Compilation results for planet1003.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

• Exec[Generate cert discovery2026__planet_discovery_wmnet_server]
• Exec[renew certificate - discovery2026__planet_discovery_wmnet_server]
• Cfssl::Csr[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]
• Exec[create chained cert /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]
• Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh]
• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]
• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.csr]
• File[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]
• Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh on intermediate ca change]
• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chained.pem]
• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem]
• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server-key.pem]
• Cfssl::Cert[discovery2026__planet_discovery_wmnet_server]

Resources only in the old catalog

• Exec[Generate cert discovery__planet_discovery_wmnet_server refresh]
• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server-key.pem]
• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem]
• Exec[create chained cert /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]
• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.csr]
• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chained.pem]
• Exec[Generate cert discovery__planet_discovery_wmnet_server]
• Exec[Generate cert discovery__planet_discovery_wmnet_server refresh on intermediate ca change]
• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]
• Exec[renew certificate - discovery__planet_discovery_wmnet_server]
• File[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]
• Cfssl::Csr[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]
• Cfssl::Cert[discovery__planet_discovery_wmnet_server]

Resources modified

• Envoyproxy::Conf[tls_terminator_443]

• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem].orig
  +++ File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem]
  
  -    mode   => 0440
  -    owner  => envoy
  -    group  => envoy
  -    ensure => file
  

• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server-key.pem]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server-key.pem].orig
  +++ File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server-key.pem]
  
  -    show_diff => False
  -    ensure    => file
  -    mode      => 0440
  -    backup    => False
  -    owner     => envoy
  -    group     => envoy
  

• Exec[Generate cert discovery__planet_discovery_wmnet_server refresh]

  Parameters differences:

  --- Exec[Generate cert discovery__planet_discovery_wmnet_server refresh].orig
  +++ Exec[Generate cert discovery__planet_discovery_wmnet_server refresh]
  
  -    subscribe   => File[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/planet1003.eqiad.wmnet.pem -label discovery -profile server /etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__planet_discovery_wmnet_server
  
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Cfssl::Cert[discovery2026__planet_discovery_wmnet_server]

  Parameters differences:

  --- Cfssl::Cert[discovery2026__planet_discovery_wmnet_server].orig
  +++ Cfssl::Cert[discovery2026__planet_discovery_wmnet_server]
  
  +    notify_services => []
  +    names           => []
  +    hosts           => ['planet.wikimedia.org', '*.planet.wikimedia.org']
  +    mode            => 0740
  +    provide_chain   => True
  +    owner           => envoy
  +    environment     => ['GODEBUG=x509ignoreCN=0']
  +    key             => {'algo': 'ecdsa', 'size': 256}
  +    renew_seconds   => 952200
  +    label           => discovery2026
  +    ensure          => present
  +    before_services => []
  +    notify          => Service[envoyproxy.service]
  +    group           => envoy
  +    common_name     => planet.discovery.wmnet
  +    profile         => server
  +    auto_renew      => True
  +    before          => Exec[verify-envoy-config]
  +    require         => Package[envoyproxy]
  +    outdir          => /etc/envoy/ssl
  

• Cfssl::Csr[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]
  
  -    hosts       => ['planet.wikimedia.org', '*.planet.wikimedia.org']
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    names       => []
  -    ensure      => present
  -    common_name => planet.discovery.wmnet
  

• Exec[Generate cert discovery__planet_discovery_wmnet_server]

  Parameters differences:

  --- Exec[Generate cert discovery__planet_discovery_wmnet_server].orig
  +++ Exec[Generate cert discovery__planet_discovery_wmnet_server]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/planet1003.eqiad.wmnet.pem -label discovery -profile server /etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__planet_discovery_wmnet_server
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/envoy/ssl/discovery__planet_discovery_wmnet_server-key.pem 2>&1)"
  
  

• File[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr].orig
  +++ File[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]
  
  +    mode   => 0400
  +    owner  => root
  +    group  => root
  +    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr.orig
  +++ /etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr
  @@ -0,0 +1,15 @@
  +{
  +  "CN": "planet.discovery.wmnet",
  +  "hosts": [
  +    "planet.wikimedia.org",
  +    "*.planet.wikimedia.org",
  +    "planet.discovery.wmnet"
  +  ],
  +  "key": {
  +    "algo": "ecdsa",
  +    "size": 256
  +  },
  +  "names": [
  +
  +  ]
  +}

