_kube-proxy.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/mlserve__system_kube-proxy.csr.orig
+++ /etc/cfssl/csr/mlserve__system_kube-proxy.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "system:kube-proxy",
+  "hosts": [
+    "system:kube-proxy"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "system:node-proxier",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Systemd::Timer[rsyslog-imfile-remedy]

Parameters differences:

--- Systemd::Timer[rsyslog-imfile-remedy].orig
+++ Systemd::Timer[rsyslog-imfile-remedy]

+    unit_name          => rsyslog-imfile-remedy.service
+    accuracy           => 15sec
+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* 00/3:41:00'}]
+    fixed_random_delay => False
+    splay              => 30
+    ensure             => present

Systemd::Unit[amd-k8s-node-labeller-amd-devplugin-after-labeller]

Parameters differences:

--- Systemd::Unit[amd-k8s-node-labeller-amd-devplugin-after-labeller].orig
+++ Systemd::Unit[amd-k8s-node-labeller-amd-devplugin-after-labeller]

+    override_filename => amd-devplugin-after-labeller
+    unit              => amd-k8s-node-labeller
+    restart           => True
+    override          => True
+    require           => ['Class[Systemd]']
+    ensure            => present

Systemd::Unit[rsyslog-imfile-remedy.timer]

Parameters differences:

--- Systemd::Unit[rsyslog-imfile-remedy.timer].orig
+++ Systemd::Unit[rsyslog-imfile-remedy.timer]

+    override_filename => puppet-override.conf
+    unit              => rsyslog-imfile-remedy.timer
+    restart           => False
+    override          => False
+    require           => ['Class[Systemd]']
+    ensure            => present

Service[kubelet]

Parameters differences:

--- Service[kubelet].orig
+++ Service[kubelet]

+    subscribe => ['File[/etc/kubernetes/kubelet.conf]']
+    ensure    => running
+    enable    => True

Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh on intermediate ca change].orig
+++ Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet

+    notify      => ['Service[kubelet]']
+    refreshonly => True

Systemd::Unit[rsyslog-release-deleted-inotify-watches.timer]

Parameters differences:

--- Systemd::Unit[rsyslog-release-deleted-inotify-watches.timer].orig
+++ Systemd::Unit[rsyslog-release-deleted-inotify-watches.timer]

+    override_filename => puppet-override.conf
+    unit              => rsyslog-release-deleted-inotify-watches.timer
+    restart           => False
+    override          => False
+    require           => ['Class[Systemd]']
+    ensure            => absent

File[/var/lib/prometheus/node.d/role_owner.prom]

Content differences:

--- /var/lib/prometheus/node.d/role_owner.prom.orig
+++ /var/lib/prometheus/node.d/role_owner.prom
@@ -1,3 +1,3 @@
 # HELP role_owner The team owner of the server role
 # TYPE role_owner gauge
-role_owner{team="machine-learning",role="ml_k8s::insetup_gpu",cluster="ml_serve"} 1.0
+role_owner{team="machine-learning",role="ml_k8s::worker",cluster="ml_serve"} 1.0

Concat::Fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

Parameters differences:

--- Concat::Fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia-header].orig
+++ Concat::Fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

+    target => /etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 01
+    source => puppet:///modules/apt/sources-deb822-header.txt

File[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]

Parameters differences:

--- File[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.list].orig
+++ File[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]

+    ensure => absent
+    owner  => root
+    group  => root

Motd::Script[ml_k8s::worker]

Parameters differences:

--- Motd::Script[ml_k8s::worker].orig
+++ Motd::Script[ml_k8s::worker]

+    priority => 5
+    ensure   => present

Exec[apt_repository_component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Exec[apt_repository_component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Exec[apt_repository_component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    command     => /usr/bin/apt-get update 
+    refreshonly => True

File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem].orig
+++ File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem]

+    mode   => 0440
+    group  => root
+    owner  => root
+    ensure => file

Concat::Fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Concat::Fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Concat::Fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    target => /etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 10

K8s::Kubeconfig[/etc/kubernetes/kubelet.conf]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/kubelet.conf].orig
+++ K8s::Kubeconfig[/etc/kubernetes/kubelet.conf]

+    username    => default-auth
+    mode        => 0400
+    group       => kube
+    require     => ['Class[K8s::Base_dirs]']
+    ensure      => present
+    auth_cert   => {'cert': '/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem', 'key': '/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet-key.pem', 'chain': '/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem', 'chained': '/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chained.pem'}
+    master_host => ml-ctrl.svc.eqiad.wmnet
+    owner       => kube

File[/lib/systemd/system/rsyslog-imfile-remedy.timer]

Parameters differences:

--- File[/lib/systemd/system/rsyslog-imfile-remedy.timer].orig
+++ File[/lib/systemd/system/rsyslog-imfile-remedy.timer]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[systemd daemon-reload for rsyslog-imfile-remedy.timer (rsyslog-imfile-remedy.timer)]
+    ensure => present

Content differences:

--- /lib/systemd/system/rsyslog-imfile-remedy.timer.orig
+++ /lib/systemd/system/rsyslog-imfile-remedy.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of rsyslog-imfile-remedy.service
+
+[Timer]
+Unit=rsyslog-imfile-remedy.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-*-* 00/3:41:00
+RandomizedDelaySec=30
+
+[Install]
+WantedBy=multi-user.target

Exec[apt_package_from_component_kubernetes131]

Parameters differences:

--- Exec[apt_package_from_component_kubernetes131].orig
+++ Exec[apt_package_from_component_kubernetes131]

+    subscribe   => Apt::Repository[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]
+    command     => /usr/bin/apt-get update
+    refreshonly => True
+    before      => []

Rsyslog::Conf[kubernetes-node-filters]

Parameters differences:

--- Rsyslog::Conf[kubernetes-node-filters].orig
+++ Rsyslog::Conf[kubernetes-node-filters]

+    priority => 10
+    mode     => 0444
+    ensure   => present
+    source   => puppet:///modules/profile/kubernetes/node/kubernetes-node-filters.rsyslog.conf

File[/etc/cfssl/csr/mlserve__calicoctl.csr]

Parameters differences:

--- File[/etc/cfssl/csr/mlserve__calicoctl.csr].orig
+++ File[/etc/cfssl/csr/mlserve__calicoctl.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/mlserve__calicoctl.csr.orig
+++ /etc/cfssl/csr/mlserve__calicoctl.csr
@@ -0,0 +1,13 @@
+{
+  "CN": "calicoctl",
+  "hosts": [
+    "calicoctl"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+
+  ]
+}

File[/etc/nerdctl/nerdctl.toml]

Parameters differences:

--- File[/etc/nerdctl/nerdctl.toml].orig
+++ File[/etc/nerdctl/nerdctl.toml]

+    mode   => 0644
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/nerdctl/nerdctl.toml.orig
+++ /etc/nerdctl/nerdctl.toml
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# For documentation of the available options, see:
+# https://github.com/containerd/nerdctl/blob/main/docs/config.md
+namespace = "k8s.io"

Exec[create chained cert /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]

+    subscribe => ['Exec[renew certificate - mlserve__system_node_ml-serve1015_eqiad_wmnet]', 'File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]', 'File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem > /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chained.pem
+    notify    => ['Service[kubelet]']
+    require   => Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh on intermediate ca change]

File[/etc/kubernetes/pki/mlserve__calico-cni.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calico-cni.chain.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__calico-cni.chain.pem]

+    mode   => 0440
+    group  => root
+    source => puppet:///modules/profile/pki/intermediates/mlserve-cert.pem
+    owner  => root
+    ensure => file

File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.csr].orig
+++ File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.csr]

+    mode   => 0440
+    group  => root
+    owner  => root
+    ensure => file

Package[calico-cni]

Parameters differences:

--- Package[calico-cni].orig
+++ Package[calico-cni]

+    ensure   => >=3.29 <3.30
+    provider => apt

File[/etc/sysctl.d/75-kube_proxy_conntrack.conf]

Parameters differences:

--- File[/etc/sysctl.d/75-kube_proxy_conntrack.conf].orig
+++ File[/etc/sysctl.d/75-kube_proxy_conntrack.conf]

+    notify => Exec[update_sysctl]
+    group  => root
+    owner  => root
+    ensure => present

Content differences:

--- /etc/sysctl.d/75-kube_proxy_conntrack.conf.orig
+++ /etc/sysctl.d/75-kube_proxy_conntrack.conf
@@ -0,0 +1,2 @@
+# sysctl parameters managed by Puppet.
+net.netfilter.nf_conntrack_max = 1048576

File[/etc/kubernetes/pki/mlserve__calicoctl-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calicoctl-key.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__calicoctl-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => root
+    owner     => root
+    show_diff => False
+    ensure    => file

Exec[Generate cert mlserve__calicoctl]

Parameters differences:

--- Exec[Generate cert mlserve__calicoctl].orig
+++ Exec[Generate cert mlserve__calicoctl]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__calicoctl.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/mlserve__calicoctl-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/mlserve__calicoctl.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__calicoctl.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__calicoctl

Exec[renew certificate - mlserve__rsyslog]

Parameters differences:

--- Exec[renew certificate - mlserve__rsyslog].orig
+++ Exec[renew certificate - mlserve__rsyslog]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.pem -checkend 952200
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog

+    notify      => ['Service[rsyslog]']
+    require     => Exec[Generate cert mlserve__rsyslog]

Package[rsyslog-kubernetes]

Parameters differences:

--- Package[rsyslog-kubernetes].orig
+++ Package[rsyslog-kubernetes]

+    ensure   => installed
+    provider => apt

Class[K8s::Kubelet]

Parameters differences:

--- Class[K8s::Kubelet].orig
+++ Class[K8s::Kubelet]

+    cni_bin_dir                     => /opt/cni/bin
+    kubeconfig                      => /etc/kubernetes/kubelet.conf
+    node_taints                     => []
+    ipv6dualstack                   => False
+    cni_conf_dir                    => /etc/cni/net.d
+    cluster_domain                  => cluster.local
+    v_log_level                     => 0
+    system_reserved                 => {'cpu': '45.3', 'memory': '50.83Gi'}
+    pod_infra_container_image       => docker-registry.discovery.wmnet/pause:3.6-1
+    version                         => 1.31
+    kubelet_cert                    => {'cert': '/etc/kubernetes/pki/mlserve__kubelet_server.pem', 'key': '/etc/kubernetes/pki/mlserve__kubelet_server-key.pem', 'chain': '/etc/kubernetes/pki/mlserve__kubelet_server.chain.pem', 'chained': '/etc/kubernetes/pki/mlserve__kubelet_server.chained.pem'}
+    docker_kubernetes_user_password => somepassword2
+    cluster_dns                     => ['10.67.0.3']
+    node_labels                     => ['topology.kubernetes.io/region=eqiad', 'topology.kubernetes.io/zone=row-e12', 'node.kubernetes.io/disk-type=ssd']

Ferm::Service[calico-bird]

Parameters differences:

--- Ferm::Service[calico-bird].orig
+++ Ferm::Service[calico-bird]

+    proto               => tcp
+    unrestricted_access => False
+    prio                => 10
+    ensure              => present
+    srange              => ($NETWORK_INFRA 10.64.167.1)
+    port                => 179
+    notrack             => False
+    desc                =>

File[/etc/kubernetes/pki/mlserve__calicoctl.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calicoctl.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__calicoctl.pem]

+    mode   => 0440
+    group  => root
+    owner  => root
+    ensure => file

Rsyslog::Conf[kubernetes]

Parameters differences:

--- Rsyslog::Conf[kubernetes].orig
+++ Rsyslog::Conf[kubernetes]

+    priority => 9
+    mode     => 0444
+    ensure   => present

Exec[cpupower_reload]

Parameters differences:

--- Exec[cpupower_reload].orig
+++ Exec[cpupower_reload]

+    unless  => /usr/bin/cpupower frequency-info -p | /bin/grep -wq performance
+    require => File[/etc/default/cpupower]
+    command => /usr/bin/systemctl restart cpupower

Systemd::Service[kube-proxy]

Parameters differences:

--- Systemd::Service[kube-proxy].orig
+++ Systemd::Service[kube-proxy]

+    migration_task           => T407130
+    subscribe                => File[/etc/kubernetes/proxy.conf]
+    monitoring_enabled       => False
+    restart                  => True
+    override                 => True
+    service_params           => {}
+    ensure                   => present
+    monitoring_critical      => False
+    monitoring_contact_group => admins
+    unit_type                => service

File[/etc/sysctl.d/75-kube_proxy_icmp.conf]

Parameters differences:

--- File[/etc/sysctl.d/75-kube_proxy_icmp.conf].orig
+++ File[/etc/sysctl.d/75-kube_proxy_icmp.conf]

+    notify => Exec[update_sysctl]
+    group  => root
+    owner  => root
+    ensure => present

Content differences:

--- /etc/sysctl.d/75-kube_proxy_icmp.conf.orig
+++ /etc/sysctl.d/75-kube_proxy_icmp.conf
@@ -0,0 +1,4 @@
+# sysctl parameters managed by Puppet.
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.ens11f1np1.send_redirects = 0

Class[Profile::Base]

Parameters differences:

--- Class[Profile::Base].orig
+++ Class[Profile::Base]

@@
-    overlayfs                    => False
+    overlayfs                    => True
@@
-    use_linux_from_bpo_on_trixie => False
+    use_linux_from_bpo_on_trixie => True

File[/etc/kubernetes/pki/mlserve__kubelet_server.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__kubelet_server.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__kubelet_server.pem]

+    mode   => 0440
+    group  => root
+    owner  => kube
+    ensure => file

Concat::Fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Concat::Fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Concat::Fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    target => /etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 10

File[/etc/apt/preferences.d/apt_pin_firmware_amd_graphics_trixie_bpo_trixie_bpo.pref]

Parameters differences:

--- File[/etc/apt/preferences.d/apt_pin_firmware_amd_graphics_trixie_bpo_trixie_bpo.pref].orig
+++ File[/etc/apt/preferences.d/apt_pin_firmware_amd_graphics_trixie_bpo_trixie_bpo.pref]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[exec-apt-get-update-firmware-amd-graphics-trixie-bpo_trixie-bpo]
+    ensure => present

Content differences:

--- /etc/apt/preferences.d/apt_pin_firmware_amd_graphics_trixie_bpo_trixie_bpo.pref.orig
+++ /etc/apt/preferences.d/apt_pin_firmware_amd_graphics_trixie_bpo_trixie_bpo.pref
@@ -0,0 +1,3 @@
+Package: firmware-amd-graphics
+Pin: release a=trixie-backports
+Pin-Priority: 1001

Concat[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

Parameters differences:

--- Concat[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources].orig
+++ Concat[/etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

+    backup         => puppet
+    mode           => 0444
+    group          => root
+    order          => alpha
+    warn           => False
+    ensure_newline => False
+    ensure         => present
+    force          => False
+    show_diff      => True
+    replace        => True
+    path           => /etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    format         => plain
+    notify         => Exec[apt_repository_component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]
+    owner          => root

Concat[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

Parameters differences:

--- Concat[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources].orig
+++ Concat[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

+    backup         => puppet
+    mode           => 0444
+    group          => root
+    order          => alpha
+    warn           => False
+    ensure_newline => False
+    ensure         => present
+    force          => False
+    show_diff      => True
+    replace        => True
+    path           => /etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    format         => plain
+    notify         => Exec[apt_repository_component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia]
+    owner          => root

Exec[Generate cert mlserve__rsyslog refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert mlserve__rsyslog refresh on intermediate ca change].orig
+++ Exec[Generate cert mlserve__rsyslog refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__rsyslog.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog

+    notify      => ['Service[rsyslog]']
+    refreshonly => True

File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]

+    mode   => 0440
+    group  => amd-nodelabeller
+    source => puppet:///modules/profile/pki/intermediates/mlserve-cert.pem
+    owner  => amd-nodelabeller
+    ensure => file

Cfssl::Csr[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => ml-serve1015.eqiad.wmnet
+    names       => []
+    hosts       => ['ml-serve1015', 'ml-serve1015.eqiad.wmnet', 'docker-registry.discovery.wmnet', '127.0.0.1', '::1', 'localhost']
+    ensure      => present

Rsyslog::Conf[rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- Rsyslog::Conf[rsyslog-release-deleted-inotify-watches].orig
+++ Rsyslog::Conf[rsyslog-release-deleted-inotify-watches]

+    require  => File[/var/log/rsyslog-release-deleted-inotify-watches]
+    priority => 40
+    mode     => 0444
+    ensure   => absent

