Compilation results for pki1001.eqiad.wmnet: System changes detected

You can retrieve this result from host.json.

Catalog differences

Summary

Total Resources:	4897
Resources added:	165
Resources removed:	2222
Resources modified:	2414
Change percentage:	98.04%

Resources only in the new catalog

File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft]
Nftables::Set[DEPLOYMENT_HOSTS]
File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft]
Prometheus::Node_textfile[check-nft]
File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft]
File[/etc/systemd/system/nftables.service.d]
Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]
File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft]
File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft]
File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]
Nftables::Set[CLOUD_NETWORKS]
File[/etc/nftables/]
File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft]
Exec[unmask_nftables.service]
Nftables::Set[LABSTORE_HOSTS]
File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf]
Nftables::Set[CUMIN_MASTERS]
Nftables::Set[ANALYTICS_NETWORKS]
File[/etc/nftables/input/10_ssh-from-bastion.nft]
File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft]
File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer]
File[/etc/nftables.conf]
File[/var/log/prometheus-node-textfile-check-nft]
File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft]
Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]
File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft]
Nftables::Set[KAFKA_BROKERS_JUMBO]
Nftables::Service[ssh-from-cumin-masters]
File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft]
File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft]
File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft]
File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft]
File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft]
File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft]
Nftables::Set[MONITORING_HOSTS]
File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft]
Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]
Class[Nftables]
File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft]
File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft]
Systemd::Timer::Job[prometheus-node-textfile-check-nft]
File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft]
File[/etc/logrotate.d/prometheus-node-textfile-check-nft]
File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft]
Nftables::Set[STAGING_KUBEPODS_NETWORKS]
File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft]
Nftables::Set[KAFKAMON_HOSTS]
File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft]
File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft]
File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft]
File[/etc/nftables/input]
Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]
Nftables::Service[full-monitoring-metrics-access-udp]
Motd::Script[insetup::infrastructure_foundations_nftables]
Nftables::File[base]
File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft]
Rsyslog::Conf[prometheus-node-textfile-check-nft]
Nftables::Set[INSTALL_HOSTS]
File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft]
Nftables::Set[PROMETHEUS_HOSTS]
Nftables::Set[FRACK_NETWORKS]
File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft]
Nftables::Service[full-monitoring-metrics-access-tcp]
File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft]
File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]
File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]
File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft]
Nftables::Set[NETWORK_INFRA]
File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft]
File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft]
Nftables::Set[ZOOKEEPER_FLINK_HOSTS]
Motd::Message[insetup::infrastructure_foundations_nftables]
File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft]
Service[prometheus-node-textfile-check-nft.timer]
Nftables::Set[ZOOKEEPER_HOSTS_MAIN]
File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft]
Nftables::Set[LABS_NETWORKS]
Systemd::Unit[prometheus-node-textfile-check-nft.service]
Nftables::Set[PRODUCTION_NETWORKS]
File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft]
File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft]
File[/etc/nftables/output]
Systemd::Service[prometheus-node-textfile-check-nft]
File[/usr/local/bin/check-nft]
File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft]
Logrotate::Conf[prometheus-node-textfile-check-nft]
File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables]
File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]
File[/etc/nftables/sets]
File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]
File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft]
File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft]
File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft]
Package[nftables]
Class[Profile::Firewall::Nftables_base_sets]
File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft]
File[/etc/nftables/main.nft]
File[/etc/nftables/sets/INTERNAL_ipv6.nft]
File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft]
Systemd::Unit[nftables]
File[/etc/nftables/sets/CACHES_ipv6.nft]
File[/etc/nftables/sets/INTERNAL_ipv4.nft]
File[/etc/nftables/prerouting]
Nftables::Set[SANDBOX_NETWORKS]
Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS]
File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft]
File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft]
Systemd::Syslog[prometheus-node-textfile-check-nft]
Class[Role::Insetup::Infrastructure_foundations_nftables]
File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]
File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft]
Systemd::Service[nftables]
Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS]
Systemd::Unmask[nftables.service]
Nftables::Set[CACHES]
File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft]
Nftables::Set[MYSQL_ROOT_CLIENTS]
File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft]
File[/etc/nftables/forward]
File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft]
File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft]
File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]
File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft]
Nftables::Set[DOMAIN_NETWORKS]
File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft]
File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft]
File[/etc/nftables/postrouting]
Systemd::Unit[prometheus-node-textfile-check-nft.timer]
File[/etc/nftables/sets/CACHES_ipv4.nft]
Node[__node_regexp__pki1001.eqiad.]
Nftables::Set[DRUID_PUBLIC_HOSTS]
Nftables::Set[MGMT_NETWORKS]
Nftables::Set[INTERNAL]
File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft]
File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft]
File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft]
File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft]
File[/etc/systemd/system/nftables.service.d/puppet-override.conf]
File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft]
Service[nftables]
File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft]
Nftables::Set[MW_APPSERVER_NETWORKS]
Nftables::Set[KAFKA_BROKERS_LOGGING]
Nftables::Set[AUX_KUBEPODS_NETWORKS]
Systemd::Timer[prometheus-node-textfile-check-nft]
File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft]
File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft]
Nftables::Set[DSE_KUBEPODS_NETWORKS]
File[/etc/nftables/notrack]
Nftables::Set[CLOUD_PRIVATE_NETWORKS]
File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft]
Exec[systemd daemon-reload for nftables.service (nftables)]
File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]
File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft]
Nftables::Set[LINK_LOCAL]
Nftables::Set[BASTION_HOSTS]
Nftables::Set[CLOUD_NETWORKS_PUBLIC]
File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft]
Nftables::Set[KAFKA_BROKERS_MAIN]
File[/etc/nftables/100_base_puppet.nft]
File[/etc/nftables/input/10_ssh-from-cumin-masters.nft]
Nftables::Service[ssh-from-bastion]
File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft]
File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft]
File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft]

Resources only in the old catalog

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]
Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]
File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]
Cfssl::Signer[dse]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]
Systemd::Unit[cfssl-ocsprefresh-mlserve.service]
Service[cfssl-ocsprefresh-kafka.timer]
File[/srv/cfssl/bundles/network_devices.pem]
Systemd::Unit[cfssl-ocsprefresh-etcd.service]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]
Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]
Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]
Package[python3-pymysql]
File[/etc/apache2/conf-available/00-defaults.conf]
Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/usr/local/bin/prometheus-check-aux-certificate-expiry]
File[/lib/systemd/system/cfssl-ocspserve@zuul.service]
Nrpe::Monitor_service[check_certificate_expiry_kafka]
File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]
File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Systemd::Syslog[cfssl-ocsprefresh-zuul]
Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]
Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]
File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[cfssl-ocsprefresh-discovery]
Exec[ensure_present_mod_filter]
Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]
Systemd::Service[cfssl-ocspserve@etcd]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]
File[/etc/logrotate.d/ulogd]
File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]
Rsyslog::Conf[cfssl-ocsprefresh-syslog]
Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Service[cfssl-ocsprefresh-mlserve_staging.timer]
Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]
Service[ferm]
File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]
Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]
Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]
Service[cfssl-ocspserve@mlserve]
Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]
Systemd::Timer::Job[nrpe2nodexp-ferm_active]
File[/etc/cfssl/signers/syslog/cfssl.conf]
Sudo::User[nrpe_certificate_check_wikikube]
Systemd::Timer[cfssl-ocsprefresh-kafka]
Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]
File[/etc/sudoers.d/nrpe_certificate_check_wikikube]
File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
Cfssl::Config[wikikube]
File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Cfssl::Config[mlserve_staging_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]
File[/etc/cfssl/ocsp/mlserve_staging.ocsp]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/var/log/cfssl-ocsprefresh-discovery]
File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]
Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]
File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]
Sudo::User[nrpe_certificate_check_dse]
Exec[Generate initial CRL for mlserve]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]
File[/etc/cfssl/signers/wikikube_staging]
File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]
Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]
Class[Profile::Pki::Multirootca]
Cfssl::Ocsp[aux]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]
File[/etc/cfssl/signers/discovery2026]
Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]
File[/var/log/cfssl-ocsprefresh-dse_front_proxy]
File[/srv/cfssl/bundles/puppet_rsa.pem]
Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]
File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf]
File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]
Service[cfssl-ocsprefresh-wikikube.timer]
Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]
Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]
Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]
File[/srv/cfssl/bundles/discovery.pem]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]
Service[cfssl-ocspserve@dse]
Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]
Service[cfssl-ocspserve@network_devices]
File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
Prometheus::Blackbox::Check::Http[PKI_syslog]
Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]
Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]
Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
File[/srv/cfssl/bundles/mlserve_staging.pem]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
File[/etc/cfssl/db.conf.json]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]
Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]
Cfssl::Ocsp[dse_front_proxy]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]
File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
File[/etc/apache2/conf-enabled]
File[/etc/ferm/conf.d/01_drop-blocked-nets]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]
Sudo::User[nrpe_certificate_check_mlserve]
Monitoring::Service[check_certificate_expiry_puppet_rsa]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]
Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_wikikube]
File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
Augeas[Apache2 logs]
Cfssl::Ocsp[Wikimedia_Internal_Root_CA]
File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Ferm::Rule[dscp-default]
File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]
Nrpe::Check[check_ferm_active]
Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]
Nrpe::Check[check_check_certificate_expiry_dse]
Exec[Generate initial CRL for wikikube_staging_front_proxy]
File[/etc/apache2/env-available]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-syslog.timer]
Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]
Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]
Nrpe::Monitor_service[check_certificate_expiry_aux]
File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]
File[/etc/cfssl/signers/wikikube_front_proxy]
Systemd::Timer::Job[cfssl-ocsprefresh-aux]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]
Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]
Systemd::Unit[cfssl-ocsprefresh-discovery.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]
Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]
Nrpe::Check[check_check_certificate_expiry_syslog]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]
Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]
File[/srv/cfssl/bundles/kafka.pem]
File[/etc/sudoers.d/nrpe_certificate_check_zuul]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Nrpe::Monitor_service[check_certificate_expiry_network_devices]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
File[/srv/cfssl/bundles/zuul.pem]
File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]
File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]
File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]
Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]
Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]
File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
File[/etc/ulogd.conf]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]
File[/etc/nagios/nrpe.d/check_ferm_active.cfg]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]
Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]
Profile::Pki::Multirootca::Monitoring[syslog]
File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
Logrotate::Conf[ulogd]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]
Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
File[/etc/ferm/conf.d/00_defs]
Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]
Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]
Systemd::Service[cfssl-ocsprefresh-discovery]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
Httpd::Mod_conf[status]
File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]
File[/etc/cfssl/ocsp/syslog.ocsp]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]
Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Exec[Generate initial CRL for dse_front_proxy]
File[/srv/cfssl/bundles/dse_front_proxy.pem]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]
Systemd::Unit[cfssl-ocspserve@mlserve_staging]
Systemd::Unit[cfssl-ocspserve@cassandra]
Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
Systemd::Service[cfssl-ocsprefresh-puppet_rsa]
Systemd::Service[cfssl-gc-expired-certs]
Sudo::User[nrpe-check_check_certificate_expiry_syslog]
Cfssl::Signer[puppet_rsa]
Nrpe::Check[check_check_certificate_expiry_wikikube]
Systemd::Unit[cfssl-gc-expired-certs.service]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]
Rsyslog::Conf[wmf_auto_restart_ulogd2]
Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]
Systemd::Service[cfssl-ocspserve@discovery]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]
Logrotate::Conf[cfssl-ocsprefresh-dse]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]
File[/etc/cfssl/signers/discovery/cfssl.conf]
Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]
Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]
Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]
Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]
File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]
Service[ulogd2]
File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/signers/dse_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]
Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
Class[Role::Pki::Multirootca]
Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]
File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]
File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]
Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]
Logrotate::Conf[cfssl-ocsprefresh-cassandra]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
Service[wmf_auto_restart_ulogd2.timer]
Exec[Generate initial CRL for cloud_wmnet_ca]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]
Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]
Systemd::Service[cfssl-ocsprefresh-wikikube_staging]
Systemd::Unit[cfssl-ocsprefresh-etcd.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]
Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]
File_line[auto_restart_file_presence_apache2]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Monitoring::Service[ferm_active]
File[/var/log/cfssl-gc-expired-certs]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]
File[/etc/cfssl/signers/zuul/cfssl.conf]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]
Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]
Cfssl::Ocsp[dse]
File[/srv/cfssl/bundles/wikikube_staging.pem]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]
Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]
File[/etc/cfssl/signers/mlserve_staging/ca]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]
File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]
Systemd::Service[cfssl-ocspserve@dse]
Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]
Prometheus::Blackbox::Check::Http[PKI_network_devices]
Systemd::Timer[wmf_auto_restart_apache-htcacheclean]
Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]
Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
Sudo::User[nrpe_certificate_check_dse_front_proxy]
File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]
Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]
Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]
Cfssl::Ocsp[wikikube_staging_front_proxy]
Service[wmf_auto_restart_apache-htcacheclean.timer]
File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
File[/usr/local/sbin/cfssl-ocsprefresh]
Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]
File[/var/log/wmf_auto_restart_apache2]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Nrpe::Check[check_check_certificate_expiry_kafka]
File[/var/log/ulogd]
File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]
Cfssl::Config[cloud_wmnet_ca]
Systemd::Syslog[cfssl-ocsprefresh-network_devices]
Systemd::Syslog[cfssl-ocsprefresh-aux]
File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]
File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]
Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]
Monitoring::Service[check_certificate_expiry_wikikube]
File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]
Service[cfssl-ocspserve@mlserve_staging]
File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
Sudo::User[nrpe_certificate_check_zuul]
Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]
File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]
Cfssl::Ocsp[mlserve_front_proxy]
Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]
Exec[Generate initial CRL for zuul]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
Cfssl::Signer[syslog]
Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]
File[/etc/ssl/dhparam.pem]
File[/etc/apache2/ports.conf]
File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
Service[cfssl-gc-expired-certs.timer]
File[/etc/cfssl/signers/mlserve]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]
File[/lib/systemd/system/cfssl-ocspserve@etcd.service]
Exec[Generate initial CRL for discovery]
Profile::Auto_restarts::Service[apache-htcacheclean]
Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]
Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]
Exec[Generate initial CRL for discovery2026]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]
File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]
Cfssl::Config[etcd]
Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]
Logrotate::Conf[cfssl-ocsprefresh-discovery2026]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
File[/etc/systemd/system/ferm.service.d]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]
Monitoring::Service[check_certificate_expiry_dse_front_proxy]
Systemd::Timer[cfssl-ocsprefresh-mlserve]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
Firewall::Service[csr_and_ocsp_responder]
Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
Systemd::Unit[wmf_auto_restart_ulogd2.service]
Cfssl::Config[discovery2026]
Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]
Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]
File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]
File[/srv/cfssl]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
File[/etc/sudoers.d/nrpe_certificate_check_cassandra]
Monitoring::Service[check_certificate_expiry_discovery2026]
Service[cfssl-ocsprefresh-syslog.timer]
Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]
Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
File[/srv/cfssl/bundles/discovery2026.pem]
Systemd::Override[apache2-after-network-online-target]
Systemd::Service[cfssl-ocsprefresh-mlserve_staging]
Systemd::Timer[cfssl-ocsprefresh-dse]
Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]
Package[python3-cryptography]
Systemd::Service[cfssl-ocspserve@mlserve_staging]
File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/lib/systemd/system/cfssl-gc-expired-certs.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]
Exec[Generate initial CRL for etcd]
Systemd::Unit[nrpe2nodexp-ferm_active.service]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]
Profile::Pki::Multirootca::Monitoring[dse]
File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]
Service[cfssl-ocspserve@debmonitor]
Nrpe::Check[check_check_certificate_expiry_etcd]
Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
Nrpe::Monitor_service[check_certificate_expiry_debmonitor]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]
Logrotate::Conf[wmf_auto_restart_apache2]
Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]
Exec[Generate initial CRL for network_devices]
File[/etc/cfssl/signers/discovery2026/ca]
Rsyslog::Conf[cfssl-ocsprefresh-dse]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]
Rsyslog::Conf[cfssl-ocsprefresh-discovery]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]
File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]
Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]
Nrpe::Check[check_check_certificate_expiry_discovery2026]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Systemd::Timer[cfssl-ocsprefresh-syslog]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]
File[/srv/cfssl/bundles/syslog.pem]
File[/etc/sudoers.d/nrpe_certificate_check_syslog]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]
File[/etc/cfssl/ocsp/puppet_rsa.ocsp]
File[/etc/apache2/sites-available]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]
File[/usr/local/lib/nagios/plugins/check_ferm]
File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]
Exec[Generate initial CRL for mlserve_staging_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]
Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]
Systemd::Unit[cfssl-ocspserve@zuul]
File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]
Systemd::Service[cfssl-ocspserve@wikikube_staging]
File[/srv/cfssl/bundles/mlserve.pem]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]
Systemd::Timer::Job[cfssl-ocsprefresh-syslog]
Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]
Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
Exec[Generate initial CRL for wikikube_staging]
Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
File[/srv/cfssl/bundles/aux.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]
Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]
Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]
Service[cfssl-ocsprefresh-aux_front_proxy.timer]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]
File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]
Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
File[/srv/cfssl/bundles/aux_front_proxy.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]
File[/var/log/cfssl-ocsprefresh-network_devices]
Cfssl::Config[aux_front_proxy]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]
File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]
Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
File[/srv/cfssl/bundles/wikikube.pem]
Sudo::User[nrpe_certificate_check_puppet_rsa]
Systemd::Timer[cfssl-ocsprefresh-discovery]
Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]
Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]
File[/etc/cfssl/multiroot.conf]
Cfssl::Signer[wikikube_front_proxy]
Ferm::Service[multirootca_tls_termination]
Systemd::Syslog[cfssl-ocsprefresh-debmonitor]
Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]
Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]
Cfssl::Config[syslog]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]
Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]
Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]
Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]
Cfssl::Signer[discovery2026]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]
File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]
Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
Class[Httpd]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]
File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]
Profile::Auto_restarts::Service[apache2]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]
Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]
Cfssl::Signer[wikikube]
Profile::Pki::Multirootca::Monitoring[wikikube]
Systemd::Unit[cfssl-ocspserve@dse]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]
File[/etc/cfssl/signers/mlserve_staging_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]
Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]
Service[apache2]
Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]
File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]
File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]
Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]
Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]
Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]
Service[cfssl-ocsprefresh-zuul.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]
File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]
File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]
File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]
File[/etc/cfssl/ocsp/aux.ocsp]
Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]
Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]
Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]
File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]
Systemd::Unit[cfssl-ocsprefresh-zuul.timer]
Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]
Systemd::Service[cfssl-ocsprefresh-zuul]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]
Class[Ulogd]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]
File[/etc/cfssl/signers/zuul]
Systemd::Service[cfssl-ocspserve@aux]
Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]
File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]
Cfssl::Config[kafka]
Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]
Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]
Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]
Systemd::Service[cfssl-ocspserve@kafka]
File[/etc/apache2/sites-enabled]
Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]
Systemd::Unit[apache2-apache2-after-network-online-target]
Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Nrpe::Monitor_service[check_certificate_expiry_dse]
Logrotate::Conf[cfssl-ocsprefresh-etcd]
Ferm::Conf[main]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]
Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Cfssl::Signer[cloud_wmnet_ca]
Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]
File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]
Service[nrpe2nodexp-check_certificate_expiry_dse.timer]
Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]
Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]
File[/srv/cfssl/bundles/etcd.pem]
Logrotate::Conf[cfssl-ocsprefresh-syslog]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]
File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]
Cfssl::Config[mlserve_staging]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]
Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]
Service[cfssl-ocsprefresh-mlserve.timer]
Exec[Generate initial CRL for wikikube_front_proxy]
Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]
Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]
Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]
File[/etc/cfssl/signers/mlserve_front_proxy]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]
Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
Prometheus::Blackbox::Check::Http[PKI_kafka]
Httpd::Mod_conf[access_compat]
Sudo::User[nrpe_certificate_check_cassandra]
File[/etc/ferm/conf.d/98_filter_log_filter-bootp]
Sudo::User[nrpe-check_check_certificate_expiry_mlserve]
Monitoring::Service[check_certificate_expiry_mlserve_staging]
Systemd::Unit[cfssl-ocsprefresh-kafka.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]
Sudo::User[nrpe_certificate_check_aux_front_proxy]
File[/etc/cfssl/signers/aux/cfssl.conf]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]
Exec[Generate initial CRL for dse]
Prometheus::Blackbox::Check::Http[PKI_discovery]
Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]
Systemd::Unit[cfssl-ocsprefresh-network_devices.service]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
File[/lib/systemd/system/cfssl-ocspserve@kafka.service]
Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]
Systemd::Service[cfssl-ocspserve@mlserve]
Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]
Exec[Generate initial CRL for mlserve_staging]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]
File[/lib/systemd/system/cfssl-ocspserve@aux.service]
Systemd::Unit[cfssl-gc-expired-certs.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]
File[/etc/sudoers.d/nrpe_certificate_check_aux]
Ferm::Filter_log[filter-bootp]
Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]
Service[cfssl-ocsprefresh-dse.timer]
Systemd::Timer[wmf_auto_restart_ulogd2]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
File[/etc/cfssl/signers/zuul/ca/zuul.pem]
File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]
Httpd::Mod_conf[headers]
File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]
Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]
Class[Profile::Firewall::Log::Ferm]
File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]
File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]
Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]
File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer]
Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]
Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]
File[/etc/cfssl/signers/wikikube_staging/ca]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]
Sudo::User[nrpe_certificate_check_aux]
File[/var/log/cfssl-ocsprefresh-puppet_rsa]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]
File[/srv/cfssl/bundles/dse.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]
Systemd::Unit[cfssl-multirootca]
Systemd::Syslog[cfssl-ocsprefresh-etcd]
File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
Alternatives::Select[iptables]
Systemd::Monitor[cfssl-multirootca]
Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]
Cfssl::Ocsp[etcd]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]
Service[cfssl-ocspserve@kafka]
Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]
Nrpe::Monitor_service[check_certificate_expiry_discovery]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]
File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]
File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]
Cfssl::Config[debmonitor]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
Profile::Pki::Multirootca::Monitoring[mlserve]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]
Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]
Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]
Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]
Cfssl::Ocsp[discovery2026]
File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]
Cfssl::Config[aux]
Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]
Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]
Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]
Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]
File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]
Cfssl::Signer[mlserve_staging_front_proxy]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]
Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-aux.timer]
Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]
Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
Systemd::Syslog[cfssl-ocsprefresh-dse]
Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]
Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]
Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]
Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]
File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Exec[ensure_present_mod_status]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]
Systemd::Service[cfssl-ocspserve@aux_front_proxy]
File[/etc/cfssl/ocsp/wikikube_staging.ocsp]
Service[cfssl-ocspserve@zuul]
Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]
File[/lib/systemd/system/cfssl-gc-expired-certs.service]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]
Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]
File[/etc/logrotate.d/cfssl-ocsprefresh-dse]
Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
File[/lib/systemd/system/cfssl-ocspserve@syslog.service]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]
Cfssl::Config[wikikube_front_proxy]
Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]
Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]
Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
Cfssl::Signer[mlserve]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]
Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]
File[/lib/systemd/system/wmf_auto_restart_apache2.timer]
Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Service[nrpe2nodexp-ferm_active.timer]
Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]
File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]
Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]
Systemd::Timer[cfssl-ocsprefresh-etcd]
Motd::Message[pki::multirootca]
Service[wmf_auto_restart_apache2.timer]
Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]
Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]
File[/etc/apache2/mods-available/status.conf]
Nrpe::Plugin[check_ferm]
Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
Prometheus::Blackbox::Check::Http[PKI_zuul]
Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]
Sudo::User[nrpe-check_check_certificate_expiry_etcd]
File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
Cfssl::Ocsp[mlserve]
Service[cfssl-ocsprefresh-network_devices.timer]
Systemd::Service[cfssl-ocspserve@debmonitor]
Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]
File[/etc/cfssl/signers/kafka/cfssl.conf]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]
Prometheus::Blackbox::Check::Http[PKI_cassandra]
Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]
Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]
Cfssl::Signer[debmonitor]
File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]
Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]
Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]
Service[cfssl-ocspserve@mlserve_front_proxy]
Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]
Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]
Exec[Generate initial CRL for mlserve_front_proxy]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]
Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]
Profile::Pki::Multirootca::Monitoring[kafka]
Sudo::User[nrpe_certificate_check_wikikube_staging]
File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]
Systemd::Service[cfssl-ocsprefresh-discovery2026]
File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]
Rsyslog::Conf[cfssl-ocsprefresh-mlserve]
Systemd::Syslog[cfssl-gc-expired-certs]
Systemd::Syslog[cfssl-ocsprefresh-mlserve]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]
Service[cfssl-ocspserve@syslog]
File[/etc/cfssl/signers/syslog/ca]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
File[/etc/cfssl/signers/zuul/ca]
Sudo::User[nrpe-check_check_certificate_expiry_zuul]
File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]
Systemd::Timer[wmf_auto_restart_apache2]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]
Cfssl::Signer[kafka]
File[/etc/cfssl/signers/cloud_wmnet_ca]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]
Systemd::Syslog[cfssl-ocsprefresh-syslog]
Nrpe::Check[check_check_certificate_expiry_puppet_rsa]
Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]
Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]
File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]
Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Exec[Generate initial CRL for wikikube]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]
File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]
File[/etc/cfssl/ocsp/etcd.ocsp]
File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]
File[/etc/ferm/conf.d/10_ssh_from_bastion]
Rsyslog::Conf[cfssl-gc-expired-certs]
Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]
Systemd::Unit[cfssl-ocspserve@kafka]
Profile::Pki::Multirootca::Monitoring[discovery2026]
Systemd::Unit[cfssl-ocspserve@aux]
Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]
Systemd::Unit[cfssl-ocsprefresh-syslog.service]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
Systemd::Unit[cfssl-ocspserve@syslog]
Systemd::Timer[cfssl-ocsprefresh-zuul]
File[/etc/apache2/sites-enabled/00-dummy.conf]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]
File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]
Class[Cfssl::Multirootca]
File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]
File[/lib/systemd/system/wmf_auto_restart_apache2.service]
Profile::Pki::Multirootca::Monitoring[aux]
Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_kafka]
Systemd::Service[cfssl-ocsprefresh-dse]
Cfssl::Signer[mlserve_front_proxy]
Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]
Httpd::Conf[dummy]
Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]
Monitoring::Service[check_certificate_expiry_zuul]
File[/etc/cfssl/signers/discovery/ca/discovery.pem]
Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Node[__node_regexp__pki10012.eqiad.]
File[/etc/update-motd.d/05-pki--multirootca]
Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]
Profile::Pki::Multirootca::Monitoring[network_devices]
Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]
Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
File[/etc/apache2/env-enabled]
Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]
File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]
File[/etc/sudoers.d/nrpe_certificate_check_mlserve]
File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]
File[/srv/cfssl/bundles]
Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]
Systemd::Override[ferm-service-status-restart]
File[/var/log/cfssl-ocsprefresh-zuul]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
Ferm::Service[full_monitoring_metrics_access_tcp]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]
Profile::Pki::Multirootca::Monitoring[discovery]
Systemd::Unit[cfssl-ocsprefresh-wikikube.service]
File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]
Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]
File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]
Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
Sudo::User[nrpe_certificate_check_mlserve_staging]
File[/usr/local/bin/prometheus-check-dse-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]
File[/etc/cfssl/ocsp/discovery2026.ocsp]
Prometheus::Blackbox::Check::Http[PKI_etcd]
File[/etc/apache2/conf-enabled/50-server-status.conf]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]
Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]
Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]
Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]
File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]
Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]
Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
Systemd::Unit[cfssl-ocspserve@debmonitor]
Exec[apache2_test_config_and_restart]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]
Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]
File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]
File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]
Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
Nrpe::Monitor_service[check_cfssl-multirootca_status]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]
Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]
Systemd::Timer[cfssl-ocsprefresh-discovery2026]
Profile::Pki::Multirootca::Monitoring[puppet_rsa]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]
File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]
Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]
File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]
File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]
File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
Cfssl::Ocsp[cassandra]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]
Systemd::Unit[cfssl-ocsprefresh-zuul.service]
Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
Systemd::Unit[cfssl-ocsprefresh-dse.service]
Package[apache2]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
Systemd::Service[cfssl-ocsprefresh-aux]
File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]
Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
File_line[auto_restart_file_presence_ulogd2]
File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
File[/etc/cfssl/signers/cassandra/cfssl.conf]
Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
Logrotate::Conf[cfssl-ocsprefresh-kafka]
File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]
Nrpe::Monitor_service[ferm_active]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]
Nrpe::Monitor_service[check_certificate_expiry_zuul]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]
Cfssl::Signer[cassandra]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]
Profile::Pki::Multirootca::Monitoring[cassandra]
Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]
Service[cfssl-ocsprefresh-dse_front_proxy.timer]
File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]
Logrotate::Conf[cfssl-ocsprefresh-discovery]
Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]
File[/etc/cfssl/signers/debmonitor]
File[/etc/sudoers.d/nrpe_certificate_check_etcd]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]
Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]
Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]
Service[cfssl-ocsprefresh-discovery2026.timer]
Sudo::User[nrpe-check_check_certificate_expiry_dse]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
File[/etc/cfssl/signers/puppet_rsa]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
Systemd::Unit[cfssl-ocspserve@wikikube_staging]
Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]
Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]
File[/etc/ferm/conf.d/02_main]
Ferm::Rule[log-everything]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]
Monitoring::Service[check_certificate_expiry_cassandra]
File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
File[/etc/cfssl/signers/syslog]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]
File[/etc/logrotate.d/cfssl-gc-expired-certs]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]
Systemd::Service[cfssl-ocspserve@syslog]
Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]
File[/lib/systemd/system/wmf_auto_restart_ulogd2.service]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]
File[/lib/systemd/system/cfssl-ocspserve@dse.service]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]
File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]
Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
Exec[ensure_present_mod_headers]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]
Systemd::Unit[cfssl-ocspserve@mlserve]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Monitoring::Service[check_certificate_expiry_network_devices]
Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Sudo::User[nrpe_certificate_check_debmonitor]
Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]
Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
File[/etc/cfssl/signers/discovery2026/cfssl.conf]
Rsyslog::Conf[cfssl-ocsprefresh-kafka]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]
File[/etc/cfssl/ocsp/zuul.ocsp]
Prometheus::Blackbox::Check::Http[PKI_discovery2026]
Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]
Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]
Sudo::User[nrpe_certificate_check_mlserve_front_proxy]
Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]
Package[ulogd2]
Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]
Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]
Systemd::Unit[cfssl-ocsprefresh-aux.service]
File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]
File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
Logrotate::Conf[cfssl-ocsprefresh-aux]
Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]
Rsyslog::Conf[cfssl-ocsprefresh-aux]
File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
File[/etc/logrotate.d/wmf_auto_restart_apache2]
Systemd::Unit[cfssl-ocspserve@discovery]
Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]
File[/etc/cfssl/signers/kafka]
Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]
Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
Systemd::Syslog[cfssl-ocsprefresh-kafka]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]
Systemd::Unit[nrpe2nodexp-ferm_active.timer]
Monitoring::Service[check_certificate_expiry_aux]
File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]
Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]
Monitoring::Service[check_certificate_expiry_syslog]
Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]
Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]
Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]
File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]
Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]
Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]
Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]
Service[cfssl-ocspserve@aux]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]
Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]
Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]
Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
Sudo::User[nrpe-check_check_certificate_expiry_aux]
Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]
File[/var/log/cfssl-ocsprefresh-syslog]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]
Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]
File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]
Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]
File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]
Prometheus::Blackbox::Check::Http[PKI_aux]
File[/lib/systemd/system/cfssl-multirootca.service]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Service[cfssl-ocsprefresh-wikikube_staging.timer]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]
Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]
File[/etc/cfssl/signers/syslog/ca/syslog.pem]
File_line[load_env_enabled]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
Nrpe::Check[check_check_certificate_expiry_aux]
File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]
Systemd::Service[cfssl-ocspserve@zuul]
Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]
File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]
File[/etc/apache2/mods-enabled/status.conf]
Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Httpd::Mod_conf[ssl]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Service[apache-htcacheclean]
File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]
File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]
File[/etc/apache2/sites-available/00-dummy.conf]
Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]
Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]
File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]
File[/etc/cfssl/signers/dse/ca/dse-key.pem]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]
Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]
Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]
Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Httpd::Site[dummy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]
File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]
Nrpe::Monitor_service[check_certificate_expiry_syslog]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]
Exec[update_alternative_iptables]
File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]
Service[cfssl-ocsprefresh-puppet_rsa.timer]
Systemd::Syslog[ulogd]
File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]
Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]
Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
Systemd::Unit[cfssl-ocspserve@discovery2026]
Nrpe::Check[check_check_certificate_expiry_zuul]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
Cfssl::Db[multirootca-db]
File[/etc/cfssl/ssl/ocsp]
Sudo::User[nrpe_certificate_check_discovery]
File[/srv/cfssl/bundles/cassandra.pem]
Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
Systemd::Unit[cfssl-ocspserve@dse_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
Ferm::Service[ssh_from_cumin_masters]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
File[/etc/cfssl/signers/dse/cfssl.conf]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]
File[/var/log/cfssl-ocsprefresh-mlserve_staging]
Systemd::Service[cfssl-ocspserve@network_devices]
Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]
File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]
File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
Profile::Pki::Multirootca::Monitoring[mlserve_staging]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]
Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]
Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
File_line[auto_restart_file_presence_apache-htcacheclean]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]
File[/etc/cfssl/signers/mlserve_front_proxy/ca]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]
Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]
File[/etc/sudoers.d/nrpe_certificate_check_network_devices]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
Nrpe::Check[check_check_certificate_expiry_mlserve]
Nrpe::Monitor_service[check_certificate_expiry_mlserve]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]
Service[cfssl-ocspserve@dse_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]
Service[cfssl-ocspserve@wikikube_staging]
File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]
File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]
Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]
Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]
Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]
Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]
Cfssl::Ocsp[debmonitor]
Sudo::User[nrpe-check_check_certificate_expiry_network_devices]
File[/etc/cfssl/signers/network_devices/ca]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]
Sudo::User[nrpe_certificate_check_kafka]
Cfssl::Signer[wikikube_staging_front_proxy]
Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]
Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]
Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]
File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
Logrotate::Conf[cfssl-ocsprefresh-network_devices]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]
File[/var/log/cfssl-ocsprefresh-wikikube]
Systemd::Unit[cfssl-ocspserve@aux_front_proxy]
File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
Service[nrpe2nodexp-check_certificate_expiry_aux.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]
Systemd::Timer[cfssl-ocsprefresh-network_devices]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]
Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
Cfssl::Ocsp[kafka]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
File[/etc/cfssl/signers/aux/ca]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]
Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]
Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
Cfssl::Config[network_devices]
Systemd::Unit[wmf_auto_restart_apache2.service]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]
Ferm::Rule[drop-blocked-nets]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
File[/etc/cfssl/signers/aux/ca/aux-key.pem]
Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
Cfssl::Ocsp[discovery]
File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
Systemd::Service[wmf_auto_restart_ulogd2]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]
Systemd::Timer[cfssl-ocsprefresh-wikikube]
Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]
Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]
Systemd::Timer[cfssl-gc-expired-certs]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]
Sudo::User[nrpe_certificate_check_etcd]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]
Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]
Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]
Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]
Cfssl::Config[zuul]
Rsyslog::Conf[cfssl-ocsprefresh-wikikube]
File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]
Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]
File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
Cfssl::Ocsp[puppet_rsa]
Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]
Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]
File[/etc/cfssl/signers/discovery/ca]
Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Nrpe::Check[check_check_cfssl-multirootca_status]
File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]
Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]
Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]
Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]
Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]
File[/usr/local/sbin/cfssl-certs]
Httpd::Conf[server-status]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Sudo::User[nrpe_certificate_check_syslog]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
File[/etc/ferm/conf.d/10_multirootca_tls_termination]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
File[/srv/cfssl/bundles/mlserve_front_proxy.pem]
Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c]
Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]
Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
Systemd::Timer::Job[cfssl-gc-expired-certs]
Cfssl::Config[mlserve_front_proxy]
Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]
Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]
Nrpe::Plugin[check_systemd_unit_status]
Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]
Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]
File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]
Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]
Exec[ensure_present_mod_ssl]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]
Profile::Pki::Multirootca::Monitoring[dse_front_proxy]
Cfssl::Signer[discovery]
Nrpe::Check[check_check_certificate_expiry_debmonitor]
File[/etc/sudoers.d/nrpe_certificate_check_discovery]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]
File[/srv/cfssl/crl]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
Cfssl::Config[discovery]
Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]
File[/etc/ferm/ferm.conf]
File[/etc/ferm/conf.d/98_log-everything]
Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]
Service[cfssl-ocsprefresh-aux.timer]
Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]
File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]
File[/etc/cfssl/signers/kafka/ca/kafka.pem]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]
File[/etc/cfssl/signers/etcd]
Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]
Cfssl::Ocsp[network_devices]
Cfssl::Signer[wikikube_staging]
Exec[Generate initial CRL for aux_front_proxy]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
Cfssl::Ocsp[mlserve_staging_front_proxy]
File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Systemd::Service[wmf_auto_restart_apache-htcacheclean]
Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]
File[/etc/cfssl/ocsp/kafka.ocsp]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]
Exec[Generate initial CRL for aux]
Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]
Ferm::Rule[filter_log_filter-bootp]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]
Profile::Auto_restarts::Service[ulogd2]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]
Systemd::Timer::Job[cfssl-ocsprefresh-dse]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
File[/usr/local/bin/apache-status]
Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]
Nrpe::Monitor_service[check_certificate_expiry_etcd]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]
Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]
Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]
Systemd::Unit[ferm-ferm-service-status-restart]
Cfssl::Signer[aux]
Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]
File[/etc/cfssl/signers/mlserve/ca]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]
File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Logrotate::Conf[cfssl-ocsprefresh-debmonitor]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]
Monitoring::Service[check_certificate_expiry_etcd]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]
Systemd::Timer::Job[wmf_auto_restart_ulogd2]
File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]
Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]
File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]
File[/etc/apache2/conf-available]
File[/etc/ferm/conf.d/99_dscp-default]
Cfssl::Ocsp[wikikube]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]
Rsyslog::Conf[cfssl-ocsprefresh-cassandra]
Cfssl::Signer[etcd]
Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]
Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]
Cfssl::Signer[aux_front_proxy]
Ferm::Conf[defs]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]
Cfssl::Config[dse]
Httpd::Mod_conf[proxy_http]
File[/etc/cfssl/signers/etcd/ca]
Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Service[cfssl-ocspserve@aux_front_proxy]
Cfssl::Ocsp[wikikube_staging]
Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]
Systemd::Unit[cfssl-ocspserve@etcd]
Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]
Systemd::Unit[cfssl-ocspserve@network_devices]
File[/etc/ferm/functions.conf]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
File[/etc/cfssl/signers/wikikube_staging_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]
Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]
Sudo::User[nrpe_certificate_check_discovery2026]
Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]
File[/etc/cfssl/signers/aux]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]
Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Service[cfssl-ocspserve@cloud_wmnet_ca]
Logrotate::Conf[cfssl-ocsprefresh-zuul]
Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]
Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]
File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]
Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]
Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]
Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]
Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]
Cfssl::Config[puppet_rsa]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Httpd::Conf[defaults]
Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]
Systemd::Timer::Job[cfssl-ocsprefresh-etcd]
Systemd::Unit[cfssl-ocsprefresh-dse.timer]
Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]
Systemd::Service[cfssl-ocsprefresh-wikikube]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]
File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]
Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]
Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
Exec[Generate initial CRL for debmonitor]
File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]
Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
Profile::Pki::Multirootca::Monitoring[wikikube_staging]
Systemd::Unit[wmf_auto_restart_ulogd2.timer]
Monitoring::Service[check_certificate_expiry_wikikube_staging]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]
File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]
Systemd::Timer[cfssl-ocsprefresh-aux]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]
Exec[Generate cert puppet_rsa__pki_discovery_wmnet]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]
Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]
Service[cfssl-ocspserve@cassandra]
File[/etc/cfssl/signers/dse/ca/dse.pem]
Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]
File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]
Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]
Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]
File[/etc/ferm/conf.d]
Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]
File[/var/log/cfssl-ocsprefresh-cassandra]
File[/etc/logrotate.d/cfssl-ocsprefresh-aux]
Service[cfssl-ocspserve@mlserve_staging_front_proxy]
Rsyslog::Conf[cfssl-ocsprefresh-zuul]
Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]
File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]
File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]
Monitoring::Exported_nagios_service[pki1001 ferm_active]
Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]
Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]
File[/etc/cfssl/signers/dse/ca]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]
Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
Cfssl::Signer[network_devices]
Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]
Monitoring::Service[check_certificate_expiry_dse]
Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]
Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]
File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
File[/etc/cfssl/signers/network_devices]
File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]
Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
Service[cfssl-ocspserve@discovery]
Systemd::Syslog[wmf_auto_restart_apache2]
Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
File[/etc/cfssl/signers/kafka/ca]
File[/etc/cfssl/signers/cassandra]
Httpd::Site[pki.discovery.wmnet]
File[/etc/cfssl/ocsp/wikikube.ocsp]
Profile::Pki::Multirootca::Monitoring[debmonitor]
File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]
Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]
File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]
Nrpe::Monitor_service[check_certificate_expiry_discovery2026]
File[/etc/cfssl/signers/mlserve/cfssl.conf]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]
Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]
Systemd::Timer::Job[wmf_auto_restart_apache2]
Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
File[/srv/cfssl/bundles/debmonitor.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]
File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]
Exec[Generate initial CRL for puppet_rsa]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]
Monitoring::Service[check_certificate_expiry_kafka]
Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
Systemd::Timer[nrpe2nodexp-ferm_active]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]
Systemd::Service[cfssl-ocsprefresh-syslog]
Cfssl::Ocsp[mlserve_staging]
Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]
File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]
File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
Cfssl::Signer[dse_front_proxy]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
Service[cfssl-ocspserve@wikikube]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
Alternatives::Select[ip6tables]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]
Service[cfssl-ocspserve@puppet_rsa]
File[/etc/cfssl/db.conf]
Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
Profile::Pki::Multirootca::Monitoring[etcd]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]
Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]
Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
Sudo::User[nrpe-check_check_cfssl-multirootca_status]
File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
File[/etc/cfssl/ocsp/discovery.ocsp]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]
File[/lib/systemd/system/nrpe2nodexp-ferm_active.service]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]
Logrotate::Conf[cfssl-ocsprefresh-wikikube]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]
File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf]
Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]
Systemd::Syslog[wmf_auto_restart_ulogd2]
File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]
Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]
Exec[Generate initial CRL for cassandra]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]
File[/etc/cfssl/signers/aux_front_proxy/ca]
File[/var/log/cfssl-ocsprefresh-dse]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]
File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]
Prometheus::Blackbox::Check::Http[PKI_mlserve]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
File[/lib/systemd/system/cfssl-ocspserve@discovery.service]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]
File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]
File[/etc/cfssl/signers/wikikube/cfssl.conf]
Systemd::Service[nrpe2nodexp-ferm_active]
File[/etc/cfssl/signers/cassandra/ca]
Exec[ensure_present_mod_access_compat]
File[/etc/cfssl/ocsp/cassandra.ocsp]
Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]
Systemd::Unit[cfssl-ocspserve@puppet_rsa]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
File[/var/log/cfssl-ocsprefresh-discovery2026]
File[/etc/cfssl/signers/network_devices/cfssl.conf]
Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]
Service[cfssl-multirootca]
Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]
Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]
File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]
Cfssl::Config[wikikube_staging]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]
Cfssl::Config[wikikube_staging_front_proxy]
Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]
File[/etc/cfssl/signers/discovery]
Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]
File[/etc/cfssl/signers/mlserve_staging]
File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]
Systemd::Timer[cfssl-ocsprefresh-debmonitor]
Systemd::Service[cfssl-ocspserve@dse_front_proxy]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]
Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]
Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]
File[/var/log/cfssl-ocsprefresh-mlserve]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]
Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]
File[/etc/apache2/conf-enabled/00-defaults.conf]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
Service[cfssl-ocspserve@discovery2026]
Nrpe::Check[check_check_certificate_expiry_wikikube_staging]
File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]
File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]
File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]
Prometheus::Blackbox::Check::Http[PKI_debmonitor]
Service[cfssl-ocspserve@etcd]
File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]
File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
File[/etc/cfssl/signers/puppet_rsa/ca]
File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]
File[/etc/cfssl/signers/cloud_wmnet_ca/ca]
Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]
Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
File[/etc/default/ferm]
Cfssl::Ocsp[cloud_wmnet_ca]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]
File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]
File[/var/log/cfssl-ocsprefresh-aux_front_proxy]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]
Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]
Service[cfssl-ocsprefresh-cassandra.timer]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]
Prometheus::Blackbox::Check::Http[PKI_wikikube]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
Monitoring::Service[check_certificate_expiry_discovery]
File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]
Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]
Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]
File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]
Systemd::Service[cfssl-ocsprefresh-cassandra]
Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]
File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]
Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]
File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]
Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]
Monitoring::Service[check_cfssl-multirootca_status]
Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]
File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]
File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]
Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]
Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]
Systemd::Service[cfssl-ocsprefresh-debmonitor]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]
Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Monitoring::Service[check_certificate_expiry_debmonitor]
Monitoring::Service[check_certificate_expiry_mlserve]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]
Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]
Service[cfssl-ocspserve@wikikube_staging_front_proxy]
Nrpe::Check[check_check_certificate_expiry_mlserve_staging]
Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]
Cfssl::Signer[mlserve_staging]
Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]
Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]
Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
File[/var/log/wmf_auto_restart_ulogd2]
Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
Cfssl::Config[mlserve]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Service[cfssl-ocsprefresh-debmonitor.timer]
Systemd::Service[cfssl-ocspserve@wikikube]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]
File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]
File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]
File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]
Systemd::Service[cfssl-ocsprefresh-network_devices]
Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]
Rsyslog::Conf[cfssl-ocsprefresh-etcd]
File[/etc/sudoers.d/nrpe-check_ferm_active]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]
Service[cfssl-ocsprefresh-discovery.timer]
Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Systemd::Service[cfssl-ocsprefresh-etcd]
Exec[update_alternative_ip6tables]
Systemd::Service[cfssl-ocspserve@discovery2026]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]
Systemd::Service[cfssl-ocsprefresh-kafka]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]
File[/var/log/wmf_auto_restart_apache-htcacheclean]
Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]
File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
Cfssl::Signer[zuul]
Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]
File[/etc/cfssl/ocsp/mlserve.ocsp]
Systemd::Service[wmf_auto_restart_apache2]
Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]
Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
Cfssl::Ocsp[aux_front_proxy]
Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]
Systemd::Syslog[cfssl-ocsprefresh-cassandra]
Logrotate::Conf[wmf_auto_restart_ulogd2]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]
Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]
File[/etc/cfssl/signers/etcd/cfssl.conf]
Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]
Sudo::User[nrpe_certificate_check_wikikube_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]
Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]
Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]
Cfssl::Config[cassandra]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]
File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp]
Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]
Cfssl::Ocsp[wikikube_front_proxy]
File[/etc/cfssl/signers/dse_front_proxy/ca]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]
Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]
File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]
Rsyslog::Conf[wmf_auto_restart_apache2]
Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]
File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]
Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]
Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]
File[/etc/cfssl/signers/aux/ca/aux.pem]
Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Service[cfssl-ocspserve@wikikube_front_proxy]
Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]
Sudo::User[nrpe-check_check_certificate_expiry_discovery]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]
Firewall::Service[multirootca tls termination]
File[/etc/cfssl/signers/etcd/ca/etcd.pem]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]
Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]
Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]
File[/etc/cfssl/signers/dse]
Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]
File[/etc/sudoers.d/nrpe_certificate_check_dse]
Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]
Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]
Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]
Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]
Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]
Cfssl::Ocsp[zuul]
Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]
File[/etc/sudoers.d/nrpe_certificate_check_kafka]
File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]
File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Package[links]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]
Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]
Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]
Sudo::User[nrpe-check_ferm_active]
Systemd::Service[cfssl-multirootca]
Systemd::Syslog[cfssl-ocsprefresh-discovery2026]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]
Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]
File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]
Exec[Generate initial CRL for kafka]
File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]
File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]
File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]
File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]
Exec[Generate initial CRL for syslog]
File[/var/log/cfssl-ocsprefresh-aux]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]
Nrpe::Check[check_check_certificate_expiry_discovery]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]
File[/etc/cfssl/signers/wikikube_front_proxy/ca]
Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]
Ferm::Service[full_monitoring_metrics_access_udp]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]
Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]
Systemd::Timer::Job[cfssl-ocsprefresh-zuul]
File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]
Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]
Class[Sslcert::Dhparam]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
Nrpe::Monitor_service[check_certificate_expiry_cassandra]
File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]
Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]
Nrpe::Monitor_service[check_certificate_expiry_wikikube]
Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-kafka.service]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]
Systemd::Service[cfssl-ocspserve@puppet_rsa]
Systemd::Syslog[cfssl-ocsprefresh-wikikube]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]
Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Systemd::Unit[wmf_auto_restart_apache2.timer]
Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]
Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]
Systemd::Timer[cfssl-ocsprefresh-cassandra]
Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]
File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]
File[/var/log/cfssl-ocsprefresh-wikikube_staging]
Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]
Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
Service[cfssl-ocsprefresh-etcd.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]
Systemd::Unit[cfssl-ocsprefresh-cassandra.service]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]
Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]
Monitoring::Service[check_certificate_expiry_aux_front_proxy]
File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]
Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]
Exec[ensure_present_mod_proxy_http]
File[/var/log/cfssl-ocsprefresh-etcd]
Httpd::Conf[pki.discovery.wmnet]
File[/srv/cfssl/bundles/wikikube_front_proxy.pem]
File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]
Prometheus::Blackbox::Check::Http[PKI_dse]
Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]
File[/var/log/cfssl-ocsprefresh-debmonitor]
Rsyslog::Conf[nrpe2nodexp-ferm_active]
File[/etc/cfssl/signers/debmonitor/cfssl.conf]
Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]
File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]
File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/ocsp/debmonitor.ocsp]
File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]
Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]
Systemd::Service[cfssl-ocsprefresh-mlserve]
Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]
File[/etc/ssl/localcerts/multiroot_ca.pem]
Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
File[/etc/cfssl/ocsp/network_devices.ocsp]
Systemd::Timer::Job[cfssl-ocsprefresh-kafka]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]
Nrpe::Check[check_check_certificate_expiry_cassandra]
File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]
File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]
File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]
Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]
Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]
File[/etc/cfssl/signers/aux_front_proxy]
File[/var/log/cfssl-ocsprefresh-kafka]
Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]
Logrotate::Conf[cfssl-ocsprefresh-mlserve]
Cfssl::Ocsp[syslog]
Ferm::Service[csr_and_ocsp_responder]
File[/etc/cfssl/signers/wikikube/ca]
Logrotate::Conf[cfssl-gc-expired-certs]
File[/etc/apache2/conf-available/50-server-status.conf]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]
File[/etc/cfssl/ocsp/dse.ocsp]
Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]
File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
File[/etc/cfssl/signers/wikikube]
Rsyslog::Conf[ulogd]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]
Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
Systemd::Unit[cfssl-ocsprefresh-discovery.service]
Ferm::Service[ssh_from_bastion]
Sudo::User[nrpe_certificate_check_network_devices]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]
File[/etc/logrotate.d/wmf_auto_restart_ulogd2]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]
File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]
Systemd::Unit[cfssl-ocspserve@wikikube]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]
Nrpe::Check[check_check_certificate_expiry_network_devices]
File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]
Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]
Rsyslog::Conf[cfssl-ocsprefresh-network_devices]
File[/etc/rsyslog.d/40-ulogd.conf]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]
Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Motd::Script[pki::multirootca]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]
File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]
Cfssl::Config[dse_front_proxy]
Profile::Pki::Multirootca::Monitoring[zuul]
Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]
Profile::Pki::Multirootca::Monitoring[aux_front_proxy]
Systemd::Service[cfssl-ocspserve@cassandra]
Sudo::User[nrpe-check_check_certificate_expiry_cassandra]
Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]
File[/etc/cfssl/signers/debmonitor/ca]
Httpd::Mod_conf[filter]

Resources modified

Class[Profile::Firewall]

Parameters differences:

--- Class[Profile::Firewall].orig
+++ Class[Profile::Firewall]

@@
-    provider => ferm
+    provider => nftables

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_wikikube_staging_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem

Prometheus::Node_textfile[check-nft]

Parameters differences:

--- Prometheus::Node_textfile[check-nft].orig
+++ Prometheus::Node_textfile[check-nft]

+    user           => root
+    run_cmd        => /usr/local/bin/check-nft
+    interval       => *:0/30
+    environment    => {}
+    extra_packages => []
+    filesource     => puppet:///modules/profile/firewall/check_nftables.py
+    ensure         => present

Cfssl::Signer[dse]

Parameters differences:

--- Cfssl::Signer[dse].orig
+++ Cfssl::Signer[dse]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/dse/ca/dse.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/dse
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/dse
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/dse/ca/dse-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   =>

File[/srv/cfssl/bundles/network_devices.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/network_devices.pem].orig
+++ File[/srv/cfssl/bundles/network_devices.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/network_devices.pem.orig
+++ /srv/cfssl/bundles/network_devices.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
-QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
-WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
-mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
-tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
------END CERTIFICATE-----

Systemd::Unit[cfssl-ocsprefresh-etcd.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-etcd.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-etcd.service]

-    unit              => cfssl-ocsprefresh-etcd.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf]

+    notify => Service[rsyslog]
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "prometheus-node-textfile-check-nft" then {
+    action(
+        type="omfile" file="/var/log/prometheus-node-textfile-check-nft/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]

-    unit              => cfssl-ocsprefresh-mlserve_front_proxy.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/apache2/conf-available/00-defaults.conf]

Parameters differences:

--- File[/etc/apache2/conf-available/00-defaults.conf].orig
+++ File[/etc/apache2/conf-available/00-defaults.conf]

-    notify => Service[apache2]
-    owner  => root
-    source => puppet:///modules/httpd/defaults.conf
-    group  => root
-    mode   => 0444
-    ensure => present

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/usr/local/bin/prometheus-check-aux-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-aux-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-aux-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Nrpe::Monitor_service[check_certificate_expiry_kafka]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_kafka].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_kafka]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: kafka
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem].orig
+++ File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem.orig
+++ /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
@@ -1 +0,0 @@
-nosecret

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem

File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-syslog.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-syslog.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-syslog.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-syslog.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Syslog[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-zuul].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-zuul]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Service[cfssl-ocsprefresh-mlserve_staging.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-mlserve_staging.timer].orig
+++ Service[cfssl-ocsprefresh-mlserve_staging.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml]

Parameters differences:

--- File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml].orig
+++ File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml]

@@
-    ensure => present
+    ensure => absent

File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]

-    before      => ['Service[cfssl-ocsprefresh-debmonitor.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bfd2f7c6497e1da6323bef48d24f9e8e" --timeout 10 --check-command "check_check_certificate_expiry_mlserve"

Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Systemd::Timer::Job[nrpe2nodexp-ferm_active]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-ferm_active].orig
+++ Systemd::Timer::Job[nrpe2nodexp-ferm_active]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-ferm_active
-    splay                     => 600
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bba0a2572329bb500b832470e08b381c" --timeout 10 --check-command "check_ferm_active"
-    description               => execution of nrpe2nodexp for the check_ferm_active command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '10min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/etc/cfssl/signers/syslog/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/syslog/cfssl.conf].orig
+++ File[/etc/cfssl/signers/syslog/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/syslog/cfssl.conf.orig
+++ /etc/cfssl/signers/syslog/cfssl.conf
@@ -1,65 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/syslog",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/syslog"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Cfssl::Config[wikikube]

Parameters differences:

--- Cfssl::Config[wikikube].orig
+++ Cfssl::Config[wikikube]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube
-    path                => /etc/cfssl/signers/wikikube/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ocsp/mlserve_staging.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/mlserve_staging.ocsp].orig
+++ File[/etc/cfssl/ocsp/mlserve_staging.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_front_proxy-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/var/log/cfssl-ocsprefresh-discovery]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-discovery].orig
+++ File[/var/log/cfssl-ocsprefresh-discovery]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-dse_front_proxy.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/FRACK_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/FRACK_NETWORKS_ipv6.nft
@@ -0,0 +1,4 @@
+# Autogenerated by puppet
+set FRACK_NETWORKS_ipv6 {
+    type ipv6_addr
+}

File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging/cfssl.conf].orig
+++ File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/mlserve_staging/cfssl.conf.orig
+++ /etc/cfssl/signers/mlserve_staging/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "72h",
-      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_staging",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_staging"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "72h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "72h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-dse.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-dse.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-dse.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - dse
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse/ca/dse.pem --responses-file /etc/cfssl/ocsp/dse.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse' dse

Sudo::User[nrpe_certificate_check_dse]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_dse].orig
+++ Sudo::User[nrpe_certificate_check_dse]

-    user       => nrpe_certificate_check_dse
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Exec[Generate initial CRL for mlserve]

Parameters differences:

--- Exec[Generate initial CRL for mlserve].orig
+++ Exec[Generate initial CRL for mlserve]

-    creates => /srv/cfssl/crl/mlserve
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve/ca/mlserve.pem /etc/cfssl/signers/mlserve/ca/mlserve-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve
-    require => ['Package[golang-cfssl]']

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - mlserve
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve/ca/mlserve.pem --responses-file /etc/cfssl/ocsp/mlserve.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve' mlserve

Nftables::Set[PRODUCTION_NETWORKS]

Parameters differences:

--- Nftables::Set[PRODUCTION_NETWORKS].orig
+++ Nftables::Set[PRODUCTION_NETWORKS]

+    hosts  => ['10.128.0.0/24', '10.128.1.0/24', '10.128.2.0/24', '10.132.0.0/24', '10.132.2.0/24', '10.136.0.0/24', '10.136.1.0/24', '10.140.0.0/24', '10.140.1.0/24', '10.140.2.0/24', '10.192.0.0/22', '10.192.10.0/24', '10.192.11.0/24', '10.192.12.0/24', '10.192.13.0/24', '10.192.14.0/24', '10.192.15.0/24', '10.192.16.0/22', '10.192.20.0/24', '10.192.21.0/24', '10.192.22.0/24', '10.192.23.0/24', '10.192.24.0/23', '10.192.26.0/24', '10.192.27.0/24', '10.192.28.0/24', '10.192.29.0/24', '10.192.30.0/24', '10.192.31.0/24', '10.192.32.0/22', '10.192.36.0/24', '10.192.37.0/24', '10.192.38.0/24', '10.192.39.0/24', '10.192.4.0/24', '10.192.40.0/24', '10.192.41.0/24', '10.192.42.0/24', '10.192.43.0/24', '10.192.44.0/24', '10.192.45.0/24', '10.192.46.0/24', '10.192.47.0/24', '10.192.48.0/22', '10.192.5.0/24', '10.192.52.0/24', '10.192.56.0/24', '10.192.57.0/24', '10.192.58.0/24', '10.192.59.0/24', '10.192.6.0/24', '10.192.64.0/21', '10.192.7.0/24', '10.192.72.0/24', '10.192.76.0/24', '10.192.8.0/24', '10.192.80.0/20', '10.192.9.0/24', '10.192.96.0/21', '10.194.0.0/20', '10.194.128.0/17', '10.194.16.0/21', '10.194.61.0/24', '10.194.62.0/23', '10.194.64.0/20', '10.194.80.0/21', '10.2.1.0/24', '10.2.2.0/24', '10.2.3.0/24', '10.2.4.0/24', '10.2.5.0/24', '10.2.6.0/24', '10.2.7.0/24', '10.64.0.0/22', '10.64.130.0/24', '10.64.131.0/24', '10.64.132.0/24', '10.64.133.0/24', '10.64.134.0/24', '10.64.135.0/24', '10.64.136.0/24', '10.64.137.0/24', '10.64.138.0/24', '10.64.139.0/24', '10.64.140.0/24', '10.64.141.0/24', '10.64.142.0/24', '10.64.143.0/24', '10.64.144.0/24', '10.64.145.0/24', '10.64.148.0/24', '10.64.149.0/24', '10.64.150.0/24', '10.64.151.0/24', '10.64.152.0/24', '10.64.153.0/24', '10.64.154.0/24', '10.64.155.0/24', '10.64.156.0/24', '10.64.157.0/24', '10.64.158.0/24', '10.64.159.0/24', '10.64.16.0/22', '10.64.160.0/24', '10.64.161.0/24', '10.64.162.0/24', '10.64.163.0/24', '10.64.164.0/24', '10.64.165.0/24', '10.64.166.0/24', '10.64.167.0/24', '10.64.169.0/24', '10.64.170.0/24', '10.64.171.0/24', '10.64.172.0/24', '10.64.173.0/24', '10.64.174.0/24', '10.64.175.0/24', '10.64.176.0/24', '10.64.177.0/24', '10.64.178.0/24', '10.64.179.0/24', '10.64.180.0/24', '10.64.181.0/24', '10.64.182.0/24', '10.64.183.0/24', '10.64.184.0/24', '10.64.185.0/24', '10.64.186.0/24', '10.64.187.0/24', '10.64.188.0/24', '10.64.189.0/24', '10.64.190.0/24', '10.64.20.0/24', '10.64.21.0/24', '10.64.24.0/23', '10.64.32.0/22', '10.64.36.0/24', '10.64.48.0/22', '10.64.5.0/24', '10.64.53.0/24', '10.64.64.0/21', '10.64.72.0/24', '10.64.76.0/24', '10.67.0.0/20', '10.67.128.0/17', '10.67.16.0/21', '10.67.24.0/21', '10.67.32.0/20', '10.67.64.0/20', '10.67.80.0/21', '10.80.0.0/24', '10.80.1.0/24', '10.80.2.0/24', '103.102.166.0/28', '103.102.166.224/27', '103.102.166.96/27', '185.15.58.0/27', '185.15.58.224/27', '185.15.58.32/27', '185.15.59.0/27', '185.15.59.224/27', '185.15.59.32/27', '185.15.59.96/27', '195.200.68.0/27', '195.200.68.224/27', '195.200.68.32/27', '195.200.68.96/27', '198.35.26.0/27', '198.35.26.32/27', '198.35.26.96/27', '198.35.26.96/27', '2001:df2:e500:101::/64', '2001:df2:e500:103::/64', '2001:df2:e500:1::/64', '2001:df2:e500:3::/64', '2001:df2:e500:ed1a::/64', '208.80.152.128/27', '208.80.153.0/27', '208.80.153.224/27', '208.80.153.32/27', '208.80.153.64/27', '208.80.153.96/27', '208.80.154.0/26', '208.80.154.128/26', '208.80.154.224/27', '208.80.154.64/26', '208.80.155.96/27', '2620:0:860:100::/64', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '2620:0:860:105::/64', '2620:0:860:106::/64', '2620:0:860:107::/64', '2620:0:860:108::/64', '2620:0:860:109::/64', '2620:0:860:10a::/64', '2620:0:860:10b::/64', '2620:0:860:10c::/64', '2620:0:860:10d::/64', '2620:0:860:10e::/64', '2620:0:860:10f::/64', '2620:0:860:110::/64', '2620:0:860:111::/64', '2620:0:860:112::/64', '2620:0:860:113::/64', '2620:0:860:114::/64', '2620:0:860:115::/64', '2620:0:860:116::/64', '2620:0:860:118::/64', '2620:0:860:119::/64', '2620:0:860:11a::/64', '2620:0:860:11b::/64', '2620:0:860:11c::/64', '2620:0:860:11d::/64', '2620:0:860:11e::/64', '2620:0:860:11f::/64', '2620:0:860:120::/64', '2620:0:860:121::/64', '2620:0:860:122::/64', '2620:0:860:123::/64', '2620:0:860:124::/64', '2620:0:860:125::/64', '2620:0:860:126::/64', '2620:0:860:127::/64', '2620:0:860:12b::/64', '2620:0:860:12c::/64', '2620:0:860:12d::/64', '2620:0:860:12e::/64', '2620:0:860:140::/64', '2620:0:860:1::/64', '2620:0:860:2::/64', '2620:0:860:300::/64', '2620:0:860:301::/64', '2620:0:860:302::/64', '2620:0:860:303::/64', '2620:0:860:304::/64', '2620:0:860:305::/64', '2620:0:860:307::/64', '2620:0:860:308::/64', '2620:0:860:3::/64', '2620:0:860:4::/64', '2620:0:860:5::/64', '2620:0:860:babe::/64', '2620:0:860:babf::/64', '2620:0:860:cabe::/64', '2620:0:860:cabf::/64', '2620:0:860:ed1a::/64', '2620:0:861:100::/64', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:104::/64', '2620:0:861:105::/64', '2620:0:861:106::/64', '2620:0:861:107::/64', '2620:0:861:108::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10c::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:110::/64', '2620:0:861:111::/64', '2620:0:861:112::/64', '2620:0:861:113::/64', '2620:0:861:114::/64', '2620:0:861:115::/64', '2620:0:861:116::/64', '2620:0:861:117::/64', '2620:0:861:118::/64', '2620:0:861:119::/64', '2620:0:861:11a::/64', '2620:0:861:11c::/64', '2620:0:861:11d::/64', '2620:0:861:11e::/64', '2620:0:861:11f::/64', '2620:0:861:120::/64', '2620:0:861:121::/64', '2620:0:861:122::/64', '2620:0:861:123::/64', '2620:0:861:124::/64', '2620:0:861:125::/64', '2620:0:861:126::/64', '2620:0:861:127::/64', '2620:0:861:128::/64', '2620:0:861:129::/64', '2620:0:861:12a::/64', '2620:0:861:12b::/64', '2620:0:861:12c::/64', '2620:0:861:12d::/64', '2620:0:861:12e::/64', '2620:0:861:12f::/64', '2620:0:861:131::/64', '2620:0:861:132::/64', '2620:0:861:133::/64', '2620:0:861:134::/64', '2620:0:861:135::/64', '2620:0:861:136::/64', '2620:0:861:137::/64', '2620:0:861:138::/64', '2620:0:861:139::/64', '2620:0:861:13a::/64', '2620:0:861:13b::/64', '2620:0:861:13c::/64', '2620:0:861:13d::/64', '2620:0:861:13e::/64', '2620:0:861:13f::/64', '2620:0:861:140::/64', '2620:0:861:141::/64', '2620:0:861:142::/64', '2620:0:861:143::/64', '2620:0:861:144::/64', '2620:0:861:145::/64', '2620:0:861:1::/64', '2620:0:861:2::/64', '2620:0:861:300::/64', '2620:0:861:301::/116', '2620:0:861:302::/64', '2620:0:861:303::/116', '2620:0:861:304::/116', '2620:0:861:305::/64', '2620:0:861:3::/64', '2620:0:861:4::/64', '2620:0:861:babe::/64', '2620:0:861:babf::/116', '2620:0:861:cabe::/64', '2620:0:861:cabf::/116', '2620:0:861:ed1a::/64', '2620:0:863:101::/64', '2620:0:863:102::/64', '2620:0:863:103::/64', '2620:0:863:1::/64', '2620:0:863:2::/64', '2620:0:863:3::/64', '2620:0:863:ed1a::/64', '2a02:ec80:300:101::/64', '2a02:ec80:300:102::/64', '2a02:ec80:300:103::/64', '2a02:ec80:300:1::/64', '2a02:ec80:300:2::/64', '2a02:ec80:300:3::/64', '2a02:ec80:300:ed1a::/64', '2a02:ec80:600:101::/64', '2a02:ec80:600:102::/64', '2a02:ec80:600:1::/64', '2a02:ec80:600:2::/64', '2a02:ec80:600:ed1a::/64', '2a02:ec80:700:101::/64', '2a02:ec80:700:102::/64', '2a02:ec80:700:103::/64', '2a02:ec80:700:1::/64', '2a02:ec80:700:2::/64', '2a02:ec80:700:3::/64', '2a02:ec80:700:ed1a::/64']
+    ensure => present

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/discovery2026]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026].orig
+++ File[/etc/cfssl/signers/discovery2026]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/var/log/cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-dse_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-dse_front_proxy]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]

-    before      => ['Service[cfssl-ocsprefresh-discovery.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem.orig
+++ /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
-y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
-+Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
-N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
-fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
------END CERTIFICATE-----

File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-ferm_active" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Service[cfssl-ocsprefresh-wikikube.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-wikikube.timer].orig
+++ Service[cfssl-ocsprefresh-wikikube.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-dse.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-dse.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-dse.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-dse.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft].orig
+++ File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CUMIN_MASTERS_ipv6.nft.orig
+++ /etc/nftables/sets/CUMIN_MASTERS_ipv6.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set CUMIN_MASTERS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:102:10:64:16:154,
+             2620:0:860:103:10:192:32:49
+    }
+}

Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/srv/cfssl/bundles/discovery.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/discovery.pem].orig
+++ File[/srv/cfssl/bundles/discovery.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/discovery.pem.orig
+++ /srv/cfssl/bundles/discovery.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
-BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
-3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
-wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
-5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
-NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
-BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
-ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
-q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
-ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
-4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
------END CERTIFICATE-----

Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem

Service[cfssl-ocspserve@dse]

Parameters differences:

--- Service[cfssl-ocspserve@dse].orig
+++ Service[cfssl-ocspserve@dse]

-    enable => True
-    ensure => running

Systemd::Syslog[prometheus-node-textfile-check-nft]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-check-nft].orig
+++ Systemd::Syslog[prometheus-node-textfile-check-nft]

+    force_stop             => True
+    readable_by            => all
+    owner                  => root
+    base_dir               => /var/log
+    group                  => root
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    ensure                 => present

Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    ensure => present

Service[cfssl-ocspserve@network_devices]

Parameters differences:

--- Service[cfssl-ocspserve@network_devices].orig
+++ Service[cfssl-ocspserve@network_devices]

-    enable => True
-    ensure => running

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_dse" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_staging
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f389c556cebfcfc345b3d6802f320045" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Prometheus::Blackbox::Check::Http[PKI_syslog]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_syslog].orig
+++ Prometheus::Blackbox::Check::Http[PKI_syslog]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"syslog"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_mlserve]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem

Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_cloud_wmnet_ca].orig
+++ Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]

-    user       => nrpe_certificate_check_cloud_wmnet_ca
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/srv/cfssl/bundles/mlserve_staging.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/mlserve_staging.pem].orig
+++ File[/srv/cfssl/bundles/mlserve_staging.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/mlserve_staging.pem.orig
+++ /srv/cfssl/bundles/mlserve_staging.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
-V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
-yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
-JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
-7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
------END CERTIFICATE-----

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"mlserve_front_proxy"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/apache2/conf-enabled]

Parameters differences:

--- File[/etc/apache2/conf-enabled].orig
+++ File[/etc/apache2/conf-enabled]

-    owner   => root
-    group   => root
-    mode    => 0755
-    require => Package[apache2]
-    recurse => True
-    purge   => True
-    notify  => Service[apache2]
-    ensure  => directory

File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/ferm/conf.d/01_drop-blocked-nets]

Parameters differences:

--- File[/etc/ferm/conf.d/01_drop-blocked-nets].orig
+++ File[/etc/ferm/conf.d/01_drop-blocked-nets]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/01_drop-blocked-nets.orig
+++ /etc/ferm/conf.d/01_drop-blocked-nets
@@ -1,11 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 01_drop-blocked-nets: drop abuse/blocked_nets.yaml defined in the requestctl private repo
-
-domain (ip ip6) {
-	table filter {
-		chain INPUT {
-			saddr $BLOCKED_NETS DROP;
-		}
-	}
-}

Monitoring::Service[check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_puppet_rsa].orig
+++ Monitoring::Service[check_certificate_expiry_puppet_rsa]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_puppet_rsa!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: puppet_rsa
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Sudo::User[nrpe-check_check_certificate_expiry_wikikube]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_wikikube].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Augeas[Apache2 logs]

Parameters differences:

--- Augeas[Apache2 logs].orig
+++ Augeas[Apache2 logs]

-    lens    => Logrotate.lns
-    incl    => /etc/logrotate.d/apache2
-    changes => ['set rule/schedule daily', 'set rule/rotate 30']
-    require => Package[apache2]

File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_aux.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/apache2/env-available]

Parameters differences:

--- File[/etc/apache2/env-available].orig
+++ File[/etc/apache2/env-available]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0755
-    require => Package[apache2]

Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --responses-file /etc/cfssl/ocsp/wikikube_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging' wikikube_staging 
-    description               => OCSP Refresh job - wikikube_staging
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Nrpe::Monitor_service[check_certificate_expiry_aux]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_aux].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_aux]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: aux
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/etc/cfssl/signers/wikikube_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Systemd::Timer::Job[cfssl-ocsprefresh-aux]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-aux].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-aux]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux/ca/aux.pem --responses-file /etc/cfssl/ocsp/aux.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux' aux 
-    description               => OCSP Refresh job - aux
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_syslog.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_syslog.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]

Parameters differences:

--- Cfssl::Cert[puppet_rsa__pki_discovery_wmnet].orig
+++ Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    owner           => root
-    hosts           => ['pki1001.eqiad.wmnet']
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    group           => root
-    key             => {'algo': 'ecdsa', 'size': 256}
-    mode            => 0740
-    common_name     => pki.discovery.wmnet
-    names           => []
-    provide_chain   => True
-    label           => puppet_rsa
-    notify_services => ['apache2']
-    ensure          => present
-    before_services => []

Nrpe::Check[check_check_certificate_expiry_syslog]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_syslog].orig
+++ Nrpe::Check[check_check_certificate_expiry_syslog]

-    before    => Monitoring::Service[check_certificate_expiry_syslog]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem
-    ensure    => present
-    sudo_user => root

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-syslog-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_cfssl-multirootca_status
-    splay                     => 300
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "52832284a5fb8b8ea6f55bb6271912c9" --timeout 10 --check-command "check_check_cfssl-multirootca_status" --page
-    description               => execution of nrpe2nodexp for the check_check_cfssl-multirootca_status command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/srv/cfssl/bundles/kafka.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/kafka.pem].orig
+++ File[/srv/cfssl/bundles/kafka.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/kafka.pem.orig
+++ /srv/cfssl/bundles/kafka.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
-AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
-DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
-kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
-AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
-RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
-CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
-d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
-MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
-X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
-tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
-b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
-up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
------END CERTIFICATE-----

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-discovery-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Nrpe::Monitor_service[check_certificate_expiry_network_devices]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_network_devices].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_network_devices]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: network_devices
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Exported_nagios_service[pki1001 ssh]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 ssh].orig
+++ Monitoring::Exported_nagios_service[pki1001 ssh]

@@
-    servicegroups         => pki_eqiad
+    servicegroups         => insetup_eqiad
@@
-    notifications_enabled => 1
+    notifications_enabled => 0

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_aux
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f7dfe9e2cd77303dfae7ae11c5c56d90" --timeout 10 --check-command "check_check_certificate_expiry_aux"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_aux command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft
@@ -0,0 +1,183 @@
+# Autogenerated by puppet
+set DOMAIN_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2001:df2:e500:101::/64,
+             2001:df2:e500:103::/64,
+             2001:df2:e500:1::/64,
+             2001:df2:e500:3::/64,
+             2001:df2:e500:ed1a::/64,
+             2620:0:860:100::/64,
+             2620:0:860:101::/64,
+             2620:0:860:102::/64,
+             2620:0:860:103::/64,
+             2620:0:860:104::/64,
+             2620:0:860:105::/64,
+             2620:0:860:106::/64,
+             2620:0:860:107::/64,
+             2620:0:860:108::/64,
+             2620:0:860:109::/64,
+             2620:0:860:10a::/64,
+             2620:0:860:10b::/64,
+             2620:0:860:10c::/64,
+             2620:0:860:10d::/64,
+             2620:0:860:10e::/64,
+             2620:0:860:10f::/64,
+             2620:0:860:110::/64,
+             2620:0:860:111::/64,
+             2620:0:860:112::/64,
+             2620:0:860:113::/64,
+             2620:0:860:114::/64,
+             2620:0:860:115::/64,
+             2620:0:860:116::/64,
+             2620:0:860:118::/64,
+             2620:0:860:119::/64,
+             2620:0:860:11a::/64,
+             2620:0:860:11b::/64,
+             2620:0:860:11c::/64,
+             2620:0:860:11d::/64,
+             2620:0:860:11e::/64,
+             2620:0:860:11f::/64,
+             2620:0:860:120::/64,
+             2620:0:860:121::/64,
+             2620:0:860:122::/64,
+             2620:0:860:123::/64,
+             2620:0:860:124::/64,
+             2620:0:860:125::/64,
+             2620:0:860:126::/64,
+             2620:0:860:127::/64,
+             2620:0:860:12b::/64,
+             2620:0:860:12c::/64,
+             2620:0:860:12d::/64,
+             2620:0:860:12e::/64,
+             2620:0:860:140::/64,
+             2620:0:860:1::/64,
+             2620:0:860:2::/64,
+             2620:0:860:300::/64,
+             2620:0:860:301::/64,
+             2620:0:860:302::/64,
+             2620:0:860:303::/64,
+             2620:0:860:304::/64,
+             2620:0:860:305::/64,
+             2620:0:860:307::/64,
+             2620:0:860:308::/64,
+             2620:0:860:3::/64,
+             2620:0:860:4::/64,
+             2620:0:860:5::/64,
+             2620:0:860:babe::/64,
+             2620:0:860:babf::/64,
+             2620:0:860:cabe::/64,
+             2620:0:860:cabf::/64,
+             2620:0:860:ed1a::/64,
+             2620:0:861:100::/64,
+             2620:0:861:101::/64,
+             2620:0:861:102::/64,
+             2620:0:861:103::/64,
+             2620:0:861:104::/64,
+             2620:0:861:105::/64,
+             2620:0:861:106::/64,
+             2620:0:861:107::/64,
+             2620:0:861:108::/64,
+             2620:0:861:109::/64,
+             2620:0:861:10a::/64,
+             2620:0:861:10b::/64,
+             2620:0:861:10c::/64,
+             2620:0:861:10d::/64,
+             2620:0:861:10e::/64,
+             2620:0:861:10f::/64,
+             2620:0:861:110::/64,
+             2620:0:861:111::/64,
+             2620:0:861:112::/64,
+             2620:0:861:113::/64,
+             2620:0:861:114::/64,
+             2620:0:861:115::/64,
+             2620:0:861:116::/64,
+             2620:0:861:117::/64,
+             2620:0:861:118::/64,
+             2620:0:861:119::/64,
+             2620:0:861:11a::/64,
+             2620:0:861:11c::/64,
+             2620:0:861:11d::/64,
+             2620:0:861:11e::/64,
+             2620:0:861:11f::/64,
+             2620:0:861:120::/64,
+             2620:0:861:121::/64,
+             2620:0:861:122::/64,
+             2620:0:861:123::/64,
+             2620:0:861:124::/64,
+             2620:0:861:125::/64,
+             2620:0:861:126::/64,
+             2620:0:861:127::/64,
+             2620:0:861:128::/64,
+             2620:0:861:129::/64,
+             2620:0:861:12a::/64,
+             2620:0:861:12b::/64,
+             2620:0:861:12c::/64,
+             2620:0:861:12d::/64,
+             2620:0:861:12e::/64,
+             2620:0:861:12f::/64,
+             2620:0:861:131::/64,
+             2620:0:861:132::/64,
+             2620:0:861:133::/64,
+             2620:0:861:134::/64,
+             2620:0:861:135::/64,
+             2620:0:861:136::/64,
+             2620:0:861:137::/64,
+             2620:0:861:138::/64,
+             2620:0:861:139::/64,
+             2620:0:861:13a::/64,
+             2620:0:861:13b::/64,
+             2620:0:861:13c::/64,
+             2620:0:861:13d::/64,
+             2620:0:861:13e::/64,
+             2620:0:861:13f::/64,
+             2620:0:861:140::/64,
+             2620:0:861:141::/64,
+             2620:0:861:142::/64,
+             2620:0:861:143::/64,
+             2620:0:861:144::/64,
+             2620:0:861:145::/64,
+             2620:0:861:1::/64,
+             2620:0:861:2::/64,
+             2620:0:861:300::/64,
+             2620:0:861:301::/116,
+             2620:0:861:302::/64,
+             2620:0:861:303::/116,
+             2620:0:861:304::/116,
+             2620:0:861:305::/64,
+             2620:0:861:3::/64,
+             2620:0:861:4::/64,
+             2620:0:861:babe::/64,
+             2620:0:861:babf::/116,
+             2620:0:861:cabe::/64,
+             2620:0:861:cabf::/116,
+             2620:0:861:ed1a::/64,
+             2620:0:863:101::/64,
+             2620:0:863:102::/64,
+             2620:0:863:103::/64,
+             2620:0:863:1::/64,
+             2620:0:863:2::/64,
+             2620:0:863:3::/64,
+             2620:0:863:ed1a::/64,
+             2a02:ec80:300:101::/64,
+             2a02:ec80:300:102::/64,
+             2a02:ec80:300:103::/64,
+             2a02:ec80:300:1::/64,
+             2a02:ec80:300:2::/64,
+             2a02:ec80:300:3::/64,
+             2a02:ec80:300:ed1a::/64,
+             2a02:ec80:600:101::/64,
+             2a02:ec80:600:102::/64,
+             2a02:ec80:600:1::/64,
+             2a02:ec80:600:2::/64,
+             2a02:ec80:600:ed1a::/64,
+             2a02:ec80:700:101::/64,
+             2a02:ec80:700:102::/64,
+             2a02:ec80:700:103::/64,
+             2a02:ec80:700:1::/64,
+             2a02:ec80:700:2::/64,
+             2a02:ec80:700:3::/64,
+             2a02:ec80:700:ed1a::/64
+    }
+}

File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-network_devices.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-network_devices.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - network_devices
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/network_devices/ca/network_devices.pem --responses-file /etc/cfssl/ocsp/network_devices.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@network_devices' network_devices

Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_dse_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_dse_front_proxy]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    ensure    => present
-    sudo_user => root

Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"aux_front_proxy"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/nagios/nrpe.d/check_ferm_active.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_ferm_active.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_ferm_active.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_ferm_active.cfg.orig
+++ /etc/nagios/nrpe.d/check_ferm_active.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_ferm_active]=/usr/bin/sudo /usr/local/lib/nagios/plugins/check_ferm

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_network_devices]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-debmonitor.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]

-    unit              => cfssl-ocsprefresh-debmonitor.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Service[cfssl-ocsprefresh-discovery]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-discovery.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/cfssl/ocsp/syslog.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/syslog.ocsp].orig
+++ File[/etc/cfssl/ocsp/syslog.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem

Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Exec[Generate initial CRL for dse_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for dse_front_proxy].orig
+++ Exec[Generate initial CRL for dse_front_proxy]

-    creates => /srv/cfssl/crl/dse_front_proxy
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/dse_front_proxy
-    require => ['Package[golang-cfssl]']

File[/srv/cfssl/bundles/dse_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/dse_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/dse_front_proxy.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/dse_front_proxy.pem.orig
+++ /srv/cfssl/bundles/dse_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
-y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
-+Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
-N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
-fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
------END CERTIFICATE-----

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_syslog!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: syslog
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_discovery2026!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: discovery2026
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_debmonitor!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: debmonitor
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/LABS_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/LABS_NETWORKS_ipv4.nft
@@ -0,0 +1,27 @@
+# Autogenerated by puppet
+set LABS_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 172.16.0.0/21,
+             172.16.128.0/24,
+             172.16.129.0/24,
+             172.16.130.0/24,
+             172.16.131.0/24,
+             172.16.16.0/21,
+             172.16.24.0/24,
+             172.16.8.0/21,
+             172.20.1.0/24,
+             172.20.2.0/24,
+             172.20.254.0/24,
+             172.20.255.0/24,
+             172.20.3.0/24,
+             172.20.4.0/24,
+             172.20.5.0/24,
+             185.15.56.0/25,
+             185.15.56.160/28,
+             185.15.57.0/29,
+             185.15.57.16/29,
+             185.15.57.24/29
+    }
+}

Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem].orig
+++ Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

-    command   => /bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem > /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem
-    subscribe => ['Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]', 'File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]', 'File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]']
-    notify    => ['Service[apache2]']
-    unless    => /usr/bin/test "$(/bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem | sha512sum)" == "$(/bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem | sha512sum)"

-    require   => Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]

Systemd::Service[cfssl-gc-expired-certs]

Parameters differences:

--- Systemd::Service[cfssl-gc-expired-certs].orig
+++ Systemd::Service[cfssl-gc-expired-certs]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-gc-expired-certs.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Nftables::Set[DOMAIN_NETWORKS]

Parameters differences:

--- Nftables::Set[DOMAIN_NETWORKS].orig
+++ Nftables::Set[DOMAIN_NETWORKS]

+    hosts  => ['10.128.0.0/24', '10.128.1.0/24', '10.128.2.0/24', '10.132.0.0/24', '10.132.2.0/24', '10.136.0.0/24', '10.136.1.0/24', '10.140.0.0/24', '10.140.1.0/24', '10.140.2.0/24', '10.192.0.0/22', '10.192.10.0/24', '10.192.11.0/24', '10.192.12.0/24', '10.192.13.0/24', '10.192.14.0/24', '10.192.15.0/24', '10.192.16.0/22', '10.192.20.0/24', '10.192.21.0/24', '10.192.22.0/24', '10.192.23.0/24', '10.192.24.0/23', '10.192.26.0/24', '10.192.27.0/24', '10.192.28.0/24', '10.192.29.0/24', '10.192.30.0/24', '10.192.31.0/24', '10.192.32.0/22', '10.192.36.0/24', '10.192.37.0/24', '10.192.38.0/24', '10.192.39.0/24', '10.192.4.0/24', '10.192.40.0/24', '10.192.41.0/24', '10.192.42.0/24', '10.192.43.0/24', '10.192.44.0/24', '10.192.45.0/24', '10.192.46.0/24', '10.192.47.0/24', '10.192.48.0/22', '10.192.5.0/24', '10.192.52.0/24', '10.192.56.0/24', '10.192.57.0/24', '10.192.58.0/24', '10.192.59.0/24', '10.192.6.0/24', '10.192.64.0/21', '10.192.7.0/24', '10.192.72.0/24', '10.192.76.0/24', '10.192.8.0/24', '10.192.80.0/20', '10.192.9.0/24', '10.192.96.0/21', '10.194.0.0/20', '10.194.128.0/17', '10.194.16.0/21', '10.194.61.0/24', '10.194.62.0/23', '10.194.64.0/20', '10.194.80.0/21', '10.2.1.0/24', '10.2.2.0/24', '10.2.3.0/24', '10.2.4.0/24', '10.2.5.0/24', '10.2.6.0/24', '10.2.7.0/24', '10.64.0.0/22', '10.64.130.0/24', '10.64.131.0/24', '10.64.132.0/24', '10.64.133.0/24', '10.64.134.0/24', '10.64.135.0/24', '10.64.136.0/24', '10.64.137.0/24', '10.64.138.0/24', '10.64.139.0/24', '10.64.140.0/24', '10.64.141.0/24', '10.64.142.0/24', '10.64.143.0/24', '10.64.144.0/24', '10.64.145.0/24', '10.64.148.0/24', '10.64.149.0/24', '10.64.150.0/24', '10.64.151.0/24', '10.64.152.0/24', '10.64.153.0/24', '10.64.154.0/24', '10.64.155.0/24', '10.64.156.0/24', '10.64.157.0/24', '10.64.158.0/24', '10.64.159.0/24', '10.64.16.0/22', '10.64.160.0/24', '10.64.161.0/24', '10.64.162.0/24', '10.64.163.0/24', '10.64.164.0/24', '10.64.165.0/24', '10.64.166.0/24', '10.64.167.0/24', '10.64.169.0/24', '10.64.170.0/24', '10.64.171.0/24', '10.64.172.0/24', '10.64.173.0/24', '10.64.174.0/24', '10.64.175.0/24', '10.64.176.0/24', '10.64.177.0/24', '10.64.178.0/24', '10.64.179.0/24', '10.64.180.0/24', '10.64.181.0/24', '10.64.182.0/24', '10.64.183.0/24', '10.64.184.0/24', '10.64.185.0/24', '10.64.186.0/24', '10.64.187.0/24', '10.64.188.0/24', '10.64.189.0/24', '10.64.190.0/24', '10.64.20.0/24', '10.64.21.0/24', '10.64.24.0/23', '10.64.32.0/22', '10.64.36.0/24', '10.64.48.0/22', '10.64.5.0/24', '10.64.53.0/24', '10.64.64.0/21', '10.64.72.0/24', '10.64.76.0/24', '10.67.0.0/20', '10.67.128.0/17', '10.67.16.0/21', '10.67.24.0/21', '10.67.32.0/20', '10.67.64.0/20', '10.67.80.0/21', '10.80.0.0/24', '10.80.1.0/24', '10.80.2.0/24', '103.102.166.0/28', '103.102.166.224/27', '103.102.166.96/27', '185.15.58.0/27', '185.15.58.224/27', '185.15.58.32/27', '185.15.59.0/27', '185.15.59.224/27', '185.15.59.32/27', '185.15.59.96/27', '195.200.68.0/27', '195.200.68.224/27', '195.200.68.32/27', '195.200.68.96/27', '198.35.26.0/27', '198.35.26.32/27', '198.35.26.96/27', '198.35.26.96/27', '2001:df2:e500:101::/64', '2001:df2:e500:103::/64', '2001:df2:e500:1::/64', '2001:df2:e500:3::/64', '2001:df2:e500:ed1a::/64', '208.80.152.128/27', '208.80.153.0/27', '208.80.153.224/27', '208.80.153.32/27', '208.80.153.64/27', '208.80.153.96/27', '208.80.154.0/26', '208.80.154.128/26', '208.80.154.224/27', '208.80.154.64/26', '208.80.155.96/27', '2620:0:860:100::/64', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '2620:0:860:105::/64', '2620:0:860:106::/64', '2620:0:860:107::/64', '2620:0:860:108::/64', '2620:0:860:109::/64', '2620:0:860:10a::/64', '2620:0:860:10b::/64', '2620:0:860:10c::/64', '2620:0:860:10d::/64', '2620:0:860:10e::/64', '2620:0:860:10f::/64', '2620:0:860:110::/64', '2620:0:860:111::/64', '2620:0:860:112::/64', '2620:0:860:113::/64', '2620:0:860:114::/64', '2620:0:860:115::/64', '2620:0:860:116::/64', '2620:0:860:118::/64', '2620:0:860:119::/64', '2620:0:860:11a::/64', '2620:0:860:11b::/64', '2620:0:860:11c::/64', '2620:0:860:11d::/64', '2620:0:860:11e::/64', '2620:0:860:11f::/64', '2620:0:860:120::/64', '2620:0:860:121::/64', '2620:0:860:122::/64', '2620:0:860:123::/64', '2620:0:860:124::/64', '2620:0:860:125::/64', '2620:0:860:126::/64', '2620:0:860:127::/64', '2620:0:860:12b::/64', '2620:0:860:12c::/64', '2620:0:860:12d::/64', '2620:0:860:12e::/64', '2620:0:860:140::/64', '2620:0:860:1::/64', '2620:0:860:2::/64', '2620:0:860:300::/64', '2620:0:860:301::/64', '2620:0:860:302::/64', '2620:0:860:303::/64', '2620:0:860:304::/64', '2620:0:860:305::/64', '2620:0:860:307::/64', '2620:0:860:308::/64', '2620:0:860:3::/64', '2620:0:860:4::/64', '2620:0:860:5::/64', '2620:0:860:babe::/64', '2620:0:860:babf::/64', '2620:0:860:cabe::/64', '2620:0:860:cabf::/64', '2620:0:860:ed1a::/64', '2620:0:861:100::/64', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:104::/64', '2620:0:861:105::/64', '2620:0:861:106::/64', '2620:0:861:107::/64', '2620:0:861:108::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10c::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:110::/64', '2620:0:861:111::/64', '2620:0:861:112::/64', '2620:0:861:113::/64', '2620:0:861:114::/64', '2620:0:861:115::/64', '2620:0:861:116::/64', '2620:0:861:117::/64', '2620:0:861:118::/64', '2620:0:861:119::/64', '2620:0:861:11a::/64', '2620:0:861:11c::/64', '2620:0:861:11d::/64', '2620:0:861:11e::/64', '2620:0:861:11f::/64', '2620:0:861:120::/64', '2620:0:861:121::/64', '2620:0:861:122::/64', '2620:0:861:123::/64', '2620:0:861:124::/64', '2620:0:861:125::/64', '2620:0:861:126::/64', '2620:0:861:127::/64', '2620:0:861:128::/64', '2620:0:861:129::/64', '2620:0:861:12a::/64', '2620:0:861:12b::/64', '2620:0:861:12c::/64', '2620:0:861:12d::/64', '2620:0:861:12e::/64', '2620:0:861:12f::/64', '2620:0:861:131::/64', '2620:0:861:132::/64', '2620:0:861:133::/64', '2620:0:861:134::/64', '2620:0:861:135::/64', '2620:0:861:136::/64', '2620:0:861:137::/64', '2620:0:861:138::/64', '2620:0:861:139::/64', '2620:0:861:13a::/64', '2620:0:861:13b::/64', '2620:0:861:13c::/64', '2620:0:861:13d::/64', '2620:0:861:13e::/64', '2620:0:861:13f::/64', '2620:0:861:140::/64', '2620:0:861:141::/64', '2620:0:861:142::/64', '2620:0:861:143::/64', '2620:0:861:144::/64', '2620:0:861:145::/64', '2620:0:861:1::/64', '2620:0:861:2::/64', '2620:0:861:300::/64', '2620:0:861:301::/116', '2620:0:861:302::/64', '2620:0:861:303::/116', '2620:0:861:304::/116', '2620:0:861:305::/64', '2620:0:861:3::/64', '2620:0:861:4::/64', '2620:0:861:babe::/64', '2620:0:861:babf::/116', '2620:0:861:cabe::/64', '2620:0:861:cabf::/116', '2620:0:861:ed1a::/64', '2620:0:863:101::/64', '2620:0:863:102::/64', '2620:0:863:103::/64', '2620:0:863:1::/64', '2620:0:863:2::/64', '2620:0:863:3::/64', '2620:0:863:ed1a::/64', '2a02:ec80:300:101::/64', '2a02:ec80:300:102::/64', '2a02:ec80:300:103::/64', '2a02:ec80:300:1::/64', '2a02:ec80:300:2::/64', '2a02:ec80:300:3::/64', '2a02:ec80:300:ed1a::/64', '2a02:ec80:600:101::/64', '2a02:ec80:600:102::/64', '2a02:ec80:600:1::/64', '2a02:ec80:600:2::/64', '2a02:ec80:600:ed1a::/64', '2a02:ec80:700:101::/64', '2a02:ec80:700:102::/64', '2a02:ec80:700:103::/64', '2a02:ec80:700:1::/64', '2a02:ec80:700:2::/64', '2a02:ec80:700:3::/64', '2a02:ec80:700:ed1a::/64']
+    ensure => present

Systemd::Unit[cfssl-gc-expired-certs.service]

Parameters differences:

--- Systemd::Unit[cfssl-gc-expired-certs.service].orig
+++ Systemd::Unit[cfssl-gc-expired-certs.service]

-    unit              => cfssl-gc-expired-certs.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]

Rsyslog::Conf[wmf_auto_restart_ulogd2]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_ulogd2].orig
+++ Rsyslog::Conf[wmf_auto_restart_ulogd2]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/wmf_auto_restart_ulogd2]

Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Logrotate::Conf[cfssl-ocsprefresh-dse]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-dse].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-dse]

-    ensure => present

Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: syslog
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__syslog
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="e3b9b989d5062ce2d267023dfe42fcd8",check_name="check_check_certificate_expiry_syslog", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: syslog
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_syslog))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]

-    unit              => cfssl-ocsprefresh-puppet_rsa.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-wikikube_staging_front_proxy
-
-/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Service[ulogd2]

Parameters differences:

--- Service[ulogd2].orig
+++ Service[ulogd2]

-    enable  => True
-    ensure  => running
-    require => Package[ulogd2]

File[/etc/cfssl/signers/dse_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy].orig
+++ File[/etc/cfssl/signers/dse_front_proxy]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem].orig
+++ File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem.orig
+++ /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
@@ -1 +0,0 @@
-nosecret

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_etcd.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Logrotate::Conf[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-cassandra].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-cassandra]

-    ensure => present

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[Generate initial CRL for cloud_wmnet_ca]

Parameters differences:

--- Exec[Generate initial CRL for cloud_wmnet_ca].orig
+++ Exec[Generate initial CRL for cloud_wmnet_ca]

-    creates => /srv/cfssl/crl/cloud_wmnet_ca
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/cloud_wmnet_ca
-    require => ['Package[golang-cfssl]']

Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    ensure    => present
-    sudo_user => root

Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    ensure => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-wikikube_staging].orig
+++ Systemd::Service[cfssl-ocsprefresh-wikikube_staging]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Unit[cfssl-ocsprefresh-etcd.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-etcd.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-etcd.timer]

-    unit              => cfssl-ocsprefresh-etcd.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@mlserve_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Monitoring::Service[ferm_active]

Parameters differences:

--- Monitoring::Service[ferm_active].orig
+++ Monitoring::Service[ferm_active]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm
-    check_command  => nrpe_check!check_ferm_active!10
-    critical       => False
-    description    => Check whether ferm is active by checking the default input chain
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 30
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/var/log/cfssl-gc-expired-certs]

Parameters differences:

--- File[/var/log/cfssl-gc-expired-certs].orig
+++ File[/var/log/cfssl-gc-expired-certs]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/zuul/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/zuul/cfssl.conf].orig
+++ File[/etc/cfssl/signers/zuul/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/zuul/cfssl.conf.orig
+++ /etc/cfssl/signers/zuul/cfssl.conf
@@ -1,63 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/zuul",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/zuul"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_debmonitor.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

File[/srv/cfssl/bundles/wikikube_staging.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/wikikube_staging.pem].orig
+++ File[/srv/cfssl/bundles/wikikube_staging.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/wikikube_staging.pem.orig
+++ /srv/cfssl/bundles/wikikube_staging.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
-BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
-6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
-MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
-MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
-FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
-cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
-LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
-MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
-bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
-QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
-id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
-9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
------END CERTIFICATE-----

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f87f54115f2f782169eed72541c30a1e" --timeout 10 --check-command "check_check_certificate_expiry_cloud_wmnet_ca"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_cloud_wmnet_ca command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem].orig
+++ File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]

-    owner  => root
-    source => /var/lib/puppet/ssl/certs/ca.pem
-    group  => root
-    mode   => 0444
-    ensure => file

File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-mlserve_staging_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-mlserve_staging_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_apache-htcacheclean].orig
+++ Systemd::Timer[wmf_auto_restart_apache-htcacheclean]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => wmf_auto_restart_apache-htcacheclean.service
-    ensure             => absent
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00'}]

Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-mlserve_staging]

Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]

Cfssl::Ocsp[wikikube_staging_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[wikikube_staging_front_proxy].orig
+++ Cfssl::Ocsp[wikikube_staging_front_proxy]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20021
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Class[Nftables]

Parameters differences:

--- Class[Nftables].orig
+++ Class[Nftables]

+    ensure => present

Confd::File[/etc/ferm/conf.d/00_defs_requestctl]

Parameters differences:

--- Confd::File[/etc/ferm/conf.d/00_defs_requestctl].orig
+++ Confd::File[/etc/ferm/conf.d/00_defs_requestctl]

@@
-    ensure => present
+    ensure => absent

File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/usr/local/sbin/cfssl-ocsprefresh]

Parameters differences:

--- File[/usr/local/sbin/cfssl-ocsprefresh].orig
+++ File[/usr/local/sbin/cfssl-ocsprefresh]

-    owner  => root
-    source => puppet:///modules/cfssl/cfssl_ocsprefresh.py
-    group  => root
-    mode   => 0550
-    ensure => file

File[/var/log/wmf_auto_restart_apache2]

Parameters differences:

--- File[/var/log/wmf_auto_restart_apache2].orig
+++ File[/var/log/wmf_auto_restart_apache2]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-discovery" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-discovery/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

File[/var/log/ulogd]

Parameters differences:

--- File[/var/log/ulogd].orig
+++ File[/var/log/ulogd]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Cfssl::Config[cloud_wmnet_ca]

Parameters differences:

--- Cfssl::Config[cloud_wmnet_ca].orig
+++ Cfssl::Config[cloud_wmnet_ca]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca
-    path                => /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/cloud_wmnet_ca

Systemd::Syslog[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-network_devices].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-network_devices]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (wikikube_staging_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20021 \
-          -responses /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]

Parameters differences:

--- Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS].orig
+++ Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]

+    hosts  => ['10.194.61.0/24', '2620:0:860:302::/64']
+    ensure => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft
@@ -0,0 +1,99 @@
+# Autogenerated by puppet
+set MW_APPSERVER_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.64.0.0/22,
+             10.64.130.0/24,
+             10.64.131.0/24,
+             10.64.132.0/24,
+             10.64.133.0/24,
+             10.64.134.0/24,
+             10.64.135.0/24,
+             10.64.136.0/24,
+             10.64.141.0/24,
+             10.64.152.0/24,
+             10.64.154.0/24,
+             10.64.156.0/24,
+             10.64.158.0/24,
+             10.64.16.0/22,
+             10.64.160.0/24,
+             10.64.162.0/24,
+             10.64.164.0/24,
+             10.64.166.0/24,
+             10.64.169.0/24,
+             10.64.171.0/24,
+             10.64.173.0/24,
+             10.64.175.0/24,
+             10.64.177.0/24,
+             10.64.179.0/24,
+             10.64.181.0/24,
+             10.64.183.0/24,
+             10.64.185.0/24,
+             10.64.187.0/24,
+             10.64.189.0/24,
+             10.64.32.0/22,
+             10.64.48.0/22,
+             10.192.0.0/22,
+             10.192.10.0/24,
+             10.192.11.0/24,
+             10.192.12.0/24,
+             10.192.13.0/24,
+             10.192.14.0/24,
+             10.192.15.0/24,
+             10.192.16.0/22,
+             10.192.21.0/24,
+             10.192.22.0/24,
+             10.192.23.0/24,
+             10.192.26.0/24,
+             10.192.27.0/24,
+             10.192.28.0/24,
+             10.192.29.0/24,
+             10.192.30.0/24,
+             10.192.31.0/24,
+             10.192.32.0/22,
+             10.192.36.0/24,
+             10.192.37.0/24,
+             10.192.38.0/24,
+             10.192.39.0/24,
+             10.192.4.0/24,
+             10.192.40.0/24,
+             10.192.41.0/24,
+             10.192.42.0/24,
+             10.192.43.0/24,
+             10.192.44.0/24,
+             10.192.45.0/24,
+             10.192.46.0/24,
+             10.192.47.0/24,
+             10.192.48.0/22,
+             10.192.5.0/24,
+             10.192.52.0/24,
+             10.192.56.0/24,
+             10.192.57.0/24,
+             10.192.58.0/24,
+             10.192.59.0/24,
+             10.192.6.0/24,
+             10.192.7.0/24,
+             10.192.8.0/24,
+             10.192.9.0/24,
+             10.192.64.0/21,
+             10.192.96.0/21,
+             10.194.128.0/17,
+             10.194.16.0/21,
+             10.194.61.0/24,
+             10.194.80.0/21,
+             10.64.64.0/21,
+             10.67.128.0/17,
+             10.67.16.0/21,
+             10.67.24.0/21,
+             10.67.80.0/21,
+             208.80.154.0/26,
+             208.80.154.128/26,
+             208.80.154.64/26,
+             208.80.155.96/27,
+             208.80.153.0/27,
+             208.80.153.32/27,
+             208.80.153.64/27,
+             208.80.153.96/27
+    }
+}

Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/BASTION_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/BASTION_HOSTS_ipv4.nft
@@ -0,0 +1,12 @@
+# Autogenerated by puppet
+set BASTION_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 208.80.154.7,
+             208.80.153.110,
+             185.15.59.99,
+             198.35.26.104,
+             103.102.166.103,
+             185.15.58.6,
+             195.200.68.99
+    }
+}

Service[cfssl-ocspserve@mlserve_staging]

Parameters differences:

--- Service[cfssl-ocspserve@mlserve_staging].orig
+++ Service[cfssl-ocspserve@mlserve_staging]

-    enable => True
-    ensure => running

Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Sudo::User[nrpe_certificate_check_zuul]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_zuul].orig
+++ Sudo::User[nrpe_certificate_check_zuul]

-    user       => nrpe_certificate_check_zuul
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="d2a76a31e44e204e2d4788a2698d0e6c",check_name="check_check_certificate_expiry_wikikube", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Cfssl::Ocsp[mlserve_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[mlserve_front_proxy].orig
+++ Cfssl::Ocsp[mlserve_front_proxy]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20031
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[Generate initial CRL for zuul]

Parameters differences:

--- Exec[Generate initial CRL for zuul].orig
+++ Exec[Generate initial CRL for zuul]

-    creates => /srv/cfssl/crl/zuul
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/zuul/ca/zuul.pem /etc/cfssl/signers/zuul/ca/zuul-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/zuul
-    require => ['Package[golang-cfssl]']

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-wikikube_staging_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom

Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-mlserve_staging].orig
+++ Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-mlserve_staging.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/apache2/ports.conf]

Parameters differences:

--- File[/etc/apache2/ports.conf].orig
+++ File[/etc/apache2/ports.conf]

-    notify  => Service[apache2]
-    owner   => root
-    ensure  => file
-    group   => root
-    source  => puppet:///modules/httpd/default-ports.conf
-    require => Package[apache2]

File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Service[cfssl-gc-expired-certs.timer]

Parameters differences:

--- Service[cfssl-gc-expired-certs.timer].orig
+++ Service[cfssl-gc-expired-certs.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/cfssl/signers/mlserve]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve].orig
+++ File[/etc/cfssl/signers/mlserve]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set LABSTORE_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 208.80.154.142,
+             208.80.154.71
+    }
+}

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_front_proxy!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_debmonitor.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Profile::Auto_restarts::Service[apache-htcacheclean]

Parameters differences:

--- Profile::Auto_restarts::Service[apache-htcacheclean].orig
+++ Profile::Auto_restarts::Service[apache-htcacheclean]

-    ensure => absent

Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Systemd::Service[nftables]

Parameters differences:

--- Systemd::Service[nftables].orig
+++ Systemd::Service[nftables]

+    unit_type                => service
+    monitoring_enabled       => False
+    monitoring_critical      => False
+    override                 => True
+    service_params           => {'hasrestart': True, 'restart': '/usr/bin/systemctl reload nftables'}
+    monitoring_contact_group => admins
+    restart                  => False
+    migration_task           => T407130
+    ensure                   => present

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-network_devices.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-network_devices.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-network_devices.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-network_devices.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Config[etcd]

Parameters differences:

--- Cfssl::Config[etcd].orig
+++ Cfssl::Config[etcd]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/etcd
-    path                => /etc/cfssl/signers/etcd/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/etcd

Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Systemd::Timer[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-mlserve].orig
+++ Systemd::Timer[cfssl-ocsprefresh-mlserve]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-mlserve.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Firewall::Service[csr_and_ocsp_responder]

Parameters differences:

--- Firewall::Service[csr_and_ocsp_responder].orig
+++ Firewall::Service[csr_and_ocsp_responder]

-    src_sets            => ['DOMAIN_NETWORKS', 'MGMT_NETWORKS']
-    unrestricted_access => False
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    ensure              => present
-    port                => 80

Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[wmf_auto_restart_ulogd2.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_ulogd2.service].orig
+++ Systemd::Unit[wmf_auto_restart_ulogd2.service]

-    unit              => wmf_auto_restart_ulogd2.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Config[discovery2026]

Parameters differences:

--- Cfssl::Config[discovery2026].orig
+++ Cfssl::Config[discovery2026]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/discovery2026
-    path                => /etc/cfssl/signers/discovery2026/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/discovery2026

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-mlserve_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft
@@ -0,0 +1,11 @@
+# Autogenerated by puppet
+set ZOOKEEPER_FLINK_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:102:10:64:16:9,
+             2620:0:861:101:10:64:0:8,
+             2620:0:861:103:10:64:32:41,
+             2620:0:860:102:10:192:16:227,
+             2620:0:860:103:10:192:32:179,
+             2620:0:860:104:10:192:48:219
+    }
+}

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_debmonitor].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]

-    group  => root
-    ensure => absent
-    owner  => root

Exec[systemd daemon-reload for nftables.service (nftables)]

Parameters differences:

--- Exec[systemd daemon-reload for nftables.service (nftables)].orig
+++ Exec[systemd daemon-reload for nftables.service (nftables)]

+    before      => ['Service[nftables]']
+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/srv/cfssl]

Parameters differences:

--- File[/srv/cfssl].orig
+++ File[/srv/cfssl]

-    group  => root
-    ensure => directory
-    owner  => root

File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-check-nft.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]

+    notify => Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-check-nft.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-check-nft.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Systemd timer to gather node metrics for check-nft
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/check-nft

File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft
@@ -0,0 +1,13 @@
+# Autogenerated by puppet
+set SANDBOX_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2001:df2:e500:202::/64,
+             2620:0:860:201::/64,
+             2620:0:861:202::/64,
+             2620:0:863:201::/64,
+             2a02:ec80:300:202::/64,
+             2a02:ec80:700:201::/64
+    }
+}

Service[cfssl-ocsprefresh-syslog.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-syslog.timer].orig
+++ Service[cfssl-ocsprefresh-syslog.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="bfd2f7c6497e1da6323bef48d24f9e8e",check_name="check_check_certificate_expiry_mlserve", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Systemd::Service[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-mlserve_staging].orig
+++ Systemd::Service[cfssl-ocsprefresh-mlserve_staging]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[Generate initial CRL for etcd]

Parameters differences:

--- Exec[Generate initial CRL for etcd].orig
+++ Exec[Generate initial CRL for etcd]

-    creates => /srv/cfssl/crl/etcd
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/etcd/ca/etcd.pem /etc/cfssl/signers/etcd/ca/etcd-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/etcd
-    require => ['Package[golang-cfssl]']

File[/etc/nftables/]

Parameters differences:

--- File[/etc/nftables/].orig
+++ File[/etc/nftables/]

+    group   => root
+    recurse => True
+    purge   => True
+    owner   => root
+    path    => /etc/nftables
+    ensure  => directory

File[/etc/ferm]

Parameters differences:

--- File[/etc/ferm].orig
+++ File[/etc/ferm]

@@
-    ensure => directory
+    ensure => absent

Profile::Pki::Multirootca::Monitoring[dse]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[dse].orig
+++ Profile::Pki::Multirootca::Monitoring[dse]

-    ca_file      => /etc/cfssl/signers/dse/ca/dse.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => dse

File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-discovery.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-discovery.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-discovery.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Service[cfssl-ocspserve@debmonitor]

Parameters differences:

--- Service[cfssl-ocspserve@debmonitor].orig
+++ Service[cfssl-ocspserve@debmonitor]

-    enable => True
-    ensure => running

Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-cassandra" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-cassandra/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Nrpe::Monitor_service[check_certificate_expiry_debmonitor]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_debmonitor].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_debmonitor]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: debmonitor
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    ensure => present

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-discovery-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Logrotate::Conf[wmf_auto_restart_apache2]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_apache2].orig
+++ Logrotate::Conf[wmf_auto_restart_apache2]

-    ensure => present

Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Rsyslog::Conf[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-discovery].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-discovery]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-discovery]

Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (aux_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20051 \
-          -responses /etc/cfssl/ocsp/aux_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-cloud_wmnet_ca-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-wikikube_staging_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-wikikube_staging_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/apache2/sites-available]

Parameters differences:

--- File[/etc/apache2/sites-available].orig
+++ File[/etc/apache2/sites-available]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0755
-    require => Package[apache2]

File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "72h",
-      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl]

Parameters differences:

--- File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl].orig
+++ File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl]

@@
-    ensure => present
+    ensure => absent

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Systemd::Unit[cfssl-ocspserve@zuul]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@zuul].orig
+++ Systemd::Unit[cfssl-ocspserve@zuul]

-    unit              => cfssl-ocspserve@zuul
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Systemd::Service[cfssl-ocspserve@wikikube_staging]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@wikikube_staging].orig
+++ Systemd::Service[cfssl-ocspserve@wikikube_staging]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Exec[Generate initial CRL for wikikube_staging]

Parameters differences:

--- Exec[Generate initial CRL for wikikube_staging].orig
+++ Exec[Generate initial CRL for wikikube_staging]

-    creates => /srv/cfssl/crl/wikikube_staging
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_staging
-    require => ['Package[golang-cfssl]']

Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Logrotate::Conf[prometheus-node-textfile-check-nft]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-check-nft].orig
+++ Logrotate::Conf[prometheus-node-textfile-check-nft]

+    ensure => present

File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-puppet_rsa" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-puppet_rsa/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_cassandra!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: cassandra
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-network_devices-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom

Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_puppet_rsa command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_puppet_rsa
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "c1b324b3d8ac107f8d7483b4017f5edf" --timeout 10 --check-command "check_check_certificate_expiry_puppet_rsa"

File[/srv/cfssl/bundles/aux_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/aux_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/aux_front_proxy.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/aux_front_proxy.pem.orig
+++ /srv/cfssl/bundles/aux_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
-9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
-pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
-ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
-HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
------END CERTIFICATE-----

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/var/log/cfssl-ocsprefresh-network_devices]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-network_devices].orig
+++ File[/var/log/cfssl-ocsprefresh-network_devices]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Cfssl::Config[aux_front_proxy]

Parameters differences:

--- Cfssl::Config[aux_front_proxy].orig
+++ Cfssl::Config[aux_front_proxy]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/aux_front_proxy
-    path                => /etc/cfssl/signers/aux_front_proxy/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/aux_front_proxy

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_staging_front_proxy-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft
@@ -0,0 +1,189 @@
+# Autogenerated by puppet
+set DOMAIN_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.128.0.0/24,
+             10.128.1.0/24,
+             10.128.2.0/24,
+             10.132.0.0/24,
+             10.132.2.0/24,
+             10.136.0.0/24,
+             10.136.1.0/24,
+             10.140.0.0/24,
+             10.140.1.0/24,
+             10.140.2.0/24,
+             10.192.0.0/22,
+             10.192.10.0/24,
+             10.192.11.0/24,
+             10.192.12.0/24,
+             10.192.13.0/24,
+             10.192.14.0/24,
+             10.192.15.0/24,
+             10.192.16.0/22,
+             10.192.20.0/24,
+             10.192.21.0/24,
+             10.192.22.0/24,
+             10.192.23.0/24,
+             10.192.24.0/23,
+             10.192.26.0/24,
+             10.192.27.0/24,
+             10.192.28.0/24,
+             10.192.29.0/24,
+             10.192.30.0/24,
+             10.192.31.0/24,
+             10.192.32.0/22,
+             10.192.36.0/24,
+             10.192.37.0/24,
+             10.192.38.0/24,
+             10.192.39.0/24,
+             10.192.4.0/24,
+             10.192.40.0/24,
+             10.192.41.0/24,
+             10.192.42.0/24,
+             10.192.43.0/24,
+             10.192.44.0/24,
+             10.192.45.0/24,
+             10.192.46.0/24,
+             10.192.47.0/24,
+             10.192.48.0/22,
+             10.192.5.0/24,
+             10.192.52.0/24,
+             10.192.56.0/24,
+             10.192.57.0/24,
+             10.192.58.0/24,
+             10.192.59.0/24,
+             10.192.6.0/24,
+             10.192.64.0/21,
+             10.192.7.0/24,
+             10.192.72.0/24,
+             10.192.76.0/24,
+             10.192.8.0/24,
+             10.192.80.0/20,
+             10.192.9.0/24,
+             10.192.96.0/21,
+             10.194.0.0/20,
+             10.194.128.0/17,
+             10.194.16.0/21,
+             10.194.61.0/24,
+             10.194.62.0/23,
+             10.194.64.0/20,
+             10.194.80.0/21,
+             10.2.1.0/24,
+             10.2.2.0/24,
+             10.2.3.0/24,
+             10.2.4.0/24,
+             10.2.5.0/24,
+             10.2.6.0/24,
+             10.2.7.0/24,
+             10.64.0.0/22,
+             10.64.130.0/24,
+             10.64.131.0/24,
+             10.64.132.0/24,
+             10.64.133.0/24,
+             10.64.134.0/24,
+             10.64.135.0/24,
+             10.64.136.0/24,
+             10.64.137.0/24,
+             10.64.138.0/24,
+             10.64.139.0/24,
+             10.64.140.0/24,
+             10.64.141.0/24,
+             10.64.142.0/24,
+             10.64.143.0/24,
+             10.64.144.0/24,
+             10.64.145.0/24,
+             10.64.148.0/24,
+             10.64.149.0/24,
+             10.64.150.0/24,
+             10.64.151.0/24,
+             10.64.152.0/24,
+             10.64.153.0/24,
+             10.64.154.0/24,
+             10.64.155.0/24,
+             10.64.156.0/24,
+             10.64.157.0/24,
+             10.64.158.0/24,
+             10.64.159.0/24,
+             10.64.16.0/22,
+             10.64.160.0/24,
+             10.64.161.0/24,
+             10.64.162.0/24,
+             10.64.163.0/24,
+             10.64.164.0/24,
+             10.64.165.0/24,
+             10.64.166.0/24,
+             10.64.167.0/24,
+             10.64.169.0/24,
+             10.64.170.0/24,
+             10.64.171.0/24,
+             10.64.172.0/24,
+             10.64.173.0/24,
+             10.64.174.0/24,
+             10.64.175.0/24,
+             10.64.176.0/24,
+             10.64.177.0/24,
+             10.64.178.0/24,
+             10.64.179.0/24,
+             10.64.180.0/24,
+             10.64.181.0/24,
+             10.64.182.0/24,
+             10.64.183.0/24,
+             10.64.184.0/24,
+             10.64.185.0/24,
+             10.64.186.0/24,
+             10.64.187.0/24,
+             10.64.188.0/24,
+             10.64.189.0/24,
+             10.64.190.0/24,
+             10.64.20.0/24,
+             10.64.21.0/24,
+             10.64.24.0/23,
+             10.64.32.0/22,
+             10.64.36.0/24,
+             10.64.48.0/22,
+             10.64.5.0/24,
+             10.64.53.0/24,
+             10.64.64.0/21,
+             10.64.72.0/24,
+             10.64.76.0/24,
+             10.67.0.0/20,
+             10.67.128.0/17,
+             10.67.16.0/21,
+             10.67.24.0/21,
+             10.67.32.0/20,
+             10.67.64.0/20,
+             10.67.80.0/21,
+             10.80.0.0/24,
+             10.80.1.0/24,
+             10.80.2.0/24,
+             103.102.166.0/28,
+             103.102.166.224/27,
+             103.102.166.96/27,
+             185.15.58.0/27,
+             185.15.58.224/27,
+             185.15.58.32/27,
+             185.15.59.0/27,
+             185.15.59.224/27,
+             185.15.59.32/27,
+             185.15.59.96/27,
+             195.200.68.0/27,
+             195.200.68.224/27,
+             195.200.68.32/27,
+             195.200.68.96/27,
+             198.35.26.0/27,
+             198.35.26.32/27,
+             198.35.26.96/27,
+             208.80.152.128/27,
+             208.80.153.0/27,
+             208.80.153.224/27,
+             208.80.153.32/27,
+             208.80.153.64/27,
+             208.80.153.96/27,
+             208.80.154.0/26,
+             208.80.154.128/26,
+             208.80.154.224/27,
+             208.80.154.64/26,
+             208.80.155.96/27
+    }
+}

File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Sudo::User[nrpe_certificate_check_puppet_rsa]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_puppet_rsa].orig
+++ Sudo::User[nrpe_certificate_check_puppet_rsa]

-    user       => nrpe_certificate_check_puppet_rsa
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]

File[/etc/cfssl/multiroot.conf]

Parameters differences:

--- File[/etc/cfssl/multiroot.conf].orig
+++ File[/etc/cfssl/multiroot.conf]

-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]
-    ensure => present

Content differences:

--- /etc/cfssl/multiroot.conf.orig
+++ /etc/cfssl/multiroot.conf
@@ -1,138 +0,0 @@
-[debmonitor]
-private = file:///etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
-certificate = /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-config = /etc/cfssl/signers/debmonitor/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[discovery]
-private = file:///etc/cfssl/signers/discovery/ca/discovery-key.pem
-certificate = /etc/cfssl/signers/discovery/ca/discovery.pem
-config = /etc/cfssl/signers/discovery/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[kafka]
-private = file:///etc/cfssl/signers/kafka/ca/kafka-key.pem
-certificate = /etc/cfssl/signers/kafka/ca/kafka.pem
-config = /etc/cfssl/signers/kafka/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[cloud_wmnet_ca]
-private = file:///etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
-certificate = /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-config = /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[etcd]
-private = file:///etc/cfssl/signers/etcd/ca/etcd-key.pem
-certificate = /etc/cfssl/signers/etcd/ca/etcd.pem
-config = /etc/cfssl/signers/etcd/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[cassandra]
-private = file:///etc/cfssl/signers/cassandra/ca/cassandra-key.pem
-certificate = /etc/cfssl/signers/cassandra/ca/cassandra.pem
-config = /etc/cfssl/signers/cassandra/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[syslog]
-private = file:///etc/cfssl/signers/syslog/ca/syslog-key.pem
-certificate = /etc/cfssl/signers/syslog/ca/syslog.pem
-config = /etc/cfssl/signers/syslog/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[puppet_rsa]
-private = file:///etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
-certificate = /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-config = /etc/cfssl/signers/puppet_rsa/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[zuul]
-private = file:///etc/cfssl/signers/zuul/ca/zuul-key.pem
-certificate = /etc/cfssl/signers/zuul/ca/zuul.pem
-config = /etc/cfssl/signers/zuul/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[discovery2026]
-private = file:///etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
-certificate = /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-config = /etc/cfssl/signers/discovery2026/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[wikikube]
-private = file:///etc/cfssl/signers/wikikube/ca/wikikube-key.pem
-certificate = /etc/cfssl/signers/wikikube/ca/wikikube.pem
-config = /etc/cfssl/signers/wikikube/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[wikikube_front_proxy]
-private = file:///etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
-certificate = /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-config = /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[wikikube_staging]
-private = file:///etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
-certificate = /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-config = /etc/cfssl/signers/wikikube_staging/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[wikikube_staging_front_proxy]
-private = file:///etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
-certificate = /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-config = /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[mlserve]
-private = file:///etc/cfssl/signers/mlserve/ca/mlserve-key.pem
-certificate = /etc/cfssl/signers/mlserve/ca/mlserve.pem
-config = /etc/cfssl/signers/mlserve/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[mlserve_front_proxy]
-private = file:///etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
-certificate = /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-config = /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[mlserve_staging]
-private = file:///etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
-certificate = /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-config = /etc/cfssl/signers/mlserve_staging/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[mlserve_staging_front_proxy]
-private = file:///etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
-certificate = /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-config = /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[aux]
-private = file:///etc/cfssl/signers/aux/ca/aux-key.pem
-certificate = /etc/cfssl/signers/aux/ca/aux.pem
-config = /etc/cfssl/signers/aux/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[aux_front_proxy]
-private = file:///etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
-certificate = /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-config = /etc/cfssl/signers/aux_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[dse]
-private = file:///etc/cfssl/signers/dse/ca/dse-key.pem
-certificate = /etc/cfssl/signers/dse/ca/dse.pem
-config = /etc/cfssl/signers/dse/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[dse_front_proxy]
-private = file:///etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem
-certificate = /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-config = /etc/cfssl/signers/dse_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[network_devices]
-private = file:///etc/cfssl/signers/network_devices/ca/network_devices-key.pem
-certificate = /etc/cfssl/signers/network_devices/ca/network_devices.pem
-config = /etc/cfssl/signers/network_devices/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-

Cfssl::Signer[wikikube_front_proxy]

Parameters differences:

--- Cfssl::Signer[wikikube_front_proxy].orig
+++ Cfssl::Signer[wikikube_front_proxy]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_front_proxy
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_front_proxy
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => test

Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]

-    unit              => cfssl-ocsprefresh-wikikube_front_proxy.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]

-    before      => ['Service[cfssl-gc-expired-certs.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_network_devices
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "21dac3775d059b8c991626e2ca33f951" --timeout 10 --check-command "check_check_certificate_expiry_network_devices"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_network_devices command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-mlserve_staging_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Cfssl::Signer[discovery2026]

Parameters differences:

--- Cfssl::Signer[discovery2026].orig
+++ Cfssl::Signer[discovery2026]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
-----END CERTIFICATE-----
-    ca_file          => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/discovery2026
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/discovery2026
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => ##### FAKE FOR PUPPET ######

Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Class[Httpd]

Parameters differences:

--- Class[Httpd].orig
+++ Class[Httpd]

-    enable_forensic_log  => False
-    wait_network_online  => False
-    legacy_compat        => present
-    http_only            => False
-    purge_manual_config  => True
-    remove_default_ports => False
-    modules              => ['proxy_http', 'ssl', 'headers']
-    rotate               => 30
-    period               => daily
-    extra_pkgs           => []

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean].orig
+++ Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    require                   => File[/usr/local/sbin/wmf-auto-restart]
-    success_exit_status       => []
-    command                   => /usr/local/sbin/wmf-auto-restart -s apache-htcacheclean
-    description               => Auto restart job: apache-htcacheclean
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Profile::Pki::Multirootca::Monitoring[wikikube]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[wikikube].orig
+++ Profile::Pki::Multirootca::Monitoring[wikikube]

-    ca_file      => /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => wikikube

Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging_front_proxy' wikikube_staging_front_proxy 
-    description               => OCSP Refresh job - wikikube_staging_front_proxy
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_cassandra
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f5e260f525c48c963fb2e6c86a0d5d63" --timeout 10 --check-command "check_check_certificate_expiry_cassandra"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_cassandra command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Service[apache2]

Parameters differences:

--- Service[apache2].orig
+++ Service[apache2]

-    before     => ['Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]']
-    enable     => True
-    ensure     => running
-    restart    => systemctl reload apache2
-    hasrestart => True
-    require    => Package[apache2]

File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-puppet_rsa
-
-/var/log/cfssl-ocsprefresh-puppet_rsa/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-cassandra.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-cassandra
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-cassandra
-
-/var/log/cfssl-ocsprefresh-cassandra/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: etcd
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__etcd
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="c834f873297e445663ead81279c0b928",check_name="check_check_certificate_expiry_etcd", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: etcd
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_etcd))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf.orig
+++ /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/cloud_wmnet_ca",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-kafka].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-kafka.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-kafka
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-kafka
-
-/var/log/cfssl-ocsprefresh-kafka/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    ensure => present

Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

-    unit              => cfssl-ocsprefresh-cloud_wmnet_ca.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Service[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-zuul].orig
+++ Systemd::Service[cfssl-ocsprefresh-zuul]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-zuul.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_staging_front_proxy!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/cfssl/signers/zuul]

Parameters differences:

--- File[/etc/cfssl/signers/zuul].orig
+++ File[/etc/cfssl/signers/zuul]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-etcd].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-etcd.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-etcd
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-etcd
-
-/var/log/cfssl-ocsprefresh-etcd/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Config[kafka]

Parameters differences:

--- Cfssl::Config[kafka].orig
+++ Cfssl::Config[kafka]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/kafka
-    path                => /etc/cfssl/signers/kafka/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'kafka_11': {'expiry': '8760h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/kafka

Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

File[/etc/apache2/sites-enabled]

Parameters differences:

--- File[/etc/apache2/sites-enabled].orig
+++ File[/etc/apache2/sites-enabled]

-    owner   => root
-    group   => root
-    mode    => 0755
-    require => Package[apache2]
-    recurse => True
-    purge   => True
-    notify  => Service[apache2]
-    ensure  => directory

Nftables::Set[INSTALL_HOSTS]

Parameters differences:

--- Nftables::Set[INSTALL_HOSTS].orig
+++ Nftables::Set[INSTALL_HOSTS]

+    hosts  => ['208.80.154.134', '208.80.153.70', '185.15.59.101', '198.35.26.98', '103.102.166.11', '185.15.58.7', '195.200.68.100', '2620:0:861:2:208:80:154:134', '2620:0:860:3:208:80:153:70', '2a02:ec80:300:3:185:15:59:101', '2620:0:863:3:198:35:26:98', '2001:df2:e500:1:103:102:166:11', '2a02:ec80:600:1:185:15:58:7', '2a02:ec80:700:3:195:200:68:100']
+    ensure => present

Nrpe::Monitor_service[check_certificate_expiry_dse]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_dse].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_dse]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: dse
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Logrotate::Conf[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-etcd].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-etcd]

-    ensure => present

Nftables::Service[full-monitoring-metrics-access-tcp]

Parameters differences:

--- Nftables::Service[full-monitoring-metrics-access-tcp].orig
+++ Nftables::Service[full-monitoring-metrics-access-tcp]

+    unrestricted_access => False
+    port_range          => [1, 65535]
+    prio                => 10
+    desc                => 
+    proto               => tcp
+    src_ips             => ['10.64.0.82', '10.64.16.62', '10.64.32.85', '10.64.48.171', '208.80.153.42', '208.80.154.78', '2620:0:860:2:208:80:153:42', '2620:0:861:101:10:64:0:82', '2620:0:861:102:10:64:16:62', '2620:0:861:103:10:64:32:85', '2620:0:861:107:10:64:48:171', '2620:0:861:3:208:80:154:78']
+    notrack             => False
+    ensure              => present

Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]

-    before      => ['Service[cfssl-ocsprefresh-discovery2026.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_debmonitor
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "224e2ac3574a9ce482218106d95a2931" --timeout 10 --check-command "check_check_certificate_expiry_debmonitor"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_debmonitor command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/srv/cfssl/bundles/etcd.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/etcd.pem].orig
+++ File[/srv/cfssl/bundles/etcd.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/etcd.pem.orig
+++ /srv/cfssl/bundles/etcd.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
-7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
-ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
-N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
-Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
-ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
-KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
-bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
-P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
-SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
-4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
-jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
-UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
------END CERTIFICATE-----

File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft.orig
+++ /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft
@@ -0,0 +1,4 @@
+# Autogenerated by puppet
+set MYSQL_ROOT_CLIENTS_ipv6 {
+    type ipv6_addr
+}

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - mlserve_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_front_proxy' mlserve_front_proxy

File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_wikikube!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: wikikube
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Cfssl::Config[mlserve_staging]

Parameters differences:

--- Cfssl::Config[mlserve_staging].orig
+++ Cfssl::Config[mlserve_staging]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_staging
-    path                => /etc/cfssl/signers/mlserve_staging/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 72h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_staging

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_debmonitor command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_debmonitor
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "224e2ac3574a9ce482218106d95a2931" --timeout 10 --check-command "check_check_certificate_expiry_debmonitor"

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocsprefresh-mlserve.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-mlserve.timer].orig
+++ Service[cfssl-ocsprefresh-mlserve.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[Generate initial CRL for wikikube_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for wikikube_front_proxy].orig
+++ Exec[Generate initial CRL for wikikube_front_proxy]

-    creates => /srv/cfssl/crl/wikikube_front_proxy
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_front_proxy
-    require => ['Package[golang-cfssl]']

Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@zuul]']

Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS]

Parameters differences:

--- Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS].orig
+++ Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS]

+    hosts  => ['10.67.128.0/17', '2620:0:861:cabe::/64', '10.194.128.0/17', '2620:0:860:cabe::/64']
+    ensure => present

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_dse_front_proxy!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: dse_front_proxy
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Httpd::Mod_conf[access_compat]

Parameters differences:

--- Httpd::Mod_conf[access_compat].orig
+++ Httpd::Mod_conf[access_compat]

-    mod      => access_compat
-    loadfile => access_compat.load
-    ensure   => present

File[/etc/ferm/conf.d/98_filter_log_filter-bootp]

Parameters differences:

--- File[/etc/ferm/conf.d/98_filter_log_filter-bootp].orig
+++ File[/etc/ferm/conf.d/98_filter_log_filter-bootp]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/98_filter_log_filter-bootp.orig
+++ /etc/ferm/conf.d/98_filter_log_filter-bootp
@@ -1,11 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 98_filter_log_filter-bootp: 
-
-domain (ip ip6) {
-	table filter {
-		chain INPUT {
-			proto udp  daddr 255.255.255.255 sport 67 dport 68 DROP;
-		}
-	}
-}

Sudo::User[nrpe-check_check_certificate_expiry_mlserve]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_mlserve].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Sudo::User[nrpe_certificate_check_aux_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_aux_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_aux_front_proxy]

-    user       => nrpe_certificate_check_aux_front_proxy
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Exec[Generate initial CRL for dse]

Parameters differences:

--- Exec[Generate initial CRL for dse].orig
+++ Exec[Generate initial CRL for dse]

-    creates => /srv/cfssl/crl/dse
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/dse/ca/dse.pem /etc/cfssl/signers/dse/ca/dse-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/dse
-    require => ['Package[golang-cfssl]']

Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Systemd::Unit[cfssl-ocsprefresh-network_devices.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-network_devices.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-network_devices.service]

-    unit              => cfssl-ocsprefresh-network_devices.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/cfssl-ocspserve@kafka.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@kafka.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@kafka.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@kafka.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@kafka.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (kafka)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10003 \
-          -responses /etc/cfssl/ocsp/kafka.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[cfssl-ocspserve@mlserve]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@mlserve].orig
+++ Systemd::Service[cfssl-ocspserve@mlserve]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-wikikube_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[Generate initial CRL for mlserve_staging]

Parameters differences:

--- Exec[Generate initial CRL for mlserve_staging].orig
+++ Exec[Generate initial CRL for mlserve_staging]

-    creates => /srv/cfssl/crl/mlserve_staging
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_staging
-    require => ['Package[golang-cfssl]']

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-mlserve.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-mlserve.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[cfssl-gc-expired-certs.timer]

Parameters differences:

--- Systemd::Unit[cfssl-gc-expired-certs.timer].orig
+++ Systemd::Unit[cfssl-gc-expired-certs.timer]

-    unit              => cfssl-gc-expired-certs.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/sudoers.d/nrpe_certificate_check_aux]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_aux].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_aux]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Timer[wmf_auto_restart_ulogd2]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_ulogd2].orig
+++ Systemd::Timer[wmf_auto_restart_ulogd2]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => wmf_auto_restart_ulogd2.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 5:37:00'}]

File[/etc/cfssl/signers/zuul/ca/zuul.pem]

Parameters differences:

--- File[/etc/cfssl/signers/zuul/ca/zuul.pem].orig
+++ File[/etc/cfssl/signers/zuul/ca/zuul.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/zuul/ca/zuul.pem.orig
+++ /etc/cfssl/signers/zuul/ca/zuul.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
-dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
-g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
-g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
-Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
-jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
-KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
-bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
-P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
-SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
-HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
-atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
-XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
------END CERTIFICATE-----

File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-discovery].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-discovery.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-discovery
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-discovery
-
-/var/log/cfssl-ocsprefresh-discovery/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Httpd::Mod_conf[headers]

Parameters differences:

--- Httpd::Mod_conf[headers].orig
+++ Httpd::Mod_conf[headers]

-    mod      => headers
-    loadfile => headers.load
-    ensure   => present

File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
@@ -1 +0,0 @@
-nosecret

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-mlserve_staging-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom

File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-cloud_wmnet_ca.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-cloud_wmnet_ca.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Class[Profile::Firewall::Log::Ferm]

Parameters differences:

--- Class[Profile::Firewall::Log::Ferm].orig
+++ Class[Profile::Firewall::Log::Ferm]

-    separate_file => True
-    log_rate      => 1/second
-    log_burst     => 5

File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]

-    group  => root
-    ensure => absent
-    owner  => root

File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/cloud_wmnet_ca.pem].orig
+++ File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/cloud_wmnet_ca.pem.orig
+++ /srv/cfssl/bundles/cloud_wmnet_ca.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
-IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
-33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
-SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
-AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
-FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
-kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
-aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
-BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
-V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
-XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
-RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
-/LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
------END CERTIFICATE-----

Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer]

-    notify => Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/wmf_auto_restart_ulogd2.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_ulogd2.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of wmf_auto_restart_ulogd2.service
-
-[Timer]
-Unit=wmf_auto_restart_ulogd2.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 5:37:00
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_staging
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="7cff186656c3cabbca85b5b57d0c8679",check_name="check_check_certificate_expiry_mlserve_staging", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_staging))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]

-    before      => ['Service[cfssl-ocsprefresh-mlserve_staging.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/log/cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-puppet_rsa].orig
+++ File[/var/log/cfssl-ocsprefresh-puppet_rsa]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_staging!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: mlserve_staging
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/srv/cfssl/bundles/dse.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/dse.pem].orig
+++ File[/srv/cfssl/bundles/dse.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/dse.pem.orig
+++ /srv/cfssl/bundles/dse.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
-rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
-apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
-Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
-/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
-wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
-BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
-bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
-oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
-bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
-JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
-Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
-pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
------END CERTIFICATE-----

Nftables::Service[ssh-from-cumin-masters]

Parameters differences:

--- Nftables::Service[ssh-from-cumin-masters].orig
+++ Nftables::Service[ssh-from-cumin-masters]

+    src_sets            => ['CUMIN_MASTERS']
+    unrestricted_access => False
+    prio                => 10
+    desc                => 
+    proto               => tcp
+    notrack             => False
+    ensure              => present
+    port                => 22

Alternatives::Select[iptables]

Parameters differences:

--- Alternatives::Select[iptables].orig
+++ Alternatives::Select[iptables]

-    path    => /usr/sbin/iptables-legacy
-    require => Package[iptables]

Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Cfssl::Ocsp[etcd]

Parameters differences:

--- Cfssl::Ocsp[etcd].orig
+++ Cfssl::Ocsp[etcd]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/etcd/ca/etcd.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10005
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft].orig
+++ File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft.orig
+++ /etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft
@@ -0,0 +1,14 @@
+# Autogenerated by puppet
+set KAFKA_BROKERS_JUMBO_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:109:10:64:130:10,
+             2620:0:861:10a:10:64:131:16,
+             2620:0:861:10b:10:64:132:21,
+             2620:0:861:10d:10:64:134:9,
+             2620:0:861:10e:10:64:135:16,
+             2620:0:861:10f:10:64:136:11,
+             2620:0:861:122:10:64:154:15,
+             2620:0:861:128:10:64:160:16,
+             2620:0:861:101:10:64:0:126
+    }
+}

File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set LABSTORE_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:2:208:80:154:142,
+             2620:0:861:3:208:80:154:71
+    }
+}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocspserve@kafka]

Parameters differences:

--- Service[cfssl-ocspserve@kafka].orig
+++ Service[cfssl-ocspserve@kafka]

-    enable => True
-    ensure => running

File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft
@@ -0,0 +1,12 @@
+# Autogenerated by puppet
+set CLOUD_PRIVATE_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2a02:ec80:a000:201::/64,
+             2a02:ec80:a000:202::/64,
+             2a02:ec80:a000:203::/64,
+             2a02:ec80:a000:204::/64,
+             2a02:ec80:a100:205::/64
+    }
+}

Nrpe::Monitor_service[check_certificate_expiry_discovery]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_discovery].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_discovery]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: discovery
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --responses-file /etc/cfssl/ocsp/puppet_rsa.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@puppet_rsa' puppet_rsa 
-    description               => OCSP Refresh job - puppet_rsa
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Cfssl::Config[debmonitor]

Parameters differences:

--- Cfssl::Config[debmonitor].orig
+++ Cfssl::Config[debmonitor]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/debmonitor
-    path                => /etc/cfssl/signers/debmonitor/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/debmonitor

Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_dse
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "4384c5ebc49e03dbe331e279fac3f393" --timeout 10 --check-command "check_check_certificate_expiry_dse"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_dse command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/etc/logrotate.d/prometheus-node-textfile-check-nft]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-check-nft].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-check-nft]

+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-check-nft.orig
+++ /etc/logrotate.d/prometheus-node-textfile-check-nft
@@ -0,0 +1,12 @@
+# logrotate(8) config for prometheus-node-textfile-check-nft
+
+/var/log/prometheus-node-textfile-check-nft/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Config[aux]

Parameters differences:

--- Cfssl::Config[aux].orig
+++ Cfssl::Config[aux]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/aux
-    path                => /etc/cfssl/signers/aux/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/aux

Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_zuul.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_mlserve_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_front_proxy!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__cloud_wmnet_ca
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="f87f54115f2f782169eed72541c30a1e",check_name="check_check_certificate_expiry_cloud_wmnet_ca", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_cloud_wmnet_ca))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Cfssl::Signer[mlserve_staging_front_proxy]

Parameters differences:

--- Cfssl::Signer[mlserve_staging_front_proxy].orig
+++ Cfssl::Signer[mlserve_staging_front_proxy]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
/wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
sBI=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 72h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_cassandra.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-aux-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[cfssl-ocsprefresh-aux.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-aux.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-aux.timer]

-    unit              => cfssl-ocsprefresh-aux.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]

-    unit              => cfssl-ocsprefresh-cloud_wmnet_ca.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]

File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Class[Profile::Firewall::Nftables_base_sets]

Parameters differences:

--- Class[Profile::Firewall::Nftables_base_sets].orig
+++ Class[Profile::Firewall::Nftables_base_sets]