• Exec[renew certificate - discovery2026__planet_discovery_wmnet_server]

  Parameters differences:

  --- Exec[renew certificate - discovery2026__planet_discovery_wmnet_server].orig
  +++ Exec[renew certificate - discovery2026__planet_discovery_wmnet_server]
  
  +    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/planet1003.eqiad.wmnet.pem -label discovery2026 -profile server /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server
  
  +    require     => Exec[Generate cert discovery2026__planet_discovery_wmnet_server]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/openssl x509 -in /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem -checkend 952200
  

• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.csr]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.csr].orig
  +++ File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.csr]
  
  +    mode   => 0440
  +    owner  => envoy
  +    group  => envoy
  +    ensure => file
  

• Exec[create chained cert /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem].orig
  +++ Exec[create chained cert /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]
  
  +    subscribe => ['Exec[renew certificate - discovery2026__planet_discovery_wmnet_server]', 'File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]', 'File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem]']
  +    command   => /bin/cat /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem > /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chained.pem
  +    require   => Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh on intermediate ca change]
  +    unless    => /usr/bin/test "$(/bin/cat /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem | sha512sum)" == "$(/bin/cat /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chained.pem | sha512sum)"
  
  

• Envoyproxy::Tls_terminator[443]

  Parameters differences:

  --- Envoyproxy::Tls_terminator[443].orig
  +++ Envoyproxy::Tls_terminator[443]
  
  @@
  -    global_certs => [{'cert_path': '/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chained.pem', 'key_path': '/etc/envoy/ssl/discovery__planet_discovery_wmnet_server-key.pem'}]
  +    global_certs => [{'cert_path': '/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chained.pem', 'key_path': '/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server-key.pem'}]
  

• Exec[Generate cert discovery__planet_discovery_wmnet_server refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert discovery__planet_discovery_wmnet_server refresh on intermediate ca change].orig
  +++ Exec[Generate cert discovery__planet_discovery_wmnet_server refresh on intermediate ca change]
  
  -    subscribe   => File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    require     => Cfssl::Csr[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/planet1003.eqiad.wmnet.pem -label discovery -profile server /etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__planet_discovery_wmnet_server
  
  -    refreshonly => True
  

• Exec[renew certificate - discovery__planet_discovery_wmnet_server]

  Parameters differences:

  --- Exec[renew certificate - discovery__planet_discovery_wmnet_server].orig
  +++ Exec[renew certificate - discovery__planet_discovery_wmnet_server]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/planet1003.eqiad.wmnet.pem -label discovery -profile server /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__planet_discovery_wmnet_server
  
  -    require     => Exec[Generate cert discovery__planet_discovery_wmnet_server]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem -checkend 952200
  

• File[/etc/envoy/listeners.d/00-tls_terminator_443.yaml]

  Content differences:

  --- /etc/envoy/listeners.d/00-tls_terminator_443.yaml.orig
  +++ /etc/envoy/listeners.d/00-tls_terminator_443.yaml
  @@ -15,8 +15,8 @@
         '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
         common_tls_context:
           tls_certificates:
  -        - certificate_chain: { filename: "/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chained.pem" }
  -          private_key: { filename: "/etc/envoy/ssl/discovery__planet_discovery_wmnet_server-key.pem" }
  +        - certificate_chain: { filename: "/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chained.pem" }
  +          private_key: { filename: "/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server-key.pem" }
     filters:
     - name: envoy.http_connection_manager
       typed_config:

• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.csr]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.csr].orig
  +++ File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.csr]
  
  -    mode   => 0440
  -    owner  => envoy
  -    group  => envoy
  -    ensure => file
  

• Exec[Generate cert discovery2026__planet_discovery_wmnet_server]

  Parameters differences:

  --- Exec[Generate cert discovery2026__planet_discovery_wmnet_server].orig
  +++ Exec[Generate cert discovery2026__planet_discovery_wmnet_server]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/planet1003.eqiad.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server
  
  +    require     => Cfssl::Csr[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server-key.pem 2>&1)"
  
  

• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chained.pem]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chained.pem].orig
  +++ File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chained.pem]
  
  -    require => Exec[create chained cert /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]
  -    owner   => envoy
  -    group   => envoy
  -    ensure  => file
  

• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem].orig
  +++ File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]
  