Systemd::Unit[rsyslog-imfile-remedy.service]

Parameters differences:

--- Systemd::Unit[rsyslog-imfile-remedy.service].orig
+++ Systemd::Unit[rsyslog-imfile-remedy.service]

+    override_filename => puppet-override.conf
+    unit              => rsyslog-imfile-remedy.service
+    restart           => False
+    override          => False
+    require           => ['Class[Systemd]']
+    ensure            => present

Exec[Generate cert mlserve__istio-cni refresh]

Parameters differences:

--- Exec[Generate cert mlserve__istio-cni refresh].orig
+++ Exec[Generate cert mlserve__istio-cni refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/mlserve__istio-cni.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__istio-cni.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__istio-cni

+    refreshonly => True

Concat_file[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

Parameters differences:

--- Concat_file[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources].orig
+++ Concat_file[/etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

+    backup         => puppet
+    mode           => 0444
+    group          => root
+    order          => alpha
+    tag            => _etc_apt_sources.list.d_component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    ensure_newline => False
+    force          => False
+    replace        => True
+    show_diff      => True
+    format         => plain
+    owner          => root

File[/etc/logrotate.d/rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- File[/etc/logrotate.d/rsyslog-release-deleted-inotify-watches].orig
+++ File[/etc/logrotate.d/rsyslog-release-deleted-inotify-watches]

+    mode   => 0444
+    group  => root
+    owner  => root
+    ensure => absent

Content differences:

--- /etc/logrotate.d/rsyslog-release-deleted-inotify-watches.orig
+++ /etc/logrotate.d/rsyslog-release-deleted-inotify-watches
@@ -0,0 +1,12 @@
+# logrotate(8) config for rsyslog-release-deleted-inotify-watches
+
+/var/log/rsyslog-release-deleted-inotify-watches/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Class[Profile::Monitoring]

Parameters differences:

--- Class[Profile::Monitoring].orig
+++ Class[Profile::Monitoring]

@@
-    nrpe_check_disk_options => -w 6% -c 3% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" -i "/srv/nvme[0-9]n[0-9]p[0-9]" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs
+    nrpe_check_disk_options => -w 10% -c 5% -W 6% -K 3% -l -e -A -i '/(var/lib|run)/(containerd|kubelet)/*' --exclude-type=tracefs

File[/etc/kubernetes/pki/mlserve__istio-cni.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__istio-cni.csr].orig
+++ File[/etc/kubernetes/pki/mlserve__istio-cni.csr]

+    mode   => 0440
+    group  => root
+    owner  => root
+    ensure => file

File[/usr/local/sbin/rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- File[/usr/local/sbin/rsyslog-release-deleted-inotify-watches].orig
+++ File[/usr/local/sbin/rsyslog-release-deleted-inotify-watches]

+    owner  => root
+    group  => root
+    mode   => 0544
+    ensure => absent

Package[amd-k8s-node-labeller]

Parameters differences:

--- Package[amd-k8s-node-labeller].orig
+++ Package[amd-k8s-node-labeller]

+    require  => K8s::Kubeconfig[/etc/amd/node-labeller-kubeconfig]
+    ensure   => present
+    provider => apt

Exec[Generate cert mlserve__rsyslog refresh]

Parameters differences:

--- Exec[Generate cert mlserve__rsyslog refresh].orig
+++ Exec[Generate cert mlserve__rsyslog refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/mlserve__rsyslog.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__rsyslog.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog

+    notify      => ['Service[rsyslog]']
+    refreshonly => True

Systemd::Service[rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- Systemd::Service[rsyslog-release-deleted-inotify-watches].orig
+++ Systemd::Service[rsyslog-release-deleted-inotify-watches]

+    migration_task           => T407130
+    monitoring_enabled       => False
+    restart                  => False
+    override                 => False
+    require                  => Systemd::Unit[rsyslog-release-deleted-inotify-watches.service]
+    service_params           => {}
+    ensure                   => absent
+    monitoring_critical      => False
+    monitoring_contact_group => admins
+    unit_type                => timer

Sysctl::Conffile[kube_proxy_conntrack]

Parameters differences:

--- Sysctl::Conffile[kube_proxy_conntrack].orig
+++ Sysctl::Conffile[kube_proxy_conntrack]

+    priority => 75
+    ensure   => present

File[/etc/udev/rules.d/70-kfd.rules]

Parameters differences:

--- File[/etc/udev/rules.d/70-kfd.rules].orig
+++ File[/etc/udev/rules.d/70-kfd.rules]

+    group => root
+    mode  => 0544
+    owner => root

Content differences:

--- /etc/udev/rules.d/70-kfd.rules.orig
+++ /etc/udev/rules.d/70-kfd.rules
@@ -0,0 +1 @@
+SUBSYSTEM=="kfd", KERNEL=="kfd", MODE="0666"

File[/etc/ferm/conf.d/10_kubelet-http]

Parameters differences:

--- File[/etc/ferm/conf.d/10_kubelet-http].orig
+++ File[/etc/ferm/conf.d/10_kubelet-http]

+    mode    => 0400
+    group   => root
+    owner   => root
+    tag     => ferm
+    notify  => Service[ferm]
+    require => File[/etc/ferm/conf.d]
+    ensure  => present

Content differences:

--- /etc/ferm/conf.d/10_kubelet-http.orig
+++ /etc/ferm/conf.d/10_kubelet-http
@@ -0,0 +1,6 @@
+# Autogenerated by puppet. DO NOT EDIT BY HAND!
+#
+# 
+&R_SERVICE(tcp, 10250, (@resolve((ml-serve-ctrl1001.eqiad.wmnet ml-serve-ctrl1002.eqiad.wmnet)) @resolve((ml-serve-ctrl1001.eqiad.wmnet ml-serve-ctrl1002.eqiad.wmnet), AAAA)));
+
+

File[/etc/systemd/system/kubelet.service.d/container-runtime.conf]

Parameters differences:

--- File[/etc/systemd/system/kubelet.service.d/container-runtime.conf].orig
+++ File[/etc/systemd/system/kubelet.service.d/container-runtime.conf]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[systemd daemon-reload for kubelet.service (kubelet-container-runtime)]
+    ensure => present

Content differences:

--- /etc/systemd/system/kubelet.service.d/container-runtime.conf.orig
+++ /etc/systemd/system/kubelet.service.d/container-runtime.conf
@@ -0,0 +1,3 @@
+[Unit]
+After=containerd.service
+Requires=containerd.service

Firewall::Service[dragonfly_dfget]

Parameters differences:

--- Firewall::Service[dragonfly_dfget].orig
+++ Firewall::Service[dragonfly_dfget]

+    proto               => tcp
+    unrestricted_access => False
+    src_sets            => ['DOMAIN_NETWORKS']
+    prio                => 10
+    ensure              => present
+    port                => 15001
+    notrack             => False
+    desc                =>

File[/etc/ferm/conf.d/10_calico_typha]

Parameters differences:

--- File[/etc/ferm/conf.d/10_calico_typha].orig
+++ File[/etc/ferm/conf.d/10_calico_typha]

+    mode    => 0400
+    group   => root
+    owner   => root
+    tag     => ferm
+    notify  => Service[ferm]
+    require => File[/etc/ferm/conf.d]
+    ensure  => present

Content differences:

--- /etc/ferm/conf.d/10_calico_typha.orig
+++ /etc/ferm/conf.d/10_calico_typha
@@ -0,0 +1,6 @@
+# Autogenerated by puppet. DO NOT EDIT BY HAND!
+#
+# 
+&R_SERVICE(tcp, 5473, $DOMAIN_NETWORKS);
+
+

Rsyslog::Conf[imfile]

Parameters differences:

--- Rsyslog::Conf[imfile].orig
+++ Rsyslog::Conf[imfile]

+    priority => 0
+    mode     => 0444
+    ensure   => present

Apt::Repository[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Apt::Repository[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Apt::Repository[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    components               => component/kubernetes131
+    uri                      => http://apt.wikimedia.org/wikimedia
+    keyfile                  => puppet:///modules/install_server/autoinstall/keyring/wikimedia-archive-keyring.gpg
+    bin                      => True
+    trust_repo               => False
+    ensure                   => present
+    source                   => True
+    allow_releaseinfo_change => False
+    dist                     => trixie-wikimedia

