--- Class[Profile::Pki::Multirootca].orig
+++ Class[Profile::Pki::Multirootca]
@@
- intermediates => {'debmonitor': {'ocsp_port': 10001}, 'discovery': {'ocsp_port': 10002, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'kafka': {'ocsp_port': 10003, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth'], 'profiles': {'kafka_11': {'expiry': '8760h'}}}, 'cloud_wmnet_ca': {'ocsp_port': 10004, 'default_usages': ['digital signature', 'key encipherment', 'server auth']}, 'etcd': {'ocsp_port': 10005, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'cassandra': {'ocsp_port': 10006, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'syslog': {'ocsp_port': 10007, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'puppet_rsa': {'ocsp_port': 10008, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'zuul': {'ocsp_port': 10009, 'default_usages': ['server auth', 'client auth']}, 'discovery2026': {'ocsp_port': 10010, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'wikikube': {'ocsp_port': 20010, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_front_proxy': {'ocsp_port': 20011}, 'wikikube_staging': {'ocsp_port': 20020, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_staging_front_proxy': {'ocsp_port': 20021, 'default_expiry': '72h'}, 'mlserve': {'ocsp_port': 20030, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_front_proxy': {'ocsp_port': 20031}, 'mlserve_staging': {'ocsp_port': 20040, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_staging_front_proxy': {'ocsp_port': 20041, 'default_expiry': '72h'}, 'aux': {'ocsp_port': 20050, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'aux_front_proxy': {'ocsp_port': 20051}, 'dse': {'ocsp_port': 20061, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'dse_front_proxy': {'ocsp_port': 20062}, 'network_devices': {'ocsp_port': 20063, 'default_expiry': '8760h', 'default_usages': ['digital signature', 'key encipherment', 'server auth']}}
+ intermediates => {'debmonitor': {'ocsp_port': 10001}, 'kafka': {'ocsp_port': 10003, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth'], 'profiles': {'kafka_11': {'expiry': '8760h'}}}, 'cloud_wmnet_ca': {'ocsp_port': 10004, 'default_usages': ['digital signature', 'key encipherment', 'server auth']}, 'etcd': {'ocsp_port': 10005, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'cassandra': {'ocsp_port': 10006, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'syslog': {'ocsp_port': 10007, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'puppet_rsa': {'ocsp_port': 10008, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'zuul': {'ocsp_port': 10009, 'default_usages': ['server auth', 'client auth']}, 'discovery2026': {'ocsp_port': 10010, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'wikikube': {'ocsp_port': 20010, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_front_proxy': {'ocsp_port': 20011}, 'wikikube_staging': {'ocsp_port': 20020, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_staging_front_proxy': {'ocsp_port': 20021, 'default_expiry': '72h'}, 'mlserve': {'ocsp_port': 20030, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_front_proxy': {'ocsp_port': 20031}, 'mlserve_staging': {'ocsp_port': 20040, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_staging_front_proxy': {'ocsp_port': 20041, 'default_expiry': '72h'}, 'aux': {'ocsp_port': 20050, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'aux_front_proxy': {'ocsp_port': 20051}, 'dse': {'ocsp_port': 20061, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'dse_front_proxy': {'ocsp_port': 20062}, 'network_devices': {'ocsp_port': 20063, 'default_expiry': '8760h', 'default_usages': ['digital signature', 'key encipherment', 'server auth']}}
Cfssl::Ocsp[discovery]
- Parameters differences:
--- Cfssl::Ocsp[discovery].orig
+++ Cfssl::Ocsp[discovery]
- ocsprefresh_update => True
- db_driver => mysql
- listen_port => 10002
- refresh_interval => 96h
- common_name => pki1001.eqiad.wmnet
- listen_addr => 127.0.0.1
- additional_names => []
- ca_file => /etc/cfssl/signers/discovery/ca/discovery.pem
- db_conf_file => /etc/cfssl/db.conf
- log_level => info
