--- Exec[create chained cert /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem].orig
+++ Exec[create chained cert /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem]
- command => /bin/cat /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.pem /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem > /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chained.pem
- require => Exec[Generate cert discovery__wcqs_discovery_wmnet_server refresh on intermediate ca change]
- subscribe => ['Exec[renew certificate - discovery__wcqs_discovery_wmnet_server]', 'File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem]', 'File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.pem]']
- unless => /usr/bin/test "$(/bin/cat /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.pem /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem | sha512sum)" == "$(/bin/cat /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chained.pem | sha512sum)"
File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chained.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chained.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chained.pem]
+ require => Exec[create chained cert /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem]
+ group => envoy
+ owner => envoy
+ ensure => file
- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server-key.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server-key.pem].orig
+++ File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server-key.pem]
- owner => envoy
- ensure => file
- backup => False
- mode => 0440
- group => envoy
- show_diff => False
- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server-key.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server-key.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server-key.pem]
+ owner => envoy
+ ensure => file
+ backup => False
+ mode => 0440
+ group => envoy
+ show_diff => False
- File[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr]
- Parameters differences:
--- File[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr].orig
+++ File[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr]
- mode => 0400
- group => root
- owner => root
- ensure => file
- Content differences:
--- /etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr.orig
+++ /etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr
@@ -1,15 +0,0 @@
-{
- "CN": "wcqs.discovery.wmnet",
- "hosts": [
- "wcqs.svc.codfw.wmnet",
- "commons-query.wikimedia.org",
- "wcqs.discovery.wmnet"
- ],
- "key": {
- "algo": "ecdsa",
- "size": 256
- },
- "names": [
-
- ]
-}
- Class[Profile::Tlsproxy::Envoy]
- Parameters differences:
--- Class[Profile::Tlsproxy::Envoy].orig
+++ Class[Profile::Tlsproxy::Envoy]
@@
- cfssl_label => discovery
+ cfssl_label => discovery2026
- Cfssl::Cert[discovery__wcqs_discovery_wmnet_server]
- Parameters differences:
--- Cfssl::Cert[discovery__wcqs_discovery_wmnet_server].orig
+++ Cfssl::Cert[discovery__wcqs_discovery_wmnet_server]
- auto_renew => True
- key => {'algo': 'ecdsa', 'size': 256}
- outdir => /etc/envoy/ssl
- renew_seconds => 952200
- before_services => []
- require => Package[envoyproxy]
- owner => envoy
- hosts => ['wcqs.svc.codfw.wmnet', 'commons-query.wikimedia.org']
- environment => ['GODEBUG=x509ignoreCN=0']
- before => Exec[verify-envoy-config]
- common_name => wcqs.discovery.wmnet
- notify => Service[envoyproxy.service]
- profile => server
- ensure => present
- label => discovery
- group => envoy
- names => []
- notify_services => []
- provide_chain => True
- mode => 0740
- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.csr]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.csr].orig
+++ File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.csr]
- mode => 0440
- group => envoy
- owner => envoy
- ensure => file
- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem].orig
+++ File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem]
- source => puppet:///modules/profile/pki/intermediates/discovery-cert.pem
- owner => envoy
- ensure => file
- mode => 0440
- group => envoy
- Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server refresh]
- Parameters differences:
--- Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server refresh].orig
+++ Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server refresh]
+ refreshonly => True
+ command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/wcqs2003.codfw.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server
+ subscribe => File[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr]
+ environment => ['GODEBUG=x509ignoreCN=0']
- Exec[Generate cert discovery__wcqs_discovery_wmnet_server refresh]
- Parameters differences:
--- Exec[Generate cert discovery__wcqs_discovery_wmnet_server refresh].orig
+++ Exec[Generate cert discovery__wcqs_discovery_wmnet_server refresh]
- refreshonly => True
- command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/wcqs2003.codfw.wmnet.pem -label discovery -profile server /etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server
