Compilation results for deploy1003.eqiad.wmnet: System changes detected

You can retrieve this result from host.json.

Catalog differences

Summary

Total Resources:	17015
Resources added:	210
Resources removed:	0
Resources modified:	215
Change percentage:	2.50%

Resources only in the new catalog

File[/etc/kubernetes/pki/dse__opensearch-ttmserver.csr]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.csr]
Exec[Generate cert dse__opensearch-apifeatureusage refresh on intermediate ca change]
File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-ttmserver]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]
Exec[Generate cert dse__opensearch-ttmserver]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem]
File[/etc/kubernetes/pki/dse__opensearch-toolhub.pem]
Exec[renew certificate - dse__opensearch-toolhub]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]
K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chained.pem]
File[/etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem]
Cfssl::Cert[dse__opensearch-apifeatureusage-test-deploy]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.csr]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]
File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-ttmserver-test]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem]
Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh]
File[/etc/kubernetes/pki/dse__opensearch-toolhub.chained.pem]
Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh]
Cfssl::Cert[dse__opensearch-ttmserver]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]
Exec[Generate cert dse__opensearch-toolhub-deploy]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub.csr]
Cfssl::Cert[dse__opensearch-ttmserver-test]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chained.pem]
Cfssl::Cert[dse__opensearch-ttmserver-deploy]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-key.pem]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chained.pem]
File[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]
File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-toolhub]
K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.csr]
Exec[Generate cert dse__opensearch-toolhub-deploy refresh on intermediate ca change]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem]
Exec[renew certificate - dse__opensearch-toolhub-test]
Exec[Generate cert dse__opensearch-ttmserver-test refresh on intermediate ca change]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]
File[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]
Cfssl::Cert[dse__opensearch-toolhub-deploy]
Exec[renew certificate - dse__opensearch-apifeatureusage-test-deploy]
File[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config]
File[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config]
Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh on intermediate ca change]
Exec[Generate cert dse__opensearch-ttmserver refresh]
Exec[Generate cert dse__opensearch-ttmserver-test]
Cfssl::Cert[dse__opensearch-apifeatureusage-test]
Exec[Generate cert dse__opensearch-ttmserver-deploy]
Exec[Generate cert dse__opensearch-ttmserver-test-deploy]
Exec[renew certificate - dse__opensearch-apifeatureusage-deploy]
Exec[Generate cert dse__opensearch-toolhub-test refresh]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]
K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]
Exec[Generate cert dse__opensearch-apifeatureusage refresh]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]
Cfssl::Cert[dse__opensearch-toolhub-test]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]
File[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config]
K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config]
File[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config]
File[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver.pem]
File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-toolhub-test]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem]
File[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem]
Exec[renew certificate - dse__opensearch-ttmserver-test-deploy]
File[/etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chained.pem]
K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config]
File[/etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config]
Cfssl::Cert[dse__opensearch-apifeatureusage]
Exec[renew certificate - dse__opensearch-toolhub-test-deploy]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem]
K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chained.pem]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.csr]
File[/etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chained.pem]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem]
File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]
K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]
Cfssl::Cert[dse__opensearch-toolhub-test-deploy]
K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config]
File[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]
Exec[Generate cert dse__opensearch-toolhub]
Exec[Generate cert dse__opensearch-toolhub-test refresh on intermediate ca change]
File[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]
File[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config]
Exec[renew certificate - dse__opensearch-toolhub-deploy]
Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy]
K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config]
K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config]
Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh on intermediate ca change]
K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem]
File[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config]
K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config]
Exec[Generate cert dse__opensearch-ttmserver-deploy refresh]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]
File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-apifeatureusage]
K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config]
Cfssl::Cert[dse__opensearch-toolhub]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.csr]
Exec[renew certificate - dse__opensearch-ttmserver]
Exec[renew certificate - dse__opensearch-ttmserver-test]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.csr]
K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config]
K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config]
Exec[Generate cert dse__opensearch-ttmserver-deploy refresh on intermediate ca change]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]
K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chained.pem]
File[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]
Exec[Generate cert dse__opensearch-apifeatureusage]
File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]
K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]
File[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chained.pem]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.pem]
K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config]
Exec[renew certificate - dse__opensearch-apifeatureusage]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]
Cfssl::Cert[dse__opensearch-ttmserver-test-deploy]
Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]
K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config]
K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.csr]
Exec[Generate cert dse__opensearch-toolhub-test-deploy]
Exec[Generate cert dse__opensearch-toolhub refresh on intermediate ca change]
Exec[Generate cert dse__opensearch-toolhub refresh]
K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.csr]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.csr]
File[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chained.pem]
K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config]
File[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]
File[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config]
File[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config]
Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]
Exec[Generate cert dse__opensearch-ttmserver-test refresh]
File[/etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config]
Exec[Generate cert dse__opensearch-toolhub-deploy refresh]
File[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]
Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh on intermediate ca change]
Exec[Generate cert dse__opensearch-ttmserver refresh on intermediate ca change]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]
File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]
File[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]
Exec[Generate cert dse__opensearch-toolhub-test]
File[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config]
File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-apifeatureusage-test]
Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]
Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]
Exec[Generate cert dse__opensearch-apifeatureusage-test]
File[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config]
Exec[renew certificate - dse__opensearch-ttmserver-deploy]
Cfssl::Cert[dse__opensearch-apifeatureusage-deploy]
File[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub.csr]
Exec[Generate cert dse__opensearch-apifeatureusage-deploy]
K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]
File[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.csr]
Exec[Generate cert dse__opensearch-apifeatureusage-test refresh on intermediate ca change]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chained.pem]
File[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config]
K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config]
File[/etc/cfssl/csr/dse__opensearch-toolhub.csr]
File[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem]
File[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config]
Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh on intermediate ca change]
Exec[Generate cert dse__opensearch-apifeatureusage-test refresh]
File[/etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem]
File[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config]
File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]
Exec[renew certificate - dse__opensearch-apifeatureusage-test]
File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chained.pem]

Resources modified

K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-apifeatureusage-deploy
+    namespace   => opensearch-apifeatureusage
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

File[/etc/profile.d/kube-conf.sh]

Content differences:

--- /etc/profile.d/kube-conf.sh.orig
+++ /etc/profile.d/kube-conf.sh
@@ -3,7 +3,7 @@
 
 # kube environments
 export KUBE_ENV_ENVIRONMENTS="eqiad codfw staging staging-eqiad staging-codfw ml-serve-eqiad ml-serve-codfw ml-staging-codfw dse-k8s-eqiad dse-k8s-codfw aux-k8s-eqiad aux-k8s-codfw"
-export KUBE_ENV_SERVICES="admin apertium api-gateway benthos-cache-invalidator changeprop changeprop-jobqueue chart-renderer cirrus-streaming-updater citoid commons-impact-analytics cxserver data-gateway developer-portal device-analytics echostore edit-analytics editor-analytics eventgate-analytics eventgate-analytics-external eventgate-logging-external eventgate-main eventstreams eventstreams-internal failoid-ng geo-analytics ipoid kartotherian linked-artifacts linkrecommendation machinetranslation mathoid media-analytics miscweb mobileapps mw-api-ext mw-api-int mw-cron mw-debug mw-experimental mw-jobrunner mw-mcrouter mw-misc mw-page-content-change-enrich mw-parsoid mw-script mw-videoscaler mw-web mw-wikifunctions opentelemetry-collector page-analytics proton push-notifications ratelimit ratelimit-media rdf-streaming-updater recommendation-api rest-gateway sessionstore shellbox shellbox-constraints shellbox-media shellbox-syntaxhighlight shellbox-timeline shellbox-video tegola-vector-tiles termbox thumbor toolhub wikidata-query-gui wikifeeds wikifunctions zotero article-descriptions article-models articletopic-outlink edit-check experimental llm logo-detection ores-legacy readability recommendation-api-ng revertrisk revise-tone-task-generator revision-models revscoring-articlequality revscoring-articletopic revscoring-draftquality revscoring-drafttopic revscoring-editquality-damaging revscoring-editquality-goodfaith revscoring-editquality-reverted analytics analytics-test kafka-mirrormaker opensearch-ipoid opensearch-ipoid-test opensearch-operator opensearch-operator-3 opensearch-semantic-search opensearch-semantic-search-test opensearch-test echoserver airflow-analytics-product airflow-analytics-test airflow-dev airflow-fr-tech airflow-main airflow-ml airflow-platform-eng airflow-research airflow-search airflow-sre airflow-test-k8s airflow-wikidata airflow-wmde blunderbuss datahub datahub-next datasets-config datasets-config-next growthbook growthbook-next llm-inference mediawiki-dumps-legacy mw-content-history-reconcile-enrich mw-content-history-reconcile-enrich-next mw-dump-rev-content-reconcile-enrich mw-dump-rev-content-reconcile-enrich-next mw-page-html-content-change-enrich mw-page-html-content-change-enrich-next mw-page-html-feature-counts-change-enrich mw-page-html-feature-counts-change-enrich-next spark spark-history spark-history-test superset superset-next test-kitchen test-kitchen-next turnilo turnilo-next wdqs-queryhammer codesearch jaeger redioscope sophroid zarcillo"
+export KUBE_ENV_SERVICES="admin apertium api-gateway benthos-cache-invalidator changeprop changeprop-jobqueue chart-renderer cirrus-streaming-updater citoid commons-impact-analytics cxserver data-gateway developer-portal device-analytics echostore edit-analytics editor-analytics eventgate-analytics eventgate-analytics-external eventgate-logging-external eventgate-main eventstreams eventstreams-internal failoid-ng geo-analytics ipoid kartotherian linked-artifacts linkrecommendation machinetranslation mathoid media-analytics miscweb mobileapps mw-api-ext mw-api-int mw-cron mw-debug mw-experimental mw-jobrunner mw-mcrouter mw-misc mw-page-content-change-enrich mw-parsoid mw-script mw-videoscaler mw-web mw-wikifunctions opentelemetry-collector page-analytics proton push-notifications ratelimit ratelimit-media rdf-streaming-updater recommendation-api rest-gateway sessionstore shellbox shellbox-constraints shellbox-media shellbox-syntaxhighlight shellbox-timeline shellbox-video tegola-vector-tiles termbox thumbor toolhub wikidata-query-gui wikifeeds wikifunctions zotero article-descriptions article-models articletopic-outlink edit-check experimental llm logo-detection ores-legacy readability recommendation-api-ng revertrisk revise-tone-task-generator revision-models revscoring-articlequality revscoring-articletopic revscoring-draftquality revscoring-drafttopic revscoring-editquality-damaging revscoring-editquality-goodfaith revscoring-editquality-reverted analytics analytics-test kafka-mirrormaker opensearch-ipoid opensearch-ipoid-test opensearch-operator opensearch-operator-3 opensearch-semantic-search opensearch-semantic-search-test opensearch-test opensearch-toolhub opensearch-toolhub-test opensearch-apifeatureusage opensearch-apifeatureusage-test opensearch-ttmserver opensearch-ttmserver-test echoserver airflow-analytics-product airflow-analytics-test airflow-dev airflow-fr-tech airflow-main airflow-ml airflow-platform-eng airflow-research airflow-search airflow-sre airflow-test-k8s airflow-wikidata airflow-wmde blunderbuss datahub datahub-next datasets-config datasets-config-next growthbook growthbook-next llm-inference mediawiki-dumps-legacy mw-content-history-reconcile-enrich mw-content-history-reconcile-enrich-next mw-dump-rev-content-reconcile-enrich mw-dump-rev-content-reconcile-enrich-next mw-page-html-content-change-enrich mw-page-html-content-change-enrich-next mw-page-html-feature-counts-change-enrich mw-page-html-feature-counts-change-enrich-next spark spark-history spark-history-test superset superset-next test-kitchen test-kitchen-next turnilo turnilo-next wdqs-queryhammer codesearch jaeger redioscope sophroid zarcillo"
 
 # Array that maps kubernetes environments to their respective versions
 # This duplicated information from KUBE_ENV_ENVIRONMENTS, but I did not want to break existing scripts

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

File[/etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-toolhub
+    namespace: opensearch-toolhub
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-toolhub
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-toolhub.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-toolhub-key.pem

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-ttmserver-test-deploy
+    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    ensure      => present
+    hosts       => []

Exec[Generate cert dse__opensearch-apifeatureusage-test refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-test refresh].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-test refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]

Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-toolhub-test
+    names       => [{'organisation': 'view'}]
+    ensure      => present
+    hosts       => []

K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-apifeatureusage-test
+    namespace   => opensearch-apifeatureusage-test
+    require     => ['Class[K8s::Base_dirs]']

Exec[Generate cert dse__opensearch-ttmserver-test-deploy]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-test-deploy].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-test-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]

File[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-ttmserver-test-deploy
+    namespace: opensearch-ttmserver-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-ttmserver-test-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem

K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-ttmserver-deploy
+    namespace   => opensearch-ttmserver
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr
@@ -0,0 +1,26 @@
+{
+  "CN": "opensearch-apifeatureusage-deploy",
+  "hosts": [
+    "opensearch-apifeatureusage-deploy"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    },
+    {
+      "C": null,
+      "L": null,
+      "O": "deploy",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-apifeatureusage-test
+    names       => [{'organisation': 'view'}]
+    ensure      => present
+    hosts       => []

Exec[Generate cert dse__opensearch-apifeatureusage refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]

File[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-toolhub-deploy
+    namespace: opensearch-toolhub
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-toolhub-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem

File[/etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-ttmserver
+    namespace: opensearch-ttmserver
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-ttmserver
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-ttmserver.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem

Cfssl::Cert[dse__opensearch-apifeatureusage]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-apifeatureusage].orig
+++ Cfssl::Cert[dse__opensearch-apifeatureusage]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-apifeatureusage
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}]
+    provide_chain   => True

File[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-apifeatureusage-test-deploy
+    namespace: opensearch-apifeatureusage-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-apifeatureusage-test-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-ttmserver]

Parameters differences:

--- File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-ttmserver].orig
+++ File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-ttmserver]

+    group   => deployment
+    mode    => 0751
+    ensure  => directory
+    recurse => True
+    owner   => mwdeploy
+    force   => True

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem > /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chained.pem
+    require   => Exec[Generate cert dse__opensearch-ttmserver-test refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-ttmserver-test]', 'File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem]']

File[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-apifeatureusage-deploy
+    namespace: opensearch-apifeatureusage
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-apifeatureusage-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem

File[/etc/kubernetes/pki/dse__opensearch-toolhub.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

Exec[Generate cert dse__opensearch-ttmserver refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver refresh].orig
+++ Exec[Generate cert dse__opensearch-ttmserver refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-toolhub-test-deploy
+    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    ensure      => present
+    hosts       => []