+    kafka_brokers_logging => ['10.64.16.205', '2620:0:861:102:10:64:16:205', '10.64.133.11', '2620:0:861:10c:10:64:133:11', '10.64.183.12', '2620:0:861:13d:10:64:183:12', '10.64.131.13', '2620:0:861:10a:10:64:131:13', '10.64.135.13', '2620:0:861:10e:10:64:135:13', '10.192.23.29', '2620:0:860:113:10:192:23:29', '10.192.11.28', '2620:0:860:10c:10:192:11:28', '10.192.26.22', '2620:0:860:105:10:192:26:22', '10.192.11.27', '2620:0:860:10c:10:192:11:27', '10.192.39.25', '2620:0:860:11e:10:192:39:25']
+    bastion_hosts         => ['208.80.154.7', '2620:0:861:1:208:80:154:7', '208.80.153.110', '2a02:ec80:300:3:185:15:59:99', '185.15.59.99', '2620:0:860:4:208:80:153:110', '198.35.26.104', '2620:0:863:3:198:35:26:104', '103.102.166.103', '2001:df2:e500:3:103:102:166:103', '185.15.58.6', '2a02:ec80:600:1:185:15:58:6', '195.200.68.99', '2a02:ec80:700:3:195:200:68:99']
+    mysql_root_clients    => ['10.64.16.90', '10.192.16.191', '10.64.16.154', '10.192.32.49', '208.80.155.103', '208.80.154.9', '10.64.0.20']
+    install_hosts         => {'eqiad': '208.80.154.134', 'codfw': '208.80.153.70', 'esams': '185.15.59.101', 'ulsfo': '198.35.26.98', 'eqsin': '103.102.166.11', 'drmrs': '185.15.58.7', 'magru': '195.200.68.100'}
+    cache_hosts           => ['10.64.0.79', '2620:0:861:101:10:64:0:79', '10.64.0.229', '2620:0:861:101:10:64:0:229', '10.64.0.14', '2620:0:861:101:10:64:0:14', '10.64.0.51', '2620:0:861:101:10:64:0:51', '10.64.16.241', '2620:0:861:102:10:64:16:241', '10.64.16.94', '2620:0:861:102:10:64:16:94', '10.64.16.95', '2620:0:861:102:10:64:16:95', '10.64.16.240', '2620:0:861:102:10:64:16:240', '10.64.32.14', '2620:0:861:103:10:64:32:14', '10.64.32.60', '2620:0:861:103:10:64:32:60', '10.64.32.15', '2620:0:861:103:10:64:32:15', '10.64.32.65', '2620:0:861:103:10:64:32:65', '10.64.48.16', '2620:0:861:107:10:64:48:16', '10.64.48.41', '2620:0:861:107:10:64:48:41', '10.64.48.27', '2620:0:861:107:10:64:48:27', '10.64.48.28', '2620:0:861:107:10:64:48:28', '10.192.23.26', '2620:0:860:113:10:192:23:26', '10.192.6.20', '2620:0:860:107:10:192:6:20', '10.192.12.35', '2620:0:860:10d:10:192:12:35', '10.192.14.25', '2620:0:860:10f:10:192:14:25', '10.192.4.22', '2620:0:860:100:10:192:4:22', '10.192.29.26', '2620:0:860:116:10:192:29:26', '10.192.30.29', '2620:0:860:119:10:192:30:29', '10.192.36.19', '2620:0:860:11b:10:192:36:19', '10.192.40.25', '2620:0:860:11f:10:192:40:25', '10.192.41.21', '2620:0:860:120:10:192:41:21', '10.192.56.3', '2620:0:860:12b:10:192:56:3', '10.192.56.4', '2620:0:860:12b:10:192:56:4', '10.192.57.3', '2620:0:860:12c:10:192:57:3', '10.192.58.2', '2620:0:860:12d:10:192:58:2', '10.192.58.3', '2620:0:860:12d:10:192:58:3', '10.192.59.2', '2620:0:860:12e:10:192:59:2', '10.80.0.14', '2a02:ec80:300:101:10:80:0:14', '10.80.1.11', '2a02:ec80:300:102:10:80:1:11', '10.80.0.13', '2a02:ec80:300:101:10:80:0:13', '10.80.1.9', '2a02:ec80:300:102:10:80:1:9', '10.80.0.12', '2a02:ec80:300:101:10:80:0:12', '10.80.1.7', '2a02:ec80:300:102:10:80:1:7', '10.80.0.11', '2a02:ec80:300:101:10:80:0:11', '10.80.1.6', '2a02:ec80:300:102:10:80:1:6', '10.80.0.10', '2a02:ec80:300:101:10:80:0:10', '10.80.1.5', '2a02:ec80:300:102:10:80:1:5', '10.80.0.8', '2a02:ec80:300:101:10:80:0:8', '10.80.1.4', '2a02:ec80:300:102:10:80:1:4', '10.80.0.7', '2a02:ec80:300:101:10:80:0:7', '10.80.1.3', '2a02:ec80:300:102:10:80:1:3', '10.80.0.6', '2a02:ec80:300:101:10:80:0:6', '10.80.1.2', '2a02:ec80:300:102:10:80:1:2', '10.128.0.19', '2620:0:863:101:10:128:0:19', '10.128.0.27', '2620:0:863:101:10:128:0:27', '10.128.0.22', '2620:0:863:101:10:128:0:22', '10.128.0.28', '2620:0:863:101:10:128:0:28', '10.128.0.25', '2620:0:863:101:10:128:0:25', '10.128.0.29', '2620:0:863:101:10:128:0:29', '10.128.0.26', '2620:0:863:101:10:128:0:26', '10.128.0.31', '2620:0:863:101:10:128:0:31', '10.128.0.14', '2620:0:863:101:10:128:0:14', '10.128.0.35', '2620:0:863:101:10:128:0:35', '10.128.0.21', '2620:0:863:101:10:128:0:21', '10.128.0.36', '2620:0:863:101:10:128:0:36', '10.128.0.24', '2620:0:863:101:10:128:0:24', '10.128.0.10', '2620:0:863:101:10:128:0:10', '10.128.0.37', '2620:0:863:101:10:128:0:37', '10.128.0.12', '2620:0:863:101:10:128:0:12', '10.132.0.17', '2001:df2:e500:101:10:132:0:17', '10.132.0.18', '2001:df2:e500:101:10:132:0:18', '10.132.0.19', '2001:df2:e500:101:10:132:0:19', '10.132.0.24', '2001:df2:e500:101:10:132:0:24', '10.132.0.29', '2001:df2:e500:101:10:132:0:29', '10.132.0.30', '2001:df2:e500:101:10:132:0:30', '10.132.0.34', '2001:df2:e500:101:10:132:0:34', '10.132.0.35', '2001:df2:e500:101:10:132:0:35', '10.132.0.36', '2001:df2:e500:101:10:132:0:36', '10.132.0.37', '2001:df2:e500:101:10:132:0:37', '10.132.0.38', '2001:df2:e500:101:10:132:0:38', '10.132.0.25', '2001:df2:e500:101:10:132:0:25', '10.132.0.26', '2001:df2:e500:101:10:132:0:26', '10.132.0.27', '2001:df2:e500:101:10:132:0:27', '10.132.0.28', '2001:df2:e500:101:10:132:0:28', '10.132.0.16', '2001:df2:e500:101:10:132:0:16', '10.136.0.6', '2a02:ec80:600:101:10:136:0:6', '10.136.1.6', '2a02:ec80:600:102:10:136:1:6', '10.136.0.7', '2a02:ec80:600:101:10:136:0:7', '10.136.1.7', '2a02:ec80:600:102:10:136:1:7', '10.136.0.8', '2a02:ec80:600:101:10:136:0:8', '10.136.1.8', '2a02:ec80:600:102:10:136:1:8', '10.136.0.9', '2a02:ec80:600:101:10:136:0:9', '10.136.1.9', '2a02:ec80:600:102:10:136:1:9', '10.136.0.10', '2a02:ec80:600:101:10:136:0:10', '10.136.1.10', '2a02:ec80:600:102:10:136:1:10', '10.136.0.11', '2a02:ec80:600:101:10:136:0:11', '10.136.1.11', '2a02:ec80:600:102:10:136:1:11', '10.136.0.12', '2a02:ec80:600:101:10:136:0:12', '10.136.1.12', '2a02:ec80:600:102:10:136:1:12', '10.136.0.13', '2a02:ec80:600:101:10:136:0:13', '10.136.1.13', '2a02:ec80:600:102:10:136:1:13', '10.140.0.3', '2a02:ec80:700:101:10:140:0:3', '10.140.1.4', '2a02:ec80:700:102:10:140:1:4', '10.140.0.4', '2a02:ec80:700:101:10:140:0:4', '10.140.1.5', '2a02:ec80:700:102:10:140:1:5', '10.140.0.5', '2a02:ec80:700:101:10:140:0:5', '10.140.1.6', '2a02:ec80:700:102:10:140:1:6', '10.140.0.6', '2a02:ec80:700:101:10:140:0:6', '10.140.1.7', '2a02:ec80:700:102:10:140:1:7', '10.140.0.7', '2a02:ec80:700:101:10:140:0:7', '10.140.1.8', '2a02:ec80:700:102:10:140:1:8', '10.140.0.8', '2a02:ec80:700:101:10:140:0:8', '10.140.1.9', '2a02:ec80:700:102:10:140:1:9', '10.140.0.9', '2a02:ec80:700:101:10:140:0:9', '10.140.1.10', '2a02:ec80:700:102:10:140:1:10', '10.140.0.10', '2a02:ec80:700:101:10:140:0:10', '10.140.1.11', '2a02:ec80:700:102:10:140:1:11']
+    install_hosts6        => {'eqiad': '2620:0:861:2:208:80:154:134', 'codfw': '2620:0:860:3:208:80:153:70', 'esams': '2a02:ec80:300:3:185:15:59:101', 'ulsfo': '2620:0:863:3:198:35:26:98', 'eqsin': '2001:df2:e500:1:103:102:166:11', 'drmrs': '2a02:ec80:600:1:185:15:58:7', 'magru': '2a02:ec80:700:3:195:200:68:100'}
+    labstore_hosts        => ['208.80.154.142', '2620:0:861:2:208:80:154:142', '208.80.154.71', '2620:0:861:3:208:80:154:71']
+    monitoring_hosts      => ['208.80.154.78', '2620:0:861:3:208:80:154:78', '208.80.153.42', '2620:0:860:2:208:80:153:42']
+    prometheus_nodes      => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet']
+    kafkamon_hosts        => ['10.64.32.11', '2620:0:861:103:10:64:32:11', '10.192.16.139', '2620:0:860:102:10:192:16:139']
+    deployment_hosts      => ['10.64.16.93', '2620:0:861:102:10:64:16:93', '10.192.32.7', '2620:0:860:103:10:192:32:7']
+    cumin_masters         => ['10.64.16.154', '2620:0:861:102:10:64:16:154', '10.192.32.49', '2620:0:860:103:10:192:32:49']
+    zookeeper_hosts_main  => ['10.64.0.207', '2620:0:861:101:10:64:0:207', '10.64.16.110', '2620:0:861:102:10:64:16:110', '10.64.48.154', '2620:0:861:107:10:64:48:154', '10.192.16.45', '2620:0:860:102:10:192:16:45', '10.192.32.52', '2620:0:860:103:10:192:32:52', '10.192.48.59', '2620:0:860:104:10:192:48:59']
+    kafka_brokers_main    => ['10.192.5.9', '2620:0:860:106:10:192:5:9', '10.192.22.6', '2620:0:860:112:10:192:22:6', '10.192.32.4', '2620:0:860:103:10:192:32:4', '10.192.48.33', '2620:0:860:104:10:192:48:33', '10.192.48.35', '2620:0:860:104:10:192:48:35', '10.64.0.101', '2620:0:861:101:10:64:0:101', '10.64.16.30', '2620:0:861:102:10:64:16:30', '10.64.32.45', '2620:0:861:103:10:64:32:45', '10.64.48.37', '2620:0:861:107:10:64:48:37', '10.64.152.5', '2620:0:861:120:10:64:152:5']
+    zookeeper_flink_hosts => ['10.64.16.9', '2620:0:861:102:10:64:16:9', '10.64.0.8', '2620:0:861:101:10:64:0:8', '10.64.32.41', '2620:0:861:103:10:64:32:41', '10.192.16.227', '2620:0:860:102:10:192:16:227', '10.192.32.179', '2620:0:860:103:10:192:32:179', '10.192.48.219', '2620:0:860:104:10:192:48:219']
+    druid_public_hosts    => ['10.64.131.9', '2620:0:861:10a:10:64:131:9', '10.64.132.12', '2620:0:861:10b:10:64:132:12', '10.64.135.9', '2620:0:861:10e:10:64:135:9', '10.64.32.101', '2620:0:861:103:10:64:32:101', '10.64.48.185', '2620:0:861:107:10:64:48:185']
+    kafka_brokers_jumbo   => ['10.64.130.10', '2620:0:861:109:10:64:130:10', '10.64.131.16', '2620:0:861:10a:10:64:131:16', '10.64.132.21', '2620:0:861:10b:10:64:132:21', '10.64.134.9', '2620:0:861:10d:10:64:134:9', '10.64.135.16', '2620:0:861:10e:10:64:135:16', '10.64.136.11', '2620:0:861:10f:10:64:136:11', '10.64.154.15', '2620:0:861:122:10:64:154:15', '10.64.160.16', '2620:0:861:128:10:64:160:16', '10.64.0.126', '2620:0:861:101:10:64:0:126']
+    lb_health_checks      => ['10.64.0.136', '10.64.16.60', '10.64.158.19', '10.64.166.19', '10.64.133.19', '10.64.141.19', '10.64.169.19', '10.64.171.19', '10.64.173.19', '10.64.175.19', '10.64.177.19', '10.64.179.19', '10.64.181.19', '10.64.183.19', '10.64.185.19', '10.64.187.19', '10.64.189.19', '10.64.48.72', '10.64.37.17', '10.64.1.17', '10.64.17.17', '10.64.33.17', '10.64.130.20', '10.64.131.20', '10.64.132.20', '10.64.134.20', '10.64.135.20', '10.64.136.20', '10.64.158.20', '10.64.166.20', '10.64.133.20', '10.64.141.20', '10.64.169.20', '10.64.171.20', '10.64.173.20', '10.64.175.20', '10.64.177.20', '10.64.179.20', '10.64.181.20', '10.64.183.20', '10.64.185.20', '10.64.187.20', '10.64.189.20', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:107::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:119::/64', '2620:0:861:10c::/64', '2620:0:861:113::/64', '2620:0:861:119::/64', '2620:0:861:131::/64', '2620:0:861:133::/64', '2620:0:861:135::/64', '2620:0:861:137::/64', '2620:0:861:139::/64', '2620:0:861:13b::/64', '2620:0:861:13d::/64', '2620:0:861:13f::/64', '2620:0:861:142::/64', '2620:0:861:144::/64', '10.192.23.8', '10.192.0.29', '10.192.17.8', '10.192.33.8', '10.192.49.8', '10.192.23.2', '10.192.5.2', '10.192.6.2', '10.192.7.2', '10.192.8.2', '10.192.9.2', '10.192.10.2', '10.192.11.2', '10.192.12.2', '10.192.13.2', '10.192.14.2', '10.192.15.2', '10.192.21.2', '10.192.22.2', '10.192.4.2', '10.192.26.2', '10.192.27.2', '10.192.28.2', '10.192.29.2', '10.192.30.2', '10.192.31.2', '10.192.36.2', '10.192.37.2', '10.192.38.2', '10.192.39.2', '10.192.40.2', '10.192.41.2', '10.192.42.2', '10.192.43.2', '10.192.11.8', '10.192.16.140', '10.192.1.8', '10.192.33.9', '10.192.49.9', '10.192.23.3', '10.192.5.3', '10.192.6.3', '10.192.7.3', '10.192.8.3', '10.192.9.3', '10.192.10.3', '10.192.11.3', '10.192.12.3', '10.192.13.3', '10.192.14.3', '10.192.15.3', '10.192.21.3', '10.192.22.3', '10.192.4.3', '10.192.26.3', '10.192.27.3', '10.192.28.3', '10.192.29.3', '10.192.30.3', '10.192.31.3', '10.192.36.3', '10.192.37.3', '10.192.38.3', '10.192.39.4', '10.192.40.3', '10.192.41.3', '10.192.42.3', '10.192.43.3', '10.192.32.14', '10.192.1.9', '10.192.17.9', '10.192.49.10', '10.192.23.4', '10.192.5.4', '10.192.6.4', '10.192.7.4', '10.192.8.4', '10.192.9.4', '10.192.10.4', '10.192.11.4', '10.192.12.4', '10.192.13.4', '10.192.14.4', '10.192.15.4', '10.192.21.4', '10.192.22.4', '10.192.4.5', '10.192.26.5', '10.192.27.5', '10.192.28.5', '10.192.29.5', '10.192.30.5', '10.192.31.5', '10.192.36.5', '10.192.37.5', '10.192.38.5', '10.192.39.6', '10.192.40.5', '10.192.41.5', '10.192.42.5', '10.192.43.5', '10.192.48.213', '10.192.1.13', '10.192.17.10', '10.192.33.10', '10.192.23.5', '10.192.5.8', '10.192.6.5', '10.192.7.5', '10.192.8.5', '10.192.9.5', '10.192.10.5', '10.192.11.5', '10.192.12.5', '10.192.13.5', '10.192.14.5', '10.192.15.5', '10.192.21.5', '10.192.22.5', '10.192.4.5', '10.192.26.5', '10.192.27.5', '10.192.28.5', '10.192.29.5', '10.192.30.5', '10.192.31.5', '10.192.36.5', '10.192.37.5', '10.192.38.5', '10.192.39.6', '10.192.40.5', '10.192.41.5', '10.192.42.5', '10.192.43.5', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '10.80.0.3', '10.80.1.8', '10.80.1.14', '10.80.0.9', '10.80.0.2', '10.80.1.10', '2a02:ec80:300:101::/64', '2a02:ec80:300:102::/64', '10.128.0.18', '10.128.0.9', '10.128.0.11', '2620:0:863:101::/64', '10.132.0.39', '10.132.0.6', '10.132.0.7', '2001:df2:e500:101::/64', '10.136.0.16', '10.136.1.19', '10.136.1.15', '10.136.0.19', '10.136.0.17', '10.136.1.20', '2a02:ec80:600:101::/64', '2a02:ec80:600:102::/64', '10.140.0.13', '10.140.1.2', '10.140.1.14', '10.140.0.2', '10.140.0.14', '10.140.1.3', '2a02:ec80:700:101::/64', '2a02:ec80:700:102::/64']

File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "wmf_auto_restart_apache-htcacheclean" then {
-    action(
-        type="omfile" file="/var/log/wmf_auto_restart_apache-htcacheclean/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[ensure_present_mod_status]

Parameters differences:

--- Exec[ensure_present_mod_status].orig
+++ Exec[ensure_present_mod_status]

-    creates => /etc/apache2/mods-enabled/status.load
-    command => /usr/sbin/a2enmod status
-    notify  => Service[apache2]
-    require => Package[apache2]

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Systemd::Service[cfssl-ocspserve@aux_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@aux_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@aux_front_proxy]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/etc/cfssl/ocsp/wikikube_staging.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/wikikube_staging.ocsp].orig
+++ File[/etc/cfssl/ocsp/wikikube_staging.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/lib/systemd/system/cfssl-gc-expired-certs.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-gc-expired-certs.service].orig
+++ File[/lib/systemd/system/cfssl-gc-expired-certs.service]

-    notify => Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-gc-expired-certs.service.orig
+++ /lib/systemd/system/cfssl-gc-expired-certs.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Delete expired Certificates from the cfssl DB
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-certs clean

File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MGMT_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/MGMT_NETWORKS_ipv4.nft
@@ -0,0 +1,14 @@
+# Autogenerated by puppet
+set MGMT_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.65.0.0/16,
+             10.128.128.0/17,
+             10.193.0.0/16,
+             10.80.128.0/17,
+             10.132.128.0/17,
+             10.136.128.0/17,
+             10.140.128.0/17
+    }
+}

File[/lib/systemd/system/cfssl-ocspserve@syslog.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@syslog.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@syslog.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@syslog.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@syslog.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (syslog)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10007 \
-          -responses /etc/cfssl/ocsp/syslog.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_staging" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft.orig
+++ /etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft
@@ -0,0 +1,191 @@
+# Autogenerated by puppet
+set LOAD_BALANCER_HEALTH_CHECKS_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.0.136,
+             10.64.16.60,
+             10.64.158.19,
+             10.64.166.19,
+             10.64.133.19,
+             10.64.141.19,
+             10.64.169.19,
+             10.64.171.19,
+             10.64.173.19,
+             10.64.175.19,
+             10.64.177.19,
+             10.64.179.19,
+             10.64.181.19,
+             10.64.183.19,
+             10.64.185.19,
+             10.64.187.19,
+             10.64.189.19,
+             10.64.48.72,
+             10.64.37.17,
+             10.64.1.17,
+             10.64.17.17,
+             10.64.33.17,
+             10.64.130.20,
+             10.64.131.20,
+             10.64.132.20,
+             10.64.134.20,
+             10.64.135.20,
+             10.64.136.20,
+             10.64.158.20,
+             10.64.166.20,
+             10.64.133.20,
+             10.64.141.20,
+             10.64.169.20,
+             10.64.171.20,
+             10.64.173.20,
+             10.64.175.20,
+             10.64.177.20,
+             10.64.179.20,
+             10.64.181.20,
+             10.64.183.20,
+             10.64.185.20,
+             10.64.187.20,
+             10.64.189.20,
+             10.192.23.8,
+             10.192.0.29,
+             10.192.17.8,
+             10.192.33.8,
+             10.192.49.8,
+             10.192.23.2,
+             10.192.5.2,
+             10.192.6.2,
+             10.192.7.2,
+             10.192.8.2,
+             10.192.9.2,
+             10.192.10.2,
+             10.192.11.2,
+             10.192.12.2,
+             10.192.13.2,
+             10.192.14.2,
+             10.192.15.2,
+             10.192.21.2,
+             10.192.22.2,
+             10.192.4.2,
+             10.192.26.2,
+             10.192.27.2,
+             10.192.28.2,
+             10.192.29.2,
+             10.192.30.2,
+             10.192.31.2,
+             10.192.36.2,
+             10.192.37.2,
+             10.192.38.2,
+             10.192.39.2,
+             10.192.40.2,
+             10.192.41.2,
+             10.192.42.2,
+             10.192.43.2,
+             10.192.11.8,
+             10.192.16.140,
+             10.192.1.8,
+             10.192.33.9,
+             10.192.49.9,
+             10.192.23.3,
+             10.192.5.3,
+             10.192.6.3,
+             10.192.7.3,
+             10.192.8.3,
+             10.192.9.3,
+             10.192.10.3,
+             10.192.11.3,
+             10.192.12.3,
+             10.192.13.3,
+             10.192.14.3,
+             10.192.15.3,
+             10.192.21.3,
+             10.192.22.3,
+             10.192.4.3,
+             10.192.26.3,
+             10.192.27.3,
+             10.192.28.3,
+             10.192.29.3,
+             10.192.30.3,
+             10.192.31.3,
+             10.192.36.3,
+             10.192.37.3,
+             10.192.38.3,
+             10.192.39.4,
+             10.192.40.3,
+             10.192.41.3,
+             10.192.42.3,
+             10.192.43.3,
+             10.192.32.14,
+             10.192.1.9,
+             10.192.17.9,
+             10.192.49.10,
+             10.192.23.4,
+             10.192.5.4,
+             10.192.6.4,
+             10.192.7.4,
+             10.192.8.4,
+             10.192.9.4,
+             10.192.10.4,
+             10.192.11.4,
+             10.192.12.4,
+             10.192.13.4,
+             10.192.14.4,
+             10.192.15.4,
+             10.192.21.4,
+             10.192.22.4,
+             10.192.4.5,
+             10.192.26.5,
+             10.192.27.5,
+             10.192.28.5,
+             10.192.29.5,
+             10.192.30.5,
+             10.192.31.5,
+             10.192.36.5,
+             10.192.37.5,
+             10.192.38.5,
+             10.192.39.6,
+             10.192.40.5,
+             10.192.41.5,
+             10.192.42.5,
+             10.192.43.5,
+             10.192.48.213,
+             10.192.1.13,
+             10.192.17.10,
+             10.192.33.10,
+             10.192.23.5,
+             10.192.5.8,
+             10.192.6.5,
+             10.192.7.5,
+             10.192.8.5,
+             10.192.9.5,
+             10.192.10.5,
+             10.192.11.5,
+             10.192.12.5,
+             10.192.13.5,
+             10.192.14.5,
+             10.192.15.5,
+             10.192.21.5,
+             10.192.22.5,
+             10.80.0.3,
+             10.80.1.8,
+             10.80.1.14,
+             10.80.0.9,
+             10.80.0.2,
+             10.80.1.10,
+             10.128.0.18,
+             10.128.0.9,
+             10.128.0.11,
+             10.132.0.39,
+             10.132.0.6,
+             10.132.0.7,
+             10.136.0.16,
+             10.136.1.19,
+             10.136.1.15,
+             10.136.0.19,
+             10.136.0.17,
+             10.136.1.20,
+             10.140.0.13,
+             10.140.1.2,
+             10.140.1.14,
+             10.140.0.2,
+             10.140.0.14,
+             10.140.1.3
+    }
+}

Cfssl::Config[wikikube_front_proxy]

Parameters differences:

--- Cfssl::Config[wikikube_front_proxy].orig
+++ Cfssl::Config[wikikube_front_proxy]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_front_proxy
-    path                => /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_front_proxy

Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]

File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft].orig
+++ File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft.orig
+++ /etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft
@@ -0,0 +1,11 @@
+# Autogenerated by puppet
+set ZOOKEEPER_HOSTS_MAIN_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:101:10:64:0:207,
+             2620:0:861:102:10:64:16:110,
+             2620:0:861:107:10:64:48:154,
+             2620:0:860:102:10:192:16:45,
+             2620:0:860:103:10:192:32:52,
+             2620:0:860:104:10:192:48:59
+    }
+}

Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@mlserve]']

Service[nrpe2nodexp-ferm_active.timer]

Parameters differences:

--- Service[nrpe2nodexp-ferm_active.timer].orig
+++ Service[nrpe2nodexp-ferm_active.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (mlserve_staging_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20041 \
-          -responses /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_dse.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/aux_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Service[wmf_auto_restart_apache2.timer]

Parameters differences:

--- Service[wmf_auto_restart_apache2.timer].orig
+++ Service[wmf_auto_restart_apache2.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => wikikube_staging
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@wikikube_staging]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Nrpe::Plugin[check_ferm]

Parameters differences:

--- Nrpe::Plugin[check_ferm].orig
+++ Nrpe::Plugin[check_ferm]

-    source => puppet:///modules/base/firewall/check_ferm
-    ensure => present

Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    ensure => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_wikikube.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]

-    before      => ['Service[nrpe2nodexp-ferm_active.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Service[cfssl-ocsprefresh-network_devices.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-network_devices.timer].orig
+++ Service[cfssl-ocsprefresh-network_devices.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Service[cfssl-ocspserve@debmonitor]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@debmonitor].orig
+++ Systemd::Service[cfssl-ocspserve@debmonitor]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
+++ Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/usr/local/sbin/ferm-status]

Parameters differences:

--- File[/usr/local/sbin/ferm-status].orig
+++ File[/usr/local/sbin/ferm-status]

@@
-    ensure => file
+    ensure => absent

Prometheus::Blackbox::Check::Http[PKI_cassandra]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_cassandra].orig
+++ Prometheus::Blackbox::Check::Http[PKI_cassandra]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"cassandra"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-puppet_rsa]

Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery2026
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__discovery2026
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="bf2e3510cb63e5f05f545e816bab4edf",check_name="check_check_certificate_expiry_discovery2026", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery2026
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_discovery2026))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem.orig
+++ /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
@@ -1 +0,0 @@
-fake

File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Monitoring::Exported_nagios_service[pki1001 disk_space]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 disk_space].orig
+++ Monitoring::Exported_nagios_service[pki1001 disk_space]

@@
-    servicegroups         => pki_eqiad
+    servicegroups         => insetup_eqiad
@@
-    notifications_enabled => 1
+    notifications_enabled => 0

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-wikikube_staging" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_staging/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Service[cfssl-ocspserve@mlserve_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@mlserve_front_proxy].orig
+++ Service[cfssl-ocspserve@mlserve_front_proxy]

-    enable => True
-    ensure => running

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@wikikube_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Profile::Pki::Multirootca::Monitoring[kafka]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[kafka].orig
+++ Profile::Pki::Multirootca::Monitoring[kafka]

-    ca_file      => /etc/cfssl/signers/kafka/ca/kafka.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => kafka

Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Sudo::User[nrpe_certificate_check_wikikube_staging]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_wikikube_staging].orig
+++ Sudo::User[nrpe_certificate_check_wikikube_staging]

-    user       => nrpe_certificate_check_wikikube_staging
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Systemd::Syslog[cfssl-gc-expired-certs]

Parameters differences:

--- Systemd::Syslog[cfssl-gc-expired-certs].orig
+++ Systemd::Syslog[cfssl-gc-expired-certs]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-puppet_rsa-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_aux_front_proxy!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: aux_front_proxy
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocspserve@syslog]

Parameters differences:

--- Service[cfssl-ocspserve@syslog].orig
+++ Service[cfssl-ocspserve@syslog]

-    enable => True
-    ensure => running

File[/etc/cfssl/signers/syslog/ca]

Parameters differences:

--- File[/etc/cfssl/signers/syslog/ca].orig
+++ File[/etc/cfssl/signers/syslog/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-cassandra-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Sudo::User[nrpe-check_check_certificate_expiry_zuul]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_zuul].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_zuul]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem

Cfssl::Signer[kafka]

Parameters differences:

--- Cfssl::Signer[kafka].orig
+++ Cfssl::Signer[kafka]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/kafka/ca/kafka.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/kafka
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/kafka
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/kafka/ca/kafka-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'kafka_11': {'expiry': '8760h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   =>

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-mlserve_staging.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-mlserve_staging.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]

-    before      => ['Service[cfssl-ocsprefresh-wikikube_staging.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Exec[Generate initial CRL for wikikube]

Parameters differences:

--- Exec[Generate initial CRL for wikikube].orig
+++ Exec[Generate initial CRL for wikikube]

-    creates => /srv/cfssl/crl/wikikube
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube/ca/wikikube.pem /etc/cfssl/signers/wikikube/ca/wikikube-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube
-    require => ['Package[golang-cfssl]']

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@puppet_rsa]']

File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/ferm/conf.d/10_ssh_from_bastion]

Parameters differences:

--- File[/etc/ferm/conf.d/10_ssh_from_bastion].orig
+++ File[/etc/ferm/conf.d/10_ssh_from_bastion]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/10_ssh_from_bastion.orig
+++ /etc/ferm/conf.d/10_ssh_from_bastion
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 22, (103.102.166.103 185.15.58.6 185.15.59.99 195.200.68.99 198.35.26.104 2001:df2:e500:3:103:102:166:103 208.80.153.110 208.80.154.7 2620:0:860:4:208:80:153:110 2620:0:861:1:208:80:154:7 2620:0:863:3:198:35:26:104 2a02:ec80:300:3:185:15:59:99 2a02:ec80:600:1:185:15:58:6 2a02:ec80:700:3:195:200:68:99));
-
-

Rsyslog::Conf[cfssl-gc-expired-certs]

Parameters differences:

--- Rsyslog::Conf[cfssl-gc-expired-certs].orig
+++ Rsyslog::Conf[cfssl-gc-expired-certs]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-gc-expired-certs]

Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]

Systemd::Unit[cfssl-ocspserve@kafka]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@kafka].orig
+++ Systemd::Unit[cfssl-ocspserve@kafka]

-    unit              => cfssl-ocspserve@kafka
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_puppet_rsa].orig
+++ Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"puppet_rsa"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-zuul].orig
+++ Systemd::Timer[cfssl-ocsprefresh-zuul]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-zuul.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Profile::Pki::Multirootca::Monitoring[aux]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[aux].orig
+++ Profile::Pki::Multirootca::Monitoring[aux]

-    ca_file      => /etc/cfssl/signers/aux/ca/aux.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => aux

Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nftables/sets/CACHES_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/CACHES_ipv4.nft].orig
+++ File[/etc/nftables/sets/CACHES_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CACHES_ipv4.nft.orig
+++ /etc/nftables/sets/CACHES_ipv4.nft
@@ -0,0 +1,117 @@
+# Autogenerated by puppet
+set CACHES_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.0.79,
+             10.64.0.229,
+             10.64.0.14,
+             10.64.0.51,
+             10.64.16.241,
+             10.64.16.94,
+             10.64.16.95,
+             10.64.16.240,
+             10.64.32.14,
+             10.64.32.60,
+             10.64.32.15,
+             10.64.32.65,
+             10.64.48.16,
+             10.64.48.41,
+             10.64.48.27,
+             10.64.48.28,
+             10.192.23.26,
+             10.192.6.20,
+             10.192.12.35,
+             10.192.14.25,
+             10.192.4.22,
+             10.192.29.26,
+             10.192.30.29,
+             10.192.36.19,
+             10.192.40.25,
+             10.192.41.21,
+             10.192.56.3,
+             10.192.56.4,
+             10.192.57.3,
+             10.192.58.2,
+             10.192.58.3,
+             10.192.59.2,
+             10.80.0.14,
+             10.80.1.11,
+             10.80.0.13,
+             10.80.1.9,
+             10.80.0.12,
+             10.80.1.7,
+             10.80.0.11,
+             10.80.1.6,
+             10.80.0.10,
+             10.80.1.5,
+             10.80.0.8,
+             10.80.1.4,
+             10.80.0.7,
+             10.80.1.3,
+             10.80.0.6,
+             10.80.1.2,
+             10.128.0.19,
+             10.128.0.27,
+             10.128.0.22,
+             10.128.0.28,
+             10.128.0.25,
+             10.128.0.29,
+             10.128.0.26,
+             10.128.0.31,
+             10.128.0.14,
+             10.128.0.35,
+             10.128.0.21,
+             10.128.0.36,
+             10.128.0.24,
+             10.128.0.10,
+             10.128.0.37,
+             10.128.0.12,
+             10.132.0.17,
+             10.132.0.18,
+             10.132.0.19,
+             10.132.0.24,
+             10.132.0.29,
+             10.132.0.30,
+             10.132.0.34,
+             10.132.0.35,
+             10.132.0.36,
+             10.132.0.37,
+             10.132.0.38,
+             10.132.0.25,
+             10.132.0.26,
+             10.132.0.27,
+             10.132.0.28,
+             10.132.0.16,
+             10.136.0.6,
+             10.136.1.6,
+             10.136.0.7,
+             10.136.1.7,
+             10.136.0.8,
+             10.136.1.8,
+             10.136.0.9,
+             10.136.1.9,
+             10.136.0.10,
+             10.136.1.10,
+             10.136.0.11,
+             10.136.1.11,
+             10.136.0.12,
+             10.136.1.12,
+             10.136.0.13,
+             10.136.1.13,
+             10.140.0.3,
+             10.140.1.4,
+             10.140.0.4,
+             10.140.1.5,
+             10.140.0.5,
+             10.140.1.6,
+             10.140.0.6,
+             10.140.1.7,
+             10.140.0.7,
+             10.140.1.8,
+             10.140.0.8,
+             10.140.1.9,
+             10.140.0.9,
+             10.140.1.10,
+             10.140.0.10,
+             10.140.1.11
+    }
+}

Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-wikikube-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/discovery/ca/discovery.pem]

Parameters differences:

--- File[/etc/cfssl/signers/discovery/ca/discovery.pem].orig
+++ File[/etc/cfssl/signers/discovery/ca/discovery.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/discovery/ca/discovery.pem.orig
+++ /etc/cfssl/signers/discovery/ca/discovery.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
-BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
-3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
-wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
-5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
-NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
-BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
-ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
-q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
-ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
-4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
------END CERTIFICATE-----

Monitoring::Service[check_certificate_expiry_zuul]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_zuul].orig
+++ Monitoring::Service[check_certificate_expiry_zuul]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_zuul!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: zuul
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]

-    unit              => cfssl-ocspserve@mlserve_front_proxy
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Nftables::Set[KAFKA_BROKERS_LOGGING]

Parameters differences:

--- Nftables::Set[KAFKA_BROKERS_LOGGING].orig
+++ Nftables::Set[KAFKA_BROKERS_LOGGING]

+    hosts  => ['10.64.16.205', '2620:0:861:102:10:64:16:205', '10.64.133.11', '2620:0:861:10c:10:64:133:11', '10.64.183.12', '2620:0:861:13d:10:64:183:12', '10.64.131.13', '2620:0:861:10a:10:64:131:13', '10.64.135.13', '2620:0:861:10e:10:64:135:13', '10.192.23.29', '2620:0:860:113:10:192:23:29', '10.192.11.28', '2620:0:860:10c:10:192:11:28', '10.192.26.22', '2620:0:860:105:10:192:26:22', '10.192.11.27', '2620:0:860:10c:10:192:11:27', '10.192.39.25', '2620:0:860:11e:10:192:39:25']
+    ensure => present

Systemd::Timer::Job[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-discovery]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery/ca/discovery.pem --responses-file /etc/cfssl/ocsp/discovery.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery' discovery 
-    description               => OCSP Refresh job - discovery
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Nftables::Set[BASTION_HOSTS]

Parameters differences:

--- Nftables::Set[BASTION_HOSTS].orig
+++ Nftables::Set[BASTION_HOSTS]

+    hosts  => ['208.80.154.7', '2620:0:861:1:208:80:154:7', '208.80.153.110', '2a02:ec80:300:3:185:15:59:99', '185.15.59.99', '2620:0:860:4:208:80:153:110', '198.35.26.104', '2620:0:863:3:198:35:26:104', '103.102.166.103', '2001:df2:e500:3:103:102:166:103', '185.15.58.6', '2a02:ec80:600:1:185:15:58:6', '195.200.68.99', '2a02:ec80:700:3:195:200:68:99']
+    ensure => present

Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube/ca/wikikube.pem].orig
+++ File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/wikikube/ca/wikikube.pem.orig
+++ /etc/cfssl/signers/wikikube/ca/wikikube.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
-AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
-4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
-YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
-VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
-B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
-MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
-cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
-QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
-ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
-GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
-GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
-9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
------END CERTIFICATE-----

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/sudoers.d/nrpe_certificate_check_mlserve]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_mlserve].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve]

-    group  => root
-    ensure => absent
-    owner  => root

File[/srv/cfssl/bundles]

Parameters differences:

--- File[/srv/cfssl/bundles].orig
+++ File[/srv/cfssl/bundles]

-    group  => root
-    ensure => directory
-    owner  => root

Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => wikikube_front_proxy
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@wikikube_front_proxy]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Systemd::Override[ferm-service-status-restart]

Parameters differences:

--- Systemd::Override[ferm-service-status-restart].orig
+++ Systemd::Override[ferm-service-status-restart]

-    unit    => ferm
-    restart => False
-    source  => puppet:///modules/ferm/ferm_systemd_override
-    ensure  => present

File[/var/log/cfssl-ocsprefresh-zuul]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-zuul].orig
+++ File[/var/log/cfssl-ocsprefresh-zuul]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft.orig
+++ /etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft
@@ -0,0 +1,42 @@
+# Autogenerated by puppet
+set LOAD_BALANCER_HEALTH_CHECKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:861:101::/64,
+             2620:0:861:102::/64,
+             2620:0:861:103::/64,
+             2620:0:861:107::/64,
+             2620:0:861:109::/64,
+             2620:0:861:10a::/64,
+             2620:0:861:10b::/64,
+             2620:0:861:10d::/64,
+             2620:0:861:10e::/64,
+             2620:0:861:10f::/64,
+             2620:0:861:119::/64,
+             2620:0:861:10c::/64,
+             2620:0:861:113::/64,
+             2620:0:861:131::/64,
+             2620:0:861:133::/64,
+             2620:0:861:135::/64,
+             2620:0:861:137::/64,
+             2620:0:861:139::/64,
+             2620:0:861:13b::/64,
+             2620:0:861:13d::/64,
+             2620:0:861:13f::/64,
+             2620:0:861:142::/64,
+             2620:0:861:144::/64,
+             2620:0:860:101::/64,
+             2620:0:860:102::/64,
+             2620:0:860:103::/64,
+             2620:0:860:104::/64,
+             2a02:ec80:300:101::/64,
+             2a02:ec80:300:102::/64,
+             2620:0:863:101::/64,
+             2001:df2:e500:101::/64,
+             2a02:ec80:600:101::/64,
+             2a02:ec80:600:102::/64,
+             2a02:ec80:700:101::/64,
+             2a02:ec80:700:102::/64
+    }
+}

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_cloud_wmnet_ca]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem

Profile::Pki::Multirootca::Monitoring[discovery]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[discovery].orig
+++ Profile::Pki::Multirootca::Monitoring[discovery]

-    ca_file      => /etc/cfssl/signers/discovery/ca/discovery.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => discovery

Systemd::Unit[cfssl-ocsprefresh-wikikube.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube.service]

-    unit              => cfssl-ocsprefresh-wikikube.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/dse_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem

File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@debmonitor.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@debmonitor.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (debmonitor)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10001 \
-          -responses /etc/cfssl/ocsp/debmonitor.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-aux-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "b194b5b9b6c9d6e05b9eed8dcfcc40cf" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging_front_proxy"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging_front_proxy command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Sudo::User[nrpe_certificate_check_mlserve_staging]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_mlserve_staging].orig
+++ Sudo::User[nrpe_certificate_check_mlserve_staging]

-    user       => nrpe_certificate_check_mlserve_staging
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

File[/usr/local/bin/prometheus-check-dse-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-dse-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-dse-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Concat_fragment[main]

Content differences:

--- main.orig
+++ main
@@ -14,7 +14,6 @@
 [agent]
 use_srv_records = true
 srv_domain = eqiad.wmnet
-dns_alt_names = pki.discovery.wmnet
 daemonize = false
 http_connect_timeout = 60
 http_read_timeout = 960

File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/discovery/ca/discovery-key.pem].orig
+++ File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/discovery/ca/discovery-key.pem.orig
+++ /etc/cfssl/signers/discovery/ca/discovery-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######

Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)].orig
+++ Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_etcd]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem

Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

-    unit              => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__dse
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="4384c5ebc49e03dbe331e279fac3f393",check_name="check_check_certificate_expiry_dse", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_dse))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_zuul.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem].orig
+++ File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem.orig
+++ /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
-V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
-yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
-JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
-7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
------END CERTIFICATE-----

File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging/cfssl.conf].orig
+++ File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/wikikube_staging/cfssl.conf.orig
+++ /etc/cfssl/signers/wikikube_staging/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "72h",
-      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_staging",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_staging"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "72h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "72h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    ensure => present

Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem].orig
+++ File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem.orig
+++ /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem
@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDBjCCAmegAwIBAgIUJzV1YuedEKoaCkVVX4sGAX6x9eMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTMyNzAwWhcNMzEwMzIzMTMyNzAwWjCB
-nDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
-biBGcmFuY2lzY28xIjAgBgNVBAoTGVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMx
-FzAVBgNVBAsTDkNsb3VkIFNlcnZpY2VzMSMwIQYDVQQDDBpXaWtpbWVkaWFfSW50
-ZXJuYWxfUm9vdF9DQTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAVJE6KrM3i7m
-7uw5oZ71qWvcQv9wBoNU3nrEqPCDPRd4FS/THrd+OqmnxhJ5UIUhE31H3Ev52dNP
-LQ+274G2MR9dACOGB4/21O1Ng5aKNAgF0NjwS50RAQmRaGs9f7kQg7coDDBqKQj0
-GF6wG1tMI0/wdmi71d1qPX5BDYy+xGQZe1Bao0IwQDAOBgNVHQ8BAf8EBAMCAQYw
-DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUO62iceY0vRv8gL81cYOR0O9pEzYw
-CgYIKoZIzj0EAwQDgYwAMIGIAkIB64t/CBqDBhti8ERNX+rUh7k7zaZw0mllpfDa
-90Gp4vUr5jNTOYi5+Was8xNHz6SCtZK6BkxjF+yb8ogG4ZknV7kCQgD6jCQHgXUx
-mwKWMrxkrfv/yLCSytHfKCm0HSSyXKpHzKbPaIkt83JQxOoKpBmdHjPjkzVC1vjR
-EVQD+PGFu+xryQ==
------END CERTIFICATE-----

File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]

-    before      => ['Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem.orig
+++ /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
-iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
-ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
-EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
-xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
-lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
-/wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
-O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
-hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
-cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
-PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
-bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
-dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
-sBI=
------END CERTIFICATE-----

Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --responses-file /etc/cfssl/ocsp/debmonitor.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@debmonitor' debmonitor 
-    description               => OCSP Refresh job - debmonitor
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem].orig
+++ File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/discovery2026/ca/discovery2026.pem.orig
+++ /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
-A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
-HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
-1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
-CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
-SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
-0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
-c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
-A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
-aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
-UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
-b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
-aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
------END CERTIFICATE-----

File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_aux.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-dse" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-dse/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Class[Profile::Base]

Parameters differences:

--- Class[Profile::Base].orig
+++ Class[Profile::Base]

@@
-    cluster => pki
+    cluster => insetup

Systemd::Unit[cfssl-ocsprefresh-zuul.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-zuul.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-zuul.service]

-    unit              => cfssl-ocsprefresh-zuul.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Package[apache2]

Parameters differences:

--- Package[apache2].orig
+++ Package[apache2]

-    ensure   => installed
-    provider => apt

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - mlserve_staging_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging_front_proxy' mlserve_staging_front_proxy

File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-kafka.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-kafka.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - kafka
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/kafka/ca/kafka.pem --responses-file /etc/cfssl/ocsp/kafka.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@kafka' kafka

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-cloud_wmnet_ca-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-debmonitor" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-debmonitor/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/cfssl/signers/cassandra/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra/cfssl.conf].orig
+++ File[/etc/cfssl/signers/cassandra/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/cassandra/cfssl.conf.orig
+++ /etc/cfssl/signers/cassandra/cfssl.conf
@@ -1,65 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/cassandra",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/cassandra"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-puppet_rsa-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom

File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_cfssl-multirootca_status command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_cfssl-multirootca_status
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "52832284a5fb8b8ea6f55bb6271912c9" --timeout 10 --check-command "check_check_cfssl-multirootca_status" --page

Nrpe::Monitor_service[ferm_active]

Parameters differences:

--- Nrpe::Monitor_service[ferm_active].orig
+++ Nrpe::Monitor_service[ferm_active]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm
-    description                 => Check whether ferm is active by checking the default input chain
-    retries                     => 3
-    check_interval              => 30
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/local/lib/nagios/plugins/check_ferm
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => True
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Nrpe::Monitor_service[check_certificate_expiry_zuul]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_zuul].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_zuul]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: zuul
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_network_devices.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca].orig
+++ Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"cloud_wmnet_ca"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Cfssl::Signer[cassandra]

Parameters differences:

--- Cfssl::Signer[cassandra].orig
+++ Cfssl::Signer[cassandra]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
+EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/cassandra
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/cassandra
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/cassandra/ca/cassandra-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

Service[cfssl-ocsprefresh-dse_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-dse_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-dse_front_proxy.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Logrotate::Conf[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-discovery].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-discovery]

-    ensure => present

Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --responses-file /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cloud_wmnet_ca' cloud_wmnet_ca 
-    description               => OCSP Refresh job - cloud_wmnet_ca
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => etcd
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-etcd]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@etcd]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Service[cfssl-ocsprefresh-discovery2026.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-discovery2026.timer].orig
+++ Service[cfssl-ocsprefresh-discovery2026.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Sudo::User[nrpe-check_check_certificate_expiry_dse]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_dse].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_dse]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-aux-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Systemd::Unit[cfssl-ocspserve@wikikube_staging]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@wikikube_staging].orig
+++ Systemd::Unit[cfssl-ocspserve@wikikube_staging]

-    unit              => cfssl-ocspserve@wikikube_staging
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/ferm/conf.d/02_main]

Parameters differences:

--- File[/etc/ferm/conf.d/02_main].orig
+++ File[/etc/ferm/conf.d/02_main]

-    tag     => ferm
-    owner   => root
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]
-    notify  => Service[ferm]
-    source  => puppet:///modules/base/firewall/main-input-default-drop.conf
-    ensure  => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-kafka-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom

Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Monitoring::Service[check_certificate_expiry_cassandra]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_cassandra].orig
+++ Monitoring::Service[check_certificate_expiry_cassandra]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_cassandra!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: cassandra
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

File[/etc/logrotate.d/cfssl-gc-expired-certs]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-gc-expired-certs].orig
+++ File[/etc/logrotate.d/cfssl-gc-expired-certs]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-gc-expired-certs.orig
+++ /etc/logrotate.d/cfssl-gc-expired-certs
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-gc-expired-certs
-
-/var/log/cfssl-gc-expired-certs/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Service[cfssl-ocspserve@syslog]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@syslog].orig
+++ Systemd::Service[cfssl-ocspserve@syslog]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/lib/systemd/system/wmf_auto_restart_ulogd2.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_ulogd2.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_ulogd2.service]

-    notify => Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/wmf_auto_restart_ulogd2.service.orig
+++ /lib/systemd/system/wmf_auto_restart_ulogd2.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Auto restart job: ulogd2
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/wmf-auto-restart -s ulogd2

File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa/cfssl.conf].orig
+++ File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/puppet_rsa/cfssl.conf.orig
+++ /etc/cfssl/signers/puppet_rsa/cfssl.conf
@@ -1,73 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/puppet_rsa",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/puppet_rsa"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "mtls": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Exec[ensure_present_mod_headers]

Parameters differences:

--- Exec[ensure_present_mod_headers].orig
+++ Exec[ensure_present_mod_headers]

-    creates => /etc/apache2/mods-enabled/headers.load
-    command => /usr/sbin/a2enmod headers
-    notify  => Service[apache2]
-    require => Package[apache2]

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Service[check_certificate_expiry_network_devices]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_network_devices].orig
+++ Monitoring::Service[check_certificate_expiry_network_devices]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_network_devices!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: network_devices
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/signers/discovery2026/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026/cfssl.conf].orig
+++ File[/etc/cfssl/signers/discovery2026/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/discovery2026/cfssl.conf.orig
+++ /etc/cfssl/signers/discovery2026/cfssl.conf
@@ -1,129 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/discovery2026",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/discovery2026"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_staging": {
-        "auth_key": "k8s_staging",
-        "expiry": "24h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_wikikube": {
-        "auth_key": "k8s_wikikube",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_mlserve": {
-        "auth_key": "k8s_mlserve",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_mlstaging": {
-        "auth_key": "k8s_mlstaging",
-        "expiry": "24h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_dse": {
-        "auth_key": "k8s_dse",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      },
-      "k8s_dse_opensearch": {
-        "auth_key": "k8s_dse",
-        "expiry": "4380h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      },
-      "k8s_aux": {
-        "auth_key": "k8s_aux",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft].orig
+++ File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft.orig
+++ /etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft
@@ -0,0 +1,15 @@
+# Autogenerated by puppet
+set KAFKA_BROKERS_LOGGING_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.16.205,
+             10.64.133.11,
+             10.64.183.12,
+             10.64.131.13,
+             10.64.135.13,
+             10.192.23.29,
+             10.192.11.28,
+             10.192.26.22,
+             10.192.11.27,
+             10.192.39.25
+    }
+}

Rsyslog::Conf[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-kafka].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-kafka]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-kafka]

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem

File[/etc/modules-load.d/conntrack.conf]

Parameters differences:

--- File[/etc/modules-load.d/conntrack.conf].orig
+++ File[/etc/modules-load.d/conntrack.conf]

@@
-    ensure => file
+    ensure => absent

Sudo::User[nrpe_certificate_check_mlserve_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_mlserve_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_mlserve_front_proxy]

-    user       => nrpe_certificate_check_mlserve_front_proxy
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

-    ensure => present

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem

File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]

Parameters differences:

--- File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf].orig
+++ File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]

-    notify => Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf.orig
+++ /etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf
@@ -1,3 +0,0 @@
-[Unit]
-After=network-online.target
-Wants=network-online.target

File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-puppet_rsa.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-puppet_rsa.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__aux
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="f7dfe9e2cd77303dfae7ae11c5c56d90",check_name="check_check_certificate_expiry_aux", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_aux))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/logrotate.d/wmf_auto_restart_apache2]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_apache2].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_apache2]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_apache2.orig
+++ /etc/logrotate.d/wmf_auto_restart_apache2
@@ -1,12 +0,0 @@
-# logrotate(8) config for wmf_auto_restart_apache2
-
-/var/log/wmf_auto_restart_apache2/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Syslog[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-kafka].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-kafka]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Systemd::Unit[nrpe2nodexp-ferm_active.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-ferm_active.timer].orig
+++ Systemd::Unit[nrpe2nodexp-ferm_active.timer]

-    unit              => nrpe2nodexp-ferm_active.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Monitoring::Service[check_certificate_expiry_aux]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_aux].orig
+++ Monitoring::Service[check_certificate_expiry_aux]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_aux!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: aux
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-dse_front_proxy]

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]

-    owner   => root
-    group   => root
-    ensure  => file
-    require => Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

Monitoring::Service[check_certificate_expiry_syslog]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_syslog].orig
+++ Monitoring::Service[check_certificate_expiry_syslog]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_syslog!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: syslog
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_apache-htcacheclean.orig
+++ /etc/logrotate.d/wmf_auto_restart_apache-htcacheclean
@@ -1,12 +0,0 @@
-# logrotate(8) config for wmf_auto_restart_apache-htcacheclean
-
-/var/log/wmf_auto_restart_apache-htcacheclean/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Package[nftables]

Parameters differences:

--- Package[nftables].orig
+++ Package[nftables]

+    ensure   => present
+    provider => apt

Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_discovery2026].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]

-    unit              => cfssl-ocsprefresh-debmonitor.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft].orig
+++ File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft.orig
+++ /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set CLOUD_NETWORKS_PUBLIC_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2a02:ec80:a000:4000::/64,
+             2a02:ec80:a100:4000::/64
+    }
+}

Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => cassandra
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@cassandra]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf]

Parameters differences:

--- File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf].orig
+++ File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf]

-    notify => Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]
-    owner  => root
-    source => puppet:///modules/ferm/ferm_systemd_override
-    group  => root
-    mode   => 0444
-    ensure => present

Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

-    unit              => cfssl-ocsprefresh-mlserve_staging_front_proxy.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_discovery!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: discovery
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/syslog/ca/syslog.pem]

Parameters differences:

--- File[/etc/cfssl/signers/syslog/ca/syslog.pem].orig
+++ File[/etc/cfssl/signers/syslog/ca/syslog.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/syslog/ca/syslog.pem.orig
+++ /etc/cfssl/signers/syslog/ca/syslog.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
-CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
-W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
-q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
-DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
-qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
-BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
-LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
-QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
-YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
-8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
-p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
-as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
------END CERTIFICATE-----

File_line[load_env_enabled]

Parameters differences:

--- File_line[load_env_enabled].orig
+++ File_line[load_env_enabled]

-    path    => /etc/apache2/envvars
-    match   => env-enabled
-    line    => for f in /etc/apache2/env-enabled/*.sh; do [ -r "$f" ] && . "$f" >&2; done || true
-    require => Package[apache2]

Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@dse_front_proxy]']

Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    ensure    => present
-    sudo_user => root

File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/nrpe2nodexp-ferm_active.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-ferm_active.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-ferm_active.service
-
-[Timer]
-Unit=nrpe2nodexp-ferm_active.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=10min
-OnActiveSec=1s
-RandomizedDelaySec=600
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Nftables::Set[KAFKA_BROKERS_MAIN]

Parameters differences:

--- Nftables::Set[KAFKA_BROKERS_MAIN].orig
+++ Nftables::Set[KAFKA_BROKERS_MAIN]

+    hosts  => ['10.192.5.9', '2620:0:860:106:10:192:5:9', '10.192.22.6', '2620:0:860:112:10:192:22:6', '10.192.32.4', '2620:0:860:103:10:192:32:4', '10.192.48.33', '2620:0:860:104:10:192:48:33', '10.192.48.35', '2620:0:860:104:10:192:48:35', '10.64.0.101', '2620:0:861:101:10:64:0:101', '10.64.16.30', '2620:0:861:102:10:64:16:30', '10.64.32.45', '2620:0:861:103:10:64:32:45', '10.64.48.37', '2620:0:861:107:10:64:48:37', '10.64.152.5', '2620:0:861:120:10:64:152:5']
+    ensure => present

File[/etc/apache2/mods-enabled/status.conf]

Parameters differences:

--- File[/etc/apache2/mods-enabled/status.conf].orig
+++ File[/etc/apache2/mods-enabled/status.conf]

-    before  => Httpd::Mod_conf[status]
-    owner   => root
-    ensure  => absent
-    group   => root
-    require => Package[apache2]

Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Httpd::Mod_conf[ssl]

Parameters differences:

--- Httpd::Mod_conf[ssl].orig
+++ Httpd::Mod_conf[ssl]

-    mod      => ssl
-    loadfile => ssl.load
-    ensure   => present

File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-discovery2026.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery2026.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - discovery2026
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --responses-file /etc/cfssl/ocsp/discovery2026.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery2026' discovery2026

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-aux_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-aux_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_cassandra.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_staging_front_proxy!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_etcd command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_etcd
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "c834f873297e445663ead81279c0b928" --timeout 10 --check-command "check_check_certificate_expiry_etcd"

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_kafka
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "22922fd6bc2d570e018cbe5ccd8d1727" --timeout 10 --check-command "check_check_certificate_expiry_kafka"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_kafka command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]

-    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service.orig
+++ /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Auto restart job: apache-htcacheclean
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/wmf-auto-restart -s apache-htcacheclean

Service[cfssl-ocsprefresh-puppet_rsa.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-puppet_rsa.timer].orig
+++ Service[cfssl-ocsprefresh-puppet_rsa.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Nrpe::Check[check_check_certificate_expiry_zuul]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_zuul].orig
+++ Nrpe::Check[check_check_certificate_expiry_zuul]

-    before    => Monitoring::Service[check_certificate_expiry_zuul]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem
-    ensure    => present
-    sudo_user => root

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Cfssl::Db[multirootca-db]

Parameters differences:

--- Cfssl::Db[multirootca-db].orig
+++ Cfssl::Db[multirootca-db]

-    username          => pki
-    host              => m1-master.eqiad.wmnet
-    driver            => mysql
-    dbname            => pki
-    password          => changeme
-    conf_file         => /etc/cfssl/db.conf
-    python_config     => True
-    ssl_ca            => /etc/ssl/certs/wmf-ca-certificates.crt
-    ssl_checkhostname => False
-    dbcharset         => utf8mb4
-    notify_service    => cfssl-multirootca
-    port              => 3306

File[/etc/cfssl/ssl/ocsp]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp].orig
+++ File[/etc/cfssl/ssl/ocsp]

-    recurse => True
-    owner   => root
-    group   => root
-    mode    => 0740
-    ensure  => directory

Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => cloud_wmnet_ca
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@cloud_wmnet_ca]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

-    ensure      => present
-    hosts       => ['pki1001.eqiad.wmnet']
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki.discovery.wmnet

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-zuul-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Systemd::Unit[cfssl-ocspserve@dse_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@dse_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@dse_front_proxy]

-    unit              => cfssl-ocspserve@dse_front_proxy
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Ferm::Service[ssh_from_cumin_masters]

Parameters differences:

--- Ferm::Service[ssh_from_cumin_masters].orig
+++ Ferm::Service[ssh_from_cumin_masters]

-    src_sets            => ['CUMIN_MASTERS']
-    unrestricted_access => False
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    ensure              => present
-    port                => 22

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-cloud_wmnet_ca.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-wikikube_staging
-
-/var/log/cfssl-ocsprefresh-wikikube_staging/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_mlserve_staging_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem

Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File_line[auto_restart_file_presence_apache-htcacheclean]

Parameters differences:

--- File_line[auto_restart_file_presence_apache-htcacheclean].orig
+++ File_line[auto_restart_file_presence_apache-htcacheclean]

-    path    => /etc/debdeploy-client/autorestarts.conf
-    line    => apache-htcacheclean
-    ensure  => absent
-    require => File[/etc/debdeploy-client/autorestarts.conf]

File[/etc/cfssl/signers/mlserve_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Nrpe::Check[check_check_certificate_expiry_mlserve]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_mlserve].orig
+++ Nrpe::Check[check_check_certificate_expiry_mlserve]

-    before    => Monitoring::Service[check_certificate_expiry_mlserve]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    ensure    => present
-    sudo_user => root

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]

-    before      => ['Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]

-    before      => ['Service[cfssl-ocsprefresh-syslog.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_zuul!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: zuul
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Sudo::User[nrpe-check_check_certificate_expiry_network_devices]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_network_devices].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_network_devices]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/etc/cfssl/signers/network_devices/ca]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices/ca].orig
+++ File[/etc/cfssl/signers/network_devices/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]

-    user       => nrpe_certificate_check_mlserve_staging_front_proxy
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_front_proxy' wikikube_front_proxy 
-    description               => OCSP Refresh job - wikikube_front_proxy
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-aux_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom

File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/var/log/cfssl-ocsprefresh-wikikube]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-wikikube].orig
+++ File[/var/log/cfssl-ocsprefresh-wikikube]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Unit[cfssl-ocspserve@aux_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@aux_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@aux_front_proxy]

-    unit              => cfssl-ocspserve@aux_front_proxy
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Nftables::Set[MW_APPSERVER_NETWORKS]

Parameters differences:

--- Nftables::Set[MW_APPSERVER_NETWORKS].orig
+++ Nftables::Set[MW_APPSERVER_NETWORKS]

+    hosts  => ['10.64.0.0/22', '10.64.130.0/24', '10.64.131.0/24', '10.64.132.0/24', '10.64.133.0/24', '10.64.134.0/24', '10.64.135.0/24', '10.64.136.0/24', '10.64.141.0/24', '10.64.152.0/24', '10.64.154.0/24', '10.64.156.0/24', '10.64.158.0/24', '10.64.16.0/22', '10.64.160.0/24', '10.64.162.0/24', '10.64.164.0/24', '10.64.166.0/24', '10.64.169.0/24', '10.64.171.0/24', '10.64.173.0/24', '10.64.175.0/24', '10.64.177.0/24', '10.64.179.0/24', '10.64.181.0/24', '10.64.183.0/24', '10.64.185.0/24', '10.64.187.0/24', '10.64.189.0/24', '10.64.32.0/22', '10.64.48.0/22', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:107::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10c::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:113::/64', '2620:0:861:119::/64', '2620:0:861:120::/64', '2620:0:861:122::/64', '2620:0:861:124::/64', '2620:0:861:126::/64', '2620:0:861:128::/64', '2620:0:861:12a::/64', '2620:0:861:12c::/64', '2620:0:861:12e::/64', '2620:0:861:131::/64', '2620:0:861:133::/64', '2620:0:861:135::/64', '2620:0:861:137::/64', '2620:0:861:139::/64', '2620:0:861:13b::/64', '2620:0:861:13d::/64', '2620:0:861:13f::/64', '2620:0:861:142::/64', '2620:0:861:144::/64', '10.192.0.0/22', '10.192.10.0/24', '10.192.11.0/24', '10.192.12.0/24', '10.192.13.0/24', '10.192.14.0/24', '10.192.15.0/24', '10.192.16.0/22', '10.192.21.0/24', '10.192.22.0/24', '10.192.23.0/24', '10.192.26.0/24', '10.192.27.0/24', '10.192.28.0/24', '10.192.29.0/24', '10.192.30.0/24', '10.192.31.0/24', '10.192.32.0/22', '10.192.36.0/24', '10.192.37.0/24', '10.192.38.0/24', '10.192.39.0/24', '10.192.4.0/24', '10.192.40.0/24', '10.192.41.0/24', '10.192.42.0/24', '10.192.43.0/24', '10.192.44.0/24', '10.192.45.0/24', '10.192.46.0/24', '10.192.47.0/24', '10.192.48.0/22', '10.192.5.0/24', '10.192.52.0/24', '10.192.56.0/24', '10.192.57.0/24', '10.192.58.0/24', '10.192.59.0/24', '10.192.6.0/24', '10.192.7.0/24', '10.192.8.0/24', '10.192.9.0/24', '2620:0:860:100::/64', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '2620:0:860:105::/64', '2620:0:860:106::/64', '2620:0:860:107::/64', '2620:0:860:108::/64', '2620:0:860:109::/64', '2620:0:860:10a::/64', '2620:0:860:10b::/64', '2620:0:860:10c::/64', '2620:0:860:10d::/64', '2620:0:860:10e::/64', '2620:0:860:10f::/64', '2620:0:860:110::/64', '2620:0:860:111::/64', '2620:0:860:112::/64', '2620:0:860:113::/64', '2620:0:860:114::/64', '2620:0:860:115::/64', '2620:0:860:116::/64', '2620:0:860:119::/64', '2620:0:860:11a::/64', '2620:0:860:11b::/64', '2620:0:860:11c::/64', '2620:0:860:11d::/64', '2620:0:860:11e::/64', '2620:0:860:11f::/64', '2620:0:860:120::/64', '2620:0:860:121::/64', '2620:0:860:122::/64', '2620:0:860:123::/64', '2620:0:860:124::/64', '2620:0:860:125::/64', '2620:0:860:126::/64', '2620:0:860:127::/64', '2620:0:860:12b::/64', '2620:0:860:12c::/64', '2620:0:860:12d::/64', '2620:0:860:12e::/64', '10.192.64.0/21', '10.192.96.0/21', '10.194.128.0/17', '10.194.16.0/21', '10.194.61.0/24', '10.194.80.0/21', '10.64.64.0/21', '10.67.128.0/17', '10.67.16.0/21', '10.67.24.0/21', '10.67.80.0/21', '2620:0:860:300::/64', '2620:0:860:302::/64', '2620:0:860:305::/64', '2620:0:860:308::/64', '2620:0:860:babe::/64', '2620:0:860:cabe::/64', '2620:0:861:300::/64', '2620:0:861:302::/64', '2620:0:861:305::/64', '2620:0:861:babe::/64', '2620:0:861:cabe::/64', '208.80.154.0/26', '208.80.154.128/26', '208.80.154.64/26', '208.80.155.96/27', '2620:0:861:1::/64', '2620:0:861:2::/64', '2620:0:861:3::/64', '2620:0:861:4::/64', '208.80.153.0/27', '208.80.153.32/27', '208.80.153.64/27', '208.80.153.96/27', '2620:0:860:1::/64', '2620:0:860:2::/64', '2620:0:860:3::/64', '2620:0:860:4::/64']
+    ensure => present

Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

-    unit              => cfssl-ocsprefresh-wikikube_staging_front_proxy.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_etcd!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: etcd
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Systemd::Timer[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-network_devices].orig
+++ Systemd::Timer[cfssl-ocsprefresh-network_devices]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-network_devices.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    ensure => present

Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Ocsp[kafka]

Parameters differences:

--- Cfssl::Ocsp[kafka].orig
+++ Cfssl::Ocsp[kafka]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/kafka/ca/kafka.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10003
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/cfssl/signers/aux/ca]

Parameters differences:

--- File[/etc/cfssl/signers/aux/ca].orig
+++ File[/etc/cfssl/signers/aux/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_kafka]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Ferm::Rule[drop-blocked-nets]

Parameters differences:

--- Ferm::Rule[drop-blocked-nets].orig
+++ Ferm::Rule[drop-blocked-nets]

-    table  => filter
-    chain  => INPUT
-    ensure => present
-    domain => (ip ip6)
-    prio   => 01
-    desc   => drop abuse/blocked_nets.yaml defined in the requestctl private repo
-    rule   => saddr $BLOCKED_NETS DROP;

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => aux_front_proxy
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@aux_front_proxy]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Cfssl::Ocsp[discovery]

Parameters differences:

--- Cfssl::Ocsp[discovery].orig
+++ Cfssl::Ocsp[discovery]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/discovery/ca/discovery.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10002
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Timer[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-wikikube].orig
+++ Systemd::Timer[cfssl-ocsprefresh-wikikube]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-wikikube.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_front_proxy
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="9d6dd05c8e5e1bb294462d932b24bd1a",check_name="check_check_certificate_expiry_mlserve_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]

Systemd::Timer[cfssl-gc-expired-certs]

Parameters differences:

--- Systemd::Timer[cfssl-gc-expired-certs].orig
+++ Systemd::Timer[cfssl-gc-expired-certs]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-gc-expired-certs.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': 'hourly'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    ensure => present

File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Cfssl::Config[zuul]

Parameters differences:

--- Cfssl::Config[zuul].orig
+++ Cfssl::Config[zuul]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/zuul
-    path                => /etc/cfssl/signers/zuul/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['server auth', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/zuul

Rsyslog::Conf[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-wikikube].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-wikikube]

Class[Cumin::Selector]

Parameters differences:

--- Class[Cumin::Selector].orig
+++ Class[Cumin::Selector]

@@
-    cluster => pki
+    cluster => insetup

File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Ocsp[puppet_rsa]

Parameters differences:

--- Cfssl::Ocsp[puppet_rsa].orig
+++ Cfssl::Ocsp[puppet_rsa]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10008
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/cfssl/signers/discovery/ca]

Parameters differences:

--- File[/etc/cfssl/signers/discovery/ca].orig
+++ File[/etc/cfssl/signers/discovery/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Nrpe::Check[check_check_cfssl-multirootca_status]

Parameters differences:

--- Nrpe::Check[check_check_cfssl-multirootca_status].orig
+++ Nrpe::Check[check_check_cfssl-multirootca_status]

-    before  => Monitoring::Service[check_cfssl-multirootca_status]
-    command => /usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca
-    ensure  => present

File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]

-    ensure => present

File[/usr/local/sbin/cfssl-certs]

Parameters differences:

--- File[/usr/local/sbin/cfssl-certs].orig
+++ File[/usr/local/sbin/cfssl-certs]

-    owner  => root
-    source => puppet:///modules/cfssl/cfssl_certs.py
-    group  => root
-    mode   => 0500
-    ensure => file

Sudo::User[nrpe_certificate_check_syslog]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_syslog].orig
+++ Sudo::User[nrpe_certificate_check_syslog]

-    user       => nrpe_certificate_check_syslog
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    ensure => present

Nftables::Set[ZOOKEEPER_FLINK_HOSTS]

Parameters differences:

--- Nftables::Set[ZOOKEEPER_FLINK_HOSTS].orig
+++ Nftables::Set[ZOOKEEPER_FLINK_HOSTS]

+    hosts  => ['10.64.16.9', '2620:0:861:102:10:64:16:9', '10.64.0.8', '2620:0:861:101:10:64:0:8', '10.64.32.41', '2620:0:861:103:10:64:32:41', '10.192.16.227', '2620:0:860:102:10:192:16:227', '10.192.32.179', '2620:0:860:103:10:192:32:179', '10.192.48.219', '2620:0:860:104:10:192:48:219']
+    ensure => present

File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft].orig
+++ File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft.orig
+++ /etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft
@@ -0,0 +1,14 @@
+# Autogenerated by puppet
+set KAFKA_BROKERS_JUMBO_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.130.10,
+             10.64.131.16,
+             10.64.132.21,
+             10.64.134.9,
+             10.64.135.16,
+             10.64.136.11,
+             10.64.154.15,
+             10.64.160.16,
+             10.64.0.126
+    }
+}

Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c]

Parameters differences:

--- Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c].orig
+++ Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check whether ferm is active by checking the default input chain
-    alert_name         => nrpe_Check_whether_ferm_is_active_by_checking_the_default_input_chain
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="bba0a2572329bb500b832470e08b381c",check_name="check_ferm_active", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check whether ferm is active by checking the default input chain
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_ferm_active))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm
-    instance           => ops
-    ensure             => present
-    for                => 32m

Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]

-    before    => Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
-    show_diff => False
-    notify    => Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
-    owner     => root
-    group     => root
-    mode      => 0400

Content differences:

--- /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem.orig
+++ /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem
@@ -1 +0,0 @@
-FAKE FAKE FAKE

Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem

Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]

Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]

File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]

Parameters differences:

--- File[/usr/local/lib/nagios/plugins/check_systemd_unit_status].orig
+++ File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]

-    tag     => nrpe::plugin
-    owner   => root
-    ensure  => file
-    source  => puppet:///modules/systemd/check_systemd_unit_status
-    group   => root
-    mode    => 0555
-    require => File[/usr/local/lib/nagios/plugins/]

Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]

Parameters differences:

--- File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf].orig
+++ File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]

-    notify => Service[apache2]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf.orig
+++ /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf
@@ -1 +0,0 @@
-Listen 8443

Profile::Pki::Multirootca::Monitoring[dse_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[dse_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[dse_front_proxy]

-    ca_file      => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => dse_front_proxy

Cfssl::Signer[discovery]

Parameters differences:

--- Cfssl::Signer[discovery].orig
+++ Cfssl::Signer[discovery]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/discovery/ca/discovery.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/discovery
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/discovery
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/discovery/ca/discovery-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => ##### FAKE FOR PUPPET ######

Nrpe::Check[check_check_certificate_expiry_debmonitor]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_debmonitor].orig
+++ Nrpe::Check[check_check_certificate_expiry_debmonitor]

-    before    => Monitoring::Service[check_certificate_expiry_debmonitor]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    ensure    => present
-    sudo_user => root

File[/etc/sudoers.d/nrpe_certificate_check_discovery]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_discovery].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_discovery]

-    group  => root
-    ensure => absent
-    owner  => root

Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => wikikube
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@wikikube]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/srv/cfssl/crl]

Parameters differences:

--- File[/srv/cfssl/crl].orig
+++ File[/srv/cfssl/crl]

-    group  => root
-    ensure => directory
-    owner  => root

Cfssl::Config[discovery]

Parameters differences:

--- Cfssl::Config[discovery].orig
+++ Cfssl::Config[discovery]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/discovery
-    path                => /etc/cfssl/signers/discovery/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/discovery

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-zuul-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom

Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

File[/etc/ferm/ferm.conf]

Parameters differences:

--- File[/etc/ferm/ferm.conf].orig
+++ File[/etc/ferm/ferm.conf]

-    notify  => Service[ferm]
-    owner   => root
-    ensure  => file
-    source  => puppet:///modules/ferm/ferm.conf
-    group   => root
-    mode    => 0400
-    require => Package[ferm]

Service[cfssl-ocsprefresh-aux.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-aux.timer].orig
+++ Service[cfssl-ocsprefresh-aux.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]

-    group  => root
-    ensure => absent
-    owner  => root

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_staging!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: wikikube_staging
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]

-    unit              => nrpe2nodexp-check_cfssl-multirootca_status.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

File[/etc/cfssl/signers/kafka/ca/kafka.pem]

Parameters differences:

--- File[/etc/cfssl/signers/kafka/ca/kafka.pem].orig
+++ File[/etc/cfssl/signers/kafka/ca/kafka.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/kafka/ca/kafka.pem.orig
+++ /etc/cfssl/signers/kafka/ca/kafka.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
-AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
-DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
-kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
-AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
-RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
-CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
-d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
-MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
-X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
-tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
-b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
-up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
------END CERTIFICATE-----

File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-dse_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-dse_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Signer[wikikube_staging]

Parameters differences:

--- Cfssl::Signer[wikikube_staging].orig
+++ Cfssl::Signer[wikikube_staging]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 72h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_staging
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_staging
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => test

Exec[Generate initial CRL for aux_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for aux_front_proxy].orig
+++ Exec[Generate initial CRL for aux_front_proxy]

-    creates => /srv/cfssl/crl/aux_front_proxy
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/aux_front_proxy
-    require => ['Package[golang-cfssl]']

Concat_fragment[main contacts]

Content differences:

--- main contacts.orig
+++ main contacts
@@ -1,3 +1,3 @@
 ---
-role::pki::multirootca:
+role::insetup::infrastructure_foundations_nftables:
 - Infrastructure Foundations

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_staging-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - wikikube
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube/ca/wikikube.pem --responses-file /etc/cfssl/ocsp/wikikube.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube' wikikube

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Ferm::Rule[filter_log_filter-bootp]

Parameters differences:

--- Ferm::Rule[filter_log_filter-bootp].orig
+++ Ferm::Rule[filter_log_filter-bootp]

-    table  => filter
-    chain  => INPUT
-    ensure => present
-    domain => (ip ip6)
-    prio   => 98
-    desc   => 
-    rule   => proto udp  daddr 255.255.255.255 sport 67 dport 68 DROP;

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_debmonitor]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-dse-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom

Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: aux_front_proxy
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_mlserve_staging]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem

Systemd::Unit[ferm-ferm-service-status-restart]

Parameters differences:

--- Systemd::Unit[ferm-ferm-service-status-restart].orig
+++ Systemd::Unit[ferm-ferm-service-status-restart]

-    unit              => ferm
-    override          => True
-    ensure            => present
-    restart           => False
-    override_filename => ferm-service-status-restart
-    source            => puppet:///modules/ferm/ferm_systemd_override
-    require           => ['Class[Systemd]']

File[/var/log/prometheus-node-textfile-check-nft]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-check-nft].orig
+++ File[/var/log/prometheus-node-textfile-check-nft]

+    owner  => root
+    force  => True
+    backup => False
+    group  => root
+    mode   => 0755
+    ensure => directory

Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_cassandra.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_cassandra.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/zuul/ca/zuul-key.pem].orig
+++ File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/zuul/ca/zuul-key.pem.orig
+++ /etc/cfssl/signers/zuul/ca/zuul-key.pem
@@ -1 +0,0 @@
-nosecret

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    ensure => present

Monitoring::Service[check_certificate_expiry_etcd]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_etcd].orig
+++ Monitoring::Service[check_certificate_expiry_etcd]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_etcd!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: etcd
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]

-    before => Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
-    notify => Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
-    owner  => root
-    group  => root
-    mode   => 0444

Content differences:

--- /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem.orig
+++ /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDmzCCAvygAwIBAgIUN3uLiKCNVwnGG5H9qKGwTGT4fJowCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTQ1MTAwWhcNMjYwMzI0MTQ1MTAwWjCB
-mTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxFzAVBgNVBAsTDkNsb3VkIFNlcnZp
-Y2VzMTUwMwYDVQQDDCxXaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQV9vY3NwX3Np
-Z25pbmdfY2VydDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLmGOcHNNTGsOVTG
-17o/lTVCgVJqX751quqBZvJQUbAgfAv0PRgv6yjWzTmZnojzKHYRaV8NXhDIVBzo
-l2DRWUOjggEbMIIBFzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH
-AwkwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQULRRzzcjqWQc2Fjci5s2v0FKSPJww
-HwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBI
-MEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dp
-a2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6
-Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
-dF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgCI41DoiQFxqs9gDCZs4VhwcNeatHqe
-98IqBIzFOMdZdkUnyTNiXf0VDkUYZ+n2mYmB5ZAaBTPYhTHgLNrc3KsmpQJCAfHM
-Qr3AEz1MlZq2krL+7Mx9OuBQ3B/hXyC+met7EmKDziU8UyScxFfSIY1lwwgAmZHA
-OEOWpgzuF4fGZFVf0dFi
------END CERTIFICATE-----

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem].orig
+++ File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/network_devices/ca/network_devices-key.pem.orig
+++ /etc/cfssl/signers/network_devices/ca/network_devices-key.pem
@@ -1 +0,0 @@
-fake key

File[/etc/ferm/conf.d/99_dscp-default]

Parameters differences:

--- File[/etc/ferm/conf.d/99_dscp-default].orig
+++ File[/etc/ferm/conf.d/99_dscp-default]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/99_dscp-default.orig
+++ /etc/ferm/conf.d/99_dscp-default
@@ -1,11 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 99_dscp-default: 
-
-domain (ip ip6) {
-	table mangle {
-		chain POSTROUTING {
-			DSCP set-dscp-class CS0;
-		}
-	}
-}

Cfssl::Ocsp[wikikube]

Parameters differences:

--- Cfssl::Ocsp[wikikube].orig
+++ Cfssl::Ocsp[wikikube]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20010
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Rsyslog::Conf[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-cassandra].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-cassandra]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-cassandra]

File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Cfssl::Signer[aux_front_proxy]

Parameters differences:

--- Cfssl::Signer[aux_front_proxy].orig
+++ Cfssl::Signer[aux_front_proxy]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/aux_front_proxy
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/aux_front_proxy
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

Httpd::Mod_conf[proxy_http]

Parameters differences:

--- Httpd::Mod_conf[proxy_http].orig
+++ Httpd::Mod_conf[proxy_http]

-    mod      => proxy_http
-    loadfile => proxy_http.load
-    ensure   => present

Package[ferm]

Parameters differences:

--- Package[ferm].orig
+++ Package[ferm]

@@
-    ensure => installed
+    ensure => purged

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Ocsp[wikikube_staging]

Parameters differences:

--- Cfssl::Ocsp[wikikube_staging].orig
+++ Cfssl::Ocsp[wikikube_staging]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20020
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Service[cfssl-ocspserve@aux_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@aux_front_proxy].orig
+++ Service[cfssl-ocspserve@aux_front_proxy]

-    enable => True
-    ensure => running

Nftables::Set[NETWORK_INFRA]

Parameters differences:

--- Nftables::Set[NETWORK_INFRA].orig
+++ Nftables::Set[NETWORK_INFRA]

+    hosts  => ['185.15.59.128/27', '2a02:ec80:300:fe00::/55', '198.35.26.128/27', '2620:0:863:fe00::/55', '208.80.153.192/27', '2620:0:860:fe00::/55', '10.192.255.0/24', '2620:0:860:13f::/64', '10.192.253.0/24', '2620:0:860:139::/64', '208.80.154.192/27', '2620:0:861:fe00::/55', '10.64.146.0/24', '2620:0:861:11b::/128', '10.64.168.0/24', '2620:0:861:130::/64', '10.64.147.0/24', '103.102.166.128/27', '2001:df2:e500:fe00::/55', '185.15.58.128/27', '2a02:ec80:600:fe00::/55', '195.200.68.128/27', '2a02:ec80:700:fe00::/55']
+    ensure => present

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-aux" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-aux/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/signers/wikikube_staging_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]

-    before      => ['Service[cfssl-ocsprefresh-puppet_rsa.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

Sudo::User[nrpe_certificate_check_discovery2026]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_discovery2026].orig
+++ Sudo::User[nrpe_certificate_check_discovery2026]

-    user       => nrpe_certificate_check_discovery2026
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/usr/local/bin/check-nft]

Parameters differences:

--- File[/usr/local/bin/check-nft].orig
+++ File[/usr/local/bin/check-nft]

+    owner  => root
+    source => puppet:///modules/profile/firewall/check_nftables.py
+    group  => root
+    mode   => 0555
+    ensure => present

File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft].orig
+++ File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CUMIN_MASTERS_ipv4.nft.orig
+++ /etc/nftables/sets/CUMIN_MASTERS_ipv4.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set CUMIN_MASTERS_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.16.154,
+             10.192.32.49
+    }
+}

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-dse-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/aux]

Parameters differences:

--- File[/etc/cfssl/signers/aux].orig
+++ File[/etc/cfssl/signers/aux]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft.orig
+++ /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft
@@ -0,0 +1,12 @@
+# Autogenerated by puppet
+set MYSQL_ROOT_CLIENTS_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.16.90,
+             10.192.16.191,
+             10.64.16.154,
+             10.192.32.49,
+             208.80.155.103,
+             208.80.154.9,
+             10.64.0.20
+    }
+}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Service[cfssl-ocspserve@cloud_wmnet_ca]

Parameters differences:

--- Service[cfssl-ocspserve@cloud_wmnet_ca].orig
+++ Service[cfssl-ocspserve@cloud_wmnet_ca]

-    enable => True
-    ensure => running

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - wikikube_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_front_proxy' wikikube_front_proxy

Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@debmonitor]']

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

Nftables::Set[MYSQL_ROOT_CLIENTS]

Parameters differences:

--- Nftables::Set[MYSQL_ROOT_CLIENTS].orig
+++ Nftables::Set[MYSQL_ROOT_CLIENTS]

+    hosts  => ['10.64.16.90', '10.192.16.191', '10.64.16.154', '10.192.32.49', '208.80.155.103', '208.80.154.9', '10.64.0.20']
+    ensure => present

File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/INSTALL_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/INSTALL_HOSTS_ipv6.nft
@@ -0,0 +1,12 @@
+# Autogenerated by puppet
+set INSTALL_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:2:208:80:154:134,
+             2620:0:860:3:208:80:153:70,
+             2a02:ec80:300:3:185:15:59:101,
+             2620:0:863:3:198:35:26:98,
+             2001:df2:e500:1:103:102:166:11,
+             2a02:ec80:600:1:185:15:58:7,
+             2a02:ec80:700:3:195:200:68:100
+    }
+}

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Cfssl::Config[puppet_rsa]

Parameters differences:

--- Cfssl::Config[puppet_rsa].orig
+++ Cfssl::Config[puppet_rsa]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/puppet_rsa
-    path                => /etc/cfssl/signers/puppet_rsa/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/puppet_rsa

Nftables::Set[DRUID_PUBLIC_HOSTS]

Parameters differences:

--- Nftables::Set[DRUID_PUBLIC_HOSTS].orig
+++ Nftables::Set[DRUID_PUBLIC_HOSTS]

+    hosts  => ['10.64.131.9', '2620:0:861:10a:10:64:131:9', '10.64.132.12', '2620:0:861:10b:10:64:132:12', '10.64.135.9', '2620:0:861:10e:10:64:135:9', '10.64.32.101', '2620:0:861:103:10:64:32:101', '10.64.48.185', '2620:0:861:107:10:64:48:185']
+    ensure => present

Systemd::Timer::Job[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-etcd].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-etcd]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/etcd/ca/etcd.pem --responses-file /etc/cfssl/ocsp/etcd.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@etcd' etcd 
-    description               => OCSP Refresh job - etcd
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Systemd::Unit[cfssl-ocsprefresh-dse.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-dse.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-dse.timer]

-    unit              => cfssl-ocsprefresh-dse.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]

Parameters differences:

--- File[/etc/ferm/conf.d/10_csr_and_ocsp_responder].orig
+++ File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/10_csr_and_ocsp_responder.orig
+++ /etc/ferm/conf.d/10_csr_and_ocsp_responder
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 80, ($DOMAIN_NETWORKS $MGMT_NETWORKS));
-
-

Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]

Parameters differences:

--- File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf].orig
+++ File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]

-    notify => Service[apache2]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/apache2/sites-available/50-pki-discovery-wmnet.conf.orig
+++ /etc/apache2/sites-available/50-pki-discovery-wmnet.conf
@@ -1,149 +0,0 @@
-#####################################################################
-
-### THIS FILE IS MANAGED BY PUPPET
-#####################################################################
-# vim: filetype=apache
-<VirtualHost *:80>
-  ServerName pki.discovery.wmnet
-  ServerAlias pki1001.eqiad.wmnet
-  DocumentRoot /srv/cfssl
-
-  <Directory  /srv/cfssl>
-    Require all granted
-  </Directory>
-
-  <Location /metrics>
-    Require host prometheus1005.eqiad.wmnet prometheus1006.eqiad.wmnet prometheus1007.eqiad.wmnet prometheus1008.eqiad.wmnet
-    ProxyPass http://127.0.0.1:8888/metrics
-    ProxyPassReverse http://127.0.0.1:8888/metrics
-  </Location>
-
-  # Wikimedia_Internal_Root_CA
-  ProxyPass /ocsp/Wikimedia_Internal_Root_CA  http://localhost:10000/
-  ProxyPassReverse /ocsp/Wikimedia_Internal_Root_CA  http://localhost:10000/
-  # debmonitor
-  ProxyPass /ocsp/debmonitor  http://localhost:10001/
-  ProxyPassReverse /ocsp/debmonitor  http://localhost:10001/
-  # discovery
-  ProxyPass /ocsp/discovery  http://localhost:10002/
-  ProxyPassReverse /ocsp/discovery  http://localhost:10002/
-  # kafka
-  ProxyPass /ocsp/kafka  http://localhost:10003/
-  ProxyPassReverse /ocsp/kafka  http://localhost:10003/
-  # cloud_wmnet_ca
-  ProxyPass /ocsp/cloud_wmnet_ca  http://localhost:10004/
-  ProxyPassReverse /ocsp/cloud_wmnet_ca  http://localhost:10004/
-  # etcd
-  ProxyPass /ocsp/etcd  http://localhost:10005/
-  ProxyPassReverse /ocsp/etcd  http://localhost:10005/
-  # cassandra
-  ProxyPass /ocsp/cassandra  http://localhost:10006/
-  ProxyPassReverse /ocsp/cassandra  http://localhost:10006/
-  # syslog
-  ProxyPass /ocsp/syslog  http://localhost:10007/
-  ProxyPassReverse /ocsp/syslog  http://localhost:10007/
-  # puppet_rsa
-  ProxyPass /ocsp/puppet_rsa  http://localhost:10008/
-  ProxyPassReverse /ocsp/puppet_rsa  http://localhost:10008/
-  # zuul
-  ProxyPass /ocsp/zuul  http://localhost:10009/
-  ProxyPassReverse /ocsp/zuul  http://localhost:10009/
-  # discovery2026
-  ProxyPass /ocsp/discovery2026  http://localhost:10010/
-  ProxyPassReverse /ocsp/discovery2026  http://localhost:10010/
-  # wikikube
-  ProxyPass /ocsp/wikikube  http://localhost:20010/
-  ProxyPassReverse /ocsp/wikikube  http://localhost:20010/
-  # wikikube_front_proxy
-  ProxyPass /ocsp/wikikube_front_proxy  http://localhost:20011/
-  ProxyPassReverse /ocsp/wikikube_front_proxy  http://localhost:20011/
-  # wikikube_staging
-  ProxyPass /ocsp/wikikube_staging  http://localhost:20020/
-  ProxyPassReverse /ocsp/wikikube_staging  http://localhost:20020/
-  # wikikube_staging_front_proxy
-  ProxyPass /ocsp/wikikube_staging_front_proxy  http://localhost:20021/
-  ProxyPassReverse /ocsp/wikikube_staging_front_proxy  http://localhost:20021/
-  # mlserve
-  ProxyPass /ocsp/mlserve  http://localhost:20030/
-  ProxyPassReverse /ocsp/mlserve  http://localhost:20030/
-  # mlserve_front_proxy
-  ProxyPass /ocsp/mlserve_front_proxy  http://localhost:20031/
-  ProxyPassReverse /ocsp/mlserve_front_proxy  http://localhost:20031/
-  # mlserve_staging
-  ProxyPass /ocsp/mlserve_staging  http://localhost:20040/
-  ProxyPassReverse /ocsp/mlserve_staging  http://localhost:20040/
-  # mlserve_staging_front_proxy
-  ProxyPass /ocsp/mlserve_staging_front_proxy  http://localhost:20041/
-  ProxyPassReverse /ocsp/mlserve_staging_front_proxy  http://localhost:20041/
-  # aux
-  ProxyPass /ocsp/aux  http://localhost:20050/
-  ProxyPassReverse /ocsp/aux  http://localhost:20050/
-  # aux_front_proxy
-  ProxyPass /ocsp/aux_front_proxy  http://localhost:20051/
-  ProxyPassReverse /ocsp/aux_front_proxy  http://localhost:20051/
-  # dse
-  ProxyPass /ocsp/dse  http://localhost:20061/
-  ProxyPassReverse /ocsp/dse  http://localhost:20061/
-  # dse_front_proxy
-  ProxyPass /ocsp/dse_front_proxy  http://localhost:20062/
-  ProxyPassReverse /ocsp/dse_front_proxy  http://localhost:20062/
-  # network_devices
-  ProxyPass /ocsp/network_devices  http://localhost:20063/
-  ProxyPassReverse /ocsp/network_devices  http://localhost:20063/
-
-  LogLevel warn
-  ErrorLog /var/log/apache2/pki.discovery.wmnet_error.log
-  CustomLog /var/log/apache2/pki.discovery.wmnet_access.log wmf
-</VirtualHost>
-
-<VirtualHost *:443>
-  # Protected by client auth
-  ServerName pki.discovery.wmnet
-  ServerAlias pki1001.eqiad.wmnet
-  DocumentRoot /srv/cfssl
-
-  SSLEngine on
-  SSLCertificateFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem
-  SSLCertificateKeyFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem
-  SSLCertificateChainFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem
-  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
-  SSLCipherSuite -ALL:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
-  SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
-  SSLHonorCipherOrder On
-  SSLOpenSSLConfCmd DHParameters "/etc/ssl/dhparam.pem"
-  Header always set Strict-Transport-Security "max-age=106384710; includeSubDomains; preload"
-  SSLVerifyClient require
-  SSLVerifyDepth 2
-  SSLCACertificateFile /etc/ssl/localcerts/multiroot_ca.pem
-
-  ProxyPass /  http://127.0.0.1:8888/
-  ProxyPassReverse / http://127.0.0.1:8888/
-
-  LogLevel warn ssl:info
-  ErrorLog /var/log/apache2/pki.discovery.wmnet_ssl_error.log
-  CustomLog /var/log/apache2/pki.discovery.wmnet_ssl_access.log wmf
-</VirtualHost>
-<VirtualHost *:8443>
-  # Protected by iptables
-  ServerName pki.discovery.wmnet
-  ServerAlias pki1001.eqiad.wmnet
-  DocumentRoot /srv/cfssl
-
-  SSLEngine on
-  SSLCertificateFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem
-  SSLCertificateKeyFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem
-  SSLCertificateChainFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem
-  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
-  SSLCipherSuite -ALL:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
-  SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
-  SSLHonorCipherOrder On
-  SSLOpenSSLConfCmd DHParameters "/etc/ssl/dhparam.pem"
-  Header always set Strict-Transport-Security "max-age=106384710; includeSubDomains; preload"
-
-  ProxyPass /  http://127.0.0.1:8888/
-  ProxyPassReverse / http://127.0.0.1:8888/
-
-  LogLevel warn ssl:info
-  ErrorLog /var/log/apache2/pki.discovery.wmnet_k8s_error.log
-  CustomLog /var/log/apache2/pki.discovery.wmnet_k8s_access.log wmf
-</VirtualHost>

Systemd::Timer[prometheus-node-textfile-check-nft]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-check-nft].orig
+++ Systemd::Timer[prometheus-node-textfile-check-nft]

+    accuracy           => 15sec
+    splay              => 0
+    unit_name          => prometheus-node-textfile-check-nft.service
+    ensure             => present
+    fixed_random_delay => False
+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*:0/30'}]

Profile::Pki::Multirootca::Monitoring[wikikube_staging]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[wikikube_staging].orig
+++ Profile::Pki::Multirootca::Monitoring[wikikube_staging]

-    ca_file      => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => wikikube_staging

Systemd::Unit[wmf_auto_restart_ulogd2.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_ulogd2.timer].orig
+++ Systemd::Unit[wmf_auto_restart_ulogd2.timer]

-    unit              => wmf_auto_restart_ulogd2.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Nftables::Set[CLOUD_PRIVATE_NETWORKS]

Parameters differences:

--- Nftables::Set[CLOUD_PRIVATE_NETWORKS].orig
+++ Nftables::Set[CLOUD_PRIVATE_NETWORKS]

+    hosts  => ['172.20.1.0/24', '172.20.2.0/24', '172.20.3.0/24', '172.20.4.0/24', '2a02:ec80:a000:201::/64', '2a02:ec80:a000:202::/64', '2a02:ec80:a000:203::/64', '2a02:ec80:a000:204::/64', '172.20.5.0/24', '2a02:ec80:a100:205::/64']
+    ensure => present

Monitoring::Service[check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_wikikube_staging].orig
+++ Monitoring::Service[check_certificate_expiry_wikikube_staging]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_staging!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: wikikube_staging
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Class[Firewall]

Parameters differences:

--- Class[Firewall].orig
+++ Class[Firewall]

@@
-    provider => ferm
+    provider => nftables

File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Systemd::Timer[cfssl-ocsprefresh-aux]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-aux].orig
+++ Systemd::Timer[cfssl-ocsprefresh-aux]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-aux.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Exec[Generate cert puppet_rsa__pki_discovery_wmnet]

Parameters differences:

--- Exec[Generate cert puppet_rsa__pki_discovery_wmnet].orig
+++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet]

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet

-    notify      => ['Service[apache2]']
-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-wikikube-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_zuul.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Service[cfssl-ocspserve@cassandra]

Parameters differences:

--- Service[cfssl-ocspserve@cassandra].orig
+++ Service[cfssl-ocspserve@cassandra]

-    enable => True
-    ensure => running

File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-zuul.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-zuul.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-zuul.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-zuul.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Nftables::Set[LABSTORE_HOSTS]

Parameters differences:

--- Nftables::Set[LABSTORE_HOSTS].orig
+++ Nftables::Set[LABSTORE_HOSTS]

+    hosts  => ['208.80.154.142', '2620:0:861:2:208:80:154:142', '208.80.154.71', '2620:0:861:3:208:80:154:71']
+    ensure => present

Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]

-    unit              => cfssl-ocspserve@wikikube_front_proxy
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]

-    unit              => cfssl-ocsprefresh-mlserve_staging.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/ferm/conf.d]

Parameters differences:

--- File[/etc/ferm/conf.d].orig
+++ File[/etc/ferm/conf.d]

-    owner   => root
-    group   => adm
-    mode    => 0551
-    force   => True
-    require => Package[ferm]
-    recurse => True
-    purge   => True
-    notify  => Service[ferm]
-    ignore  => ['.*']
-    ensure  => directory

File[/var/log/cfssl-ocsprefresh-cassandra]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-cassandra].orig
+++ File[/var/log/cfssl-ocsprefresh-cassandra]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/logrotate.d/cfssl-ocsprefresh-aux]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-aux].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-aux]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-aux.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-aux
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-aux
-
-/var/log/cfssl-ocsprefresh-aux/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Rsyslog::Conf[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-zuul].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-zuul]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-zuul]

File[/etc/nftables.conf]

Parameters differences:

--- File[/etc/nftables.conf].orig
+++ File[/etc/nftables.conf]

+    group  => root
+    ensure => absent
+    owner  => root

File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]

-    group  => root
-    ensure => absent
-    owner  => root

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-wikikube_staging.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-wikikube_staging.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Monitoring::Exported_nagios_service[pki1001 ferm_active]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 ferm_active].orig
+++ Monitoring::Exported_nagios_service[pki1001 ferm_active]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 30
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_ferm_active!10
-    host_name              => pki1001
-    service_description    => Check whether ferm is active by checking the default input chain
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"wikikube_front_proxy"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/etc/cfssl/signers/dse/ca]

Parameters differences:

--- File[/etc/cfssl/signers/dse/ca].orig
+++ File[/etc/cfssl/signers/dse/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@aux_front_proxy]']

Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    ensure => present

Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Monitoring::Service[check_certificate_expiry_dse]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_dse].orig
+++ Monitoring::Service[check_certificate_expiry_dse]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_dse!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: dse
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/signers/network_devices]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices].orig
+++ File[/etc/cfssl/signers/network_devices]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-discovery2026-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom

Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => wikikube_staging_front_proxy
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@wikikube_staging_front_proxy]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Systemd::Syslog[wmf_auto_restart_apache2]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_apache2].orig
+++ Systemd::Syslog[wmf_auto_restart_apache2]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-dse_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom

File[/etc/cfssl/ocsp/wikikube.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/wikikube.ocsp].orig
+++ File[/etc/cfssl/ocsp/wikikube.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Nrpe::Monitor_service[check_certificate_expiry_discovery2026]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_discovery2026].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_discovery2026]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: discovery2026
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Timer::Job[wmf_auto_restart_apache2]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_apache2].orig
+++ Systemd::Timer::Job[wmf_auto_restart_apache2]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    require                   => File[/usr/local/sbin/wmf-auto-restart]
-    success_exit_status       => []
-    command                   => /usr/local/sbin/wmf-auto-restart -s apache2
-    description               => Auto restart job: apache2
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
+++ Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

-    unit              => cfssl-ocspserve@Wikimedia_Internal_Root_CA
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_syslog.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@wikikube.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@wikikube.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@wikikube.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (wikikube)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20010 \
-          -responses /etc/cfssl/ocsp/wikikube.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_cfssl-multirootca_status" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_discovery.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Nftables::Set[LABS_NETWORKS]

Parameters differences:

--- Nftables::Set[LABS_NETWORKS].orig
+++ Nftables::Set[LABS_NETWORKS]

+    hosts  => ['172.16.0.0/21', '172.16.128.0/24', '172.16.129.0/24', '172.16.130.0/24', '172.16.131.0/24', '172.16.16.0/21', '172.16.24.0/24', '172.16.8.0/21', '172.20.1.0/24', '172.20.2.0/24', '172.20.254.0/24', '172.20.255.0/24', '172.20.3.0/24', '172.20.4.0/24', '172.20.5.0/24', '185.15.56.0/25', '185.15.56.160/28', '185.15.57.0/29', '185.15.57.16/29', '185.15.57.24/29', '2a02:ec80:a000:100::/64', '2a02:ec80:a000:1::/64', '2a02:ec80:a000:201::/64', '2a02:ec80:a000:202::/64', '2a02:ec80:a000:203::/64', '2a02:ec80:a000:204::/64', '2a02:ec80:a000:2ff::/64', '2a02:ec80:a000:4000::/64', '2a02:ec80:a100:100::/64', '2a02:ec80:a100:1::/64', '2a02:ec80:a100:205::/64', '2a02:ec80:a100:2ff::/64', '2a02:ec80:a100:4000::/64']
+    ensure => present

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - puppet_rsa
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --responses-file /etc/cfssl/ocsp/puppet_rsa.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@puppet_rsa' puppet_rsa

Monitoring::Service[check_certificate_expiry_kafka]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_kafka].orig
+++ Monitoring::Service[check_certificate_expiry_kafka]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_kafka!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: kafka
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem].orig
+++ File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem.orig
+++ /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
-BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
-6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
-MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
-MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
-FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
-cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
-LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
-MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
-bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
-QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
-id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
-9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
------END CERTIFICATE-----

File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Service[cfssl-ocspserve@wikikube]

Parameters differences:

--- Service[cfssl-ocspserve@wikikube].orig
+++ Service[cfssl-ocspserve@wikikube]

-    enable => True
-    ensure => running

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-mlserve-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Service[cfssl-ocspserve@puppet_rsa]

Parameters differences:

--- Service[cfssl-ocspserve@puppet_rsa].orig
+++ Service[cfssl-ocspserve@puppet_rsa]

-    enable => True
-    ensure => running

Profile::Pki::Multirootca::Monitoring[etcd]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[etcd].orig
+++ Profile::Pki::Multirootca::Monitoring[etcd]

-    ca_file      => /etc/cfssl/signers/etcd/ca/etcd.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => etcd

Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@syslog]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Sudo::User[nrpe-check_check_cfssl-multirootca_status]

Parameters differences:

--- Sudo::User[nrpe-check_check_cfssl-multirootca_status].orig
+++ Sudo::User[nrpe-check_check_cfssl-multirootca_status]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft]

Parameters differences:

--- File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft].orig
+++ File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/input/10_full-monitoring-metrics-access-udp.nft.orig
+++ /etc/nftables/input/10_full-monitoring-metrics-access-udp.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr { 10.64.0.82, 10.64.16.62, 10.64.32.85, 10.64.48.171, 208.80.153.42, 208.80.154.78 } udp dport 1-65535 accept
+ip6 saddr { 2620:0:860:2:208:80:153:42, 2620:0:861:101:10:64:0:82, 2620:0:861:102:10:64:16:62, 2620:0:861:103:10:64:32:85, 2620:0:861:107:10:64:48:171, 2620:0:861:3:208:80:154:78 } udp dport 1-65535 accept

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/lib/systemd/system/nrpe2nodexp-ferm_active.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-ferm_active.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-ferm_active.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/nrpe2nodexp-ferm_active.service.orig
+++ /lib/systemd/system/nrpe2nodexp-ferm_active.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_ferm_active command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-ferm_active
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bba0a2572329bb500b832470e08b381c" --timeout 10 --check-command "check_ferm_active"

Logrotate::Conf[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-wikikube].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-wikikube]

-    ensure => present

File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "wmf_auto_restart_ulogd2" then {
-    action(
-        type="omfile" file="/var/log/wmf_auto_restart_ulogd2/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

Systemd::Syslog[wmf_auto_restart_ulogd2]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_ulogd2].orig
+++ Systemd::Syslog[wmf_auto_restart_ulogd2]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem].orig
+++ File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/debmonitor/ca/debmonitor.pem.orig
+++ /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
-AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
-M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
-WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
-BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
-TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
-EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
-dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
-HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
-bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
-XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
-y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
-EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
------END CERTIFICATE-----

Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-debmonitor].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-debmonitor]

Exec[Generate initial CRL for cassandra]

Parameters differences:

--- Exec[Generate initial CRL for cassandra].orig
+++ Exec[Generate initial CRL for cassandra]

-    creates => /srv/cfssl/crl/cassandra
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/cassandra/ca/cassandra.pem /etc/cfssl/signers/cassandra/ca/cassandra-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/cassandra
-    require => ['Package[golang-cfssl]']

File[/etc/nftables/input/10_ssh-from-cumin-masters.nft]

Parameters differences:

--- File[/etc/nftables/input/10_ssh-from-cumin-masters.nft].orig
+++ File[/etc/nftables/input/10_ssh-from-cumin-masters.nft]

+    tag     => nft
+    notify  => ['Service[nftables]']
+    owner   => root
+    ensure  => present
+    group   => root
+    mode    => 0444
+    require => ['Nftables::Set[CUMIN_MASTERS]']

Content differences:

--- /etc/nftables/input/10_ssh-from-cumin-masters.nft.orig
+++ /etc/nftables/input/10_ssh-from-cumin-masters.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr @CUMIN_MASTERS_ipv4 tcp dport { 22 } accept
+ip6 saddr @CUMIN_MASTERS_ipv6 tcp dport { 22 } accept

Prometheus::Blackbox::Check::Http[PKI_mlserve]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_mlserve].orig
+++ Prometheus::Blackbox::Check::Http[PKI_mlserve]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"mlserve"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft].orig
+++ File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft.orig
+++ /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft
@@ -0,0 +1,12 @@
+# Autogenerated by puppet
+set CLOUD_NETWORKS_PUBLIC_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 185.15.56.0/25,
+             185.15.56.160/28,
+             185.15.57.0/29,
+             185.15.57.16/29,
+             185.15.57.24/29
+    }
+}

File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Service[nrpe2nodexp-ferm_active]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-ferm_active].orig
+++ Systemd::Service[nrpe2nodexp-ferm_active]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-ferm_active.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[ensure_present_mod_access_compat]

Parameters differences:

--- Exec[ensure_present_mod_access_compat].orig
+++ Exec[ensure_present_mod_access_compat]

-    creates => /etc/apache2/mods-enabled/access_compat.load
-    command => /usr/sbin/a2enmod access_compat
-    notify  => Service[apache2]
-    require => Package[apache2]

File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer]

+    notify => Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-check-nft.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-check-nft.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of prometheus-node-textfile-check-nft.service
+
+[Timer]
+Unit=prometheus-node-textfile-check-nft.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*:0/30
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    ensure => present

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_aux]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_wikikube_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem

File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
@@ -1 +0,0 @@
-nosecret

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/discovery]

Parameters differences:

--- File[/etc/cfssl/signers/discovery].orig
+++ File[/etc/cfssl/signers/discovery]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/cfssl/signers/mlserve_staging]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging].orig
+++ File[/etc/cfssl/signers/mlserve_staging]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[cfssl-ocspserve@dse_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@dse_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@dse_front_proxy]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_dse_front_proxy
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "2560f4f577ba169af651cf96bd5dc1ba" --timeout 10 --check-command "check_check_certificate_expiry_dse_front_proxy"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_dse_front_proxy command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/log/cfssl-ocsprefresh-mlserve]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-mlserve].orig
+++ File[/var/log/cfssl-ocsprefresh-mlserve]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Timer::Job[prometheus-node-textfile-check-nft]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-check-nft].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-check-nft]

+    user                      => root
+    logfile_group             => root
+    send_mail_only_on_error   => True
+    send_mail                 => False
+    success_exit_status       => []
+    command                   => /usr/local/bin/check-nft
+    description               => Systemd timer to gather node metrics for check-nft
+    syslog_force_stop         => True
+    monitoring_contact_groups => admins
+    interval                  => {'start': 'OnCalendar', 'interval': '*:0/30'}
+    logfile_perms             => all
+    logging_enabled           => True
+    syslog_match_startswith   => True
+    logfile_name              => syslog.log
+    send_mail_to              => root@pki1001.eqiad.wmnet
+    environment               => {}
+    private_tmp               => False
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    ignore_errors             => False
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    logfile_basedir           => /var/log
+    ensure                    => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-dse-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/apache2/conf-enabled/00-defaults.conf]

Parameters differences:

--- File[/etc/apache2/conf-enabled/00-defaults.conf].orig
+++ File[/etc/apache2/conf-enabled/00-defaults.conf]

-    target => /etc/apache2/conf-available/00-defaults.conf
-    owner  => root
-    notify => Service[apache2]
-    group  => root
-    ensure => link

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
@@ -1 +0,0 @@
-test

Nrpe::Check[check_check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_wikikube_staging].orig
+++ Nrpe::Check[check_check_certificate_expiry_wikikube_staging]

-    before    => Monitoring::Service[check_certificate_expiry_wikikube_staging]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    ensure    => present
-    sudo_user => root

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => mlserve_staging
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@mlserve_staging]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Prometheus::Blackbox::Check::Http[PKI_debmonitor]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_debmonitor].orig
+++ Prometheus::Blackbox::Check::Http[PKI_debmonitor]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"debmonitor"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Service[cfssl-ocspserve@etcd]

Parameters differences:

--- Service[cfssl-ocspserve@etcd].orig
+++ Service[cfssl-ocspserve@etcd]

-    enable => True
-    ensure => running

File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]

-    group  => root
-    ensure => absent
-    owner  => root

File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/signers/cloud_wmnet_ca/ca]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca/ca].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

Class[Ferm]

Parameters differences:

--- Class[Ferm].orig
+++ Class[Ferm]

@@
-    ensure => present
+    ensure => absent

File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status].orig
+++ File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]

-    owner   => root
-    group   => root
-    ensure  => absent
-    require => Package[nagios-nrpe-server]

Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/default/ferm]

Parameters differences:

--- File[/etc/default/ferm].orig
+++ File[/etc/default/ferm]

-    notify  => Service[ferm]
-    owner   => root
-    ensure  => file
-    source  => puppet:///modules/ferm/ferm.default
-    group   => root
-    mode    => 0400
-    require => Package[ferm]

Cfssl::Ocsp[cloud_wmnet_ca]

Parameters differences:

--- Cfssl::Ocsp[cloud_wmnet_ca].orig
+++ Cfssl::Ocsp[cloud_wmnet_ca]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10004
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-aux_front_proxy
-
-/var/log/cfssl-ocsprefresh-aux_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/var/log/cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-aux_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-aux_front_proxy]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_staging_front_proxy!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_syslog.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_aux_front_proxy
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "99cf4f8f014e8fd527800abcc213f494" --timeout 10 --check-command "check_check_certificate_expiry_aux_front_proxy"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_aux_front_proxy command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Monitoring::Service[check_certificate_expiry_discovery]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_discovery].orig
+++ Monitoring::Service[check_certificate_expiry_discovery]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_discovery!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: discovery
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@wikikube_staging_front_proxy]']

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_discovery2026" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "d2a76a31e44e204e2d4788a2698d0e6c" --timeout 10 --check-command "check_check_certificate_expiry_wikikube"

File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MGMT_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/MGMT_NETWORKS_ipv6.nft
@@ -0,0 +1,4 @@
+# Autogenerated by puppet
+set MGMT_NETWORKS_ipv6 {
+    type ipv6_addr
+}

File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@puppet_rsa.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@puppet_rsa.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (puppet_rsa)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10008 \
-          -responses /etc/cfssl/ocsp/puppet_rsa.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-network_devices.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-network_devices
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-network_devices
-
-/var/log/cfssl-ocsprefresh-network_devices/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Nftables::Set[SANDBOX_NETWORKS]

Parameters differences:

--- Nftables::Set[SANDBOX_NETWORKS].orig
+++ Nftables::Set[SANDBOX_NETWORKS]

+    hosts  => ['103.102.166.72/29', '185.15.59.72/29', '195.200.68.64/29', '198.35.26.240/28', '2001:df2:e500:202::/64', '208.80.152.240/28', '208.80.155.64/28', '2620:0:860:201::/64', '2620:0:861:202::/64', '2620:0:863:201::/64', '2a02:ec80:300:202::/64', '2a02:ec80:700:201::/64']
+    ensure => present

Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_aux_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_aux_front_proxy]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    ensure    => present
-    sudo_user => root

Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --responses-file /etc/cfssl/ocsp/dse_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse_front_proxy' dse_front_proxy 
-    description               => OCSP Refresh job - dse_front_proxy
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    ensure => present

Monitoring::Service[check_certificate_expiry_mlserve]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_mlserve].orig
+++ Monitoring::Service[check_certificate_expiry_mlserve]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_mlserve!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: mlserve
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/etc/systemd/system/nftables.service.d/puppet-override.conf]

Parameters differences:

--- File[/etc/systemd/system/nftables.service.d/puppet-override.conf].orig
+++ File[/etc/systemd/system/nftables.service.d/puppet-override.conf]

+    notify => Exec[systemd daemon-reload for nftables.service (nftables)]
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/systemd/system/nftables.service.d/puppet-override.conf.orig
+++ /etc/systemd/system/nftables.service.d/puppet-override.conf
@@ -0,0 +1,5 @@
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/nft -f /etc/nftables/main.nft
+ExecReload=
+ExecReload=/usr/sbin/nft -f /etc/nftables/main.nft

Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]

-    unit              => cfssl-ocsprefresh-wikikube.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Service[cfssl-ocspserve@wikikube_staging_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@wikikube_staging_front_proxy].orig
+++ Service[cfssl-ocspserve@wikikube_staging_front_proxy]

-    enable => True
-    ensure => running

Class[Adduser]

Parameters differences:

--- Class[Adduser].orig
+++ Class[Adduser]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[apache2]', 'Package[links]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[python3-pymysql]', 'Package[python3-cryptography]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Cfssl::Signer[mlserve_staging]

Parameters differences:

--- Cfssl::Signer[mlserve_staging].orig
+++ Cfssl::Signer[mlserve_staging]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 72h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_staging
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_staging
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Service[cfssl-ocsprefresh-debmonitor.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-debmonitor.timer].orig
+++ Service[cfssl-ocsprefresh-debmonitor.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Service[cfssl-ocspserve@wikikube]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@wikikube].orig
+++ Systemd::Service[cfssl-ocspserve@wikikube]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@network_devices.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@network_devices.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@network_devices.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (network_devices)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20063 \
-          -responses /etc/cfssl/ocsp/network_devices.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-network_devices].orig
+++ Systemd::Service[cfssl-ocsprefresh-network_devices]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-network_devices.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-gc-expired-certs.conf.orig
+++ /etc/rsyslog.d/40-cfssl-gc-expired-certs.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-gc-expired-certs" then {
-    action(
-        type="omfile" file="/var/log/cfssl-gc-expired-certs/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Nftables::Set[DEPLOYMENT_HOSTS]

Parameters differences:

--- Nftables::Set[DEPLOYMENT_HOSTS].orig
+++ Nftables::Set[DEPLOYMENT_HOSTS]

+    hosts  => ['10.64.16.93', '2620:0:861:102:10:64:16:93', '10.192.32.7', '2620:0:860:103:10:192:32:7']
+    ensure => present

File[/etc/sudoers.d/nrpe-check_ferm_active]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_ferm_active].orig
+++ File[/etc/sudoers.d/nrpe-check_ferm_active]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_ferm_active.orig
+++ /etc/sudoers.d/nrpe-check_ferm_active
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/local/lib/nagios/plugins/check_ferm

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[update_alternative_ip6tables]

Parameters differences:

--- Exec[update_alternative_ip6tables].orig
+++ Exec[update_alternative_ip6tables]

-    command => /usr/bin/update-alternatives --force --set ip6tables /usr/sbin/ip6tables-legacy
-    unless  => /usr/bin/update-alternatives --query ip6tables | /bin/grep 'Value: /usr/sbin/ip6tables-legacy'

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-kafka].orig
+++ Systemd::Service[cfssl-ocsprefresh-kafka]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-kafka.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-etcd-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/ocsp/mlserve.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/mlserve.ocsp].orig
+++ File[/etc/cfssl/ocsp/mlserve.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Systemd::Service[wmf_auto_restart_apache2]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_apache2].orig
+++ Systemd::Service[wmf_auto_restart_apache2]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[wmf_auto_restart_apache2.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

Systemd::Syslog[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-cassandra].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-cassandra]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/cfssl/signers/etcd/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/etcd/cfssl.conf].orig
+++ File[/etc/cfssl/signers/etcd/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/etcd/cfssl.conf.orig
+++ /etc/cfssl/signers/etcd/cfssl.conf
@@ -1,65 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/etcd",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/etcd"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Sudo::User[nrpe_certificate_check_wikikube_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_wikikube_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_wikikube_front_proxy]

-    user       => nrpe_certificate_check_wikikube_front_proxy
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-aux_front_proxy]

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp]

Parameters differences:

--- File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp].orig
+++ File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp.orig
+++ /etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 1:65535, (10.64.0.82 10.64.16.62 10.64.32.85 10.64.48.171 208.80.153.42 208.80.154.78 2620:0:860:2:208:80:153:42 2620:0:861:101:10:64:0:82 2620:0:861:102:10:64:16:62 2620:0:861:103:10:64:32:85 2620:0:861:107:10:64:48:171 2620:0:861:3:208:80:154:78));
-
-

Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_cloud_wmnet_ca!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/etc/cfssl/signers/dse_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/dse_front_proxy/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Rsyslog::Conf[wmf_auto_restart_apache2]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_apache2].orig
+++ Rsyslog::Conf[wmf_auto_restart_apache2]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/wmf_auto_restart_apache2]

Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-network_devices].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/network_devices/ca/network_devices.pem --responses-file /etc/cfssl/ocsp/network_devices.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@network_devices' network_devices 
-    description               => OCSP Refresh job - network_devices
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set STAGING_KUBEPODS_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:861:babe::/64,
+             2620:0:860:babe::/64
+    }
+}

File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (Wikimedia_Internal_Root_CA)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10000 \
-          -responses /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]

-    before      => ['Service[cfssl-ocsprefresh-kafka.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/aux/ca/aux.pem]

Parameters differences:

--- File[/etc/cfssl/signers/aux/ca/aux.pem].orig
+++ File[/etc/cfssl/signers/aux/ca/aux.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/aux/ca/aux.pem.orig
+++ /etc/cfssl/signers/aux/ca/aux.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
-h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
-sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
-QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
-/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
-1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
-BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
-bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
-oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
-bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
-tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
-Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
-A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
------END CERTIFICATE-----

Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Sudo::User[nrpe-check_check_certificate_expiry_discovery]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_discovery].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_discovery]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-wikikube_front_proxy
-
-/var/log/cfssl-ocsprefresh-wikikube_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft
@@ -0,0 +1,189 @@
+# Autogenerated by puppet
+set PRODUCTION_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.128.0.0/24,
+             10.128.1.0/24,
+             10.128.2.0/24,
+             10.132.0.0/24,
+             10.132.2.0/24,
+             10.136.0.0/24,
+             10.136.1.0/24,
+             10.140.0.0/24,
+             10.140.1.0/24,
+             10.140.2.0/24,
+             10.192.0.0/22,
+             10.192.10.0/24,
+             10.192.11.0/24,
+             10.192.12.0/24,
+             10.192.13.0/24,
+             10.192.14.0/24,
+             10.192.15.0/24,
+             10.192.16.0/22,
+             10.192.20.0/24,
+             10.192.21.0/24,
+             10.192.22.0/24,
+             10.192.23.0/24,
+             10.192.24.0/23,
+             10.192.26.0/24,
+             10.192.27.0/24,
+             10.192.28.0/24,
+             10.192.29.0/24,
+             10.192.30.0/24,
+             10.192.31.0/24,
+             10.192.32.0/22,
+             10.192.36.0/24,
+             10.192.37.0/24,
+             10.192.38.0/24,
+             10.192.39.0/24,
+             10.192.4.0/24,
+             10.192.40.0/24,
+             10.192.41.0/24,
+             10.192.42.0/24,
+             10.192.43.0/24,
+             10.192.44.0/24,
+             10.192.45.0/24,
+             10.192.46.0/24,
+             10.192.47.0/24,
+             10.192.48.0/22,
+             10.192.5.0/24,
+             10.192.52.0/24,
+             10.192.56.0/24,
+             10.192.57.0/24,
+             10.192.58.0/24,
+             10.192.59.0/24,
+             10.192.6.0/24,
+             10.192.64.0/21,
+             10.192.7.0/24,
+             10.192.72.0/24,
+             10.192.76.0/24,
+             10.192.8.0/24,
+             10.192.80.0/20,
+             10.192.9.0/24,
+             10.192.96.0/21,
+             10.194.0.0/20,
+             10.194.128.0/17,
+             10.194.16.0/21,
+             10.194.61.0/24,
+             10.194.62.0/23,
+             10.194.64.0/20,
+             10.194.80.0/21,
+             10.2.1.0/24,
+             10.2.2.0/24,
+             10.2.3.0/24,
+             10.2.4.0/24,
+             10.2.5.0/24,
+             10.2.6.0/24,
+             10.2.7.0/24,
+             10.64.0.0/22,
+             10.64.130.0/24,
+             10.64.131.0/24,
+             10.64.132.0/24,
+             10.64.133.0/24,
+             10.64.134.0/24,
+             10.64.135.0/24,
+             10.64.136.0/24,
+             10.64.137.0/24,
+             10.64.138.0/24,
+             10.64.139.0/24,
+             10.64.140.0/24,
+             10.64.141.0/24,
+             10.64.142.0/24,
+             10.64.143.0/24,
+             10.64.144.0/24,
+             10.64.145.0/24,
+             10.64.148.0/24,
+             10.64.149.0/24,
+             10.64.150.0/24,
+             10.64.151.0/24,
+             10.64.152.0/24,
+             10.64.153.0/24,
+             10.64.154.0/24,
+             10.64.155.0/24,
+             10.64.156.0/24,
+             10.64.157.0/24,
+             10.64.158.0/24,
+             10.64.159.0/24,
+             10.64.16.0/22,
+             10.64.160.0/24,
+             10.64.161.0/24,
+             10.64.162.0/24,
+             10.64.163.0/24,
+             10.64.164.0/24,
+             10.64.165.0/24,
+             10.64.166.0/24,
+             10.64.167.0/24,
+             10.64.169.0/24,
+             10.64.170.0/24,
+             10.64.171.0/24,
+             10.64.172.0/24,
+             10.64.173.0/24,
+             10.64.174.0/24,
+             10.64.175.0/24,
+             10.64.176.0/24,
+             10.64.177.0/24,
+             10.64.178.0/24,
+             10.64.179.0/24,
+             10.64.180.0/24,
+             10.64.181.0/24,
+             10.64.182.0/24,
+             10.64.183.0/24,
+             10.64.184.0/24,
+             10.64.185.0/24,
+             10.64.186.0/24,
+             10.64.187.0/24,
+             10.64.188.0/24,
+             10.64.189.0/24,
+             10.64.190.0/24,
+             10.64.20.0/24,
+             10.64.21.0/24,
+             10.64.24.0/23,
+             10.64.32.0/22,
+             10.64.36.0/24,
+             10.64.48.0/22,
+             10.64.5.0/24,
+             10.64.53.0/24,
+             10.64.64.0/21,
+             10.64.72.0/24,
+             10.64.76.0/24,
+             10.67.0.0/20,
+             10.67.128.0/17,
+             10.67.16.0/21,
+             10.67.24.0/21,
+             10.67.32.0/20,
+             10.67.64.0/20,
+             10.67.80.0/21,
+             10.80.0.0/24,
+             10.80.1.0/24,
+             10.80.2.0/24,
+             103.102.166.0/28,
+             103.102.166.224/27,
+             103.102.166.96/27,
+             185.15.58.0/27,
+             185.15.58.224/27,
+             185.15.58.32/27,
+             185.15.59.0/27,
+             185.15.59.224/27,
+             185.15.59.32/27,
+             185.15.59.96/27,
+             195.200.68.0/27,
+             195.200.68.224/27,
+             195.200.68.32/27,
+             195.200.68.96/27,
+             198.35.26.0/27,
+             198.35.26.32/27,
+             198.35.26.96/27,
+             208.80.152.128/27,
+             208.80.153.0/27,
+             208.80.153.224/27,
+             208.80.153.32/27,
+             208.80.153.64/27,
+             208.80.153.96/27,
+             208.80.154.0/26,
+             208.80.154.128/26,
+             208.80.154.224/27,
+             208.80.154.64/26,
+             208.80.155.96/27
+    }
+}

File[/etc/cfssl/signers/etcd/ca/etcd.pem]

Parameters differences:

--- File[/etc/cfssl/signers/etcd/ca/etcd.pem].orig
+++ File[/etc/cfssl/signers/etcd/ca/etcd.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/etcd/ca/etcd.pem.orig
+++ /etc/cfssl/signers/etcd/ca/etcd.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
-7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
-ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
-N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
-Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
-ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
-KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
-bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
-P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
-SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
-4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
-jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
-UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
------END CERTIFICATE-----

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-Wikimedia_Internal_Root_CA" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-cassandra.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]

-    unit              => cfssl-ocsprefresh-cassandra.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]

-    before      => ['Service[wmf_auto_restart_apache2.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/dse]

Parameters differences:

--- File[/etc/cfssl/signers/dse].orig
+++ File[/etc/cfssl/signers/dse]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set AUX_KUBEPODS_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.67.80.0/21,
+             10.194.80.0/21
+    }
+}

File[/etc/sudoers.d/nrpe_certificate_check_dse]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_dse].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_dse]

-    group  => root
-    ensure => absent
-    owner  => root

Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@wikikube_staging]']

Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean].orig
+++ Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]

-    priority => 40
-    mode     => 0444
-    ensure   => absent
-    require  => File[/var/log/wmf_auto_restart_apache-htcacheclean]

File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft
@@ -0,0 +1,8 @@
+# Autogenerated by puppet
+set MLSTAGE_KUBEPODS_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.194.61.0/24
+    }
+}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_cassandra.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => aux
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-aux]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@aux]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]

-    before      => ['Service[cfssl-ocsprefresh-zuul.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Sudo::User[nrpe-check_ferm_active]

Parameters differences:

--- Sudo::User[nrpe-check_ferm_active].orig
+++ Sudo::User[nrpe-check_ferm_active]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/local/lib/nagios/plugins/check_ferm']
-    ensure     => present
-    require    => ['Class[Sudo]']

Systemd::Service[cfssl-multirootca]

Parameters differences:

--- Systemd::Service[cfssl-multirootca].orig
+++ Systemd::Service[cfssl-multirootca]

-    unit_type                => service
-    monitoring_enabled       => True
-    monitoring_critical      => True
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    monitoring_notes_url     => https://wikitech.wikimedia.org/wiki/PKI
-    migration_task           => T350694
-    ensure                   => present

Systemd::Syslog[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-discovery2026].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-discovery2026]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_staging-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_discovery2026]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-mlserve_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-mlserve_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[Generate initial CRL for syslog]

Parameters differences:

--- Exec[Generate initial CRL for syslog].orig
+++ Exec[Generate initial CRL for syslog]

-    creates => /srv/cfssl/crl/syslog
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/syslog/ca/syslog.pem /etc/cfssl/signers/syslog/ca/syslog-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/syslog
-    require => ['Package[golang-cfssl]']

File[/var/log/cfssl-ocsprefresh-aux]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-aux].orig
+++ File[/var/log/cfssl-ocsprefresh-aux]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]

-    before      => ['Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Ferm::Service[full_monitoring_metrics_access_udp]

Parameters differences:

--- Ferm::Service[full_monitoring_metrics_access_udp].orig
+++ Ferm::Service[full_monitoring_metrics_access_udp]

-    unrestricted_access => False
-    port_range          => [1, 65535]
-    prio                => 10
-    desc                => 
-    proto               => udp
-    notrack             => False
-    ensure              => present
-    srange              => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet', '208.80.154.78', '2620:0:861:3:208:80:154:78', '208.80.153.42', '2620:0:860:2:208:80:153:42']

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Monitoring::Exported_nagios_service[pki1001 raid_md]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 raid_md].orig
+++ Monitoring::Exported_nagios_service[pki1001 raid_md]

@@
-    servicegroups         => pki_eqiad
+    servicegroups         => insetup_eqiad
@@
-    notifications_enabled => 1
+    notifications_enabled => 0

Systemd::Timer::Job[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-zuul].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-zuul]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/zuul/ca/zuul.pem --responses-file /etc/cfssl/ocsp/zuul.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@zuul' zuul 
-    description               => OCSP Refresh job - zuul
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_dse.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Nrpe::Monitor_service[check_certificate_expiry_cassandra]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_cassandra].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_cassandra]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: cassandra
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_kafka" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Syslog[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-wikikube].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-wikikube]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Systemd::Timer[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-cassandra].orig
+++ Systemd::Timer[cfssl-ocsprefresh-cassandra]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-cassandra.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem.orig
+++ /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
-gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
-BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
-h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
-6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
-o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
-VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
-/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
-L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
-dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
-dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
-MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
-lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
-EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
------END CERTIFICATE-----

File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-syslog].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-syslog.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-syslog
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-syslog
-
-/var/log/cfssl-ocsprefresh-syslog/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca].orig
+++ Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]

-    ca_file      => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => cloud_wmnet_ca

Service[cfssl-ocsprefresh-etcd.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-etcd.timer].orig
+++ Service[cfssl-ocsprefresh-etcd.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Unit[cfssl-ocsprefresh-cassandra.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-cassandra.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-cassandra.service]

-    unit              => cfssl-ocsprefresh-cassandra.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_puppet_rsa
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "c1b324b3d8ac107f8d7483b4017f5edf" --timeout 10 --check-command "check_check_certificate_expiry_puppet_rsa"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_puppet_rsa command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => puppet_rsa
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@puppet_rsa]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft].orig
+++ File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/NETWORK_INFRA_ipv4.nft.orig
+++ /etc/nftables/sets/NETWORK_INFRA_ipv4.nft
@@ -0,0 +1,19 @@
+# Autogenerated by puppet
+set NETWORK_INFRA_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 185.15.59.128/27,
+             198.35.26.128/27,
+             208.80.153.192/27,
+             10.192.255.0/24,
+             10.192.253.0/24,
+             208.80.154.192/27,
+             10.64.146.0/24,
+             10.64.168.0/24,
+             10.64.147.0/24,
+             103.102.166.128/27,
+             185.15.58.128/27,
+             195.200.68.128/27
+    }
+}

File[/var/log/cfssl-ocsprefresh-etcd]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-etcd].orig
+++ File[/var/log/cfssl-ocsprefresh-etcd]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
+++ Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-aux_front_proxy.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/var/log/cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-debmonitor].orig
+++ File[/var/log/cfssl-ocsprefresh-debmonitor]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/signers/debmonitor/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor/cfssl.conf].orig
+++ File[/etc/cfssl/signers/debmonitor/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/debmonitor/cfssl.conf.orig
+++ /etc/cfssl/signers/debmonitor/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/debmonitor",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/debmonitor"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]

-    ensure => present

Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]

-    before      => ['Service[wmf_auto_restart_ulogd2.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft
@@ -0,0 +1,13 @@
+# Autogenerated by puppet
+set SANDBOX_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 103.102.166.72/29,
+             185.15.59.72/29,
+             195.200.68.64/29,
+             198.35.26.240/28,
+             208.80.152.240/28,
+             208.80.155.64/28
+    }
+}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_aux_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_aux_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "99cf4f8f014e8fd527800abcc213f494" --timeout 10 --check-command "check_check_certificate_expiry_aux_front_proxy"

File[/etc/cfssl/ocsp/network_devices.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/network_devices.ocsp].orig
+++ File[/etc/cfssl/ocsp/network_devices.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Systemd::Timer::Job[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-kafka].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-kafka]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/kafka/ca/kafka.pem --responses-file /etc/cfssl/ocsp/kafka.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@kafka' kafka 
-    description               => OCSP Refresh job - kafka
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-network_devices" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-network_devices/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-kafka.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-kafka.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-kafka.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-kafka.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_kafka.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/kafka/ca/kafka-key.pem].orig
+++ File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

File[/etc/cfssl/signers/aux_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy].orig
+++ File[/etc/cfssl/signers/aux_front_proxy]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

-    unit              => cfssl-ocsprefresh-wikikube_staging_front_proxy.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_front_proxy!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Cfssl::Ocsp[syslog]

Parameters differences:

--- Cfssl::Ocsp[syslog].orig
+++ Cfssl::Ocsp[syslog]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/syslog/ca/syslog.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10007
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Ferm::Service[csr_and_ocsp_responder]

Parameters differences:

--- Ferm::Service[csr_and_ocsp_responder].orig
+++ Ferm::Service[csr_and_ocsp_responder]

-    src_sets            => ['DOMAIN_NETWORKS', 'MGMT_NETWORKS']
-    unrestricted_access => False
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    ensure              => present
-    port                => 80

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service].orig
+++ Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]

-    unit              => wmf_auto_restart_apache-htcacheclean.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/syslog/ca/syslog-key.pem].orig
+++ File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/syslog/ca/syslog-key.pem.orig
+++ /etc/cfssl/signers/syslog/ca/syslog-key.pem
@@ -1 +0,0 @@
-nosecret

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nftables/sets/INTERNAL_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/INTERNAL_ipv6.nft].orig
+++ File[/etc/nftables/sets/INTERNAL_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/INTERNAL_ipv6.nft.orig
+++ /etc/nftables/sets/INTERNAL_ipv6.nft
@@ -0,0 +1,15 @@
+# Autogenerated by puppet
+set INTERNAL_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:860:100::/56,
+             2620:0:861:100::/56,
+             2620:0:863:100::/56,
+             2a02:ec80:300:100::/56,
+             2a02:ec80:600:100::/56,
+             2a02:ec80:700:100::/56,
+             2001:df2:e500:100::/56,
+             2a02:ec80:ff00:100::/56
+    }
+}

Rsyslog::Conf[ulogd]

Parameters differences:

--- Rsyslog::Conf[ulogd].orig
+++ Rsyslog::Conf[ulogd]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/ulogd]

Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Unit[cfssl-ocsprefresh-discovery.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-discovery.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-discovery.service]

-    unit              => cfssl-ocsprefresh-discovery.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Ferm::Service[ssh_from_bastion]

Parameters differences:

--- Ferm::Service[ssh_from_bastion].orig
+++ Ferm::Service[ssh_from_bastion]

-    unrestricted_access => False
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    port                => 22
-    ensure              => present
-    srange              => ['208.80.154.7', '2620:0:861:1:208:80:154:7', '208.80.153.110', '2a02:ec80:300:3:185:15:59:99', '185.15.59.99', '2620:0:860:4:208:80:153:110', '198.35.26.104', '2620:0:863:3:198:35:26:104', '103.102.166.103', '2001:df2:e500:3:103:102:166:103', '185.15.58.6', '2a02:ec80:600:1:185:15:58:6', '195.200.68.99', '2a02:ec80:700:3:195:200:68:99']

Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS]

Parameters differences:

--- Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS].orig
+++ Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS]

+    hosts  => ['10.64.0.136', '10.64.16.60', '10.64.158.19', '10.64.166.19', '10.64.133.19', '10.64.141.19', '10.64.169.19', '10.64.171.19', '10.64.173.19', '10.64.175.19', '10.64.177.19', '10.64.179.19', '10.64.181.19', '10.64.183.19', '10.64.185.19', '10.64.187.19', '10.64.189.19', '10.64.48.72', '10.64.37.17', '10.64.1.17', '10.64.17.17', '10.64.33.17', '10.64.130.20', '10.64.131.20', '10.64.132.20', '10.64.134.20', '10.64.135.20', '10.64.136.20', '10.64.158.20', '10.64.166.20', '10.64.133.20', '10.64.141.20', '10.64.169.20', '10.64.171.20', '10.64.173.20', '10.64.175.20', '10.64.177.20', '10.64.179.20', '10.64.181.20', '10.64.183.20', '10.64.185.20', '10.64.187.20', '10.64.189.20', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:107::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:119::/64', '2620:0:861:10c::/64', '2620:0:861:113::/64', '2620:0:861:119::/64', '2620:0:861:131::/64', '2620:0:861:133::/64', '2620:0:861:135::/64', '2620:0:861:137::/64', '2620:0:861:139::/64', '2620:0:861:13b::/64', '2620:0:861:13d::/64', '2620:0:861:13f::/64', '2620:0:861:142::/64', '2620:0:861:144::/64', '10.192.23.8', '10.192.0.29', '10.192.17.8', '10.192.33.8', '10.192.49.8', '10.192.23.2', '10.192.5.2', '10.192.6.2', '10.192.7.2', '10.192.8.2', '10.192.9.2', '10.192.10.2', '10.192.11.2', '10.192.12.2', '10.192.13.2', '10.192.14.2', '10.192.15.2', '10.192.21.2', '10.192.22.2', '10.192.4.2', '10.192.26.2', '10.192.27.2', '10.192.28.2', '10.192.29.2', '10.192.30.2', '10.192.31.2', '10.192.36.2', '10.192.37.2', '10.192.38.2', '10.192.39.2', '10.192.40.2', '10.192.41.2', '10.192.42.2', '10.192.43.2', '10.192.11.8', '10.192.16.140', '10.192.1.8', '10.192.33.9', '10.192.49.9', '10.192.23.3', '10.192.5.3', '10.192.6.3', '10.192.7.3', '10.192.8.3', '10.192.9.3', '10.192.10.3', '10.192.11.3', '10.192.12.3', '10.192.13.3', '10.192.14.3', '10.192.15.3', '10.192.21.3', '10.192.22.3', '10.192.4.3', '10.192.26.3', '10.192.27.3', '10.192.28.3', '10.192.29.3', '10.192.30.3', '10.192.31.3', '10.192.36.3', '10.192.37.3', '10.192.38.3', '10.192.39.4', '10.192.40.3', '10.192.41.3', '10.192.42.3', '10.192.43.3', '10.192.32.14', '10.192.1.9', '10.192.17.9', '10.192.49.10', '10.192.23.4', '10.192.5.4', '10.192.6.4', '10.192.7.4', '10.192.8.4', '10.192.9.4', '10.192.10.4', '10.192.11.4', '10.192.12.4', '10.192.13.4', '10.192.14.4', '10.192.15.4', '10.192.21.4', '10.192.22.4', '10.192.4.5', '10.192.26.5', '10.192.27.5', '10.192.28.5', '10.192.29.5', '10.192.30.5', '10.192.31.5', '10.192.36.5', '10.192.37.5', '10.192.38.5', '10.192.39.6', '10.192.40.5', '10.192.41.5', '10.192.42.5', '10.192.43.5', '10.192.48.213', '10.192.1.13', '10.192.17.10', '10.192.33.10', '10.192.23.5', '10.192.5.8', '10.192.6.5', '10.192.7.5', '10.192.8.5', '10.192.9.5', '10.192.10.5', '10.192.11.5', '10.192.12.5', '10.192.13.5', '10.192.14.5', '10.192.15.5', '10.192.21.5', '10.192.22.5', '10.192.4.5', '10.192.26.5', '10.192.27.5', '10.192.28.5', '10.192.29.5', '10.192.30.5', '10.192.31.5', '10.192.36.5', '10.192.37.5', '10.192.38.5', '10.192.39.6', '10.192.40.5', '10.192.41.5', '10.192.42.5', '10.192.43.5', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '10.80.0.3', '10.80.1.8', '10.80.1.14', '10.80.0.9', '10.80.0.2', '10.80.1.10', '2a02:ec80:300:101::/64', '2a02:ec80:300:102::/64', '10.128.0.18', '10.128.0.9', '10.128.0.11', '2620:0:863:101::/64', '10.132.0.39', '10.132.0.6', '10.132.0.7', '2001:df2:e500:101::/64', '10.136.0.16', '10.136.1.19', '10.136.1.15', '10.136.0.19', '10.136.0.17', '10.136.1.20', '2a02:ec80:600:101::/64', '2a02:ec80:600:102::/64', '10.140.0.13', '10.140.1.2', '10.140.1.14', '10.140.0.2', '10.140.0.14', '10.140.1.3', '2a02:ec80:700:101::/64', '2a02:ec80:700:102::/64']
+    ensure => present

Systemd::Unit[cfssl-ocspserve@wikikube]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@wikikube].orig
+++ Systemd::Unit[cfssl-ocspserve@wikikube]

-    unit              => cfssl-ocspserve@wikikube
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => mlserve_front_proxy
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@mlserve_front_proxy]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]

-    group  => root
-    ensure => absent
-    owner  => root

Nrpe::Check[check_check_certificate_expiry_network_devices]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_network_devices].orig
+++ Nrpe::Check[check_check_certificate_expiry_network_devices]

-    before    => Monitoring::Service[check_certificate_expiry_network_devices]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    ensure    => present
-    sudo_user => root

Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Rsyslog::Conf[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-network_devices].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-network_devices]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-network_devices]

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Motd::Script[pki::multirootca]

Parameters differences:

--- Motd::Script[pki::multirootca].orig
+++ Motd::Script[pki::multirootca]

-    priority => 5
-    ensure   => present

Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    ensure => present

Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-wikikube_staging]

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_puppet_rsa]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bfd2f7c6497e1da6323bef48d24f9e8e" --timeout 10 --check-command "check_check_certificate_expiry_mlserve"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Cfssl::Config[dse_front_proxy]

Parameters differences:

--- Cfssl::Config[dse_front_proxy].orig
+++ Cfssl::Config[dse_front_proxy]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/dse_front_proxy
-    path                => /etc/cfssl/signers/dse_front_proxy/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/dse_front_proxy

Nftables::Set[CLOUD_NETWORKS_PUBLIC]

Parameters differences:

--- Nftables::Set[CLOUD_NETWORKS_PUBLIC].orig
+++ Nftables::Set[CLOUD_NETWORKS_PUBLIC]

+    hosts  => ['185.15.56.0/25', '185.15.56.160/28', '185.15.57.0/29', '185.15.57.16/29', '185.15.57.24/29', '2a02:ec80:a000:4000::/64', '2a02:ec80:a100:4000::/64']
+    ensure => present

File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_dse]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem

Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]

Parameters differences:

--- Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods].orig
+++ Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]

-    src_sets            => ['WIKIKUBE_KUBEPODS_NETWORKS', 'STAGING_KUBEPODS_NETWORKS', 'MLSERVE_KUBEPODS_NETWORKS', 'MLSTAGE_KUBEPODS_NETWORKS', 'DSE_KUBEPODS_NETWORKS', 'AUX_KUBEPODS_NETWORKS']
-    unrestricted_access => False
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    ensure              => present
-    port                => 8443

File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem].orig
+++ File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem.orig
+++ /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
@@ -1 +0,0 @@
-test

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Systemd::Unit[cfssl-ocsprefresh-mlserve.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve.service]

-    unit              => cfssl-ocsprefresh-mlserve.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Service[cfssl-ocsprefresh-kafka.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-kafka.timer].orig
+++ Service[cfssl-ocsprefresh-kafka.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Package[python3-pymysql]

Parameters differences:

--- Package[python3-pymysql].orig
+++ Package[python3-pymysql]

-    ensure   => installed
-    provider => apt

Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@wikikube_front_proxy]']

File[/lib/systemd/system/cfssl-ocspserve@zuul.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@zuul.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@zuul.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@zuul.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@zuul.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (zuul)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10009 \
-          -responses /etc/cfssl/ocsp/zuul.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Concat::Fragment[main]

Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Syslog[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-discovery]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Exec[ensure_present_mod_filter]

Parameters differences:

--- Exec[ensure_present_mod_filter].orig
+++ Exec[ensure_present_mod_filter]

-    creates => /etc/apache2/mods-enabled/filter.load
-    command => /usr/sbin/a2enmod filter
-    notify  => Service[apache2]
-    require => Package[apache2]

File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft].orig
+++ File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/NETWORK_INFRA_ipv6.nft.orig
+++ /etc/nftables/sets/NETWORK_INFRA_ipv6.nft
@@ -0,0 +1,18 @@
+# Autogenerated by puppet
+set NETWORK_INFRA_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2a02:ec80:300:fe00::/55,
+             2620:0:863:fe00::/55,
+             2620:0:860:fe00::/55,
+             2620:0:860:13f::/64,
+             2620:0:860:139::/64,
+             2620:0:861:fe00::/55,
+             2620:0:861:11b::/128,
+             2620:0:861:130::/64,
+             2001:df2:e500:fe00::/55,
+             2a02:ec80:600:fe00::/55,
+             2a02:ec80:700:fe00::/55
+    }
+}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[cfssl-ocspserve@etcd]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@etcd].orig
+++ Systemd::Service[cfssl-ocspserve@etcd]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_network_devices!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: network_devices
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft
@@ -0,0 +1,99 @@
+# Autogenerated by puppet
+set MW_APPSERVER_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:861:101::/64,
+             2620:0:861:102::/64,
+             2620:0:861:103::/64,
+             2620:0:861:107::/64,
+             2620:0:861:109::/64,
+             2620:0:861:10a::/64,
+             2620:0:861:10b::/64,
+             2620:0:861:10c::/64,
+             2620:0:861:10d::/64,
+             2620:0:861:10e::/64,
+             2620:0:861:10f::/64,
+             2620:0:861:113::/64,
+             2620:0:861:119::/64,
+             2620:0:861:120::/64,
+             2620:0:861:122::/64,
+             2620:0:861:124::/64,
+             2620:0:861:126::/64,
+             2620:0:861:128::/64,
+             2620:0:861:12a::/64,
+             2620:0:861:12c::/64,
+             2620:0:861:12e::/64,
+             2620:0:861:131::/64,
+             2620:0:861:133::/64,
+             2620:0:861:135::/64,
+             2620:0:861:137::/64,
+             2620:0:861:139::/64,
+             2620:0:861:13b::/64,
+             2620:0:861:13d::/64,
+             2620:0:861:13f::/64,
+             2620:0:861:142::/64,
+             2620:0:861:144::/64,
+             2620:0:860:100::/64,
+             2620:0:860:101::/64,
+             2620:0:860:102::/64,
+             2620:0:860:103::/64,
+             2620:0:860:104::/64,
+             2620:0:860:105::/64,
+             2620:0:860:106::/64,
+             2620:0:860:107::/64,
+             2620:0:860:108::/64,
+             2620:0:860:109::/64,
+             2620:0:860:10a::/64,
+             2620:0:860:10b::/64,
+             2620:0:860:10c::/64,
+             2620:0:860:10d::/64,
+             2620:0:860:10e::/64,
+             2620:0:860:10f::/64,
+             2620:0:860:110::/64,
+             2620:0:860:111::/64,
+             2620:0:860:112::/64,
+             2620:0:860:113::/64,
+             2620:0:860:114::/64,
+             2620:0:860:115::/64,
+             2620:0:860:116::/64,
+             2620:0:860:119::/64,
+             2620:0:860:11a::/64,
+             2620:0:860:11b::/64,
+             2620:0:860:11c::/64,
+             2620:0:860:11d::/64,
+             2620:0:860:11e::/64,
+             2620:0:860:11f::/64,
+             2620:0:860:120::/64,
+             2620:0:860:121::/64,
+             2620:0:860:122::/64,
+             2620:0:860:123::/64,
+             2620:0:860:124::/64,
+             2620:0:860:125::/64,
+             2620:0:860:126::/64,
+             2620:0:860:127::/64,
+             2620:0:860:12b::/64,
+             2620:0:860:12c::/64,
+             2620:0:860:12d::/64,
+             2620:0:860:12e::/64,
+             2620:0:860:300::/64,
+             2620:0:860:302::/64,
+             2620:0:860:305::/64,
+             2620:0:860:308::/64,
+             2620:0:860:babe::/64,
+             2620:0:860:cabe::/64,
+             2620:0:861:300::/64,
+             2620:0:861:302::/64,
+             2620:0:861:305::/64,
+             2620:0:861:babe::/64,
+             2620:0:861:cabe::/64,
+             2620:0:861:1::/64,
+             2620:0:861:2::/64,
+             2620:0:861:3::/64,
+             2620:0:861:4::/64,
+             2620:0:860:1::/64,
+             2620:0:860:2::/64,
+             2620:0:860:3::/64,
+             2620:0:860:4::/64
+    }
+}