File[/etc/kubernetes/pki/mlserve__kubelet_server-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__kubelet_server-key.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__kubelet_server-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => root
+    owner     => kube
+    show_diff => False
+    ensure    => file

Exec[renew certificate - mlserve__calicoctl]

Parameters differences:

--- Exec[renew certificate - mlserve__calicoctl].orig
+++ Exec[renew certificate - mlserve__calicoctl]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__calicoctl.pem -checkend 952200
+    require     => Exec[Generate cert mlserve__calicoctl]
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/kubernetes/pki/mlserve__calicoctl.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__calicoctl

File[/lib/systemd/system/cpupower.service]

Parameters differences:

--- File[/lib/systemd/system/cpupower.service].orig
+++ File[/lib/systemd/system/cpupower.service]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[systemd daemon-reload for cpupower.service (cpupower)]
+    ensure => present

Content differences:

--- /lib/systemd/system/cpupower.service.orig
+++ /lib/systemd/system/cpupower.service
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: Apache-2.0
+# Adapted from:
+# https://sources.debian.org/src/linux/6.16.3-1/tools/power/cpupower/cpupower.service.in
+
+[Unit]
+Description=Apply cpupower configuration
+
+[Service]
+Type=oneshot
+EnvironmentFile=-/etc/default/cpupower
+ExecStart=/usr/libexec/cpupower
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

Cfssl::Csr[/etc/cfssl/csr/mlserve__calico-cni.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/mlserve__calico-cni.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/mlserve__calico-cni.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => calico-cni
+    names       => []
+    hosts       => []
+    ensure      => present

Cfssl::Cert[mlserve__calico-cni]

Parameters differences:

--- Cfssl::Cert[mlserve__calico-cni].orig
+++ Cfssl::Cert[mlserve__calico-cni]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => calico-cni
+    outdir          => /etc/kubernetes/pki
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    label           => mlserve
+    names           => []
+    auto_renew      => True
+    notify_services => []
+    provide_chain   => True
+    renew_seconds   => 952200
+    owner           => root
+    group           => root
+    ensure          => present
+    before_services => []
+    hosts           => []

File[/etc/update-motd.d/05-ml-k8s--insetup-gpu]

Parameters differences:

--- File[/etc/update-motd.d/05-ml-k8s--insetup-gpu].orig
+++ File[/etc/update-motd.d/05-ml-k8s--insetup-gpu]

-    owner  => root
-    group  => root
-    mode   => 0555
-    ensure => present

Content differences:

--- /etc/update-motd.d/05-ml-k8s--insetup-gpu.orig
+++ /etc/update-motd.d/05-ml-k8s--insetup-gpu
@@ -1,2 +0,0 @@
-#!/bin/sh
-printf "%s\n" "ml-serve1015 is a Machine Learning GPU host in setup. (ml_k8s::insetup_gpu)"

File[/etc/dragonfly/dfdaemon.yml]

Parameters differences:

--- File[/etc/dragonfly/dfdaemon.yml].orig
+++ File[/etc/dragonfly/dfdaemon.yml]

+    mode   => 0644
+    group  => root
+    owner  => root
+    notify => Service[dragonfly-dfdaemon]
+    ensure => file

Content differences:

--- /etc/dragonfly/dfdaemon.yml.orig
+++ /etc/dragonfly/dfdaemon.yml
@@ -0,0 +1,49 @@
+# This is only used if dfdaemon is configured in registry-mirrors of
+# /etc/docker/daemon.json.
+# It is not used in our configuration, but I'll keep it here as the default is
+# the upstream docker hub and that looks very phishy in logs.
+registry_mirror:
+  remote: "https://docker-registry.discovery.wmnet"
+
+# dfdaemon will listen on TCP 65001 by default for connections to be proxied to the registry.
+# If certpem and keypem is set, dfdaemon will only accept HTTPS connections.
+# Prometheus metrics are served as well using this port, so we need to bind to 0.0.0.0.
+hostIp: 0.0.0.0
+port: 65001
+# We can't use HTTP even though we're localhost only as docker will refuse to send credentials
+# for a registry via HTTPS. So this needs to be a certificate for: 127.0.0.1, ::1, localhost and $(hostname -f) (for scraping metrics).
+certpem: "/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem"
+keypem: "/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet-key.pem"
+
+# Requests will be handled by the first matching rule
+# "use_https: true" can be used to upgrade incoming HTTP requests to HTTPS (this means connections
+# from dfdaemon to the source registry will always use HTTPS).
+proxies:
+  - regx: "wikimedia/machinelearning-liftwing.*/blobs/sha256.*"
+    use_https: true
+  - regx: "amd-pytorch.*/blobs/sha256.*"
+    use_https: true
+
+# If an https request's host matches any of the hijacking rules, dfdaemon will
+# decrypt the request with given key pair and proxy it with the proxy rules.
+hijack_https:
+  # Cert and key of docker-registry.discovery.wmnet
+  cert: "/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chained.pem"
+  key: "/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet-key.pem"
+  hosts:
+    - regx: "docker-registry.discovery.wmnet"
+      # Puppet-ca here, for validation of the cert from source
+      certs: ["/etc/ssl/certs/wmf-ca-certificates.crt"]
+
+# Configure dfget to use a specific home directory (will be created if it does not exist).
+#
+# The IP used here is not only a listen IP but the IP annonced to the supernode. Using 0.0.0.0
+# leads to the network still functioning but every client will ask it's own dfget server for parts
+# which will make them fetch the parts from the docker-registry istead of peers.
+#
+# Port needs to be specified here as dfget will choose a random one (per invocation) if not.
+dfget_flags: ["--home", "/var/lib/dragonfly-dfdaemon/dfget", "--ip", "10.64.167.6", "--port", "15001"]
+
+# Network bandwith rate limit, will actually be used as "--locallimit" and "--totallimit" for dfget.
+# In format of G(B)/g/M(B)/m/K(B)/k/B, pure number will also be parsed as Byte.
+ratelimit: 100M

File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem].orig
+++ File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem]

+    mode   => 0440
+    group  => root
+    owner  => dragonfly
+    ensure => file

File[/var/lib/kubelet]

Parameters differences:

--- File[/var/lib/kubelet].orig
+++ File[/var/lib/kubelet]

+    mode   => 0700
+    group  => root
+    owner  => root
+    ensure => directory

Class[Calico]

Parameters differences:

--- Class[Calico].orig
+++ Class[Calico]

+    auth_cert          => {'cert': '/etc/kubernetes/pki/mlserve__calicoctl.pem', 'key': '/etc/kubernetes/pki/mlserve__calicoctl-key.pem', 'chain': '/etc/kubernetes/pki/mlserve__calicoctl.chain.pem', 'chained': '/etc/kubernetes/pki/mlserve__calicoctl.chained.pem'}
+    version            => 3.29
+    calicoctl_username => calicoctl
+    master_fqdn        => ml-ctrl.svc.eqiad.wmnet

File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.chain.pem]

+    mode   => 0440
+    group  => root
+    source => puppet:///modules/profile/pki/intermediates/mlserve-cert.pem
+    owner  => kube
+    ensure => file

File[/etc/containerd]

Parameters differences:

--- File[/etc/containerd].orig
+++ File[/etc/containerd]

+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => directory

File[/etc/nerdctl]

Parameters differences:

--- File[/etc/nerdctl].orig
+++ File[/etc/nerdctl]

+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => directory

Rsyslog::Conf[output_kafka_k8s]

Parameters differences:

--- Rsyslog::Conf[output_kafka_k8s].orig
+++ Rsyslog::Conf[output_kafka_k8s]

+    priority => 35
+    mode     => 0444
+    ensure   => present

Concat::Fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

Parameters differences:

--- Concat::Fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia-header].orig
+++ Concat::Fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

+    target => /etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 01
+    source => puppet:///modules/apt/sources-deb822-header.txt

File[/etc/systemd/system/ferm.service.d/ferm-service-auto-restart.conf]

Parameters differences:

--- File[/etc/systemd/system/ferm.service.d/ferm-service-auto-restart.conf].orig
+++ File[/etc/systemd/system/ferm.service.d/ferm-service-auto-restart.conf]

+    mode   => 0444
+    group  => root
+    source => puppet:///modules/profile/kubernetes/node/ferm_systemd_override
+    owner  => root
+    notify => Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-auto-restart)]
+    ensure => present

Service[dragonfly-dfdaemon]