- Profile::Pki::Multirootca::Monitoring[discovery]
- Parameters differences:
--- Profile::Pki::Multirootca::Monitoring[discovery].orig
+++ Profile::Pki::Multirootca::Monitoring[discovery]
- ca_file => /etc/cfssl/signers/discovery/ca/discovery.pem
- ensure => present
- vhost => pki.discovery.wmnet
- intermediate => discovery
- Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]
- Parameters differences:
--- Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]
- command => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet
- subscribe => File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
- refreshonly => True
- environment => ['GODEBUG=x509ignoreCN=0']
- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]
- Parameters differences:
--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]
- group => root
- notify => Service[rsyslog]
- owner => root
- ensure => present
- mode => 0444
- Content differences:
--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-discovery-certificate-expiry" then {
- action(
- type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry/syslog.log"
- fileOwner="root" fileGroup="root"
- fileCreateMode="0644"
- )
- & stop
-}
- Nrpe::Check[check_check_certificate_expiry_discovery]
- Parameters differences:
--- Nrpe::Check[check_check_certificate_expiry_discovery].orig
+++ Nrpe::Check[check_check_certificate_expiry_discovery]
- command => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem
- ensure => present
- sudo_user => root
- before => Monitoring::Service[check_certificate_expiry_discovery]
- Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
- Parameters differences:
--- Systemd::Timer::Job[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
- syslog_match_startswith => True
- command => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery/ca/discovery.pem --responses-file /etc/cfssl/ocsp/discovery.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery' discovery
- syslog_force_stop => True
- send_mail_to => root@pki1001.eqiad.wmnet
- logfile_basedir => /var/log
- monitoring_contact_groups => admins
- logfile_group => root
- logfile_name => syslog.log
- logging_enabled => True
- success_exit_status => []
- ignore_errors => False
- monitoring_enabled => False
- send_mail => False
- environment => {}
- private_tmp => False
- fixed_random_delay => False
- send_mail_only_on_error => True
- description => OCSP Refresh job - discovery
- monitoring_notes_url => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
- ensure => present
- user => root
- logfile_perms => all
- interval => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
- Parameters differences:
--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
- command => /bin/systemctl daemon-reload
- refreshonly => True
- Sudo::User[nrpe-check_check_certificate_expiry_discovery]
- Parameters differences:
--- Sudo::User[nrpe-check_check_certificate_expiry_discovery].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_discovery]
- privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem']
- user => nagios
- ensure => present
- tag => nrpe::check
- require => ['Class[Sudo]']
- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]
- Parameters differences:
--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]
- syslog_match_startswith => True
- command => /usr/local/bin/nrpe2nodexp --alert-rule-hash "38e4dbcfd07ed60daf5bb89397abbe29" --timeout 10 --check-command "check_check_certificate_expiry_discovery"
- syslog_force_stop => True
- send_mail_to => root@pki1001.eqiad.wmnet
- logfile_basedir => /var/log
- splay => 60
- group => prometheus-node-exporter
- monitoring_contact_groups => admins
- logfile_group => root
- logfile_name => syslog.log
- logging_enabled => False
- syslog_identifier => nrpe2nodexp-check_certificate_expiry_discovery
- success_exit_status => []
- ignore_errors => True
- monitoring_enabled => False
- send_mail => False
- environment => {}
- fixed_random_delay => True
- private_tmp => False
- send_mail_only_on_error => True
- description => execution of nrpe2nodexp for the check_check_certificate_expiry_discovery command.
