--- Envoyproxy::Tls_terminator[443].orig
+++ Envoyproxy::Tls_terminator[443]
@@
- global_certs => [{'cert_path': '/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chained.pem', 'key_path': '/etc/envoy/ssl/discovery__performance_discovery_wmnet_server-key.pem'}]
+ global_certs => [{'cert_path': '/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chained.pem', 'key_path': '/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server-key.pem'}]
File[/etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr]
- Parameters differences:
--- File[/etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr].orig
+++ File[/etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr]
- group => root
- mode => 0400
- owner => root
- ensure => file
- Content differences:
--- /etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr.orig
+++ /etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr
@@ -1,14 +0,0 @@
-{
- "CN": "performance.discovery.wmnet",
- "hosts": [
- "performance.wikimedia.org",
- "performance.discovery.wmnet"
- ],
- "key": {
- "algo": "ecdsa",
- "size": 256
- },
- "names": [
-
- ]
-}
- File[/etc/envoy/listeners.d/00-tls_terminator_443.yaml]
- Content differences:
--- /etc/envoy/listeners.d/00-tls_terminator_443.yaml.orig
+++ /etc/envoy/listeners.d/00-tls_terminator_443.yaml
@@ -15,8 +15,8 @@
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
common_tls_context:
tls_certificates:
- - certificate_chain: { filename: "/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chained.pem" }
- private_key: { filename: "/etc/envoy/ssl/discovery__performance_discovery_wmnet_server-key.pem" }
+ - certificate_chain: { filename: "/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chained.pem" }
+ private_key: { filename: "/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server-key.pem" }
filters:
- name: envoy.http_connection_manager
typed_config:
- File[/etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr]
- Parameters differences:
--- File[/etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr].orig
+++ File[/etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr]
+ group => root
+ mode => 0400
+ owner => root
+ ensure => file
- Content differences:
--- /etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr.orig
+++ /etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr
@@ -0,0 +1,14 @@
+{
+ "CN": "performance.discovery.wmnet",
+ "hosts": [
+ "performance.wikimedia.org",
+ "performance.discovery.wmnet"
+ ],
+ "key": {
+ "algo": "ecdsa",
+ "size": 256
+ },
+ "names": [
+
+ ]
+}
- Exec[Generate cert discovery2026__performance_discovery_wmnet_server]
- Parameters differences:
--- Exec[Generate cert discovery2026__performance_discovery_wmnet_server].orig
+++ Exec[Generate cert discovery2026__performance_discovery_wmnet_server]
+ require => Cfssl::Csr[/etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr]
+ unless => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server-key.pem 2>&1)"
+ environment => ['GODEBUG=x509ignoreCN=0']
+ command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/webperf1003.eqiad.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server
- Cfssl::Cert[discovery__performance_discovery_wmnet_server]
- Parameters differences:
--- Cfssl::Cert[discovery__performance_discovery_wmnet_server].orig
+++ Cfssl::Cert[discovery__performance_discovery_wmnet_server]
- group => envoy
- mode => 0740
- key => {'algo': 'ecdsa', 'size': 256}
- before => Exec[verify-envoy-config]
- environment => ['GODEBUG=x509ignoreCN=0']
- label => discovery
- names => []
- owner => envoy
- hosts => ['performance.wikimedia.org']
- provide_chain => True
- before_services => []
- notify => Service[envoyproxy.service]
- notify_services => []
- common_name => performance.discovery.wmnet
- auto_renew => True
- require => Package[envoyproxy]
- profile => server
- renew_seconds => 952200
- ensure => present
- outdir => /etc/envoy/ssl
- Envoyproxy::Listener[tls_terminator_443]
- File[/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chained.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chained.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chained.pem]
+ group => envoy
+ require => Exec[create chained cert /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem]
+ owner => envoy
+ ensure => file
- File[/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.pem].orig
+++ File[/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.pem]
- group => envoy
- mode => 0440
- owner => envoy
- ensure => file
- Cfssl::Csr[/etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr]
- Parameters differences:
--- Cfssl::Csr[/etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr]
- key => {'algo': 'ecdsa', 'size': 256}
- ensure => present
- names => []
- common_name => performance.discovery.wmnet
- hosts => ['performance.wikimedia.org']
- File[/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem]
+ group => envoy
+ mode => 0440
+ ensure => file
+ owner => envoy
+ source => puppet:///modules/profile/pki/intermediates/discovery2026-cert.pem