File[/etc/logrotate.d/ulogd]

Parameters differences:

--- File[/etc/logrotate.d/ulogd].orig
+++ File[/etc/logrotate.d/ulogd]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/ulogd.orig
+++ /etc/logrotate.d/ulogd
@@ -1,12 +0,0 @@
-# logrotate(8) config for ulogd
-
-/var/log/ulogd/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Rsyslog::Conf[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-syslog].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-syslog]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-syslog]

File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft].orig
+++ File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft.orig
+++ /etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft
@@ -0,0 +1,11 @@
+# Autogenerated by puppet
+set ZOOKEEPER_HOSTS_MAIN_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.0.207,
+             10.64.16.110,
+             10.64.48.154,
+             10.192.16.45,
+             10.192.32.52,
+             10.192.48.59
+    }
+}

Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Service[ferm]

Parameters differences:

--- Service[ferm].orig
+++ Service[ferm]

-    restart => /bin/systemctl reload-or-restart ferm
-    ensure  => running

File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => discovery2026
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@discovery2026]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Service[cfssl-ocspserve@mlserve]

Parameters differences:

--- Service[cfssl-ocspserve@mlserve].orig
+++ Service[cfssl-ocspserve@mlserve]

-    enable => True
-    ensure => running

Sudo::User[nrpe_certificate_check_wikikube]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_wikikube].orig
+++ Sudo::User[nrpe_certificate_check_wikikube]

-    user       => nrpe_certificate_check_wikikube
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Systemd::Timer[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-kafka].orig
+++ Systemd::Timer[cfssl-ocsprefresh-kafka]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-kafka.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]

Parameters differences:

--- Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh].orig
+++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]

-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet

-    subscribe   => File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
-    notify      => ['Service[apache2]']
-    environment => ['GODEBUG=x509ignoreCN=0']

File[/etc/sudoers.d/nrpe_certificate_check_wikikube]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_wikikube].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/nftables/input]

Parameters differences:

--- File[/etc/nftables/input].orig
+++ File[/etc/nftables/input]

+    recurse => True
+    purge   => True
+    owner   => root
+    group   => root
+    ensure  => directory

File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Cfssl::Config[mlserve_staging_front_proxy]

Parameters differences:

--- Cfssl::Config[mlserve_staging_front_proxy].orig
+++ Cfssl::Config[mlserve_staging_front_proxy]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy
-    path                => /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 72h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy

File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/mlserve_staging_front_proxy.pem.orig
+++ /srv/cfssl/bundles/mlserve_staging_front_proxy.pem
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
-iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
-ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
-EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
-xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
-lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
-/wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
-O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
-hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
-cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
-PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
-bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
-dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
-sBI=
------END CERTIFICATE-----

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/cfssl/signers/wikikube_staging]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging].orig
+++ File[/etc/cfssl/signers/wikikube_staging]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@wikikube_staging.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@wikikube_staging.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (wikikube_staging)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20020 \
-          -responses /etc/cfssl/ocsp/wikikube_staging.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --responses-file /etc/cfssl/ocsp/mlserve_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging' mlserve_staging 
-    description               => OCSP Refresh job - mlserve_staging
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Class[Profile::Pki::Multirootca]

Parameters differences:

--- Class[Profile::Pki::Multirootca].orig
+++ Class[Profile::Pki::Multirootca]

-    enable_monitoring  => True
-    cfssl_httpd_cert   => True
-    vhost              => pki.discovery.wmnet
-    root_ocsp_key      => pki/ROOT/Wikimedia_Internal_Root_CA_ocsp_signing_cert.pem
-    db_pass            => changeme
-    root_ocsp_port     => 10000
-    root_ca_cn         => Wikimedia_Internal_Root_CA
-    db_user            => pki
-    enable_k8s_vhost   => True
-    default_auth_keys  => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    client_ca_source   => puppet:///modules/profile/pki/production/client_auth_CA.pem
-    default_expiry     => 672h
-    prometheus_nodes   => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet']
-    db_driver          => mysql
-    db_host            => m1-master.eqiad.wmnet
-    root_ocsp_cert     => profile/pki/ROOT/Wikimedia_Internal_Root_CA_ocsp_signing_cert.pem
-    db_name            => pki
-    default_profiles   => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_usages     => ['signing', 'key encipherment', 'client auth']
-    public_cert_base   => profile/pki/intermediates
-    maintenance_jobs   => True
-    private_cert_base  => pki/intermediates
-    default_nets       => ['127.0.0.1/32']
-    intermediates      => {'debmonitor': {'ocsp_port': 10001}, 'discovery': {'ocsp_port': 10002, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'kafka': {'ocsp_port': 10003, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth'], 'profiles': {'kafka_11': {'expiry': '8760h'}}}, 'cloud_wmnet_ca': {'ocsp_port': 10004, 'default_usages': ['digital signature', 'key encipherment', 'server auth']}, 'etcd': {'ocsp_port': 10005, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'cassandra': {'ocsp_port': 10006, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'syslog': {'ocsp_port': 10007, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'puppet_rsa': {'ocsp_port': 10008, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'zuul': {'ocsp_port': 10009, 'default_usages': ['server auth', 'client auth']}, 'discovery2026': {'ocsp_port': 10010, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'wikikube': {'ocsp_port': 20010, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_front_proxy': {'ocsp_port': 20011}, 'wikikube_staging': {'ocsp_port': 20020, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_staging_front_proxy': {'ocsp_port': 20021, 'default_expiry': '72h'}, 'mlserve': {'ocsp_port': 20030, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_front_proxy': {'ocsp_port': 20031}, 'mlserve_staging': {'ocsp_port': 20040, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_staging_front_proxy': {'ocsp_port': 20041, 'default_expiry': '72h'}, 'aux': {'ocsp_port': 20050, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'aux_front_proxy': {'ocsp_port': 20051}, 'dse': {'ocsp_port': 20061, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'dse_front_proxy': {'ocsp_port': 20062}, 'network_devices': {'ocsp_port': 20063, 'default_expiry': '8760h', 'default_usages': ['digital signature', 'key encipherment', 'server auth']}}
-    root_ca_cert       => profile/pki/ROOT/Wikimedia_Internal_Root_CA.pem
-    enable_client_auth => True

Cfssl::Ocsp[aux]

Parameters differences:

--- Cfssl::Ocsp[aux].orig
+++ Cfssl::Ocsp[aux]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/aux/ca/aux.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20050
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/nftables/output]

Parameters differences:

--- File[/etc/nftables/output].orig
+++ File[/etc/nftables/output]

+    recurse => True
+    purge   => True
+    owner   => root
+    group   => root
+    ensure  => directory

Systemd::Service[prometheus-node-textfile-check-nft]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-check-nft].orig
+++ Systemd::Service[prometheus-node-textfile-check-nft]

+    unit_type                => timer
+    monitoring_enabled       => False
+    require                  => Systemd::Unit[prometheus-node-textfile-check-nft.service]
+    monitoring_critical      => False
+    override                 => False
+    service_params           => {}
+    monitoring_contact_group => admins
+    restart                  => False
+    migration_task           => T407130
+    ensure                   => present

Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@dse]']

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/srv/cfssl/bundles/puppet_rsa.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/puppet_rsa.pem].orig
+++ File[/srv/cfssl/bundles/puppet_rsa.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/puppet_rsa.pem.orig
+++ /srv/cfssl/bundles/puppet_rsa.pem
@@ -1,30 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
-MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
-lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
-Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
-z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
-i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
-FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
-BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
-AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
-mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
-Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
-GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
-AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
-DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
-vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
-a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
-Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
-Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
-hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
-9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
-xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
------END CERTIFICATE-----

File[/etc/nftables/sets]

Parameters differences:

--- File[/etc/nftables/sets].orig
+++ File[/etc/nftables/sets]

+    recurse => True
+    purge   => True
+    owner   => root
+    group   => root
+    ensure  => directory

File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Concat::Fragment[main contacts]

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]

-    before      => ['Service[cfssl-ocsprefresh-etcd.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca].orig
+++ Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem.orig
+++ /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
-gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
-AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
-hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
-92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
-raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
-A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
-G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
-Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
-b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
-ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
-ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
-hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
-0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
------END CERTIFICATE-----

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]

Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]

-    ca_file      => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => wikikube_front_proxy

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_mlserve!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: mlserve
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/db.conf.json]

Parameters differences:

--- File[/etc/cfssl/db.conf.json].orig
+++ File[/etc/cfssl/db.conf.json]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => file

Content differences:

--- /etc/cfssl/db.conf.json.orig
+++ /etc/cfssl/db.conf.json
@@ -1,12 +0,0 @@
-{
-  "host": "m1-master.eqiad.wmnet",
-  "port": 3306,
-  "user": "pki",
-  "password": "changeme",
-  "db": "pki",
-  "charset": "utf8mb4",
-  "ssl": {
-    "ca": "/etc/ssl/certs/wmf-ca-certificates.crt",
-    "check_hostname": false
-  }
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_discovery2026.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Ocsp[dse_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[dse_front_proxy].orig
+++ Cfssl::Ocsp[dse_front_proxy]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20062
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer].orig
+++ Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]

-    unit              => wmf_auto_restart_apache-htcacheclean.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Sudo::User[nrpe_certificate_check_mlserve]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_mlserve].orig
+++ Sudo::User[nrpe_certificate_check_mlserve]

-    user       => nrpe_certificate_check_mlserve
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp]

Parameters differences:

--- File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp].orig
+++ File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/10_full_monitoring_metrics_access_udp.orig
+++ /etc/ferm/conf.d/10_full_monitoring_metrics_access_udp
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(udp, 1:65535, (10.64.0.82 10.64.16.62 10.64.32.85 10.64.48.171 208.80.153.42 208.80.154.78 2620:0:860:2:208:80:153:42 2620:0:861:101:10:64:0:82 2620:0:861:102:10:64:16:62 2620:0:861:103:10:64:32:85 2620:0:861:107:10:64:48:171 2620:0:861:3:208:80:154:78));
-
-

Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Cfssl::Ocsp[Wikimedia_Internal_Root_CA]

Parameters differences:

--- Cfssl::Ocsp[Wikimedia_Internal_Root_CA].orig
+++ Cfssl::Ocsp[Wikimedia_Internal_Root_CA]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10000
-    require            => Service[cfssl-multirootca]
-    common_name        => pki1001.eqiad.wmnet
-    key_content        => FAKE FAKE FAKE

-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    cert_content       => -----BEGIN CERTIFICATE-----
MIIDmzCCAvygAwIBAgIUN3uLiKCNVwnGG5H9qKGwTGT4fJowCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTQ1MTAwWhcNMjYwMzI0MTQ1MTAwWjCB
mTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxFzAVBgNVBAsTDkNsb3VkIFNlcnZp
Y2VzMTUwMwYDVQQDDCxXaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQV9vY3NwX3Np
Z25pbmdfY2VydDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLmGOcHNNTGsOVTG
17o/lTVCgVJqX751quqBZvJQUbAgfAv0PRgv6yjWzTmZnojzKHYRaV8NXhDIVBzo
l2DRWUOjggEbMIIBFzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH
AwkwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQULRRzzcjqWQc2Fjci5s2v0FKSPJww
HwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBI
MEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dp
a2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6
Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
dF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgCI41DoiQFxqs9gDCZs4VhwcNeatHqe
98IqBIzFOMdZdkUnyTNiXf0VDkUYZ+n2mYmB5ZAaBTPYhTHgLNrc3KsmpQJCAfHM
Qr3AEz1MlZq2krL+7Mx9OuBQ3B/hXyC+met7EmKDziU8UyScxFfSIY1lwwgAmZHA
OEOWpgzuF4fGZFVf0dFi
-----END CERTIFICATE-----

-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/ferm/conf.d/00_defs_requestctl]

Parameters differences:

--- File[/etc/ferm/conf.d/00_defs_requestctl].orig
+++ File[/etc/ferm/conf.d/00_defs_requestctl]

@@
-    ensure => file
+    ensure => absent

Ferm::Rule[dscp-default]

Parameters differences:

--- Ferm::Rule[dscp-default].orig
+++ Ferm::Rule[dscp-default]

-    table  => mangle
-    chain  => POSTROUTING
-    ensure => present
-    domain => (ip ip6)
-    prio   => 99
-    desc   => 
-    rule   => DSCP set-dscp-class CS0;

Nrpe::Check[check_ferm_active]

Parameters differences:

--- Nrpe::Check[check_ferm_active].orig
+++ Nrpe::Check[check_ferm_active]

-    before    => Monitoring::Service[ferm_active]
-    command   => /usr/local/lib/nagios/plugins/check_ferm
-    ensure    => present
-    sudo_user => root

Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nrpe::Check[check_check_certificate_expiry_dse]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_dse].orig
+++ Nrpe::Check[check_check_certificate_expiry_dse]

-    before    => Monitoring::Service[check_certificate_expiry_dse]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem
-    ensure    => present
-    sudo_user => root

Exec[Generate initial CRL for wikikube_staging_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for wikikube_staging_front_proxy].orig
+++ Exec[Generate initial CRL for wikikube_staging_front_proxy]

-    creates => /srv/cfssl/crl/wikikube_staging_front_proxy
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_staging_front_proxy
-    require => ['Package[golang-cfssl]']

Systemd::Unit[cfssl-ocsprefresh-syslog.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-syslog.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-syslog.timer]

-    unit              => cfssl-ocsprefresh-syslog.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nftables/input/10_ssh-from-bastion.nft]

Parameters differences:

--- File[/etc/nftables/input/10_ssh-from-bastion.nft].orig
+++ File[/etc/nftables/input/10_ssh-from-bastion.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/input/10_ssh-from-bastion.nft.orig
+++ /etc/nftables/input/10_ssh-from-bastion.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr { 103.102.166.103, 185.15.58.6, 185.15.59.99, 195.200.68.99, 198.35.26.104, 208.80.153.110, 208.80.154.7 } tcp dport { 22 } accept
+ip6 saddr { 2001:df2:e500:3:103:102:166:103, 2620:0:860:4:208:80:153:110, 2620:0:861:1:208:80:154:7, 2620:0:863:3:198:35:26:104, 2a02:ec80:300:3:185:15:59:99, 2a02:ec80:600:1:185:15:58:6, 2a02:ec80:700:3:195:200:68:99 } tcp dport { 22 } accept

File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (mlserve_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20031 \
-          -responses /etc/cfssl/ocsp/mlserve_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-puppet_rsa].orig
+++ Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-puppet_rsa.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Unit[cfssl-ocsprefresh-discovery.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-discovery.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-discovery.timer]

-    unit              => cfssl-ocsprefresh-discovery.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft].orig
+++ File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/LINK_LOCAL_ipv6.nft.orig
+++ /etc/nftables/sets/LINK_LOCAL_ipv6.nft
@@ -0,0 +1,8 @@
+# Autogenerated by puppet
+set LINK_LOCAL_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { fe80::/10
+    }
+}

Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]

-    before      => ['Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_dse.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_dse.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-dse_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-dse_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/sudoers.d/nrpe_certificate_check_zuul]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_zuul].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_zuul]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/srv/cfssl/bundles/zuul.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/zuul.pem].orig
+++ File[/srv/cfssl/bundles/zuul.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/zuul.pem.orig
+++ /srv/cfssl/bundles/zuul.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
-dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
-g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
-g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
-Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
-jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
-KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
-bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
-P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
-SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
-HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
-atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
-XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
------END CERTIFICATE-----

File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp].orig
+++ File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]

-    before      => ['Service[cfssl-ocsprefresh-dse.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft].orig
+++ File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/LINK_LOCAL_ipv4.nft.orig
+++ /etc/nftables/sets/LINK_LOCAL_ipv4.nft
@@ -0,0 +1,8 @@
+# Autogenerated by puppet
+set LINK_LOCAL_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 169.254.0.0/16
+    }
+}

File[/etc/ulogd.conf]

Parameters differences:

--- File[/etc/ulogd.conf].orig
+++ File[/etc/ulogd.conf]

-    owner  => root
-    group  => root
-    notify => Service[ulogd2]
-    ensure => file

Content differences:

--- /etc/ulogd.conf.orig
+++ /etc/ulogd.conf
@@ -1,71 +0,0 @@
-# MANAGED BY PUPPET
-[global]
-logfile=syslog
-loglevel=3
-
-
-stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,syslog1:SYSLOG
-
-
-
-
-[ct1]
-
-[ct2]
-hash_enable=0
-
-[mark]
-
-[log1]
-group=0
-
-[log2]
-group=1
-
-[log3]
-group=2
-
-[logemu1]
-sync=1
-file=/var/log/ulog/syslogemu.log
-
-[emunfct1]
-sync=1
-file=/var/log/ulog/syslogemu_nfct.log
-
-[json1]
-sync=1
-file=/var/log/ulog/ulogd.json
-
-[jsonnfct1]
-sync=1
-file=/var/log/ulog/ulogd_nfct.json
-
-
-[oprint1]
-sync=1
-file=/var/log/ulog/oprint.log
-
-[gprint1]
-sync=1
-file=/var/log/ulog/gprint.log
-
-[json1]
-sync=1
-file=/var/log/ulog/ulogd.json
-
-[xml1]
-sync=1
-file=/var/log/ulog/
-
-[pcap1]
-sync=1
-file=
-
-[nacct1]
-sync=1
-file=
-
-[syslog1]
-facility=LOG_LOCAL7
-level=LOG_INFO

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft
@@ -0,0 +1,8 @@
+# Autogenerated by puppet
+set MLSTAGE_KUBEPODS_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:860:302::/64
+    }
+}

Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]

-    unit              => cfssl-ocsprefresh-mlserve.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Profile::Pki::Multirootca::Monitoring[syslog]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[syslog].orig
+++ Profile::Pki::Multirootca::Monitoring[syslog]

-    ca_file      => /etc/cfssl/signers/syslog/ca/syslog.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => syslog

File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft
@@ -0,0 +1,27 @@
+# Autogenerated by puppet
+set CLOUD_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 172.16.0.0/21,
+             172.16.128.0/24,
+             172.16.129.0/24,
+             172.16.130.0/24,
+             172.16.131.0/24,
+             172.16.16.0/21,
+             172.16.24.0/24,
+             172.16.8.0/21,
+             172.20.1.0/24,
+             172.20.2.0/24,
+             172.20.254.0/24,
+             172.20.255.0/24,
+             172.20.3.0/24,
+             172.20.4.0/24,
+             172.20.5.0/24,
+             185.15.56.0/25,
+             185.15.56.160/28,
+             185.15.57.0/29,
+             185.15.57.16/29,
+             185.15.57.24/29
+    }
+}

Logrotate::Conf[ulogd]

Parameters differences:

--- Logrotate::Conf[ulogd].orig
+++ Logrotate::Conf[ulogd]

-    ensure => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-debmonitor-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom

File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]

Parameters differences:

--- File[/etc/ferm/conf.d/10_ssh_from_cumin_masters].orig
+++ File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/10_ssh_from_cumin_masters.orig
+++ /etc/ferm/conf.d/10_ssh_from_cumin_masters
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 22, $CUMIN_MASTERS);
-
-

Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-wikikube_staging_front_proxy.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/ferm/conf.d/00_defs]

Parameters differences:

--- File[/etc/ferm/conf.d/00_defs].orig
+++ File[/etc/ferm/conf.d/00_defs]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/00_defs.orig
+++ /etc/ferm/conf.d/00_defs
@@ -1,1139 +0,0 @@
-
-@def $LINK_LOCAL = (169.254.0.0/16 fe80::/10);
-@def $INTERNAL = (10.0.0.0/8 2620:0:860:100::/56 2620:0:861:100::/56 2620:0:863:100::/56 2001:df2:e500:100::/56 2a02:ec80:300:100::/56 2a02:ec80:600:100::/56 2a02:ec80:700:100::/56 2a02:ec80:ff00:100::/56);
-# $DOMAIN_NETWORKS is a set of all networks belonging to a domain.
-# a domain is a realm currently, but the notion is more generic than that on purpose
-@def $DOMAIN_NETWORKS = (10.128.0.0/24 10.128.1.0/24 10.128.2.0/24 10.132.0.0/24 10.132.2.0/24 10.136.0.0/24 10.136.1.0/24 10.140.0.0/24 10.140.1.0/24 10.140.2.0/24 10.192.0.0/22 10.192.10.0/24 10.192.11.0/24 10.192.12.0/24 10.192.13.0/24 10.192.14.0/24 10.192.15.0/24 10.192.16.0/22 10.192.20.0/24 10.192.21.0/24 10.192.22.0/24 10.192.23.0/24 10.192.24.0/23 10.192.26.0/24 10.192.27.0/24 10.192.28.0/24 10.192.29.0/24 10.192.30.0/24 10.192.31.0/24 10.192.32.0/22 10.192.36.0/24 10.192.37.0/24 10.192.38.0/24 10.192.39.0/24 10.192.4.0/24 10.192.40.0/24 10.192.41.0/24 10.192.42.0/24 10.192.43.0/24 10.192.44.0/24 10.192.45.0/24 10.192.46.0/24 10.192.47.0/24 10.192.48.0/22 10.192.5.0/24 10.192.52.0/24 10.192.56.0/24 10.192.57.0/24 10.192.58.0/24 10.192.59.0/24 10.192.6.0/24 10.192.64.0/21 10.192.7.0/24 10.192.72.0/24 10.192.76.0/24 10.192.8.0/24 10.192.80.0/20 10.192.9.0/24 10.192.96.0/21 10.194.0.0/20 10.194.128.0/17 10.194.16.0/21 10.194.61.0/24 10.194.62.0/23 10.194.64.0/20 10.194.80.0/21 10.2.1.0/24 10.2.2.0/24 10.2.3.0/24 10.2.4.0/24 10.2.5.0/24 10.2.6.0/24 10.2.7.0/24 10.64.0.0/22 10.64.130.0/24 10.64.131.0/24 10.64.132.0/24 10.64.133.0/24 10.64.134.0/24 10.64.135.0/24 10.64.136.0/24 10.64.137.0/24 10.64.138.0/24 10.64.139.0/24 10.64.140.0/24 10.64.141.0/24 10.64.142.0/24 10.64.143.0/24 10.64.144.0/24 10.64.145.0/24 10.64.148.0/24 10.64.149.0/24 10.64.150.0/24 10.64.151.0/24 10.64.152.0/24 10.64.153.0/24 10.64.154.0/24 10.64.155.0/24 10.64.156.0/24 10.64.157.0/24 10.64.158.0/24 10.64.159.0/24 10.64.16.0/22 10.64.160.0/24 10.64.161.0/24 10.64.162.0/24 10.64.163.0/24 10.64.164.0/24 10.64.165.0/24 10.64.166.0/24 10.64.167.0/24 10.64.169.0/24 10.64.170.0/24 10.64.171.0/24 10.64.172.0/24 10.64.173.0/24 10.64.174.0/24 10.64.175.0/24 10.64.176.0/24 10.64.177.0/24 10.64.178.0/24 10.64.179.0/24 10.64.180.0/24 10.64.181.0/24 10.64.182.0/24 10.64.183.0/24 10.64.184.0/24 10.64.185.0/24 10.64.186.0/24 10.64.187.0/24 10.64.188.0/24 10.64.189.0/24 10.64.190.0/24 10.64.20.0/24 10.64.21.0/24 10.64.24.0/23 10.64.32.0/22 10.64.36.0/24 10.64.48.0/22 10.64.5.0/24 10.64.53.0/24 10.64.64.0/21 10.64.72.0/24 10.64.76.0/24 10.67.0.0/20 10.67.128.0/17 10.67.16.0/21 10.67.24.0/21 10.67.32.0/20 10.67.64.0/20 10.67.80.0/21 10.80.0.0/24 10.80.1.0/24 10.80.2.0/24 103.102.166.0/28 103.102.166.224/27 103.102.166.96/27 185.15.58.0/27 185.15.58.224/27 185.15.58.32/27 185.15.59.0/27 185.15.59.224/27 185.15.59.32/27 185.15.59.96/27 195.200.68.0/27 195.200.68.224/27 195.200.68.32/27 195.200.68.96/27 198.35.26.0/27 198.35.26.32/27 198.35.26.96/27 198.35.26.96/27 2001:df2:e500:101::/64 2001:df2:e500:103::/64 2001:df2:e500:1::/64 2001:df2:e500:3::/64 2001:df2:e500:ed1a::/64 208.80.152.128/27 208.80.153.0/27 208.80.153.224/27 208.80.153.32/27 208.80.153.64/27 208.80.153.96/27 208.80.154.0/26 208.80.154.128/26 208.80.154.224/27 208.80.154.64/26 208.80.155.96/27 2620:0:860:100::/64 2620:0:860:101::/64 2620:0:860:102::/64 2620:0:860:103::/64 2620:0:860:104::/64 2620:0:860:105::/64 2620:0:860:106::/64 2620:0:860:107::/64 2620:0:860:108::/64 2620:0:860:109::/64 2620:0:860:10a::/64 2620:0:860:10b::/64 2620:0:860:10c::/64 2620:0:860:10d::/64 2620:0:860:10e::/64 2620:0:860:10f::/64 2620:0:860:110::/64 2620:0:860:111::/64 2620:0:860:112::/64 2620:0:860:113::/64 2620:0:860:114::/64 2620:0:860:115::/64 2620:0:860:116::/64 2620:0:860:118::/64 2620:0:860:119::/64 2620:0:860:11a::/64 2620:0:860:11b::/64 2620:0:860:11c::/64 2620:0:860:11d::/64 2620:0:860:11e::/64 2620:0:860:11f::/64 2620:0:860:120::/64 2620:0:860:121::/64 2620:0:860:122::/64 2620:0:860:123::/64 2620:0:860:124::/64 2620:0:860:125::/64 2620:0:860:126::/64 2620:0:860:127::/64 2620:0:860:12b::/64 2620:0:860:12c::/64 2620:0:860:12d::/64 2620:0:860:12e::/64 2620:0:860:140::/64 2620:0:860:1::/64 2620:0:860:2::/64 2620:0:860:300::/64 2620:0:860:301::/64 2620:0:860:302::/64 2620:0:860:303::/64 2620:0:860:304::/64 2620:0:860:305::/64 2620:0:860:307::/64 2620:0:860:308::/64 2620:0:860:3::/64 2620:0:860:4::/64 2620:0:860:5::/64 2620:0:860:babe::/64 2620:0:860:babf::/64 2620:0:860:cabe::/64 2620:0:860:cabf::/64 2620:0:860:ed1a::/64 2620:0:861:100::/64 2620:0:861:101::/64 2620:0:861:102::/64 2620:0:861:103::/64 2620:0:861:104::/64 2620:0:861:105::/64 2620:0:861:106::/64 2620:0:861:107::/64 2620:0:861:108::/64 2620:0:861:109::/64 2620:0:861:10a::/64 2620:0:861:10b::/64 2620:0:861:10c::/64 2620:0:861:10d::/64 2620:0:861:10e::/64 2620:0:861:10f::/64 2620:0:861:110::/64 2620:0:861:111::/64 2620:0:861:112::/64 2620:0:861:113::/64 2620:0:861:114::/64 2620:0:861:115::/64 2620:0:861:116::/64 2620:0:861:117::/64 2620:0:861:118::/64 2620:0:861:119::/64 2620:0:861:11a::/64 2620:0:861:11c::/64 2620:0:861:11d::/64 2620:0:861:11e::/64 2620:0:861:11f::/64 2620:0:861:120::/64 2620:0:861:121::/64 2620:0:861:122::/64 2620:0:861:123::/64 2620:0:861:124::/64 2620:0:861:125::/64 2620:0:861:126::/64 2620:0:861:127::/64 2620:0:861:128::/64 2620:0:861:129::/64 2620:0:861:12a::/64 2620:0:861:12b::/64 2620:0:861:12c::/64 2620:0:861:12d::/64 2620:0:861:12e::/64 2620:0:861:12f::/64 2620:0:861:131::/64 2620:0:861:132::/64 2620:0:861:133::/64 2620:0:861:134::/64 2620:0:861:135::/64 2620:0:861:136::/64 2620:0:861:137::/64 2620:0:861:138::/64 2620:0:861:139::/64 2620:0:861:13a::/64 2620:0:861:13b::/64 2620:0:861:13c::/64 2620:0:861:13d::/64 2620:0:861:13e::/64 2620:0:861:13f::/64 2620:0:861:140::/64 2620:0:861:141::/64 2620:0:861:142::/64 2620:0:861:143::/64 2620:0:861:144::/64 2620:0:861:145::/64 2620:0:861:1::/64 2620:0:861:2::/64 2620:0:861:300::/64 2620:0:861:301::/116 2620:0:861:302::/64 2620:0:861:303::/116 2620:0:861:304::/116 2620:0:861:305::/64 2620:0:861:3::/64 2620:0:861:4::/64 2620:0:861:babe::/64 2620:0:861:babf::/116 2620:0:861:cabe::/64 2620:0:861:cabf::/116 2620:0:861:ed1a::/64 2620:0:863:101::/64 2620:0:863:102::/64 2620:0:863:103::/64 2620:0:863:1::/64 2620:0:863:2::/64 2620:0:863:3::/64 2620:0:863:ed1a::/64 2a02:ec80:300:101::/64 2a02:ec80:300:102::/64 2a02:ec80:300:103::/64 2a02:ec80:300:1::/64 2a02:ec80:300:2::/64 2a02:ec80:300:3::/64 2a02:ec80:300:ed1a::/64 2a02:ec80:600:101::/64 2a02:ec80:600:102::/64 2a02:ec80:600:1::/64 2a02:ec80:600:2::/64 2a02:ec80:600:ed1a::/64 2a02:ec80:700:101::/64 2a02:ec80:700:102::/64 2a02:ec80:700:103::/64 2a02:ec80:700:1::/64 2a02:ec80:700:2::/64 2a02:ec80:700:3::/64 2a02:ec80:700:ed1a::/64 );
-
-# $PRODUCTION_NETWORKS is a set of all production networks
-@def $PRODUCTION_NETWORKS = (10.128.0.0/24 10.128.1.0/24 10.128.2.0/24 10.132.0.0/24 10.132.2.0/24 10.136.0.0/24 10.136.1.0/24 10.140.0.0/24 10.140.1.0/24 10.140.2.0/24 10.192.0.0/22 10.192.10.0/24 10.192.11.0/24 10.192.12.0/24 10.192.13.0/24 10.192.14.0/24 10.192.15.0/24 10.192.16.0/22 10.192.20.0/24 10.192.21.0/24 10.192.22.0/24 10.192.23.0/24 10.192.24.0/23 10.192.26.0/24 10.192.27.0/24 10.192.28.0/24 10.192.29.0/24 10.192.30.0/24 10.192.31.0/24 10.192.32.0/22 10.192.36.0/24 10.192.37.0/24 10.192.38.0/24 10.192.39.0/24 10.192.4.0/24 10.192.40.0/24 10.192.41.0/24 10.192.42.0/24 10.192.43.0/24 10.192.44.0/24 10.192.45.0/24 10.192.46.0/24 10.192.47.0/24 10.192.48.0/22 10.192.5.0/24 10.192.52.0/24 10.192.56.0/24 10.192.57.0/24 10.192.58.0/24 10.192.59.0/24 10.192.6.0/24 10.192.64.0/21 10.192.7.0/24 10.192.72.0/24 10.192.76.0/24 10.192.8.0/24 10.192.80.0/20 10.192.9.0/24 10.192.96.0/21 10.194.0.0/20 10.194.128.0/17 10.194.16.0/21 10.194.61.0/24 10.194.62.0/23 10.194.64.0/20 10.194.80.0/21 10.2.1.0/24 10.2.2.0/24 10.2.3.0/24 10.2.4.0/24 10.2.5.0/24 10.2.6.0/24 10.2.7.0/24 10.64.0.0/22 10.64.130.0/24 10.64.131.0/24 10.64.132.0/24 10.64.133.0/24 10.64.134.0/24 10.64.135.0/24 10.64.136.0/24 10.64.137.0/24 10.64.138.0/24 10.64.139.0/24 10.64.140.0/24 10.64.141.0/24 10.64.142.0/24 10.64.143.0/24 10.64.144.0/24 10.64.145.0/24 10.64.148.0/24 10.64.149.0/24 10.64.150.0/24 10.64.151.0/24 10.64.152.0/24 10.64.153.0/24 10.64.154.0/24 10.64.155.0/24 10.64.156.0/24 10.64.157.0/24 10.64.158.0/24 10.64.159.0/24 10.64.16.0/22 10.64.160.0/24 10.64.161.0/24 10.64.162.0/24 10.64.163.0/24 10.64.164.0/24 10.64.165.0/24 10.64.166.0/24 10.64.167.0/24 10.64.169.0/24 10.64.170.0/24 10.64.171.0/24 10.64.172.0/24 10.64.173.0/24 10.64.174.0/24 10.64.175.0/24 10.64.176.0/24 10.64.177.0/24 10.64.178.0/24 10.64.179.0/24 10.64.180.0/24 10.64.181.0/24 10.64.182.0/24 10.64.183.0/24 10.64.184.0/24 10.64.185.0/24 10.64.186.0/24 10.64.187.0/24 10.64.188.0/24 10.64.189.0/24 10.64.190.0/24 10.64.20.0/24 10.64.21.0/24 10.64.24.0/23 10.64.32.0/22 10.64.36.0/24 10.64.48.0/22 10.64.5.0/24 10.64.53.0/24 10.64.64.0/21 10.64.72.0/24 10.64.76.0/24 10.67.0.0/20 10.67.128.0/17 10.67.16.0/21 10.67.24.0/21 10.67.32.0/20 10.67.64.0/20 10.67.80.0/21 10.80.0.0/24 10.80.1.0/24 10.80.2.0/24 103.102.166.0/28 103.102.166.224/27 103.102.166.96/27 185.15.58.0/27 185.15.58.224/27 185.15.58.32/27 185.15.59.0/27 185.15.59.224/27 185.15.59.32/27 185.15.59.96/27 195.200.68.0/27 195.200.68.224/27 195.200.68.32/27 195.200.68.96/27 198.35.26.0/27 198.35.26.32/27 198.35.26.96/27 198.35.26.96/27 2001:df2:e500:101::/64 2001:df2:e500:103::/64 2001:df2:e500:1::/64 2001:df2:e500:3::/64 2001:df2:e500:ed1a::/64 208.80.152.128/27 208.80.153.0/27 208.80.153.224/27 208.80.153.32/27 208.80.153.64/27 208.80.153.96/27 208.80.154.0/26 208.80.154.128/26 208.80.154.224/27 208.80.154.64/26 208.80.155.96/27 2620:0:860:100::/64 2620:0:860:101::/64 2620:0:860:102::/64 2620:0:860:103::/64 2620:0:860:104::/64 2620:0:860:105::/64 2620:0:860:106::/64 2620:0:860:107::/64 2620:0:860:108::/64 2620:0:860:109::/64 2620:0:860:10a::/64 2620:0:860:10b::/64 2620:0:860:10c::/64 2620:0:860:10d::/64 2620:0:860:10e::/64 2620:0:860:10f::/64 2620:0:860:110::/64 2620:0:860:111::/64 2620:0:860:112::/64 2620:0:860:113::/64 2620:0:860:114::/64 2620:0:860:115::/64 2620:0:860:116::/64 2620:0:860:118::/64 2620:0:860:119::/64 2620:0:860:11a::/64 2620:0:860:11b::/64 2620:0:860:11c::/64 2620:0:860:11d::/64 2620:0:860:11e::/64 2620:0:860:11f::/64 2620:0:860:120::/64 2620:0:860:121::/64 2620:0:860:122::/64 2620:0:860:123::/64 2620:0:860:124::/64 2620:0:860:125::/64 2620:0:860:126::/64 2620:0:860:127::/64 2620:0:860:12b::/64 2620:0:860:12c::/64 2620:0:860:12d::/64 2620:0:860:12e::/64 2620:0:860:140::/64 2620:0:860:1::/64 2620:0:860:2::/64 2620:0:860:300::/64 2620:0:860:301::/64 2620:0:860:302::/64 2620:0:860:303::/64 2620:0:860:304::/64 2620:0:860:305::/64 2620:0:860:307::/64 2620:0:860:308::/64 2620:0:860:3::/64 2620:0:860:4::/64 2620:0:860:5::/64 2620:0:860:babe::/64 2620:0:860:babf::/64 2620:0:860:cabe::/64 2620:0:860:cabf::/64 2620:0:860:ed1a::/64 2620:0:861:100::/64 2620:0:861:101::/64 2620:0:861:102::/64 2620:0:861:103::/64 2620:0:861:104::/64 2620:0:861:105::/64 2620:0:861:106::/64 2620:0:861:107::/64 2620:0:861:108::/64 2620:0:861:109::/64 2620:0:861:10a::/64 2620:0:861:10b::/64 2620:0:861:10c::/64 2620:0:861:10d::/64 2620:0:861:10e::/64 2620:0:861:10f::/64 2620:0:861:110::/64 2620:0:861:111::/64 2620:0:861:112::/64 2620:0:861:113::/64 2620:0:861:114::/64 2620:0:861:115::/64 2620:0:861:116::/64 2620:0:861:117::/64 2620:0:861:118::/64 2620:0:861:119::/64 2620:0:861:11a::/64 2620:0:861:11c::/64 2620:0:861:11d::/64 2620:0:861:11e::/64 2620:0:861:11f::/64 2620:0:861:120::/64 2620:0:861:121::/64 2620:0:861:122::/64 2620:0:861:123::/64 2620:0:861:124::/64 2620:0:861:125::/64 2620:0:861:126::/64 2620:0:861:127::/64 2620:0:861:128::/64 2620:0:861:129::/64 2620:0:861:12a::/64 2620:0:861:12b::/64 2620:0:861:12c::/64 2620:0:861:12d::/64 2620:0:861:12e::/64 2620:0:861:12f::/64 2620:0:861:131::/64 2620:0:861:132::/64 2620:0:861:133::/64 2620:0:861:134::/64 2620:0:861:135::/64 2620:0:861:136::/64 2620:0:861:137::/64 2620:0:861:138::/64 2620:0:861:139::/64 2620:0:861:13a::/64 2620:0:861:13b::/64 2620:0:861:13c::/64 2620:0:861:13d::/64 2620:0:861:13e::/64 2620:0:861:13f::/64 2620:0:861:140::/64 2620:0:861:141::/64 2620:0:861:142::/64 2620:0:861:143::/64 2620:0:861:144::/64 2620:0:861:145::/64 2620:0:861:1::/64 2620:0:861:2::/64 2620:0:861:300::/64 2620:0:861:301::/116 2620:0:861:302::/64 2620:0:861:303::/116 2620:0:861:304::/116 2620:0:861:305::/64 2620:0:861:3::/64 2620:0:861:4::/64 2620:0:861:babe::/64 2620:0:861:babf::/116 2620:0:861:cabe::/64 2620:0:861:cabf::/116 2620:0:861:ed1a::/64 2620:0:863:101::/64 2620:0:863:102::/64 2620:0:863:103::/64 2620:0:863:1::/64 2620:0:863:2::/64 2620:0:863:3::/64 2620:0:863:ed1a::/64 2a02:ec80:300:101::/64 2a02:ec80:300:102::/64 2a02:ec80:300:103::/64 2a02:ec80:300:1::/64 2a02:ec80:300:2::/64 2a02:ec80:300:3::/64 2a02:ec80:300:ed1a::/64 2a02:ec80:600:101::/64 2a02:ec80:600:102::/64 2a02:ec80:600:1::/64 2a02:ec80:600:2::/64 2a02:ec80:600:ed1a::/64 2a02:ec80:700:101::/64 2a02:ec80:700:102::/64 2a02:ec80:700:103::/64 2a02:ec80:700:1::/64 2a02:ec80:700:2::/64 2a02:ec80:700:3::/64 2a02:ec80:700:ed1a::/64 );
-# $CLOUD_NETWORKS is a set of all Cloud VPS instance networks
-@def $CLOUD_NETWORKS = (172.16.0.0/21 172.16.128.0/24 172.16.129.0/24 172.16.130.0/24 172.16.131.0/24 172.16.16.0/21 172.16.24.0/24 172.16.8.0/21 172.20.1.0/24 172.20.2.0/24 172.20.254.0/24 172.20.255.0/24 172.20.3.0/24 172.20.4.0/24 172.20.5.0/24 185.15.56.0/25 185.15.56.160/28 185.15.57.0/29 185.15.57.16/29 185.15.57.24/29 2a02:ec80:a000:100::/64 2a02:ec80:a000:1::/64 2a02:ec80:a000:201::/64 2a02:ec80:a000:202::/64 2a02:ec80:a000:203::/64 2a02:ec80:a000:204::/64 2a02:ec80:a000:2ff::/64 2a02:ec80:a000:4000::/64 2a02:ec80:a100:100::/64 2a02:ec80:a100:1::/64 2a02:ec80:a100:205::/64 2a02:ec80:a100:2ff::/64 2a02:ec80:a100:4000::/64 );
-# $LABS_NETWORKS is a deprecated alias for $CLOUD_NETWORKS
-@def $LABS_NETWORKS = (172.16.0.0/21 172.16.128.0/24 172.16.129.0/24 172.16.130.0/24 172.16.131.0/24 172.16.16.0/21 172.16.24.0/24 172.16.8.0/21 172.20.1.0/24 172.20.2.0/24 172.20.254.0/24 172.20.255.0/24 172.20.3.0/24 172.20.4.0/24 172.20.5.0/24 185.15.56.0/25 185.15.56.160/28 185.15.57.0/29 185.15.57.16/29 185.15.57.24/29 2a02:ec80:a000:100::/64 2a02:ec80:a000:1::/64 2a02:ec80:a000:201::/64 2a02:ec80:a000:202::/64 2a02:ec80:a000:203::/64 2a02:ec80:a000:204::/64 2a02:ec80:a000:2ff::/64 2a02:ec80:a000:4000::/64 2a02:ec80:a100:100::/64 2a02:ec80:a100:1::/64 2a02:ec80:a100:205::/64 2a02:ec80:a100:2ff::/64 2a02:ec80:a100:4000::/64 );
-# $CLOUD_NETWORKS_PUBLIC is meant to be a set of all Cloud public networks
-@def $CLOUD_NETWORKS_PUBLIC = (185.15.56.0/25 185.15.56.160/28 185.15.57.0/29 185.15.57.16/29 185.15.57.24/29 2a02:ec80:a000:4000::/64 2a02:ec80:a100:4000::/64 );
-# $CLOUD_PRIVATE_NETWORKS is the cloud-private networks with WMCS
-# hardware with cloud realm private 172.20.x.x addresses. These
-# hosts are dual-homed, usually also in at least cloud-hosts.
-@def $CLOUD_PRIVATE_NETWORKS = (172.20.1.0/24 172.20.2.0/24 172.20.3.0/24 172.20.4.0/24 2a02:ec80:a000:201::/64 2a02:ec80:a000:202::/64 2a02:ec80:a000:203::/64 2a02:ec80:a000:204::/64 172.20.5.0/24 2a02:ec80:a100:205::/64);
-# $FRACK_NETWORKS is meant to be a set of all fundraising networks
-@def $FRACK_NETWORKS = (10.195.0.0/27 10.195.0.128/29 10.195.0.32/27 10.195.0.64/28 10.195.0.80/29 10.195.0.96/27 10.195.1.0/25 10.64.40.0/27 10.64.40.160/27 10.64.40.192/26 10.64.40.32/27 10.64.40.64/27 10.64.40.96/27 208.80.152.224/28 208.80.155.0/27 );
-
-@def $ANALYTICS_NETWORKS = (10.64.137.0/24 10.64.138.0/24 10.64.139.0/24 10.64.140.0/24 10.64.142.0/24 10.64.143.0/24 10.64.144.0/24 10.64.145.0/24 10.64.153.0/24 10.64.155.0/24 10.64.157.0/24 10.64.159.0/24 10.64.161.0/24 10.64.163.0/24 10.64.165.0/24 10.64.167.0/24 10.64.170.0/24 10.64.172.0/24 10.64.174.0/24 10.64.176.0/24 10.64.178.0/24 10.64.180.0/24 10.64.182.0/24 10.64.184.0/24 10.64.186.0/24 10.64.188.0/24 10.64.190.0/24 10.64.21.0/24 10.64.36.0/24 10.64.5.0/24 10.64.53.0/24 2620:0:861:100::/64 2620:0:861:104::/64 2620:0:861:105::/64 2620:0:861:106::/64 2620:0:861:108::/64 2620:0:861:110::/64 2620:0:861:111::/64 2620:0:861:112::/64 2620:0:861:114::/64 2620:0:861:115::/64 2620:0:861:116::/64 2620:0:861:117::/64 2620:0:861:11a::/64 2620:0:861:121::/64 2620:0:861:123::/64 2620:0:861:125::/64 2620:0:861:127::/64 2620:0:861:129::/64 2620:0:861:12b::/64 2620:0:861:12d::/64 2620:0:861:12f::/64 2620:0:861:132::/64 2620:0:861:134::/64 2620:0:861:136::/64 2620:0:861:138::/64 2620:0:861:13a::/64 2620:0:861:13c::/64 2620:0:861:13e::/64 2620:0:861:141::/64 2620:0:861:143::/64 2620:0:861:145::/64 );
-@def $MW_APPSERVER_NETWORKS = (10.64.0.0/22 10.64.130.0/24 10.64.131.0/24 10.64.132.0/24 10.64.133.0/24 10.64.134.0/24 10.64.135.0/24 10.64.136.0/24 10.64.141.0/24 10.64.152.0/24 10.64.154.0/24 10.64.156.0/24 10.64.158.0/24 10.64.16.0/22 10.64.160.0/24 10.64.162.0/24 10.64.164.0/24 10.64.166.0/24 10.64.169.0/24 10.64.171.0/24 10.64.173.0/24 10.64.175.0/24 10.64.177.0/24 10.64.179.0/24 10.64.181.0/24 10.64.183.0/24 10.64.185.0/24 10.64.187.0/24 10.64.189.0/24 10.64.32.0/22 10.64.48.0/22 2620:0:861:101::/64 2620:0:861:102::/64 2620:0:861:103::/64 2620:0:861:107::/64 2620:0:861:109::/64 2620:0:861:10a::/64 2620:0:861:10b::/64 2620:0:861:10c::/64 2620:0:861:10d::/64 2620:0:861:10e::/64 2620:0:861:10f::/64 2620:0:861:113::/64 2620:0:861:119::/64 2620:0:861:120::/64 2620:0:861:122::/64 2620:0:861:124::/64 2620:0:861:126::/64 2620:0:861:128::/64 2620:0:861:12a::/64 2620:0:861:12c::/64 2620:0:861:12e::/64 2620:0:861:131::/64 2620:0:861:133::/64 2620:0:861:135::/64 2620:0:861:137::/64 2620:0:861:139::/64 2620:0:861:13b::/64 2620:0:861:13d::/64 2620:0:861:13f::/64 2620:0:861:142::/64 2620:0:861:144::/64 10.192.0.0/22 10.192.10.0/24 10.192.11.0/24 10.192.12.0/24 10.192.13.0/24 10.192.14.0/24 10.192.15.0/24 10.192.16.0/22 10.192.21.0/24 10.192.22.0/24 10.192.23.0/24 10.192.26.0/24 10.192.27.0/24 10.192.28.0/24 10.192.29.0/24 10.192.30.0/24 10.192.31.0/24 10.192.32.0/22 10.192.36.0/24 10.192.37.0/24 10.192.38.0/24 10.192.39.0/24 10.192.4.0/24 10.192.40.0/24 10.192.41.0/24 10.192.42.0/24 10.192.43.0/24 10.192.44.0/24 10.192.45.0/24 10.192.46.0/24 10.192.47.0/24 10.192.48.0/22 10.192.5.0/24 10.192.52.0/24 10.192.56.0/24 10.192.57.0/24 10.192.58.0/24 10.192.59.0/24 10.192.6.0/24 10.192.7.0/24 10.192.8.0/24 10.192.9.0/24 2620:0:860:100::/64 2620:0:860:101::/64 2620:0:860:102::/64 2620:0:860:103::/64 2620:0:860:104::/64 2620:0:860:105::/64 2620:0:860:106::/64 2620:0:860:107::/64 2620:0:860:108::/64 2620:0:860:109::/64 2620:0:860:10a::/64 2620:0:860:10b::/64 2620:0:860:10c::/64 2620:0:860:10d::/64 2620:0:860:10e::/64 2620:0:860:10f::/64 2620:0:860:110::/64 2620:0:860:111::/64 2620:0:860:112::/64 2620:0:860:113::/64 2620:0:860:114::/64 2620:0:860:115::/64 2620:0:860:116::/64 2620:0:860:119::/64 2620:0:860:11a::/64 2620:0:860:11b::/64 2620:0:860:11c::/64 2620:0:860:11d::/64 2620:0:860:11e::/64 2620:0:860:11f::/64 2620:0:860:120::/64 2620:0:860:121::/64 2620:0:860:122::/64 2620:0:860:123::/64 2620:0:860:124::/64 2620:0:860:125::/64 2620:0:860:126::/64 2620:0:860:127::/64 2620:0:860:12b::/64 2620:0:860:12c::/64 2620:0:860:12d::/64 2620:0:860:12e::/64 10.192.64.0/21 10.192.96.0/21 10.194.128.0/17 10.194.16.0/21 10.194.61.0/24 10.194.80.0/21 10.64.64.0/21 10.67.128.0/17 10.67.16.0/21 10.67.24.0/21 10.67.80.0/21 2620:0:860:300::/64 2620:0:860:302::/64 2620:0:860:305::/64 2620:0:860:308::/64 2620:0:860:babe::/64 2620:0:860:cabe::/64 2620:0:861:300::/64 2620:0:861:302::/64 2620:0:861:305::/64 2620:0:861:babe::/64 2620:0:861:cabe::/64 208.80.154.0/26 208.80.154.128/26 208.80.154.64/26 208.80.155.96/27 2620:0:861:1::/64 2620:0:861:2::/64 2620:0:861:3::/64 2620:0:861:4::/64 208.80.153.0/27 208.80.153.32/27 208.80.153.64/27 208.80.153.96/27 2620:0:860:1::/64 2620:0:860:2::/64 2620:0:860:3::/64 2620:0:860:4::/64 );
-@def $WIKIKUBE_KUBEPODS_NETWORKS  = (10.67.128.0/17 2620:0:861:cabe::/64 10.194.128.0/17 2620:0:860:cabe::/64 );
-@def $STAGING_KUBEPODS_NETWORKS  = (10.64.64.0/21 2620:0:861:babe::/64 10.192.64.0/21 2620:0:860:babe::/64 );
-@def $MLSERVE_KUBEPODS_NETWORKS = (10.67.16.0/21 2620:0:861:300::/64 10.194.16.0/21 2620:0:860:300::/64 );
-@def $MLSTAGE_KUBEPODS_NETWORKS = (10.194.61.0/24 2620:0:860:302::/64 );
-@def $DSE_KUBEPODS_NETWORKS = (10.67.24.0/21 2620:0:861:302::/64 10.192.96.0/21 2620:0:860:308::/64 );
-@def $AUX_KUBEPODS_NETWORKS = (10.67.80.0/21 2620:0:861:305::/64 10.194.80.0/21 2620:0:860:305::/64 );
-
-@def $NETWORK_INFRA = (185.15.59.128/27 2a02:ec80:300:fe00::/55 198.35.26.128/27 2620:0:863:fe00::/55 208.80.153.192/27 2620:0:860:fe00::/55 10.192.255.0/24 2620:0:860:13f::/64 10.192.253.0/24 2620:0:860:139::/64 208.80.154.192/27 2620:0:861:fe00::/55 10.64.146.0/24 2620:0:861:11b::/128 10.64.168.0/24 2620:0:861:130::/64 10.64.147.0/24 103.102.166.128/27 2001:df2:e500:fe00::/55 185.15.58.128/27 2a02:ec80:600:fe00::/55 195.200.68.128/27 2a02:ec80:700:fe00::/55);
-@def $MGMT_NETWORKS = (10.65.0.0/16 10.128.128.0/17 10.193.0.0/16 10.80.128.0/17 10.132.128.0/17 10.136.128.0/17 10.140.128.0/17 );
-@def $SANDBOX_NETWORKS = (103.102.166.72/29 185.15.59.72/29 195.200.68.64/29 198.35.26.240/28 2001:df2:e500:202::/64 208.80.152.240/28 208.80.155.64/28 2620:0:860:201::/64 2620:0:861:202::/64 2620:0:863:201::/64 2a02:ec80:300:202::/64 2a02:ec80:700:201::/64 );
-
-@def $DEPLOYMENT_HOSTS = (10.64.16.93 2620:0:861:102:10:64:16:93 10.192.32.7 2620:0:860:103:10:192:32:7 );
-@def $CUMIN_MASTERS = (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49 );
-@def $CACHES = (10.64.0.79 2620:0:861:101:10:64:0:79 10.64.0.229 2620:0:861:101:10:64:0:229 10.64.0.14 2620:0:861:101:10:64:0:14 10.64.0.51 2620:0:861:101:10:64:0:51 10.64.16.241 2620:0:861:102:10:64:16:241 10.64.16.94 2620:0:861:102:10:64:16:94 10.64.16.95 2620:0:861:102:10:64:16:95 10.64.16.240 2620:0:861:102:10:64:16:240 10.64.32.14 2620:0:861:103:10:64:32:14 10.64.32.60 2620:0:861:103:10:64:32:60 10.64.32.15 2620:0:861:103:10:64:32:15 10.64.32.65 2620:0:861:103:10:64:32:65 10.64.48.16 2620:0:861:107:10:64:48:16 10.64.48.41 2620:0:861:107:10:64:48:41 10.64.48.27 2620:0:861:107:10:64:48:27 10.64.48.28 2620:0:861:107:10:64:48:28 10.192.23.26 2620:0:860:113:10:192:23:26 10.192.6.20 2620:0:860:107:10:192:6:20 10.192.12.35 2620:0:860:10d:10:192:12:35 10.192.14.25 2620:0:860:10f:10:192:14:25 10.192.4.22 2620:0:860:100:10:192:4:22 10.192.29.26 2620:0:860:116:10:192:29:26 10.192.30.29 2620:0:860:119:10:192:30:29 10.192.36.19 2620:0:860:11b:10:192:36:19 10.192.40.25 2620:0:860:11f:10:192:40:25 10.192.41.21 2620:0:860:120:10:192:41:21 10.192.56.3 2620:0:860:12b:10:192:56:3 10.192.56.4 2620:0:860:12b:10:192:56:4 10.192.57.3 2620:0:860:12c:10:192:57:3 10.192.58.2 2620:0:860:12d:10:192:58:2 10.192.58.3 2620:0:860:12d:10:192:58:3 10.192.59.2 2620:0:860:12e:10:192:59:2 10.80.0.14 2a02:ec80:300:101:10:80:0:14 10.80.1.11 2a02:ec80:300:102:10:80:1:11 10.80.0.13 2a02:ec80:300:101:10:80:0:13 10.80.1.9 2a02:ec80:300:102:10:80:1:9 10.80.0.12 2a02:ec80:300:101:10:80:0:12 10.80.1.7 2a02:ec80:300:102:10:80:1:7 10.80.0.11 2a02:ec80:300:101:10:80:0:11 10.80.1.6 2a02:ec80:300:102:10:80:1:6 10.80.0.10 2a02:ec80:300:101:10:80:0:10 10.80.1.5 2a02:ec80:300:102:10:80:1:5 10.80.0.8 2a02:ec80:300:101:10:80:0:8 10.80.1.4 2a02:ec80:300:102:10:80:1:4 10.80.0.7 2a02:ec80:300:101:10:80:0:7 10.80.1.3 2a02:ec80:300:102:10:80:1:3 10.80.0.6 2a02:ec80:300:101:10:80:0:6 10.80.1.2 2a02:ec80:300:102:10:80:1:2 10.128.0.19 2620:0:863:101:10:128:0:19 10.128.0.27 2620:0:863:101:10:128:0:27 10.128.0.22 2620:0:863:101:10:128:0:22 10.128.0.28 2620:0:863:101:10:128:0:28 10.128.0.25 2620:0:863:101:10:128:0:25 10.128.0.29 2620:0:863:101:10:128:0:29 10.128.0.26 2620:0:863:101:10:128:0:26 10.128.0.31 2620:0:863:101:10:128:0:31 10.128.0.14 2620:0:863:101:10:128:0:14 10.128.0.35 2620:0:863:101:10:128:0:35 10.128.0.21 2620:0:863:101:10:128:0:21 10.128.0.36 2620:0:863:101:10:128:0:36 10.128.0.24 2620:0:863:101:10:128:0:24 10.128.0.10 2620:0:863:101:10:128:0:10 10.128.0.37 2620:0:863:101:10:128:0:37 10.128.0.12 2620:0:863:101:10:128:0:12 10.132.0.17 2001:df2:e500:101:10:132:0:17 10.132.0.18 2001:df2:e500:101:10:132:0:18 10.132.0.19 2001:df2:e500:101:10:132:0:19 10.132.0.24 2001:df2:e500:101:10:132:0:24 10.132.0.29 2001:df2:e500:101:10:132:0:29 10.132.0.30 2001:df2:e500:101:10:132:0:30 10.132.0.34 2001:df2:e500:101:10:132:0:34 10.132.0.35 2001:df2:e500:101:10:132:0:35 10.132.0.36 2001:df2:e500:101:10:132:0:36 10.132.0.37 2001:df2:e500:101:10:132:0:37 10.132.0.38 2001:df2:e500:101:10:132:0:38 10.132.0.25 2001:df2:e500:101:10:132:0:25 10.132.0.26 2001:df2:e500:101:10:132:0:26 10.132.0.27 2001:df2:e500:101:10:132:0:27 10.132.0.28 2001:df2:e500:101:10:132:0:28 10.132.0.16 2001:df2:e500:101:10:132:0:16 10.136.0.6 2a02:ec80:600:101:10:136:0:6 10.136.1.6 2a02:ec80:600:102:10:136:1:6 10.136.0.7 2a02:ec80:600:101:10:136:0:7 10.136.1.7 2a02:ec80:600:102:10:136:1:7 10.136.0.8 2a02:ec80:600:101:10:136:0:8 10.136.1.8 2a02:ec80:600:102:10:136:1:8 10.136.0.9 2a02:ec80:600:101:10:136:0:9 10.136.1.9 2a02:ec80:600:102:10:136:1:9 10.136.0.10 2a02:ec80:600:101:10:136:0:10 10.136.1.10 2a02:ec80:600:102:10:136:1:10 10.136.0.11 2a02:ec80:600:101:10:136:0:11 10.136.1.11 2a02:ec80:600:102:10:136:1:11 10.136.0.12 2a02:ec80:600:101:10:136:0:12 10.136.1.12 2a02:ec80:600:102:10:136:1:12 10.136.0.13 2a02:ec80:600:101:10:136:0:13 10.136.1.13 2a02:ec80:600:102:10:136:1:13 10.140.0.3 2a02:ec80:700:101:10:140:0:3 10.140.1.4 2a02:ec80:700:102:10:140:1:4 10.140.0.4 2a02:ec80:700:101:10:140:0:4 10.140.1.5 2a02:ec80:700:102:10:140:1:5 10.140.0.5 2a02:ec80:700:101:10:140:0:5 10.140.1.6 2a02:ec80:700:102:10:140:1:6 10.140.0.6 2a02:ec80:700:101:10:140:0:6 10.140.1.7 2a02:ec80:700:102:10:140:1:7 10.140.0.7 2a02:ec80:700:101:10:140:0:7 10.140.1.8 2a02:ec80:700:102:10:140:1:8 10.140.0.8 2a02:ec80:700:101:10:140:0:8 10.140.1.9 2a02:ec80:700:102:10:140:1:9 10.140.0.9 2a02:ec80:700:101:10:140:0:9 10.140.1.10 2a02:ec80:700:102:10:140:1:10 10.140.0.10 2a02:ec80:700:101:10:140:0:10 10.140.1.11 2a02:ec80:700:102:10:140:1:11 );
-@def $LOAD_BALANCER_HEALTH_CHECKS = (10.64.0.136 10.64.16.60 10.64.158.19 10.64.166.19 10.64.133.19 10.64.141.19 10.64.169.19 10.64.171.19 10.64.173.19 10.64.175.19 10.64.177.19 10.64.179.19 10.64.181.19 10.64.183.19 10.64.185.19 10.64.187.19 10.64.189.19 10.64.48.72 10.64.37.17 10.64.1.17 10.64.17.17 10.64.33.17 10.64.130.20 10.64.131.20 10.64.132.20 10.64.134.20 10.64.135.20 10.64.136.20 10.64.158.20 10.64.166.20 10.64.133.20 10.64.141.20 10.64.169.20 10.64.171.20 10.64.173.20 10.64.175.20 10.64.177.20 10.64.179.20 10.64.181.20 10.64.183.20 10.64.185.20 10.64.187.20 10.64.189.20 2620:0:861:101::/64 2620:0:861:102::/64 2620:0:861:103::/64 2620:0:861:107::/64 2620:0:861:109::/64 2620:0:861:10a::/64 2620:0:861:10b::/64 2620:0:861:10d::/64 2620:0:861:10e::/64 2620:0:861:10f::/64 2620:0:861:119::/64 2620:0:861:10c::/64 2620:0:861:113::/64 2620:0:861:119::/64 2620:0:861:131::/64 2620:0:861:133::/64 2620:0:861:135::/64 2620:0:861:137::/64 2620:0:861:139::/64 2620:0:861:13b::/64 2620:0:861:13d::/64 2620:0:861:13f::/64 2620:0:861:142::/64 2620:0:861:144::/64 10.192.23.8 10.192.0.29 10.192.17.8 10.192.33.8 10.192.49.8 10.192.23.2 10.192.5.2 10.192.6.2 10.192.7.2 10.192.8.2 10.192.9.2 10.192.10.2 10.192.11.2 10.192.12.2 10.192.13.2 10.192.14.2 10.192.15.2 10.192.21.2 10.192.22.2 10.192.4.2 10.192.26.2 10.192.27.2 10.192.28.2 10.192.29.2 10.192.30.2 10.192.31.2 10.192.36.2 10.192.37.2 10.192.38.2 10.192.39.2 10.192.40.2 10.192.41.2 10.192.42.2 10.192.43.2 10.192.11.8 10.192.16.140 10.192.1.8 10.192.33.9 10.192.49.9 10.192.23.3 10.192.5.3 10.192.6.3 10.192.7.3 10.192.8.3 10.192.9.3 10.192.10.3 10.192.11.3 10.192.12.3 10.192.13.3 10.192.14.3 10.192.15.3 10.192.21.3 10.192.22.3 10.192.4.3 10.192.26.3 10.192.27.3 10.192.28.3 10.192.29.3 10.192.30.3 10.192.31.3 10.192.36.3 10.192.37.3 10.192.38.3 10.192.39.4 10.192.40.3 10.192.41.3 10.192.42.3 10.192.43.3 10.192.32.14 10.192.1.9 10.192.17.9 10.192.49.10 10.192.23.4 10.192.5.4 10.192.6.4 10.192.7.4 10.192.8.4 10.192.9.4 10.192.10.4 10.192.11.4 10.192.12.4 10.192.13.4 10.192.14.4 10.192.15.4 10.192.21.4 10.192.22.4 10.192.4.5 10.192.26.5 10.192.27.5 10.192.28.5 10.192.29.5 10.192.30.5 10.192.31.5 10.192.36.5 10.192.37.5 10.192.38.5 10.192.39.6 10.192.40.5 10.192.41.5 10.192.42.5 10.192.43.5 10.192.48.213 10.192.1.13 10.192.17.10 10.192.33.10 10.192.23.5 10.192.5.8 10.192.6.5 10.192.7.5 10.192.8.5 10.192.9.5 10.192.10.5 10.192.11.5 10.192.12.5 10.192.13.5 10.192.14.5 10.192.15.5 10.192.21.5 10.192.22.5 10.192.4.5 10.192.26.5 10.192.27.5 10.192.28.5 10.192.29.5 10.192.30.5 10.192.31.5 10.192.36.5 10.192.37.5 10.192.38.5 10.192.39.6 10.192.40.5 10.192.41.5 10.192.42.5 10.192.43.5 2620:0:860:101::/64 2620:0:860:102::/64 2620:0:860:103::/64 2620:0:860:104::/64 10.80.0.3 10.80.1.8 10.80.1.14 10.80.0.9 10.80.0.2 10.80.1.10 2a02:ec80:300:101::/64 2a02:ec80:300:102::/64 10.128.0.18 10.128.0.9 10.128.0.11 2620:0:863:101::/64 10.132.0.39 10.132.0.6 10.132.0.7 2001:df2:e500:101::/64 10.136.0.16 10.136.1.19 10.136.1.15 10.136.0.19 10.136.0.17 10.136.1.20 2a02:ec80:600:101::/64 2a02:ec80:600:102::/64 10.140.0.13 10.140.1.2 10.140.1.14 10.140.0.2 10.140.0.14 10.140.1.3 2a02:ec80:700:101::/64 2a02:ec80:700:102::/64 );
-@def $KAFKA_BROKERS_MAIN = (10.192.5.9 2620:0:860:106:10:192:5:9 10.192.22.6 2620:0:860:112:10:192:22:6 10.192.32.4 2620:0:860:103:10:192:32:4 10.192.48.33 2620:0:860:104:10:192:48:33 10.192.48.35 2620:0:860:104:10:192:48:35 10.64.0.101 2620:0:861:101:10:64:0:101 10.64.16.30 2620:0:861:102:10:64:16:30 10.64.32.45 2620:0:861:103:10:64:32:45 10.64.48.37 2620:0:861:107:10:64:48:37 10.64.152.5 2620:0:861:120:10:64:152:5 );
-@def $KAFKA_BROKERS_JUMBO = (10.64.130.10 2620:0:861:109:10:64:130:10 10.64.131.16 2620:0:861:10a:10:64:131:16 10.64.132.21 2620:0:861:10b:10:64:132:21 10.64.134.9 2620:0:861:10d:10:64:134:9 10.64.135.16 2620:0:861:10e:10:64:135:16 10.64.136.11 2620:0:861:10f:10:64:136:11 10.64.154.15 2620:0:861:122:10:64:154:15 10.64.160.16 2620:0:861:128:10:64:160:16 10.64.0.126 2620:0:861:101:10:64:0:126 );
-@def $KAFKA_BROKERS_LOGGING = (10.64.16.205 2620:0:861:102:10:64:16:205 10.64.133.11 2620:0:861:10c:10:64:133:11 10.64.183.12 2620:0:861:13d:10:64:183:12 10.64.131.13 2620:0:861:10a:10:64:131:13 10.64.135.13 2620:0:861:10e:10:64:135:13 10.192.23.29 2620:0:860:113:10:192:23:29 10.192.11.28 2620:0:860:10c:10:192:11:28 10.192.26.22 2620:0:860:105:10:192:26:22 10.192.11.27 2620:0:860:10c:10:192:11:27 10.192.39.25 2620:0:860:11e:10:192:39:25 );
-@def $KAFKAMON_HOSTS = (10.64.32.11 2620:0:861:103:10:64:32:11 10.192.16.139 2620:0:860:102:10:192:16:139 );
-@def $ZOOKEEPER_HOSTS_MAIN = (10.64.0.207 2620:0:861:101:10:64:0:207 10.64.16.110 2620:0:861:102:10:64:16:110 10.64.48.154 2620:0:861:107:10:64:48:154 10.192.16.45 2620:0:860:102:10:192:16:45 10.192.32.52 2620:0:860:103:10:192:32:52 10.192.48.59 2620:0:860:104:10:192:48:59 );
-@def $ZOOKEEPER_FLINK_HOSTS = (10.64.16.9 2620:0:861:102:10:64:16:9 10.64.0.8 2620:0:861:101:10:64:0:8 10.64.32.41 2620:0:861:103:10:64:32:41 10.192.16.227 2620:0:860:102:10:192:16:227 10.192.32.179 2620:0:860:103:10:192:32:179 10.192.48.219 2620:0:860:104:10:192:48:219 );
-@def $DRUID_PUBLIC_HOSTS = (10.64.131.9 2620:0:861:10a:10:64:131:9 10.64.132.12 2620:0:861:10b:10:64:132:12 10.64.135.9 2620:0:861:10e:10:64:135:9 10.64.32.101 2620:0:861:103:10:64:32:101 10.64.48.185 2620:0:861:107:10:64:48:185 );
-@def $LABSTORE_HOSTS = (208.80.154.142 2620:0:861:2:208:80:154:142 208.80.154.71 2620:0:861:3:208:80:154:71 );
-@def $MYSQL_ROOT_CLIENTS = (10.64.16.90 10.192.16.191 10.64.16.154 10.192.32.49 208.80.155.103 208.80.154.9 10.64.0.20 );
-
-# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-codfw-bgp-private-vips
-@def $CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS_IPV4 = (172.20.254.0/24);
-@def $CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS_IPV6 = (2a02:ec80:a100:2ff::/64);
-@def $CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS = ($CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS_IPV4 $CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS_IPV6 );
-
-# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-instances-flat3-codfw
-@def $CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW_IPV4 = (172.16.129.0/24);
-@def $CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW_IPV6 = (2a02:ec80:a100:1::/64);
-@def $CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW = ($CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW_IPV4 $CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW_IPV6 );
-
-# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-instances-octavia-lb-mgmt-net-codfw1dev
-@def $CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV_IPV4 = (172.16.131.0/24);
-@def $CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV_IPV6 = (2a02:ec80:a100:100::/64);
-@def $CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV = ($CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV_IPV4 $CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV_IPV6 );
-
-# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-instances-vxlan-ipv4-only-codfw
-@def $CODFW_PRIVATE_CLOUD_INSTANCES_VXLAN_IPV4_ONLY_CODFW_IPV4 = (172.16.130.0/24);
-@def $CODFW_PRIVATE_CLOUD_INSTANCES_VXLAN_IPV4_ONLY_CODFW = ($CODFW_PRIVATE_CLOUD_INSTANCES_VXLAN_IPV4_ONLY_CODFW_IPV4 );
-
-# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-instances2-b-codfw
-@def $CODFW_PRIVATE_CLOUD_INSTANCES2_B_CODFW_IPV4 = (172.16.128.0/24);
-@def $CODFW_PRIVATE_CLOUD_INSTANCES2_B_CODFW = ($CODFW_PRIVATE_CLOUD_INSTANCES2_B_CODFW_IPV4 );
-
-# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-private-b1-codfw
-@def $CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW_IPV4 = (172.20.5.0/24);
-@def $CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW_IPV6 = (2a02:ec80:a100:205::/64);
-@def $CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW = ($CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW_IPV4 $CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW_IPV6 );
-
-# Realm: cloud, # Site: codfw, # Sphere: public, # Network: cloud-codfw1dev-bgp-public-vips
-@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS_IPV4 = (185.15.57.24/29);
-@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS_IPV6 = (2a02:ec80:a100:4000::/64);
-@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS = ($CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS_IPV4 $CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS_IPV6 );
-
-# Realm: cloud, # Site: codfw, # Sphere: public, # Network: cloud-codfw1dev-floating
-@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_IPV4 = (185.15.57.0/29);
-@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING = ($CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_IPV4 );
-
-# Realm: cloud, # Site: codfw, # Sphere: public, # Network: cloud-codfw1dev-floating-additional
-@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_ADDITIONAL_IPV4 = (185.15.57.16/29);
-@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_ADDITIONAL = ($CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_ADDITIONAL_IPV4 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-eqiad-bgp-private-vips
-@def $EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS_IPV4 = (172.20.255.0/24);
-@def $EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS_IPV6 = (2a02:ec80:a000:2ff::/64);
-@def $EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS = ($EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS_IPV4 $EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS_IPV6 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-instances-octavia-lb-mgmt-net-eqiad1
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1_IPV4 = (172.16.24.0/24);
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1_IPV6 = (2a02:ec80:a000:100::/64);
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1 = ($EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1_IPV4 $EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1_IPV6 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-instances-vxlan-dualstack-eqiad
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD_IPV4 = (172.16.16.0/21);
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD_IPV6 = (2a02:ec80:a000:1::/64);
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD = ($EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD_IPV6 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-instances-vxlan-v4only-eqiad
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_V4ONLY_EQIAD_IPV4 = (172.16.8.0/21);
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_V4ONLY_EQIAD = ($EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_V4ONLY_EQIAD_IPV4 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-instances2-b-eqiad
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES2_B_EQIAD_IPV4 = (172.16.0.0/21);
-@def $EQIAD_PRIVATE_CLOUD_INSTANCES2_B_EQIAD = ($EQIAD_PRIVATE_CLOUD_INSTANCES2_B_EQIAD_IPV4 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-private-c8-eqiad
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD_IPV4 = (172.20.1.0/24);
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD_IPV6 = (2a02:ec80:a000:201::/64);
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD = ($EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD_IPV6 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-private-d5-eqiad
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD_IPV4 = (172.20.2.0/24);
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD_IPV6 = (2a02:ec80:a000:202::/64);
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD = ($EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD_IPV6 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-private-e4-eqiad
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD_IPV4 = (172.20.3.0/24);
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD_IPV6 = (2a02:ec80:a000:203::/64);
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD = ($EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD_IPV6 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-private-f4-eqiad
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD_IPV4 = (172.20.4.0/24);
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD_IPV6 = (2a02:ec80:a000:204::/64);
-@def $EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD = ($EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD_IPV6 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: public, # Network: cloud-eqiad1-bgp-public-vips
-@def $EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS_IPV4 = (185.15.56.160/28);
-@def $EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS_IPV6 = (2a02:ec80:a000:4000::/64);
-@def $EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS = ($EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS_IPV4 $EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS_IPV6 );
-
-# Realm: cloud, # Site: eqiad, # Sphere: public, # Network: cloud-eqiad1-floating
-@def $EQIAD_PUBLIC_CLOUD_EQIAD1_FLOATING_IPV4 = (185.15.56.0/25);
-@def $EQIAD_PUBLIC_CLOUD_EQIAD1_FLOATING = ($EQIAD_PUBLIC_CLOUD_EQIAD1_FLOATING_IPV4 );
-
-# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-administration-codfw
-@def $CODFW_PRIVATE_FRACK_ADMINISTRATION_CODFW_IPV4 = (10.195.0.64/28);
-@def $CODFW_PRIVATE_FRACK_ADMINISTRATION_CODFW = ($CODFW_PRIVATE_FRACK_ADMINISTRATION_CODFW_IPV4 );
-
-# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-bastion-codfw
-@def $CODFW_PRIVATE_FRACK_BASTION_CODFW_IPV4 = (10.195.0.128/29);
-@def $CODFW_PRIVATE_FRACK_BASTION_CODFW = ($CODFW_PRIVATE_FRACK_BASTION_CODFW_IPV4 );
-
-# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-fundraising-codfw
-@def $CODFW_PRIVATE_FRACK_FUNDRAISING_CODFW_IPV4 = (10.195.0.32/27);
-@def $CODFW_PRIVATE_FRACK_FUNDRAISING_CODFW = ($CODFW_PRIVATE_FRACK_FUNDRAISING_CODFW_IPV4 );
-
-# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-listenerdmz-codfw
-@def $CODFW_PRIVATE_FRACK_LISTENERDMZ_CODFW_IPV4 = (10.195.0.80/29);
-@def $CODFW_PRIVATE_FRACK_LISTENERDMZ_CODFW = ($CODFW_PRIVATE_FRACK_LISTENERDMZ_CODFW_IPV4 );
-
-# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-management-codfw
-@def $CODFW_PRIVATE_FRACK_MANAGEMENT_CODFW_IPV4 = (10.195.1.0/25);
-@def $CODFW_PRIVATE_FRACK_MANAGEMENT_CODFW = ($CODFW_PRIVATE_FRACK_MANAGEMENT_CODFW_IPV4 );
-
-# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-management-legacy-codfw
-@def $CODFW_PRIVATE_FRACK_MANAGEMENT_LEGACY_CODFW_IPV4 = (10.195.0.96/27);
-@def $CODFW_PRIVATE_FRACK_MANAGEMENT_LEGACY_CODFW = ($CODFW_PRIVATE_FRACK_MANAGEMENT_LEGACY_CODFW_IPV4 );
-
-# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-payments-codfw
-@def $CODFW_PRIVATE_FRACK_PAYMENTS_CODFW_IPV4 = (10.195.0.0/27);
-@def $CODFW_PRIVATE_FRACK_PAYMENTS_CODFW = ($CODFW_PRIVATE_FRACK_PAYMENTS_CODFW_IPV4 );
-
-# Realm: frack, # Site: codfw, # Sphere: public, # Network: frack-external-codfw
-@def $CODFW_PUBLIC_FRACK_EXTERNAL_CODFW_IPV4 = (208.80.152.224/28);
-@def $CODFW_PUBLIC_FRACK_EXTERNAL_CODFW = ($CODFW_PUBLIC_FRACK_EXTERNAL_CODFW_IPV4 );
-
-# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-administration1-e15-eqiad
-@def $EQIAD_PRIVATE_FRACK_ADMINISTRATION1_E15_EQIAD_IPV4 = (10.64.40.64/27);
-@def $EQIAD_PRIVATE_FRACK_ADMINISTRATION1_E15_EQIAD = ($EQIAD_PRIVATE_FRACK_ADMINISTRATION1_E15_EQIAD_IPV4 );
-
-# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-bastion1-e15-eqiad
-@def $EQIAD_PRIVATE_FRACK_BASTION1_E15_EQIAD_IPV4 = (10.64.40.32/27);
-@def $EQIAD_PRIVATE_FRACK_BASTION1_E15_EQIAD = ($EQIAD_PRIVATE_FRACK_BASTION1_E15_EQIAD_IPV4 );
-
-# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-fundraising1-e16-eqiad
-@def $EQIAD_PRIVATE_FRACK_FUNDRAISING1_E16_EQIAD_IPV4 = (10.64.40.96/27);
-@def $EQIAD_PRIVATE_FRACK_FUNDRAISING1_E16_EQIAD = ($EQIAD_PRIVATE_FRACK_FUNDRAISING1_E16_EQIAD_IPV4 );
-
-# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-listenerdmz1-e15-eqiad
-@def $EQIAD_PRIVATE_FRACK_LISTENERDMZ1_E15_EQIAD_IPV4 = (10.64.40.160/27);
-@def $EQIAD_PRIVATE_FRACK_LISTENERDMZ1_E15_EQIAD = ($EQIAD_PRIVATE_FRACK_LISTENERDMZ1_E15_EQIAD_IPV4 );
-
-# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-management1-eqiad
-@def $EQIAD_PRIVATE_FRACK_MANAGEMENT1_EQIAD_IPV4 = (10.64.40.192/26);
-@def $EQIAD_PRIVATE_FRACK_MANAGEMENT1_EQIAD = ($EQIAD_PRIVATE_FRACK_MANAGEMENT1_EQIAD_IPV4 );
-
-# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-payments1-e15-eqiad
-@def $EQIAD_PRIVATE_FRACK_PAYMENTS1_E15_EQIAD_IPV4 = (10.64.40.0/27);
-@def $EQIAD_PRIVATE_FRACK_PAYMENTS1_E15_EQIAD = ($EQIAD_PRIVATE_FRACK_PAYMENTS1_E15_EQIAD_IPV4 );
-
-# Realm: frack, # Site: eqiad, # Sphere: public, # Network: frack-external1-eqiad
-@def $EQIAD_PUBLIC_FRACK_EXTERNAL1_EQIAD_IPV4 = (208.80.155.0/27);
-@def $EQIAD_PUBLIC_FRACK_EXTERNAL1_EQIAD = ($EQIAD_PUBLIC_FRACK_EXTERNAL1_EQIAD_IPV4 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: cloud-hosts1-b1-codfw
-@def $CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW_IPV4 = (10.192.20.0/24);
-@def $CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW_IPV6 = (2620:0:860:118::/64);
-@def $CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW = ($CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW_IPV4 $CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a-codfw
-@def $CODFW_PRIVATE_PRIVATE1_A_CODFW_IPV4 = (10.192.0.0/22);
-@def $CODFW_PRIVATE_PRIVATE1_A_CODFW_IPV6 = (2620:0:860:101::/64);
-@def $CODFW_PRIVATE_PRIVATE1_A_CODFW = ($CODFW_PRIVATE_PRIVATE1_A_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a2-codfw
-@def $CODFW_PRIVATE_PRIVATE1_A2_CODFW_IPV4 = (10.192.23.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_A2_CODFW_IPV6 = (2620:0:860:113::/64);
-@def $CODFW_PRIVATE_PRIVATE1_A2_CODFW = ($CODFW_PRIVATE_PRIVATE1_A2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A2_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a3-codfw
-@def $CODFW_PRIVATE_PRIVATE1_A3_CODFW_IPV4 = (10.192.5.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_A3_CODFW_IPV6 = (2620:0:860:106::/64);
-@def $CODFW_PRIVATE_PRIVATE1_A3_CODFW = ($CODFW_PRIVATE_PRIVATE1_A3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A3_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a4-codfw
-@def $CODFW_PRIVATE_PRIVATE1_A4_CODFW_IPV4 = (10.192.6.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_A4_CODFW_IPV6 = (2620:0:860:107::/64);
-@def $CODFW_PRIVATE_PRIVATE1_A4_CODFW = ($CODFW_PRIVATE_PRIVATE1_A4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A4_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a5-codfw
-@def $CODFW_PRIVATE_PRIVATE1_A5_CODFW_IPV4 = (10.192.7.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_A5_CODFW_IPV6 = (2620:0:860:108::/64);
-@def $CODFW_PRIVATE_PRIVATE1_A5_CODFW = ($CODFW_PRIVATE_PRIVATE1_A5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A5_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a6-codfw
-@def $CODFW_PRIVATE_PRIVATE1_A6_CODFW_IPV4 = (10.192.8.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_A6_CODFW_IPV6 = (2620:0:860:109::/64);
-@def $CODFW_PRIVATE_PRIVATE1_A6_CODFW = ($CODFW_PRIVATE_PRIVATE1_A6_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A6_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a7-codfw
-@def $CODFW_PRIVATE_PRIVATE1_A7_CODFW_IPV4 = (10.192.9.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_A7_CODFW_IPV6 = (2620:0:860:10a::/64);
-@def $CODFW_PRIVATE_PRIVATE1_A7_CODFW = ($CODFW_PRIVATE_PRIVATE1_A7_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A7_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a8-codfw
-@def $CODFW_PRIVATE_PRIVATE1_A8_CODFW_IPV4 = (10.192.10.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_A8_CODFW_IPV6 = (2620:0:860:10b::/64);
-@def $CODFW_PRIVATE_PRIVATE1_A8_CODFW = ($CODFW_PRIVATE_PRIVATE1_A8_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A8_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-aux-kubepods-codfw
-@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW_IPV4 = (10.194.80.0/21);
-@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW_IPV6 = (2620:0:860:305::/64);
-@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-aux-kubesvc-codfw
-@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW_IPV4 = (10.194.64.0/20);
-@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW_IPV6 = (2620:0:860:304::/64);
-@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b-codfw
-@def $CODFW_PRIVATE_PRIVATE1_B_CODFW_IPV4 = (10.192.16.0/22);
-@def $CODFW_PRIVATE_PRIVATE1_B_CODFW_IPV6 = (2620:0:860:102::/64);
-@def $CODFW_PRIVATE_PRIVATE1_B_CODFW = ($CODFW_PRIVATE_PRIVATE1_B_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b2-codfw
-@def $CODFW_PRIVATE_PRIVATE1_B2_CODFW_IPV4 = (10.192.11.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_B2_CODFW_IPV6 = (2620:0:860:10c::/64);
-@def $CODFW_PRIVATE_PRIVATE1_B2_CODFW = ($CODFW_PRIVATE_PRIVATE1_B2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B2_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b3-codfw
-@def $CODFW_PRIVATE_PRIVATE1_B3_CODFW_IPV4 = (10.192.12.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_B3_CODFW_IPV6 = (2620:0:860:10d::/64);
-@def $CODFW_PRIVATE_PRIVATE1_B3_CODFW = ($CODFW_PRIVATE_PRIVATE1_B3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B3_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b4-codfw
-@def $CODFW_PRIVATE_PRIVATE1_B4_CODFW_IPV4 = (10.192.13.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_B4_CODFW_IPV6 = (2620:0:860:10e::/64);
-@def $CODFW_PRIVATE_PRIVATE1_B4_CODFW = ($CODFW_PRIVATE_PRIVATE1_B4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B4_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b5-codfw
-@def $CODFW_PRIVATE_PRIVATE1_B5_CODFW_IPV4 = (10.192.14.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_B5_CODFW_IPV6 = (2620:0:860:10f::/64);
-@def $CODFW_PRIVATE_PRIVATE1_B5_CODFW = ($CODFW_PRIVATE_PRIVATE1_B5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B5_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b6-codfw
-@def $CODFW_PRIVATE_PRIVATE1_B6_CODFW_IPV4 = (10.192.15.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_B6_CODFW_IPV6 = (2620:0:860:110::/64);
-@def $CODFW_PRIVATE_PRIVATE1_B6_CODFW = ($CODFW_PRIVATE_PRIVATE1_B6_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B6_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b7-codfw
-@def $CODFW_PRIVATE_PRIVATE1_B7_CODFW_IPV4 = (10.192.21.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_B7_CODFW_IPV6 = (2620:0:860:111::/64);
-@def $CODFW_PRIVATE_PRIVATE1_B7_CODFW = ($CODFW_PRIVATE_PRIVATE1_B7_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B7_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b8-codfw
-@def $CODFW_PRIVATE_PRIVATE1_B8_CODFW_IPV4 = (10.192.22.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_B8_CODFW_IPV6 = (2620:0:860:112::/64);
-@def $CODFW_PRIVATE_PRIVATE1_B8_CODFW = ($CODFW_PRIVATE_PRIVATE1_B8_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B8_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c-codfw
-@def $CODFW_PRIVATE_PRIVATE1_C_CODFW_IPV4 = (10.192.32.0/22);
-@def $CODFW_PRIVATE_PRIVATE1_C_CODFW_IPV6 = (2620:0:860:103::/64);
-@def $CODFW_PRIVATE_PRIVATE1_C_CODFW = ($CODFW_PRIVATE_PRIVATE1_C_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c1-codfw
-@def $CODFW_PRIVATE_PRIVATE1_C1_CODFW_IPV4 = (10.192.4.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_C1_CODFW_IPV6 = (2620:0:860:100::/64);
-@def $CODFW_PRIVATE_PRIVATE1_C1_CODFW = ($CODFW_PRIVATE_PRIVATE1_C1_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C1_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c2-codfw
-@def $CODFW_PRIVATE_PRIVATE1_C2_CODFW_IPV4 = (10.192.26.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_C2_CODFW_IPV6 = (2620:0:860:105::/64);
-@def $CODFW_PRIVATE_PRIVATE1_C2_CODFW = ($CODFW_PRIVATE_PRIVATE1_C2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C2_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c3-codfw
-@def $CODFW_PRIVATE_PRIVATE1_C3_CODFW_IPV4 = (10.192.27.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_C3_CODFW_IPV6 = (2620:0:860:114::/64);
-@def $CODFW_PRIVATE_PRIVATE1_C3_CODFW = ($CODFW_PRIVATE_PRIVATE1_C3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C3_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c4-codfw
-@def $CODFW_PRIVATE_PRIVATE1_C4_CODFW_IPV4 = (10.192.28.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_C4_CODFW_IPV6 = (2620:0:860:115::/64);
-@def $CODFW_PRIVATE_PRIVATE1_C4_CODFW = ($CODFW_PRIVATE_PRIVATE1_C4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C4_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c5-codfw
-@def $CODFW_PRIVATE_PRIVATE1_C5_CODFW_IPV4 = (10.192.29.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_C5_CODFW_IPV6 = (2620:0:860:116::/64);
-@def $CODFW_PRIVATE_PRIVATE1_C5_CODFW = ($CODFW_PRIVATE_PRIVATE1_C5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C5_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c6-codfw
-@def $CODFW_PRIVATE_PRIVATE1_C6_CODFW_IPV4 = (10.192.30.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_C6_CODFW_IPV6 = (2620:0:860:119::/64);
-@def $CODFW_PRIVATE_PRIVATE1_C6_CODFW = ($CODFW_PRIVATE_PRIVATE1_C6_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C6_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c7-codfw
-@def $CODFW_PRIVATE_PRIVATE1_C7_CODFW_IPV4 = (10.192.31.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_C7_CODFW_IPV6 = (2620:0:860:11a::/64);
-@def $CODFW_PRIVATE_PRIVATE1_C7_CODFW = ($CODFW_PRIVATE_PRIVATE1_C7_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C7_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D_CODFW_IPV4 = (10.192.48.0/22);
-@def $CODFW_PRIVATE_PRIVATE1_D_CODFW_IPV6 = (2620:0:860:104::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D_CODFW = ($CODFW_PRIVATE_PRIVATE1_D_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d1-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D1_CODFW_IPV4 = (10.192.36.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_D1_CODFW_IPV6 = (2620:0:860:11b::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D1_CODFW = ($CODFW_PRIVATE_PRIVATE1_D1_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D1_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d2-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D2_CODFW_IPV4 = (10.192.37.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_D2_CODFW_IPV6 = (2620:0:860:11c::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D2_CODFW = ($CODFW_PRIVATE_PRIVATE1_D2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D2_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d3-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D3_CODFW_IPV4 = (10.192.38.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_D3_CODFW_IPV6 = (2620:0:860:11d::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D3_CODFW = ($CODFW_PRIVATE_PRIVATE1_D3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D3_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d4-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D4_CODFW_IPV4 = (10.192.39.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_D4_CODFW_IPV6 = (2620:0:860:11e::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D4_CODFW = ($CODFW_PRIVATE_PRIVATE1_D4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D4_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d5-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D5_CODFW_IPV4 = (10.192.40.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_D5_CODFW_IPV6 = (2620:0:860:11f::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D5_CODFW = ($CODFW_PRIVATE_PRIVATE1_D5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D5_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d6-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D6_CODFW_IPV4 = (10.192.41.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_D6_CODFW_IPV6 = (2620:0:860:120::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D6_CODFW = ($CODFW_PRIVATE_PRIVATE1_D6_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D6_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d7-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D7_CODFW_IPV4 = (10.192.42.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_D7_CODFW_IPV6 = (2620:0:860:121::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D7_CODFW = ($CODFW_PRIVATE_PRIVATE1_D7_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D7_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d8-codfw
-@def $CODFW_PRIVATE_PRIVATE1_D8_CODFW_IPV4 = (10.192.43.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_D8_CODFW_IPV6 = (2620:0:860:122::/64);
-@def $CODFW_PRIVATE_PRIVATE1_D8_CODFW = ($CODFW_PRIVATE_PRIVATE1_D8_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D8_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-dse-kubepods-codfw
-@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW_IPV4 = (10.192.96.0/21);
-@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW_IPV6 = (2620:0:860:308::/64);
-@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-dse-kubesvc-codfw
-@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW_IPV4 = (10.192.80.0/20);
-@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW_IPV6 = (2620:0:860:307::/64);
-@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e1-codfw
-@def $CODFW_PRIVATE_PRIVATE1_E1_CODFW_IPV4 = (10.192.56.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_E1_CODFW_IPV6 = (2620:0:860:12b::/64);
-@def $CODFW_PRIVATE_PRIVATE1_E1_CODFW = ($CODFW_PRIVATE_PRIVATE1_E1_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E1_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e2-codfw
-@def $CODFW_PRIVATE_PRIVATE1_E2_CODFW_IPV4 = (10.192.44.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_E2_CODFW_IPV6 = (2620:0:860:123::/64);
-@def $CODFW_PRIVATE_PRIVATE1_E2_CODFW = ($CODFW_PRIVATE_PRIVATE1_E2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E2_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e3-codfw
-@def $CODFW_PRIVATE_PRIVATE1_E3_CODFW_IPV4 = (10.192.57.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_E3_CODFW_IPV6 = (2620:0:860:12c::/64);
-@def $CODFW_PRIVATE_PRIVATE1_E3_CODFW = ($CODFW_PRIVATE_PRIVATE1_E3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E3_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e4-codfw
-@def $CODFW_PRIVATE_PRIVATE1_E4_CODFW_IPV4 = (10.192.45.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_E4_CODFW_IPV6 = (2620:0:860:124::/64);
-@def $CODFW_PRIVATE_PRIVATE1_E4_CODFW = ($CODFW_PRIVATE_PRIVATE1_E4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E4_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e5-codfw
-@def $CODFW_PRIVATE_PRIVATE1_E5_CODFW_IPV4 = (10.192.46.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_E5_CODFW_IPV6 = (2620:0:860:125::/64);
-@def $CODFW_PRIVATE_PRIVATE1_E5_CODFW = ($CODFW_PRIVATE_PRIVATE1_E5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E5_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-f1-codfw
-@def $CODFW_PRIVATE_PRIVATE1_F1_CODFW_IPV4 = (10.192.58.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_F1_CODFW_IPV6 = (2620:0:860:12d::/64);
-@def $CODFW_PRIVATE_PRIVATE1_F1_CODFW = ($CODFW_PRIVATE_PRIVATE1_F1_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_F1_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-f2-codfw
-@def $CODFW_PRIVATE_PRIVATE1_F2_CODFW_IPV4 = (10.192.47.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_F2_CODFW_IPV6 = (2620:0:860:126::/64);
-@def $CODFW_PRIVATE_PRIVATE1_F2_CODFW = ($CODFW_PRIVATE_PRIVATE1_F2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_F2_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-f3-codfw
-@def $CODFW_PRIVATE_PRIVATE1_F3_CODFW_IPV4 = (10.192.59.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_F3_CODFW_IPV6 = (2620:0:860:12e::/64);
-@def $CODFW_PRIVATE_PRIVATE1_F3_CODFW = ($CODFW_PRIVATE_PRIVATE1_F3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_F3_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-f4-codfw
-@def $CODFW_PRIVATE_PRIVATE1_F4_CODFW_IPV4 = (10.192.52.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_F4_CODFW_IPV6 = (2620:0:860:127::/64);
-@def $CODFW_PRIVATE_PRIVATE1_F4_CODFW = ($CODFW_PRIVATE_PRIVATE1_F4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_F4_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-lvs-codfw
-@def $CODFW_PRIVATE_PRIVATE1_LVS_CODFW_IPV4 = (10.2.1.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_LVS_CODFW = ($CODFW_PRIVATE_PRIVATE1_LVS_CODFW_IPV4 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-mlserve-kubepods-codfw
-@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW_IPV4 = (10.194.16.0/21);
-@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW_IPV6 = (2620:0:860:300::/64);
-@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-mlserve-kubesvc-codfw
-@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW_IPV4 = (10.194.0.0/20);
-@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW_IPV6 = (2620:0:860:301::/64);
-@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-mlstage-kubepods-codfw
-@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW_IPV4 = (10.194.61.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW_IPV6 = (2620:0:860:302::/64);
-@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-mlstage-kubesvc-codfw
-@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW_IPV4 = (10.194.62.0/23);
-@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW_IPV6 = (2620:0:860:303::/64);
-@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-services-kubepods-codfw
-@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW_IPV4 = (10.194.128.0/17);
-@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW_IPV6 = (2620:0:860:cabe::/64);
-@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-services-kubesvc-codfw
-@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW_IPV4 = (10.192.72.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW_IPV6 = (2620:0:860:cabf::/64);
-@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-staging-kubepods-codfw
-@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW_IPV4 = (10.192.64.0/21);
-@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW_IPV6 = (2620:0:860:babe::/64);
-@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-staging-kubesvc-codfw
-@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW_IPV4 = (10.192.76.0/24);
-@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW_IPV6 = (2620:0:860:babf::/64);
-@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-virtual-codfw
-@def $CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW_IPV4 = (10.192.24.0/23);
-@def $CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW_IPV6 = (2620:0:860:140::/64);
-@def $CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW = ($CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-a-codfw
-@def $CODFW_PUBLIC_PUBLIC1_A_CODFW_IPV4 = (208.80.153.0/27);
-@def $CODFW_PUBLIC_PUBLIC1_A_CODFW_IPV6 = (2620:0:860:1::/64);
-@def $CODFW_PUBLIC_PUBLIC1_A_CODFW = ($CODFW_PUBLIC_PUBLIC1_A_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_A_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-b-codfw
-@def $CODFW_PUBLIC_PUBLIC1_B_CODFW_IPV4 = (208.80.153.32/27);
-@def $CODFW_PUBLIC_PUBLIC1_B_CODFW_IPV6 = (2620:0:860:2::/64);
-@def $CODFW_PUBLIC_PUBLIC1_B_CODFW = ($CODFW_PUBLIC_PUBLIC1_B_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_B_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-c-codfw
-@def $CODFW_PUBLIC_PUBLIC1_C_CODFW_IPV4 = (208.80.153.64/27);
-@def $CODFW_PUBLIC_PUBLIC1_C_CODFW_IPV6 = (2620:0:860:3::/64);
-@def $CODFW_PUBLIC_PUBLIC1_C_CODFW = ($CODFW_PUBLIC_PUBLIC1_C_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_C_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-d-codfw
-@def $CODFW_PUBLIC_PUBLIC1_D_CODFW_IPV4 = (208.80.153.96/27);
-@def $CODFW_PUBLIC_PUBLIC1_D_CODFW_IPV6 = (2620:0:860:4::/64);
-@def $CODFW_PUBLIC_PUBLIC1_D_CODFW = ($CODFW_PUBLIC_PUBLIC1_D_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_D_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-lvs-codfw
-@def $CODFW_PUBLIC_PUBLIC1_LVS_CODFW_IPV4 = (208.80.153.224/27);
-@def $CODFW_PUBLIC_PUBLIC1_LVS_CODFW_IPV6 = (2620:0:860:ed1a::/64);
-@def $CODFW_PUBLIC_PUBLIC1_LVS_CODFW = ($CODFW_PUBLIC_PUBLIC1_LVS_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_LVS_CODFW_IPV6 );
-
-# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-virtual-codfw
-@def $CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW_IPV4 = (208.80.152.128/27);
-@def $CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW_IPV6 = (2620:0:860:5::/64);
-@def $CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW = ($CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW_IPV6 );
-
-# Realm: production, # Site: drmrs, # Sphere: private, # Network: private1-b12-drmrs
-@def $DRMRS_PRIVATE_PRIVATE1_B12_DRMRS_IPV4 = (10.136.0.0/24);
-@def $DRMRS_PRIVATE_PRIVATE1_B12_DRMRS_IPV6 = (2a02:ec80:600:101::/64);
-@def $DRMRS_PRIVATE_PRIVATE1_B12_DRMRS = ($DRMRS_PRIVATE_PRIVATE1_B12_DRMRS_IPV4 $DRMRS_PRIVATE_PRIVATE1_B12_DRMRS_IPV6 );
-
-# Realm: production, # Site: drmrs, # Sphere: private, # Network: private1-b13-drmrs
-@def $DRMRS_PRIVATE_PRIVATE1_B13_DRMRS_IPV4 = (10.136.1.0/24);
-@def $DRMRS_PRIVATE_PRIVATE1_B13_DRMRS_IPV6 = (2a02:ec80:600:102::/64);
-@def $DRMRS_PRIVATE_PRIVATE1_B13_DRMRS = ($DRMRS_PRIVATE_PRIVATE1_B13_DRMRS_IPV4 $DRMRS_PRIVATE_PRIVATE1_B13_DRMRS_IPV6 );
-
-# Realm: production, # Site: drmrs, # Sphere: private, # Network: private1-lvs-drmrs
-@def $DRMRS_PRIVATE_PRIVATE1_LVS_DRMRS_IPV4 = (10.2.6.0/24);
-@def $DRMRS_PRIVATE_PRIVATE1_LVS_DRMRS = ($DRMRS_PRIVATE_PRIVATE1_LVS_DRMRS_IPV4 );
-
-# Realm: production, # Site: drmrs, # Sphere: public, # Network: public1-b12-drmrs
-@def $DRMRS_PUBLIC_PUBLIC1_B12_DRMRS_IPV4 = (185.15.58.0/27);
-@def $DRMRS_PUBLIC_PUBLIC1_B12_DRMRS_IPV6 = (2a02:ec80:600:1::/64);
-@def $DRMRS_PUBLIC_PUBLIC1_B12_DRMRS = ($DRMRS_PUBLIC_PUBLIC1_B12_DRMRS_IPV4 $DRMRS_PUBLIC_PUBLIC1_B12_DRMRS_IPV6 );
-
-# Realm: production, # Site: drmrs, # Sphere: public, # Network: public1-b13-drmrs
-@def $DRMRS_PUBLIC_PUBLIC1_B13_DRMRS_IPV4 = (185.15.58.32/27);
-@def $DRMRS_PUBLIC_PUBLIC1_B13_DRMRS_IPV6 = (2a02:ec80:600:2::/64);
-@def $DRMRS_PUBLIC_PUBLIC1_B13_DRMRS = ($DRMRS_PUBLIC_PUBLIC1_B13_DRMRS_IPV4 $DRMRS_PUBLIC_PUBLIC1_B13_DRMRS_IPV6 );
-
-# Realm: production, # Site: drmrs, # Sphere: public, # Network: public1-lvs-drmrs
-@def $DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS_IPV4 = (185.15.58.224/27);
-@def $DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS_IPV6 = (2a02:ec80:600:ed1a::/64);
-@def $DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS = ($DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS_IPV4 $DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-a-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_A_EQIAD_IPV4 = (10.64.5.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_A_EQIAD_IPV6 = (2620:0:861:104::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_A_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_A_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_A_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-b-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_B_EQIAD_IPV4 = (10.64.21.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_B_EQIAD_IPV6 = (2620:0:861:105::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_B_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_B_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_B_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_C_EQIAD_IPV4 = (10.64.36.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_C_EQIAD_IPV6 = (2620:0:861:106::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_C_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c2-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD_IPV4 = (10.64.137.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD_IPV6 = (2620:0:861:110::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c3-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD_IPV4 = (10.64.145.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD_IPV6 = (2620:0:861:117::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c4-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD_IPV4 = (10.64.170.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD_IPV6 = (2620:0:861:11a::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c5-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD_IPV4 = (10.64.172.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD_IPV6 = (2620:0:861:132::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c6-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD_IPV4 = (10.64.174.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD_IPV6 = (2620:0:861:134::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c7-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD_IPV4 = (10.64.176.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD_IPV6 = (2620:0:861:136::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_D_EQIAD_IPV4 = (10.64.53.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_D_EQIAD_IPV6 = (2620:0:861:108::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_D_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d1-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD_IPV4 = (10.64.178.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD_IPV6 = (2620:0:861:138::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d2-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD_IPV4 = (10.64.180.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD_IPV6 = (2620:0:861:13a::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d3-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD_IPV4 = (10.64.182.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD_IPV6 = (2620:0:861:13c::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d4-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD_IPV4 = (10.64.184.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD_IPV6 = (2620:0:861:13e::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d6-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD_IPV4 = (10.64.186.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD_IPV6 = (2620:0:861:141::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d7-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD_IPV4 = (10.64.188.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD_IPV6 = (2620:0:861:143::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d8-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD_IPV4 = (10.64.190.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD_IPV6 = (2620:0:861:145::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e1-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD_IPV4 = (10.64.138.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD_IPV6 = (2620:0:861:100::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e2-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD_IPV4 = (10.64.139.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD_IPV6 = (2620:0:861:111::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e3-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD_IPV4 = (10.64.140.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD_IPV6 = (2620:0:861:112::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e5-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD_IPV4 = (10.64.153.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD_IPV6 = (2620:0:861:121::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e6-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD_IPV4 = (10.64.155.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD_IPV6 = (2620:0:861:123::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e7-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD_IPV4 = (10.64.157.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD_IPV6 = (2620:0:861:125::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e8-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD_IPV4 = (10.64.159.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD_IPV6 = (2620:0:861:127::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f1-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD_IPV4 = (10.64.142.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD_IPV6 = (2620:0:861:114::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f2-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD_IPV4 = (10.64.143.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD_IPV6 = (2620:0:861:115::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f3-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD_IPV4 = (10.64.144.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD_IPV6 = (2620:0:861:116::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f5-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD_IPV4 = (10.64.161.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD_IPV6 = (2620:0:861:129::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f6-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD_IPV4 = (10.64.163.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD_IPV6 = (2620:0:861:12b::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f7-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD_IPV4 = (10.64.165.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD_IPV6 = (2620:0:861:12d::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f8-eqiad
-@def $EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD_IPV4 = (10.64.167.0/24);
-@def $EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD_IPV6 = (2620:0:861:12f::/64);
-@def $EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-c8-eqiad
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD_IPV4 = (10.64.151.0/24);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD_IPV6 = (2620:0:861:11f::/64);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-d5-eqiad
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD_IPV4 = (10.64.150.0/24);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD_IPV6 = (2620:0:861:11e::/64);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-e4-eqiad
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD_IPV4 = (10.64.148.0/24);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD_IPV6 = (2620:0:861:11c::/64);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-eqiad
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD_IPV4 = (10.64.20.0/24);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD_IPV6 = (2620:0:861:118::/64);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-f4-eqiad
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD_IPV4 = (10.64.149.0/24);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD_IPV6 = (2620:0:861:11d::/64);
-@def $EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-a-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_A_EQIAD_IPV4 = (10.64.0.0/22);
-@def $EQIAD_PRIVATE_PRIVATE1_A_EQIAD_IPV6 = (2620:0:861:101::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_A_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_A_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_A_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-aux-kubepods-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD_IPV4 = (10.67.80.0/21);
-@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD_IPV6 = (2620:0:861:305::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-aux-kubesvc-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD_IPV4 = (10.67.64.0/20);
-@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD_IPV6 = (2620:0:861:304::/116);
-@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-b-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_B_EQIAD_IPV4 = (10.64.16.0/22);
-@def $EQIAD_PRIVATE_PRIVATE1_B_EQIAD_IPV6 = (2620:0:861:102::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_B_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_B_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_B_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_C_EQIAD_IPV4 = (10.64.32.0/22);
-@def $EQIAD_PRIVATE_PRIVATE1_C_EQIAD_IPV6 = (2620:0:861:103::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_C_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c2-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_C2_EQIAD_IPV4 = (10.64.133.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_C2_EQIAD_IPV6 = (2620:0:861:10c::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_C2_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C2_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C2_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c3-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_C3_EQIAD_IPV4 = (10.64.141.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_C3_EQIAD_IPV6 = (2620:0:861:113::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_C3_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C3_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C3_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c4-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_C4_EQIAD_IPV4 = (10.64.169.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_C4_EQIAD_IPV6 = (2620:0:861:119::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_C4_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C4_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C4_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c5-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_C5_EQIAD_IPV4 = (10.64.171.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_C5_EQIAD_IPV6 = (2620:0:861:131::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_C5_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C5_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C5_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c6-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_C6_EQIAD_IPV4 = (10.64.173.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_C6_EQIAD_IPV6 = (2620:0:861:133::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_C6_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C6_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C6_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c7-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_C7_EQIAD_IPV4 = (10.64.175.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_C7_EQIAD_IPV6 = (2620:0:861:135::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_C7_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C7_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C7_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_D_EQIAD_IPV4 = (10.64.48.0/22);
-@def $EQIAD_PRIVATE_PRIVATE1_D_EQIAD_IPV6 = (2620:0:861:107::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_D_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d1-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_D1_EQIAD_IPV4 = (10.64.177.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_D1_EQIAD_IPV6 = (2620:0:861:137::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_D1_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D1_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D1_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d2-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_D2_EQIAD_IPV4 = (10.64.179.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_D2_EQIAD_IPV6 = (2620:0:861:139::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_D2_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D2_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D2_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d3-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_D3_EQIAD_IPV4 = (10.64.181.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_D3_EQIAD_IPV6 = (2620:0:861:13b::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_D3_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D3_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D3_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d4-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_D4_EQIAD_IPV4 = (10.64.183.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_D4_EQIAD_IPV6 = (2620:0:861:13d::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_D4_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D4_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D4_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d6-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_D6_EQIAD_IPV4 = (10.64.185.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_D6_EQIAD_IPV6 = (2620:0:861:13f::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_D6_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D6_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D6_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d7-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_D7_EQIAD_IPV4 = (10.64.187.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_D7_EQIAD_IPV6 = (2620:0:861:142::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_D7_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D7_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D7_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d8-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_D8_EQIAD_IPV4 = (10.64.189.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_D8_EQIAD_IPV6 = (2620:0:861:144::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_D8_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D8_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D8_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-dse-kubepods-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD_IPV4 = (10.67.24.0/21);
-@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD_IPV6 = (2620:0:861:302::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-dse-kubesvc-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD_IPV4 = (10.67.32.0/20);
-@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD_IPV6 = (2620:0:861:303::/116);
-@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e1-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_E1_EQIAD_IPV4 = (10.64.130.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_E1_EQIAD_IPV6 = (2620:0:861:109::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_E1_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E1_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E1_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e2-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_E2_EQIAD_IPV4 = (10.64.131.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_E2_EQIAD_IPV6 = (2620:0:861:10a::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_E2_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E2_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E2_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e3-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_E3_EQIAD_IPV4 = (10.64.132.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_E3_EQIAD_IPV6 = (2620:0:861:10b::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_E3_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E3_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E3_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e5-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_E5_EQIAD_IPV4 = (10.64.152.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_E5_EQIAD_IPV6 = (2620:0:861:120::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_E5_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E5_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E5_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e6-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_E6_EQIAD_IPV4 = (10.64.154.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_E6_EQIAD_IPV6 = (2620:0:861:122::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_E6_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E6_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E6_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e7-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_E7_EQIAD_IPV4 = (10.64.156.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_E7_EQIAD_IPV6 = (2620:0:861:124::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_E7_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E7_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E7_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e8-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_E8_EQIAD_IPV4 = (10.64.158.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_E8_EQIAD_IPV6 = (2620:0:861:126::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_E8_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E8_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E8_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f1-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_F1_EQIAD_IPV4 = (10.64.134.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_F1_EQIAD_IPV6 = (2620:0:861:10d::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_F1_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F1_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F1_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f2-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_F2_EQIAD_IPV4 = (10.64.135.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_F2_EQIAD_IPV6 = (2620:0:861:10e::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_F2_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F2_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F2_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f3-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_F3_EQIAD_IPV4 = (10.64.136.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_F3_EQIAD_IPV6 = (2620:0:861:10f::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_F3_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F3_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F3_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f5-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_F5_EQIAD_IPV4 = (10.64.160.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_F5_EQIAD_IPV6 = (2620:0:861:128::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_F5_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F5_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F5_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f6-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_F6_EQIAD_IPV4 = (10.64.162.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_F6_EQIAD_IPV6 = (2620:0:861:12a::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_F6_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F6_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F6_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f7-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_F7_EQIAD_IPV4 = (10.64.164.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_F7_EQIAD_IPV6 = (2620:0:861:12c::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_F7_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F7_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F7_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f8-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_F8_EQIAD_IPV4 = (10.64.166.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_F8_EQIAD_IPV6 = (2620:0:861:12e::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_F8_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F8_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F8_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-lvs-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_LVS_EQIAD_IPV4 = (10.2.2.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_LVS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_LVS_EQIAD_IPV4 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-mlserve-kubepods-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD_IPV4 = (10.67.16.0/21);
-@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD_IPV6 = (2620:0:861:300::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-mlserve-kubesvc-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD_IPV4 = (10.67.0.0/20);
-@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD_IPV6 = (2620:0:861:301::/116);
-@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-services-kubepods-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD_IPV4 = (10.67.128.0/17);
-@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD_IPV6 = (2620:0:861:cabe::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-services-kubesvc-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD_IPV4 = (10.64.72.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD_IPV6 = (2620:0:861:cabf::/116);
-@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-staging-kubepods-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD_IPV4 = (10.64.64.0/21);
-@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD_IPV6 = (2620:0:861:babe::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-staging-kubesvc-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD_IPV4 = (10.64.76.0/24);
-@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD_IPV6 = (2620:0:861:babf::/116);
-@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-virtual-eqiad
-@def $EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD_IPV4 = (10.64.24.0/23);
-@def $EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD_IPV6 = (2620:0:861:140::/64);
-@def $EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-a-eqiad
-@def $EQIAD_PUBLIC_PUBLIC1_A_EQIAD_IPV4 = (208.80.154.0/26);
-@def $EQIAD_PUBLIC_PUBLIC1_A_EQIAD_IPV6 = (2620:0:861:1::/64);
-@def $EQIAD_PUBLIC_PUBLIC1_A_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_A_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_A_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-b-eqiad
-@def $EQIAD_PUBLIC_PUBLIC1_B_EQIAD_IPV4 = (208.80.154.128/26);
-@def $EQIAD_PUBLIC_PUBLIC1_B_EQIAD_IPV6 = (2620:0:861:2::/64);
-@def $EQIAD_PUBLIC_PUBLIC1_B_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_B_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_B_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-c-eqiad
-@def $EQIAD_PUBLIC_PUBLIC1_C_EQIAD_IPV4 = (208.80.154.64/26);
-@def $EQIAD_PUBLIC_PUBLIC1_C_EQIAD_IPV6 = (2620:0:861:3::/64);
-@def $EQIAD_PUBLIC_PUBLIC1_C_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_C_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_C_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-d-eqiad
-@def $EQIAD_PUBLIC_PUBLIC1_D_EQIAD_IPV4 = (208.80.155.96/27);
-@def $EQIAD_PUBLIC_PUBLIC1_D_EQIAD_IPV6 = (2620:0:861:4::/64);
-@def $EQIAD_PUBLIC_PUBLIC1_D_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_D_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_D_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-lvs-eqiad
-@def $EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD_IPV4 = (208.80.154.224/27);
-@def $EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD_IPV6 = (2620:0:861:ed1a::/64);
-@def $EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD_IPV6 );
-
-# Realm: production, # Site: eqsin, # Sphere: private, # Network: private1-eqsin
-@def $EQSIN_PRIVATE_PRIVATE1_EQSIN_IPV4 = (10.132.0.0/24);
-@def $EQSIN_PRIVATE_PRIVATE1_EQSIN_IPV6 = (2001:df2:e500:101::/64);
-@def $EQSIN_PRIVATE_PRIVATE1_EQSIN = ($EQSIN_PRIVATE_PRIVATE1_EQSIN_IPV4 $EQSIN_PRIVATE_PRIVATE1_EQSIN_IPV6 );
-
-# Realm: production, # Site: eqsin, # Sphere: private, # Network: private1-lvs-eqsin
-@def $EQSIN_PRIVATE_PRIVATE1_LVS_EQSIN_IPV4 = (10.2.5.0/24);
-@def $EQSIN_PRIVATE_PRIVATE1_LVS_EQSIN = ($EQSIN_PRIVATE_PRIVATE1_LVS_EQSIN_IPV4 );
-
-# Realm: production, # Site: eqsin, # Sphere: private, # Network: private1-virtual-eqsin
-@def $EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN_IPV4 = (10.132.2.0/24);
-@def $EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN_IPV6 = (2001:df2:e500:103::/64);
-@def $EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN = ($EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN_IPV4 $EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN_IPV6 );
-
-# Realm: production, # Site: eqsin, # Sphere: public, # Network: public1-eqsin
-@def $EQSIN_PUBLIC_PUBLIC1_EQSIN_IPV4 = (103.102.166.0/28);
-@def $EQSIN_PUBLIC_PUBLIC1_EQSIN_IPV6 = (2001:df2:e500:1::/64);
-@def $EQSIN_PUBLIC_PUBLIC1_EQSIN = ($EQSIN_PUBLIC_PUBLIC1_EQSIN_IPV4 $EQSIN_PUBLIC_PUBLIC1_EQSIN_IPV6 );
-
-# Realm: production, # Site: eqsin, # Sphere: public, # Network: public1-lvs-eqsin
-@def $EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN_IPV4 = (103.102.166.224/27);
-@def $EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN_IPV6 = (2001:df2:e500:ed1a::/64);
-@def $EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN = ($EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN_IPV4 $EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN_IPV6 );
-
-# Realm: production, # Site: eqsin, # Sphere: public, # Network: public1-virtual-eqsin
-@def $EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN_IPV4 = (103.102.166.96/27);
-@def $EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN_IPV6 = (2001:df2:e500:3::/64);
-@def $EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN = ($EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN_IPV4 $EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN_IPV6 );
-
-# Realm: production, # Site: esams, # Sphere: private, # Network: private1-bw27-esams
-@def $ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS_IPV4 = (10.80.0.0/24);
-@def $ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS_IPV6 = (2a02:ec80:300:101::/64);
-@def $ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS = ($ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS_IPV4 $ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS_IPV6 );
-
-# Realm: production, # Site: esams, # Sphere: private, # Network: private1-by27-esams
-@def $ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS_IPV4 = (10.80.1.0/24);
-@def $ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS_IPV6 = (2a02:ec80:300:102::/64);
-@def $ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS = ($ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS_IPV4 $ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS_IPV6 );
-
-# Realm: production, # Site: esams, # Sphere: private, # Network: private1-lvs-esams
-@def $ESAMS_PRIVATE_PRIVATE1_LVS_ESAMS_IPV4 = (10.2.3.0/24);
-@def $ESAMS_PRIVATE_PRIVATE1_LVS_ESAMS = ($ESAMS_PRIVATE_PRIVATE1_LVS_ESAMS_IPV4 );
-
-# Realm: production, # Site: esams, # Sphere: private, # Network: private1-virtual-esams
-@def $ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS_IPV4 = (10.80.2.0/24);
-@def $ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS_IPV6 = (2a02:ec80:300:103::/64);
-@def $ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS = ($ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS_IPV4 $ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS_IPV6 );
-
-# Realm: production, # Site: esams, # Sphere: public, # Network: public1-bw27-esams
-@def $ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS_IPV4 = (185.15.59.0/27);
-@def $ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS_IPV6 = (2a02:ec80:300:1::/64);
-@def $ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS = ($ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS_IPV4 $ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS_IPV6 );
-
-# Realm: production, # Site: esams, # Sphere: public, # Network: public1-by27-esams
-@def $ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS_IPV4 = (185.15.59.32/27);
-@def $ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS_IPV6 = (2a02:ec80:300:2::/64);
-@def $ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS = ($ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS_IPV4 $ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS_IPV6 );
-
-# Realm: production, # Site: esams, # Sphere: public, # Network: public1-lvs-esams
-@def $ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS_IPV4 = (185.15.59.224/27);
-@def $ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS_IPV6 = (2a02:ec80:300:ed1a::/64);
-@def $ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS = ($ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS_IPV4 $ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS_IPV6 );
-
-# Realm: production, # Site: esams, # Sphere: public, # Network: public1-virtual-esams
-@def $ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS_IPV4 = (185.15.59.96/27);
-@def $ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS_IPV6 = (2a02:ec80:300:3::/64);
-@def $ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS = ($ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS_IPV4 $ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS_IPV6 );
-
-# Realm: production, # Site: magru, # Sphere: private, # Network: private1-b3-magru
-@def $MAGRU_PRIVATE_PRIVATE1_B3_MAGRU_IPV4 = (10.140.0.0/24);
-@def $MAGRU_PRIVATE_PRIVATE1_B3_MAGRU_IPV6 = (2a02:ec80:700:101::/64);
-@def $MAGRU_PRIVATE_PRIVATE1_B3_MAGRU = ($MAGRU_PRIVATE_PRIVATE1_B3_MAGRU_IPV4 $MAGRU_PRIVATE_PRIVATE1_B3_MAGRU_IPV6 );
-
-# Realm: production, # Site: magru, # Sphere: private, # Network: private1-b4-magru
-@def $MAGRU_PRIVATE_PRIVATE1_B4_MAGRU_IPV4 = (10.140.1.0/24);
-@def $MAGRU_PRIVATE_PRIVATE1_B4_MAGRU_IPV6 = (2a02:ec80:700:102::/64);
-@def $MAGRU_PRIVATE_PRIVATE1_B4_MAGRU = ($MAGRU_PRIVATE_PRIVATE1_B4_MAGRU_IPV4 $MAGRU_PRIVATE_PRIVATE1_B4_MAGRU_IPV6 );
-
-# Realm: production, # Site: magru, # Sphere: private, # Network: private1-lvs-magru
-@def $MAGRU_PRIVATE_PRIVATE1_LVS_MAGRU_IPV4 = (10.2.7.0/24);
-@def $MAGRU_PRIVATE_PRIVATE1_LVS_MAGRU = ($MAGRU_PRIVATE_PRIVATE1_LVS_MAGRU_IPV4 );
-
-# Realm: production, # Site: magru, # Sphere: private, # Network: private1-virtual-magru
-@def $MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU_IPV4 = (10.140.2.0/24);
-@def $MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU_IPV6 = (2a02:ec80:700:103::/64);
-@def $MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU = ($MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU_IPV4 $MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU_IPV6 );
-
-# Realm: production, # Site: magru, # Sphere: public, # Network: public1-b3-magru
-@def $MAGRU_PUBLIC_PUBLIC1_B3_MAGRU_IPV4 = (195.200.68.0/27);
-@def $MAGRU_PUBLIC_PUBLIC1_B3_MAGRU_IPV6 = (2a02:ec80:700:1::/64);
-@def $MAGRU_PUBLIC_PUBLIC1_B3_MAGRU = ($MAGRU_PUBLIC_PUBLIC1_B3_MAGRU_IPV4 $MAGRU_PUBLIC_PUBLIC1_B3_MAGRU_IPV6 );
-
-# Realm: production, # Site: magru, # Sphere: public, # Network: public1-b4-magru
-@def $MAGRU_PUBLIC_PUBLIC1_B4_MAGRU_IPV4 = (195.200.68.32/27);
-@def $MAGRU_PUBLIC_PUBLIC1_B4_MAGRU_IPV6 = (2a02:ec80:700:2::/64);
-@def $MAGRU_PUBLIC_PUBLIC1_B4_MAGRU = ($MAGRU_PUBLIC_PUBLIC1_B4_MAGRU_IPV4 $MAGRU_PUBLIC_PUBLIC1_B4_MAGRU_IPV6 );
-
-# Realm: production, # Site: magru, # Sphere: public, # Network: public1-lvs-magru
-@def $MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU_IPV4 = (195.200.68.224/27);
-@def $MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU_IPV6 = (2a02:ec80:700:ed1a::/64);
-@def $MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU = ($MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU_IPV4 $MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU_IPV6 );
-
-# Realm: production, # Site: magru, # Sphere: public, # Network: public1-virtual-magru
-@def $MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU_IPV4 = (195.200.68.96/27);
-@def $MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU_IPV6 = (2a02:ec80:700:3::/64);
-@def $MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU = ($MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU_IPV4 $MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU_IPV6 );
-
-# Realm: production, # Site: ulsfo, # Sphere: private, # Network: private1-22-ulsfo
-@def $ULSFO_PRIVATE_PRIVATE1_22_ULSFO_IPV4 = (10.128.0.0/24);
-@def $ULSFO_PRIVATE_PRIVATE1_22_ULSFO_IPV6 = (2620:0:863:101::/64);
-@def $ULSFO_PRIVATE_PRIVATE1_22_ULSFO = ($ULSFO_PRIVATE_PRIVATE1_22_ULSFO_IPV4 $ULSFO_PRIVATE_PRIVATE1_22_ULSFO_IPV6 );
-
-# Realm: production, # Site: ulsfo, # Sphere: private, # Network: private1-23-ulsfo
-@def $ULSFO_PRIVATE_PRIVATE1_23_ULSFO_IPV4 = (10.128.1.0/24);
-@def $ULSFO_PRIVATE_PRIVATE1_23_ULSFO_IPV6 = (2620:0:863:102::/64);
-@def $ULSFO_PRIVATE_PRIVATE1_23_ULSFO = ($ULSFO_PRIVATE_PRIVATE1_23_ULSFO_IPV4 $ULSFO_PRIVATE_PRIVATE1_23_ULSFO_IPV6 );
-
-# Realm: production, # Site: ulsfo, # Sphere: private, # Network: private1-lvs-ulsfo
-@def $ULSFO_PRIVATE_PRIVATE1_LVS_ULSFO_IPV4 = (10.2.4.0/24);
-@def $ULSFO_PRIVATE_PRIVATE1_LVS_ULSFO = ($ULSFO_PRIVATE_PRIVATE1_LVS_ULSFO_IPV4 );
-
-# Realm: production, # Site: ulsfo, # Sphere: private, # Network: private1-virtual-ulsfo
-@def $ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO_IPV4 = (10.128.2.0/24);
-@def $ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO_IPV6 = (2620:0:863:103::/64);
-@def $ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO = ($ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO_IPV4 $ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO_IPV6 );
-
-# Realm: production, # Site: ulsfo, # Sphere: public, # Network: public1-22-ulsfo
-@def $ULSFO_PUBLIC_PUBLIC1_22_ULSFO_IPV4 = (198.35.26.0/27);
-@def $ULSFO_PUBLIC_PUBLIC1_22_ULSFO_IPV6 = (2620:0:863:1::/64);
-@def $ULSFO_PUBLIC_PUBLIC1_22_ULSFO = ($ULSFO_PUBLIC_PUBLIC1_22_ULSFO_IPV4 $ULSFO_PUBLIC_PUBLIC1_22_ULSFO_IPV6 );
-
-# Realm: production, # Site: ulsfo, # Sphere: public, # Network: public1-23-ulsfo
-@def $ULSFO_PUBLIC_PUBLIC1_23_ULSFO_IPV4 = (198.35.26.32/27);
-@def $ULSFO_PUBLIC_PUBLIC1_23_ULSFO_IPV6 = (2620:0:863:2::/64);
-@def $ULSFO_PUBLIC_PUBLIC1_23_ULSFO = ($ULSFO_PUBLIC_PUBLIC1_23_ULSFO_IPV4 $ULSFO_PUBLIC_PUBLIC1_23_ULSFO_IPV6 );
-
-# Realm: production, # Site: ulsfo, # Sphere: public, # Network: public1-lvs-ulsfo
-@def $ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO_IPV4 = (198.35.26.96/27);
-@def $ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO_IPV6 = (2620:0:863:ed1a::/64);
-@def $ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO = ($ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO_IPV4 $ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO_IPV6 );
-
-# Realm: production, # Site: ulsfo, # Sphere: public, # Network: public1-virtual-ulsfo
-@def $ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO_IPV4 = (198.35.26.96/27);
-@def $ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO_IPV6 = (2620:0:863:3::/64);
-@def $ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO = ($ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO_IPV4 $ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO_IPV6 );
-
-# Realm: sandbox, # Site: codfw, # Sphere: public, # Network: sandbox1-a-codfw
-@def $CODFW_PUBLIC_SANDBOX1_A_CODFW_IPV4 = (208.80.152.240/28);
-@def $CODFW_PUBLIC_SANDBOX1_A_CODFW_IPV6 = (2620:0:860:201::/64);
-@def $CODFW_PUBLIC_SANDBOX1_A_CODFW = ($CODFW_PUBLIC_SANDBOX1_A_CODFW_IPV4 $CODFW_PUBLIC_SANDBOX1_A_CODFW_IPV6 );
-
-# Realm: sandbox, # Site: eqiad, # Sphere: public, # Network: sandbox1-b-eqiad
-@def $EQIAD_PUBLIC_SANDBOX1_B_EQIAD_IPV4 = (208.80.155.64/28);
-@def $EQIAD_PUBLIC_SANDBOX1_B_EQIAD_IPV6 = (2620:0:861:202::/64);
-@def $EQIAD_PUBLIC_SANDBOX1_B_EQIAD = ($EQIAD_PUBLIC_SANDBOX1_B_EQIAD_IPV4 $EQIAD_PUBLIC_SANDBOX1_B_EQIAD_IPV6 );
-
-# Realm: sandbox, # Site: eqsin, # Sphere: public, # Network: sandbox1-virtual-eqsin
-@def $EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN_IPV4 = (103.102.166.72/29);
-@def $EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN_IPV6 = (2001:df2:e500:202::/64);
-@def $EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN = ($EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN_IPV4 $EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN_IPV6 );
-
-# Realm: sandbox, # Site: esams, # Sphere: public, # Network: sandbox1-virtual-esams
-@def $ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS_IPV4 = (185.15.59.72/29);
-@def $ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS_IPV6 = (2a02:ec80:300:202::/64);
-@def $ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS = ($ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS_IPV4 $ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS_IPV6 );
-
-# Realm: sandbox, # Site: magru, # Sphere: public, # Network: sandbox1-virtual-magru
-@def $MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU_IPV4 = (195.200.68.64/29);
-@def $MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU_IPV6 = (2a02:ec80:700:201::/64);
-@def $MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU = ($MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU_IPV4 $MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU_IPV6 );
-
-# Realm: sandbox, # Site: ulsfo, # Sphere: public, # Network: sandbox1-ulsfo
-@def $ULSFO_PUBLIC_SANDBOX1_ULSFO_IPV4 = (198.35.26.240/28);
-@def $ULSFO_PUBLIC_SANDBOX1_ULSFO_IPV6 = (2620:0:863:201::/64);
-@def $ULSFO_PUBLIC_SANDBOX1_ULSFO = ($ULSFO_PUBLIC_SANDBOX1_ULSFO_IPV4 $ULSFO_PUBLIC_SANDBOX1_ULSFO_IPV6 );

Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]

-    unit              => cfssl-ocsprefresh-dse_front_proxy.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/LABS_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/LABS_NETWORKS_ipv6.nft
@@ -0,0 +1,20 @@
+# Autogenerated by puppet
+set LABS_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2a02:ec80:a000:100::/64,
+             2a02:ec80:a000:1::/64,
+             2a02:ec80:a000:201::/64,
+             2a02:ec80:a000:202::/64,
+             2a02:ec80:a000:203::/64,
+             2a02:ec80:a000:204::/64,
+             2a02:ec80:a000:2ff::/64,
+             2a02:ec80:a000:4000::/64,
+             2a02:ec80:a100:100::/64,
+             2a02:ec80:a100:1::/64,
+             2a02:ec80:a100:205::/64,
+             2a02:ec80:a100:2ff::/64,
+             2a02:ec80:a100:4000::/64
+    }
+}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-cassandra-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom

Httpd::Mod_conf[status]

Parameters differences:

--- Httpd::Mod_conf[status].orig
+++ Httpd::Mod_conf[status]

-    mod      => status
-    loadfile => status.load
-    ensure   => present

File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (wikikube_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20011 \
-          -responses /etc/cfssl/ocsp/wikikube_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/nftables/prerouting]

Parameters differences:

--- File[/etc/nftables/prerouting].orig
+++ File[/etc/nftables/prerouting]

+    recurse => True
+    purge   => True
+    owner   => root
+    group   => root
+    ensure  => directory

Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Unit[cfssl-ocspserve@mlserve_staging]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@mlserve_staging].orig
+++ Systemd::Unit[cfssl-ocspserve@mlserve_staging]

-    unit              => cfssl-ocspserve@mlserve_staging
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[cfssl-ocspserve@cassandra]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@cassandra].orig
+++ Systemd::Unit[cfssl-ocspserve@cassandra]

-    unit              => cfssl-ocspserve@cassandra
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unmask[nftables.service]

Parameters differences:

--- Systemd::Unmask[nftables.service].orig
+++ Systemd::Unmask[nftables.service]

+    unit        => nftables.service
+    refreshonly => False

Systemd::Service[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-puppet_rsa].orig
+++ Systemd::Service[cfssl-ocsprefresh-puppet_rsa]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Cfssl::Signer[puppet_rsa]

Parameters differences:

--- Cfssl::Signer[puppet_rsa].orig
+++ Cfssl::Signer[puppet_rsa]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/puppet_rsa
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/puppet_rsa
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

Sudo::User[nrpe-check_check_certificate_expiry_syslog]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_syslog].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_syslog]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Nrpe::Check[check_check_certificate_expiry_wikikube]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_wikikube].orig
+++ Nrpe::Check[check_check_certificate_expiry_wikikube]

-    before    => Monitoring::Service[check_certificate_expiry_wikikube]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    ensure    => present
-    sudo_user => root

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[cfssl-ocspserve@discovery]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@discovery].orig
+++ Systemd::Service[cfssl-ocspserve@discovery]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/etc/cfssl/signers/discovery/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/discovery/cfssl.conf].orig
+++ File[/etc/cfssl/signers/discovery/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/discovery/cfssl.conf.orig
+++ /etc/cfssl/signers/discovery/cfssl.conf
@@ -1,129 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/discovery",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/discovery"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_staging": {
-        "auth_key": "k8s_staging",
-        "expiry": "24h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_wikikube": {
-        "auth_key": "k8s_wikikube",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_mlserve": {
-        "auth_key": "k8s_mlserve",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_mlstaging": {
-        "auth_key": "k8s_mlstaging",
-        "expiry": "24h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_dse": {
-        "auth_key": "k8s_dse",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      },
-      "k8s_dse_opensearch": {
-        "auth_key": "k8s_dse",
-        "expiry": "4380h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      },
-      "k8s_aux": {
-        "auth_key": "k8s_aux",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse_front_proxy
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__dse_front_proxy
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="2560f4f577ba169af651cf96bd5dc1ba",check_name="check_check_certificate_expiry_dse_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse_front_proxy
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_dse_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]

-    unit              => cfssl-ocsprefresh-aux_front_proxy.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_discovery2026].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]

-    group  => root
-    ensure => absent
-    owner  => root

Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"wikikube_staging_front_proxy"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Service[wmf_auto_restart_ulogd2.timer]

Parameters differences:

--- Service[wmf_auto_restart_ulogd2.timer].orig
+++ Service[wmf_auto_restart_ulogd2.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]

-    before      => ['Service[cfssl-ocsprefresh-cassandra.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File_line[auto_restart_file_presence_apache2]

Parameters differences:

--- File_line[auto_restart_file_presence_apache2].orig
+++ File_line[auto_restart_file_presence_apache2]

-    path    => /etc/debdeploy-client/autorestarts.conf
-    line    => apache2
-    ensure  => present
-    require => File[/etc/debdeploy-client/autorestarts.conf]

Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_etcd.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_etcd.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Ocsp[dse]

Parameters differences:

--- Cfssl::Ocsp[dse].orig
+++ Cfssl::Ocsp[dse]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/dse/ca/dse.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20061
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_zuul
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "373325faaa689f3e9b058d91d4eb6cdb" --timeout 10 --check-command "check_check_certificate_expiry_zuul"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_zuul command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_network_devices command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_network_devices
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "21dac3775d059b8c991626e2ca33f951" --timeout 10 --check-command "check_check_certificate_expiry_network_devices"

File[/etc/cfssl/signers/mlserve_staging/ca]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging/ca].orig
+++ File[/etc/cfssl/signers/mlserve_staging/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Systemd::Service[cfssl-ocspserve@dse]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@dse].orig
+++ Systemd::Service[cfssl-ocspserve@dse]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_zuul]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem

Prometheus::Blackbox::Check::Http[PKI_network_devices]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_network_devices].orig
+++ Prometheus::Blackbox::Check::Http[PKI_network_devices]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"network_devices"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca].orig
+++ Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]

-    unit              => cfssl-ocspserve@cloud_wmnet_ca
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Sudo::User[nrpe_certificate_check_dse_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_dse_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_dse_front_proxy]

-    user       => nrpe_certificate_check_dse_front_proxy
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-dse_front_proxy
-
-/var/log/cfssl-ocsprefresh-dse_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Service[wmf_auto_restart_apache-htcacheclean.timer]

Parameters differences:

--- Service[wmf_auto_restart_apache-htcacheclean.timer].orig
+++ Service[wmf_auto_restart_apache-htcacheclean.timer]

-    before   => ['Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Nrpe::Check[check_check_certificate_expiry_kafka]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_kafka].orig
+++ Nrpe::Check[check_check_certificate_expiry_kafka]

-    before    => Monitoring::Service[check_certificate_expiry_kafka]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem
-    ensure    => present
-    sudo_user => root

File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/BASTION_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/BASTION_HOSTS_ipv6.nft
@@ -0,0 +1,12 @@
+# Autogenerated by puppet
+set BASTION_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:1:208:80:154:7,
+             2a02:ec80:300:3:185:15:59:99,
+             2620:0:860:4:208:80:153:110,
+             2620:0:863:3:198:35:26:104,
+             2001:df2:e500:3:103:102:166:103,
+             2a02:ec80:600:1:185:15:58:6,
+             2a02:ec80:700:3:195:200:68:99
+    }
+}

File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (cloud_wmnet_ca)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10004 \
-          -responses /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Syslog[cfssl-ocsprefresh-aux]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-aux].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-aux]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (dse_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20062 \
-          -responses /etc/cfssl/ocsp/dse_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Monitoring::Service[check_certificate_expiry_wikikube]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_wikikube].orig
+++ Monitoring::Service[check_certificate_expiry_wikikube]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_wikikube!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: wikikube
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Nftables::Set[PROMETHEUS_HOSTS]

Parameters differences:

--- Nftables::Set[PROMETHEUS_HOSTS].orig
+++ Nftables::Set[PROMETHEUS_HOSTS]

+    hosts  => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet']
+    ensure => present

Nftables::Set[FRACK_NETWORKS]

Parameters differences:

--- Nftables::Set[FRACK_NETWORKS].orig
+++ Nftables::Set[FRACK_NETWORKS]

+    hosts  => ['10.195.0.0/27', '10.195.0.128/29', '10.195.0.32/27', '10.195.0.64/28', '10.195.0.80/29', '10.195.0.96/27', '10.195.1.0/25', '10.64.40.0/27', '10.64.40.160/27', '10.64.40.192/26', '10.64.40.32/27', '10.64.40.64/27', '10.64.40.96/27', '208.80.152.224/28', '208.80.155.0/27']
+    ensure => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "b194b5b9b6c9d6e05b9eed8dcfcc40cf" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging_front_proxy"

Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - Wikimedia_Internal_Root_CA
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem --responses-file /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@Wikimedia_Internal_Root_CA' Wikimedia_Internal_Root_CA

Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-aux.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-aux.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-aux.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-aux.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Signer[syslog]

Parameters differences:

--- Cfssl::Signer[syslog].orig
+++ Cfssl::Signer[syslog]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/syslog/ca/syslog.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/syslog
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/syslog
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/syslog/ca/syslog-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

File[/etc/ssl/dhparam.pem]

Parameters differences:

--- File[/etc/ssl/dhparam.pem].orig
+++ File[/etc/ssl/dhparam.pem]

-    owner  => root
-    source => puppet:///modules/sslcert/dhparam.pem
-    group  => root
-    mode   => 0444
-    ensure => present

File[/lib/systemd/system/cfssl-ocspserve@etcd.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@etcd.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@etcd.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@etcd.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@etcd.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (etcd)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10005 \
-          -responses /etc/cfssl/ocsp/etcd.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[Generate initial CRL for discovery]

Parameters differences:

--- Exec[Generate initial CRL for discovery].orig
+++ Exec[Generate initial CRL for discovery]

-    creates => /srv/cfssl/crl/discovery
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/discovery/ca/discovery.pem /etc/cfssl/signers/discovery/ca/discovery-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/discovery
-    require => ['Package[golang-cfssl]']

File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

Parameters differences:

--- File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods].orig
+++ File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods.orig
+++ /etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 8443, ($WIKIKUBE_KUBEPODS_NETWORKS $STAGING_KUBEPODS_NETWORKS $MLSERVE_KUBEPODS_NETWORKS $MLSTAGE_KUBEPODS_NETWORKS $DSE_KUBEPODS_NETWORKS $AUX_KUBEPODS_NETWORKS));
-
-

File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set DSE_KUBEPODS_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:861:302::/64,
+             2620:0:860:308::/64
+    }
+}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_cassandra command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_cassandra
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f5e260f525c48c963fb2e6c86a0d5d63" --timeout 10 --check-command "check_check_certificate_expiry_cassandra"

Exec[Generate initial CRL for discovery2026]

Parameters differences:

--- Exec[Generate initial CRL for discovery2026].orig
+++ Exec[Generate initial CRL for discovery2026]

-    creates => /srv/cfssl/crl/discovery2026
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/discovery2026/ca/discovery2026.pem /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/discovery2026
-    require => ['Package[golang-cfssl]']

Logrotate::Conf[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-discovery2026].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-discovery2026]

-    ensure => present

File[/etc/systemd/system/ferm.service.d]

Parameters differences:

--- File[/etc/systemd/system/ferm.service.d].orig
+++ File[/etc/systemd/system/ferm.service.d]

-    owner  => root
-    group  => root
-    mode   => 0555
-    ensure => directory

Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-kafka-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Monitoring::Service[check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_dse_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_dse_front_proxy]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_dse_front_proxy!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: dse_front_proxy
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem --responses-file /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@Wikimedia_Internal_Root_CA' Wikimedia_Internal_Root_CA 
-    description               => OCSP Refresh job - Wikimedia_Internal_Root_CA
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_syslog.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "e515778a769f523fb98a7f642670e011" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging_front_proxy"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging_front_proxy command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/etc/sudoers.d/nrpe_certificate_check_cassandra]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_cassandra].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_cassandra]

-    group  => root
-    ensure => absent
-    owner  => root

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_cloud_wmnet_ca command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f87f54115f2f782169eed72541c30a1e" --timeout 10 --check-command "check_check_certificate_expiry_cloud_wmnet_ca"

Monitoring::Service[check_certificate_expiry_discovery2026]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_discovery2026].orig
+++ Monitoring::Service[check_certificate_expiry_discovery2026]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_discovery2026!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: discovery2026
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/srv/cfssl/bundles/discovery2026.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/discovery2026.pem].orig
+++ File[/srv/cfssl/bundles/discovery2026.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/discovery2026.pem.orig
+++ /srv/cfssl/bundles/discovery2026.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
-A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
-HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
-1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
-CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
-SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
-0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
-c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
-A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
-aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
-UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
-b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
-aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
------END CERTIFICATE-----

Systemd::Override[apache2-after-network-online-target]

Parameters differences:

--- Systemd::Override[apache2-after-network-online-target].orig
+++ Systemd::Override[apache2-after-network-online-target]

-    unit    => apache2
-    restart => False
-    ensure  => absent

Systemd::Timer[cfssl-ocsprefresh-dse]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-dse].orig
+++ Systemd::Timer[cfssl-ocsprefresh-dse]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-dse.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set PROMETHEUS_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.0.82,
+             10.64.16.62,
+             10.64.48.171,
+             10.64.32.85
+    }
+}

Package[python3-cryptography]

Parameters differences:

--- Package[python3-cryptography].orig
+++ Package[python3-cryptography]

-    ensure   => installed
-    provider => apt

Systemd::Service[cfssl-ocspserve@mlserve_staging]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@mlserve_staging].orig
+++ Systemd::Service[cfssl-ocspserve@mlserve_staging]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft
@@ -0,0 +1,38 @@
+# Autogenerated by puppet
+set ANALYTICS_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.64.137.0/24,
+             10.64.138.0/24,
+             10.64.139.0/24,
+             10.64.140.0/24,
+             10.64.142.0/24,
+             10.64.143.0/24,
+             10.64.144.0/24,
+             10.64.145.0/24,
+             10.64.153.0/24,
+             10.64.155.0/24,
+             10.64.157.0/24,
+             10.64.159.0/24,
+             10.64.161.0/24,
+             10.64.163.0/24,
+             10.64.165.0/24,
+             10.64.167.0/24,
+             10.64.170.0/24,
+             10.64.172.0/24,
+             10.64.174.0/24,
+             10.64.176.0/24,
+             10.64.178.0/24,
+             10.64.180.0/24,
+             10.64.182.0/24,
+             10.64.184.0/24,
+             10.64.186.0/24,
+             10.64.188.0/24,
+             10.64.190.0/24,
+             10.64.21.0/24,
+             10.64.36.0/24,
+             10.64.5.0/24,
+             10.64.53.0/24
+    }
+}

File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

File[/lib/systemd/system/cfssl-gc-expired-certs.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-gc-expired-certs.timer].orig
+++ File[/lib/systemd/system/cfssl-gc-expired-certs.timer]

-    notify => Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-gc-expired-certs.timer.orig
+++ /lib/systemd/system/cfssl-gc-expired-certs.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-gc-expired-certs.service
-
-[Timer]
-Unit=cfssl-gc-expired-certs.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=hourly
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_network_devices.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[nrpe2nodexp-ferm_active.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-ferm_active.service].orig
+++ Systemd::Unit[nrpe2nodexp-ferm_active.service]

-    unit              => nrpe2nodexp-ferm_active.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nrpe::Check[check_check_certificate_expiry_etcd]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_etcd].orig
+++ Nrpe::Check[check_check_certificate_expiry_etcd]

-    before    => Monitoring::Service[check_certificate_expiry_etcd]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem
-    ensure    => present
-    sudo_user => root