Parameters differences:

--- Service[dragonfly-dfdaemon].orig
+++ Service[dragonfly-dfdaemon]

+    ensure => running

Apt::Package_from_component[kubernetes131]

Parameters differences:

--- Apt::Package_from_component[kubernetes131].orig
+++ Apt::Package_from_component[kubernetes131]

+    packages        => []
+    distro          => trixie-wikimedia
+    uri             => http://apt.wikimedia.org/wikimedia
+    ensure_packages => True
+    priority        => 1001
+    component       => component/kubernetes131
+    ensure          => present

Exec[Generate cert mlserve__system_kube-proxy refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert mlserve__system_kube-proxy refresh on intermediate ca change].orig
+++ Exec[Generate cert mlserve__system_kube-proxy refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__system_kube-proxy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__system_kube-proxy

+    notify      => ['Service[kube-proxy]']
+    refreshonly => True

Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet].orig
+++ Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet-key.pem 2>&1)"

+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label discovery  /etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet

+    notify      => ['Service[dragonfly-dfdaemon]']
+    require     => Cfssl::Csr[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr]

Udev::Rule[kube_proxy_conntrack]

Parameters differences:

--- Udev::Rule[kube_proxy_conntrack].orig
+++ Udev::Rule[kube_proxy_conntrack]

+    priority => 75
+    ensure   => present

File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet-key.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => root
+    owner     => kube
+    show_diff => False
+    ensure    => file

Class[Containerd]

Parameters differences:

--- Class[Containerd].orig
+++ Class[Containerd]

+    require => ['Class[Containerd::Configuration]']
+    ensure  => present

File[/etc/calico/calicoctl.cfg]

Parameters differences:

--- File[/etc/calico/calicoctl.cfg].orig
+++ File[/etc/calico/calicoctl.cfg]

+    mode   => 0444
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/calico/calicoctl.cfg.orig
+++ /etc/calico/calicoctl.cfg
@@ -0,0 +1,10 @@
+# This configures calicoctl to use the kubernetes datastore.
+# The user referenced in the kubeconfig file probably needs broad permissions, see:
+# https://docs.projectcalico.org/getting-started/clis/calicoctl/configure/overview
+# https://docs.projectcalico.org/getting-started/kubernetes/hardway/end-user-rbac
+apiVersion: projectcalico.org/v3
+kind: CalicoAPIConfig
+metadata:
+spec:
+  datastoreType: "kubernetes"
+  kubeconfig: "/etc/calico/calicoctl-kubeconfig"

File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chained.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/mlserve__amdgpu-node-labeller.chain.pem]
+    group   => amd-nodelabeller
+    owner   => amd-nodelabeller
+    ensure  => file

File[/etc/nagios/nrpe.d/check_disk_space.cfg]

Content differences:

--- /etc/nagios/nrpe.d/check_disk_space.cfg.orig
+++ /etc/nagios/nrpe.d/check_disk_space.cfg
@@ -1,2 +1,2 @@
 # File generated by puppet. DO NOT edit by hand
-command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" -i "/srv/nvme[0-9]n[0-9]p[0-9]" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs
+command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 10% -c 5% -W 6% -K 3% -l -e -A -i '/(var/lib|run)/(containerd|kubelet)/*' --exclude-type=tracefs

Apt::Repository[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Apt::Repository[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Apt::Repository[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    components               => component/calico329
+    uri                      => http://apt.wikimedia.org/wikimedia
+    keyfile                  => puppet:///modules/install_server/autoinstall/keyring/wikimedia-archive-keyring.gpg
+    bin                      => True
+    trust_repo               => False
+    ensure                   => present
+    source                   => True
+    allow_releaseinfo_change => False
+    dist                     => trixie-wikimedia

File[/etc/cni]

Parameters differences:

--- File[/etc/cni].orig
+++ File[/etc/cni]

+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => directory

Exec[create chained cert /etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/mlserve__kubelet_server.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]

+    subscribe => ['Exec[renew certificate - mlserve__kubelet_server]', 'File[/etc/kubernetes/pki/mlserve__kubelet_server.chain.pem]', 'File[/etc/kubernetes/pki/mlserve__kubelet_server.pem]']
+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/mlserve__kubelet_server.pem /etc/kubernetes/pki/mlserve__kubelet_server.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/mlserve__kubelet_server.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/mlserve__kubelet_server.pem /etc/kubernetes/pki/mlserve__kubelet_server.chain.pem > /etc/kubernetes/pki/mlserve__kubelet_server.chained.pem
+    notify    => ['Service[kubelet]']
+    require   => Exec[Generate cert mlserve__kubelet_server refresh on intermediate ca change]

Class[Containerd::Configuration]

Parameters differences:

--- Class[Containerd::Configuration].orig
+++ Class[Containerd::Configuration]

+    registry_username => kubernetes
+    dragonfly_enabled => True
+    ensure            => present
+    sandbox_image     => docker-registry.discovery.wmnet/pause:3.6-1

File[/var/log/rsyslog-release-deleted-inotify-watches]

Parameters differences:

--- File[/var/log/rsyslog-release-deleted-inotify-watches].orig
+++ File[/var/log/rsyslog-release-deleted-inotify-watches]

+    backup => False
+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => absent
+    force  => True

File[/lib/systemd/system/rsyslog-imfile-remedy.service]

Parameters differences:

--- File[/lib/systemd/system/rsyslog-imfile-remedy.service].orig
+++ File[/lib/systemd/system/rsyslog-imfile-remedy.service]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[systemd daemon-reload for rsyslog-imfile-remedy.service (rsyslog-imfile-remedy.service)]
+    ensure => present

Content differences:

--- /lib/systemd/system/rsyslog-imfile-remedy.service.orig
+++ /lib/systemd/system/rsyslog-imfile-remedy.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Restart rsyslog T357616
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/bin/systemctl try-restart rsyslog

Class[Profile::Containerd]

Parameters differences:

--- Class[Profile::Containerd].orig
+++ Class[Profile::Containerd]

+    registry_username       => kubernetes
+    kubernetes_cluster_name => ml-serve-eqiad
+    ensure                  => present

Systemd::Unit[kube-proxy]

Parameters differences:

--- Systemd::Unit[kube-proxy].orig
+++ Systemd::Unit[kube-proxy]

+    override_filename => puppet-override.conf
+    unit              => kube-proxy
+    restart           => True
+    override          => True
+    require           => ['Class[Systemd]']
+    ensure            => present

File[/etc/kubernetes/pki/mlserve__istio-cni.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__istio-cni.chain.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__istio-cni.chain.pem]

+    mode   => 0440
+    group  => root
+    source => puppet:///modules/profile/pki/intermediates/mlserve-cert.pem
+    owner  => root
+    ensure => file

File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem].orig
+++ File[/etc/cfssl/ssl/mlserve__rsyslog/mlserve__rsyslog.chain.pem]

+    mode   => 0440
+    group  => root
+    source => puppet:///modules/profile/pki/intermediates/mlserve-cert.pem
+    owner  => root
+    ensure => file

Cfssl::Csr[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/mlserve__amdgpu-node-labeller.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => amdgpu-node-labeller
+    names       => []
+    hosts       => []
+    ensure      => present

K8s::Package[kubelet]

Parameters differences:

--- K8s::Package[kubelet].orig
+++ K8s::Package[kubelet]

+    require         => ['Class[K8s::Base_dirs]']
+    version         => 1.31
+    distro          => trixie-wikimedia
+    uri             => http://apt.wikimedia.org/wikimedia
+    package         => node
+    priority        => 1001
+    ensure_packages => True

Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh].orig
+++ Exec[Generate cert mlserve__system_node_ml-serve1015_eqiad_wmnet refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet

+    notify      => ['Service[kubelet]']
+    refreshonly => True

Package[calicoctl]

Parameters differences:

--- Package[calicoctl].orig
+++ Package[calicoctl]

+    ensure   => >=3.29 <3.30
+    provider => apt

File[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "system:node:ml-serve1015.eqiad.wmnet",
+  "hosts": [
+    "system:node:ml-serve1015.eqiad.wmnet"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "system:nodes",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

File[/etc/sysctl.d/70-increase_inotify_limits.conf]

Parameters differences:

--- File[/etc/sysctl.d/70-increase_inotify_limits.conf].orig
+++ File[/etc/sysctl.d/70-increase_inotify_limits.conf]