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr
@@ -0,0 +1,26 @@
+{
+  "CN": "opensearch-apifeatureusage-test-deploy",
+  "hosts": [
+    "opensearch-apifeatureusage-test-deploy"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    },
+    {
+      "C": null,
+      "L": null,
+      "O": "deploy",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Cfssl::Cert[dse__opensearch-ttmserver-test-deploy]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-ttmserver-test-deploy].orig
+++ Cfssl::Cert[dse__opensearch-ttmserver-test-deploy]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-ttmserver-test-deploy
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    provide_chain   => True

Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]

Exec[renew certificate - dse__opensearch-apifeatureusage-deploy]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-apifeatureusage-deploy].orig
+++ Exec[renew certificate - dse__opensearch-apifeatureusage-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-apifeatureusage-deploy]

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-ttmserver-test
+    namespace   => opensearch-ttmserver-test
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/helmfile-defaults/services-dse-k8s-eqiad.yaml]

Content differences:

--- /etc/helmfile-defaults/services-dse-k8s-eqiad.yaml.orig
+++ /etc/helmfile-defaults/services-dse-k8s-eqiad.yaml
@@ -48,6 +48,30 @@
     usernames:
     - name: opensearch-test
     - name: opensearch-test-deploy
+  opensearch-toolhub:
+    usernames:
+    - name: opensearch-toolhub
+    - name: opensearch-toolhub-deploy
+  opensearch-toolhub-test:
+    usernames:
+    - name: opensearch-toolhub-test
+    - name: opensearch-toolhub-test-deploy
+  opensearch-apifeatureusage:
+    usernames:
+    - name: opensearch-apifeatureusage
+    - name: opensearch-apifeatureusage-deploy
+  opensearch-apifeatureusage-test:
+    usernames:
+    - name: opensearch-apifeatureusage-test
+    - name: opensearch-apifeatureusage-test-deploy
+  opensearch-ttmserver:
+    usernames:
+    - name: opensearch-ttmserver
+    - name: opensearch-ttmserver-deploy
+  opensearch-ttmserver-test:
+    usernames:
+    - name: opensearch-ttmserver-test
+    - name: opensearch-ttmserver-test-deploy
   airflow-analytics-product:
     private_files:
       group: airflow-deployers

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-ttmserver-deploy
+    namespace: opensearch-ttmserver
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-ttmserver-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem

Cfssl::Cert[dse__opensearch-apifeatureusage-test-deploy]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-apifeatureusage-test-deploy].orig
+++ Cfssl::Cert[dse__opensearch-apifeatureusage-test-deploy]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-apifeatureusage-test-deploy
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    provide_chain   => True

Cfssl::Cert[dse__opensearch-ttmserver-deploy]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-ttmserver-deploy].orig
+++ Cfssl::Cert[dse__opensearch-ttmserver-deploy]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-ttmserver-deploy
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    provide_chain   => True

K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-toolhub.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-toolhub-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-toolhub.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-toolhub
+    namespace   => opensearch-toolhub
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/pki/dse__opensearch-toolhub-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-toolhub]

Parameters differences:

--- File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-toolhub].orig
+++ File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-toolhub]

+    group   => deployment
+    mode    => 0751
+    ensure  => directory
+    recurse => True
+    owner   => mwdeploy
+    force   => True

K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-ttmserver-test-deploy
+    namespace   => opensearch-ttmserver-test
+    require     => ['Class[K8s::Base_dirs]']

K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-apifeatureusage
+    namespace   => opensearch-apifeatureusage
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/helmfile-defaults/services-dse-k8s-codfw.yaml]

Content differences:

--- /etc/helmfile-defaults/services-dse-k8s-codfw.yaml.orig
+++ /etc/helmfile-defaults/services-dse-k8s-codfw.yaml
@@ -48,6 +48,30 @@
     usernames:
     - name: opensearch-test
     - name: opensearch-test-deploy
+  opensearch-toolhub:
+    usernames:
+    - name: opensearch-toolhub
+    - name: opensearch-toolhub-deploy
+  opensearch-toolhub-test:
+    usernames:
+    - name: opensearch-toolhub-test
+    - name: opensearch-toolhub-test-deploy
+  opensearch-apifeatureusage:
+    usernames:
+    - name: opensearch-apifeatureusage
+    - name: opensearch-apifeatureusage-deploy
+  opensearch-apifeatureusage-test:
+    usernames:
+    - name: opensearch-apifeatureusage-test
+    - name: opensearch-apifeatureusage-test-deploy
+  opensearch-ttmserver:
+    usernames:
+    - name: opensearch-ttmserver
+    - name: opensearch-ttmserver-deploy
+  opensearch-ttmserver-test:
+    usernames:
+    - name: opensearch-ttmserver-test
+    - name: opensearch-ttmserver-test-deploy
   echoserver:
     usernames:
     - name: echoserver

Exec[Generate cert dse__opensearch-ttmserver-test refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-test refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-test refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-test

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

Exec[Generate cert dse__opensearch-toolhub-deploy]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-deploy].orig
+++ Exec[Generate cert dse__opensearch-toolhub-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-deploy

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]

File[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-ttmserver-deploy
+    namespace: opensearch-ttmserver
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-ttmserver-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem

K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-toolhub-test.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-toolhub-test.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-toolhub-test
+    namespace   => opensearch-toolhub-test
+    require     => ['Class[K8s::Base_dirs]']

K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-apifeatureusage
+    namespace   => opensearch-apifeatureusage
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]

File[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-apifeatureusage-test-deploy
+    namespace: opensearch-apifeatureusage-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-apifeatureusage-test-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem

Exec[renew certificate - dse__opensearch-toolhub-test-deploy]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-toolhub-test-deploy].orig
+++ Exec[renew certificate - dse__opensearch-toolhub-test-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-toolhub-test-deploy]

Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh].orig
+++ Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]

Exec[Generate cert dse__opensearch-apifeatureusage refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage refresh].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]

File[/etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-deploy-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-ttmserver-deploy
+    namespace   => opensearch-ttmserver
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-ttmserver-test
+    namespace: opensearch-ttmserver-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-ttmserver-test
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

Exec[Generate cert dse__opensearch-toolhub refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub refresh].orig
+++ Exec[Generate cert dse__opensearch-toolhub refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-toolhub.csr]

File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "opensearch-apifeatureusage-test",
+  "hosts": [
+    "opensearch-apifeatureusage-test"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Exec[Generate cert dse__opensearch-toolhub-test refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-test refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-toolhub-test refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-test

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]

Exec[Generate cert dse__opensearch-ttmserver refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-ttmserver refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]

File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Exec[Generate cert dse__opensearch-toolhub-test]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-test].orig
+++ Exec[Generate cert dse__opensearch-toolhub-test]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-test

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-toolhub-test.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]

K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-ttmserver-test-deploy
+    namespace   => opensearch-ttmserver-test
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-ttmserver-test]

Parameters differences:

--- File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-ttmserver-test].orig
+++ File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-ttmserver-test]

+    group   => deployment
+    mode    => 0751
+    ensure  => directory
+    recurse => True
+    owner   => mwdeploy
+    force   => True

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-toolhub-deploy
+    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    ensure      => present
+    hosts       => []

Cfssl::Cert[dse__opensearch-toolhub-test-deploy]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-toolhub-test-deploy].orig
+++ Cfssl::Cert[dse__opensearch-toolhub-test-deploy]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-toolhub-test-deploy
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    provide_chain   => True

Exec[renew certificate - dse__opensearch-toolhub]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-toolhub].orig
+++ Exec[renew certificate - dse__opensearch-toolhub]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-toolhub.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-toolhub.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-toolhub]

K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-apifeatureusage-test
+    namespace   => opensearch-apifeatureusage-test
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-ttmserver.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-ttmserver.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-ttmserver.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "opensearch-ttmserver",
+  "hosts": [
+    "opensearch-ttmserver"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver.pem /etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver.pem /etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem > /etc/kubernetes/pki/dse__opensearch-ttmserver.chained.pem
+    require   => Exec[Generate cert dse__opensearch-ttmserver refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-ttmserver]', 'File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-ttmserver.pem]']

Exec[Generate cert dse__opensearch-toolhub refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-toolhub refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]

Exec[Generate cert dse__opensearch-apifeatureusage]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr
@@ -0,0 +1,26 @@
+{
+  "CN": "opensearch-ttmserver-deploy",
+  "hosts": [
+    "opensearch-ttmserver-deploy"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    },
+    {
+      "C": null,
+      "L": null,
+      "O": "deploy",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem > /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chained.pem
+    require   => Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-ttmserver-test-deploy]', 'File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem]']

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Exec[Generate cert dse__opensearch-toolhub-test refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-test refresh].orig
+++ Exec[Generate cert dse__opensearch-toolhub-test refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-test

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]

Exec[renew certificate - dse__opensearch-apifeatureusage-test]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-apifeatureusage-test].orig
+++ Exec[renew certificate - dse__opensearch-apifeatureusage-test]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-apifeatureusage-test]

File[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-apifeatureusage.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-apifeatureusage.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "opensearch-apifeatureusage",
+  "hosts": [
+    "opensearch-apifeatureusage"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-ttmserver
+    names       => [{'organisation': 'view'}]
+    ensure      => present
+    hosts       => []

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem > /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chained.pem
+    require   => Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-apifeatureusage-deploy]', 'File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem]']

K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-apifeatureusage-test-deploy
+    namespace   => opensearch-apifeatureusage-test
+    require     => ['Class[K8s::Base_dirs]']

Exec[Generate cert dse__opensearch-ttmserver]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver].orig
+++ Exec[Generate cert dse__opensearch-ttmserver]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-ttmserver.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver.csr]

Exec[renew certificate - dse__opensearch-toolhub-deploy]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-toolhub-deploy].orig
+++ Exec[renew certificate - dse__opensearch-toolhub-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-deploy

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-toolhub-deploy]

Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-ttmserver-test
+    names       => [{'organisation': 'view'}]
+    ensure      => present
+    hosts       => []

File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Exec[Generate cert dse__opensearch-apifeatureusage-deploy]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-deploy].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem > /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chained.pem
+    require   => Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-apifeatureusage-test-deploy]', 'File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem]']

Cfssl::Cert[dse__opensearch-apifeatureusage-deploy]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-apifeatureusage-deploy].orig
+++ Cfssl::Cert[dse__opensearch-apifeatureusage-deploy]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-apifeatureusage-deploy
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    provide_chain   => True

File[/etc/kubernetes/pki/dse__opensearch-ttmserver.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-ttmserver-test-deploy-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-ttmserver-test-deploy
+    namespace: opensearch-ttmserver-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-ttmserver-test-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy-key.pem

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem > /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chained.pem
+    require   => Exec[Generate cert dse__opensearch-toolhub-test-deploy refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-toolhub-test-deploy]', 'File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem]']

K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-toolhub-deploy
+    namespace   => opensearch-toolhub
+    require     => ['Class[K8s::Base_dirs]']

Cfssl::Cert[dse__opensearch-ttmserver-test]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-ttmserver-test].orig
+++ Cfssl::Cert[dse__opensearch-ttmserver-test]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-ttmserver-test
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}]
+    provide_chain   => True

K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-toolhub-test-deploy
+    namespace   => opensearch-toolhub-test
+    require     => ['Class[K8s::Base_dirs]']

Exec[Generate cert dse__opensearch-apifeatureusage-test refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-test refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-test refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]

Cfssl::Cert[dse__opensearch-toolhub]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-toolhub].orig
+++ Cfssl::Cert[dse__opensearch-toolhub]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-toolhub
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}]
+    provide_chain   => True

Exec[Generate cert dse__opensearch-ttmserver-deploy refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-deploy refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-deploy refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]

File[/etc/cfssl/csr/dse__opensearch-toolhub.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-toolhub.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-toolhub.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-toolhub.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-toolhub.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "opensearch-toolhub",
+  "hosts": [
+    "opensearch-toolhub"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

File[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-ttmserver-test-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-ttmserver-test
+    namespace: opensearch-ttmserver-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-ttmserver-test
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem

File[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr
@@ -0,0 +1,26 @@
+{
+  "CN": "opensearch-toolhub-test-deploy",
+  "hosts": [
+    "opensearch-toolhub-test-deploy"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    },
+    {
+      "C": null,
+      "L": null,
+      "O": "deploy",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-toolhub-deploy
+    namespace   => opensearch-toolhub
+    require     => ['Class[K8s::Base_dirs]']

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem > /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chained.pem
+    require   => Exec[Generate cert dse__opensearch-toolhub-deploy refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-toolhub-deploy]', 'File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem]']

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Cfssl::Cert[dse__opensearch-apifeatureusage-test]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-apifeatureusage-test].orig
+++ Cfssl::Cert[dse__opensearch-apifeatureusage-test]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-apifeatureusage-test
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}]
+    provide_chain   => True

File[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-apifeatureusage-test
+    namespace: opensearch-apifeatureusage-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-apifeatureusage-test
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem > /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chained.pem
+    require   => Exec[Generate cert dse__opensearch-ttmserver-deploy refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-ttmserver-deploy]', 'File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem]']

K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-ttmserver.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-ttmserver.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-ttmserver
+    namespace   => opensearch-ttmserver
+    require     => ['Class[K8s::Base_dirs]']

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-test.pem /etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-test.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub-test.pem /etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem > /etc/kubernetes/pki/dse__opensearch-toolhub-test.chained.pem
+    require   => Exec[Generate cert dse__opensearch-toolhub-test refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-toolhub-test]', 'File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.pem]']

Exec[Generate cert dse__opensearch-ttmserver-test refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-test refresh].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-test refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-test

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]

Exec[Generate cert dse__opensearch-ttmserver-deploy refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-deploy refresh].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-deploy refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

Exec[Generate cert dse__opensearch-apifeatureusage-test]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-test].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-test]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test.csr]

Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr
@@ -0,0 +1,26 @@
+{
+  "CN": "opensearch-ttmserver-test-deploy",
+  "hosts": [
+    "opensearch-ttmserver-test-deploy"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    },
+    {
+      "C": null,
+      "L": null,
+      "O": "deploy",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Class[Profile::Kubernetes::Deployment_server]

Parameters differences:

--- Class[Profile::Kubernetes::Deployment_server].orig
+++ Class[Profile::Kubernetes::Deployment_server]