- monitoring_notes_url => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
- ensure => absent
- user => nagios
- logfile_perms => all
- interval => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
- Parameters differences:
--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
- group => root
- notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
- owner => root
- ensure => present
- mode => 0444
- Content differences:
--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-discovery-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom
- File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]
- Parameters differences:
--- File[/etc/cfssl/signers/discovery/ca/discovery-key.pem].orig
+++ File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]
- group => root
- notify => Service[cfssl-multirootca]
- owner => root
- ensure => file
- show_diff => False
- mode => 0400
- Content differences:
--- /etc/cfssl/signers/discovery/ca/discovery-key.pem.orig
+++ /etc/cfssl/signers/discovery/ca/discovery-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######
- File[/var/log/cfssl-ocsprefresh-discovery]
- Parameters differences:
--- File[/var/log/cfssl-ocsprefresh-discovery].orig
+++ File[/var/log/cfssl-ocsprefresh-discovery]
- group => root
- force => True
- owner => root
- backup => False
- ensure => directory
- mode => 0755
- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
- Parameters differences:
--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
- group => root
- notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]
- owner => root
- ensure => present
- mode => 0444
- Content differences:
--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target
- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]
- Parameters differences:
--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]
- group => root
- notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
- owner => root
- ensure => present
- mode => 0444
- Content differences:
--- /lib/systemd/system/cfssl-ocsprefresh-discovery.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - discovery
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery/ca/discovery.pem --responses-file /etc/cfssl/ocsp/discovery.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery' discovery
- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]
- Parameters differences:
--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]
- group => root
- notify => Service[nagios-nrpe-server]
- owner => root
- ensure => present
- tag => nrpe::check
- require => Package[nagios-nrpe-server]
- mode => 0444
- Content differences:
--- /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_discovery]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem
- Httpd::Site[pki.discovery.wmnet]
- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]
- Parameters differences:
--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]
- group => root
- owner => root
- ensure => file
- mode => 0440
- Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
- Parameters differences:
--- Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
- override => False
- migration_task => T407130
- monitoring_enabled => False
- require => Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
- restart => False
- service_params => {}
- unit_type => timer
- monitoring_contact_group => admins
- monitoring_critical => False
- ensure => present
- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]
- Parameters differences:
--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]
- group => root
- notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
- owner => root
- ensure => present
- mode => 0444
- Content differences:
--- /lib/systemd/system/cfssl-ocsprefresh-discovery.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-discovery.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-discovery.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target
- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]
- Parameters differences:
--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]
- group => root
- notify => Service[rsyslog]
- owner => root
- ensure => present
- mode => 0444
- Content differences:
--- /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-discovery" then {
- action(
- type="omfile" file="/var/log/cfssl-ocsprefresh-discovery/syslog.log"
- fileOwner="root" fileGroup="root"
- fileCreateMode="0644"
- )
- & stop
-}
- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
- Parameters differences:
--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
- group => root
- owner => root
- ensure => present
- mode => 0444
- Content differences:
--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry/*.log {
- daily
- copytruncate
- missingok
- compress
- delaycompress
- notifempty
- rotate 15
- size 256M
-}
- File[/etc/cfssl/multiroot.conf]
- Content differences:
--- /etc/cfssl/multiroot.conf.orig
+++ /etc/cfssl/multiroot.conf
@@ -2,12 +2,6 @@
private = file:///etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
certificate = /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
config = /etc/cfssl/signers/debmonitor/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[discovery]
-private = file:///etc/cfssl/signers/discovery/ca/discovery-key.pem
-certificate = /etc/cfssl/signers/discovery/ca/discovery.pem
-config = /etc/cfssl/signers/discovery/cfssl.conf
dbconfig = /etc/cfssl/db.conf
[kafka]
- Systemd::Timer[cfssl-ocsprefresh-discovery]
- Parameters differences:
--- Systemd::Timer[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Timer[cfssl-ocsprefresh-discovery]
- splay => 0
- accuracy => 15sec
- unit_name => cfssl-ocsprefresh-discovery.service
- ensure => present
- timer_intervals => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
- fixed_random_delay => False
- Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]
- Parameters differences:
--- Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]
- user => root
- environment => {}
- extra_packages => []
- require => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
- run_cmd => /usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom
- ensure => present
- filesource => puppet:///modules/prometheus/check_certificate_expiry.py
- interval => daily
- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]
- Parameters differences:
--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]
- group => root
- notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]