+    notify => Exec[update_sysctl]
+    group  => root
+    owner  => root
+    ensure => present

Content differences:

--- /etc/sysctl.d/70-increase_inotify_limits.conf.orig
+++ /etc/sysctl.d/70-increase_inotify_limits.conf
@@ -0,0 +1,3 @@
+# sysctl parameters managed by Puppet.
+fs.inotify.max_user_instances = 512
+fs.inotify.max_user_watches = 32768

File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr].orig
+++ File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]

+    mode   => 0440
+    group  => root
+    owner  => kube
+    ensure => file

Cfssl::Cert[mlserve__istio-cni]

Parameters differences:

--- Cfssl::Cert[mlserve__istio-cni].orig
+++ Cfssl::Cert[mlserve__istio-cni]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => istio-cni
+    outdir          => /etc/kubernetes/pki
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    label           => mlserve
+    names           => []
+    auto_renew      => True
+    notify_services => []
+    provide_chain   => True
+    renew_seconds   => 952200
+    owner           => root
+    group           => root
+    ensure          => present
+    before_services => []
+    hosts           => []

File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__system_kube-proxy.chain.pem]

+    mode   => 0440
+    group  => root
+    source => puppet:///modules/profile/pki/intermediates/mlserve-cert.pem
+    owner  => kube
+    ensure => file

Class[Profile::Amd_gpu]

Parameters differences:

--- Class[Profile::Amd_gpu].orig
+++ Class[Profile::Amd_gpu]

+    kubernetes_cluster_name => ml-serve-eqiad
@@
-    is_kubernetes_node      => False
+    is_kubernetes_node      => True
@@
-    is_basic_gpu_node       => True
+    is_basic_gpu_node       => False
@@
-    firmwares_from_bpo      => False
+    firmwares_from_bpo      => True

Systemd::Override[container-runtime]

Parameters differences:

--- Systemd::Override[container-runtime].orig
+++ Systemd::Override[container-runtime]

+    ensure  => present
+    unit    => kubelet
+    restart => True

File[/etc/cfssl/ssl/mlserve__rsyslog]

Parameters differences:

--- File[/etc/cfssl/ssl/mlserve__rsyslog].orig
+++ File[/etc/cfssl/ssl/mlserve__rsyslog]

+    mode    => 0740
+    group   => root
+    owner   => root
+    recurse => True
+    ensure  => directory

File[/lib/systemd/system/rsyslog-release-deleted-inotify-watches.service]

Parameters differences:

--- File[/lib/systemd/system/rsyslog-release-deleted-inotify-watches.service].orig
+++ File[/lib/systemd/system/rsyslog-release-deleted-inotify-watches.service]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.service (rsyslog-release-deleted-inotify-watches.service)]
+    ensure => absent

Content differences:

--- /lib/systemd/system/rsyslog-release-deleted-inotify-watches.service.orig
+++ /lib/systemd/system/rsyslog-release-deleted-inotify-watches.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Restart rsyslog to release inotify watches of deleted container logs
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/rsyslog-release-deleted-inotify-watches

Exec[exec-apt-get-update-linux-6.16-trixie_trixie-bpo]

Parameters differences:

--- Exec[exec-apt-get-update-linux-6.16-trixie_trixie-bpo].orig
+++ Exec[exec-apt-get-update-linux-6.16-trixie_trixie-bpo]

+    command     => /usr/bin/apt-get update
+    refreshonly => True

Exec[Generate cert mlserve__system_kube-proxy]

Parameters differences:

--- Exec[Generate cert mlserve__system_kube-proxy].orig
+++ Exec[Generate cert mlserve__system_kube-proxy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/mlserve__system_kube-proxy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/mlserve__system_kube-proxy-key.pem 2>&1)"

+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__system_kube-proxy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__system_kube-proxy

+    notify      => ['Service[kube-proxy]']
+    require     => Cfssl::Csr[/etc/cfssl/csr/mlserve__system_kube-proxy.csr]

Apt::Pin[apt_pin_firmware-amd-graphics-trixie-bpo_trixie-bpo]

Parameters differences:

--- Apt::Pin[apt_pin_firmware-amd-graphics-trixie-bpo_trixie-bpo].orig
+++ Apt::Pin[apt_pin_firmware-amd-graphics-trixie-bpo_trixie-bpo]

+    package  => firmware-amd-graphics
+    before   => ['Package[firmware-amd-graphics]']
+    ensure   => present
+    notify   => Exec[exec-apt-get-update-firmware-amd-graphics-trixie-bpo_trixie-bpo]
+    priority => 1001
+    pin      => release a=trixie-backports

Concat::Fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

Parameters differences:

--- Concat::Fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia-header].orig
+++ Concat::Fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

+    target => /etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 01
+    source => puppet:///modules/apt/sources-deb822-header.txt

Exec[systemd daemon-reload for cpupower.service (cpupower)]

Parameters differences:

--- Exec[systemd daemon-reload for cpupower.service (cpupower)].orig
+++ Exec[systemd daemon-reload for cpupower.service (cpupower)]

+    notify      => ['Service[cpupower]']
+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

File[/etc/udev/rules.d/70-render.rules]

Parameters differences:

--- File[/etc/udev/rules.d/70-render.rules].orig
+++ File[/etc/udev/rules.d/70-render.rules]

+    group => root
+    mode  => 0544
+    owner => root

Content differences:

--- /etc/udev/rules.d/70-render.rules.orig
+++ /etc/udev/rules.d/70-render.rules
@@ -0,0 +1 @@
+SUBSYSTEM=="drm", KERNEL=="renderD*", MODE="0666"

Exec[Generate cert mlserve__calicoctl refresh]

Parameters differences:

--- Exec[Generate cert mlserve__calicoctl refresh].orig
+++ Exec[Generate cert mlserve__calicoctl refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/cfssl/csr/mlserve__calicoctl.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__calicoctl.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__calicoctl

+    refreshonly => True

Exec[systemd daemon-reload for kubelet.service (kubelet-container-runtime)]

Parameters differences:

--- Exec[systemd daemon-reload for kubelet.service (kubelet-container-runtime)].orig
+++ Exec[systemd daemon-reload for kubelet.service (kubelet-container-runtime)]

+    notify      => ['Service[kubelet]']
+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

Systemd::Service[rsyslog-imfile-remedy]

Parameters differences:

--- Systemd::Service[rsyslog-imfile-remedy].orig
+++ Systemd::Service[rsyslog-imfile-remedy]

+    migration_task           => T407130
+    monitoring_enabled       => False
+    restart                  => False
+    override                 => False
+    require                  => Systemd::Unit[rsyslog-imfile-remedy.service]
+    service_params           => {}
+    ensure                   => present
+    monitoring_critical      => False
+    monitoring_contact_group => admins
+    unit_type                => timer

Class[Toil::Rsyslog_imfile_remedy]

Parameters differences:

--- Class[Toil::Rsyslog_imfile_remedy].orig
+++ Class[Toil::Rsyslog_imfile_remedy]

+    period_hours => 3
+    ensure       => present

Cfssl::Cert[mlserve__kubelet_server]

Parameters differences:

--- Cfssl::Cert[mlserve__kubelet_server].orig
+++ Cfssl::Cert[mlserve__kubelet_server]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => kubelet
+    outdir          => /etc/kubernetes/pki
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    label           => mlserve
+    names           => []
+    profile         => server
+    auto_renew      => True
+    provide_chain   => True
+    notify_services => ['kubelet']
+    renew_seconds   => 952200
+    owner           => kube
+    group           => root
+    ensure          => present
+    before_services => []
+    hosts           => ['ml-serve1015', 'ml-serve1015.eqiad.wmnet', '10.64.167.6', '2620:0:861:12f:10:64:167:6']

File[/etc/udev/rules.d/75-kube_proxy_conntrack.rules]

Parameters differences:

--- File[/etc/udev/rules.d/75-kube_proxy_conntrack.rules].orig
+++ File[/etc/udev/rules.d/75-kube_proxy_conntrack.rules]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[udev_reload]
+    ensure => present

Content differences:

--- /etc/udev/rules.d/75-kube_proxy_conntrack.rules.orig
+++ /etc/udev/rules.d/75-kube_proxy_conntrack.rules
@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="module", KERNEL=="nf_conntrack", \
+    RUN+="/usr/lib/systemd/systemd-sysctl --prefix net.netfilter.nf_conntrack_max"