@@
-    services => {'main': {'apertium': {'usernames': [{'name': 'apertium'}, {'name': 'apertium-deploy'}]}, 'api-gateway': {'usernames': [{'name': 'api-gateway'}, {'name': 'api-gateway-deploy'}]}, 'benthos-cache-invalidator': {'usernames': [{'name': 'benthos-cache-invalidator'}, {'name': 'benthos-cache-invalidator-deploy'}]}, 'changeprop': {'usernames': [{'name': 'changeprop'}, {'name': 'changeprop-deploy'}]}, 'changeprop-jobqueue': {'usernames': [{'name': 'changeprop-jobqueue'}, {'name': 'changeprop-jobqueue-deploy'}]}, 'chart-renderer': {'usernames': [{'name': 'chart-renderer'}, {'name': 'chart-renderer-deploy'}]}, 'cirrus-streaming-updater': {'usernames': [{'name': 'cirrus-streaming-updater'}, {'name': 'cirrus-streaming-updater-deploy'}]}, 'citoid': {'usernames': [{'name': 'citoid'}, {'name': 'citoid-deploy'}]}, 'commons-impact-analytics': {'usernames': [{'name': 'commons-impact-analytics'}, {'name': 'commons-impact-analytics-deploy'}]}, 'cxserver': {'usernames': [{'name': 'cxserver'}, {'name': 'cxserver-deploy'}]}, 'data-gateway': {'usernames': [{'name': 'data-gateway'}, {'name': 'data-gateway-deploy'}]}, 'developer-portal': {'usernames': [{'name': 'developer-portal'}, {'name': 'developer-portal-deploy'}]}, 'device-analytics': {'usernames': [{'name': 'device-analytics'}, {'name': 'device-analytics-deploy'}]}, 'echostore': {'usernames': [{'name': 'echostore'}, {'name': 'echostore-deploy'}]}, 'edit-analytics': {'usernames': [{'name': 'edit-analytics'}, {'name': 'edit-analytics-deploy'}]}, 'editor-analytics': {'usernames': [{'name': 'editor-analytics'}, {'name': 'editor-analytics-deploy'}]}, 'eventgate-analytics': {'usernames': [{'name': 'eventgate-analytics'}, {'name': 'eventgate-analytics-deploy'}]}, 'eventgate-analytics-external': {'usernames': [{'name': 'eventgate-analytics-external'}, {'name': 'eventgate-analytics-external-deploy'}]}, 'eventgate-logging-external': {'usernames': [{'name': 'eventgate-logging-external'}, {'name': 'eventgate-logging-external-deploy'}]}, 'eventgate-main': {'usernames': [{'name': 'eventgate-main'}, {'name': 'eventgate-main-deploy'}]}, 'eventstreams': {'usernames': [{'name': 'eventstreams'}, {'name': 'eventstreams-deploy'}]}, 'eventstreams-internal': {'usernames': [{'name': 'eventstreams-internal'}, {'name': 'eventstreams-internal-deploy'}]}, 'failoid-ng': {'usernames': [{'name': 'failoid-ng'}, {'name': 'failoid-ng-deploy'}]}, 'geo-analytics': {'usernames': [{'name': 'geo-analytics'}, {'name': 'geo-analytics-deploy'}]}, 'ipoid': {'usernames': [{'name': 'ipoid'}, {'name': 'ipoid-deploy'}]}, 'kartotherian': {'usernames': [{'name': 'kartotherian'}, {'name': 'kartotherian-deploy'}]}, 'linked-artifacts': {'usernames': [{'name': 'linked-artifacts'}, {'name': 'linked-artifacts-deploy'}]}, 'linkrecommendation': {'usernames': [{'name': 'linkrecommendation'}, {'name': 'linkrecommendation-deploy'}]}, 'machinetranslation': {'usernames': [{'name': 'machinetranslation'}, {'name': 'machinetranslation-deploy'}]}, 'mathoid': {'usernames': [{'name': 'mathoid'}, {'name': 'mathoid-deploy'}]}, 'media-analytics': {'usernames': [{'name': 'media-analytics'}, {'name': 'media-analytics-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'mobileapps': {'usernames': [{'name': 'mobileapps'}, {'name': 'mobileapps-deploy'}]}, 'mw-api-ext': {'usernames': [{'name': 'mw-api-ext'}, {'name': 'mw-api-ext-deploy'}]}, 'mw-api-int': {'usernames': [{'name': 'mw-api-int'}, {'name': 'mw-api-int-deploy'}]}, 'mw-cron': {'usernames': [{'name': 'mw-cron'}, {'name': 'mw-cron-deploy'}, {'group': 'restricted', 'name': 'mw-cron-restricted'}, {'group': 'restricted', 'name': 'mw-cron-restricted-deploy'}]}, 'mw-debug': {'usernames': [{'name': 'mw-debug'}, {'name': 'mw-debug-deploy'}]}, 'mw-experimental': {'usernames': [{'name': 'mw-experimental'}, {'name': 'mw-experimental-deploy'}]}, 'mw-jobrunner': {'usernames': [{'name': 'mw-jobrunner'}, {'name': 'mw-jobrunner-deploy'}]}, 'mw-mcrouter': {'usernames': [{'name': 'mw-mcrouter'}, {'name': 'mw-mcrouter-deploy'}]}, 'mw-misc': {'usernames': [{'name': 'mw-misc'}, {'name': 'mw-misc-deploy'}]}, 'mw-page-content-change-enrich': {'usernames': [{'name': 'mw-page-content-change-enrich'}, {'name': 'mw-page-content-change-enrich-deploy'}]}, 'mw-parsoid': {'usernames': [{'name': 'mw-parsoid'}, {'name': 'mw-parsoid-deploy'}]}, 'mw-script': {'usernames': [{'name': 'mw-script'}, {'name': 'mw-script-deploy'}, {'group': 'restricted', 'name': 'mw-script-restricted'}, {'group': 'restricted', 'name': 'mw-script-restricted-deploy'}]}, 'mw-videoscaler': {'usernames': [{'name': 'mw-videoscaler'}, {'name': 'mw-videoscaler-deploy'}]}, 'mw-web': {'usernames': [{'name': 'mw-web'}, {'name': 'mw-web-deploy'}]}, 'mw-wikifunctions': {'usernames': [{'name': 'mw-wikifunctions'}, {'name': 'mw-wikifunctions-deploy'}]}, 'opentelemetry-collector': {'usernames': [{'name': 'opentelemetry-collector'}, {'name': 'opentelemetry-collector-deploy'}]}, 'page-analytics': {'usernames': [{'name': 'page-analytics'}, {'name': 'page-analytics-deploy'}]}, 'proton': {'usernames': [{'name': 'proton'}, {'name': 'proton-deploy'}]}, 'push-notifications': {'usernames': [{'name': 'push-notifications'}, {'name': 'push-notifications-deploy'}]}, 'ratelimit': {'usernames': [{'name': 'ratelimit'}, {'name': 'ratelimit-deploy'}]}, 'ratelimit-media': {'usernames': [{'name': 'ratelimit-media'}, {'name': 'ratelimit-media-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'recommendation-api': {'usernames': [{'name': 'recommendation-api'}, {'name': 'recommendation-api-deploy'}]}, 'rest-gateway': {'usernames': [{'name': 'rest-gateway'}, {'name': 'rest-gateway-deploy'}]}, 'sessionstore': {'usernames': [{'name': 'sessionstore'}, {'name': 'sessionstore-deploy'}]}, 'shellbox': {'usernames': [{'name': 'shellbox'}, {'name': 'shellbox-deploy'}]}, 'shellbox-constraints': {'usernames': [{'name': 'shellbox-constraints'}, {'name': 'shellbox-constraints-deploy'}]}, 'shellbox-media': {'usernames': [{'name': 'shellbox-media'}, {'name': 'shellbox-media-deploy'}]}, 'shellbox-syntaxhighlight': {'usernames': [{'name': 'shellbox-syntaxhighlight'}, {'name': 'shellbox-syntaxhighlight-deploy'}]}, 'shellbox-timeline': {'usernames': [{'name': 'shellbox-timeline'}, {'name': 'shellbox-timeline-deploy'}]}, 'shellbox-video': {'usernames': [{'name': 'shellbox-video'}, {'name': 'shellbox-video-deploy'}]}, 'tegola-vector-tiles': {'usernames': [{'name': 'tegola-vector-tiles'}, {'name': 'tegola-vector-tiles-deploy'}]}, 'termbox': {'usernames': [{'name': 'termbox'}, {'name': 'termbox-deploy'}]}, 'thumbor': {'usernames': [{'name': 'thumbor'}, {'name': 'thumbor-deploy'}]}, 'toolhub': {'usernames': [{'name': 'toolhub'}, {'name': 'toolhub-deploy'}]}, 'wikidata-query-gui': {'usernames': [{'name': 'wikidata-query-gui'}, {'name': 'wikidata-query-gui-deploy'}]}, 'wikifeeds': {'usernames': [{'name': 'wikifeeds'}, {'name': 'wikifeeds-deploy'}]}, 'wikifunctions': {'usernames': [{'name': 'wikifunctions'}, {'name': 'wikifunctions-deploy'}]}, 'zotero': {'usernames': [{'name': 'zotero'}, {'name': 'zotero-deploy'}]}}, 'ml-serve': {'article-descriptions': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-descriptions', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-descriptions-deploy', 'owner': 'root'}]}, 'article-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-models-deploy', 'owner': 'root'}]}, 'articletopic-outlink': {'usernames': [{'group': 'deploy-ml-service', 'name': 'articletopic-outlink', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'articletopic-outlink-deploy', 'owner': 'root'}]}, 'edit-check': {'usernames': [{'group': 'deploy-ml-service', 'name': 'edit-check', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'edit-check-deploy', 'owner': 'root'}]}, 'experimental': {'usernames': [{'group': 'deploy-ml-service', 'name': 'experimental', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-deploy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-debug', 'owner': 'root'}]}, 'llm': {'usernames': [{'group': 'deploy-ml-service', 'name': 'llm', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'llm-deploy', 'owner': 'root'}]}, 'logo-detection': {'usernames': [{'group': 'deploy-ml-service', 'name': 'logo-detection', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'logo-detection-deploy', 'owner': 'root'}]}, 'ores-legacy': {'usernames': [{'group': 'deploy-ml-service', 'name': 'ores-legacy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'ores-legacy-deploy', 'owner': 'root'}]}, 'readability': {'usernames': [{'group': 'deploy-ml-service', 'name': 'readability', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'readability-deploy', 'owner': 'root'}]}, 'recommendation-api-ng': {'usernames': [{'group': 'deploy-ml-service', 'name': 'recommendation-api-ng', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'recommendation-api-ng-deploy', 'owner': 'root'}]}, 'revertrisk': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revertrisk', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revertrisk-deploy', 'owner': 'root'}]}, 'revise-tone-task-generator': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator-deploy', 'owner': 'root'}]}, 'revision-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revision-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revision-models-deploy', 'owner': 'root'}]}, 'revscoring-articlequality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articlequality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articlequality-deploy', 'owner': 'root'}]}, 'revscoring-articletopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articletopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articletopic-deploy', 'owner': 'root'}]}, 'revscoring-draftquality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-draftquality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-draftquality-deploy', 'owner': 'root'}]}, 'revscoring-drafttopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic-deploy', 'owner': 'root'}]}, 'revscoring-editquality-damaging': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging-deploy', 'owner': 'root'}]}, 'revscoring-editquality-goodfaith': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith-deploy', 'owner': 'root'}]}, 'revscoring-editquality-reverted': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted-deploy', 'owner': 'root'}]}}, 'dse-k8s': {'analytics': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-deploy', 'owner': 'root'}]}, 'analytics-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-test-deploy', 'owner': 'root'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'opensearch-ipoid': {'usernames': [{'name': 'opensearch-ipoid'}, {'name': 'opensearch-ipoid-deploy'}]}, 'opensearch-ipoid-test': {'usernames': [{'name': 'opensearch-ipoid-test'}, {'name': 'opensearch-ipoid-test-deploy'}]}, 'opensearch-operator': {'usernames': [{'name': 'opensearch-operator'}, {'name': 'opensearch-operator-deploy'}]}, 'opensearch-operator-3': {'usernames': [{'name': 'opensearch-operator-3'}, {'name': 'opensearch-operator-3-deploy'}]}, 'opensearch-semantic-search': {'usernames': [{'name': 'opensearch-semantic-search'}, {'name': 'opensearch-semantic-search-deploy'}]}, 'opensearch-semantic-search-test': {'usernames': [{'name': 'opensearch-semantic-search-test'}, {'name': 'opensearch-semantic-search-test-deploy'}]}, 'opensearch-test': {'usernames': [{'name': 'opensearch-test'}, {'name': 'opensearch-test-deploy'}]}}, 'dse-k8s-codfw': {'echoserver': {'usernames': [{'name': 'echoserver'}, {'name': 'echoserver-deploy'}]}}, 'dse-k8s-eqiad': {'airflow-analytics-product': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-product', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-product-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product-deploy', 'owner': 'root'}]}, 'airflow-analytics-test': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-test', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-test-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test-deploy', 'owner': 'root'}]}, 'airflow-dev': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-dev', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-dev-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev-deploy', 'owner': 'root'}]}, 'airflow-fr-tech': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-fr-tech', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-fr-tech-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech-deploy', 'owner': 'root'}]}, 'airflow-main': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-main', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-main-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main-deploy', 'owner': 'root'}]}, 'airflow-ml': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-ml', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-ml-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml-deploy', 'owner': 'root'}]}, 'airflow-platform-eng': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-platform-eng', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-platform-eng-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng-deploy', 'owner': 'root'}]}, 'airflow-research': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-research', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-research-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research-deploy', 'owner': 'root'}]}, 'airflow-search': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-search', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-search-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search-deploy', 'owner': 'root'}]}, 'airflow-sre': {'private_files': {'group': 'ops', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-sre', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-sre-deploy', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre-deploy', 'owner': 'root'}]}, 'airflow-test-k8s': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-test-k8s', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-test-k8s-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s-deploy', 'owner': 'root'}]}, 'airflow-wikidata': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wikidata', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wikidata-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata-deploy', 'owner': 'root'}]}, 'airflow-wmde': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wmde', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wmde-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde-deploy', 'owner': 'root'}]}, 'blunderbuss': {'usernames': [{'name': 'blunderbuss'}, {'name': 'blunderbuss-deploy'}]}, 'datahub': {'usernames': [{'name': 'datahub'}, {'name': 'datahub-deploy'}]}, 'datahub-next': {'usernames': [{'name': 'datahub-next'}, {'name': 'datahub-next-deploy'}]}, 'datasets-config': {'usernames': [{'name': 'datasets-config'}, {'name': 'datasets-config-deploy'}]}, 'datasets-config-next': {'usernames': [{'name': 'datasets-config-next'}, {'name': 'datasets-config-next-deploy'}]}, 'growthbook': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-deploy', 'owner': 'root'}, {'name': 'growthbook'}, {'name': 'growthbook-deploy'}]}, 'growthbook-next': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook-next', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-next-deploy', 'owner': 'root'}, {'name': 'growthbook-next'}, {'name': 'growthbook-next-deploy'}]}, 'llm-inference': {'usernames': [{'group': 'research-deployers', 'name': 'llm-inference', 'owner': 'root'}, {'group': 'research-deployers', 'name': 'llm-inference-deploy', 'owner': 'root'}]}, 'mediawiki-dumps-legacy': {'usernames': [{'name': 'mediawiki-dumps-legacy'}, {'name': 'mediawiki-dumps-legacy-deploy'}]}, 'mw-content-history-reconcile-enrich': {'usernames': [{'name': 'mw-content-history-reconcile-enrich'}, {'name': 'mw-content-history-reconcile-enrich-deploy'}]}, 'mw-content-history-reconcile-enrich-next': {'usernames': [{'name': 'mw-content-history-reconcile-enrich-next'}, {'name': 'mw-content-history-reconcile-enrich-next-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich'}, {'name': 'mw-dump-rev-content-reconcile-enrich-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich-next': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich-next'}, {'name': 'mw-dump-rev-content-reconcile-enrich-next-deploy'}]}, 'mw-page-html-content-change-enrich': {'usernames': [{'name': 'mw-page-html-content-change-enrich'}, {'name': 'mw-page-html-content-change-enrich-deploy'}]}, 'mw-page-html-content-change-enrich-next': {'usernames': [{'name': 'mw-page-html-content-change-enrich-next'}, {'name': 'mw-page-html-content-change-enrich-next-deploy'}]}, 'mw-page-html-feature-counts-change-enrich': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich'}, {'name': 'mw-page-html-feature-counts-change-enrich-deploy'}]}, 'mw-page-html-feature-counts-change-enrich-next': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich-next'}, {'name': 'mw-page-html-feature-counts-change-enrich-next-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'spark': {'usernames': [{'name': 'spark'}, {'name': 'spark-deploy'}]}, 'spark-history': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-deploy', 'owner': 'root'}]}, 'spark-history-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-test-deploy', 'owner': 'root'}]}, 'superset': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-deploy', 'owner': 'root'}]}, 'superset-next': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset-next', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-next-deploy', 'owner': 'root'}]}, 'test-kitchen': {'usernames': [{'name': 'test-kitchen'}, {'name': 'test-kitchen-deploy'}]}, 'test-kitchen-next': {'usernames': [{'name': 'test-kitchen-next'}, {'name': 'test-kitchen-next-deploy'}]}, 'turnilo': {'usernames': [{'name': 'turnilo'}, {'name': 'turnilo-deploy'}]}, 'turnilo-next': {'usernames': [{'name': 'turnilo-next'}, {'name': 'turnilo-next-deploy'}]}, 'wdqs-queryhammer': {'usernames': [{'name': 'wdqs-queryhammer'}, {'name': 'wdqs-queryhammer-deploy'}]}}, 'aux-k8s': {'codesearch': {'usernames': [{'name': 'codesearch'}, {'name': 'codesearch-deploy'}]}, 'jaeger': {'usernames': [{'name': 'jaeger'}, {'name': 'jaeger-deploy'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'redioscope': {'usernames': [{'name': 'redioscope'}, {'name': 'redioscope-deploy'}]}, 'sophroid': {'usernames': [{'name': 'sophroid'}, {'name': 'sophroid-deploy'}]}, 'zarcillo': {'usernames': [{'name': 'zarcillo'}, {'name': 'zarcillo-deploy'}]}}}