- subscribe => File[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr]
- environment => ['GODEBUG=x509ignoreCN=0']
- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.pem].orig
+++ File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.pem]
- mode => 0440
- group => envoy
- owner => envoy
- ensure => file
- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem]
+ source => puppet:///modules/profile/pki/intermediates/discovery2026-cert.pem
+ owner => envoy
+ ensure => file
+ mode => 0440
+ group => envoy
- Exec[renew certificate - discovery2026__wcqs_discovery_wmnet_server]
- Parameters differences:
--- Exec[renew certificate - discovery2026__wcqs_discovery_wmnet_server].orig
+++ Exec[renew certificate - discovery2026__wcqs_discovery_wmnet_server]
+ unless => /usr/bin/openssl x509 -in /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.pem -checkend 952200
+ command => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/wcqs2003.codfw.wmnet.pem -label discovery2026 -profile server /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server
+ require => Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server]
+ environment => ['GODEBUG=x509ignoreCN=0']
- Exec[create chained cert /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem]
- Parameters differences:
--- Exec[create chained cert /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem].orig
+++ Exec[create chained cert /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem]
+ command => /bin/cat /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.pem /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem > /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chained.pem
+ require => Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server refresh on intermediate ca change]
+ subscribe => ['Exec[renew certificate - discovery2026__wcqs_discovery_wmnet_server]', 'File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem]', 'File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.pem]']
+ unless => /usr/bin/test "$(/bin/cat /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.pem /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem | sha512sum)" == "$(/bin/cat /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chained.pem | sha512sum)"
- Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server refresh on intermediate ca change]
- Parameters differences:
--- Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server refresh on intermediate ca change].orig
+++ Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server refresh on intermediate ca change]
+ command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/wcqs2003.codfw.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server
+ require => Cfssl::Csr[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr]
+ subscribe => File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chain.pem]
+ refreshonly => True
+ environment => ['GODEBUG=x509ignoreCN=0']
- Exec[Generate cert discovery__wcqs_discovery_wmnet_server refresh on intermediate ca change]
- Parameters differences:
--- Exec[Generate cert discovery__wcqs_discovery_wmnet_server refresh on intermediate ca change].orig
+++ Exec[Generate cert discovery__wcqs_discovery_wmnet_server refresh on intermediate ca change]
- command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/wcqs2003.codfw.wmnet.pem -label discovery -profile server /etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server
- require => Cfssl::Csr[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr]
- subscribe => File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem]
- refreshonly => True
- environment => ['GODEBUG=x509ignoreCN=0']
- Envoyproxy::Tls_terminator[443]
- Parameters differences:
--- Envoyproxy::Tls_terminator[443].orig
+++ Envoyproxy::Tls_terminator[443]
@@
- global_certs => [{'cert_path': '/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chained.pem', 'key_path': '/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server-key.pem'}]
+ global_certs => [{'cert_path': '/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chained.pem', 'key_path': '/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server-key.pem'}]
- Exec[renew certificate - discovery__wcqs_discovery_wmnet_server]
- Parameters differences:
--- Exec[renew certificate - discovery__wcqs_discovery_wmnet_server].orig
+++ Exec[renew certificate - discovery__wcqs_discovery_wmnet_server]
- unless => /usr/bin/openssl x509 -in /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.pem -checkend 952200
- command => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/wcqs2003.codfw.wmnet.pem -label discovery -profile server /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server
- require => Exec[Generate cert discovery__wcqs_discovery_wmnet_server]
- environment => ['GODEBUG=x509ignoreCN=0']
- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chained.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chained.pem].orig
+++ File[/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chained.pem]
- require => Exec[create chained cert /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chain.pem]
- group => envoy
- owner => envoy
- ensure => file
- Envoyproxy::Conf[tls_terminator_443]
- Cfssl::Cert[discovery2026__wcqs_discovery_wmnet_server]
- Parameters differences:
--- Cfssl::Cert[discovery2026__wcqs_discovery_wmnet_server].orig
+++ Cfssl::Cert[discovery2026__wcqs_discovery_wmnet_server]
+ auto_renew => True
+ key => {'algo': 'ecdsa', 'size': 256}
+ outdir => /etc/envoy/ssl
+ renew_seconds => 952200
+ before_services => []
+ require => Package[envoyproxy]
+ owner => envoy
+ hosts => ['wcqs.svc.codfw.wmnet', 'commons-query.wikimedia.org']
+ environment => ['GODEBUG=x509ignoreCN=0']
+ before => Exec[verify-envoy-config]
+ common_name => wcqs.discovery.wmnet
+ notify => Service[envoyproxy.service]
+ profile => server
+ ensure => present
+ label => discovery2026
+ group => envoy
+ names => []
+ notify_services => []
+ provide_chain => True
+ mode => 0740
- Cfssl::Csr[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr]
- Parameters differences:
--- Cfssl::Csr[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr]
+ key => {'algo': 'ecdsa', 'size': 256}
+ names => []
+ common_name => wcqs.discovery.wmnet
+ ensure => present
+ hosts => ['wcqs.svc.codfw.wmnet', 'commons-query.wikimedia.org']
- File[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr]
- Parameters differences:
--- File[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr].orig
+++ File[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr]
+ mode => 0400
+ group => root
+ owner => root
+ ensure => file
- Content differences:
--- /etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr.orig
+++ /etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr
@@ -0,0 +1,15 @@
+{
+ "CN": "wcqs.discovery.wmnet",
+ "hosts": [
+ "wcqs.svc.codfw.wmnet",
+ "commons-query.wikimedia.org",
+ "wcqs.discovery.wmnet"
+ ],
+ "key": {
+ "algo": "ecdsa",
+ "size": 256
+ },
+ "names": [
+
+ ]
+}
- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.pem]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.pem]
+ mode => 0440
+ group => envoy
+ owner => envoy
+ ensure => file
- Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server]
- Parameters differences:
--- Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server].orig
+++ Exec[Generate cert discovery2026__wcqs_discovery_wmnet_server]
+ unless => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server-key.pem 2>&1)"
+ command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/wcqs2003.codfw.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server
+ require => Cfssl::Csr[/etc/cfssl/csr/discovery2026__wcqs_discovery_wmnet_server.csr]
+ environment => ['GODEBUG=x509ignoreCN=0']
- Cfssl::Csr[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr]
- Parameters differences:
--- Cfssl::Csr[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr]
- key => {'algo': 'ecdsa', 'size': 256}
- names => []
- common_name => wcqs.discovery.wmnet
- ensure => present
- hosts => ['wcqs.svc.codfw.wmnet', 'commons-query.wikimedia.org']
- Exec[Generate cert discovery__wcqs_discovery_wmnet_server]
- Parameters differences:
--- Exec[Generate cert discovery__wcqs_discovery_wmnet_server].orig
+++ Exec[Generate cert discovery__wcqs_discovery_wmnet_server]
- unless => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server-key.pem 2>&1)"
- command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/wcqs2003.codfw.wmnet.pem -label discovery -profile server /etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server
- require => Cfssl::Csr[/etc/cfssl/csr/discovery__wcqs_discovery_wmnet_server.csr]
- environment => ['GODEBUG=x509ignoreCN=0']
- File[/etc/envoy/listeners.d/00-tls_terminator_443.yaml]
- Content differences:
--- /etc/envoy/listeners.d/00-tls_terminator_443.yaml.orig
+++ /etc/envoy/listeners.d/00-tls_terminator_443.yaml
@@ -15,8 +15,8 @@
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
common_tls_context:
tls_certificates:
- - certificate_chain: { filename: "/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server.chained.pem" }
- private_key: { filename: "/etc/envoy/ssl/discovery__wcqs_discovery_wmnet_server-key.pem" }
+ - certificate_chain: { filename: "/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.chained.pem" }
+ private_key: { filename: "/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server-key.pem" }
filters:
- name: envoy.http_connection_manager
typed_config:
- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.csr]
- Parameters differences:
--- File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.csr].orig
+++ File[/etc/envoy/ssl/discovery2026__wcqs_discovery_wmnet_server.csr]
+ mode => 0440
+ group => envoy
+ owner => envoy
+ ensure => file