Exec[/usr/sbin/dpkg-reconfigure -p critical -f noninteractive wikimedia-lvs-realserver]

Parameters differences:

--- Exec[/usr/sbin/dpkg-reconfigure -p critical -f noninteractive wikimedia-lvs-realserver].orig
+++ Exec[/usr/sbin/dpkg-reconfigure -p critical -f noninteractive wikimedia-lvs-realserver]

+    subscribe   => File[/etc/default/wikimedia-lvs-realserver]
+    require     => Package[wikimedia-lvs-realserver]
+    refreshonly => True
+    path        => /bin:/sbin:/usr/bin:/usr/sbin

Apt::Package_from_bpo[firmware-amd-graphics-trixie-bpo]

Parameters differences:

--- Apt::Package_from_bpo[firmware-amd-graphics-trixie-bpo].orig
+++ Apt::Package_from_bpo[firmware-amd-graphics-trixie-bpo]

+    priority        => 1001
+    distro          => trixie
+    packages        => {'firmware-amd-graphics': '20251021-1~bpo13+1'}
+    ensure_packages => True

File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__system_node_ml-serve1015_eqiad_wmnet.pem]

+    mode   => 0440
+    group  => root
+    owner  => kube
+    ensure => file

File[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr
@@ -0,0 +1,18 @@
+{
+  "CN": "ml-serve1015.eqiad.wmnet",
+  "hosts": [
+    "ml-serve1015",
+    "ml-serve1015.eqiad.wmnet",
+    "docker-registry.discovery.wmnet",
+    "127.0.0.1",
+    "::1",
+    "localhost"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+
+  ]
+}

Systemd::Unit[ferm-ferm-service-auto-restart]

Parameters differences:

--- Systemd::Unit[ferm-ferm-service-auto-restart].orig
+++ Systemd::Unit[ferm-ferm-service-auto-restart]

+    override_filename => ferm-service-auto-restart
+    unit              => ferm
+    restart           => False
+    source            => puppet:///modules/profile/kubernetes/node/ferm_systemd_override
+    override          => True
+    require           => ['Class[Systemd]']
+    ensure            => present

File[/etc/kubernetes/pki/mlserve__istio-cni.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__istio-cni.chained.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__istio-cni.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/mlserve__istio-cni.chain.pem]
+    group   => root
+    owner   => root
+    ensure  => file

File[/etc/cni/net.d/calico-kubeconfig]

Parameters differences:

--- File[/etc/cni/net.d/calico-kubeconfig].orig
+++ File[/etc/cni/net.d/calico-kubeconfig]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => present

Content differences:

--- /etc/cni/net.d/calico-kubeconfig.orig
+++ /etc/cni/net.d/calico-kubeconfig
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: calico-cni
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://ml-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: calico-cni
+  user:
+    client-certificate: /etc/kubernetes/pki/mlserve__calico-cni.pem
+    client-key: /etc/kubernetes/pki/mlserve__calico-cni-key.pem

File[/etc/calico/pki]

Parameters differences:

--- File[/etc/calico/pki].orig
+++ File[/etc/calico/pki]

+    mode   => 0755
+    group  => root
+    owner  => root
+    ensure => absent

File[/usr/libexec/cpupower]

Parameters differences:

--- File[/usr/libexec/cpupower].orig
+++ File[/usr/libexec/cpupower]

+    mode   => 0555
+    group  => root
+    source => puppet:///modules/cpufrequtils/cpupower.sh
+    owner  => root
+    ensure => present

Package[wikimedia-lvs-realserver]

Parameters differences:

--- Package[wikimedia-lvs-realserver].orig
+++ Package[wikimedia-lvs-realserver]

+    require  => File[/etc/default/wikimedia-lvs-realserver]
+    ensure   => present
+    provider => apt

Concat::Fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]

Parameters differences:

--- Concat::Fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia].orig
+++ Concat::Fragment[component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia]

+    target => /etc/apt/sources.list.d/component-kubernetes131-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 10

Class[Containerd::Nerdctl]

Parameters differences:

--- Class[Containerd::Nerdctl].orig
+++ Class[Containerd::Nerdctl]

+    ensure    => present
+    namespace => k8s.io

Exec[Generate cert mlserve__calico-cni refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert mlserve__calico-cni refresh on intermediate ca change].orig
+++ Exec[Generate cert mlserve__calico-cni refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/kubernetes/pki/mlserve__calico-cni.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label mlserve  /etc/cfssl/csr/mlserve__calico-cni.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/mlserve__calico-cni

+    refreshonly => True

Cfssl::Csr[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/mlserve__system_node_ml-serve1015_eqiad_wmnet.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => system:node:ml-serve1015.eqiad.wmnet
+    names       => [{'organisation': 'system:nodes'}]
+    hosts       => []
+    ensure      => present

File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller-key.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__amdgpu-node-labeller-key.pem]

+    backup    => False
+    mode      => 0440
+    group     => amd-nodelabeller
+    owner     => amd-nodelabeller
+    show_diff => False
+    ensure    => file

Cfssl::Csr[/etc/cfssl/csr/mlserve__system_kube-proxy.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/mlserve__system_kube-proxy.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/mlserve__system_kube-proxy.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => system:kube-proxy
+    names       => [{'organisation': 'system:node-proxier'}]
+    hosts       => []
+    ensure      => present

Service[containerd]

Parameters differences:

--- Service[containerd].orig
+++ Service[containerd]

+    ensure => running

Concat::Fragment[main contacts]

File[/etc/cfssl/csr/mlserve__rsyslog.csr]

Parameters differences:

--- File[/etc/cfssl/csr/mlserve__rsyslog.csr].orig
+++ File[/etc/cfssl/csr/mlserve__rsyslog.csr]

+    mode   => 0400
+    group  => root
+    owner  => root
+    ensure => file

Content differences:

--- /etc/cfssl/csr/mlserve__rsyslog.csr.orig
+++ /etc/cfssl/csr/mlserve__rsyslog.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "rsyslog",
+  "hosts": [
+    "rsyslog"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Class[Base::Kernel]

Parameters differences:

--- Class[Base::Kernel].orig
+++ Class[Base::Kernel]

@@
-    overlayfs => False
+    overlayfs => True

Concat_file[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

Parameters differences:

--- Concat_file[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources].orig
+++ Concat_file[/etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]

+    backup         => puppet
+    mode           => 0444
+    group          => root
+    order          => alpha
+    tag            => _etc_apt_sources.list.d_component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    ensure_newline => False
+    force          => False
+    replace        => True
+    show_diff      => True
+    format         => plain
+    owner          => root

Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh on intermediate ca change].orig
+++ Exec[Generate cert discovery__ml-serve1015_eqiad_wmnet refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    subscribe   => File[/etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet.chain.pem]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/ml-serve1015.eqiad.wmnet.pem -label discovery  /etc/cfssl/csr/discovery__ml-serve1015_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/dragonfly/discovery__ml-serve1015_eqiad_wmnet

+    notify      => ['Service[dragonfly-dfdaemon]']
+    refreshonly => True

Cfssl::Cert[mlserve__rsyslog]

Parameters differences:

--- Cfssl::Cert[mlserve__rsyslog].orig
+++ Cfssl::Cert[mlserve__rsyslog]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => rsyslog
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    group           => root
+    ensure          => present
+    label           => mlserve
+    provide_chain   => True
+    names           => [{'organisation': 'view'}]
+    before_services => []
+    hosts           => []
+    auto_renew      => True
+    notify_services => ['rsyslog']
+    renew_seconds   => 952200
+    owner           => root

Concat_fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

Parameters differences:

--- Concat_fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia-header].orig
+++ Concat_fragment[component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

+    tag    => _etc_apt_sources.list.d_component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    target => /etc/apt/sources.list.d/component-calico329-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 01
+    source => puppet:///modules/apt/sources-deb822-header.txt

File[/lib/systemd/system/rsyslog-release-deleted-inotify-watches.timer]

Parameters differences:

--- File[/lib/systemd/system/rsyslog-release-deleted-inotify-watches.timer].orig
+++ File[/lib/systemd/system/rsyslog-release-deleted-inotify-watches.timer]

+    mode   => 0444
+    group  => root
+    owner  => root
+    notify => Exec[systemd daemon-reload for rsyslog-release-deleted-inotify-watches.timer (rsyslog-release-deleted-inotify-watches.timer)]
+    ensure => absent