+    services => {'main': {'apertium': {'usernames': [{'name': 'apertium'}, {'name': 'apertium-deploy'}]}, 'api-gateway': {'usernames': [{'name': 'api-gateway'}, {'name': 'api-gateway-deploy'}]}, 'benthos-cache-invalidator': {'usernames': [{'name': 'benthos-cache-invalidator'}, {'name': 'benthos-cache-invalidator-deploy'}]}, 'changeprop': {'usernames': [{'name': 'changeprop'}, {'name': 'changeprop-deploy'}]}, 'changeprop-jobqueue': {'usernames': [{'name': 'changeprop-jobqueue'}, {'name': 'changeprop-jobqueue-deploy'}]}, 'chart-renderer': {'usernames': [{'name': 'chart-renderer'}, {'name': 'chart-renderer-deploy'}]}, 'cirrus-streaming-updater': {'usernames': [{'name': 'cirrus-streaming-updater'}, {'name': 'cirrus-streaming-updater-deploy'}]}, 'citoid': {'usernames': [{'name': 'citoid'}, {'name': 'citoid-deploy'}]}, 'commons-impact-analytics': {'usernames': [{'name': 'commons-impact-analytics'}, {'name': 'commons-impact-analytics-deploy'}]}, 'cxserver': {'usernames': [{'name': 'cxserver'}, {'name': 'cxserver-deploy'}]}, 'data-gateway': {'usernames': [{'name': 'data-gateway'}, {'name': 'data-gateway-deploy'}]}, 'developer-portal': {'usernames': [{'name': 'developer-portal'}, {'name': 'developer-portal-deploy'}]}, 'device-analytics': {'usernames': [{'name': 'device-analytics'}, {'name': 'device-analytics-deploy'}]}, 'echostore': {'usernames': [{'name': 'echostore'}, {'name': 'echostore-deploy'}]}, 'edit-analytics': {'usernames': [{'name': 'edit-analytics'}, {'name': 'edit-analytics-deploy'}]}, 'editor-analytics': {'usernames': [{'name': 'editor-analytics'}, {'name': 'editor-analytics-deploy'}]}, 'eventgate-analytics': {'usernames': [{'name': 'eventgate-analytics'}, {'name': 'eventgate-analytics-deploy'}]}, 'eventgate-analytics-external': {'usernames': [{'name': 'eventgate-analytics-external'}, {'name': 'eventgate-analytics-external-deploy'}]}, 'eventgate-logging-external': {'usernames': [{'name': 'eventgate-logging-external'}, {'name': 'eventgate-logging-external-deploy'}]}, 'eventgate-main': {'usernames': [{'name': 'eventgate-main'}, {'name': 'eventgate-main-deploy'}]}, 'eventstreams': {'usernames': [{'name': 'eventstreams'}, {'name': 'eventstreams-deploy'}]}, 'eventstreams-internal': {'usernames': [{'name': 'eventstreams-internal'}, {'name': 'eventstreams-internal-deploy'}]}, 'failoid-ng': {'usernames': [{'name': 'failoid-ng'}, {'name': 'failoid-ng-deploy'}]}, 'geo-analytics': {'usernames': [{'name': 'geo-analytics'}, {'name': 'geo-analytics-deploy'}]}, 'ipoid': {'usernames': [{'name': 'ipoid'}, {'name': 'ipoid-deploy'}]}, 'kartotherian': {'usernames': [{'name': 'kartotherian'}, {'name': 'kartotherian-deploy'}]}, 'linked-artifacts': {'usernames': [{'name': 'linked-artifacts'}, {'name': 'linked-artifacts-deploy'}]}, 'linkrecommendation': {'usernames': [{'name': 'linkrecommendation'}, {'name': 'linkrecommendation-deploy'}]}, 'machinetranslation': {'usernames': [{'name': 'machinetranslation'}, {'name': 'machinetranslation-deploy'}]}, 'mathoid': {'usernames': [{'name': 'mathoid'}, {'name': 'mathoid-deploy'}]}, 'media-analytics': {'usernames': [{'name': 'media-analytics'}, {'name': 'media-analytics-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'mobileapps': {'usernames': [{'name': 'mobileapps'}, {'name': 'mobileapps-deploy'}]}, 'mw-api-ext': {'usernames': [{'name': 'mw-api-ext'}, {'name': 'mw-api-ext-deploy'}]}, 'mw-api-int': {'usernames': [{'name': 'mw-api-int'}, {'name': 'mw-api-int-deploy'}]}, 'mw-cron': {'usernames': [{'name': 'mw-cron'}, {'name': 'mw-cron-deploy'}, {'group': 'restricted', 'name': 'mw-cron-restricted'}, {'group': 'restricted', 'name': 'mw-cron-restricted-deploy'}]}, 'mw-debug': {'usernames': [{'name': 'mw-debug'}, {'name': 'mw-debug-deploy'}]}, 'mw-experimental': {'usernames': [{'name': 'mw-experimental'}, {'name': 'mw-experimental-deploy'}]}, 'mw-jobrunner': {'usernames': [{'name': 'mw-jobrunner'}, {'name': 'mw-jobrunner-deploy'}]}, 'mw-mcrouter': {'usernames': [{'name': 'mw-mcrouter'}, {'name': 'mw-mcrouter-deploy'}]}, 'mw-misc': {'usernames': [{'name': 'mw-misc'}, {'name': 'mw-misc-deploy'}]}, 'mw-page-content-change-enrich': {'usernames': [{'name': 'mw-page-content-change-enrich'}, {'name': 'mw-page-content-change-enrich-deploy'}]}, 'mw-parsoid': {'usernames': [{'name': 'mw-parsoid'}, {'name': 'mw-parsoid-deploy'}]}, 'mw-script': {'usernames': [{'name': 'mw-script'}, {'name': 'mw-script-deploy'}, {'group': 'restricted', 'name': 'mw-script-restricted'}, {'group': 'restricted', 'name': 'mw-script-restricted-deploy'}]}, 'mw-videoscaler': {'usernames': [{'name': 'mw-videoscaler'}, {'name': 'mw-videoscaler-deploy'}]}, 'mw-web': {'usernames': [{'name': 'mw-web'}, {'name': 'mw-web-deploy'}]}, 'mw-wikifunctions': {'usernames': [{'name': 'mw-wikifunctions'}, {'name': 'mw-wikifunctions-deploy'}]}, 'opentelemetry-collector': {'usernames': [{'name': 'opentelemetry-collector'}, {'name': 'opentelemetry-collector-deploy'}]}, 'page-analytics': {'usernames': [{'name': 'page-analytics'}, {'name': 'page-analytics-deploy'}]}, 'proton': {'usernames': [{'name': 'proton'}, {'name': 'proton-deploy'}]}, 'push-notifications': {'usernames': [{'name': 'push-notifications'}, {'name': 'push-notifications-deploy'}]}, 'ratelimit': {'usernames': [{'name': 'ratelimit'}, {'name': 'ratelimit-deploy'}]}, 'ratelimit-media': {'usernames': [{'name': 'ratelimit-media'}, {'name': 'ratelimit-media-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'recommendation-api': {'usernames': [{'name': 'recommendation-api'}, {'name': 'recommendation-api-deploy'}]}, 'rest-gateway': {'usernames': [{'name': 'rest-gateway'}, {'name': 'rest-gateway-deploy'}]}, 'sessionstore': {'usernames': [{'name': 'sessionstore'}, {'name': 'sessionstore-deploy'}]}, 'shellbox': {'usernames': [{'name': 'shellbox'}, {'name': 'shellbox-deploy'}]}, 'shellbox-constraints': {'usernames': [{'name': 'shellbox-constraints'}, {'name': 'shellbox-constraints-deploy'}]}, 'shellbox-media': {'usernames': [{'name': 'shellbox-media'}, {'name': 'shellbox-media-deploy'}]}, 'shellbox-syntaxhighlight': {'usernames': [{'name': 'shellbox-syntaxhighlight'}, {'name': 'shellbox-syntaxhighlight-deploy'}]}, 'shellbox-timeline': {'usernames': [{'name': 'shellbox-timeline'}, {'name': 'shellbox-timeline-deploy'}]}, 'shellbox-video': {'usernames': [{'name': 'shellbox-video'}, {'name': 'shellbox-video-deploy'}]}, 'tegola-vector-tiles': {'usernames': [{'name': 'tegola-vector-tiles'}, {'name': 'tegola-vector-tiles-deploy'}]}, 'termbox': {'usernames': [{'name': 'termbox'}, {'name': 'termbox-deploy'}]}, 'thumbor': {'usernames': [{'name': 'thumbor'}, {'name': 'thumbor-deploy'}]}, 'toolhub': {'usernames': [{'name': 'toolhub'}, {'name': 'toolhub-deploy'}]}, 'wikidata-query-gui': {'usernames': [{'name': 'wikidata-query-gui'}, {'name': 'wikidata-query-gui-deploy'}]}, 'wikifeeds': {'usernames': [{'name': 'wikifeeds'}, {'name': 'wikifeeds-deploy'}]}, 'wikifunctions': {'usernames': [{'name': 'wikifunctions'}, {'name': 'wikifunctions-deploy'}]}, 'zotero': {'usernames': [{'name': 'zotero'}, {'name': 'zotero-deploy'}]}}, 'ml-serve': {'article-descriptions': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-descriptions', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-descriptions-deploy', 'owner': 'root'}]}, 'article-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-models-deploy', 'owner': 'root'}]}, 'articletopic-outlink': {'usernames': [{'group': 'deploy-ml-service', 'name': 'articletopic-outlink', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'articletopic-outlink-deploy', 'owner': 'root'}]}, 'edit-check': {'usernames': [{'group': 'deploy-ml-service', 'name': 'edit-check', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'edit-check-deploy', 'owner': 'root'}]}, 'experimental': {'usernames': [{'group': 'deploy-ml-service', 'name': 'experimental', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-deploy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-debug', 'owner': 'root'}]}, 'llm': {'usernames': [{'group': 'deploy-ml-service', 'name': 'llm', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'llm-deploy', 'owner': 'root'}]}, 'logo-detection': {'usernames': [{'group': 'deploy-ml-service', 'name': 'logo-detection', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'logo-detection-deploy', 'owner': 'root'}]}, 'ores-legacy': {'usernames': [{'group': 'deploy-ml-service', 'name': 'ores-legacy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'ores-legacy-deploy', 'owner': 'root'}]}, 'readability': {'usernames': [{'group': 'deploy-ml-service', 'name': 'readability', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'readability-deploy', 'owner': 'root'}]}, 'recommendation-api-ng': {'usernames': [{'group': 'deploy-ml-service', 'name': 'recommendation-api-ng', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'recommendation-api-ng-deploy', 'owner': 'root'}]}, 'revertrisk': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revertrisk', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revertrisk-deploy', 'owner': 'root'}]}, 'revise-tone-task-generator': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator-deploy', 'owner': 'root'}]}, 'revision-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revision-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revision-models-deploy', 'owner': 'root'}]}, 'revscoring-articlequality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articlequality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articlequality-deploy', 'owner': 'root'}]}, 'revscoring-articletopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articletopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articletopic-deploy', 'owner': 'root'}]}, 'revscoring-draftquality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-draftquality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-draftquality-deploy', 'owner': 'root'}]}, 'revscoring-drafttopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic-deploy', 'owner': 'root'}]}, 'revscoring-editquality-damaging': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging-deploy', 'owner': 'root'}]}, 'revscoring-editquality-goodfaith': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith-deploy', 'owner': 'root'}]}, 'revscoring-editquality-reverted': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted-deploy', 'owner': 'root'}]}}, 'dse-k8s': {'analytics': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-deploy', 'owner': 'root'}]}, 'analytics-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-test-deploy', 'owner': 'root'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'opensearch-ipoid': {'usernames': [{'name': 'opensearch-ipoid'}, {'name': 'opensearch-ipoid-deploy'}]}, 'opensearch-ipoid-test': {'usernames': [{'name': 'opensearch-ipoid-test'}, {'name': 'opensearch-ipoid-test-deploy'}]}, 'opensearch-operator': {'usernames': [{'name': 'opensearch-operator'}, {'name': 'opensearch-operator-deploy'}]}, 'opensearch-operator-3': {'usernames': [{'name': 'opensearch-operator-3'}, {'name': 'opensearch-operator-3-deploy'}]}, 'opensearch-semantic-search': {'usernames': [{'name': 'opensearch-semantic-search'}, {'name': 'opensearch-semantic-search-deploy'}]}, 'opensearch-semantic-search-test': {'usernames': [{'name': 'opensearch-semantic-search-test'}, {'name': 'opensearch-semantic-search-test-deploy'}]}, 'opensearch-test': {'usernames': [{'name': 'opensearch-test'}, {'name': 'opensearch-test-deploy'}]}, 'opensearch-toolhub': {'usernames': [{'name': 'opensearch-toolhub'}, {'name': 'opensearch-toolhub-deploy'}]}, 'opensearch-toolhub-test': {'usernames': [{'name': 'opensearch-toolhub-test'}, {'name': 'opensearch-toolhub-test-deploy'}]}, 'opensearch-apifeatureusage': {'usernames': [{'name': 'opensearch-apifeatureusage'}, {'name': 'opensearch-apifeatureusage-deploy'}]}, 'opensearch-apifeatureusage-test': {'usernames': [{'name': 'opensearch-apifeatureusage-test'}, {'name': 'opensearch-apifeatureusage-test-deploy'}]}, 'opensearch-ttmserver': {'usernames': [{'name': 'opensearch-ttmserver'}, {'name': 'opensearch-ttmserver-deploy'}]}, 'opensearch-ttmserver-test': {'usernames': [{'name': 'opensearch-ttmserver-test'}, {'name': 'opensearch-ttmserver-test-deploy'}]}}, 'dse-k8s-codfw': {'echoserver': {'usernames': [{'name': 'echoserver'}, {'name': 'echoserver-deploy'}]}}, 'dse-k8s-eqiad': {'airflow-analytics-product': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-product', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-product-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product-deploy', 'owner': 'root'}]}, 'airflow-analytics-test': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-test', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-test-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test-deploy', 'owner': 'root'}]}, 'airflow-dev': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-dev', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-dev-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev-deploy', 'owner': 'root'}]}, 'airflow-fr-tech': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-fr-tech', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-fr-tech-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech-deploy', 'owner': 'root'}]}, 'airflow-main': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-main', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-main-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main-deploy', 'owner': 'root'}]}, 'airflow-ml': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-ml', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-ml-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml-deploy', 'owner': 'root'}]}, 'airflow-platform-eng': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-platform-eng', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-platform-eng-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng-deploy', 'owner': 'root'}]}, 'airflow-research': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-research', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-research-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research-deploy', 'owner': 'root'}]}, 'airflow-search': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-search', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-search-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search-deploy', 'owner': 'root'}]}, 'airflow-sre': {'private_files': {'group': 'ops', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-sre', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-sre-deploy', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre-deploy', 'owner': 'root'}]}, 'airflow-test-k8s': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-test-k8s', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-test-k8s-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s-deploy', 'owner': 'root'}]}, 'airflow-wikidata': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wikidata', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wikidata-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata-deploy', 'owner': 'root'}]}, 'airflow-wmde': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wmde', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wmde-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde-deploy', 'owner': 'root'}]}, 'blunderbuss': {'usernames': [{'name': 'blunderbuss'}, {'name': 'blunderbuss-deploy'}]}, 'datahub': {'usernames': [{'name': 'datahub'}, {'name': 'datahub-deploy'}]}, 'datahub-next': {'usernames': [{'name': 'datahub-next'}, {'name': 'datahub-next-deploy'}]}, 'datasets-config': {'usernames': [{'name': 'datasets-config'}, {'name': 'datasets-config-deploy'}]}, 'datasets-config-next': {'usernames': [{'name': 'datasets-config-next'}, {'name': 'datasets-config-next-deploy'}]}, 'growthbook': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-deploy', 'owner': 'root'}, {'name': 'growthbook'}, {'name': 'growthbook-deploy'}]}, 'growthbook-next': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook-next', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-next-deploy', 'owner': 'root'}, {'name': 'growthbook-next'}, {'name': 'growthbook-next-deploy'}]}, 'llm-inference': {'usernames': [{'group': 'research-deployers', 'name': 'llm-inference', 'owner': 'root'}, {'group': 'research-deployers', 'name': 'llm-inference-deploy', 'owner': 'root'}]}, 'mediawiki-dumps-legacy': {'usernames': [{'name': 'mediawiki-dumps-legacy'}, {'name': 'mediawiki-dumps-legacy-deploy'}]}, 'mw-content-history-reconcile-enrich': {'usernames': [{'name': 'mw-content-history-reconcile-enrich'}, {'name': 'mw-content-history-reconcile-enrich-deploy'}]}, 'mw-content-history-reconcile-enrich-next': {'usernames': [{'name': 'mw-content-history-reconcile-enrich-next'}, {'name': 'mw-content-history-reconcile-enrich-next-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich'}, {'name': 'mw-dump-rev-content-reconcile-enrich-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich-next': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich-next'}, {'name': 'mw-dump-rev-content-reconcile-enrich-next-deploy'}]}, 'mw-page-html-content-change-enrich': {'usernames': [{'name': 'mw-page-html-content-change-enrich'}, {'name': 'mw-page-html-content-change-enrich-deploy'}]}, 'mw-page-html-content-change-enrich-next': {'usernames': [{'name': 'mw-page-html-content-change-enrich-next'}, {'name': 'mw-page-html-content-change-enrich-next-deploy'}]}, 'mw-page-html-feature-counts-change-enrich': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich'}, {'name': 'mw-page-html-feature-counts-change-enrich-deploy'}]}, 'mw-page-html-feature-counts-change-enrich-next': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich-next'}, {'name': 'mw-page-html-feature-counts-change-enrich-next-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'spark': {'usernames': [{'name': 'spark'}, {'name': 'spark-deploy'}]}, 'spark-history': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-deploy', 'owner': 'root'}]}, 'spark-history-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-test-deploy', 'owner': 'root'}]}, 'superset': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-deploy', 'owner': 'root'}]}, 'superset-next': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset-next', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-next-deploy', 'owner': 'root'}]}, 'test-kitchen': {'usernames': [{'name': 'test-kitchen'}, {'name': 'test-kitchen-deploy'}]}, 'test-kitchen-next': {'usernames': [{'name': 'test-kitchen-next'}, {'name': 'test-kitchen-next-deploy'}]}, 'turnilo': {'usernames': [{'name': 'turnilo'}, {'name': 'turnilo-deploy'}]}, 'turnilo-next': {'usernames': [{'name': 'turnilo-next'}, {'name': 'turnilo-next-deploy'}]}, 'wdqs-queryhammer': {'usernames': [{'name': 'wdqs-queryhammer'}, {'name': 'wdqs-queryhammer-deploy'}]}}, 'aux-k8s': {'codesearch': {'usernames': [{'name': 'codesearch'}, {'name': 'codesearch-deploy'}]}, 'jaeger': {'usernames': [{'name': 'jaeger'}, {'name': 'jaeger-deploy'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'redioscope': {'usernames': [{'name': 'redioscope'}, {'name': 'redioscope-deploy'}]}, 'sophroid': {'usernames': [{'name': 'sophroid'}, {'name': 'sophroid-deploy'}]}, 'zarcillo': {'usernames': [{'name': 'zarcillo'}, {'name': 'zarcillo-deploy'}]}}}