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]

-    before      => ['Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Class[Profile::Cumin::Target]

Parameters differences:

--- Class[Profile::Cumin::Target].orig
+++ Class[Profile::Cumin::Target]

@@
-    cluster => pki
+    cluster => insetup

Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Exec[Generate initial CRL for network_devices]

Parameters differences:

--- Exec[Generate initial CRL for network_devices].orig
+++ Exec[Generate initial CRL for network_devices]

-    creates => /srv/cfssl/crl/network_devices
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/network_devices/ca/network_devices.pem /etc/cfssl/signers/network_devices/ca/network_devices-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/network_devices
-    require => ['Package[golang-cfssl]']

File[/etc/cfssl/signers/discovery2026/ca]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026/ca].orig
+++ File[/etc/cfssl/signers/discovery2026/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Rsyslog::Conf[cfssl-ocsprefresh-dse]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-dse].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-dse]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-dse]

Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-discovery.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - discovery
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery/ca/discovery.pem --responses-file /etc/cfssl/ocsp/discovery.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery' discovery

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nrpe::Check[check_check_certificate_expiry_discovery2026]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_discovery2026].orig
+++ Nrpe::Check[check_check_certificate_expiry_discovery2026]

-    before    => Monitoring::Service[check_certificate_expiry_discovery2026]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    ensure    => present
-    sudo_user => root

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Systemd::Timer[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-syslog].orig
+++ Systemd::Timer[cfssl-ocsprefresh-syslog]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-syslog.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/srv/cfssl/bundles/syslog.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/syslog.pem].orig
+++ File[/srv/cfssl/bundles/syslog.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/syslog.pem.orig
+++ /srv/cfssl/bundles/syslog.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
-CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
-W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
-q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
-DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
-qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
-BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
-LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
-QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
-YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
-8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
-p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
-as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
------END CERTIFICATE-----

File[/etc/sudoers.d/nrpe_certificate_check_syslog]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_syslog].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_syslog]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/cfssl/ocsp/puppet_rsa.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/puppet_rsa.ocsp].orig
+++ File[/etc/cfssl/ocsp/puppet_rsa.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set PROMETHEUS_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:101:10:64:0:82,
+             2620:0:861:102:10:64:16:62,
+             2620:0:861:107:10:64:48:171,
+             2620:0:861:103:10:64:32:85
+    }
+}

Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/usr/local/lib/nagios/plugins/check_ferm]

Parameters differences:

--- File[/usr/local/lib/nagios/plugins/check_ferm].orig
+++ File[/usr/local/lib/nagios/plugins/check_ferm]

-    tag     => nrpe::plugin
-    owner   => root
-    ensure  => file
-    source  => puppet:///modules/base/firewall/check_ferm
-    group   => root
-    mode    => 0555
-    require => File[/usr/local/lib/nagios/plugins/]

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_staging" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Exec[Generate initial CRL for mlserve_staging_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for mlserve_staging_front_proxy].orig
+++ Exec[Generate initial CRL for mlserve_staging_front_proxy]

-    creates => /srv/cfssl/crl/mlserve_staging_front_proxy
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_staging_front_proxy
-    require => ['Package[golang-cfssl]']

Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]

-    unit              => cfssl-ocsprefresh-discovery2026.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_front_proxy' mlserve_front_proxy 
-    description               => OCSP Refresh job - mlserve_front_proxy
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/srv/cfssl/bundles/mlserve.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/mlserve.pem].orig
+++ File[/srv/cfssl/bundles/mlserve.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/mlserve.pem.orig
+++ /srv/cfssl/bundles/mlserve.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
-4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
-hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
-4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
-HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
-fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
-VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
-eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
-MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
-aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
-6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
-GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
-jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
------END CERTIFICATE-----

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Timer::Job[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-syslog].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-syslog]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/syslog/ca/syslog.pem --responses-file /etc/cfssl/ocsp/syslog.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@syslog' syslog 
-    description               => OCSP Refresh job - syslog
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/srv/cfssl/bundles/aux.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/aux.pem].orig
+++ File[/srv/cfssl/bundles/aux.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/aux.pem.orig
+++ /srv/cfssl/bundles/aux.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
-h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
-sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
-QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
-/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
-1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
-BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
-bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
-oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
-bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
-tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
-Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
-A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
------END CERTIFICATE-----

File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables]

Parameters differences:

--- File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables].orig
+++ File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables]

+    owner  => root
+    group  => root
+    mode   => 0555
+    ensure => present

Content differences:

--- /etc/update-motd.d/05-insetup--infrastructure-foundations-nftables.orig
+++ /etc/update-motd.d/05-insetup--infrastructure-foundations-nftables
@@ -0,0 +1,2 @@
+#!/bin/sh
+printf "%s\n" "pki1001 is a Host being setup by Infrastructure Foundations SREs with ntables (insetup::infrastructure_foundations_nftables)"

File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/FRACK_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/FRACK_NETWORKS_ipv4.nft
@@ -0,0 +1,22 @@
+# Autogenerated by puppet
+set FRACK_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.195.0.0/27,
+             10.195.0.128/29,
+             10.195.0.32/27,
+             10.195.0.64/28,
+             10.195.0.80/29,
+             10.195.0.96/27,
+             10.195.1.0/25,
+             10.64.40.0/27,
+             10.64.40.160/27,
+             10.64.40.192/26,
+             10.64.40.32/27,
+             10.64.40.64/27,
+             10.64.40.96/27,
+             208.80.152.224/28,
+             208.80.155.0/27
+    }
+}

Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_debmonitor.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_debmonitor.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => mlserve_staging_front_proxy
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@mlserve_staging_front_proxy]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: debmonitor
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__debmonitor
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="224e2ac3574a9ce482218106d95a2931",check_name="check_check_certificate_expiry_debmonitor", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: debmonitor
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_debmonitor))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --responses-file /etc/cfssl/ocsp/discovery2026.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery2026' discovery2026 
-    description               => OCSP Refresh job - discovery2026
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Monitoring::Exported_nagios_host[pki1001]

Parameters differences:

--- Monitoring::Exported_nagios_host[pki1001].orig
+++ Monitoring::Exported_nagios_host[pki1001]

@@
-    hostgroups            => pki_eqiad,asw2-a-eqiad
+    hostgroups            => insetup_eqiad,asw2-a-eqiad
@@
-    notifications_enabled => 1
+    notifications_enabled => 0

Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@mlserve_staging_front_proxy]']

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_puppet_rsa!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: puppet_rsa
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Service[cfssl-ocsprefresh-aux_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-aux_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-aux_front_proxy.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]

-    user       => nrpe_certificate_check_wikikube_staging_front_proxy
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 10
-    max_check_attempts     => 2
-    retry_interval         => 1
-    contact_groups         => admins,sms,admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 240
-    check_command          => nrpe_check!check_check_cfssl-multirootca_status!10
-    host_name              => pki1001
-    service_description    => Check unit status of cfssl-multirootca #page
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/srv/cfssl/bundles/wikikube.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/wikikube.pem].orig
+++ File[/srv/cfssl/bundles/wikikube.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/wikikube.pem.orig
+++ /srv/cfssl/bundles/wikikube.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
-AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
-4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
-YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
-VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
-B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
-MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
-cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
-QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
-ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
-GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
-GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
-9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
------END CERTIFICATE-----

Systemd::Timer[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Timer[cfssl-ocsprefresh-discovery]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-discovery.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-syslog" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-syslog/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Ferm::Service[multirootca_tls_termination]

Parameters differences:

--- Ferm::Service[multirootca_tls_termination].orig
+++ Ferm::Service[multirootca_tls_termination]

-    src_sets            => ['DOMAIN_NETWORKS']
-    unrestricted_access => False
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    ensure              => present
-    port                => 443

Systemd::Syslog[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-debmonitor].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-debmonitor]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Cfssl::Config[syslog]

Parameters differences:

--- Cfssl::Config[syslog].orig
+++ Cfssl::Config[syslog]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/syslog
-    path                => /etc/cfssl/signers/syslog/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/syslog

Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_kafka.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: network_devices
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__network_devices
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="21dac3775d059b8c991626e2ca33f951",check_name="check_check_certificate_expiry_network_devices", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: network_devices
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_network_devices))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_kafka command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_kafka
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "22922fd6bc2d570e018cbe5ccd8d1727" --timeout 10 --check-command "check_check_certificate_expiry_kafka"

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve/ca/mlserve.pem].orig
+++ File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/mlserve/ca/mlserve.pem.orig
+++ /etc/cfssl/signers/mlserve/ca/mlserve.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
-4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
-hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
-4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
-HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
-fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
-VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
-eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
-MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
-aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
-6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
-GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
-jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
------END CERTIFICATE-----

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem.orig
+++ /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
-9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
-pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
-ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
-HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
------END CERTIFICATE-----

File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft]

Parameters differences:

--- File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft].orig
+++ File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft.orig
+++ /etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr { 10.64.0.82, 10.64.16.62, 10.64.32.85, 10.64.48.171, 208.80.153.42, 208.80.154.78 } tcp dport 1-65535 accept
+ip6 saddr { 2620:0:860:2:208:80:153:42, 2620:0:861:101:10:64:0:82, 2620:0:861:102:10:64:16:62, 2620:0:861:103:10:64:32:85, 2620:0:861:107:10:64:48:171, 2620:0:861:3:208:80:154:78 } tcp dport 1-65535 accept

Profile::Auto_restarts::Service[apache2]

Parameters differences:

--- Profile::Auto_restarts::Service[apache2].orig
+++ Profile::Auto_restarts::Service[apache2]

-    ensure => present

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Signer[wikikube]

Parameters differences:

--- Cfssl::Signer[wikikube].orig
+++ Cfssl::Signer[wikikube]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/wikikube/ca/wikikube-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => test

File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set MLSERVE_KUBEPODS_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.67.16.0/21,
+             10.194.16.0/21
+    }
+}

Systemd::Unit[cfssl-ocspserve@dse]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@dse].orig
+++ Systemd::Unit[cfssl-ocspserve@dse]

-    unit              => cfssl-ocspserve@dse
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    ensure => present

File[/etc/cfssl/signers/mlserve_staging_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/systemd/system/nftables.service.d]

Parameters differences:

--- File[/etc/systemd/system/nftables.service.d].orig
+++ File[/etc/systemd/system/nftables.service.d]

+    owner  => root
+    group  => root
+    mode   => 0555
+    ensure => directory

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_aux.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_aux.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube/ca/wikikube.pem --responses-file /etc/cfssl/ocsp/wikikube.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube' wikikube 
-    description               => OCSP Refresh job - wikikube
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Nftables::Set[CLOUD_NETWORKS]

Parameters differences:

--- Nftables::Set[CLOUD_NETWORKS].orig
+++ Nftables::Set[CLOUD_NETWORKS]

+    hosts  => ['172.16.0.0/21', '172.16.128.0/24', '172.16.129.0/24', '172.16.130.0/24', '172.16.131.0/24', '172.16.16.0/21', '172.16.24.0/24', '172.16.8.0/21', '172.20.1.0/24', '172.20.2.0/24', '172.20.254.0/24', '172.20.255.0/24', '172.20.3.0/24', '172.20.4.0/24', '172.20.5.0/24', '185.15.56.0/25', '185.15.56.160/28', '185.15.57.0/29', '185.15.57.16/29', '185.15.57.24/29', '2a02:ec80:a000:100::/64', '2a02:ec80:a000:1::/64', '2a02:ec80:a000:201::/64', '2a02:ec80:a000:202::/64', '2a02:ec80:a000:203::/64', '2a02:ec80:a000:204::/64', '2a02:ec80:a000:2ff::/64', '2a02:ec80:a000:4000::/64', '2a02:ec80:a100:100::/64', '2a02:ec80:a100:1::/64', '2a02:ec80:a100:205::/64', '2a02:ec80:a100:2ff::/64', '2a02:ec80:a100:4000::/64']
+    ensure => present

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_etcd" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_wikikube_staging]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem

Service[cfssl-ocsprefresh-zuul.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-zuul.timer].orig
+++ Service[cfssl-ocsprefresh-zuul.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-cloud_wmnet_ca" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-cloud_wmnet_ca/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/ocsp/aux.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/aux.ocsp].orig
+++ File[/etc/cfssl/ocsp/aux.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: wikikube_staging
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-cassandra.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-cassandra.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-cassandra.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-cassandra.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[cfssl-ocsprefresh-zuul.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-zuul.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-zuul.timer]

-    unit              => cfssl-ocsprefresh-zuul.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]

-    unit              => cfssl-ocsprefresh-puppet_rsa.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Class[Ulogd]

Parameters differences:

--- Class[Ulogd].orig
+++ Class[Ulogd]

-    gprint_logfile      => /var/log/ulog/gprint.log
-    nacct_file          => /var/log/ulog/nacct.log
-    pcap_file           => /var/log/ulog/ulogd.pcap
-    sync                => True
-    config_file         => /etc/ulogd.conf
-    nfct                => []
-    oprint_logfile      => /var/log/ulog/oprint.log
-    logemu_nfct_logfile => /var/log/ulog/syslogemu_nfct.log
-    logemu_logfile      => /var/log/ulog/syslogemu.log
-    syslog_level        => info
-    logfile             => syslog
-    json_nfct_logfile   => /var/log/ulog/ulogd_nfct.json
-    syslog_facility     => local7
-    xml_directory       => /var/log/ulog/
-    json_logfile        => /var/log/ulog/ulogd.json
-    nflog               => ['SYSLOG']
-    log_level           => info
-    acct                => []
-    ensure              => present

Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Systemd::Service[cfssl-ocspserve@aux]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@aux].orig
+++ Systemd::Service[cfssl-ocspserve@aux]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

Systemd::Service[cfssl-ocspserve@kafka]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@kafka].orig
+++ Systemd::Service[cfssl-ocspserve@kafka]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_front_proxy
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="4d759acaf0fd7dd3abaa03dc4565aef6",check_name="check_check_certificate_expiry_wikikube_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Motd::Script[insetup::infrastructure_foundations_nftables]

Parameters differences:

--- Motd::Script[insetup::infrastructure_foundations_nftables].orig
+++ Motd::Script[insetup::infrastructure_foundations_nftables]

+    priority => 5
+    ensure   => present

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_aux_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Unit[apache2-apache2-after-network-online-target]

Parameters differences:

--- Systemd::Unit[apache2-apache2-after-network-online-target].orig
+++ Systemd::Unit[apache2-apache2-after-network-online-target]

-    unit              => apache2
-    override          => True
-    ensure            => absent
-    restart           => False
-    override_filename => apache2-after-network-online-target
-    require           => ['Class[Systemd]']

Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Ferm::Conf[main]

Parameters differences:

--- Ferm::Conf[main].orig
+++ Ferm::Conf[main]

-    prio   => 02
-    source => puppet:///modules/base/firewall/main-input-default-drop.conf
-    ensure => present

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_syslog
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "e3b9b989d5062ce2d267023dfe42fcd8" --timeout 10 --check-command "check_check_certificate_expiry_syslog"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_syslog command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Cfssl::Signer[cloud_wmnet_ca]

Parameters differences:

--- Cfssl::Signer[cloud_wmnet_ca].orig
+++ Cfssl::Signer[cloud_wmnet_ca]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
/LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/cloud_wmnet_ca
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => fake

Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem].orig
+++ File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem.orig
+++ /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Service[nrpe2nodexp-check_certificate_expiry_dse.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_dse.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_dse.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@cassandra]']

Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_cassandra]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem

Logrotate::Conf[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-syslog].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-syslog]

-    ensure => present

Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@discovery]']

File[/etc/cfssl/signers/mlserve_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_discovery" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

Parameters differences:

--- Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
+++ Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

-    enable => True
-    ensure => running

Prometheus::Blackbox::Check::Http[PKI_kafka]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_kafka].orig
+++ Prometheus::Blackbox::Check::Http[PKI_kafka]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"kafka"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Sudo::User[nrpe_certificate_check_cassandra]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_cassandra].orig
+++ Sudo::User[nrpe_certificate_check_cassandra]

-    user       => nrpe_certificate_check_cassandra
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Monitoring::Service[check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_mlserve_staging].orig
+++ Monitoring::Service[check_certificate_expiry_mlserve_staging]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_staging!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: mlserve_staging
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Unit[cfssl-ocsprefresh-kafka.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-kafka.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-kafka.timer]

-    unit              => cfssl-ocsprefresh-kafka.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/signers/aux/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/aux/cfssl.conf].orig
+++ File[/etc/cfssl/signers/aux/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/aux/cfssl.conf.orig
+++ /etc/cfssl/signers/aux/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/aux",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/aux"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set WIKIKUBE_KUBEPODS_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:861:cabe::/64,
+             2620:0:860:cabe::/64
+    }
+}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Prometheus::Blackbox::Check::Http[PKI_discovery]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_discovery].orig
+++ Prometheus::Blackbox::Check::Http[PKI_discovery]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"discovery"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]

-    unit              => cfssl-ocsprefresh-wikikube_staging.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/lib/systemd/system/cfssl-ocspserve@aux.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@aux.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@aux.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@aux.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@aux.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (aux)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20050 \
-          -responses /etc/cfssl/ocsp/aux.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-debmonitor.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-debmonitor.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - debmonitor
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --responses-file /etc/cfssl/ocsp/debmonitor.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@debmonitor' debmonitor

Ferm::Filter_log[filter-bootp]

Parameters differences:

--- Ferm::Filter_log[filter-bootp].orig
+++ Ferm::Filter_log[filter-bootp]

-    daddr  => 255.255.255.255
-    dport  => 68
-    ensure => present
-    sport  => 67
-    proto  => udp

Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@kafka]']

Service[cfssl-ocsprefresh-dse.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-dse.timer].orig
+++ Service[cfssl-ocsprefresh-dse.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/nftables/100_base_puppet.nft]

Parameters differences:

--- File[/etc/nftables/100_base_puppet.nft].orig
+++ File[/etc/nftables/100_base_puppet.nft]

+    tag     => nft
+    notify  => ['Service[nftables]']
+    owner   => root
+    ensure  => present
+    group   => root
+    mode    => 0444
+    require => File[/etc/nftables/]

Content differences:

--- /etc/nftables/100_base_puppet.nft.orig
+++ /etc/nftables/100_base_puppet.nft
@@ -0,0 +1,45 @@
+# SPDX-License-Identifier: Apache-2.0
+table inet base {
+
+    # Include all Puppet-managed sets
+    include "/etc/nftables/sets/*.nft"
+
+    chain prerouting {
+        type filter hook prerouting priority -300;
+
+        # Include all Puppet-managed rules targetting prerouting chain
+        include "/etc/nftables/prerouting/*.nft"
+        # Include all Puppet-managed exceptions from connection tracking
+        include "/etc/nftables/notrack/*.nft"
+    }
+
+    chain input {
+        type filter hook input priority 0 ; policy drop;
+
+        ct state related,established accept
+        iifname "lo" accept
+        pkttype multicast accept
+        meta l4proto ipv6-icmp accept
+        ip protocol icmp accept
+
+        # Include all Puppet-managed service definitions for incoming traffic
+        include "/etc/nftables/input/*.nft"
+    }
+
+    chain output {
+        type filter hook output priority 0 ; policy accept;
+
+        # Include any Puppet-managed client definitions filtering outbound traffic
+        include "/etc/nftables/output/*.nft"
+    }
+
+    chain postrouting {
+        type filter hook postrouting priority 0 ;
+
+        # Include any Puppet-managed custom rules to mark DSCP bits
+        include "/etc/nftables/postrouting/*.nft"
+        # Anything else mark as CS0 / default priority class
+        ip dscp != cs0 ip dscp set cs0 counter
+        ip6 dscp != cs0 ip6 dscp set cs0 counter
+    }
+}

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => dse_front_proxy
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@dse_front_proxy]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@network_devices]']

File[/etc/cfssl/signers/wikikube_staging/ca]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging/ca].orig
+++ File[/etc/cfssl/signers/wikikube_staging/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Sudo::User[nrpe_certificate_check_aux]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_aux].orig
+++ Sudo::User[nrpe_certificate_check_aux]

-    user       => nrpe_certificate_check_aux
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_debmonitor.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[cfssl-multirootca]

Parameters differences:

--- Systemd::Unit[cfssl-multirootca].orig
+++ Systemd::Unit[cfssl-multirootca]

-    unit              => cfssl-multirootca
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Syslog[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-etcd].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-etcd]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-syslog-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_etcd.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Monitor[cfssl-multirootca]

Parameters differences:

--- Systemd::Monitor[cfssl-multirootca].orig
+++ Systemd::Monitor[cfssl-multirootca]

-    contact_group  => admins
-    critical       => True
-    retries        => 2
-    check_interval => 10
-    migration_task => T350694
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI
-    ensure         => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-aux_front_proxy-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Profile::Pki::Multirootca::Monitoring[mlserve]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[mlserve].orig
+++ Profile::Pki::Multirootca::Monitoring[mlserve]

-    ca_file      => /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => mlserve

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-discovery-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve/ca/mlserve.pem --responses-file /etc/cfssl/ocsp/mlserve.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve' mlserve 
-    description               => OCSP Refresh job - mlserve
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]

Parameters differences:

--- Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)].orig
+++ Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]

-    before      => ['Service[ferm]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Ocsp[discovery2026]

Parameters differences:

--- Cfssl::Ocsp[discovery2026].orig
+++ Cfssl::Ocsp[discovery2026]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10010
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Nftables::Set[KAFKAMON_HOSTS]

Parameters differences:

--- Nftables::Set[KAFKAMON_HOSTS].orig
+++ Nftables::Set[KAFKAMON_HOSTS]

+    hosts  => ['10.64.32.11', '2620:0:861:103:10:64:32:11', '10.192.16.139', '2620:0:860:102:10:192:16:139']
+    ensure => present

File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_apache-htcacheclean].orig
+++ Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]

-    ensure => absent

Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_staging
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="f389c556cebfcfc345b3d6802f320045",check_name="check_check_certificate_expiry_wikikube_staging", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_staging))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Syslog[cfssl-ocsprefresh-dse]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-dse].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-dse]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]

-    unit              => cfssl-ocspserve@mlserve_staging_front_proxy
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux_front_proxy
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__aux_front_proxy
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="99cf4f8f014e8fd527800abcc213f494",check_name="check_check_certificate_expiry_aux_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux_front_proxy
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_aux_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set KAFKAMON_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.32.11,
+             10.192.16.139
+    }
+}

Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: mlserve_staging
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-etcd-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Service[cfssl-ocspserve@zuul]

Parameters differences:

--- Service[cfssl-ocspserve@zuul].orig
+++ Service[cfssl-ocspserve@zuul]

-    enable => True
-    ensure => running

Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --responses-file /etc/cfssl/ocsp/aux_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux_front_proxy' aux_front_proxy 
-    description               => OCSP Refresh job - aux_front_proxy
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Nftables::Set[CACHES]

Parameters differences:

--- Nftables::Set[CACHES].orig
+++ Nftables::Set[CACHES]

+    hosts  => ['10.64.0.79', '2620:0:861:101:10:64:0:79', '10.64.0.229', '2620:0:861:101:10:64:0:229', '10.64.0.14', '2620:0:861:101:10:64:0:14', '10.64.0.51', '2620:0:861:101:10:64:0:51', '10.64.16.241', '2620:0:861:102:10:64:16:241', '10.64.16.94', '2620:0:861:102:10:64:16:94', '10.64.16.95', '2620:0:861:102:10:64:16:95', '10.64.16.240', '2620:0:861:102:10:64:16:240', '10.64.32.14', '2620:0:861:103:10:64:32:14', '10.64.32.60', '2620:0:861:103:10:64:32:60', '10.64.32.15', '2620:0:861:103:10:64:32:15', '10.64.32.65', '2620:0:861:103:10:64:32:65', '10.64.48.16', '2620:0:861:107:10:64:48:16', '10.64.48.41', '2620:0:861:107:10:64:48:41', '10.64.48.27', '2620:0:861:107:10:64:48:27', '10.64.48.28', '2620:0:861:107:10:64:48:28', '10.192.23.26', '2620:0:860:113:10:192:23:26', '10.192.6.20', '2620:0:860:107:10:192:6:20', '10.192.12.35', '2620:0:860:10d:10:192:12:35', '10.192.14.25', '2620:0:860:10f:10:192:14:25', '10.192.4.22', '2620:0:860:100:10:192:4:22', '10.192.29.26', '2620:0:860:116:10:192:29:26', '10.192.30.29', '2620:0:860:119:10:192:30:29', '10.192.36.19', '2620:0:860:11b:10:192:36:19', '10.192.40.25', '2620:0:860:11f:10:192:40:25', '10.192.41.21', '2620:0:860:120:10:192:41:21', '10.192.56.3', '2620:0:860:12b:10:192:56:3', '10.192.56.4', '2620:0:860:12b:10:192:56:4', '10.192.57.3', '2620:0:860:12c:10:192:57:3', '10.192.58.2', '2620:0:860:12d:10:192:58:2', '10.192.58.3', '2620:0:860:12d:10:192:58:3', '10.192.59.2', '2620:0:860:12e:10:192:59:2', '10.80.0.14', '2a02:ec80:300:101:10:80:0:14', '10.80.1.11', '2a02:ec80:300:102:10:80:1:11', '10.80.0.13', '2a02:ec80:300:101:10:80:0:13', '10.80.1.9', '2a02:ec80:300:102:10:80:1:9', '10.80.0.12', '2a02:ec80:300:101:10:80:0:12', '10.80.1.7', '2a02:ec80:300:102:10:80:1:7', '10.80.0.11', '2a02:ec80:300:101:10:80:0:11', '10.80.1.6', '2a02:ec80:300:102:10:80:1:6', '10.80.0.10', '2a02:ec80:300:101:10:80:0:10', '10.80.1.5', '2a02:ec80:300:102:10:80:1:5', '10.80.0.8', '2a02:ec80:300:101:10:80:0:8', '10.80.1.4', '2a02:ec80:300:102:10:80:1:4', '10.80.0.7', '2a02:ec80:300:101:10:80:0:7', '10.80.1.3', '2a02:ec80:300:102:10:80:1:3', '10.80.0.6', '2a02:ec80:300:101:10:80:0:6', '10.80.1.2', '2a02:ec80:300:102:10:80:1:2', '10.128.0.19', '2620:0:863:101:10:128:0:19', '10.128.0.27', '2620:0:863:101:10:128:0:27', '10.128.0.22', '2620:0:863:101:10:128:0:22', '10.128.0.28', '2620:0:863:101:10:128:0:28', '10.128.0.25', '2620:0:863:101:10:128:0:25', '10.128.0.29', '2620:0:863:101:10:128:0:29', '10.128.0.26', '2620:0:863:101:10:128:0:26', '10.128.0.31', '2620:0:863:101:10:128:0:31', '10.128.0.14', '2620:0:863:101:10:128:0:14', '10.128.0.35', '2620:0:863:101:10:128:0:35', '10.128.0.21', '2620:0:863:101:10:128:0:21', '10.128.0.36', '2620:0:863:101:10:128:0:36', '10.128.0.24', '2620:0:863:101:10:128:0:24', '10.128.0.10', '2620:0:863:101:10:128:0:10', '10.128.0.37', '2620:0:863:101:10:128:0:37', '10.128.0.12', '2620:0:863:101:10:128:0:12', '10.132.0.17', '2001:df2:e500:101:10:132:0:17', '10.132.0.18', '2001:df2:e500:101:10:132:0:18', '10.132.0.19', '2001:df2:e500:101:10:132:0:19', '10.132.0.24', '2001:df2:e500:101:10:132:0:24', '10.132.0.29', '2001:df2:e500:101:10:132:0:29', '10.132.0.30', '2001:df2:e500:101:10:132:0:30', '10.132.0.34', '2001:df2:e500:101:10:132:0:34', '10.132.0.35', '2001:df2:e500:101:10:132:0:35', '10.132.0.36', '2001:df2:e500:101:10:132:0:36', '10.132.0.37', '2001:df2:e500:101:10:132:0:37', '10.132.0.38', '2001:df2:e500:101:10:132:0:38', '10.132.0.25', '2001:df2:e500:101:10:132:0:25', '10.132.0.26', '2001:df2:e500:101:10:132:0:26', '10.132.0.27', '2001:df2:e500:101:10:132:0:27', '10.132.0.28', '2001:df2:e500:101:10:132:0:28', '10.132.0.16', '2001:df2:e500:101:10:132:0:16', '10.136.0.6', '2a02:ec80:600:101:10:136:0:6', '10.136.1.6', '2a02:ec80:600:102:10:136:1:6', '10.136.0.7', '2a02:ec80:600:101:10:136:0:7', '10.136.1.7', '2a02:ec80:600:102:10:136:1:7', '10.136.0.8', '2a02:ec80:600:101:10:136:0:8', '10.136.1.8', '2a02:ec80:600:102:10:136:1:8', '10.136.0.9', '2a02:ec80:600:101:10:136:0:9', '10.136.1.9', '2a02:ec80:600:102:10:136:1:9', '10.136.0.10', '2a02:ec80:600:101:10:136:0:10', '10.136.1.10', '2a02:ec80:600:102:10:136:1:10', '10.136.0.11', '2a02:ec80:600:101:10:136:0:11', '10.136.1.11', '2a02:ec80:600:102:10:136:1:11', '10.136.0.12', '2a02:ec80:600:101:10:136:0:12', '10.136.1.12', '2a02:ec80:600:102:10:136:1:12', '10.136.0.13', '2a02:ec80:600:101:10:136:0:13', '10.136.1.13', '2a02:ec80:600:102:10:136:1:13', '10.140.0.3', '2a02:ec80:700:101:10:140:0:3', '10.140.1.4', '2a02:ec80:700:102:10:140:1:4', '10.140.0.4', '2a02:ec80:700:101:10:140:0:4', '10.140.1.5', '2a02:ec80:700:102:10:140:1:5', '10.140.0.5', '2a02:ec80:700:101:10:140:0:5', '10.140.1.6', '2a02:ec80:700:102:10:140:1:6', '10.140.0.6', '2a02:ec80:700:101:10:140:0:6', '10.140.1.7', '2a02:ec80:700:102:10:140:1:7', '10.140.0.7', '2a02:ec80:700:101:10:140:0:7', '10.140.1.8', '2a02:ec80:700:102:10:140:1:8', '10.140.0.8', '2a02:ec80:700:101:10:140:0:8', '10.140.1.9', '2a02:ec80:700:102:10:140:1:9', '10.140.0.9', '2a02:ec80:700:101:10:140:0:9', '10.140.1.10', '2a02:ec80:700:102:10:140:1:10', '10.140.0.10', '2a02:ec80:700:101:10:140:0:10', '10.140.1.11', '2a02:ec80:700:102:10:140:1:11']
+    ensure => present

Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-discovery2026.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]

-    unit              => cfssl-ocsprefresh-discovery2026.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/logrotate.d/cfssl-ocsprefresh-dse]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-dse].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-dse]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-dse.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-dse
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-dse
-
-/var/log/cfssl-ocsprefresh-dse/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]

-    before      => ['Service[cfssl-ocsprefresh-wikikube.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Cfssl::Signer[mlserve]

Parameters differences:

--- Cfssl::Signer[mlserve].orig
+++ Cfssl::Signer[mlserve]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/mlserve/ca/mlserve-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem

Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]

-    before      => ['Service[cfssl-ocsprefresh-network_devices.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/wmf_auto_restart_apache2.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_apache2.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_apache2.timer]

-    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/wmf_auto_restart_apache2.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_apache2.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of wmf_auto_restart_apache2.service
-
-[Timer]
-Unit=wmf_auto_restart_apache2.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-kafka-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
+++ Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    ensure => present

Systemd::Timer[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-etcd].orig
+++ Systemd::Timer[cfssl-ocsprefresh-etcd]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-etcd.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Motd::Message[pki::multirootca]

Parameters differences:

--- Motd::Message[pki::multirootca].orig
+++ Motd::Message[pki::multirootca]

-    priority => 5
-    message  => pki1001 is a PKI server (pki::multirootca)
-    ensure   => present

Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/etc/apache2/mods-available/status.conf]

Parameters differences:

--- File[/etc/apache2/mods-available/status.conf].orig
+++ File[/etc/apache2/mods-available/status.conf]

-    before  => Httpd::Mod_conf[status]
-    owner   => root
-    ensure  => absent
-    group   => root
-    require => Package[apache2]

Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]

Prometheus::Blackbox::Check::Http[PKI_zuul]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_zuul].orig
+++ Prometheus::Blackbox::Check::Http[PKI_zuul]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"zuul"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Sudo::User[nrpe-check_check_certificate_expiry_etcd]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_etcd].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_etcd]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-debmonitor.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-debmonitor
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-debmonitor
-
-/var/log/cfssl-ocsprefresh-debmonitor/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Ocsp[mlserve]

Parameters differences:

--- Cfssl::Ocsp[mlserve].orig
+++ Cfssl::Ocsp[mlserve]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20030
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft].orig
+++ File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft.orig
+++ /etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft
@@ -0,0 +1,15 @@
+# Autogenerated by puppet
+set KAFKA_BROKERS_MAIN_ipv4 {
+    type ipv4_addr
+    elements = { 10.192.5.9,
+             10.192.22.6,
+             10.192.32.4,
+             10.192.48.33,
+             10.192.48.35,
+             10.64.0.101,
+             10.64.16.30,
+             10.64.32.45,
+             10.64.48.37,
+             10.64.152.5
+    }
+}

File[/etc/cfssl/signers/kafka/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/kafka/cfssl.conf].orig
+++ File[/etc/cfssl/signers/kafka/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/kafka/cfssl.conf.orig
+++ /etc/cfssl/signers/kafka/cfssl.conf
@@ -1,75 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/kafka",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/kafka"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "kafka_11": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_etcd
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "c834f873297e445663ead81279c0b928" --timeout 10 --check-command "check_check_certificate_expiry_etcd"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_etcd command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Exec[unmask_nftables.service]

Parameters differences:

--- Exec[unmask_nftables.service].orig
+++ Exec[unmask_nftables.service]

+    onlyif      => /bin/readlink -f /etc/systemd/system/nftables.service | grep -q /dev/null
+    refreshonly => False
+    command     => /bin/systemctl unmask nftables.service

Cfssl::Signer[debmonitor]

Parameters differences:

--- Cfssl::Signer[debmonitor].orig
+++ Cfssl::Signer[debmonitor]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
-----END CERTIFICATE-----
-    ca_file          => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/debmonitor
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/debmonitor
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => ##### FAKE FOR PUPPET ######

Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: zuul
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__zuul
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="373325faaa689f3e9b058d91d4eb6cdb",check_name="check_check_certificate_expiry_zuul", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: zuul
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_zuul))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_aux" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    ensure => present

Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Exec[Generate initial CRL for mlserve_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for mlserve_front_proxy].orig
+++ Exec[Generate initial CRL for mlserve_front_proxy]

-    creates => /srv/cfssl/crl/mlserve_front_proxy
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_front_proxy
-    require => ['Package[golang-cfssl]']

Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]

Parameters differences:

--- Nftables::Set[MLSERVE_KUBEPODS_NETWORKS].orig
+++ Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]

+    hosts  => ['10.67.16.0/21', '2620:0:861:300::/64', '10.194.16.0/21', '2620:0:860:300::/64']
+    ensure => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-mlserve_staging" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_staging/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Service[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-discovery2026].orig
+++ Systemd::Service[cfssl-ocsprefresh-discovery2026]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem.orig
+++ /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
-IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
-33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
-SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
-AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
-FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
-kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
-aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
-BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
-V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
-XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
-RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
-/LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
------END CERTIFICATE-----

Rsyslog::Conf[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-mlserve].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-mlserve]

Systemd::Syslog[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-mlserve].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-mlserve]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    ensure => present

Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/zuul/ca]

Parameters differences:

--- File[/etc/cfssl/signers/zuul/ca].orig
+++ File[/etc/cfssl/signers/zuul/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-mlserve.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-mlserve
-
-/var/log/cfssl-ocsprefresh-mlserve/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Timer[wmf_auto_restart_apache2]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_apache2].orig
+++ Systemd::Timer[wmf_auto_restart_apache2]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => wmf_auto_restart_apache2.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00'}]

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/cfssl/signers/cloud_wmnet_ca]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Systemd::Syslog[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-syslog].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-syslog]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Nftables::Set[STAGING_KUBEPODS_NETWORKS]

Parameters differences:

--- Nftables::Set[STAGING_KUBEPODS_NETWORKS].orig
+++ Nftables::Set[STAGING_KUBEPODS_NETWORKS]

+    hosts  => ['10.64.64.0/21', '2620:0:861:babe::/64', '10.192.64.0/21', '2620:0:860:babe::/64']
+    ensure => present

Nrpe::Check[check_check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_puppet_rsa].orig
+++ Nrpe::Check[check_check_certificate_expiry_puppet_rsa]

-    before    => Monitoring::Service[check_certificate_expiry_puppet_rsa]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    ensure    => present
-    sudo_user => root

Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-cassandra].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cassandra/ca/cassandra.pem --responses-file /etc/cfssl/ocsp/cassandra.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cassandra' cassandra 
-    description               => OCSP Refresh job - cassandra
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Nftables::File[base]

Parameters differences:

--- Nftables::File[base].orig
+++ Nftables::File[base]

+    order  => 100
+    ensure => present

File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/etc/cfssl/ocsp/etcd.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/etcd.ocsp].orig
+++ File[/etc/cfssl/ocsp/etcd.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-discovery2026" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-discovery2026/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Profile::Pki::Multirootca::Monitoring[discovery2026]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[discovery2026].orig
+++ Profile::Pki::Multirootca::Monitoring[discovery2026]

-    ca_file      => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => discovery2026

Systemd::Unit[cfssl-ocspserve@aux]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@aux].orig
+++ Systemd::Unit[cfssl-ocspserve@aux]

-    unit              => cfssl-ocspserve@aux
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[cfssl-ocsprefresh-syslog.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-syslog.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-syslog.service]

-    unit              => cfssl-ocsprefresh-syslog.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-aux-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Systemd::Unit[cfssl-ocspserve@syslog]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@syslog].orig
+++ Systemd::Unit[cfssl-ocspserve@syslog]

-    unit              => cfssl-ocspserve@syslog
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nftables/main.nft]

Parameters differences:

--- File[/etc/nftables/main.nft].orig
+++ File[/etc/nftables/main.nft]

+    notify  => Service[nftables]
+    owner   => root
+    ensure  => present
+    group   => root
+    source  => puppet:///modules/nftables/main.nft
+    require => File[/etc/nftables]

File[/etc/nftables/sets/INTERNAL_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/INTERNAL_ipv4.nft].orig
+++ File[/etc/nftables/sets/INTERNAL_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/INTERNAL_ipv4.nft.orig
+++ /etc/nftables/sets/INTERNAL_ipv4.nft
@@ -0,0 +1,8 @@
+# Autogenerated by puppet
+set INTERNAL_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.0.0.0/8
+    }
+}

File[/etc/apache2/sites-enabled/00-dummy.conf]

Parameters differences:

--- File[/etc/apache2/sites-enabled/00-dummy.conf].orig
+++ File[/etc/apache2/sites-enabled/00-dummy.conf]

-    target => /etc/apache2/sites-available/00-dummy.conf
-    owner  => root
-    notify => Service[apache2]
-    group  => root
-    ensure => link

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Class[Cfssl::Multirootca]

Parameters differences:

--- Class[Cfssl::Multirootca].orig
+++ Class[Cfssl::Multirootca]

-    monitoring_critical => True
-    enable_monitoring   => True
-    host                => 127.0.0.1
-    port                => 8888
-    ensure              => present
-    signers             => {'debmonitor': {'private': '/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem', 'certificate': '/etc/cfssl/signers/debmonitor/ca/debmonitor.pem', 'config': '/etc/cfssl/signers/debmonitor/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'discovery': {'private': '/etc/cfssl/signers/discovery/ca/discovery-key.pem', 'certificate': '/etc/cfssl/signers/discovery/ca/discovery.pem', 'config': '/etc/cfssl/signers/discovery/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'kafka': {'private': '/etc/cfssl/signers/kafka/ca/kafka-key.pem', 'certificate': '/etc/cfssl/signers/kafka/ca/kafka.pem', 'config': '/etc/cfssl/signers/kafka/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'cloud_wmnet_ca': {'private': '/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem', 'certificate': '/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem', 'config': '/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'etcd': {'private': '/etc/cfssl/signers/etcd/ca/etcd-key.pem', 'certificate': '/etc/cfssl/signers/etcd/ca/etcd.pem', 'config': '/etc/cfssl/signers/etcd/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'cassandra': {'private': '/etc/cfssl/signers/cassandra/ca/cassandra-key.pem', 'certificate': '/etc/cfssl/signers/cassandra/ca/cassandra.pem', 'config': '/etc/cfssl/signers/cassandra/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'syslog': {'private': '/etc/cfssl/signers/syslog/ca/syslog-key.pem', 'certificate': '/etc/cfssl/signers/syslog/ca/syslog.pem', 'config': '/etc/cfssl/signers/syslog/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'puppet_rsa': {'private': '/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem', 'certificate': '/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem', 'config': '/etc/cfssl/signers/puppet_rsa/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'zuul': {'private': '/etc/cfssl/signers/zuul/ca/zuul-key.pem', 'certificate': '/etc/cfssl/signers/zuul/ca/zuul.pem', 'config': '/etc/cfssl/signers/zuul/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'discovery2026': {'private': '/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem', 'certificate': '/etc/cfssl/signers/discovery2026/ca/discovery2026.pem', 'config': '/etc/cfssl/signers/discovery2026/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube': {'private': '/etc/cfssl/signers/wikikube/ca/wikikube-key.pem', 'certificate': '/etc/cfssl/signers/wikikube/ca/wikikube.pem', 'config': '/etc/cfssl/signers/wikikube/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_front_proxy': {'private': '/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem', 'config': '/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_staging': {'private': '/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem', 'config': '/etc/cfssl/signers/wikikube_staging/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_staging_front_proxy': {'private': '/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem', 'config': '/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve': {'private': '/etc/cfssl/signers/mlserve/ca/mlserve-key.pem', 'certificate': '/etc/cfssl/signers/mlserve/ca/mlserve.pem', 'config': '/etc/cfssl/signers/mlserve/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_front_proxy': {'private': '/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem', 'config': '/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_staging': {'private': '/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem', 'config': '/etc/cfssl/signers/mlserve_staging/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_staging_front_proxy': {'private': '/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem', 'config': '/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'aux': {'private': '/etc/cfssl/signers/aux/ca/aux-key.pem', 'certificate': '/etc/cfssl/signers/aux/ca/aux.pem', 'config': '/etc/cfssl/signers/aux/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'aux_front_proxy': {'private': '/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem', 'config': '/etc/cfssl/signers/aux_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'dse': {'private': '/etc/cfssl/signers/dse/ca/dse-key.pem', 'certificate': '/etc/cfssl/signers/dse/ca/dse.pem', 'config': '/etc/cfssl/signers/dse/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'dse_front_proxy': {'private': '/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem', 'config': '/etc/cfssl/signers/dse_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'network_devices': {'private': '/etc/cfssl/signers/network_devices/ca/network_devices-key.pem', 'certificate': '/etc/cfssl/signers/network_devices/ca/network_devices.pem', 'config': '/etc/cfssl/signers/network_devices/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/wmf_auto_restart_apache2.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_apache2.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_apache2.service]

-    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/wmf_auto_restart_apache2.service.orig
+++ /lib/systemd/system/wmf_auto_restart_apache2.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Auto restart job: apache2
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/wmf-auto-restart -s apache2

Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@etcd]']

Nftables::Set[INTERNAL]

Parameters differences:

--- Nftables::Set[INTERNAL].orig
+++ Nftables::Set[INTERNAL]

+    hosts  => ['10.0.0.0/8', '2620:0:860:100::/56', '2620:0:861:100::/56', '2620:0:863:100::/56', '2a02:ec80:300:100::/56', '2a02:ec80:600:100::/56', '2a02:ec80:700:100::/56', '2001:df2:e500:100::/56', '2a02:ec80:ff00:100::/56']
+    ensure => present

Sudo::User[nrpe-check_check_certificate_expiry_kafka]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_kafka].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_kafka]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Systemd::Service[cfssl-ocsprefresh-dse]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-dse].orig
+++ Systemd::Service[cfssl-ocsprefresh-dse]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-dse.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Cfssl::Signer[mlserve_front_proxy]

Parameters differences:

--- Cfssl::Signer[mlserve_front_proxy].orig
+++ Cfssl::Signer[mlserve_front_proxy]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_front_proxy
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_front_proxy
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@cloud_wmnet_ca]']

Httpd::Conf[dummy]

Parameters differences:

--- Httpd::Conf[dummy].orig
+++ Httpd::Conf[dummy]

-    priority  => 0
-    conf_type => sites
-    source    => puppet:///modules/httpd/dummy.conf
-    ensure    => present

File[/etc/update-motd.d/05-pki--multirootca]

Parameters differences:

--- File[/etc/update-motd.d/05-pki--multirootca].orig
+++ File[/etc/update-motd.d/05-pki--multirootca]

-    owner  => root
-    group  => root
-    mode   => 0555
-    ensure => present

Content differences:

--- /etc/update-motd.d/05-pki--multirootca.orig
+++ /etc/update-motd.d/05-pki--multirootca
@@ -1,2 +0,0 @@
-#!/bin/sh
-printf "%s\n" "pki1001 is a PKI server (pki::multirootca)"

Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Profile::Pki::Multirootca::Monitoring[network_devices]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[network_devices].orig
+++ Profile::Pki::Multirootca::Monitoring[network_devices]

-    ca_file      => /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => network_devices

Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: puppet_rsa
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nftables::Set[LINK_LOCAL]

Parameters differences:

--- Nftables::Set[LINK_LOCAL].orig
+++ Nftables::Set[LINK_LOCAL]

+    hosts  => ['169.254.0.0/16', 'fe80::/10']
+    ensure => present

File[/etc/apache2/env-enabled]

Parameters differences:

--- File[/etc/apache2/env-enabled].orig
+++ File[/etc/apache2/env-enabled]

-    owner   => root
-    group   => root
-    mode    => 0755
-    require => Package[apache2]
-    recurse => True
-    purge   => True
-    notify  => Service[apache2]
-    ensure  => directory

File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - dse_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --responses-file /etc/cfssl/ocsp/dse_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse_front_proxy' dse_front_proxy

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "4d759acaf0fd7dd3abaa03dc4565aef6" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_front_proxy"

File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set AUX_KUBEPODS_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:861:305::/64,
+             2620:0:860:305::/64
+    }
+}

Ferm::Service[full_monitoring_metrics_access_tcp]

Parameters differences:

--- Ferm::Service[full_monitoring_metrics_access_tcp].orig
+++ Ferm::Service[full_monitoring_metrics_access_tcp]

-    unrestricted_access => False
-    port_range          => [1, 65535]
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    ensure              => present
-    srange              => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet', '208.80.154.78', '2620:0:861:3:208:80:154:78', '208.80.153.42', '2620:0:860:2:208:80:153:42']

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-network_devices-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_dse command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_dse
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "4384c5ebc49e03dbe331e279fac3f393" --timeout 10 --check-command "check_check_certificate_expiry_dse"

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/INSTALL_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/INSTALL_HOSTS_ipv4.nft
@@ -0,0 +1,12 @@
+# Autogenerated by puppet
+set INSTALL_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 208.80.154.134,
+             208.80.153.70,
+             185.15.59.101,
+             198.35.26.98,
+             103.102.166.11,
+             185.15.58.7,
+             195.200.68.100
+    }
+}

Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-mlserve_staging_front_proxy.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    ensure => present

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_mlserve_staging].orig
+++ Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"mlserve_staging"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/var/lib/prometheus/node.d/role_owner.prom]

Content differences:

--- /var/lib/prometheus/node.d/role_owner.prom.orig
+++ /var/lib/prometheus/node.d/role_owner.prom
@@ -1,3 +1,3 @@
 # HELP role_owner The team owner of the server role
 # TYPE role_owner gauge
-role_owner{team="infrastructure-foundations",role="pki::multirootca",cluster="pki"} 1.0
+role_owner{team="infrastructure-foundations",role="insetup::infrastructure_foundations_nftables",cluster="insetup"} 1.0

File[/etc/cfssl/ocsp/discovery2026.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/discovery2026.ocsp].orig
+++ File[/etc/cfssl/ocsp/discovery2026.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Prometheus::Blackbox::Check::Http[PKI_etcd]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_etcd].orig
+++ Prometheus::Blackbox::Check::Http[PKI_etcd]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"etcd"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/etc/apache2/conf-enabled/50-server-status.conf]

Parameters differences:

--- File[/etc/apache2/conf-enabled/50-server-status.conf].orig
+++ File[/etc/apache2/conf-enabled/50-server-status.conf]

-    target => /etc/apache2/conf-available/50-server-status.conf
-    owner  => root
-    notify => Service[apache2]
-    group  => root
-    ensure => link

File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]

Parameters differences:

--- File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf].orig
+++ File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]

-    target => /etc/apache2/sites-available/50-pki-discovery-wmnet.conf
-    owner  => root
-    notify => Service[apache2]
-    group  => root
-    ensure => link

Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_kafka!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: kafka
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-syslog.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-syslog.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - syslog
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/syslog/ca/syslog.pem --responses-file /etc/cfssl/ocsp/syslog.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@syslog' syslog

Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Unit[cfssl-ocspserve@debmonitor]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@debmonitor].orig
+++ Systemd::Unit[cfssl-ocspserve@debmonitor]

-    unit              => cfssl-ocspserve@debmonitor
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[apache2_test_config_and_restart]

Parameters differences:

--- Exec[apache2_test_config_and_restart].orig
+++ Exec[apache2_test_config_and_restart]

-    onlyif      => /usr/sbin/apache2ctl configtest
-    before      => Service[apache2]
-    refreshonly => True
-    command     => /usr/sbin/service apache2 restart

Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]

-    before      => ['Service[cfssl-ocsprefresh-aux.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Class[Monitoring]

Parameters differences:

--- Class[Monitoring].orig
+++ Class[Monitoring]

@@
-    nagios_group          => pki_eqiad
+    nagios_group          => insetup_eqiad
@@
-    cluster               => pki
+    cluster               => insetup
@@
-    notifications_enabled => True
+    notifications_enabled => False

File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]

Parameters differences:

--- File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf].orig
+++ File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]

-    target => /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf
-    owner  => root
-    notify => Service[apache2]
-    group  => root
-    ensure => link

Nrpe::Monitor_service[check_cfssl-multirootca_status]

Parameters differences:

--- Nrpe::Monitor_service[check_cfssl-multirootca_status].orig
+++ Nrpe::Monitor_service[check_cfssl-multirootca_status]

-    contact_group               => admins
-    nrpe_command                => /usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => True
-    description                 => Check unit status of cfssl-multirootca
-    retries                     => 2
-    check_interval              => 10
-    migration_task              => T350694
-    timeout                     => 10
-    ensure                      => present
-    retry_interval              => 1

Systemd::Timer[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-discovery2026].orig
+++ Systemd::Timer[cfssl-ocsprefresh-discovery2026]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-discovery2026.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Profile::Pki::Multirootca::Monitoring[puppet_rsa]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[puppet_rsa].orig
+++ Profile::Pki::Multirootca::Monitoring[puppet_rsa]

-    ca_file      => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => puppet_rsa

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_zuul" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-zuul].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-zuul.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-zuul
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-zuul
-
-/var/log/cfssl-ocsprefresh-zuul/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_discovery.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Motd::Message[insetup::infrastructure_foundations_nftables]

Parameters differences:

--- Motd::Message[insetup::infrastructure_foundations_nftables].orig
+++ Motd::Message[insetup::infrastructure_foundations_nftables]

+    priority => 5
+    message  => pki1001 is a Host being setup by Infrastructure Foundations SREs with ntables (insetup::infrastructure_foundations_nftables)
+    ensure   => present

Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: cassandra
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__cassandra
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="f5e260f525c48c963fb2e6c86a0d5d63",check_name="check_check_certificate_expiry_cassandra", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: cassandra
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_cassandra))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nftables::Set[ZOOKEEPER_HOSTS_MAIN]

Parameters differences:

--- Nftables::Set[ZOOKEEPER_HOSTS_MAIN].orig
+++ Nftables::Set[ZOOKEEPER_HOSTS_MAIN]

+    hosts  => ['10.64.0.207', '2620:0:861:101:10:64:0:207', '10.64.16.110', '2620:0:861:102:10:64:16:110', '10.64.48.154', '2620:0:861:107:10:64:48:154', '10.192.16.45', '2620:0:860:102:10:192:16:45', '10.192.32.52', '2620:0:860:103:10:192:32:52', '10.192.48.59', '2620:0:860:104:10:192:48:59']
+    ensure => present

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "9d6dd05c8e5e1bb294462d932b24bd1a" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_front_proxy"

Cfssl::Ocsp[cassandra]

Parameters differences:

--- Cfssl::Ocsp[cassandra].orig
+++ Cfssl::Ocsp[cassandra]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10006
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Unit[cfssl-ocsprefresh-dse.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-dse.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-dse.service]

-    unit              => cfssl-ocsprefresh-dse.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[cfssl-ocsprefresh-aux]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-aux].orig
+++ Systemd::Service[cfssl-ocsprefresh-aux]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-aux.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File_line[auto_restart_file_presence_ulogd2]

Parameters differences:

--- File_line[auto_restart_file_presence_ulogd2].orig
+++ File_line[auto_restart_file_presence_ulogd2]

-    path    => /etc/debdeploy-client/autorestarts.conf
-    line    => ulogd2
-    ensure  => present
-    require => File[/etc/debdeploy-client/autorestarts.conf]

Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

Logrotate::Conf[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-kafka].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-kafka]

-    ensure => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-kafka" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-kafka/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_discovery.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Service[nftables]

Parameters differences:

--- Service[nftables].orig
+++ Service[nftables]

+    hasrestart => True
+    enable     => True
+    ensure     => running
+    restart    => /usr/bin/systemctl reload nftables

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Profile::Pki::Multirootca::Monitoring[cassandra]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[cassandra].orig
+++ Profile::Pki::Multirootca::Monitoring[cassandra]

-    ca_file      => /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => cassandra

Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__discovery
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="38e4dbcfd07ed60daf5bb89397abbe29",check_name="check_check_certificate_expiry_discovery", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_discovery))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_network_devices.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_network_devices.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - aux_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --responses-file /etc/cfssl/ocsp/aux_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux_front_proxy' aux_front_proxy

File[/etc/cfssl/signers/debmonitor]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor].orig
+++ File[/etc/cfssl/signers/debmonitor]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/sudoers.d/nrpe_certificate_check_etcd]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_etcd].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_etcd]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set STAGING_KUBEPODS_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.64.64.0/21,
+             10.192.64.0/21
+    }
+}

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-aux_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-aux_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/puppet_rsa]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa].orig
+++ File[/etc/cfssl/signers/puppet_rsa]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

-    owner  => root
-    source => puppet:///modules/profile/pki/intermediates/puppet_rsa-cert.pem
-    group  => root
-    mode   => 0440
-    ensure => file

Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change].orig
+++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]

-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet

-    subscribe   => File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
-    notify      => ['Service[apache2]']
-    environment => ['GODEBUG=x509ignoreCN=0']
-    require     => Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

Ferm::Rule[log-everything]

Parameters differences:

--- Ferm::Rule[log-everything].orig
+++ Ferm::Rule[log-everything]

-    table  => filter
-    chain  => INPUT
-    ensure => present
-    domain => (ip ip6)
-    prio   => 98
-    desc   => 
-    rule   => NFLOG mod limit limit 1/second limit-burst 5 nflog-prefix "[fw-in-drop]";

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/signers/syslog]

Parameters differences:

--- File[/etc/cfssl/signers/syslog].orig
+++ File[/etc/cfssl/signers/syslog]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_wikikube]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem

Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set MLSERVE_KUBEPODS_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:861:300::/64,
+             2620:0:860:300::/64
+    }
+}

File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft
@@ -0,0 +1,20 @@
+# Autogenerated by puppet
+set CLOUD_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2a02:ec80:a000:100::/64,
+             2a02:ec80:a000:1::/64,
+             2a02:ec80:a000:201::/64,
+             2a02:ec80:a000:202::/64,
+             2a02:ec80:a000:203::/64,
+             2a02:ec80:a000:204::/64,
+             2a02:ec80:a000:2ff::/64,
+             2a02:ec80:a000:4000::/64,
+             2a02:ec80:a100:100::/64,
+             2a02:ec80:a100:1::/64,
+             2a02:ec80:a100:205::/64,
+             2a02:ec80:a100:2ff::/64,
+             2a02:ec80:a100:4000::/64
+    }
+}

Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/cfssl-ocspserve@dse.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@dse.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@dse.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@dse.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@dse.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (dse)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20061 \
-          -responses /etc/cfssl/ocsp/dse.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]

-    before      => ['Service[cfssl-ocsprefresh-mlserve.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Systemd::Unit[cfssl-ocspserve@mlserve]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@mlserve].orig
+++ Systemd::Unit[cfssl-ocspserve@mlserve]

-    unit              => cfssl-ocspserve@mlserve
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Sudo::User[nrpe_certificate_check_debmonitor]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_debmonitor].orig
+++ Sudo::User[nrpe_certificate_check_debmonitor]

-    user       => nrpe_certificate_check_debmonitor
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nftables::Set[KAFKA_BROKERS_JUMBO]

Parameters differences:

--- Nftables::Set[KAFKA_BROKERS_JUMBO].orig
+++ Nftables::Set[KAFKA_BROKERS_JUMBO]

+    hosts  => ['10.64.130.10', '2620:0:861:109:10:64:130:10', '10.64.131.16', '2620:0:861:10a:10:64:131:16', '10.64.132.21', '2620:0:861:10b:10:64:132:21', '10.64.134.9', '2620:0:861:10d:10:64:134:9', '10.64.135.16', '2620:0:861:10e:10:64:135:16', '10.64.136.11', '2620:0:861:10f:10:64:136:11', '10.64.154.15', '2620:0:861:122:10:64:154:15', '10.64.160.16', '2620:0:861:128:10:64:160:16', '10.64.0.126', '2620:0:861:101:10:64:0:126']
+    ensure => present

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "d2a76a31e44e204e2d4788a2698d0e6c" --timeout 10 --check-command "check_check_certificate_expiry_wikikube"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/etc/cfssl/ocsp/zuul.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/zuul.ocsp].orig
+++ File[/etc/cfssl/ocsp/zuul.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Prometheus::Blackbox::Check::Http[PKI_discovery2026]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_discovery2026].orig
+++ Prometheus::Blackbox::Check::Http[PKI_discovery2026]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"discovery2026"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-etcd.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-etcd.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - etcd
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/etcd/ca/etcd.pem --responses-file /etc/cfssl/ocsp/etcd.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@etcd' etcd

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Package[ulogd2]

Parameters differences:

--- Package[ulogd2].orig
+++ Package[ulogd2]

-    ensure   => installed
-    provider => apt

Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => syslog
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-syslog]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@syslog]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_wikikube_staging].orig
+++ Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"wikikube_staging"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Systemd::Unit[cfssl-ocsprefresh-aux.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-aux.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-aux.service]

-    unit              => cfssl-ocsprefresh-aux.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    ensure => present

Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Logrotate::Conf[cfssl-ocsprefresh-aux]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-aux].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-aux]

-    ensure => present

Rsyslog::Conf[cfssl-ocsprefresh-aux]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-aux].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-aux]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-aux]

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_kafka.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[cfssl-ocspserve@discovery]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@discovery].orig
+++ Systemd::Unit[cfssl-ocspserve@discovery]

-    unit              => cfssl-ocspserve@discovery
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-syslog-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/kafka]

Parameters differences:

--- File[/etc/cfssl/signers/kafka].orig
+++ File[/etc/cfssl/signers/kafka]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem].orig
+++ File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/cassandra/ca/cassandra-key.pem.orig
+++ /etc/cfssl/signers/cassandra/ca/cassandra-key.pem
@@ -1 +0,0 @@
-nosecret

Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]

-    unit              => cfssl-ocsprefresh-aux_front_proxy.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]

-    before      => ['Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => zuul
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-zuul]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@zuul]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

Service[cfssl-ocspserve@aux]

Parameters differences:

--- Service[cfssl-ocspserve@aux].orig
+++ Service[cfssl-ocspserve@aux]

-    enable => True
-    ensure => running

Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Class[Profile::Puppet::Agent]

Parameters differences:

--- Class[Profile::Puppet::Agent].orig
+++ Class[Profile::Puppet::Agent]

@@
-    dns_alt_names => ['pki.discovery.wmnet']
+    dns_alt_names => []

File[/etc/nftables/sets/CACHES_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/CACHES_ipv6.nft].orig
+++ File[/etc/nftables/sets/CACHES_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CACHES_ipv6.nft.orig
+++ /etc/nftables/sets/CACHES_ipv6.nft
@@ -0,0 +1,117 @@
+# Autogenerated by puppet
+set CACHES_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:101:10:64:0:79,
+             2620:0:861:101:10:64:0:229,
+             2620:0:861:101:10:64:0:14,
+             2620:0:861:101:10:64:0:51,
+             2620:0:861:102:10:64:16:241,
+             2620:0:861:102:10:64:16:94,
+             2620:0:861:102:10:64:16:95,
+             2620:0:861:102:10:64:16:240,
+             2620:0:861:103:10:64:32:14,
+             2620:0:861:103:10:64:32:60,
+             2620:0:861:103:10:64:32:15,
+             2620:0:861:103:10:64:32:65,
+             2620:0:861:107:10:64:48:16,
+             2620:0:861:107:10:64:48:41,
+             2620:0:861:107:10:64:48:27,
+             2620:0:861:107:10:64:48:28,
+             2620:0:860:113:10:192:23:26,
+             2620:0:860:107:10:192:6:20,
+             2620:0:860:10d:10:192:12:35,
+             2620:0:860:10f:10:192:14:25,
+             2620:0:860:100:10:192:4:22,
+             2620:0:860:116:10:192:29:26,
+             2620:0:860:119:10:192:30:29,
+             2620:0:860:11b:10:192:36:19,
+             2620:0:860:11f:10:192:40:25,
+             2620:0:860:120:10:192:41:21,
+             2620:0:860:12b:10:192:56:3,
+             2620:0:860:12b:10:192:56:4,
+             2620:0:860:12c:10:192:57:3,
+             2620:0:860:12d:10:192:58:2,
+             2620:0:860:12d:10:192:58:3,
+             2620:0:860:12e:10:192:59:2,
+             2a02:ec80:300:101:10:80:0:14,
+             2a02:ec80:300:102:10:80:1:11,
+             2a02:ec80:300:101:10:80:0:13,
+             2a02:ec80:300:102:10:80:1:9,
+             2a02:ec80:300:101:10:80:0:12,
+             2a02:ec80:300:102:10:80:1:7,
+             2a02:ec80:300:101:10:80:0:11,
+             2a02:ec80:300:102:10:80:1:6,
+             2a02:ec80:300:101:10:80:0:10,
+             2a02:ec80:300:102:10:80:1:5,
+             2a02:ec80:300:101:10:80:0:8,
+             2a02:ec80:300:102:10:80:1:4,
+             2a02:ec80:300:101:10:80:0:7,
+             2a02:ec80:300:102:10:80:1:3,
+             2a02:ec80:300:101:10:80:0:6,
+             2a02:ec80:300:102:10:80:1:2,
+             2620:0:863:101:10:128:0:19,
+             2620:0:863:101:10:128:0:27,
+             2620:0:863:101:10:128:0:22,
+             2620:0:863:101:10:128:0:28,
+             2620:0:863:101:10:128:0:25,
+             2620:0:863:101:10:128:0:29,
+             2620:0:863:101:10:128:0:26,
+             2620:0:863:101:10:128:0:31,
+             2620:0:863:101:10:128:0:14,
+             2620:0:863:101:10:128:0:35,
+             2620:0:863:101:10:128:0:21,
+             2620:0:863:101:10:128:0:36,
+             2620:0:863:101:10:128:0:24,
+             2620:0:863:101:10:128:0:10,
+             2620:0:863:101:10:128:0:37,
+             2620:0:863:101:10:128:0:12,
+             2001:df2:e500:101:10:132:0:17,
+             2001:df2:e500:101:10:132:0:18,
+             2001:df2:e500:101:10:132:0:19,
+             2001:df2:e500:101:10:132:0:24,
+             2001:df2:e500:101:10:132:0:29,
+             2001:df2:e500:101:10:132:0:30,
+             2001:df2:e500:101:10:132:0:34,
+             2001:df2:e500:101:10:132:0:35,
+             2001:df2:e500:101:10:132:0:36,
+             2001:df2:e500:101:10:132:0:37,
+             2001:df2:e500:101:10:132:0:38,
+             2001:df2:e500:101:10:132:0:25,
+             2001:df2:e500:101:10:132:0:26,
+             2001:df2:e500:101:10:132:0:27,
+             2001:df2:e500:101:10:132:0:28,
+             2001:df2:e500:101:10:132:0:16,
+             2a02:ec80:600:101:10:136:0:6,
+             2a02:ec80:600:102:10:136:1:6,
+             2a02:ec80:600:101:10:136:0:7,
+             2a02:ec80:600:102:10:136:1:7,
+             2a02:ec80:600:101:10:136:0:8,
+             2a02:ec80:600:102:10:136:1:8,
+             2a02:ec80:600:101:10:136:0:9,
+             2a02:ec80:600:102:10:136:1:9,
+             2a02:ec80:600:101:10:136:0:10,
+             2a02:ec80:600:102:10:136:1:10,
+             2a02:ec80:600:101:10:136:0:11,
+             2a02:ec80:600:102:10:136:1:11,
+             2a02:ec80:600:101:10:136:0:12,
+             2a02:ec80:600:102:10:136:1:12,
+             2a02:ec80:600:101:10:136:0:13,
+             2a02:ec80:600:102:10:136:1:13,
+             2a02:ec80:700:101:10:140:0:3,
+             2a02:ec80:700:102:10:140:1:4,
+             2a02:ec80:700:101:10:140:0:4,
+             2a02:ec80:700:102:10:140:1:5,
+             2a02:ec80:700:101:10:140:0:5,
+             2a02:ec80:700:102:10:140:1:6,
+             2a02:ec80:700:101:10:140:0:6,
+             2a02:ec80:700:102:10:140:1:7,
+             2a02:ec80:700:101:10:140:0:7,
+             2a02:ec80:700:102:10:140:1:8,
+             2a02:ec80:700:101:10:140:0:8,
+             2a02:ec80:700:102:10:140:1:9,
+             2a02:ec80:700:101:10:140:0:9,
+             2a02:ec80:700:102:10:140:1:10,
+             2a02:ec80:700:101:10:140:0:10,
+             2a02:ec80:700:102:10:140:1:11
+    }
+}

Sudo::User[nrpe-check_check_certificate_expiry_aux]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_aux].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_aux]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/var/log/cfssl-ocsprefresh-syslog]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-syslog].orig
+++ File[/var/log/cfssl-ocsprefresh-syslog]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-wikikube" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_network_devices" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/nftables/forward]

Parameters differences:

--- File[/etc/nftables/forward].orig
+++ File[/etc/nftables/forward]

+    recurse => True
+    purge   => True
+    owner   => root
+    group   => root
+    ensure  => directory

Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca].orig
+++ Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]

-    before    => Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    ensure    => present
-    sudo_user => root

File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@mlserve_staging.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@mlserve_staging.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (mlserve_staging)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20040 \
-          -responses /etc/cfssl/ocsp/mlserve_staging.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set DSE_KUBEPODS_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.67.24.0/21,
+             10.192.96.0/21
+    }
+}

Prometheus::Blackbox::Check::Http[PKI_aux]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_aux].orig
+++ Prometheus::Blackbox::Check::Http[PKI_aux]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"aux"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/lib/systemd/system/cfssl-multirootca.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-multirootca.service].orig
+++ File[/lib/systemd/system/cfssl-multirootca.service]

-    notify => Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-multirootca.service.orig
+++ /lib/systemd/system/cfssl-multirootca.service
@@ -1,14 +0,0 @@
-[Unit]
-Description=Cloudflare SSL MultiRootCA
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/blob/master/doc/cmd/multiroot.txt
-
-[Service]
-ExecStart=/usr/bin/multirootca \
-          -a "127.0.0.1:8888" \
-          -roots /etc/cfssl/multiroot.conf 
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft].orig
+++ File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft.orig
+++ /etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft
@@ -0,0 +1,15 @@
+# Autogenerated by puppet
+set KAFKA_BROKERS_MAIN_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:860:106:10:192:5:9,
+             2620:0:860:112:10:192:22:6,
+             2620:0:860:103:10:192:32:4,
+             2620:0:860:104:10:192:48:33,
+             2620:0:860:104:10:192:48:35,
+             2620:0:861:101:10:64:0:101,
+             2620:0:861:102:10:64:16:30,
+             2620:0:861:103:10:64:32:45,
+             2620:0:861:107:10:64:48:37,
+             2620:0:861:120:10:64:152:5
+    }
+}

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-mlserve-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom

Service[cfssl-ocsprefresh-wikikube_staging.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-wikikube_staging.timer].orig
+++ Service[cfssl-ocsprefresh-wikikube_staging.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem

File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-kafka-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_dse_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_dse_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "2560f4f577ba169af651cf96bd5dc1ba" --timeout 10 --check-command "check_check_certificate_expiry_dse_front_proxy"

Nftables::Set[AUX_KUBEPODS_NETWORKS]

Parameters differences:

--- Nftables::Set[AUX_KUBEPODS_NETWORKS].orig
+++ Nftables::Set[AUX_KUBEPODS_NETWORKS]

+    hosts  => ['10.67.80.0/21', '2620:0:861:305::/64', '10.194.80.0/21', '2620:0:860:305::/64']
+    ensure => present

Nrpe::Check[check_check_certificate_expiry_aux]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_aux].orig
+++ Nrpe::Check[check_check_certificate_expiry_aux]

-    before    => Monitoring::Service[check_certificate_expiry_aux]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem
-    ensure    => present
-    sudo_user => root

File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr].orig
+++ File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr.orig
+++ /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr
@@ -1,14 +0,0 @@
-{
-  "CN": "pki.discovery.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet",
-    "pki.discovery.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Nftables::Set[DSE_KUBEPODS_NETWORKS]

Parameters differences:

--- Nftables::Set[DSE_KUBEPODS_NETWORKS].orig
+++ Nftables::Set[DSE_KUBEPODS_NETWORKS]

+    hosts  => ['10.67.24.0/21', '2620:0:861:302::/64', '10.192.96.0/21', '2620:0:860:308::/64']
+    ensure => present

Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft
@@ -0,0 +1,10 @@
+# Autogenerated by puppet
+set DRUID_PUBLIC_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.131.9,
+             10.64.132.12,
+             10.64.135.9,
+             10.64.32.101,
+             10.64.48.185
+    }
+}

Systemd::Service[cfssl-ocspserve@zuul]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@zuul].orig
+++ Systemd::Service[cfssl-ocspserve@zuul]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

-    ensure => present

Class[Profile::Apt]

Parameters differences:

--- Class[Profile::Apt].orig
+++ Class[Profile::Apt]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[apache2]', 'Package[links]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[python3-pymysql]', 'Package[python3-cryptography]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Service[apache-htcacheclean]

Parameters differences:

--- Service[apache-htcacheclean].orig
+++ Service[apache-htcacheclean]

-    enable => False
-    ensure => stopped

Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - wikikube_staging
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --responses-file /etc/cfssl/ocsp/wikikube_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging' wikikube_staging

File[/etc/apache2/sites-available/00-dummy.conf]

Parameters differences:

--- File[/etc/apache2/sites-available/00-dummy.conf].orig
+++ File[/etc/apache2/sites-available/00-dummy.conf]

-    notify => Service[apache2]
-    owner  => root
-    source => puppet:///modules/httpd/dummy.conf
-    group  => root
-    mode   => 0444
-    ensure => present

Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]

-    ca_file      => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => wikikube_staging_front_proxy

Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/signers/dse/ca/dse-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/dse/ca/dse-key.pem].orig
+++ File[/etc/cfssl/signers/dse/ca/dse-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-wikikube_front_proxy.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Httpd::Site[dummy]

Parameters differences:

--- Httpd::Site[dummy].orig
+++ Httpd::Site[dummy]

-    priority => 0
-    source   => puppet:///modules/httpd/dummy.conf
-    ensure   => present