Content differences:

--- /lib/systemd/system/rsyslog-release-deleted-inotify-watches.timer.orig
+++ /lib/systemd/system/rsyslog-release-deleted-inotify-watches.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of rsyslog-release-deleted-inotify-watches.service
+
+[Timer]
+Unit=rsyslog-release-deleted-inotify-watches.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-*-* *:54:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

K8s::Kubeconfig[/etc/cni/net.d/calico-kubeconfig]

Parameters differences:

--- K8s::Kubeconfig[/etc/cni/net.d/calico-kubeconfig].orig
+++ K8s::Kubeconfig[/etc/cni/net.d/calico-kubeconfig]

+    username    => calico-cni
+    mode        => 0400
+    group       => root
+    require     => ['File[/etc/cni/net.d]', 'Class[K8s::Base_dirs]']
+    ensure      => present
+    auth_cert   => {'cert': '/etc/kubernetes/pki/mlserve__calico-cni.pem', 'key': '/etc/kubernetes/pki/mlserve__calico-cni-key.pem', 'chain': '/etc/kubernetes/pki/mlserve__calico-cni.chain.pem', 'chained': '/etc/kubernetes/pki/mlserve__calico-cni.chained.pem'}
+    master_host => ml-ctrl.svc.eqiad.wmnet
+    owner       => root

Concat_fragment[main contacts]

Content differences:

--- main contacts.orig
+++ main contacts
@@ -1,3 +1,3 @@
 ---
-role::ml_k8s::insetup_gpu:
+role::ml_k8s::worker:
 - Machine Learning

File[/etc/kubernetes/pki/mlserve__calico-cni.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calico-cni.csr].orig
+++ File[/etc/kubernetes/pki/mlserve__calico-cni.csr]

+    mode   => 0440
+    group  => root
+    owner  => root
+    ensure => file

Class[Base::Sysctl::Inotify]

Parameters differences:

--- Class[Base::Sysctl::Inotify].orig
+++ Class[Base::Sysctl::Inotify]

+    max_user_watches   => 32768
+    max_user_instances => 512

Concat_fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

Parameters differences:

--- Concat_fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia-header].orig
+++ Concat_fragment[component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]

+    tag    => _etc_apt_sources.list.d_component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    target => /etc/apt/sources.list.d/component-istio115-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
+    order  => 01
+    source => puppet:///modules/apt/sources-deb822-header.txt

File[/etc/kubernetes/pki/mlserve__calico-cni.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__calico-cni.pem].orig
+++ File[/etc/kubernetes/pki/mlserve__calico-cni.pem]

+    mode   => 0440
+    group  => root
+    owner  => root
+    ensure => file

Systemd::Timer::Job[rsyslog-imfile-remedy]

Parameters differences:

--- Systemd::Timer::Job[rsyslog-imfile-remedy].orig
+++ Systemd::Timer::Job[rsyslog-imfile-remedy]

+    environment               => {}
+    logfile_basedir           => /var/log
+    logging_enabled           => False
+    description               => Restart rsyslog T357616
+    syslog_force_stop         => True
+    logfile_perms             => all
+    private_tmp               => False
+    logfile_group             => root
+    send_mail_only_on_error   => True
+    success_exit_status       => []
+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* 00/3:41:00'}
+    user                      => root
+    ignore_errors             => False
+    command                   => /usr/bin/systemctl try-restart rsyslog
+    logfile_name              => syslog.log
+    monitoring_enabled        => False
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    splay                     => 30
+    ensure                    => present
+    send_mail_to              => root@ml-serve1015.eqiad.wmnet
+    syslog_match_startswith   => True
+    send_mail                 => False
+    fixed_random_delay        => False
+    monitoring_contact_groups => admins

Apt::Pin[apt_pin_linux-6.16-trixie_trixie-bpo]

Parameters differences:

--- Apt::Pin[apt_pin_linux-6.16-trixie_trixie-bpo].orig
+++ Apt::Pin[apt_pin_linux-6.16-trixie_trixie-bpo]

+    package  => linux-image-6.16.3+deb13-amd64
+    before   => ['Package[linux-image-6.16.3+deb13-amd64]']
+    ensure   => present
+    notify   => Exec[exec-apt-get-update-linux-6.16-trixie_trixie-bpo]
+    priority => 1001
+    pin      => release a=trixie-backports

File[/etc/update-motd.d/05-ml-k8s--worker]

Parameters differences:

--- File[/etc/update-motd.d/05-ml-k8s--worker].orig
+++ File[/etc/update-motd.d/05-ml-k8s--worker]

+    owner  => root
+    group  => root
+    mode   => 0555
+    ensure => present

Content differences:

--- /etc/update-motd.d/05-ml-k8s--worker.orig
+++ /etc/update-motd.d/05-ml-k8s--worker
@@ -0,0 +1,2 @@
+#!/bin/sh
+printf "%s\n" "ml-serve1015 is a ML Kubernetes worker node (ml_k8s::worker)"

File[/etc/kubernetes/proxy.conf]

Parameters differences:

--- File[/etc/kubernetes/proxy.conf].orig
+++ File[/etc/kubernetes/proxy.conf]

+    mode   => 0400
+    group  => kube
+    owner  => kube
+    ensure => present

Content differences:

--- /etc/kubernetes/proxy.conf.orig
+++ /etc/kubernetes/proxy.conf
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: default-proxy
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://ml-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: default-proxy
+  user:
+    client-certificate: /etc/kubernetes/pki/mlserve__system_kube-proxy.pem
+    client-key: /etc/kubernetes/pki/mlserve__system_kube-proxy-key.pem

Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-auto-restart)]

Parameters differences:

--- Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-auto-restart)].orig
+++ Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-auto-restart)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True
+    before      => ['Service[ferm]']

Cfssl::Cert[mlserve__system_kube-proxy]

Parameters differences:

--- Cfssl::Cert[mlserve__system_kube-proxy].orig
+++ Cfssl::Cert[mlserve__system_kube-proxy]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    common_name     => system:kube-proxy
+    outdir          => /etc/kubernetes/pki
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    mode            => 0740
+    label           => mlserve
+    names           => [{'organisation': 'system:node-proxier'}]
+    auto_renew      => True
+    provide_chain   => True
+    notify_services => ['kube-proxy']
+    renew_seconds   => 952200
+    owner           => kube
+    group           => root
+    ensure          => present
+    before_services => []
+    hosts           => []

User[kube]

Parameters differences:

--- User[kube].orig
+++ User[kube]

+    gid    => kube
+    shell  => /usr/sbin/nologin
+    system => True
+    home   => /nonexistent
+    ensure => present

File[/etc/kubernetes/pki/mlserve__system_kube-proxy.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/mlserve__system_kube-proxy.csr].orig
+++ File[/etc/kubernetes/pki/mlserve__system_kube-proxy.csr]

+    mode   => 0440
+    group  => root
+    owner  => kube
+    ensure => file

File[/etc/kubernetes/kubelet-config.yaml]

Parameters differences:

--- File[/etc/kubernetes/kubelet-config.yaml].orig
+++ File[/etc/kubernetes/kubelet-config.yaml]

+    mode    => 0400
+    group   => kube
+    owner   => kube
+    notify  => Service[kubelet]
+    require => K8s::Package[kubelet]
+    ensure  => file

Content differences:

--- /etc/kubernetes/kubelet-config.yaml.orig
+++ /etc/kubernetes/kubelet-config.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+tlsPrivateKeyFile: "/etc/kubernetes/pki/mlserve__kubelet_server-key.pem"
+tlsCertFile: "/etc/kubernetes/pki/mlserve__kubelet_server.chained.pem"
+clusterDomain: cluster.local
+clusterDNS:
+- 10.67.0.3
+authentication:
+  anonymous:
+    enabled: false
+  webhook:
+    enabled: true
+  x509:
+    clientCAFile: "/etc/kubernetes/pki/mlserve__kubelet_server.chain.pem"
+authorization:
+  mode: Webhook
+cgroupDriver: systemd
+evictionHard:
+  imagefs.available: 15%
+  memory.available: 300M
+  nodefs.available: 10%
+  nodefs.inodesFree: 5%
+containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
+seccompDefault: true

Compilation results for ml-serve1015.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

Resources only in the old catalog

Resources modified

Relevant files