File[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-toolhub-test-deploy
+    namespace: opensearch-toolhub-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-toolhub-test-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem

Exec[renew certificate - dse__opensearch-toolhub-test]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-toolhub-test].orig
+++ Exec[renew certificate - dse__opensearch-toolhub-test]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-toolhub-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-test

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-toolhub-test.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-toolhub-test]

Cfssl::Cert[dse__opensearch-toolhub-deploy]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-toolhub-deploy].orig
+++ Cfssl::Cert[dse__opensearch-toolhub-deploy]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-toolhub-deploy
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    provide_chain   => True

File[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-apifeatureusage-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-apifeatureusage
+    namespace: opensearch-apifeatureusage
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-apifeatureusage
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem

File[/etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-ttmserver
+    namespace: opensearch-ttmserver
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-ttmserver
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-ttmserver.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-toolhub
+    names       => [{'organisation': 'view'}]
+    ensure      => present
+    hosts       => []

File[/etc/kubernetes/pki/dse__opensearch-ttmserver.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Exec[renew certificate - dse__opensearch-ttmserver]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-ttmserver].orig
+++ Exec[renew certificate - dse__opensearch-ttmserver]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-ttmserver.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-ttmserver.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-ttmserver]

File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-apifeatureusage
+    names       => [{'organisation': 'view'}]
+    ensure      => present
+    hosts       => []

K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-test-deploy-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-apifeatureusage-test-deploy
+    namespace   => opensearch-apifeatureusage-test
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-apifeatureusage-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-apifeatureusage
+    namespace: opensearch-apifeatureusage
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-apifeatureusage
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-key.pem

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

Exec[Generate cert dse__opensearch-toolhub-deploy refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-deploy refresh].orig
+++ Exec[Generate cert dse__opensearch-toolhub-deploy refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-deploy

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

Exec[Generate cert dse__opensearch-ttmserver-test]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-test].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-test]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-test

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]

Exec[renew certificate - dse__opensearch-ttmserver-test]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-ttmserver-test].orig
+++ Exec[renew certificate - dse__opensearch-ttmserver-test]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-ttmserver-test.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-test

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-ttmserver-test]

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-ttmserver-deploy
+    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    ensure      => present
+    hosts       => []

K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-apifeatureusage-deploy
+    namespace   => opensearch-apifeatureusage
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/pki/dse__opensearch-toolhub.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-toolhub-test.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-toolhub-test.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-toolhub-test.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-toolhub-test
+    namespace   => opensearch-toolhub-test
+    require     => ['Class[K8s::Base_dirs]']

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem > /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chained.pem
+    require   => Exec[Generate cert dse__opensearch-apifeatureusage-test refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-apifeatureusage-test]', 'File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem]']

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-apifeatureusage]

Parameters differences:

--- File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-apifeatureusage].orig
+++ File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-apifeatureusage]

+    group   => deployment
+    mode    => 0751
+    ensure  => directory
+    recurse => True
+    owner   => mwdeploy
+    force   => True

File[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-toolhub-test.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-toolhub-test.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-toolhub-test.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "opensearch-toolhub-test",
+  "hosts": [
+    "opensearch-toolhub-test"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy

+    refreshonly => True
+    subscribe   => File[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]

K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-toolhub-test-deploy
+    namespace   => opensearch-toolhub-test
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-apifeatureusage-test-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-apifeatureusage-test
+    namespace: opensearch-apifeatureusage-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-apifeatureusage-test
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-key.pem

K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-toolhub-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-toolhub.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-toolhub-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-toolhub.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-toolhub
+    namespace   => opensearch-toolhub
+    require     => ['Class[K8s::Base_dirs]']

File[/etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-toolhub-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-toolhub
+    namespace: opensearch-toolhub
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-toolhub
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-toolhub.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-toolhub-key.pem

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-toolhub-deploy-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-toolhub-deploy
+    namespace: opensearch-toolhub
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-toolhub-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test.chain.pem]

+    mode   => 0440
+    ensure => file
+    owner  => mwdeploy
+    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

Exec[Generate cert dse__opensearch-toolhub-deploy refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-deploy refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-toolhub-deploy refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-deploy

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]

Exec[renew certificate - dse__opensearch-apifeatureusage-test-deploy]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-apifeatureusage-test-deploy].orig
+++ Exec[renew certificate - dse__opensearch-apifeatureusage-test-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage-test-deploy.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-apifeatureusage-test-deploy]

Exec[Generate cert dse__opensearch-ttmserver-deploy]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-deploy].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-deploy.csr]

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-apifeatureusage-deploy
+    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    ensure      => present
+    hosts       => []

File[/etc/kubernetes/pki/dse__opensearch-toolhub.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Cfssl::Cert[dse__opensearch-toolhub-test]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-toolhub-test].orig
+++ Cfssl::Cert[dse__opensearch-toolhub-test]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-toolhub-test
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}]
+    provide_chain   => True

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub.pem /etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-toolhub.pem /etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem > /etc/kubernetes/pki/dse__opensearch-toolhub.chained.pem
+    require   => Exec[Generate cert dse__opensearch-toolhub refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-toolhub]', 'File[/etc/kubernetes/pki/dse__opensearch-toolhub.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-toolhub.pem]']

File[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-toolhub-test-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-toolhub-test
+    namespace: opensearch-toolhub-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-toolhub-test
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-toolhub-test.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem

File[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-toolhub-test-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-toolhub-test
+    namespace: opensearch-toolhub-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-toolhub-test
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-toolhub-test.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-toolhub-test-key.pem

Exec[Generate cert dse__opensearch-toolhub]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub].orig
+++ Exec[Generate cert dse__opensearch-toolhub]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-toolhub.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-toolhub-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub.csr]

File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

File[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config].orig
+++ File[/etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config.orig
+++ /etc/kubernetes/opensearch-apifeatureusage-deploy-dse-k8s-eqiad.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-apifeatureusage-deploy
+    namespace: opensearch-apifeatureusage
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
+users:
+- name: opensearch-apifeatureusage-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy-key.pem

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.csr]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.csr].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.csr]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Exec[renew certificate - dse__opensearch-ttmserver-deploy]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-ttmserver-deploy].orig
+++ Exec[renew certificate - dse__opensearch-ttmserver-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-ttmserver-deploy.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-ttmserver-deploy]

File[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-toolhub-deploy.csr
@@ -0,0 +1,26 @@
+{
+  "CN": "opensearch-toolhub-deploy",
+  "hosts": [
+    "opensearch-toolhub-deploy"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    },
+    {
+      "C": null,
+      "L": null,
+      "O": "deploy",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-toolhub-test]

Parameters differences:

--- File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-toolhub-test].orig
+++ File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-toolhub-test]

+    group   => deployment
+    mode    => 0751
+    ensure  => directory
+    recurse => True
+    owner   => mwdeploy
+    force   => True

