Compilation results for pki-root1001.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the old catalog

• File[/etc/cfssl/ssl/discovery/discovery.csr]
• File[/etc/cfssl/ssl/discovery]
• Exec[Generate cert discovery refresh]
• Exec[renew certificate - discovery]
• Cfssl::Cert[discovery]
• Cfssl::Csr[/etc/cfssl/csr/discovery.csr]
• File[/etc/cfssl/ssl/discovery/discovery.pem]
• File[/etc/cfssl/csr/discovery.csr]
• File[/etc/cfssl/ssl/discovery/discovery-key.pem]
• Exec[Generate cert discovery]

Resources modified

• File[/etc/cfssl/ssl/discovery]

  Parameters differences:

  --- File[/etc/cfssl/ssl/discovery].orig
  +++ File[/etc/cfssl/ssl/discovery]
  
  -    group   => root
  -    recurse => True
  -    owner   => root
  -    ensure  => directory
  -    mode    => 0740
  

• Cfssl::Cert[discovery]

  Parameters differences:

  --- Cfssl::Cert[discovery].orig
  +++ Cfssl::Cert[discovery]
  
  -    profile         => intermediate
  -    names           => [{'organisation': 'Wikimedia Foundation, Inc', 'organisational_unit': 'SRE Foundations', 'locality': 'San Francisco', 'state': 'California', 'country': 'US'}]
  -    provide_chain   => False
  -    notify_services => []
  -    group           => root
  -    owner           => root
  -    before_services => []
  -    hosts           => []
  -    common_name     => discovery
  -    key             => {'algo': 'ecdsa', 'size': 521}
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    require         => Cfssl::Signer[Wikimedia_Internal_Root_CA]
  -    mode            => 0740
  -    signer_config   => {'config_dir': '/etc/cfssl/signers/Wikimedia_Internal_Root_CA'}
  -    auto_renew      => True
  -    renew_seconds   => 952200
  -    ensure          => present
  

• Cfssl::Csr[/etc/cfssl/csr/discovery.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/discovery.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/discovery.csr]
  
  -    common_name => discovery
  -    hosts       => []
  -    names       => [{'organisation': 'Wikimedia Foundation, Inc', 'organisational_unit': 'SRE Foundations', 'locality': 'San Francisco', 'state': 'California', 'country': 'US'}]
  -    ensure      => present
  -    key         => {'algo': 'ecdsa', 'size': 521}
  

• File[/etc/cfssl/csr/discovery.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/discovery.csr].orig
  +++ File[/etc/cfssl/csr/discovery.csr]
  
  -    group  => root
  -    owner  => root
  -    ensure => file
  -    mode   => 0400
  

  Content differences:

  --- /etc/cfssl/csr/discovery.csr.orig
  +++ /etc/cfssl/csr/discovery.csr
  @@ -1,19 +0,0 @@
  -{
  -  "CN": "discovery",
  -  "hosts": [
  -    "discovery"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 521
  -  },
  -  "names": [
  -    {
  -      "C": "US",
  -      "L": "San Francisco",
  -      "O": "Wikimedia Foundation, Inc",
  -      "OU": "SRE Foundations",
  -      "S": "California"
  -    }
  -  ]
  -}

• Exec[renew certificate - discovery]

  Parameters differences:

  --- Exec[renew certificate - discovery].orig
  +++ Exec[renew certificate - discovery]
  
  -    command     => /usr/bin/cfssl sign -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf  -profile intermediate /etc/cfssl/ssl/discovery/discovery.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/discovery/discovery
  
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/discovery/discovery.pem -checkend 952200
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    require     => Exec[Generate cert discovery]
  

• File[/etc/cfssl/ssl/discovery/discovery.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/discovery/discovery.pem].orig
  +++ File[/etc/cfssl/ssl/discovery/discovery.pem]
  
  -    group  => root
  -    owner  => root
  -    ensure => file
  -    mode   => 0440
  

• Exec[Generate cert discovery refresh]

  Parameters differences:

  --- Exec[Generate cert discovery refresh].orig
  +++ Exec[Generate cert discovery refresh]
  
  -    command     => /usr/bin/cfssl gencert -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf  -profile intermediate /etc/cfssl/csr/discovery.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/discovery/discovery
  
  -    subscribe   => File[/etc/cfssl/csr/discovery.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/cfssl/ssl/discovery/discovery.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/discovery/discovery.csr].orig
  +++ File[/etc/cfssl/ssl/discovery/discovery.csr]
  
  -    group  => root
  -    owner  => root
  -    ensure => file
  -    mode   => 0440
  

• File[/etc/cfssl/ssl/discovery/discovery-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/discovery/discovery-key.pem].orig
  +++ File[/etc/cfssl/ssl/discovery/discovery-key.pem]
  
  -    group     => root
  -    owner     => root
  -    backup    => False
  -    ensure    => file
  -    show_diff => False
  -    mode      => 0440
  

• Class[Profile::Pki::Root_ca]

  Parameters differences:

  --- Class[Profile::Pki::Root_ca].orig
  +++ Class[Profile::Pki::Root_ca]
  
  @@
  -    intermediates => ['debmonitor', 'discovery', 'discovery2026', 'kafka', 'cloud_wmnet_ca', 'etcd', 'wikikube', 'wikikube_front_proxy', 'wikikube_staging', 'wikikube_staging_front_proxy', 'mlserve', 'mlserve_front_proxy', 'mlserve_staging', 'mlserve_staging_front_proxy', 'aux', 'aux_front_proxy', 'dse', 'dse_front_proxy', 'cassandra', 'puppet', 'network_devices', 'syslog', 'zuul']
  +    intermediates => ['debmonitor', 'discovery2026', 'kafka', 'cloud_wmnet_ca', 'etcd', 'wikikube', 'wikikube_front_proxy', 'wikikube_staging', 'wikikube_staging_front_proxy', 'mlserve', 'mlserve_front_proxy', 'mlserve_staging', 'mlserve_staging_front_proxy', 'aux', 'aux_front_proxy', 'dse', 'dse_front_proxy', 'cassandra', 'puppet', 'network_devices', 'syslog', 'zuul']
  

• Exec[Generate cert discovery]

  Parameters differences:

  --- Exec[Generate cert discovery].orig
  +++ Exec[Generate cert discovery]
  
  -    command     => /usr/bin/cfssl gencert -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf  -profile intermediate /etc/cfssl/csr/discovery.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/discovery/discovery
  
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/discovery/discovery.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/discovery/discovery-key.pem 2>&1)"
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    require     => Cfssl::Csr[/etc/cfssl/csr/discovery.csr]
  

Relevant files

• Production catalog
• Change catalog
• Production errors/warnings
• Change errors/warnings
• Core Diff
• Standard Diff