- owner => root
- ensure => absent
- mode => 0444
- Content differences:
--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_discovery command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_discovery
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "38e4dbcfd07ed60daf5bb89397abbe29" --timeout 10 --check-command "check_check_certificate_expiry_discovery"
- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
- Parameters differences:
--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
- command => /bin/systemctl daemon-reload
- refreshonly => True
- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
- Parameters differences:
--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
- command => /bin/systemctl daemon-reload
- refreshonly => True
- before => ['Service[cfssl-ocsprefresh-discovery.timer]']
- Logrotate::Conf[cfssl-ocsprefresh-discovery]
- Parameters differences:
--- Logrotate::Conf[cfssl-ocsprefresh-discovery].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-discovery]
- ensure => present
- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]
- Parameters differences:
--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]
- command => /bin/systemctl daemon-reload
- refreshonly => True
- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]
- Parameters differences:
--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]
- contact_groups => admins
- is_volatile => 0
- check_period => 24x7
- max_check_attempts => 3
- check_interval => 1
- notification_options => c,r,f
- notification_period => 24x7
- check_freshness => 0
- notifications_enabled => 1
- service_description => Check to ensure the signer certificate is valid CA: discovery
- notes_url => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
- servicegroups => pki_eqiad
- retry_interval => 1
- notification_interval => 0
- check_command => nrpe_check!check_check_certificate_expiry_discovery!10
- active_checks_enabled => 1
- host_name => pki1001
- passive_checks_enabled => 1
- ensure => present
- Systemd::Unit[cfssl-ocspserve@discovery]
- Parameters differences:
--- Systemd::Unit[cfssl-ocspserve@discovery].orig
+++ Systemd::Unit[cfssl-ocspserve@discovery]
- restart => True
- override => False
- override_filename => puppet-override.conf
- unit => cfssl-ocspserve@discovery
- ensure => present
- require => ['Class[Systemd]']
- Systemd::Service[cfssl-ocsprefresh-discovery]
- Parameters differences:
--- Systemd::Service[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Service[cfssl-ocsprefresh-discovery]
- override => False
- migration_task => T407130
- monitoring_enabled => False
- require => Systemd::Unit[cfssl-ocsprefresh-discovery.service]
- restart => False
- service_params => {}
- unit_type => timer
- monitoring_contact_group => admins
- monitoring_critical => False
- ensure => present
- Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]
- Parameters differences:
--- Service[nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]
- ensure => stopped
- enable => False
- provider => systemd
- before => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]']
- Httpd::Conf[pki.discovery.wmnet]
- Cfssl::Config[discovery]
- Parameters differences:
--- Cfssl::Config[discovery].orig
+++ Cfssl::Config[discovery]
- notify => Service[cfssl-multirootca]
- default_crl_url => http://pki.discovery.wmnet/crl/discovery
- default_ocsp_url => http://pki.discovery.wmnet/ocsp/discovery
- profiles => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
- default_expiry => 672h
- default_usages => ['digital signature', 'key encipherment', 'server auth']
- ensure => present
- remotes => {}
- path => /etc/cfssl/signers/discovery/cfssl.conf
- default_auth_key => default_auth
- default_auth_remote => {}
- auth_keys => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]
- Parameters differences:
--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]
- group => root
- owner => root
- ensure => absent
- File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
- Parameters differences:
--- File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
- group => root
- owner => root
- ensure => file
- mode => 0400
- Content differences:
--- /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
- "CN": "pki1001.eqiad.wmnet",
- "hosts": [
- "pki1001.eqiad.wmnet"
- ],
- "key": {
- "algo": "ecdsa",
- "size": 256
- },
- "names": [
-
- ]
-}
- Nrpe::Monitor_service[check_certificate_expiry_discovery]
- Parameters differences:
--- Nrpe::Monitor_service[check_certificate_expiry_discovery].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_discovery]
- nrpe2nodexp_parse_perf_data => False
- enable_nrpe2nodexp => False
- retries => 3
- nrpe_command => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem
- check_interval => 1
- contact_group => admins
- sudo_user => root
- notes_url => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
- retry_interval => 1
- migration_task => T350694
- enable_icinga_check => True
- critical => False
- description => Check to ensure the signer certificate is valid CA: discovery
- ensure => present
- alertmanager_team => observability
- timeout => 10
- Systemd::Syslog[cfssl-ocsprefresh-discovery]
- Parameters differences:
--- Systemd::Syslog[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-discovery]
- readable_by => all
- programname_comparison => startswith
- base_dir => /var/log
- force_stop => True
- group => root
- owner => root
- log_filename => syslog.log
- ensure => present
- File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]
- Parameters differences:
--- File[/usr/local/bin/prometheus-check-discovery-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]
- group => root
- owner => root
- source => puppet:///modules/prometheus/check_certificate_expiry.py
- ensure => present
- mode => 0555
- File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]
- Parameters differences:
--- File[/etc/logrotate.d/cfssl-ocsprefresh-discovery].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]
- group => root
- owner => root
- ensure => present
- mode => 0444
- Content differences:
--- /etc/logrotate.d/cfssl-ocsprefresh-discovery.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-discovery
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-discovery
-
-/var/log/cfssl-ocsprefresh-discovery/*.log {
- daily
- copytruncate
- missingok
- compress
- delaycompress
- notifempty
- rotate 15
- size 256M
-}
- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]