K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-test-dse-k8s-eqiad.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
+    username    => opensearch-ttmserver-test
+    namespace   => opensearch-ttmserver-test
+    require     => ['Class[K8s::Base_dirs]']

Exec[renew certificate - dse__opensearch-ttmserver-test-deploy]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-ttmserver-test-deploy].orig
+++ Exec[renew certificate - dse__opensearch-ttmserver-test-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-ttmserver-test-deploy]

Class[Profile::Kubernetes::Deployment_server::Helmfile]

Parameters differences:

--- Class[Profile::Kubernetes::Deployment_server::Helmfile].orig
+++ Class[Profile::Kubernetes::Deployment_server::Helmfile]

@@
-    services => {'main': {'apertium': {'usernames': [{'name': 'apertium'}, {'name': 'apertium-deploy'}]}, 'api-gateway': {'usernames': [{'name': 'api-gateway'}, {'name': 'api-gateway-deploy'}]}, 'benthos-cache-invalidator': {'usernames': [{'name': 'benthos-cache-invalidator'}, {'name': 'benthos-cache-invalidator-deploy'}]}, 'changeprop': {'usernames': [{'name': 'changeprop'}, {'name': 'changeprop-deploy'}]}, 'changeprop-jobqueue': {'usernames': [{'name': 'changeprop-jobqueue'}, {'name': 'changeprop-jobqueue-deploy'}]}, 'chart-renderer': {'usernames': [{'name': 'chart-renderer'}, {'name': 'chart-renderer-deploy'}]}, 'cirrus-streaming-updater': {'usernames': [{'name': 'cirrus-streaming-updater'}, {'name': 'cirrus-streaming-updater-deploy'}]}, 'citoid': {'usernames': [{'name': 'citoid'}, {'name': 'citoid-deploy'}]}, 'commons-impact-analytics': {'usernames': [{'name': 'commons-impact-analytics'}, {'name': 'commons-impact-analytics-deploy'}]}, 'cxserver': {'usernames': [{'name': 'cxserver'}, {'name': 'cxserver-deploy'}]}, 'data-gateway': {'usernames': [{'name': 'data-gateway'}, {'name': 'data-gateway-deploy'}]}, 'developer-portal': {'usernames': [{'name': 'developer-portal'}, {'name': 'developer-portal-deploy'}]}, 'device-analytics': {'usernames': [{'name': 'device-analytics'}, {'name': 'device-analytics-deploy'}]}, 'echostore': {'usernames': [{'name': 'echostore'}, {'name': 'echostore-deploy'}]}, 'edit-analytics': {'usernames': [{'name': 'edit-analytics'}, {'name': 'edit-analytics-deploy'}]}, 'editor-analytics': {'usernames': [{'name': 'editor-analytics'}, {'name': 'editor-analytics-deploy'}]}, 'eventgate-analytics': {'usernames': [{'name': 'eventgate-analytics'}, {'name': 'eventgate-analytics-deploy'}]}, 'eventgate-analytics-external': {'usernames': [{'name': 'eventgate-analytics-external'}, {'name': 'eventgate-analytics-external-deploy'}]}, 'eventgate-logging-external': {'usernames': [{'name': 'eventgate-logging-external'}, {'name': 'eventgate-logging-external-deploy'}]}, 'eventgate-main': {'usernames': [{'name': 'eventgate-main'}, {'name': 'eventgate-main-deploy'}]}, 'eventstreams': {'usernames': [{'name': 'eventstreams'}, {'name': 'eventstreams-deploy'}]}, 'eventstreams-internal': {'usernames': [{'name': 'eventstreams-internal'}, {'name': 'eventstreams-internal-deploy'}]}, 'failoid-ng': {'usernames': [{'name': 'failoid-ng'}, {'name': 'failoid-ng-deploy'}]}, 'geo-analytics': {'usernames': [{'name': 'geo-analytics'}, {'name': 'geo-analytics-deploy'}]}, 'ipoid': {'usernames': [{'name': 'ipoid'}, {'name': 'ipoid-deploy'}]}, 'kartotherian': {'usernames': [{'name': 'kartotherian'}, {'name': 'kartotherian-deploy'}]}, 'linked-artifacts': {'usernames': [{'name': 'linked-artifacts'}, {'name': 'linked-artifacts-deploy'}]}, 'linkrecommendation': {'usernames': [{'name': 'linkrecommendation'}, {'name': 'linkrecommendation-deploy'}]}, 'machinetranslation': {'usernames': [{'name': 'machinetranslation'}, {'name': 'machinetranslation-deploy'}]}, 'mathoid': {'usernames': [{'name': 'mathoid'}, {'name': 'mathoid-deploy'}]}, 'media-analytics': {'usernames': [{'name': 'media-analytics'}, {'name': 'media-analytics-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'mobileapps': {'usernames': [{'name': 'mobileapps'}, {'name': 'mobileapps-deploy'}]}, 'mw-api-ext': {'usernames': [{'name': 'mw-api-ext'}, {'name': 'mw-api-ext-deploy'}]}, 'mw-api-int': {'usernames': [{'name': 'mw-api-int'}, {'name': 'mw-api-int-deploy'}]}, 'mw-cron': {'usernames': [{'name': 'mw-cron'}, {'name': 'mw-cron-deploy'}, {'group': 'restricted', 'name': 'mw-cron-restricted'}, {'group': 'restricted', 'name': 'mw-cron-restricted-deploy'}]}, 'mw-debug': {'usernames': [{'name': 'mw-debug'}, {'name': 'mw-debug-deploy'}]}, 'mw-experimental': {'usernames': [{'name': 'mw-experimental'}, {'name': 'mw-experimental-deploy'}]}, 'mw-jobrunner': {'usernames': [{'name': 'mw-jobrunner'}, {'name': 'mw-jobrunner-deploy'}]}, 'mw-mcrouter': {'usernames': [{'name': 'mw-mcrouter'}, {'name': 'mw-mcrouter-deploy'}]}, 'mw-misc': {'usernames': [{'name': 'mw-misc'}, {'name': 'mw-misc-deploy'}]}, 'mw-page-content-change-enrich': {'usernames': [{'name': 'mw-page-content-change-enrich'}, {'name': 'mw-page-content-change-enrich-deploy'}]}, 'mw-parsoid': {'usernames': [{'name': 'mw-parsoid'}, {'name': 'mw-parsoid-deploy'}]}, 'mw-script': {'usernames': [{'name': 'mw-script'}, {'name': 'mw-script-deploy'}, {'group': 'restricted', 'name': 'mw-script-restricted'}, {'group': 'restricted', 'name': 'mw-script-restricted-deploy'}]}, 'mw-videoscaler': {'usernames': [{'name': 'mw-videoscaler'}, {'name': 'mw-videoscaler-deploy'}]}, 'mw-web': {'usernames': [{'name': 'mw-web'}, {'name': 'mw-web-deploy'}]}, 'mw-wikifunctions': {'usernames': [{'name': 'mw-wikifunctions'}, {'name': 'mw-wikifunctions-deploy'}]}, 'opentelemetry-collector': {'usernames': [{'name': 'opentelemetry-collector'}, {'name': 'opentelemetry-collector-deploy'}]}, 'page-analytics': {'usernames': [{'name': 'page-analytics'}, {'name': 'page-analytics-deploy'}]}, 'proton': {'usernames': [{'name': 'proton'}, {'name': 'proton-deploy'}]}, 'push-notifications': {'usernames': [{'name': 'push-notifications'}, {'name': 'push-notifications-deploy'}]}, 'ratelimit': {'usernames': [{'name': 'ratelimit'}, {'name': 'ratelimit-deploy'}]}, 'ratelimit-media': {'usernames': [{'name': 'ratelimit-media'}, {'name': 'ratelimit-media-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'recommendation-api': {'usernames': [{'name': 'recommendation-api'}, {'name': 'recommendation-api-deploy'}]}, 'rest-gateway': {'usernames': [{'name': 'rest-gateway'}, {'name': 'rest-gateway-deploy'}]}, 'sessionstore': {'usernames': [{'name': 'sessionstore'}, {'name': 'sessionstore-deploy'}]}, 'shellbox': {'usernames': [{'name': 'shellbox'}, {'name': 'shellbox-deploy'}]}, 'shellbox-constraints': {'usernames': [{'name': 'shellbox-constraints'}, {'name': 'shellbox-constraints-deploy'}]}, 'shellbox-media': {'usernames': [{'name': 'shellbox-media'}, {'name': 'shellbox-media-deploy'}]}, 'shellbox-syntaxhighlight': {'usernames': [{'name': 'shellbox-syntaxhighlight'}, {'name': 'shellbox-syntaxhighlight-deploy'}]}, 'shellbox-timeline': {'usernames': [{'name': 'shellbox-timeline'}, {'name': 'shellbox-timeline-deploy'}]}, 'shellbox-video': {'usernames': [{'name': 'shellbox-video'}, {'name': 'shellbox-video-deploy'}]}, 'tegola-vector-tiles': {'usernames': [{'name': 'tegola-vector-tiles'}, {'name': 'tegola-vector-tiles-deploy'}]}, 'termbox': {'usernames': [{'name': 'termbox'}, {'name': 'termbox-deploy'}]}, 'thumbor': {'usernames': [{'name': 'thumbor'}, {'name': 'thumbor-deploy'}]}, 'toolhub': {'usernames': [{'name': 'toolhub'}, {'name': 'toolhub-deploy'}]}, 'wikidata-query-gui': {'usernames': [{'name': 'wikidata-query-gui'}, {'name': 'wikidata-query-gui-deploy'}]}, 'wikifeeds': {'usernames': [{'name': 'wikifeeds'}, {'name': 'wikifeeds-deploy'}]}, 'wikifunctions': {'usernames': [{'name': 'wikifunctions'}, {'name': 'wikifunctions-deploy'}]}, 'zotero': {'usernames': [{'name': 'zotero'}, {'name': 'zotero-deploy'}]}}, 'ml-serve': {'article-descriptions': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-descriptions', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-descriptions-deploy', 'owner': 'root'}]}, 'article-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-models-deploy', 'owner': 'root'}]}, 'articletopic-outlink': {'usernames': [{'group': 'deploy-ml-service', 'name': 'articletopic-outlink', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'articletopic-outlink-deploy', 'owner': 'root'}]}, 'edit-check': {'usernames': [{'group': 'deploy-ml-service', 'name': 'edit-check', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'edit-check-deploy', 'owner': 'root'}]}, 'experimental': {'usernames': [{'group': 'deploy-ml-service', 'name': 'experimental', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-deploy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-debug', 'owner': 'root'}]}, 'llm': {'usernames': [{'group': 'deploy-ml-service', 'name': 'llm', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'llm-deploy', 'owner': 'root'}]}, 'logo-detection': {'usernames': [{'group': 'deploy-ml-service', 'name': 'logo-detection', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'logo-detection-deploy', 'owner': 'root'}]}, 'ores-legacy': {'usernames': [{'group': 'deploy-ml-service', 'name': 'ores-legacy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'ores-legacy-deploy', 'owner': 'root'}]}, 'readability': {'usernames': [{'group': 'deploy-ml-service', 'name': 'readability', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'readability-deploy', 'owner': 'root'}]}, 'recommendation-api-ng': {'usernames': [{'group': 'deploy-ml-service', 'name': 'recommendation-api-ng', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'recommendation-api-ng-deploy', 'owner': 'root'}]}, 'revertrisk': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revertrisk', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revertrisk-deploy', 'owner': 'root'}]}, 'revise-tone-task-generator': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator-deploy', 'owner': 'root'}]}, 'revision-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revision-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revision-models-deploy', 'owner': 'root'}]}, 'revscoring-articlequality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articlequality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articlequality-deploy', 'owner': 'root'}]}, 'revscoring-articletopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articletopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articletopic-deploy', 'owner': 'root'}]}, 'revscoring-draftquality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-draftquality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-draftquality-deploy', 'owner': 'root'}]}, 'revscoring-drafttopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic-deploy', 'owner': 'root'}]}, 'revscoring-editquality-damaging': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging-deploy', 'owner': 'root'}]}, 'revscoring-editquality-goodfaith': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith-deploy', 'owner': 'root'}]}, 'revscoring-editquality-reverted': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted-deploy', 'owner': 'root'}]}}, 'dse-k8s': {'analytics': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-deploy', 'owner': 'root'}]}, 'analytics-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-test-deploy', 'owner': 'root'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'opensearch-ipoid': {'usernames': [{'name': 'opensearch-ipoid'}, {'name': 'opensearch-ipoid-deploy'}]}, 'opensearch-ipoid-test': {'usernames': [{'name': 'opensearch-ipoid-test'}, {'name': 'opensearch-ipoid-test-deploy'}]}, 'opensearch-operator': {'usernames': [{'name': 'opensearch-operator'}, {'name': 'opensearch-operator-deploy'}]}, 'opensearch-operator-3': {'usernames': [{'name': 'opensearch-operator-3'}, {'name': 'opensearch-operator-3-deploy'}]}, 'opensearch-semantic-search': {'usernames': [{'name': 'opensearch-semantic-search'}, {'name': 'opensearch-semantic-search-deploy'}]}, 'opensearch-semantic-search-test': {'usernames': [{'name': 'opensearch-semantic-search-test'}, {'name': 'opensearch-semantic-search-test-deploy'}]}, 'opensearch-test': {'usernames': [{'name': 'opensearch-test'}, {'name': 'opensearch-test-deploy'}]}}, 'dse-k8s-codfw': {'echoserver': {'usernames': [{'name': 'echoserver'}, {'name': 'echoserver-deploy'}]}}, 'dse-k8s-eqiad': {'airflow-analytics-product': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-product', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-product-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product-deploy', 'owner': 'root'}]}, 'airflow-analytics-test': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-test', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-test-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test-deploy', 'owner': 'root'}]}, 'airflow-dev': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-dev', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-dev-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev-deploy', 'owner': 'root'}]}, 'airflow-fr-tech': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-fr-tech', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-fr-tech-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech-deploy', 'owner': 'root'}]}, 'airflow-main': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-main', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-main-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main-deploy', 'owner': 'root'}]}, 'airflow-ml': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-ml', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-ml-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml-deploy', 'owner': 'root'}]}, 'airflow-platform-eng': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-platform-eng', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-platform-eng-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng-deploy', 'owner': 'root'}]}, 'airflow-research': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-research', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-research-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research-deploy', 'owner': 'root'}]}, 'airflow-search': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-search', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-search-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search-deploy', 'owner': 'root'}]}, 'airflow-sre': {'private_files': {'group': 'ops', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-sre', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-sre-deploy', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre-deploy', 'owner': 'root'}]}, 'airflow-test-k8s': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-test-k8s', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-test-k8s-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s-deploy', 'owner': 'root'}]}, 'airflow-wikidata': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wikidata', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wikidata-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata-deploy', 'owner': 'root'}]}, 'airflow-wmde': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wmde', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wmde-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde-deploy', 'owner': 'root'}]}, 'blunderbuss': {'usernames': [{'name': 'blunderbuss'}, {'name': 'blunderbuss-deploy'}]}, 'datahub': {'usernames': [{'name': 'datahub'}, {'name': 'datahub-deploy'}]}, 'datahub-next': {'usernames': [{'name': 'datahub-next'}, {'name': 'datahub-next-deploy'}]}, 'datasets-config': {'usernames': [{'name': 'datasets-config'}, {'name': 'datasets-config-deploy'}]}, 'datasets-config-next': {'usernames': [{'name': 'datasets-config-next'}, {'name': 'datasets-config-next-deploy'}]}, 'growthbook': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-deploy', 'owner': 'root'}, {'name': 'growthbook'}, {'name': 'growthbook-deploy'}]}, 'growthbook-next': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook-next', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-next-deploy', 'owner': 'root'}, {'name': 'growthbook-next'}, {'name': 'growthbook-next-deploy'}]}, 'llm-inference': {'usernames': [{'group': 'research-deployers', 'name': 'llm-inference', 'owner': 'root'}, {'group': 'research-deployers', 'name': 'llm-inference-deploy', 'owner': 'root'}]}, 'mediawiki-dumps-legacy': {'usernames': [{'name': 'mediawiki-dumps-legacy'}, {'name': 'mediawiki-dumps-legacy-deploy'}]}, 'mw-content-history-reconcile-enrich': {'usernames': [{'name': 'mw-content-history-reconcile-enrich'}, {'name': 'mw-content-history-reconcile-enrich-deploy'}]}, 'mw-content-history-reconcile-enrich-next': {'usernames': [{'name': 'mw-content-history-reconcile-enrich-next'}, {'name': 'mw-content-history-reconcile-enrich-next-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich'}, {'name': 'mw-dump-rev-content-reconcile-enrich-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich-next': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich-next'}, {'name': 'mw-dump-rev-content-reconcile-enrich-next-deploy'}]}, 'mw-page-html-content-change-enrich': {'usernames': [{'name': 'mw-page-html-content-change-enrich'}, {'name': 'mw-page-html-content-change-enrich-deploy'}]}, 'mw-page-html-content-change-enrich-next': {'usernames': [{'name': 'mw-page-html-content-change-enrich-next'}, {'name': 'mw-page-html-content-change-enrich-next-deploy'}]}, 'mw-page-html-feature-counts-change-enrich': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich'}, {'name': 'mw-page-html-feature-counts-change-enrich-deploy'}]}, 'mw-page-html-feature-counts-change-enrich-next': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich-next'}, {'name': 'mw-page-html-feature-counts-change-enrich-next-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'spark': {'usernames': [{'name': 'spark'}, {'name': 'spark-deploy'}]}, 'spark-history': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-deploy', 'owner': 'root'}]}, 'spark-history-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-test-deploy', 'owner': 'root'}]}, 'superset': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-deploy', 'owner': 'root'}]}, 'superset-next': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset-next', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-next-deploy', 'owner': 'root'}]}, 'test-kitchen': {'usernames': [{'name': 'test-kitchen'}, {'name': 'test-kitchen-deploy'}]}, 'test-kitchen-next': {'usernames': [{'name': 'test-kitchen-next'}, {'name': 'test-kitchen-next-deploy'}]}, 'turnilo': {'usernames': [{'name': 'turnilo'}, {'name': 'turnilo-deploy'}]}, 'turnilo-next': {'usernames': [{'name': 'turnilo-next'}, {'name': 'turnilo-next-deploy'}]}, 'wdqs-queryhammer': {'usernames': [{'name': 'wdqs-queryhammer'}, {'name': 'wdqs-queryhammer-deploy'}]}}, 'aux-k8s': {'codesearch': {'usernames': [{'name': 'codesearch'}, {'name': 'codesearch-deploy'}]}, 'jaeger': {'usernames': [{'name': 'jaeger'}, {'name': 'jaeger-deploy'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'redioscope': {'usernames': [{'name': 'redioscope'}, {'name': 'redioscope-deploy'}]}, 'sophroid': {'usernames': [{'name': 'sophroid'}, {'name': 'sophroid-deploy'}]}, 'zarcillo': {'usernames': [{'name': 'zarcillo'}, {'name': 'zarcillo-deploy'}]}}}