  +    source => puppet:///modules/profile/pki/intermediates/discovery2026-cert.pem
  +    ensure => file
  +    mode   => 0440
  +    owner  => envoy
  +    group  => envoy
  

• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chained.pem]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chained.pem].orig
  +++ File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chained.pem]
  
  +    require => Exec[create chained cert /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]
  +    owner   => envoy
  +    group   => envoy
  +    ensure  => file
  

• Exec[create chained cert /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem].orig
  +++ Exec[create chained cert /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]
  
  -    subscribe => ['Exec[renew certificate - discovery__planet_discovery_wmnet_server]', 'File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]', 'File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem]']
  -    command   => /bin/cat /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem > /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chained.pem
  -    require   => Exec[Generate cert discovery__planet_discovery_wmnet_server refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.pem /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem | sha512sum)" == "$(/bin/cat /etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chained.pem | sha512sum)"
  
  

• File[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr].orig
  +++ File[/etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr.orig
  +++ /etc/cfssl/csr/discovery__planet_discovery_wmnet_server.csr
  @@ -1,15 +0,0 @@
  -{
  -  "CN": "planet.discovery.wmnet",
  -  "hosts": [
  -    "planet.wikimedia.org",
  -    "*.planet.wikimedia.org",
  -    "planet.discovery.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server-key.pem]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server-key.pem].orig
  +++ File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server-key.pem]
  
  +    show_diff => False
  +    ensure    => file
  +    mode      => 0440
  +    backup    => False
  +    owner     => envoy
  +    group     => envoy
  

• File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem].orig
  +++ File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.pem]
  
  +    mode   => 0440
  +    owner  => envoy
  +    group  => envoy
  +    ensure => file
  

• File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]

  Parameters differences:

  --- File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem].orig
  +++ File[/etc/envoy/ssl/discovery__planet_discovery_wmnet_server.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/discovery-cert.pem
  -    ensure => file
  -    mode   => 0440
  -    owner  => envoy
  -    group  => envoy
  

• Cfssl::Cert[discovery__planet_discovery_wmnet_server]

  Parameters differences:

  --- Cfssl::Cert[discovery__planet_discovery_wmnet_server].orig
  +++ Cfssl::Cert[discovery__planet_discovery_wmnet_server]
  
  -    notify_services => []
  -    names           => []
  -    hosts           => ['planet.wikimedia.org', '*.planet.wikimedia.org']
  -    mode            => 0740
  -    provide_chain   => True
  -    owner           => envoy
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    renew_seconds   => 952200
  -    label           => discovery
  -    ensure          => present
  -    before_services => []
  -    notify          => Service[envoyproxy.service]
  -    group           => envoy
  -    common_name     => planet.discovery.wmnet
  -    profile         => server
  -    auto_renew      => True
  -    before          => Exec[verify-envoy-config]
  -    require         => Package[envoyproxy]
  -    outdir          => /etc/envoy/ssl
  

• Class[Profile::Tlsproxy::Envoy]

  Parameters differences:

  --- Class[Profile::Tlsproxy::Envoy].orig
  +++ Class[Profile::Tlsproxy::Envoy]
  
  @@
  -    cfssl_label => discovery
  +    cfssl_label => discovery2026
  

• Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh on intermediate ca change].orig
  +++ Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh on intermediate ca change]
  
  +    subscribe   => File[/etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server.chain.pem]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    require     => Cfssl::Csr[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/planet1003.eqiad.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server
  
  +    refreshonly => True
  

• Envoyproxy::Listener[tls_terminator_443]

• Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh]

  Parameters differences:

  --- Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh].orig
  +++ Exec[Generate cert discovery2026__planet_discovery_wmnet_server refresh]
  
  +    subscribe   => File[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/planet1003.eqiad.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__planet_discovery_wmnet_server
  
  +    refreshonly => True
  +    environment => ['GODEBUG=x509ignoreCN=0']
  

• Cfssl::Csr[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/discovery2026__planet_discovery_wmnet_server.csr]
  
  +    hosts       => ['planet.wikimedia.org', '*.planet.wikimedia.org']
  +    key         => {'algo': 'ecdsa', 'size': 256}
  +    names       => []
  +    ensure      => present
  +    common_name => planet.discovery.wmnet
  

Relevant files

• Production catalog
• Change catalog
• Production errors/warnings
• Change errors/warnings
• Core Diff
• Standard Diff