- Exec[Generate cert discovery__performance_discovery_wmnet_server]
- Parameters differences:
--- Exec[Generate cert discovery__performance_discovery_wmnet_server].orig
+++ Exec[Generate cert discovery__performance_discovery_wmnet_server]
- require => Cfssl::Csr[/etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr]
- unless => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/envoy/ssl/discovery__performance_discovery_wmnet_server-key.pem 2>&1)"
- environment => ['GODEBUG=x509ignoreCN=0']
- command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/webperf1003.eqiad.wmnet.pem -label discovery -profile server /etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__performance_discovery_wmnet_server
- Exec[create chained cert /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chain.pem]
- Parameters differences:
--- Exec[create chained cert /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chain.pem].orig
+++ Exec[create chained cert /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chain.pem]
- require => Exec[Generate cert discovery__performance_discovery_wmnet_server refresh on intermediate ca change]
- unless => /usr/bin/test "$(/bin/cat /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.pem /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chain.pem | sha512sum)" == "$(/bin/cat /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chained.pem | sha512sum)"
- subscribe => ['Exec[renew certificate - discovery__performance_discovery_wmnet_server]', 'File[/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chain.pem]', 'File[/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.pem]']
- command => /bin/cat /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.pem /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chain.pem > /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.chained.pem
- File[/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.csr]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.csr].orig
+++ File[/etc/envoy/ssl/discovery__performance_discovery_wmnet_server.csr]
- group => envoy
- mode => 0440
- owner => envoy
- ensure => file
- Exec[create chained cert /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem]
- Parameters differences:
--- Exec[create chained cert /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem].orig
+++ Exec[create chained cert /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem]
+ require => Exec[Generate cert discovery2026__performance_discovery_wmnet_server refresh on intermediate ca change]
+ unless => /usr/bin/test "$(/bin/cat /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.pem /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem | sha512sum)" == "$(/bin/cat /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chained.pem | sha512sum)"
+ subscribe => ['Exec[renew certificate - discovery2026__performance_discovery_wmnet_server]', 'File[/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem]', 'File[/etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.pem]']
+ command => /bin/cat /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.pem /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chain.pem > /etc/envoy/ssl/discovery2026__performance_discovery_wmnet_server.chained.pem
- Exec[Generate cert discovery__performance_discovery_wmnet_server refresh]
- Parameters differences:
--- Exec[Generate cert discovery__performance_discovery_wmnet_server refresh].orig
+++ Exec[Generate cert discovery__performance_discovery_wmnet_server refresh]
- subscribe => File[/etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr]
- refreshonly => True
- environment => ['GODEBUG=x509ignoreCN=0']
- command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/webperf1003.eqiad.wmnet.pem -label discovery -profile server /etc/cfssl/csr/discovery__performance_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__performance_discovery_wmnet_server
- Cfssl::Csr[/etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr]
- Parameters differences:
--- Cfssl::Csr[/etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/discovery2026__performance_discovery_wmnet_server.csr]
+ key => {'algo': 'ecdsa', 'size': 256}
+ ensure => present
+ names => []
+ common_name => performance.discovery.wmnet
+ hosts => ['performance.wikimedia.org']
- Exec[renew certificate - discovery__performance_discovery_wmnet_server]
- Parameters differences:
--- Exec[renew certificate - discovery__performance_discovery_wmnet_server].orig
+++ Exec[renew certificate - discovery__performance_discovery_wmnet_server]
- require => Exec[Generate cert discovery__performance_discovery_wmnet_server]
- unless => /usr/bin/openssl x509 -in /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.pem -checkend 952200
- environment => ['GODEBUG=x509ignoreCN=0']
- command => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/webperf1003.eqiad.wmnet.pem -label discovery -profile server /etc/envoy/ssl/discovery__performance_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__performance_discovery_wmnet_server