+    services => {'main': {'apertium': {'usernames': [{'name': 'apertium'}, {'name': 'apertium-deploy'}]}, 'api-gateway': {'usernames': [{'name': 'api-gateway'}, {'name': 'api-gateway-deploy'}]}, 'benthos-cache-invalidator': {'usernames': [{'name': 'benthos-cache-invalidator'}, {'name': 'benthos-cache-invalidator-deploy'}]}, 'changeprop': {'usernames': [{'name': 'changeprop'}, {'name': 'changeprop-deploy'}]}, 'changeprop-jobqueue': {'usernames': [{'name': 'changeprop-jobqueue'}, {'name': 'changeprop-jobqueue-deploy'}]}, 'chart-renderer': {'usernames': [{'name': 'chart-renderer'}, {'name': 'chart-renderer-deploy'}]}, 'cirrus-streaming-updater': {'usernames': [{'name': 'cirrus-streaming-updater'}, {'name': 'cirrus-streaming-updater-deploy'}]}, 'citoid': {'usernames': [{'name': 'citoid'}, {'name': 'citoid-deploy'}]}, 'commons-impact-analytics': {'usernames': [{'name': 'commons-impact-analytics'}, {'name': 'commons-impact-analytics-deploy'}]}, 'cxserver': {'usernames': [{'name': 'cxserver'}, {'name': 'cxserver-deploy'}]}, 'data-gateway': {'usernames': [{'name': 'data-gateway'}, {'name': 'data-gateway-deploy'}]}, 'developer-portal': {'usernames': [{'name': 'developer-portal'}, {'name': 'developer-portal-deploy'}]}, 'device-analytics': {'usernames': [{'name': 'device-analytics'}, {'name': 'device-analytics-deploy'}]}, 'echostore': {'usernames': [{'name': 'echostore'}, {'name': 'echostore-deploy'}]}, 'edit-analytics': {'usernames': [{'name': 'edit-analytics'}, {'name': 'edit-analytics-deploy'}]}, 'editor-analytics': {'usernames': [{'name': 'editor-analytics'}, {'name': 'editor-analytics-deploy'}]}, 'eventgate-analytics': {'usernames': [{'name': 'eventgate-analytics'}, {'name': 'eventgate-analytics-deploy'}]}, 'eventgate-analytics-external': {'usernames': [{'name': 'eventgate-analytics-external'}, {'name': 'eventgate-analytics-external-deploy'}]}, 'eventgate-logging-external': {'usernames': [{'name': 'eventgate-logging-external'}, {'name': 'eventgate-logging-external-deploy'}]}, 'eventgate-main': {'usernames': [{'name': 'eventgate-main'}, {'name': 'eventgate-main-deploy'}]}, 'eventstreams': {'usernames': [{'name': 'eventstreams'}, {'name': 'eventstreams-deploy'}]}, 'eventstreams-internal': {'usernames': [{'name': 'eventstreams-internal'}, {'name': 'eventstreams-internal-deploy'}]}, 'failoid-ng': {'usernames': [{'name': 'failoid-ng'}, {'name': 'failoid-ng-deploy'}]}, 'geo-analytics': {'usernames': [{'name': 'geo-analytics'}, {'name': 'geo-analytics-deploy'}]}, 'ipoid': {'usernames': [{'name': 'ipoid'}, {'name': 'ipoid-deploy'}]}, 'kartotherian': {'usernames': [{'name': 'kartotherian'}, {'name': 'kartotherian-deploy'}]}, 'linked-artifacts': {'usernames': [{'name': 'linked-artifacts'}, {'name': 'linked-artifacts-deploy'}]}, 'linkrecommendation': {'usernames': [{'name': 'linkrecommendation'}, {'name': 'linkrecommendation-deploy'}]}, 'machinetranslation': {'usernames': [{'name': 'machinetranslation'}, {'name': 'machinetranslation-deploy'}]}, 'mathoid': {'usernames': [{'name': 'mathoid'}, {'name': 'mathoid-deploy'}]}, 'media-analytics': {'usernames': [{'name': 'media-analytics'}, {'name': 'media-analytics-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'mobileapps': {'usernames': [{'name': 'mobileapps'}, {'name': 'mobileapps-deploy'}]}, 'mw-api-ext': {'usernames': [{'name': 'mw-api-ext'}, {'name': 'mw-api-ext-deploy'}]}, 'mw-api-int': {'usernames': [{'name': 'mw-api-int'}, {'name': 'mw-api-int-deploy'}]}, 'mw-cron': {'usernames': [{'name': 'mw-cron'}, {'name': 'mw-cron-deploy'}, {'group': 'restricted', 'name': 'mw-cron-restricted'}, {'group': 'restricted', 'name': 'mw-cron-restricted-deploy'}]}, 'mw-debug': {'usernames': [{'name': 'mw-debug'}, {'name': 'mw-debug-deploy'}]}, 'mw-experimental': {'usernames': [{'name': 'mw-experimental'}, {'name': 'mw-experimental-deploy'}]}, 'mw-jobrunner': {'usernames': [{'name': 'mw-jobrunner'}, {'name': 'mw-jobrunner-deploy'}]}, 'mw-mcrouter': {'usernames': [{'name': 'mw-mcrouter'}, {'name': 'mw-mcrouter-deploy'}]}, 'mw-misc': {'usernames': [{'name': 'mw-misc'}, {'name': 'mw-misc-deploy'}]}, 'mw-page-content-change-enrich': {'usernames': [{'name': 'mw-page-content-change-enrich'}, {'name': 'mw-page-content-change-enrich-deploy'}]}, 'mw-parsoid': {'usernames': [{'name': 'mw-parsoid'}, {'name': 'mw-parsoid-deploy'}]}, 'mw-script': {'usernames': [{'name': 'mw-script'}, {'name': 'mw-script-deploy'}, {'group': 'restricted', 'name': 'mw-script-restricted'}, {'group': 'restricted', 'name': 'mw-script-restricted-deploy'}]}, 'mw-videoscaler': {'usernames': [{'name': 'mw-videoscaler'}, {'name': 'mw-videoscaler-deploy'}]}, 'mw-web': {'usernames': [{'name': 'mw-web'}, {'name': 'mw-web-deploy'}]}, 'mw-wikifunctions': {'usernames': [{'name': 'mw-wikifunctions'}, {'name': 'mw-wikifunctions-deploy'}]}, 'opentelemetry-collector': {'usernames': [{'name': 'opentelemetry-collector'}, {'name': 'opentelemetry-collector-deploy'}]}, 'page-analytics': {'usernames': [{'name': 'page-analytics'}, {'name': 'page-analytics-deploy'}]}, 'proton': {'usernames': [{'name': 'proton'}, {'name': 'proton-deploy'}]}, 'push-notifications': {'usernames': [{'name': 'push-notifications'}, {'name': 'push-notifications-deploy'}]}, 'ratelimit': {'usernames': [{'name': 'ratelimit'}, {'name': 'ratelimit-deploy'}]}, 'ratelimit-media': {'usernames': [{'name': 'ratelimit-media'}, {'name': 'ratelimit-media-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'recommendation-api': {'usernames': [{'name': 'recommendation-api'}, {'name': 'recommendation-api-deploy'}]}, 'rest-gateway': {'usernames': [{'name': 'rest-gateway'}, {'name': 'rest-gateway-deploy'}]}, 'sessionstore': {'usernames': [{'name': 'sessionstore'}, {'name': 'sessionstore-deploy'}]}, 'shellbox': {'usernames': [{'name': 'shellbox'}, {'name': 'shellbox-deploy'}]}, 'shellbox-constraints': {'usernames': [{'name': 'shellbox-constraints'}, {'name': 'shellbox-constraints-deploy'}]}, 'shellbox-media': {'usernames': [{'name': 'shellbox-media'}, {'name': 'shellbox-media-deploy'}]}, 'shellbox-syntaxhighlight': {'usernames': [{'name': 'shellbox-syntaxhighlight'}, {'name': 'shellbox-syntaxhighlight-deploy'}]}, 'shellbox-timeline': {'usernames': [{'name': 'shellbox-timeline'}, {'name': 'shellbox-timeline-deploy'}]}, 'shellbox-video': {'usernames': [{'name': 'shellbox-video'}, {'name': 'shellbox-video-deploy'}]}, 'tegola-vector-tiles': {'usernames': [{'name': 'tegola-vector-tiles'}, {'name': 'tegola-vector-tiles-deploy'}]}, 'termbox': {'usernames': [{'name': 'termbox'}, {'name': 'termbox-deploy'}]}, 'thumbor': {'usernames': [{'name': 'thumbor'}, {'name': 'thumbor-deploy'}]}, 'toolhub': {'usernames': [{'name': 'toolhub'}, {'name': 'toolhub-deploy'}]}, 'wikidata-query-gui': {'usernames': [{'name': 'wikidata-query-gui'}, {'name': 'wikidata-query-gui-deploy'}]}, 'wikifeeds': {'usernames': [{'name': 'wikifeeds'}, {'name': 'wikifeeds-deploy'}]}, 'wikifunctions': {'usernames': [{'name': 'wikifunctions'}, {'name': 'wikifunctions-deploy'}]}, 'zotero': {'usernames': [{'name': 'zotero'}, {'name': 'zotero-deploy'}]}}, 'ml-serve': {'article-descriptions': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-descriptions', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-descriptions-deploy', 'owner': 'root'}]}, 'article-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-models-deploy', 'owner': 'root'}]}, 'articletopic-outlink': {'usernames': [{'group': 'deploy-ml-service', 'name': 'articletopic-outlink', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'articletopic-outlink-deploy', 'owner': 'root'}]}, 'edit-check': {'usernames': [{'group': 'deploy-ml-service', 'name': 'edit-check', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'edit-check-deploy', 'owner': 'root'}]}, 'experimental': {'usernames': [{'group': 'deploy-ml-service', 'name': 'experimental', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-deploy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-debug', 'owner': 'root'}]}, 'llm': {'usernames': [{'group': 'deploy-ml-service', 'name': 'llm', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'llm-deploy', 'owner': 'root'}]}, 'logo-detection': {'usernames': [{'group': 'deploy-ml-service', 'name': 'logo-detection', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'logo-detection-deploy', 'owner': 'root'}]}, 'ores-legacy': {'usernames': [{'group': 'deploy-ml-service', 'name': 'ores-legacy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'ores-legacy-deploy', 'owner': 'root'}]}, 'readability': {'usernames': [{'group': 'deploy-ml-service', 'name': 'readability', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'readability-deploy', 'owner': 'root'}]}, 'recommendation-api-ng': {'usernames': [{'group': 'deploy-ml-service', 'name': 'recommendation-api-ng', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'recommendation-api-ng-deploy', 'owner': 'root'}]}, 'revertrisk': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revertrisk', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revertrisk-deploy', 'owner': 'root'}]}, 'revise-tone-task-generator': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator-deploy', 'owner': 'root'}]}, 'revision-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revision-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revision-models-deploy', 'owner': 'root'}]}, 'revscoring-articlequality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articlequality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articlequality-deploy', 'owner': 'root'}]}, 'revscoring-articletopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articletopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articletopic-deploy', 'owner': 'root'}]}, 'revscoring-draftquality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-draftquality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-draftquality-deploy', 'owner': 'root'}]}, 'revscoring-drafttopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic-deploy', 'owner': 'root'}]}, 'revscoring-editquality-damaging': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging-deploy', 'owner': 'root'}]}, 'revscoring-editquality-goodfaith': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith-deploy', 'owner': 'root'}]}, 'revscoring-editquality-reverted': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted-deploy', 'owner': 'root'}]}}, 'dse-k8s': {'analytics': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-deploy', 'owner': 'root'}]}, 'analytics-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-test-deploy', 'owner': 'root'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'opensearch-ipoid': {'usernames': [{'name': 'opensearch-ipoid'}, {'name': 'opensearch-ipoid-deploy'}]}, 'opensearch-ipoid-test': {'usernames': [{'name': 'opensearch-ipoid-test'}, {'name': 'opensearch-ipoid-test-deploy'}]}, 'opensearch-operator': {'usernames': [{'name': 'opensearch-operator'}, {'name': 'opensearch-operator-deploy'}]}, 'opensearch-operator-3': {'usernames': [{'name': 'opensearch-operator-3'}, {'name': 'opensearch-operator-3-deploy'}]}, 'opensearch-semantic-search': {'usernames': [{'name': 'opensearch-semantic-search'}, {'name': 'opensearch-semantic-search-deploy'}]}, 'opensearch-semantic-search-test': {'usernames': [{'name': 'opensearch-semantic-search-test'}, {'name': 'opensearch-semantic-search-test-deploy'}]}, 'opensearch-test': {'usernames': [{'name': 'opensearch-test'}, {'name': 'opensearch-test-deploy'}]}, 'opensearch-toolhub': {'usernames': [{'name': 'opensearch-toolhub'}, {'name': 'opensearch-toolhub-deploy'}]}, 'opensearch-toolhub-test': {'usernames': [{'name': 'opensearch-toolhub-test'}, {'name': 'opensearch-toolhub-test-deploy'}]}, 'opensearch-apifeatureusage': {'usernames': [{'name': 'opensearch-apifeatureusage'}, {'name': 'opensearch-apifeatureusage-deploy'}]}, 'opensearch-apifeatureusage-test': {'usernames': [{'name': 'opensearch-apifeatureusage-test'}, {'name': 'opensearch-apifeatureusage-test-deploy'}]}, 'opensearch-ttmserver': {'usernames': [{'name': 'opensearch-ttmserver'}, {'name': 'opensearch-ttmserver-deploy'}]}, 'opensearch-ttmserver-test': {'usernames': [{'name': 'opensearch-ttmserver-test'}, {'name': 'opensearch-ttmserver-test-deploy'}]}}, 'dse-k8s-codfw': {'echoserver': {'usernames': [{'name': 'echoserver'}, {'name': 'echoserver-deploy'}]}}, 'dse-k8s-eqiad': {'airflow-analytics-product': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-product', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-product-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product-deploy', 'owner': 'root'}]}, 'airflow-analytics-test': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-test', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-test-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test-deploy', 'owner': 'root'}]}, 'airflow-dev': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-dev', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-dev-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev-deploy', 'owner': 'root'}]}, 'airflow-fr-tech': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-fr-tech', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-fr-tech-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech-deploy', 'owner': 'root'}]}, 'airflow-main': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-main', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-main-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main-deploy', 'owner': 'root'}]}, 'airflow-ml': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-ml', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-ml-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml-deploy', 'owner': 'root'}]}, 'airflow-platform-eng': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-platform-eng', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-platform-eng-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng-deploy', 'owner': 'root'}]}, 'airflow-research': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-research', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-research-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research-deploy', 'owner': 'root'}]}, 'airflow-search': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-search', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-search-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search-deploy', 'owner': 'root'}]}, 'airflow-sre': {'private_files': {'group': 'ops', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-sre', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-sre-deploy', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre-deploy', 'owner': 'root'}]}, 'airflow-test-k8s': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-test-k8s', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-test-k8s-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s-deploy', 'owner': 'root'}]}, 'airflow-wikidata': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wikidata', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wikidata-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata-deploy', 'owner': 'root'}]}, 'airflow-wmde': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wmde', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wmde-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde-deploy', 'owner': 'root'}]}, 'blunderbuss': {'usernames': [{'name': 'blunderbuss'}, {'name': 'blunderbuss-deploy'}]}, 'datahub': {'usernames': [{'name': 'datahub'}, {'name': 'datahub-deploy'}]}, 'datahub-next': {'usernames': [{'name': 'datahub-next'}, {'name': 'datahub-next-deploy'}]}, 'datasets-config': {'usernames': [{'name': 'datasets-config'}, {'name': 'datasets-config-deploy'}]}, 'datasets-config-next': {'usernames': [{'name': 'datasets-config-next'}, {'name': 'datasets-config-next-deploy'}]}, 'growthbook': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-deploy', 'owner': 'root'}, {'name': 'growthbook'}, {'name': 'growthbook-deploy'}]}, 'growthbook-next': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook-next', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-next-deploy', 'owner': 'root'}, {'name': 'growthbook-next'}, {'name': 'growthbook-next-deploy'}]}, 'llm-inference': {'usernames': [{'group': 'research-deployers', 'name': 'llm-inference', 'owner': 'root'}, {'group': 'research-deployers', 'name': 'llm-inference-deploy', 'owner': 'root'}]}, 'mediawiki-dumps-legacy': {'usernames': [{'name': 'mediawiki-dumps-legacy'}, {'name': 'mediawiki-dumps-legacy-deploy'}]}, 'mw-content-history-reconcile-enrich': {'usernames': [{'name': 'mw-content-history-reconcile-enrich'}, {'name': 'mw-content-history-reconcile-enrich-deploy'}]}, 'mw-content-history-reconcile-enrich-next': {'usernames': [{'name': 'mw-content-history-reconcile-enrich-next'}, {'name': 'mw-content-history-reconcile-enrich-next-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich'}, {'name': 'mw-dump-rev-content-reconcile-enrich-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich-next': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich-next'}, {'name': 'mw-dump-rev-content-reconcile-enrich-next-deploy'}]}, 'mw-page-html-content-change-enrich': {'usernames': [{'name': 'mw-page-html-content-change-enrich'}, {'name': 'mw-page-html-content-change-enrich-deploy'}]}, 'mw-page-html-content-change-enrich-next': {'usernames': [{'name': 'mw-page-html-content-change-enrich-next'}, {'name': 'mw-page-html-content-change-enrich-next-deploy'}]}, 'mw-page-html-feature-counts-change-enrich': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich'}, {'name': 'mw-page-html-feature-counts-change-enrich-deploy'}]}, 'mw-page-html-feature-counts-change-enrich-next': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich-next'}, {'name': 'mw-page-html-feature-counts-change-enrich-next-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'spark': {'usernames': [{'name': 'spark'}, {'name': 'spark-deploy'}]}, 'spark-history': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-deploy', 'owner': 'root'}]}, 'spark-history-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-test-deploy', 'owner': 'root'}]}, 'superset': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-deploy', 'owner': 'root'}]}, 'superset-next': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset-next', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-next-deploy', 'owner': 'root'}]}, 'test-kitchen': {'usernames': [{'name': 'test-kitchen'}, {'name': 'test-kitchen-deploy'}]}, 'test-kitchen-next': {'usernames': [{'name': 'test-kitchen-next'}, {'name': 'test-kitchen-next-deploy'}]}, 'turnilo': {'usernames': [{'name': 'turnilo'}, {'name': 'turnilo-deploy'}]}, 'turnilo-next': {'usernames': [{'name': 'turnilo-next'}, {'name': 'turnilo-next-deploy'}]}, 'wdqs-queryhammer': {'usernames': [{'name': 'wdqs-queryhammer'}, {'name': 'wdqs-queryhammer-deploy'}]}}, 'aux-k8s': {'codesearch': {'usernames': [{'name': 'codesearch'}, {'name': 'codesearch-deploy'}]}, 'jaeger': {'usernames': [{'name': 'jaeger'}, {'name': 'jaeger-deploy'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'redioscope': {'usernames': [{'name': 'redioscope'}, {'name': 'redioscope-deploy'}]}, 'sophroid': {'usernames': [{'name': 'sophroid'}, {'name': 'sophroid-deploy'}]}, 'zarcillo': {'usernames': [{'name': 'zarcillo'}, {'name': 'zarcillo-deploy'}]}}}