File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/etcd/ca/etcd-key.pem].orig
+++ File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/etcd/ca/etcd-key.pem.orig
+++ /etc/cfssl/signers/etcd/ca/etcd-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Nrpe::Monitor_service[check_certificate_expiry_syslog]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_syslog].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_syslog]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: syslog
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_dse_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Exec[update_alternative_iptables]

Parameters differences:

--- Exec[update_alternative_iptables].orig
+++ Exec[update_alternative_iptables]

-    command => /usr/bin/update-alternatives --force --set iptables /usr/sbin/iptables-legacy
-    unless  => /usr/bin/update-alternatives --query iptables | /bin/grep 'Value: /usr/sbin/iptables-legacy'

Systemd::Syslog[ulogd]

Parameters differences:

--- Systemd::Syslog[ulogd].orig
+++ Systemd::Syslog[ulogd]

-    force_stop             => True
-    readable_by            => user
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status].orig
+++ Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]

-    accuracy           => 15sec
-    splay              => 300
-    unit_name          => nrpe2nodexp-check_cfssl-multirootca_status.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_dse.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Systemd::Unit[cfssl-ocspserve@discovery2026]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@discovery2026].orig
+++ Systemd::Unit[cfssl-ocspserve@discovery2026]

-    unit              => cfssl-ocspserve@discovery2026
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Sudo::User[nrpe_certificate_check_discovery]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_discovery].orig
+++ Sudo::User[nrpe_certificate_check_discovery]

-    user       => nrpe_certificate_check_discovery
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

File[/srv/cfssl/bundles/cassandra.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/cassandra.pem].orig
+++ File[/srv/cfssl/bundles/cassandra.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/cassandra.pem.orig
+++ /srv/cfssl/bundles/cassandra.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
-BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
-zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
-CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
-eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
-NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
-BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
-ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
-+EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
-D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
-B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
------END CERTIFICATE-----

File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - wikikube_staging_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging_front_proxy' wikikube_staging_front_proxy

File[/etc/cfssl/signers/dse/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/dse/cfssl.conf].orig
+++ File[/etc/cfssl/signers/dse/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/dse/cfssl.conf.orig
+++ /etc/cfssl/signers/dse/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/dse",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/dse"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/var/log/cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-mlserve_staging].orig
+++ File[/var/log/cfssl-ocsprefresh-mlserve_staging]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Service[cfssl-ocspserve@network_devices]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@network_devices].orig
+++ Systemd::Service[cfssl-ocspserve@network_devices]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]

-    unit              => cfssl-ocsprefresh-mlserve_staging.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices/ca/network_devices.pem].orig
+++ File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/network_devices/ca/network_devices.pem.orig
+++ /etc/cfssl/signers/network_devices/ca/network_devices.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
-QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
-WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
-mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
-tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
------END CERTIFICATE-----

File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem].orig
+++ File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem.orig
+++ /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
@@ -1,30 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
-MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
-lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
-Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
-z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
-i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
-FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
-BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
-AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
-mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
-Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
-GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
-AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
-DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
-vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
-a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
-Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
-Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
-hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
-9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
-xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
------END CERTIFICATE-----

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-wikikube_staging-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom

File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Profile::Pki::Multirootca::Monitoring[mlserve_staging]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[mlserve_staging].orig
+++ Profile::Pki::Multirootca::Monitoring[mlserve_staging]

-    ca_file      => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => mlserve_staging

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]

-    unit              => cfssl-ocspserve@wikikube_staging_front_proxy
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_mlserve_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem

File[/etc/sudoers.d/nrpe_certificate_check_network_devices]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_network_devices].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_network_devices]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Nrpe::Monitor_service[check_certificate_expiry_mlserve]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_mlserve].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_mlserve]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: mlserve
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocspserve@dse_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@dse_front_proxy].orig
+++ Service[cfssl-ocspserve@dse_front_proxy]

-    enable => True
-    ensure => running

Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]

-    unit              => cfssl-ocsprefresh-mlserve_front_proxy.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Service[cfssl-ocspserve@wikikube_staging]

Parameters differences:

--- Service[cfssl-ocspserve@wikikube_staging].orig
+++ Service[cfssl-ocspserve@wikikube_staging]

-    enable => True
-    ensure => running

Class[Profile::Contacts]

Parameters differences:

--- Class[Profile::Contacts].orig
+++ Class[Profile::Contacts]

@@
-    cluster => pki
+    cluster => insetup

File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]

-    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of wmf_auto_restart_apache-htcacheclean.service
-
-[Timer]
-Unit=wmf_auto_restart_apache-htcacheclean.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-dse-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]

-    ca_file      => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => mlserve_front_proxy

File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    ensure    => present
-    sudo_user => root

Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_zuul.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_zuul.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]

-    before      => ['Service[cfssl-ocsprefresh-dse_front_proxy.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Cfssl::Ocsp[debmonitor]

Parameters differences:

--- Cfssl::Ocsp[debmonitor].orig
+++ Cfssl::Ocsp[debmonitor]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10001
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem

Sudo::User[nrpe_certificate_check_kafka]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_kafka].orig
+++ Sudo::User[nrpe_certificate_check_kafka]

-    user       => nrpe_certificate_check_kafka
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Cfssl::Signer[wikikube_staging_front_proxy]

Parameters differences:

--- Cfssl::Signer[wikikube_staging_front_proxy].orig
+++ Cfssl::Signer[wikikube_staging_front_proxy]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
/3y5tw==
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 72h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => test

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_front_proxy-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_discovery command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_discovery
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "38e4dbcfd07ed60daf5bb89397abbe29" --timeout 10 --check-command "check_check_certificate_expiry_discovery"

File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft
@@ -0,0 +1,10 @@
+# Autogenerated by puppet
+set DRUID_PUBLIC_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:10a:10:64:131:9,
+             2620:0:861:10b:10:64:132:12,
+             2620:0:861:10e:10:64:135:9,
+             2620:0:861:103:10:64:32:101,
+             2620:0:861:107:10:64:48:185
+    }
+}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_debmonitor].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Logrotate::Conf[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-network_devices].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-network_devices]

-    ensure => present

File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Service[nrpe2nodexp-check_certificate_expiry_aux.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_aux.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_aux.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - mlserve_staging
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --responses-file /etc/cfssl/ocsp/mlserve_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging' mlserve_staging

Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-mlserve_staging_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom

Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
+++ Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-zuul" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-zuul/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Cfssl::Config[network_devices]

Parameters differences:

--- Cfssl::Config[network_devices].orig
+++ Cfssl::Config[network_devices]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/network_devices
-    path                => /etc/cfssl/signers/network_devices/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 8760h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/network_devices

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_discovery2026.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[wmf_auto_restart_apache2.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_apache2.service].orig
+++ Systemd::Unit[wmf_auto_restart_apache2.service]

-    unit              => wmf_auto_restart_apache2.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_discovery2026.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_discovery2026.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp].orig
+++ File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/cfssl/signers/aux/ca/aux-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/aux/ca/aux-key.pem].orig
+++ File[/etc/cfssl/signers/aux/ca/aux-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/aux/ca/aux-key.pem.orig
+++ /etc/cfssl/signers/aux/ca/aux-key.pem
@@ -1 +0,0 @@
-nosecret

Nftables::Set[ANALYTICS_NETWORKS]

Parameters differences:

--- Nftables::Set[ANALYTICS_NETWORKS].orig
+++ Nftables::Set[ANALYTICS_NETWORKS]

+    hosts  => ['10.64.137.0/24', '10.64.138.0/24', '10.64.139.0/24', '10.64.140.0/24', '10.64.142.0/24', '10.64.143.0/24', '10.64.144.0/24', '10.64.145.0/24', '10.64.153.0/24', '10.64.155.0/24', '10.64.157.0/24', '10.64.159.0/24', '10.64.161.0/24', '10.64.163.0/24', '10.64.165.0/24', '10.64.167.0/24', '10.64.170.0/24', '10.64.172.0/24', '10.64.174.0/24', '10.64.176.0/24', '10.64.178.0/24', '10.64.180.0/24', '10.64.182.0/24', '10.64.184.0/24', '10.64.186.0/24', '10.64.188.0/24', '10.64.190.0/24', '10.64.21.0/24', '10.64.36.0/24', '10.64.5.0/24', '10.64.53.0/24', '2620:0:861:100::/64', '2620:0:861:104::/64', '2620:0:861:105::/64', '2620:0:861:106::/64', '2620:0:861:108::/64', '2620:0:861:110::/64', '2620:0:861:111::/64', '2620:0:861:112::/64', '2620:0:861:114::/64', '2620:0:861:115::/64', '2620:0:861:116::/64', '2620:0:861:117::/64', '2620:0:861:11a::/64', '2620:0:861:121::/64', '2620:0:861:123::/64', '2620:0:861:125::/64', '2620:0:861:127::/64', '2620:0:861:129::/64', '2620:0:861:12b::/64', '2620:0:861:12d::/64', '2620:0:861:12f::/64', '2620:0:861:132::/64', '2620:0:861:134::/64', '2620:0:861:136::/64', '2620:0:861:138::/64', '2620:0:861:13a::/64', '2620:0:861:13c::/64', '2620:0:861:13e::/64', '2620:0:861:141::/64', '2620:0:861:143::/64', '2620:0:861:145::/64']
+    ensure => present

Systemd::Service[wmf_auto_restart_ulogd2]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_ulogd2].orig
+++ Systemd::Service[wmf_auto_restart_ulogd2]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[wmf_auto_restart_ulogd2.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_aux!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: aux
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]

-    group  => root
-    ensure => absent
-    owner  => root

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_staging
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "7cff186656c3cabbca85b5b57d0c8679" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Sudo::User[nrpe_certificate_check_etcd]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_etcd].orig
+++ Sudo::User[nrpe_certificate_check_etcd]

-    user       => nrpe_certificate_check_etcd
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

-    ensure => present

Nftables::Set[MONITORING_HOSTS]

Parameters differences:

--- Nftables::Set[MONITORING_HOSTS].orig
+++ Nftables::Set[MONITORING_HOSTS]

+    hosts  => ['208.80.154.78', '2620:0:861:3:208:80:154:78', '208.80.153.42', '2620:0:860:2:208:80:153:42']
+    ensure => present

Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem].orig
+++ File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/mlserve/ca/mlserve-key.pem.orig
+++ /etc/cfssl/signers/mlserve/ca/mlserve-key.pem
@@ -1 +0,0 @@
-nosecret

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-cassandra.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-cassandra.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - cassandra
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cassandra/ca/cassandra.pem --responses-file /etc/cfssl/ocsp/cassandra.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cassandra' cassandra

Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]

-    unit              => cfssl-ocsprefresh-dse_front_proxy.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]

Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Nftables::Service[full-monitoring-metrics-access-udp]

Parameters differences:

--- Nftables::Service[full-monitoring-metrics-access-udp].orig
+++ Nftables::Service[full-monitoring-metrics-access-udp]

+    unrestricted_access => False
+    port_range          => [1, 65535]
+    prio                => 10
+    desc                => 
+    proto               => udp
+    src_ips             => ['10.64.0.82', '10.64.16.62', '10.64.32.85', '10.64.48.171', '208.80.153.42', '208.80.154.78', '2620:0:860:2:208:80:153:42', '2620:0:861:101:10:64:0:82', '2620:0:861:102:10:64:16:62', '2620:0:861:103:10:64:32:85', '2620:0:861:107:10:64:48:171', '2620:0:861:3:208:80:154:78']
+    notrack             => False
+    ensure              => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA
-
-/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_staging_front_proxy!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Httpd::Conf[server-status]

Parameters differences:

--- Httpd::Conf[server-status].orig
+++ Httpd::Conf[server-status]

-    conf_type => conf
-    ensure    => present
-    priority  => 50
-    source    => puppet:///modules/httpd/status.conf
-    require   => Httpd::Mod_conf[status]

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

File[/etc/ferm/conf.d/10_multirootca_tls_termination]

Parameters differences:

--- File[/etc/ferm/conf.d/10_multirootca_tls_termination].orig
+++ File[/etc/ferm/conf.d/10_multirootca_tls_termination]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/10_multirootca_tls_termination.orig
+++ /etc/ferm/conf.d/10_multirootca_tls_termination
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 443, $DOMAIN_NETWORKS);
-
-

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-etcd-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom

File[/srv/cfssl/bundles/mlserve_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/mlserve_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/mlserve_front_proxy.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/mlserve_front_proxy.pem.orig
+++ /srv/cfssl/bundles/mlserve_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
-gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
-BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
-h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
-6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
-o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
-VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
-/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
-L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
-dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
-dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
-MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
-lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
-EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
------END CERTIFICATE-----

Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: kafka
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__kafka
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="22922fd6bc2d570e018cbe5ccd8d1727",check_name="check_check_certificate_expiry_kafka", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: kafka
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_kafka))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

Systemd::Timer::Job[cfssl-gc-expired-certs]

Parameters differences:

--- Systemd::Timer::Job[cfssl-gc-expired-certs].orig
+++ Systemd::Timer::Job[cfssl-gc-expired-certs]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-certs clean
-    description               => Delete expired Certificates from the cfssl DB
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': 'hourly'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Cfssl::Config[mlserve_front_proxy]

Parameters differences:

--- Cfssl::Config[mlserve_front_proxy].orig
+++ Cfssl::Config[mlserve_front_proxy]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_front_proxy
-    path                => /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_front_proxy

Nrpe::Plugin[check_systemd_unit_status]

Parameters differences:

--- Nrpe::Plugin[check_systemd_unit_status].orig
+++ Nrpe::Plugin[check_systemd_unit_status]

-    source => puppet:///modules/systemd/check_systemd_unit_status
-    ensure => present

Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Exec[ensure_present_mod_ssl]

Parameters differences:

--- Exec[ensure_present_mod_ssl].orig
+++ Exec[ensure_present_mod_ssl]

-    creates => /etc/apache2/mods-enabled/ssl.load
-    command => /usr/sbin/a2enmod ssl
-    notify  => Service[apache2]
-    require => Package[apache2]

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_aux command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_aux
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f7dfe9e2cd77303dfae7ae11c5c56d90" --timeout 10 --check-command "check_check_certificate_expiry_aux"

File[/etc/ferm/conf.d/98_log-everything]

Parameters differences:

--- File[/etc/ferm/conf.d/98_log-everything].orig
+++ File[/etc/ferm/conf.d/98_log-everything]

-    tag     => ferm
-    notify  => Service[ferm]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0400
-    require => File[/etc/ferm/conf.d]

Content differences:

--- /etc/ferm/conf.d/98_log-everything.orig
+++ /etc/ferm/conf.d/98_log-everything
@@ -1,11 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 98_log-everything: 
-
-domain (ip ip6) {
-	table filter {
-		chain INPUT {
-			NFLOG mod limit limit 1/second limit-burst 5 nflog-prefix "[fw-in-drop]";
-		}
-	}
-}

Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => kafka
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-kafka]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@kafka]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft
@@ -0,0 +1,38 @@
+# Autogenerated by puppet
+set ANALYTICS_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2620:0:861:100::/64,
+             2620:0:861:104::/64,
+             2620:0:861:105::/64,
+             2620:0:861:106::/64,
+             2620:0:861:108::/64,
+             2620:0:861:110::/64,
+             2620:0:861:111::/64,
+             2620:0:861:112::/64,
+             2620:0:861:114::/64,
+             2620:0:861:115::/64,
+             2620:0:861:116::/64,
+             2620:0:861:117::/64,
+             2620:0:861:11a::/64,
+             2620:0:861:121::/64,
+             2620:0:861:123::/64,
+             2620:0:861:125::/64,
+             2620:0:861:127::/64,
+             2620:0:861:129::/64,
+             2620:0:861:12b::/64,
+             2620:0:861:12d::/64,
+             2620:0:861:12f::/64,
+             2620:0:861:132::/64,
+             2620:0:861:134::/64,
+             2620:0:861:136::/64,
+             2620:0:861:138::/64,
+             2620:0:861:13a::/64,
+             2620:0:861:13c::/64,
+             2620:0:861:13e::/64,
+             2620:0:861:141::/64,
+             2620:0:861:143::/64,
+             2620:0:861:145::/64
+    }
+}

Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-discovery2026-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_staging_front_proxy-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status].orig
+++ Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_dse_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/signers/etcd]

Parameters differences:

--- File[/etc/cfssl/signers/etcd].orig
+++ File[/etc/cfssl/signers/etcd]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Cfssl::Ocsp[network_devices]

Parameters differences:

--- Cfssl::Ocsp[network_devices].orig
+++ Cfssl::Ocsp[network_devices]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20063
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/nftables/notrack]

Parameters differences:

--- File[/etc/nftables/notrack].orig
+++ File[/etc/nftables/notrack]

+    recurse => True
+    purge   => True
+    owner   => root
+    group   => root
+    ensure  => directory

Cfssl::Ocsp[mlserve_staging_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[mlserve_staging_front_proxy].orig
+++ Cfssl::Ocsp[mlserve_staging_front_proxy]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20041
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Systemd::Service[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_apache-htcacheclean].orig
+++ Systemd::Service[wmf_auto_restart_apache-htcacheclean]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/ocsp/kafka.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/kafka.ocsp].orig
+++ File[/etc/cfssl/ocsp/kafka.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Exec[Generate initial CRL for aux]

Parameters differences:

--- Exec[Generate initial CRL for aux].orig
+++ Exec[Generate initial CRL for aux]

-    creates => /srv/cfssl/crl/aux
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/aux/ca/aux.pem /etc/cfssl/signers/aux/ca/aux-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/aux
-    require => ['Package[golang-cfssl]']

Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging_front_proxy' mlserve_staging_front_proxy 
-    description               => OCSP Refresh job - mlserve_staging_front_proxy
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]

-    group  => root
-    ensure => absent
-    owner  => root

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-wikikube_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom

Profile::Auto_restarts::Service[ulogd2]

Parameters differences:

--- Profile::Auto_restarts::Service[ulogd2].orig
+++ Profile::Auto_restarts::Service[ulogd2]

-    ensure => present

File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft
@@ -0,0 +1,9 @@
+# Autogenerated by puppet
+set WIKIKUBE_KUBEPODS_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 10.67.128.0/17,
+             10.194.128.0/17
+    }
+}

Systemd::Timer::Job[cfssl-ocsprefresh-dse]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-dse].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-dse]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse/ca/dse.pem --responses-file /etc/cfssl/ocsp/dse.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse' dse 
-    description               => OCSP Refresh job - dse
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Nftables::Set[CUMIN_MASTERS]

Parameters differences:

--- Nftables::Set[CUMIN_MASTERS].orig
+++ Nftables::Set[CUMIN_MASTERS]

+    hosts  => ['10.64.16.154', '2620:0:861:102:10:64:16:154', '10.192.32.49', '2620:0:860:103:10:192:32:49']
+    ensure => present

File[/usr/local/bin/apache-status]

Parameters differences:

--- File[/usr/local/bin/apache-status].orig
+++ File[/usr/local/bin/apache-status]

-    mode   => 0555
-    group  => root
-    source => puppet:///modules/httpd/apache-status
-    owner  => root

Nrpe::Monitor_service[check_certificate_expiry_etcd]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_etcd].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_etcd]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: etcd
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Cfssl::Signer[aux]

Parameters differences:

--- Cfssl::Signer[aux].orig
+++ Cfssl::Signer[aux]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/aux/ca/aux.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/aux
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/aux
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/aux/ca/aux-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

File[/etc/cfssl/signers/mlserve/ca]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve/ca].orig
+++ File[/etc/cfssl/signers/mlserve/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/dse_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/dse_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/dse_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/dse_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Logrotate::Conf[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-debmonitor].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-debmonitor]

-    ensure => present

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem

Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    ensure => present

Systemd::Timer::Job[wmf_auto_restart_ulogd2]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_ulogd2].orig
+++ Systemd::Timer::Job[wmf_auto_restart_ulogd2]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    require                   => File[/usr/local/sbin/wmf-auto-restart]
-    success_exit_status       => []
-    command                   => /usr/local/sbin/wmf-auto-restart -s ulogd2
-    description               => Auto restart job: ulogd2
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 5:37:00'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

Parameters differences:

--- Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods].orig
+++ Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

-    src_sets            => ['WIKIKUBE_KUBEPODS_NETWORKS', 'STAGING_KUBEPODS_NETWORKS', 'MLSERVE_KUBEPODS_NETWORKS', 'MLSTAGE_KUBEPODS_NETWORKS', 'DSE_KUBEPODS_NETWORKS', 'AUX_KUBEPODS_NETWORKS']
-    unrestricted_access => False
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    ensure              => present
-    port                => 8443

File[/etc/apache2/conf-available]

Parameters differences:

--- File[/etc/apache2/conf-available].orig
+++ File[/etc/apache2/conf-available]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0755
-    require => Package[apache2]

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_debmonitor" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Cfssl::Signer[etcd]

Parameters differences:

--- Cfssl::Signer[etcd].orig
+++ Cfssl::Signer[etcd]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/etcd/ca/etcd.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/etcd
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/etcd
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/etcd/ca/etcd-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => ##### FAKE FOR PUPPET ######

Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

-    unit              => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_discovery2026 command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_discovery2026
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bf2e3510cb63e5f05f545e816bab4edf" --timeout 10 --check-command "check_check_certificate_expiry_discovery2026"

Ferm::Conf[defs]

Parameters differences:

--- Ferm::Conf[defs].orig
+++ Ferm::Conf[defs]

-    prio   => 00
-    ensure => present

File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Cfssl::Config[dse]

Parameters differences:

--- Cfssl::Config[dse].orig
+++ Cfssl::Config[dse]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/dse
-    path                => /etc/cfssl/signers/dse/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/dse

File[/etc/cfssl/signers/etcd/ca]

Parameters differences:

--- File[/etc/cfssl/signers/etcd/ca].orig
+++ File[/etc/cfssl/signers/etcd/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_wikikube_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_front_proxy!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Systemd::Unit[cfssl-ocspserve@etcd]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@etcd].orig
+++ Systemd::Unit[cfssl-ocspserve@etcd]

-    unit              => cfssl-ocspserve@etcd
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@wikikube]']

Systemd::Unit[cfssl-ocspserve@network_devices]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@network_devices].orig
+++ Systemd::Unit[cfssl-ocspserve@network_devices]

-    unit              => cfssl-ocspserve@network_devices
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Class[Profile::Monitoring]

Parameters differences:

--- Class[Profile::Monitoring].orig
+++ Class[Profile::Monitoring]

@@
-    nagios_group          => pki_eqiad
+    nagios_group          => insetup_eqiad
@@
-    cluster               => pki
+    cluster               => insetup
@@
-    notifications_enabled => True
+    notifications_enabled => False

File[/etc/ferm/functions.conf]

Parameters differences:

--- File[/etc/ferm/functions.conf].orig
+++ File[/etc/ferm/functions.conf]

-    notify  => Service[ferm]
-    owner   => root
-    ensure  => file
-    source  => puppet:///modules/ferm/functions.conf
-    group   => root
-    mode    => 0400
-    require => Package[ferm]

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "e515778a769f523fb98a7f642670e011" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging_front_proxy"

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Logrotate::Conf[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-zuul].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-zuul]

-    ensure => present

Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]

-    ensure => present

Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    ensure    => present
-    sudo_user => root

File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
@@ -1 +0,0 @@
-test

Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-mlserve" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_cfssl-multirootca_status]=/usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca

Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    ensure => present

Httpd::Conf[defaults]

Parameters differences:

--- Httpd::Conf[defaults].orig
+++ Httpd::Conf[defaults]

-    priority  => 0
-    conf_type => conf
-    source    => puppet:///modules/httpd/defaults.conf
-    ensure    => present

Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@mlserve_front_proxy]']

File[/etc/nftables/postrouting]

Parameters differences:

--- File[/etc/nftables/postrouting].orig
+++ File[/etc/nftables/postrouting]

+    recurse => True
+    purge   => True
+    owner   => root
+    group   => root
+    ensure  => directory

Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set DEPLOYMENT_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:102:10:64:16:93,
+             2620:0:860:103:10:192:32:7
+    }
+}

Systemd::Service[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-wikikube].orig
+++ Systemd::Service[cfssl-ocsprefresh-wikikube]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[Generate initial CRL for debmonitor]

Parameters differences:

--- Exec[Generate initial CRL for debmonitor].orig
+++ Exec[Generate initial CRL for debmonitor]

-    creates => /srv/cfssl/crl/debmonitor
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/debmonitor/ca/debmonitor.pem /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/debmonitor
-    require => ['Package[golang-cfssl]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_cassandra" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_syslog]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca].orig
+++ Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_cloud_wmnet_ca!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_aux.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/etc/cfssl/signers/dse/ca/dse.pem]

Parameters differences:

--- File[/etc/cfssl/signers/dse/ca/dse.pem].orig
+++ File[/etc/cfssl/signers/dse/ca/dse.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/dse/ca/dse.pem.orig
+++ /etc/cfssl/signers/dse/ca/dse.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
-rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
-apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
-Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
-/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
-wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
-BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
-bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
-oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
-bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
-JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
-Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
-pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
------END CERTIFICATE-----

Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: puppet_rsa
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__puppet_rsa
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="c1b324b3d8ac107f8d7483b4017f5edf",check_name="check_check_certificate_expiry_puppet_rsa", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: puppet_rsa
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_puppet_rsa))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_staging
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "7cff186656c3cabbca85b5b57d0c8679" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging"

Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => mlserve
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@mlserve]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Service[cfssl-ocspserve@mlserve_staging_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@mlserve_staging_front_proxy].orig
+++ Service[cfssl-ocspserve@mlserve_staging_front_proxy]

-    enable => True
-    ensure => running

Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Cfssl::Signer[network_devices]

Parameters differences:

--- Cfssl::Signer[network_devices].orig
+++ Cfssl::Signer[network_devices]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 8760h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/network_devices
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/network_devices
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/network_devices/ca/network_devices-key.pem
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => fake key

Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]

Parameters differences:

--- Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)].orig
+++ Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]

Parameters differences:

--- Exec[renew certificate - puppet_rsa__pki_discovery_wmnet].orig
+++ Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]

-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet

-    notify      => ['Service[apache2]']
-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert puppet_rsa__pki_discovery_wmnet]

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_syslog" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_staging
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f389c556cebfcfc345b3d6802f320045" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging"

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Service[cfssl-ocspserve@discovery]

Parameters differences:

--- Service[cfssl-ocspserve@discovery].orig
+++ Service[cfssl-ocspserve@discovery]

-    enable => True
-    ensure => running

File[/etc/cfssl/signers/kafka/ca]

Parameters differences:

--- File[/etc/cfssl/signers/kafka/ca].orig
+++ File[/etc/cfssl/signers/kafka/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/cfssl/signers/cassandra]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra].orig
+++ File[/etc/cfssl/signers/cassandra]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Httpd::Site[pki.discovery.wmnet]

Parameters differences:

--- Httpd::Site[pki.discovery.wmnet].orig
+++ Httpd::Site[pki.discovery.wmnet]

-    priority => 50
-    ensure   => present

Profile::Pki::Multirootca::Monitoring[debmonitor]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[debmonitor].orig
+++ Profile::Pki::Multirootca::Monitoring[debmonitor]

-    ca_file      => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => debmonitor

File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Rsyslog::Conf[prometheus-node-textfile-check-nft]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-check-nft].orig
+++ Rsyslog::Conf[prometheus-node-textfile-check-nft]

+    priority => 40
+    mode     => 0444
+    ensure   => present
+    require  => File[/var/log/prometheus-node-textfile-check-nft]

File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-zuul-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-mlserve_staging
-
-/var/log/cfssl-ocsprefresh-mlserve_staging/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft].orig
+++ File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft.orig
+++ /etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft
@@ -0,0 +1,15 @@
+# Autogenerated by puppet
+set KAFKA_BROKERS_LOGGING_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:102:10:64:16:205,
+             2620:0:861:10c:10:64:133:11,
+             2620:0:861:13d:10:64:183:12,
+             2620:0:861:10a:10:64:131:13,
+             2620:0:861:10e:10:64:135:13,
+             2620:0:860:113:10:192:23:29,
+             2620:0:860:10c:10:192:11:28,
+             2620:0:860:105:10:192:26:22,
+             2620:0:860:10c:10:192:11:27,
+             2620:0:860:11e:10:192:39:25
+    }
+}

File[/etc/cfssl/signers/mlserve/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve/cfssl.conf].orig
+++ File[/etc/cfssl/signers/mlserve/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/mlserve/cfssl.conf.orig
+++ /etc/cfssl/signers/mlserve/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/mlserve",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]

File[/srv/cfssl/bundles/debmonitor.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/debmonitor.pem].orig
+++ File[/srv/cfssl/bundles/debmonitor.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/debmonitor.pem.orig
+++ /srv/cfssl/bundles/debmonitor.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
-AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
-M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
-WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
-BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
-TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
-EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
-dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
-HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
-bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
-XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
-y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
-EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
------END CERTIFICATE-----

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_network_devices.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem

Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_apache-htcacheclean].orig
+++ Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => absent

Exec[Generate initial CRL for puppet_rsa]

Parameters differences:

--- Exec[Generate initial CRL for puppet_rsa].orig
+++ Exec[Generate initial CRL for puppet_rsa]

-    creates => /srv/cfssl/crl/puppet_rsa
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/puppet_rsa
-    require => ['Package[golang-cfssl]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]

-    unit              => cfssl-ocsprefresh-wikikube_staging.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Timer[nrpe2nodexp-ferm_active]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-ferm_active].orig
+++ Systemd::Timer[nrpe2nodexp-ferm_active]

-    accuracy           => 15sec
-    splay              => 600
-    unit_name          => nrpe2nodexp-ferm_active.service
-    ensure             => present
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '10min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
@@ -1 +0,0 @@
-nosecret

Systemd::Service[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-syslog].orig
+++ Systemd::Service[cfssl-ocsprefresh-syslog]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-syslog.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Cfssl::Ocsp[mlserve_staging]

Parameters differences:

--- Cfssl::Ocsp[mlserve_staging].orig
+++ Cfssl::Ocsp[mlserve_staging]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20040
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Cfssl::Signer[dse_front_proxy]

Parameters differences:

--- Cfssl::Signer[dse_front_proxy].orig
+++ Cfssl::Signer[dse_front_proxy]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
+Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/dse_front_proxy
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/dse_front_proxy
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   =>

Alternatives::Select[ip6tables]

Parameters differences:

--- Alternatives::Select[ip6tables].orig
+++ Alternatives::Select[ip6tables]

-    path    => /usr/sbin/ip6tables-legacy
-    require => Package[iptables]

Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

File[/etc/cfssl/db.conf]

Parameters differences:

--- File[/etc/cfssl/db.conf].orig
+++ File[/etc/cfssl/db.conf]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    ensure    => file
-    group     => root
-    mode      => 0440
-    require   => ['Package[golang-cfssl]']

Content differences:

--- /etc/cfssl/db.conf.orig
+++ /etc/cfssl/db.conf
@@ -1 +0,0 @@
-{"driver":"mysql","data_source":"pki:changeme@tcp(m1-master.eqiad.wmnet:3306)/pki?parseTime=true&tls=skip-verify"}

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "4d759acaf0fd7dd3abaa03dc4565aef6" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_front_proxy"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_front_proxy command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]

-    notification_period    => 24x7
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    servicegroups          => pki_eqiad
-    notifications_enabled  => 1
-    check_interval         => 1
-    max_check_attempts     => 3
-    retry_interval         => 1
-    contact_groups         => admins
-    active_checks_enabled  => 1
-    passive_checks_enabled => 1
-    check_period           => 24x7
-    is_volatile            => 0
-    notification_interval  => 0
-    check_command          => nrpe_check!check_check_certificate_expiry_dse!10
-    host_name              => pki1001
-    service_description    => Check to ensure the signer certificate is valid CA: dse
-    notification_options   => c,r,f
-    ensure                 => present
-    check_freshness        => 0

Nftables::Set[MGMT_NETWORKS]

Parameters differences:

--- Nftables::Set[MGMT_NETWORKS].orig
+++ Nftables::Set[MGMT_NETWORKS]

+    hosts  => ['10.65.0.0/16', '10.128.128.0/17', '10.193.0.0/16', '10.80.128.0/17', '10.132.128.0/17', '10.136.128.0/17', '10.140.128.0/17']
+    ensure => present

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_puppet_rsa" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/etc/cfssl/ocsp/discovery.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/discovery.ocsp].orig
+++ File[/etc/cfssl/ocsp/discovery.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_discovery2026
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bf2e3510cb63e5f05f545e816bab4edf" --timeout 10 --check-command "check_check_certificate_expiry_discovery2026"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_discovery2026 command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => absent

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

-    unit              => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/etc/cfssl/signers/aux_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/aux_front_proxy/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/var/log/cfssl-ocsprefresh-dse]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-dse].orig
+++ File[/var/log/cfssl-ocsprefresh-dse]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nftables::Service[ssh-from-bastion]

Parameters differences:

--- Nftables::Service[ssh-from-bastion].orig
+++ Nftables::Service[ssh-from-bastion]

+    unrestricted_access => False
+    prio                => 10
+    desc                => 
+    proto               => tcp
+    src_ips             => ['103.102.166.103', '185.15.58.6', '185.15.59.99', '195.200.68.99', '198.35.26.104', '2001:df2:e500:3:103:102:166:103', '208.80.153.110', '208.80.154.7', '2620:0:860:4:208:80:153:110', '2620:0:861:1:208:80:154:7', '2620:0:863:3:198:35:26:104', '2a02:ec80:300:3:185:15:59:99', '2a02:ec80:600:1:185:15:58:6', '2a02:ec80:700:3:195:200:68:99']
+    notrack             => False
+    ensure              => present
+    port                => 22

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-apache2.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-apache2.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "wmf_auto_restart_apache2" then {
-    action(
-        type="omfile" file="/var/log/wmf_auto_restart_apache2/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-dse_front_proxy-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/lib/systemd/system/cfssl-ocspserve@discovery.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@discovery.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@discovery.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@discovery.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@discovery.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (discovery)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10002 \
-          -responses /etc/cfssl/ocsp/discovery.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/signers/wikikube/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube/cfssl.conf].orig
+++ File[/etc/cfssl/signers/wikikube/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/wikikube/cfssl.conf.orig
+++ /etc/cfssl/signers/wikikube/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/wikikube",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/cfssl/signers/cassandra/ca]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra/ca].orig
+++ File[/etc/cfssl/signers/cassandra/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/cfssl/ocsp/cassandra.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/cassandra.ocsp].orig
+++ File[/etc/cfssl/ocsp/cassandra.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-discovery2026].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-discovery2026]

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Unit[cfssl-ocspserve@puppet_rsa]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@puppet_rsa].orig
+++ Systemd::Unit[cfssl-ocspserve@puppet_rsa]

-    unit              => cfssl-ocspserve@puppet_rsa
-    override          => False
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/var/log/cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-discovery2026].orig
+++ File[/var/log/cfssl-ocsprefresh-discovery2026]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

File[/etc/cfssl/signers/network_devices/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices/cfssl.conf].orig
+++ File[/etc/cfssl/signers/network_devices/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/network_devices/cfssl.conf.orig
+++ /etc/cfssl/signers/network_devices/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "8760h",
-      "crl_url": "http://pki.discovery.wmnet/crl/network_devices",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/network_devices"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

Service[cfssl-multirootca]

Parameters differences:

--- Service[cfssl-multirootca].orig
+++ Service[cfssl-multirootca]

-    enable => True
-    ensure => running

Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_kafka.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_kafka.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Package[iptables]

Parameters differences:

--- Package[iptables].orig
+++ Package[iptables]

@@
-    ensure => installed
+    ensure => absent

Cfssl::Config[wikikube_staging]

Parameters differences:

--- Cfssl::Config[wikikube_staging].orig
+++ Cfssl::Config[wikikube_staging]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_staging
-    path                => /etc/cfssl/signers/wikikube_staging/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 72h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_staging

Cfssl::Config[wikikube_staging_front_proxy]

Parameters differences:

--- Cfssl::Config[wikikube_staging_front_proxy].orig
+++ Cfssl::Config[wikikube_staging_front_proxy]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy
-    path                => /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 72h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_discovery.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_discovery.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    ensure => present

Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_staging_front_proxy
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="b194b5b9b6c9d6e05b9eed8dcfcc40cf",check_name="check_check_certificate_expiry_mlserve_staging_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_staging_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-zuul.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-zuul.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - zuul
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/zuul/ca/zuul.pem --responses-file /etc/cfssl/ocsp/zuul.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@zuul' zuul

Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    ensure => present

Systemd::Timer[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-debmonitor].orig
+++ Systemd::Timer[cfssl-ocsprefresh-debmonitor]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-debmonitor.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MONITORING_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/MONITORING_HOSTS_ipv6.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set MONITORING_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:3:208:80:154:78,
+             2620:0:860:2:208:80:153:42
+    }
+}

File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem].orig
+++ File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem.orig
+++ /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######

Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]

-    unit              => cfssl-ocsprefresh-wikikube_front_proxy.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"mlserve_staging_front_proxy"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-wikikube_staging].orig
+++ Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-wikikube_staging.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Service[cfssl-ocspserve@discovery2026]

Parameters differences:

--- Service[cfssl-ocspserve@discovery2026].orig
+++ Service[cfssl-ocspserve@discovery2026]

-    enable => True
-    ensure => running

File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-cloud_wmnet_ca
-
-/var/log/cfssl-ocsprefresh-cloud_wmnet_ca/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "9d6dd05c8e5e1bb294462d932b24bd1a" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_front_proxy"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_front_proxy command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

File[/etc/cfssl/signers/puppet_rsa/ca]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa/ca].orig
+++ File[/etc/cfssl/signers/puppet_rsa/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@mlserve.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@mlserve.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@mlserve.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (mlserve)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20030 \
-          -responses /etc/cfssl/ocsp/mlserve.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

Systemd::Unit[prometheus-node-textfile-check-nft.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-check-nft.service].orig
+++ Systemd::Unit[prometheus-node-textfile-check-nft.service]

+    unit              => prometheus-node-textfile-check-nft.service
+    override          => False
+    ensure            => present
+    restart           => False
+    override_filename => puppet-override.conf
+    require           => ['Class[Systemd]']

Service[cfssl-ocsprefresh-cassandra.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-cassandra.timer].orig
+++ Service[cfssl-ocsprefresh-cassandra.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Prometheus::Blackbox::Check::Http[PKI_wikikube]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_wikikube].orig
+++ Prometheus::Blackbox::Check::Http[PKI_wikikube]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"wikikube"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - cloud_wmnet_ca
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --responses-file /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cloud_wmnet_ca' cloud_wmnet_ca

Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Systemd::Service[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-cassandra].orig
+++ Systemd::Service[cfssl-ocsprefresh-cassandra]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-cassandra.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Unit[nftables]

Parameters differences:

--- Systemd::Unit[nftables].orig
+++ Systemd::Unit[nftables]

+    unit              => nftables
+    override          => True
+    ensure            => present
+    restart           => False
+    override_filename => puppet-override.conf
+    require           => ['Class[Systemd]']

File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    ensure => present

Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]

-    unit              => nrpe2nodexp-check_cfssl-multirootca_status.service
-    override          => False
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: dse_front_proxy
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Monitoring::Service[check_cfssl-multirootca_status]

Parameters differences:

--- Monitoring::Service[check_cfssl-multirootca_status].orig
+++ Monitoring::Service[check_cfssl-multirootca_status]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI
-    check_command  => nrpe_check!check_check_cfssl-multirootca_status!10
-    critical       => True
-    description    => Check unit status of cfssl-multirootca
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 2
-    check_interval => 10
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem

File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@discovery2026.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@discovery2026.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (discovery2026)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10010 \
-          -responses /etc/cfssl/ocsp/discovery2026.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]

-    recurse => True
-    owner   => root
-    group   => root
-    mode    => 0740
-    ensure  => directory

File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem].orig
+++ File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]

-    show_diff => False
-    notify    => Service[cfssl-multirootca]
-    owner     => root
-    group     => root
-    mode      => 0400
-    ensure    => file

Content differences:

--- /etc/cfssl/signers/wikikube/ca/wikikube-key.pem.orig
+++ /etc/cfssl/signers/wikikube/ca/wikikube-key.pem
@@ -1 +0,0 @@
-test

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_syslog command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_syslog
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "e3b9b989d5062ce2d267023dfe42fcd8" --timeout 10 --check-command "check_check_certificate_expiry_syslog"

Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]

Parameters differences:

--- Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port].orig
+++ Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]

-    priority  => 50
-    conf_type => conf
-    ensure    => present

Systemd::Service[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-debmonitor].orig
+++ Systemd::Service[cfssl-ocsprefresh-debmonitor]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/MONITORING_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/MONITORING_HOSTS_ipv4.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set MONITORING_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 208.80.154.78,
+             208.80.153.42
+    }
+}

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-zuul-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Monitoring::Service[check_certificate_expiry_debmonitor]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_debmonitor].orig
+++ Monitoring::Service[check_certificate_expiry_debmonitor]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_debmonitor!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: debmonitor
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-mlserve_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom

File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-debmonitor.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-debmonitor.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Nrpe::Check[check_check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_mlserve_staging].orig
+++ Nrpe::Check[check_check_certificate_expiry_mlserve_staging]

-    before    => Monitoring::Service[check_certificate_expiry_mlserve_staging]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    ensure    => present
-    sudo_user => root

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-wikikube_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-wikikube_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"dse_front_proxy"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

-    unit              => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/var/log/wmf_auto_restart_ulogd2]

Parameters differences:

--- File[/var/log/wmf_auto_restart_ulogd2].orig
+++ File[/var/log/wmf_auto_restart_ulogd2]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Cfssl::Config[mlserve]

Parameters differences:

--- Cfssl::Config[mlserve].orig
+++ Cfssl::Config[mlserve]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve
-    path                => /etc/cfssl/signers/mlserve/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve

File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@cassandra.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@cassandra.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@cassandra.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (cassandra)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10006 \
-          -responses /etc/cfssl/ocsp/cassandra.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9].orig
+++ Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check unit status of cfssl-multirootca #page
-    alert_name         => nrpe_Check_unit_status_of_cfssl_multirootca
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="52832284a5fb8b8ea6f55bb6271912c9",check_name="check_check_cfssl-multirootca_status", status="CRITICAL", severity="page"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check unit status of cfssl-multirootca
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_cfssl-multirootca_status))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI
-    instance           => ops
-    ensure             => absent
-    for                => 11m

Rsyslog::Conf[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-etcd].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-etcd]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-etcd]

Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

Service[cfssl-ocsprefresh-discovery.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-discovery.timer].orig
+++ Service[cfssl-ocsprefresh-discovery.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Service[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-etcd].orig
+++ Systemd::Service[cfssl-ocsprefresh-etcd]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-etcd.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

Systemd::Service[cfssl-ocspserve@discovery2026]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@discovery2026].orig
+++ Systemd::Service[cfssl-ocspserve@discovery2026]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/var/log/wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- File[/var/log/wmf_auto_restart_apache-htcacheclean].orig
+++ File[/var/log/wmf_auto_restart_apache-htcacheclean]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => absent

Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Cfssl::Signer[zuul]

Parameters differences:

--- Cfssl::Signer[zuul].orig
+++ Cfssl::Signer[zuul]

-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
-----END CERTIFICATE-----

-    ca_file          => /etc/cfssl/signers/zuul/ca/zuul.pem
-    listen_addr      => pki1001.eqiad.wmnet
-    listen_port      => 8888
-    manage_db        => False
-    manage_services  => False
-    db_user          => cfssl
-    db_pass          => changeme
-    serve_service    => cfssl-multirootca
-    default_expiry   => 672h
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    db_driver        => sqlite3
-    default_crl_url  => http://pki.discovery.wmnet/crl/zuul
-    log_level        => info
-    db_name          => cfssl
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/zuul
-    db_conf_file     => /etc/cfssl/db.conf
-    ca_key_file      => /etc/cfssl/signers/zuul/ca/zuul-key.pem
-    default_usages   => ['server auth', 'client auth']
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    serve_ensure     => absent
-    db_host          => localhost
-    default_auth_key => default_auth
-    ca_key_content   => nosecret

Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => debmonitor
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@debmonitor]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]

-    user                      => nagios
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_discovery
-    splay                     => 60
-    send_mail                 => False
-    group                     => prometheus-node-exporter
-    success_exit_status       => []
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "38e4dbcfd07ed60daf5bb89397abbe29" --timeout 10 --check-command "check_check_certificate_expiry_discovery"
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_discovery command.
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    logging_enabled           => False
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => True
-    ignore_errors             => True
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => absent

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Cfssl::Ocsp[aux_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[aux_front_proxy].orig
+++ Cfssl::Ocsp[aux_front_proxy]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20051
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Logrotate::Conf[wmf_auto_restart_ulogd2]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_ulogd2].orig
+++ Logrotate::Conf[wmf_auto_restart_ulogd2]

-    ensure => present

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-wikikube.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-wikikube.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@aux]']

Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

-    unit              => cfssl-ocsprefresh-mlserve_staging_front_proxy.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_cfssl-multirootca_status.service
-
-[Timer]
-Unit=nrpe2nodexp-check_cfssl-multirootca_status.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=5min
-OnActiveSec=1s
-RandomizedDelaySec=300
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]

+    before      => ['Service[prometheus-node-textfile-check-nft.timer]']
+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Cfssl::Config[cassandra]

Parameters differences:

--- Cfssl::Config[cassandra].orig
+++ Cfssl::Config[cassandra]

-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/cassandra
-    path                => /etc/cfssl/signers/cassandra/cfssl.conf
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    remotes             => {}
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    notify              => Service[cfssl-multirootca]
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    ensure              => present
-    default_crl_url     => http://pki.discovery.wmnet/crl/cassandra

Cfssl::Ocsp[wikikube_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[wikikube_front_proxy].orig
+++ Cfssl::Ocsp[wikikube_front_proxy]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 20011
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@mlserve_staging]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set DEPLOYMENT_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.16.93,
+             10.192.32.7
+    }
+}

Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-ocspserve@discovery2026]']

Service[cfssl-ocspserve@wikikube_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@wikikube_front_proxy].orig
+++ Service[cfssl-ocspserve@wikikube_front_proxy]

-    enable => True
-    ensure => running

Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

-    ensure      => present
-    hosts       => []
-    names       => []
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]

-    ensure => present

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-discovery2026.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-discovery2026.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Firewall::Service[multirootca tls termination]

Parameters differences:

--- Firewall::Service[multirootca tls termination].orig
+++ Firewall::Service[multirootca tls termination]

-    src_sets            => ['DOMAIN_NETWORKS']
-    unrestricted_access => False
-    prio                => 10
-    desc                => 
-    proto               => tcp
-    notrack             => False
-    ensure              => present
-    port                => 443

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]

-    group  => root
-    ensure => absent
-    owner  => root

Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]

-    ensure => present

Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

Class[Profile::Base::Production]

Parameters differences:

--- Class[Profile::Base::Production].orig
+++ Class[Profile::Base::Production]

@@
-    role_description => PKI server
+    role_description => Host being setup by Infrastructure Foundations SREs with ntables

Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]

-    before      => ['Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]']
-    enable   => False
-    ensure   => stopped
-    provider => systemd

Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

Cfssl::Ocsp[zuul]

Parameters differences:

--- Cfssl::Ocsp[zuul].orig
+++ Cfssl::Ocsp[zuul]

-    db_conf_file       => /etc/cfssl/db.conf
-    ca_file            => /etc/cfssl/signers/zuul/ca/zuul.pem
-    listen_addr        => 127.0.0.1
-    listen_port        => 10009
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    ocsprefresh_update => True
-    log_level          => info
-    db_driver          => mysql
-    refresh_interval   => 96h

Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => discovery
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@discovery]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/etc/sudoers.d/nrpe_certificate_check_kafka]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_kafka].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_kafka]

-    group  => root
-    ensure => absent
-    owner  => root

File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-aux.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-aux.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-aux.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - aux
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux/ca/aux.pem --responses-file /etc/cfssl/ocsp/aux.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux' aux

File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Package[links]

Parameters differences:

--- Package[links].orig
+++ Package[links]

-    ensure   => installed
-    provider => apt

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

-    validate_cmd => /usr/sbin/visudo -cqf %
-    owner        => root
-    ensure       => present
-    group        => root
-    mode         => 0440
-    require      => Package[nagios-nrpe-server]

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-etcd" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-etcd/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/aux_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/aux_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/aux_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/aux_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]

-    dashboard          => TODO
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_staging_front_proxy
-    severity           => info
-    group              => nrpechecks
-    team               => observability
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="e515778a769f523fb98a7f642670e011",check_name="check_check_certificate_expiry_wikikube_staging_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    def_label_whitelst => ['team', 'severity']
-    site               => eqiad
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_staging_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    instance           => ops
-    ensure             => absent
-    for                => 3m

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_zuul command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_zuul
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "373325faaa689f3e9b058d91d4eb6cdb" --timeout 10 --check-command "check_check_certificate_expiry_zuul"

File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra/ca/cassandra.pem].orig
+++ File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/cassandra/ca/cassandra.pem.orig
+++ /etc/cfssl/signers/cassandra/ca/cassandra.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
-BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
-zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
-CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
-eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
-NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
-BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
-ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
-+EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
-D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
-B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
------END CERTIFICATE-----

Exec[Generate initial CRL for kafka]

Parameters differences:

--- Exec[Generate initial CRL for kafka].orig
+++ Exec[Generate initial CRL for kafka]

-    creates => /srv/cfssl/crl/kafka
-    path    => ['/usr/bin']
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/kafka/ca/kafka.pem /etc/cfssl/signers/kafka/ca/kafka-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/kafka
-    require => ['Package[golang-cfssl]']

File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-etcd-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-syslog-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-mlserve_front_proxy
-
-/var/log/cfssl-ocsprefresh-mlserve_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[prometheus-node-textfile-check-nft.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-check-nft.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-check-nft.timer]

+    unit              => prometheus-node-textfile-check-nft.timer
+    override          => False
+    ensure            => present
+    restart           => False
+    override_filename => puppet-override.conf
+    require           => ['Class[Systemd]']

Nrpe::Check[check_check_certificate_expiry_discovery]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_discovery].orig
+++ Nrpe::Check[check_check_certificate_expiry_discovery]

-    before    => Monitoring::Service[check_certificate_expiry_discovery]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem
-    ensure    => present
-    sudo_user => root

File[/etc/cfssl/signers/wikikube_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)].orig
+++ Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    notify      => ['Service[cfssl-multirootca]']

Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem -checkend 952200
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet

-    require     => Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-network_devices.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]

-    unit              => cfssl-ocsprefresh-network_devices.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Nrpe::Monitor_service[check_certificate_expiry_wikikube]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_wikikube].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_wikikube]

-    contact_group               => admins
-    sudo_user                   => root
-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: wikikube
-    retries                     => 3
-    check_interval              => 1
-    migration_task              => T350694
-    retry_interval              => 1
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    alertmanager_team           => observability
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    timeout                     => 10
-    ensure                      => present

Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet

-    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Systemd::Unit[cfssl-ocsprefresh-kafka.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-kafka.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-kafka.service]

-    unit              => cfssl-ocsprefresh-kafka.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Systemd::Service[cfssl-ocspserve@puppet_rsa]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@puppet_rsa].orig
+++ Systemd::Service[cfssl-ocspserve@puppet_rsa]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-wikikube_staging_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]

-    priority => 25
-    mode     => 0444
-    ensure   => absent

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_discovery]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Systemd::Unit[wmf_auto_restart_apache2.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_apache2.timer].orig
+++ Systemd::Unit[wmf_auto_restart_apache2.timer]

-    unit              => wmf_auto_restart_apache2.timer
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]

-    ca_file      => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => mlserve_staging_front_proxy

Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_etcd.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/var/log/cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-wikikube_staging].orig
+++ File[/var/log/cfssl-ocsprefresh-wikikube_staging]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => cfssl-ocsprefresh-mlserve_front_proxy.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

-    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
-    override          => False
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf
-    require           => ['Class[Systemd]']

File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]

-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-etcd.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-etcd.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-etcd.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-etcd.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0440
-    ensure => file

File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]

-    show_diff => False
-    owner     => root
-    group     => root
-    mode      => 0440
-    ensure    => present

Content differences:

--- /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "72h",
-      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Monitoring::Service[check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_aux_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_aux_front_proxy]

-    contact_group  => admins
-    host           => pki1001
-    passive        => False
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    check_command  => nrpe_check!check_check_certificate_expiry_aux_front_proxy!10
-    critical       => False
-    description    => Check to ensure the signer certificate is valid CA: aux_front_proxy
-    config_dir     => /etc/nagios
-    freshness      => 36000
-    retries        => 3
-    check_interval => 1
-    migration_task => T350694
-    ensure         => present
-    retry_interval => 1

File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/wikikube_staging_front_proxy.pem.orig
+++ /srv/cfssl/bundles/wikikube_staging_front_proxy.pem
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
-ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
-BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
-FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
-j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
-dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
-Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
-FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
-AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
-ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
-dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
-zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
-E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
-2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
-/3y5tw==
------END CERTIFICATE-----

Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    force_stop             => True
-    readable_by            => all
-    owner                  => root
-    base_dir               => /var/log
-    group                  => root
-    programname_comparison => startswith
-    log_filename           => syslog.log
-    ensure                 => present

File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => dse
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-dse]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@dse]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]

-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => absent

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_mlserve.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Exec[ensure_present_mod_proxy_http]

Parameters differences:

--- Exec[ensure_present_mod_proxy_http].orig
+++ Exec[ensure_present_mod_proxy_http]

-    creates => /etc/apache2/mods-enabled/proxy_http.load
-    command => /usr/sbin/a2enmod proxy_http
-    notify  => Service[apache2]
-    require => Package[apache2]

Httpd::Conf[pki.discovery.wmnet]

Parameters differences:

--- Httpd::Conf[pki.discovery.wmnet].orig
+++ Httpd::Conf[pki.discovery.wmnet]

-    priority  => 50
-    conf_type => sites
-    ensure    => present

File[/srv/cfssl/bundles/wikikube_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/wikikube_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/wikikube_front_proxy.pem]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/wikikube_front_proxy.pem.orig
+++ /srv/cfssl/bundles/wikikube_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
-gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
-AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
-hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
-92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
-raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
-A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
-G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
-Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
-b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
-ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
-ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
-hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
-0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
------END CERTIFICATE-----

File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]

-    notify => Service[cfssl-multirootca]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => file

Content differences:

--- /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem.orig
+++ /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
-ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
-BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
-FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
-j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
-dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
-Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
-FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
-AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
-ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
-dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
-zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
-E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
-2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
-/3y5tw==
------END CERTIFICATE-----

Prometheus::Blackbox::Check::Http[PKI_dse]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_dse].orig
+++ Prometheus::Blackbox::Check::Http[PKI_dse]

-    severity                => critical
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    alert_after             => 2m
-    body_regex_matches      => ['"success":true']
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ip4                     => 10.64.0.10
-    ip6                     => 2620:0:861:101:10:64:0:10
-    status_matches          => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    certificate_expiry_days => 10
-    force_tls               => False
-    team                    => sre
-    header_not_matches      => []
-    instance_label          => pki1001
-    method                  => POST
-    req_headers             => {}
-    prometheus_instance     => ops
-    body_raw                => {"label":"dse"}
-    header_matches          => []
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    site                    => eqiad
-    use_client_auth         => True
-    port                    => 443
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    follow_redirects        => False
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    path                    => /api/v1/cfssl/info
-    insecure_tls            => False
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    body_regex_not_matches  => []
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem

Rsyslog::Conf[nrpe2nodexp-ferm_active]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-ferm_active].orig
+++ Rsyslog::Conf[nrpe2nodexp-ferm_active]

-    priority => 25
-    mode     => 0444
-    ensure   => present

Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]

-    user           => root
-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    environment    => {}
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    run_cmd        => /usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom
-    extra_packages => []
-    interval       => daily
-    ensure         => present

File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-discovery2026.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-discovery2026
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-discovery2026
-
-/var/log/cfssl-ocsprefresh-discovery2026/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

-    owner  => root
-    group  => root
-    mode   => 0400
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/cfssl/ocsp/debmonitor.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/debmonitor.ocsp].orig
+++ File[/etc/cfssl/ocsp/debmonitor.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Systemd::Service[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-mlserve].orig
+++ Systemd::Service[cfssl-ocsprefresh-mlserve]

-    unit_type                => timer
-    monitoring_enabled       => False
-    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve.service]
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => False
-    migration_task           => T407130
-    ensure                   => present

File[/etc/ssl/localcerts/multiroot_ca.pem]

Parameters differences:

--- File[/etc/ssl/localcerts/multiroot_ca.pem].orig
+++ File[/etc/ssl/localcerts/multiroot_ca.pem]

-    notify => Service[apache2]
-    owner  => root
-    source => puppet:///modules/profile/pki/production/client_auth_CA.pem
-    group  => root
-    mode   => 0440
-    ensure => file

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Nrpe::Check[check_check_certificate_expiry_cassandra]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_cassandra].orig
+++ Nrpe::Check[check_check_certificate_expiry_cassandra]

-    before    => Monitoring::Service[check_certificate_expiry_cassandra]
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    ensure    => present
-    sudo_user => root

File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft].orig
+++ File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft.orig
+++ /etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft
@@ -0,0 +1,183 @@
+# Autogenerated by puppet
+set PRODUCTION_NETWORKS_ipv6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+    elements = { 2001:df2:e500:101::/64,
+             2001:df2:e500:103::/64,
+             2001:df2:e500:1::/64,
+             2001:df2:e500:3::/64,
+             2001:df2:e500:ed1a::/64,
+             2620:0:860:100::/64,
+             2620:0:860:101::/64,
+             2620:0:860:102::/64,
+             2620:0:860:103::/64,
+             2620:0:860:104::/64,
+             2620:0:860:105::/64,
+             2620:0:860:106::/64,
+             2620:0:860:107::/64,
+             2620:0:860:108::/64,
+             2620:0:860:109::/64,
+             2620:0:860:10a::/64,
+             2620:0:860:10b::/64,
+             2620:0:860:10c::/64,
+             2620:0:860:10d::/64,
+             2620:0:860:10e::/64,
+             2620:0:860:10f::/64,
+             2620:0:860:110::/64,
+             2620:0:860:111::/64,
+             2620:0:860:112::/64,
+             2620:0:860:113::/64,
+             2620:0:860:114::/64,
+             2620:0:860:115::/64,
+             2620:0:860:116::/64,
+             2620:0:860:118::/64,
+             2620:0:860:119::/64,
+             2620:0:860:11a::/64,
+             2620:0:860:11b::/64,
+             2620:0:860:11c::/64,
+             2620:0:860:11d::/64,
+             2620:0:860:11e::/64,
+             2620:0:860:11f::/64,
+             2620:0:860:120::/64,
+             2620:0:860:121::/64,
+             2620:0:860:122::/64,
+             2620:0:860:123::/64,
+             2620:0:860:124::/64,
+             2620:0:860:125::/64,
+             2620:0:860:126::/64,
+             2620:0:860:127::/64,
+             2620:0:860:12b::/64,
+             2620:0:860:12c::/64,
+             2620:0:860:12d::/64,
+             2620:0:860:12e::/64,
+             2620:0:860:140::/64,
+             2620:0:860:1::/64,
+             2620:0:860:2::/64,
+             2620:0:860:300::/64,
+             2620:0:860:301::/64,
+             2620:0:860:302::/64,
+             2620:0:860:303::/64,
+             2620:0:860:304::/64,
+             2620:0:860:305::/64,
+             2620:0:860:307::/64,
+             2620:0:860:308::/64,
+             2620:0:860:3::/64,
+             2620:0:860:4::/64,
+             2620:0:860:5::/64,
+             2620:0:860:babe::/64,
+             2620:0:860:babf::/64,
+             2620:0:860:cabe::/64,
+             2620:0:860:cabf::/64,
+             2620:0:860:ed1a::/64,
+             2620:0:861:100::/64,
+             2620:0:861:101::/64,
+             2620:0:861:102::/64,
+             2620:0:861:103::/64,
+             2620:0:861:104::/64,
+             2620:0:861:105::/64,
+             2620:0:861:106::/64,
+             2620:0:861:107::/64,
+             2620:0:861:108::/64,
+             2620:0:861:109::/64,
+             2620:0:861:10a::/64,
+             2620:0:861:10b::/64,
+             2620:0:861:10c::/64,
+             2620:0:861:10d::/64,
+             2620:0:861:10e::/64,
+             2620:0:861:10f::/64,
+             2620:0:861:110::/64,
+             2620:0:861:111::/64,
+             2620:0:861:112::/64,
+             2620:0:861:113::/64,
+             2620:0:861:114::/64,
+             2620:0:861:115::/64,
+             2620:0:861:116::/64,
+             2620:0:861:117::/64,
+             2620:0:861:118::/64,
+             2620:0:861:119::/64,
+             2620:0:861:11a::/64,
+             2620:0:861:11c::/64,
+             2620:0:861:11d::/64,
+             2620:0:861:11e::/64,
+             2620:0:861:11f::/64,
+             2620:0:861:120::/64,
+             2620:0:861:121::/64,
+             2620:0:861:122::/64,
+             2620:0:861:123::/64,
+             2620:0:861:124::/64,
+             2620:0:861:125::/64,
+             2620:0:861:126::/64,
+             2620:0:861:127::/64,
+             2620:0:861:128::/64,
+             2620:0:861:129::/64,
+             2620:0:861:12a::/64,
+             2620:0:861:12b::/64,
+             2620:0:861:12c::/64,
+             2620:0:861:12d::/64,
+             2620:0:861:12e::/64,
+             2620:0:861:12f::/64,
+             2620:0:861:131::/64,
+             2620:0:861:132::/64,
+             2620:0:861:133::/64,
+             2620:0:861:134::/64,
+             2620:0:861:135::/64,
+             2620:0:861:136::/64,
+             2620:0:861:137::/64,
+             2620:0:861:138::/64,
+             2620:0:861:139::/64,
+             2620:0:861:13a::/64,
+             2620:0:861:13b::/64,
+             2620:0:861:13c::/64,
+             2620:0:861:13d::/64,
+             2620:0:861:13e::/64,
+             2620:0:861:13f::/64,
+             2620:0:861:140::/64,
+             2620:0:861:141::/64,
+             2620:0:861:142::/64,
+             2620:0:861:143::/64,
+             2620:0:861:144::/64,
+             2620:0:861:145::/64,
+             2620:0:861:1::/64,
+             2620:0:861:2::/64,
+             2620:0:861:300::/64,
+             2620:0:861:301::/116,
+             2620:0:861:302::/64,
+             2620:0:861:303::/116,
+             2620:0:861:304::/116,
+             2620:0:861:305::/64,
+             2620:0:861:3::/64,
+             2620:0:861:4::/64,
+             2620:0:861:babe::/64,
+             2620:0:861:babf::/116,
+             2620:0:861:cabe::/64,
+             2620:0:861:cabf::/116,
+             2620:0:861:ed1a::/64,
+             2620:0:863:101::/64,
+             2620:0:863:102::/64,
+             2620:0:863:103::/64,
+             2620:0:863:1::/64,
+             2620:0:863:2::/64,
+             2620:0:863:3::/64,
+             2620:0:863:ed1a::/64,
+             2a02:ec80:300:101::/64,
+             2a02:ec80:300:102::/64,
+             2a02:ec80:300:103::/64,
+             2a02:ec80:300:1::/64,
+             2a02:ec80:300:2::/64,
+             2a02:ec80:300:3::/64,
+             2a02:ec80:300:ed1a::/64,
+             2a02:ec80:600:101::/64,
+             2a02:ec80:600:102::/64,
+             2a02:ec80:600:1::/64,
+             2a02:ec80:600:2::/64,
+             2a02:ec80:600:ed1a::/64,
+             2a02:ec80:700:101::/64,
+             2a02:ec80:700:102::/64,
+             2a02:ec80:700:103::/64,
+             2a02:ec80:700:1::/64,
+             2a02:ec80:700:2::/64,
+             2a02:ec80:700:3::/64,
+             2a02:ec80:700:ed1a::/64
+    }
+}

File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-discovery-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]

-    owner  => root
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    group  => root
-    mode   => 0555
-    ensure => present

File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft]

Parameters differences:

--- File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft].orig
+++ File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft.orig
+++ /etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft
@@ -0,0 +1,7 @@
+# Autogenerated by puppet
+set KAFKAMON_HOSTS_ipv6 {
+    type ipv6_addr
+    elements = { 2620:0:861:103:10:64:32:11,
+             2620:0:860:102:10:192:16:139
+    }
+}

Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-mlserve_staging_front_proxy
-
-/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Service[prometheus-node-textfile-check-nft.timer]

Parameters differences:

--- Service[prometheus-node-textfile-check-nft.timer].orig
+++ Service[prometheus-node-textfile-check-nft.timer]

+    enable   => True
+    ensure   => running
+    provider => systemd

File[/var/log/cfssl-ocsprefresh-kafka]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-kafka].orig
+++ File[/var/log/cfssl-ocsprefresh-kafka]

-    owner  => root
-    force  => True
-    backup => False
-    group  => root
-    mode   => 0755
-    ensure => directory

Logrotate::Conf[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-mlserve].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-mlserve]

-    ensure => present

File[/etc/cfssl/signers/wikikube/ca]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube/ca].orig
+++ File[/etc/cfssl/signers/wikikube/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

File[/etc/apache2/conf-available/50-server-status.conf]

Parameters differences:

--- File[/etc/apache2/conf-available/50-server-status.conf].orig
+++ File[/etc/apache2/conf-available/50-server-status.conf]

-    notify => Service[apache2]
-    owner  => root
-    source => puppet:///modules/httpd/status.conf
-    group  => root
-    mode   => 0444
-    ensure => present

Logrotate::Conf[cfssl-gc-expired-certs]

Parameters differences:

--- Logrotate::Conf[cfssl-gc-expired-certs].orig
+++ Logrotate::Conf[cfssl-gc-expired-certs]

-    ensure => present

File[/etc/cfssl/ocsp/dse.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/dse.ocsp].orig
+++ File[/etc/cfssl/ocsp/dse.ocsp]

-    group  => root
-    ensure => file
-    owner  => root

File[/etc/cfssl/signers/wikikube]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube].orig
+++ File[/etc/cfssl/signers/wikikube]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft].orig
+++ File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft.orig
+++ /etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft
@@ -0,0 +1,11 @@
+# Autogenerated by puppet
+set ZOOKEEPER_FLINK_HOSTS_ipv4 {
+    type ipv4_addr
+    elements = { 10.64.16.9,
+             10.64.0.8,
+             10.64.32.41,
+             10.192.16.227,
+             10.192.32.179,
+             10.192.48.219
+    }
+}

Sudo::User[nrpe_certificate_check_network_devices]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_network_devices].orig
+++ Sudo::User[nrpe_certificate_check_network_devices]

-    user       => nrpe_certificate_check_network_devices
-    privileges => []
-    ensure     => absent
-    require    => ['Class[Sudo]']

File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft]

Parameters differences:

--- File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft].orig
+++ File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft]

+    tag    => nft
+    notify => ['Service[nftables]']
+    owner  => root
+    group  => root
+    mode   => 0444
+    ensure => present

Content differences:

--- /etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft.orig
+++ /etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft
@@ -0,0 +1,12 @@
+# Autogenerated by puppet
+set CLOUD_PRIVATE_NETWORKS_ipv4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    elements = { 172.20.1.0/24,
+             172.20.2.0/24,
+             172.20.3.0/24,
+             172.20.4.0/24,
+             172.20.5.0/24
+    }
+}

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]

-    accuracy           => 15sec
-    splay              => 60
-    unit_name          => nrpe2nodexp-check_certificate_expiry_discovery2026.service
-    ensure             => absent
-    fixed_random_delay => True
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]

File[/etc/logrotate.d/wmf_auto_restart_ulogd2]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_ulogd2].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_ulogd2]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_ulogd2.orig
+++ /etc/logrotate.d/wmf_auto_restart_ulogd2
@@ -1,12 +0,0 @@
-# logrotate(8) config for wmf_auto_restart_ulogd2
-
-/var/log/wmf_auto_restart_ulogd2/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]

-    before      => ['Service[cfssl-ocsprefresh-aux_front_proxy.timer]']
-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]

-    group  => root
-    ensure => absent
-    owner  => root

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]

-    tag     => nrpe::check
-    notify  => Service[nagios-nrpe-server]
-    owner   => root
-    ensure  => present
-    group   => root
-    mode    => 0444
-    require => Package[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_aux_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem

Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    ensure => present

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    user                      => root
-    logfile_group             => root
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    success_exit_status       => []
-    command                   => /usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom
-    description               => Systemd timer to gather node metrics for prometheus-check-debmonitor-certificate-expiry
-    syslog_force_stop         => True
-    monitoring_contact_groups => admins
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    logging_enabled           => True
-    syslog_match_startswith   => True
-    logfile_name              => syslog.log
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    environment               => {}
-    private_tmp               => False
-    monitoring_enabled        => False
-    fixed_random_delay        => False
-    ignore_errors             => False
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    logfile_basedir           => /var/log
-    ensure                    => present

File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]

-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-wikikube.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-wikikube
-
-/var/log/cfssl-ocsprefresh-wikikube/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]

-    auto_renew      => True
-    renew_seconds   => 952200
-    profile         => ocsp
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    hosts           => []
-    group           => root
-    mode            => 0740
-    common_name     => pki1001.eqiad.wmnet
-    label           => network_devices
-    names           => []
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    key             => {'algo': 'ecdsa', 'size': 256}
-    outdir          => /etc/cfssl/ssl/ocsp
-    owner           => root
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    notify          => Service[cfssl-ocspserve@network_devices]
-    provide_chain   => False
-    notify_services => []
-    ensure          => present
-    before_services => []

Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

File[/etc/rsyslog.d/40-ulogd.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-ulogd.conf].orig
+++ File[/etc/rsyslog.d/40-ulogd.conf]

-    notify => Service[rsyslog]
-    owner  => root
-    group  => root
-    mode   => 0444
-    ensure => present

Content differences:

--- /etc/rsyslog.d/40-ulogd.conf.orig
+++ /etc/rsyslog.d/40-ulogd.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "ulogd" then {
-    action(
-        type="omfile" file="/var/log/ulogd/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0600"
-    )
-    & stop
-}

Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

-    enable   => True
-    ensure   => running
-    provider => systemd

Class[Puppet::Agent]

Parameters differences:

--- Class[Puppet::Agent].orig
+++ Class[Puppet::Agent]

@@
-    dns_alt_names => ['pki.discovery.wmnet']
+    dns_alt_names => []

File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]

-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root
-    mode      => 0440
-    ensure    => file

Profile::Pki::Multirootca::Monitoring[zuul]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[zuul].orig
+++ Profile::Pki::Multirootca::Monitoring[zuul]

-    ca_file      => /etc/cfssl/signers/zuul/ca/zuul.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => zuul

Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

-    priority => 40
-    mode     => 0444
-    ensure   => present
-    require  => File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]

Profile::Pki::Multirootca::Monitoring[aux_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[aux_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[aux_front_proxy]

-    ca_file      => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    intermediate => aux_front_proxy

Systemd::Service[cfssl-ocspserve@cassandra]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@cassandra].orig
+++ Systemd::Service[cfssl-ocspserve@cassandra]

-    unit_type                => service
-    monitoring_enabled       => False
-    monitoring_critical      => False
-    override                 => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    restart                  => True
-    migration_task           => T407130
-    ensure                   => present

Sudo::User[nrpe-check_check_certificate_expiry_cassandra]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_cassandra].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_cassandra]

-    user       => nagios
-    tag        => nrpe::check
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem']
-    ensure     => present
-    require    => ['Class[Sudo]']

Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    accuracy           => 15sec
-    splay              => 0
-    unit_name          => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
-    ensure             => present
-    fixed_random_delay => False
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]

File[/etc/cfssl/signers/debmonitor/ca]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor/ca].orig
+++ File[/etc/cfssl/signers/debmonitor/ca]

-    owner   => root
-    ensure  => directory
-    group   => root
-    mode    => 0550
-    require => ['Package[golang-cfssl]']

Httpd::Mod_conf[filter]

Parameters differences:

--- Httpd::Mod_conf[filter].orig
+++ Httpd::Mod_conf[filter]

-    mod      => filter
-    loadfile => filter.load
-    ensure   => present

Compilation results for pki1001.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

Resources only in the old catalog

Resources modified

Relevant files