K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config]

Parameters differences:

--- K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config].orig
+++ K8s::Kubeconfig[/etc/kubernetes/opensearch-ttmserver-dse-k8s-codfw.config]

+    ensure      => present
+    owner       => mwdeploy
+    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__opensearch-ttmserver.pem', 'key': '/etc/kubernetes/pki/dse__opensearch-ttmserver-key.pem', 'chain': '/etc/kubernetes/pki/dse__opensearch-ttmserver.chain.pem', 'chained': '/etc/kubernetes/pki/dse__opensearch-ttmserver.chained.pem'}
+    group       => deployment
+    mode        => 0640
+    master_host => dse-k8s-ctrl.svc.codfw.wmnet
+    username    => opensearch-ttmserver
+    namespace   => opensearch-ttmserver
+    require     => ['Class[K8s::Base_dirs]']

Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-ttmserver-test-deploy refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-ttmserver-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test-deploy.chain.pem]

File[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]

Parameters differences:

--- File[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr].orig
+++ File[/etc/cfssl/csr/dse__opensearch-ttmserver-test.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/dse__opensearch-ttmserver-test.csr.orig
+++ /etc/cfssl/csr/dse__opensearch-ttmserver-test.csr
@@ -0,0 +1,19 @@
+{
+  "CN": "opensearch-ttmserver-test",
+  "hosts": [
+    "opensearch-ttmserver-test"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+    {
+      "C": null,
+      "L": null,
+      "O": "view",
+      "OU": null,
+      "S": null
+    }
+  ]
+}

Cfssl::Cert[dse__opensearch-ttmserver]

Parameters differences:

--- Cfssl::Cert[dse__opensearch-ttmserver].orig
+++ Cfssl::Cert[dse__opensearch-ttmserver]

+    key             => {'algo': 'ecdsa', 'size': 256}
+    ensure          => present
+    owner           => mwdeploy
+    renew_seconds   => 952200
+    group           => deployment
+    common_name     => opensearch-ttmserver
+    mode            => 0740
+    notify_services => []
+    label           => dse
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    auto_renew      => True
+    outdir          => /etc/kubernetes/pki
+    hosts           => []
+    before_services => []
+    names           => [{'organisation': 'view'}]
+    provide_chain   => True

Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh on intermediate ca change].orig
+++ Exec[Generate cert dse__opensearch-apifeatureusage-deploy refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr]
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-apifeatureusage-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy

+    refreshonly => True
+    subscribe   => File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage-deploy.chain.pem]

File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-ttmserver-test.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-ttmserver-test.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-test.pem]

+    mode   => 0440
+    owner  => mwdeploy
+    ensure => file
+    group  => deployment

Exec[renew certificate - dse__opensearch-apifeatureusage]

Parameters differences:

--- Exec[renew certificate - dse__opensearch-apifeatureusage].orig
+++ Exec[renew certificate - dse__opensearch-apifeatureusage]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__opensearch-apifeatureusage.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-apifeatureusage

+    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem -checkend 952200
+    require     => Exec[Generate cert dse__opensearch-apifeatureusage]

Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-apifeatureusage-test-deploy.csr]

+    key         => {'algo': 'ecdsa', 'size': 256}
+    common_name => opensearch-apifeatureusage-test-deploy
+    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
+    ensure      => present
+    hosts       => []

File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy-key.pem]

+    mode      => 0440
+    ensure    => file
+    show_diff => False
+    owner     => mwdeploy
+    backup    => False
+    group     => deployment

Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem].orig
+++ Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]

+    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem > /etc/kubernetes/pki/dse__opensearch-apifeatureusage.chained.pem
+    require   => Exec[Generate cert dse__opensearch-apifeatureusage refresh on intermediate ca change]
+    subscribe => ['Exec[renew certificate - dse__opensearch-apifeatureusage]', 'File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.chain.pem]', 'File[/etc/kubernetes/pki/dse__opensearch-apifeatureusage.pem]']

File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-apifeatureusage-test]

Parameters differences:

--- File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-apifeatureusage-test].orig
+++ File[/etc/helmfile-defaults/private/dse-k8s_services/opensearch-apifeatureusage-test]

+    group   => deployment
+    mode    => 0751
+    ensure  => directory
+    recurse => True
+    owner   => mwdeploy
+    force   => True

File[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config]

Parameters differences:

--- File[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config].orig
+++ File[/etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config]

+    mode   => 0640
+    owner  => mwdeploy
+    ensure => present
+    group  => deployment

Content differences:

--- /etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config.orig
+++ /etc/kubernetes/opensearch-toolhub-test-deploy-dse-k8s-codfw.config
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+preferences: {}
+current-context: default-system
+contexts:
+- name: default-system
+  context:
+    cluster: default-cluster
+    user: opensearch-toolhub-test-deploy
+    namespace: opensearch-toolhub-test
+clusters:
+- name: default-cluster
+  cluster:
+    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
+users:
+- name: opensearch-toolhub-test-deploy
+  user:
+    client-certificate: /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem
+    client-key: /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem

File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chained.pem]

Parameters differences:

--- File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chained.pem].orig
+++ File[/etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chained.pem]

+    require => Exec[create chained cert /etc/kubernetes/pki/dse__opensearch-toolhub-deploy.chain.pem]
+    owner   => mwdeploy
+    ensure  => file
+    group   => deployment

Exec[Generate cert dse__opensearch-toolhub-test-deploy]

Parameters differences:

--- Exec[Generate cert dse__opensearch-toolhub-test-deploy].orig
+++ Exec[Generate cert dse__opensearch-toolhub-test-deploy]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy

+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__opensearch-toolhub-test-deploy-key.pem 2>&1)"

+    require     => Cfssl::Csr[/etc/cfssl/csr/dse__opensearch-toolhub-test-deploy.csr]

Compilation results for deploy1003.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

Resources modified

Relevant files